feat(provider-review): add authorized Bitbucket review reads - #5745
feat(provider-review): add authorized Bitbucket review reads#5745iscekic wants to merge 9 commits into
Conversation
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryExplicit Files Reviewed (1 file)
Previous Review Summaries (2 snapshots, latest commit b50cc1d)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit b50cc1d)Status: No Issues Found | Recommendation: Merge Executive SummaryImplied Files Reviewed (2 files)
Previous review (commit 8e50df8)Status: No Issues Found | Recommendation: Merge Executive SummaryReviewed the new Bitbucket authorization and read adapters (4 files); identity pinning, pagination, fork-source reads, and capability mapping look consistent with the intended fail-closed contract. Files Reviewed (4 files)
Reviewed by grok-4.6 · Input: 42.7K · Output: 7.9K · Cached: 373.6K Review guidance: REVIEW.md from base branch |
|
Closing: the owner stopped this workflow section. The branch is retained. |
1 participant
No new behavior — Bitbucket review support is not connected to the app in this change.
Summary
BitbucketReviewAuthorizationaccepts organization-ownedOwnerIntegrationAuthorizationonly, using the existing broker to check the caller, integration, workspace, destination repository, and review.BitbucketUuidSchema,BitbucketRepositoryIdentitySchema,BitbucketProviderRepositorySchema,BitbucketPathSchema, andBitbucketUserSchemavalidate canonical identities and provider data while managed credentials stay on the server.Workspace tokens identify the workspace instead of the Kilo user; changes to the actor, credential kind, or grants require reconnection during a read.
Files
apps/web/src/lib/provider-review/bitbucket-authorization.ts— A (added source), 238 lines (+238/-0). Uses UUID-addressed repository requests and exact organization, integration, workspace, repository-name, review-number, and canonical-link checks. Normalizes provider users, labels workspace principals separately, filters unsafe avatars, and preserves an unknown default branch as null. Rejects control characters, backslashes, empty path segments, and dot segments. Limits paths to 4,096 characters and full repository names to 511. Checks metadata on every response and pins the actor, credential kind, and deduplicated scope set across calls. Reuses the broker's membership, blocked-user, integration, cache-identity, and credential-generation checks.apps/web/src/lib/provider-review/bitbucket-authorization.test.ts— A (added test), 245 lines (+245/-0). Adds the focused authorization suite.Bitbucket adapters translate provider reads into
ReviewInbox,ReviewOverview,ReviewPage,ReviewFile,ReviewFileContext,ReviewThread,ReviewRevision,ReviewCursor, andReviewCapability.Revision checks and bounded pagination preserve complete evidence; existing read-only grants remain usable, while missing write grants produce operation-specific recovery.
These additions remain internal: public routes, provider mutations, and mobile rendering do not change, and the inherited fork-source broker contract remains unchanged.
Files
apps/web/src/lib/provider-review/bitbucket-read.ts— A (added source), 1,169 lines (+1,169/-0). Adds repository-scoped inboxes with actor labels, an open default, and merged, declined, or superseded filters without implying reviewer assignments. Checks canonical destinations and review identities before reads. Binds cursors to the caller, authorization, actor, credential, grants, resource, query, and revision; rejects foreign links, wrong resources, loops, and inconsistent continuations. Limits provider pages to 50 items, collections to 100 pages and 5,000 items, and responses to the shared byte limit. Resolves abbreviated heads through review commits or validated commits in the authorized repository, including closed reviews after source deletion. Rejects ambiguous or mismatched hashes and preserves typed provider failures instead of reporting false emptiness. Rechecks both heads, source identities, and branch names after composite reads; changed snapshots returnconflict. Normalizes descriptions, participants, source and target branches, commit/file counts, and nullable line totals; complete empty collections retain zero counts. Distinguishes absent checks from inaccessible checks, maps provider states, leaves requirement status unknown, and retains only secure detail links. Takes merge-strategy identifiers from destination branch data instead of a fixed GitHub set. Reportspullrequest,pullrequest:write, andrepository:writerequirements withreconnectorreplaceTokenrecovery. Keeps approvals, reversals, change requests, and comment resolution supported when grants permit, without adding write operations. Marks unknown token participants and OAuth merge permission explicitly; records closed-review, author, prior-participation, and draft restrictions. Describes separate review effects and setsexpectedHeadProtectiontonone, rather than claiming atomic revision protection. Carries the shared request-size limit and leaves unknown body limits, squash settings, automatic-merge state, and merge tasks null. Evaluates enforced approvals, requested changes, open tasks, and passing builds; distinguishes advisory rules and unknown group or branching-model evidence. Restricts source deletion for protected branches, forks, absent branches, default or target branches, unknown defaults, and unavailable restrictions. Applies user exceptions to push and merge restrictions where valid; delete restrictions never use user or group exemptions. Accepts branching-model rules without patterns, requires glob patterns, and treats only*as a wildcard, including across branch separators. Marks automatic-merge scheduling, branch synchronization, and reactions unsupported, with provider evidence andopenProviderrecovery. Uses immutable topic diffs, preserves old/new paths, renames and copies, and keeps missing bases or line totals unknown. Validates per-file commit links and both hunk lengths, including context, before returning a complete patch. Returns binary, truncated, or unavailable content with metadata and provider links; confirmed empty patches remain available. Validates diff membership and the selected base before context reads, using immutable commits and the inherited fork-source selector through destination authorization. Checks metadata, paths, commit prefixes, byte sizes, and binary content; limits context to 500 lines and does not expand links or subrepositories. Collects complete comment sets before grouping replies and returning 25-thread pages; rejects duplicate, foreign, cyclic, or orphan comments. Preserves thread subjects and resolution, clears deleted authors and bodies, restricts deleted-root resolution, and leaves unprovable positions, diff hunks, and outdatedness null.apps/web/src/lib/provider-review/bitbucket-read.test.ts— A (added test), 1,506 lines (+1,506/-0). Adds provider fixtures and regression coverage for closed-review revisions, patch completeness, and source deletion protection.Tests: 2 files added —
bitbucket-authorization.test.tsandbitbucket-read.test.ts; 1,751 added lines and no removed lines.Generated: 0 files changed.
Visual Changes
Visual Changes: N/A
Verification
Reviewer Notes
Human steps
Automated evidence
Scope and inventory
Kilo-Org/cloud./Users/igor/Projects/.worktrees/mobile-provider-parity-1d93; branch:mobile-provider-parity-1d93.mobile-provider-parity-1d93-s9...mobile-provider-parity-1d93-s10.Notes
E2E: bot-e2e — cumulative runtime verification is pending until the remaining section levels land.
Stacked PRs — merge bottom to top. Each level shows only its own diff.
Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.
mobile-provider-parity-1d93-s1— feat(provider-review): add shared identity and stack checks #5663mobile-provider-parity-1d93-s2— feat(provider-review): define review contracts and vocabulary #5665mobile-provider-parity-1d93-s3— feat(provider-review): add safe provider SDK boundaries #5689mobile-provider-parity-1d93-s4— feat(git-token): authorize exact provider review resources #5692mobile-provider-parity-1d93-s5— feat(cloud-agent): preserve provider identity through checkout #5700mobile-provider-parity-1d93-s6— feat(provider-review): expose exact repositories and branches #5705mobile-provider-parity-1d93-s7— feat(mobile): preserve provider launch and recent identity #5711mobile-provider-parity-1d93-s8— feat(mobile): select exact provider repositories and branches #5729mobile-provider-parity-1d93-s9— feat(provider-review): add authorized GitLab review reads #5738mobile-provider-parity-1d93-s10— feat(provider-review): add authorized Bitbucket review reads #5745 ← this PRmobile-provider-parity-1d93-s11— feat(provider-review): add reconciled GitLab review actions #5748mobile-provider-parity-1d93-s12— feat(provider-review): add Bitbucket review actions and recovery #5756mobile-provider-parity-1d93-s13— feat(provider-review): expose the neutral review facade #5763 (tip)