fix(bitbucket): accept provider diff redirect specs

Author: Bill Leoutsakos

apps/sim/tools/bitbucket/pull-requests.test.ts

@@ -713,9 +713,9 @@ describe('Bitbucket pull request diff safety', () => {
 
   it('fetches an already-validated repository diffstat cursor directly', async () => {
     const nextUrl =
-      'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/main..feature?page=2'
+      'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/source-team/source-repo:6315b3bac849%0Decdc2efc4f27?page=2'
     serverMocks.resolveBitbucketPullRequestRedirect.mockResolvedValueOnce(
-      'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/main..feature'
+      'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/source-team/source-repo:6315b3bac849%0Decdc2efc4f27'
     )
     serverMocks.secureBitbucketRead.mockResolvedValueOnce(
       Response.json({ values: [RAW_DIFFSTAT], page: 2 })
@@ -739,14 +739,14 @@ describe('Bitbucket pull request diff safety', () => {
 
   it('rejects a diffstat cursor for a different pull request revspec', async () => {
     serverMocks.resolveBitbucketPullRequestRedirect.mockResolvedValueOnce(
-      'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/main..feature'
+      'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/source-team/source-repo:6315b3bac849%0Decdc2efc4f27'
     )
 
     await expect(
       bitbucketGetPullRequestDiffstatTool.directExecution!({
         ...PULL_REQUEST_PARAMS,
         nextUrl:
-          'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/main..unrelated?page=2',
+          'https://api.bitbucket.org/2.0/repositories/acme%20team/sdk%2Fcore/diffstat/source-team/source-repo:6315b3bac849%0Dunrelated?page=2',
       })
     ).rejects.toThrow(/does not belong to this Bitbucket pull request diffstat/)
     expect(serverMocks.secureBitbucketRead).not.toHaveBeenCalled()

apps/sim/tools/bitbucket/utils.server.test.ts

@@ -161,7 +161,7 @@ describe('resolveBitbucketPullRequestRedirect', () => {
       headers: {
         get: (name: string) =>
           name.toLowerCase() === 'location'
-            ? 'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/main..feature'
+            ? 'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/source-team/source-repo:6315b3bac849%0Decdc2efc4f27?from_pullrequest_id=7&topic=true'
             : null,
       },
       body: { cancel },
@@ -181,7 +181,7 @@ describe('resolveBitbucketPullRequestRedirect', () => {
         { targetQuery: { path: 'src/index.ts', binary: 'false' } }
       )
     ).resolves.toBe(
-      'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/main..feature?path=src%2Findex.ts&binary=false'
+      'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/source-team/source-repo:6315b3bac849%0Decdc2efc4f27?from_pullrequest_id=7&topic=true&path=src%2Findex.ts&binary=false'
     )
     expect(order).toEqual(['cancel', 'close'])
   })

apps/sim/tools/bitbucket/utils.test.ts

@@ -163,6 +163,11 @@ describe('Bitbucket path and pagination safety', () => {
   it('accepts PR redirects only for the requested repository and endpoint kind', () => {
     const diff = 'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/main..feature'
     expect(validateBitbucketPullRequestRedirect(diff, 'acme', 'demo', 'diff')).toBe(diff)
+    const providerQualified =
+      'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/source-team/source-repo:6315b3bac849%0Decdc2efc4f27?from_pullrequest_id=7&topic=true'
+    expect(validateBitbucketPullRequestRedirect(providerQualified, 'acme', 'demo', 'diff')).toBe(
+      providerQualified
+    )
     expect(() =>
       validateBitbucketPullRequestRedirect(
         'https://api.bitbucket.org/2.0/repositories/acme/other/diff/main..feature',
@@ -173,12 +178,12 @@ describe('Bitbucket path and pagination safety', () => {
     ).toThrow(/did not target/)
     expect(() =>
       validateBitbucketPullRequestRedirect(
-        'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/main..feature/extra',
+        'https://api.bitbucket.org/2.0/repositories/acme/demo/diff/main..feature//extra',
         'acme',
         'demo',
         'diff'
       )
-    ).toThrow(/did not target/)
+    ).toThrow(/empty spec path segment/)
     expect(() =>
       validateBitbucketPullRequestRedirect(
         'https://api.bitbucket.org/2.0/repositories/acme/demo/diffstat/main..feature',

apps/sim/tools/bitbucket/utils.ts

@@ -321,18 +321,31 @@ export function validateBitbucketPullRequestRedirect(
   const validated = validateBitbucketOpaqueUrl(value)
   const parsed = new URL(validated)
   const expectedPrefix = `/2.0${bitbucketRepositoryPath(workspaceSlug, repoSlug)}/${kind}/`
-  const encodedRevspec = parsed.pathname.startsWith(expectedPrefix)
+  const encodedSpec = parsed.pathname.startsWith(expectedPrefix)
     ? parsed.pathname.slice(expectedPrefix.length)
     : ''
-  let decodedRevspec = ''
-  try {
-    decodedRevspec = decodeURIComponent(encodedRevspec)
-  } catch {
-    throw new Error(`Bitbucket ${kind} redirect contained invalid path encoding`)
-  }
-  if (!encodedRevspec || encodedRevspec.includes('/') || decodedRevspec.includes('/')) {
+  if (!encodedSpec) {
     throw new Error(`Bitbucket ${kind} redirect did not target this repository's ${kind} endpoint`)
   }
+
+  /**
+   * Bitbucket documents the redirect target as the repository `{kind}/{spec}`
+   * endpoint. In live responses that opaque spec is repository-qualified, for
+   * example `source-workspace/source-repo:sourceHash%0DdestinationHash`, so it
+   * legitimately spans multiple URL path segments. The exact API origin and
+   * destination repository remain bound above; only the trailing spec is
+   * treated as provider-owned opaque path data.
+   */
+  for (const segment of encodedSpec.split('/')) {
+    if (!segment) {
+      throw new Error(`Bitbucket ${kind} redirect contained an empty spec path segment`)
+    }
+    try {
+      decodeURIComponent(segment)
+    } catch {
+      throw new Error(`Bitbucket ${kind} redirect contained invalid path encoding`)
+    }
+  }
   return parsed.toString()
 }