fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts

[brendan-kellam]

Summary

• Bitbucket Server instances with anonymous access enabled (feature.public.access) silently treat expired/invalid OAuth tokens as anonymous rather than returning a 401
• This caused account-driven permission syncing to call /rest/api/1.0/repos?permission=REPO_READ, which is guaranteed to return an empty list for anonymous requests, wiping all AccountToRepoPermission records
• Added isBitbucketServerUserAuthenticated() which calls /rest/api/1.0/profile/recent/repos — an endpoint that always requires authentication even with anonymous access enabled — to detect this condition and abort the sync job before any permissions are touched
• Also added explicit throws for unsupported provider/code host types in both syncers instead of silently returning empty results

Test plan

• Verify that an expired Bitbucket Server OAuth token causes the account permission sync job to fail with a clear error message rather than wiping permissions
• Verify that a valid Bitbucket Server OAuth token allows the sync to proceed as normal
• Confirm on a Bitbucket Server instance with anonymous access enabled that the auth check correctly detects the anonymous fallback

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where Bitbucket Server repository permissions could be silently wiped when OAuth tokens expired on instances with anonymous access enabled.
  • Added explicit authentication checks for Bitbucket Server access to prevent unauthorized fetches.
  • Enhanced error handling to return clear errors for unsupported code hosts instead of silently continuing.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 59ebf316-2cb4-4f1f-abf3-24cd2f38783f

📥 Commits

Reviewing files that changed from the base of the PR and between 3e38735 and f4feeba.

📒 Files selected for processing (1)

• packages/backend/src/bitbucket.ts

---

Walkthrough

Adds an explicit Bitbucket Server authentication check before fetching repositories and changes permission-sync workflows to throw errors for unsupported code host types; also documents a FIXED changelog entry for an OAuth-token expiration bug that could wipe Bitbucket Server repo permissions.

Changes

Cohort / File(s)	Summary
Changelog CHANGELOG.md	Added FIXED entry documenting a bug where expired OAuth tokens could silently remove Bitbucket Server repository permissions when anonymous access was enabled.
Bitbucket Server auth & API packages/backend/src/bitbucket.ts	Added and exported isBitbucketServerUserAuthenticated(client) which queries /rest/api/1.0/profile/recent/repos; getReposForAuthenticatedBitbucketServerUser now checks authentication and throws on unauthenticated responses; updated JSDoc API reference path.
Permission syncer error handling packages/backend/src/ee/accountPermissionSyncer.ts, packages/backend/src/ee/repoPermissionSyncer.ts	Replaced silent no-op/empty-return behavior for unsupported code host types with explicit thrown errors (Unsupported code host type: ...), changing control flow to surface unsupported-provider cases.

Sequence Diagram(s)

sequenceDiagram
participant Syncer as Account/RepoPermissionSyncer
participant Client as BitbucketClient
participant BBServer as Bitbucket Server API
participant DB as Permissions DB
rect rgba(0,128,255,0.5)
Syncer->>Client: isBitbucketServerUserAuthenticated()
end
rect rgba(0,200,83,0.5)
Client->>BBServer: GET /rest/api/1.0/profile/recent/repos
BBServer-->>Client: 200 / 401/403 / other
end
alt 200 OK
Client-->>Syncer: true
Syncer->>Client: getReposForAuthenticatedBitbucketServerUser()
Client->>BBServer: GET /rest/api/1.0/repos/...
BBServer-->>Client: repo list
Client-->>Syncer: repo IDs
Syncer->>DB: update permissions for repos
else 401 or 403
Client-->>Syncer: false
Syncer-->>Syncer: throw authentication error -> abort sync
else other error
Client-->>Syncer: propagate error -> abort sync
end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(worker): guard against anonymous Bitbucket Server token fallback in account permission sync #998 — Implements the same Bitbucket authentication helper and unsupported-host error handling changes in bitbucket.ts and permission syncers.
• perf(bitbucket): increase server page limit to 1000 #981 — Modifies Bitbucket Server repository-fetching logic in the same area of the codebase.
• feat(backend): add Bitbucket Server (Data Center) permission syncing #938 — Updates bitbucket.ts and permission-sync flows related to Bitbucket authentication and syncing behavior.

Suggested reviewers

• msukkari

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding a guard to prevent anonymous token fallback in Bitbucket Server account permission sync, which aligns with the core bug fix across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brendan/fix-bitbucket-server-permission-sync-SOU-635

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/bitbucket.ts`:
- Around line 789-794: The current isBitbucketServerUserAuthenticated conflates
any API error with “not authenticated”; update the implementation so it
distinguishes authentication failures from other errors by inspecting the API
error status (from the result or thrown exception from client.apiClient.GET).
Specifically, call client.apiClient.GET inside a try/catch, treat explicit auth
statuses (401 or 403) as authenticated=false (return false), rethrow or surface
any other errors so callers can handle service-side problems, and return true
only when the call succeeds; refer to isBitbucketServerUserAuthenticated and the
client.apiClient.GET(`/rest/api/1.0/profile/recent/repos`) call to locate where
to apply this change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5906002d-018b-4ac7-8c95-f05b8b375d07

📥 Commits

Reviewing files that changed from the base of the PR and between 93199aa and 3e38735.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/backend/src/bitbucket.ts
• packages/backend/src/ee/accountPermissionSyncer.ts
• packages/backend/src/ee/repoPermissionSyncer.ts