Commit ec1313c8f8333292506f05a355bb72d308a455d8 | the-knife

author	Sebastian Pugliese <73218979+RealDoc06@users.noreply.github.com> 2026-10-15 03:15:53+02:00
committer	GitHub <noreply@github.com> 2026-10-14 18:15:53-07:00
log	ec1313c8f8333292506f05a355bb72d308a455d8
tree	a28518d652a039da21c461a27d8bca695986d8db
parent	ab3a3cd162d90fd9f01ac62efdb9d4ad55c33639
signature	Signed by PGP key B5690EEEBB952194

fix(server): use workspace-scoped Bitbucket permissions API (#10984)

Co-authored-by: RealDoc06 <73218979+RealDoc06@users.noreply.github.com>
Co-authored-by: Theo Browne <me@t3.gg>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 62 insertions(+), 52 deletions(-)

packages
- source-control-bitbucket
  - src
    server
    BitbucketPullRequestApi.test.ts
    BitbucketPullRequestApi.ts
    bitbucketPullRequestJson.ts

packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.test.ts+37-26

 @@ -998,11 +998,29 @@ layer("BitbucketPullRequestApi.layer", (it) => {
       assert.isFalse(yield* api.getRepositoryPermission({ repository: "acme/web" }));
-      expect(callAt(0).url).toContain("/user/permissions/repositories");
+      expect(new URL(callAt(0).url, "https://api.bitbucket.org").pathname).toBe(
+        "/user/workspaces/acme/permissions/repositories",
+      );
       assert.strictEqual(filterOfCall(0), 'repository.full_name="acme/web"');
     }),
   );
+  it.effect("matches repository permissions after normalizing whitespace around segments", () =>
+    Effect.gen(function* () {
+      mockedRequest.mockImplementation((input) => {
+        const url = new URL(input.url, "https://api.bitbucket.org");
+        const matches =
+          url.pathname === "/user/workspaces/acme/permissions/repositories" &&
+          url.searchParams.get("q") === 'repository.full_name="acme/web"';
+        return Effect.succeed(response(valuePage(matches ? [{ permission: "read" }] : [])));
+      });
+      const api = yield* BitbucketPullRequestApi.BitbucketPullRequestApi;
+      // An unmatched, empty permission page is treated as unknown and would allow this attempt.
+      assert.isFalse(yield* api.getRepositoryPermission({ repository: " acme / web " }));
+    }),
+  );
   it.effect("escapes a repository name before it goes inside a filter literal", () =>
     Effect.gen(function* () {
       mockedRequest.mockReturnValue(Effect.succeed(response(JSON.stringify({ values: [] }))));
 @@ -1015,43 +1033,36 @@ layer("BitbucketPullRequestApi.layer", (it) => {
     }),
   );
-  it.effect(
+  const permissionFailure = (status: number) =>
-    "reads a removed permissions endpoint as granted rather than failing the merge on it",
+    Effect.fail(
-    () =>
+      new BitbucketApi.BitbucketResponseError({
+        operation: "request",
+        status,
+        responseBodyLength: 0,
+      }),
+    );
+  it.effect.each([403, 404, 410])(
+    "reads HTTP %s from the permissions endpoint as an unknown permission",
+    (status) =>
       Effect.gen(function* () {
-        // Bitbucket retired /user/permissions/repositories under CHANGE-2770: every account now
+        mockedRequest.mockReturnValue(permissionFailure(status));
-        // gets HTTP 410 here, whatever it may do.
-        mockedRequest.mockReturnValue(
-          Effect.fail(
-            new BitbucketApi.BitbucketResponseError({
-              operation: "request",
-              status: 410,
-              responseBodyLength: 0,
-            }),
-          ),
-        );
         const api = yield* BitbucketPullRequestApi.BitbucketPullRequestApi;
         assert.isTrue(yield* api.getRepositoryPermission({ repository: "acme/web" }));
       }),
   );
-  it.effect("still fails the permission read on a failure that is not the removed endpoint", () =>
+  it.effect.each([401, 500])("still fails the permission read on HTTP %s", (status) =>
     Effect.gen(function* () {
-      mockedRequest.mockReturnValue(
+      mockedRequest.mockReturnValue(permissionFailure(status));
-        Effect.fail(
-          new BitbucketApi.BitbucketResponseError({
-            operation: "request",
-            status: 401,
-            responseBodyLength: 0,
-          }),
-        ),
-      );
       const api = yield* BitbucketPullRequestApi.BitbucketPullRequestApi;
       const error = yield* Effect.flip(api.getRepositoryPermission({ repository: "acme/web" }));
       assert.strictEqual(error._tag, "BitbucketResponseError");
+      if (error._tag === "BitbucketResponseError") {
+        assert.strictEqual(error.status, status);
+      }
     }),
   );

packages/source-control-bitbucket/src/server/BitbucketPullRequestApi.ts+23-23

 @@ -112,14 +112,14 @@ export type BitbucketPullRequestApiError =
   | BitbucketRepositoryUnsupportedError
   | BitbucketDiffCommitError;
-/**
+/** The permissions endpoint refusing or missing for these credentials, rather than answering. */
- * `/user/permissions/repositories` answering CHANGE-2770's removal notice rather than a
+function isRepositoryPermissionUnavailableError(
- * permission — Bitbucket sends this for every account now, not only ones it would have refused.
- */
-function isRepositoryPermissionRemovedError(
   error: BitbucketPullRequestApiError,
 ): error is BitbucketApi.BitbucketResponseError {
-  return error._tag === "BitbucketResponseError" && error.status === 410;
+  return (
+    error._tag === "BitbucketResponseError" &&
+    (error.status === 403 || error.status === 404 || error.status === 410)
+  );
 }
 /**
 @@ -412,16 +412,19 @@ export const make = Effect.gen(function* () {
   const bitbucket = yield* BitbucketApi.BitbucketApi;
   /**
-   * The repository's own path, and the workspace above it — which the people who may review are
+   * The repository's API path and normalized segments, used for workspace reads and filters.
-   * kept on rather than on the repository, so both are handed over at once.
    */
   const withRepository = <A>(
     repository: string,
-    use: (path: string, workspace: string) => Effect.Effect<A, BitbucketPullRequestApiError>,
+    use: (
+      path: string,
+      workspace: string,
+      slug: string,
+    ) => Effect.Effect<A, BitbucketPullRequestApiError>,
   ): Effect.Effect<A, BitbucketPullRequestApiError> => {
     const segments = repositorySegments(repository);
     return Result.isSuccess(segments)
-      ? use(repositoryPathOf(segments.success), segments.success.workspace)
+      ? use(repositoryPathOf(segments.success), segments.success.workspace, segments.success.slug)
       : Effect.fail(segments.failure);
   };
 @@ -656,26 +659,23 @@ export const make = Effect.gen(function* () {
         }),
       ),
-    // Nothing on the repository, the pull request or the workspace states what the credentials
+    // Ask for the caller's effective permission within this workspace. The full name identifies
-    // may do, so this endpoint is the one request Bitbucket makes unavoidable. It is asked
+    // the repository by its slug, even when its display name differs.
-    // alongside the reads the detail was already making, so it costs no round trip of its own.
     //
-    // Bitbucket permanently removed this endpoint (CHANGE-2770): every account now gets HTTP 410
+    // Bitbucket has retired permission endpoints before (CHANGE-2770), and some credentials may
-    // in place of an answer, whatever it may do. That is the deprecated-endpoint signal, not a
+    // not reach `/user` endpoints at all. A 403, 404 or 410 here is read as a permission that
-    // permission being refused, so it is read the same way an unreachable read already is
+    // could not be learned, the same as an empty page: it grants, and the write itself says why
-    // elsewhere — as a permission that could not be learned, which grants rather than blocks, and
+    // if the account may not do it. Other failures (a bad token, a network fault) still fail.
-    // leaves the actual merge or write to say why if the account may not do it. Any other failure
-    // (a bad token, a network fault, an unreadable body) still fails as it did before.
     getRepositoryPermission: (input) =>
-      withRepository(input.repository, () =>
+      withRepository(input.repository, (_path, workspace, slug) =>
         readPage({
           operation: "getRepositoryPermission",
-          url: `/user/permissions/repositories?q=${encodeURIComponent(
+          url: `/user/workspaces/${encodeURIComponent(workspace)}/permissions/repositories?q=${encodeURIComponent(
-            `repository.full_name="${filterLiteral(input.repository.trim())}"`,
+            `repository.full_name="${filterLiteral(`${workspace}/${slug}`)}"`,
           )}`,
           decode: decodeRepositoryPermissionJson,
         }),
-      ).pipe(Effect.catchIf(isRepositoryPermissionRemovedError, () => Effect.succeed(true))),
+      ).pipe(Effect.catchIf(isRepositoryPermissionUnavailableError, () => Effect.succeed(true))),
     getPullRequestDiff: pullRequestDiff,

packages/source-control-bitbucket/src/server/bitbucketPullRequestJson.ts+2-3

 @@ -163,9 +163,8 @@ const RawViewerSchema = Schema.Struct({
 });
 /**
- * `/user/permissions/repositories` filtered to one repository, which is the only place Bitbucket
+ * The caller's workspace-scoped repository permissions, filtered to one repository.
- * states what the credentials may do with it: nothing on the repository, the pull request or the
+ * One row, or none where Bitbucket names no permission for this account.
- * workspace carries it. One row, or none where Bitbucket names no permission for this account.
  */
 const RawRepositoryPermissionsSchema = Schema.Struct({
   values: Schema.optional(