@backstage/integration 2.0.0-next.1 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @backstage/integration
 
+## 2.0.0
+
+### Major Changes
+
+- 527cf88: **BREAKING** Removed deprecated Azure DevOps, Bitbucket, Gerrit and GitHub code:
+
+  - For Azure DevOps, the long deprecated `token` string and `credential` object have been removed from the `config.d.ts`. Use the `credentials` array object instead.
+  - For Bitbucket, the long deprecated `bitbucket` object has been removed from the `config.d.ts`. Use the `bitbucketCloud` or `bitbucketServer` objects instead.
+  - For Gerrit, the `parseGerritGitilesUrl` function has been removed, use `parseGitilesUrlRef` instead. The `buildGerritGitilesArchiveUrl` function has also been removed, use `buildGerritGitilesArchiveUrlFromLocation` instead.
+  - For GitHub, the `getGitHubRequestOptions` function has been removed.
+
+### Minor Changes
+
+- d933f62: Add configurable throttling and retry mechanism for GitLab integration.
+
+### Patch Changes
+
+- 1513a0b: Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.
+- 993a598: Fixed Azure integration config schema visibility annotations to use per-field `@visibility secret` instead of `@deepVisibility secret` on parent objects, so that non-secret fields like `clientId`, `tenantId`, `organizations`, and `managedIdentityClientId` are no longer incorrectly marked as secret.
+
+## 2.0.0-next.2
+
+### Patch Changes
+
+- 1513a0b: Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.
+
 ## 2.0.0-next.1
 
 ### Major Changes

package/dist/bitbucketCloud/core.cjs.js

@@ -2,6 +2,7 @@
 
 var fetch = require('cross-fetch');
 var parseGitUrl = require('git-url-parse');
+var helpers = require('../helpers.cjs.js');
 var luxon = require('luxon');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
@@ -88,7 +89,7 @@ async function getBitbucketCloudDownloadUrl(url, config) {
     ref,
     protocol,
     resource
-  } = parseGitUrl__default.default(url);
+  } = helpers.parseGitUrlSafe(url);
   let branch = ref;
   if (!branch) {
     branch = await getBitbucketCloudDefaultBranch(url, config);
@@ -97,7 +98,7 @@ async function getBitbucketCloudDownloadUrl(url, config) {
 }
 function getBitbucketCloudFileFetchUrl(url, config) {
   try {
-    const { owner, name, ref, filepathtype, filepath } = parseGitUrl__default.default(url);
+    const { owner, name, ref, filepathtype, filepath } = helpers.parseGitUrlSafe(url);
     if (!owner || !name || filepathtype !== "src" && filepathtype !== "raw") {
       throw new Error("Invalid Bitbucket Cloud URL or file path");
     }

package/dist/bitbucketCloud/core.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.cjs.js","sources":["../../src/bitbucketCloud/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { BitbucketCloudIntegrationConfig } from './config';\nimport { DateTime } from 'luxon';\n\ntype OAuthTokenData = {\n  token: string;\n  expiresAt: DateTime;\n};\n\n// In-memory token cache (single entry since there's only one Bitbucket Cloud integration)\nlet cachedToken: OAuthTokenData | undefined;\n\n// Track in-flight token refresh request to prevent concurrent fetches\nlet refreshPromise: Promise<string> | undefined;\n\n/**\n * Fetches an OAuth access token from Bitbucket Cloud using client credentials flow.\n * Tokens are cached with a 10-minute grace period to account for clock skew.\n * Implements concurrent refresh protection to prevent multiple simultaneous token requests.\n *\n * @param clientId - OAuth client ID\n * @param clientSecret - OAuth client secret\n * @public\n */\nexport async function getBitbucketCloudOAuthToken(\n  clientId: string,\n  clientSecret: string,\n): Promise<string> {\n  // Check cache\n  if (cachedToken && DateTime.now() < cachedToken.expiresAt) {\n    return cachedToken.token;\n  }\n\n  // Check if there's already a refresh in progress\n  if (refreshPromise) {\n    return refreshPromise;\n  }\n\n  // Start a new token fetch and track it\n  refreshPromise = (async () => {\n    try {\n      // Fetch new token\n      const credentials = Buffer.from(\n        `${clientId}:${clientSecret}`,\n        'utf8',\n      ).toString('base64');\n\n      const response = await fetch(\n        'https://bitbucket.org/site/oauth2/access_token',\n        {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            Authorization: `Basic ${credentials}`,\n          },\n          body: 'grant_type=client_credentials',\n        },\n      );\n\n      if (!response.ok) {\n        throw new Error(\n          `Failed to fetch OAuth token from Bitbucket Cloud: ${response.status} ${response.statusText}`,\n        );\n      }\n\n      const data = await response.json();\n\n      if (!data.access_token) {\n        throw new Error('OAuth token response missing access_token field');\n      }\n\n      // Calculate expiration with 10-minute grace period\n      const expiresIn = data.expires_in || 3600; // Default to 1 hour\n      const expiresAt = DateTime.now()\n        .plus({ seconds: expiresIn })\n        .minus({ minutes: 10 });\n\n      // Cache the token\n      cachedToken = {\n        token: data.access_token,\n        expiresAt,\n      };\n\n      return data.access_token;\n    } catch (error) {\n      throw new Error(\n        `Failed to fetch OAuth token for Bitbucket Cloud: ${error}`,\n      );\n    } finally {\n      // Clean up the in-flight promise tracking\n      refreshPromise = undefined;\n    }\n  })();\n\n  return refreshPromise;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDefaultBranch(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  const branchUrl = `${config.apiBaseUrl}/repositories/${project}/${repoName}`;\n  const response = await fetch(\n    branchUrl,\n    await getBitbucketCloudRequestOptions(config),\n  );\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const repoInfo = await response.json();\n  const defaultBranch = repoInfo.mainbranch.name;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDownloadUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const {\n    name: repoName,\n    owner: project,\n    ref,\n    protocol,\n    resource,\n  } = parseGitUrl(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketCloudDefaultBranch(url, config);\n  }\n  return `${protocol}://${resource}/${project}/${repoName}/get/${branch}.tar.gz`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.org/orgname/reponame/src/master/file.yaml\n * to:   https://api.bitbucket.org/2.0/repositories/orgname/reponame/src/master/file.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketCloudFileFetchUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);\n    if (!owner || !name || (filepathtype !== 'src' && filepathtype !== 'raw')) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n\n    if (!ref) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n    return `${config.apiBaseUrl}/repositories/${owner}/${name}/src/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n * Returns headers for authenticating with Bitbucket Cloud.\n * Supports OAuth (clientId/clientSecret), username/token, and username/appPassword auth.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudRequestOptions(\n  config: BitbucketCloudIntegrationConfig,\n): Promise<{\n  headers: Record<string, string>;\n}> {\n  const headers: Record<string, string> = {};\n\n  // OAuth authentication (clientId/clientSecret)\n  if (config.clientId && config.clientSecret) {\n    const token = await getBitbucketCloudOAuthToken(\n      config.clientId,\n      config.clientSecret,\n    );\n    headers.Authorization = `Bearer ${token}`;\n    return { headers };\n  }\n\n  // Basic authentication (username + token/appPassword)\n  // TODO: appPassword can be removed once fully\n  // deprecated by BitBucket on 9th June 2026.\n  if (config.username && (config.token ?? config.appPassword)) {\n    const buffer = Buffer.from(\n      `${config.username}:${config.token ?? config.appPassword}`,\n      'utf8',\n    );\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return { headers };\n}\n"],"names":["DateTime","fetch","parseGitUrl"],"mappings":";;;;;;;;;;;AA2BA,IAAI,WAAA;AAGJ,IAAI,cAAA;AAWJ,eAAsB,2BAAA,CACpB,UACA,YAAA,EACiB;AAEjB,EAAA,IAAI,WAAA,IAAeA,cAAA,CAAS,GAAA,EAAI,GAAI,YAAY,SAAA,EAAW;AACzD,IAAA,OAAO,WAAA,CAAY,KAAA;AAAA,EACrB;AAGA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA;AAAA,EACT;AAGA,EAAA,cAAA,GAAA,CAAkB,YAAY;AAC5B,IAAA,IAAI;AAEF,MAAA,MAAM,cAAc,MAAA,CAAO,IAAA;AAAA,QACzB,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AAAA,QAC3B;AAAA,OACF,CAAE,SAAS,QAAQ,CAAA;AAEnB,MAAA,MAAM,WAAW,MAAMC,sBAAA;AAAA,QACrB,gDAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,cAAA,EAAgB,mCAAA;AAAA,YAChB,aAAA,EAAe,SAAS,WAAW,CAAA;AAAA,WACrC;AAAA,UACA,IAAA,EAAM;AAAA;AACR,OACF;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,kDAAA,EAAqD,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA;AAAA,SAC7F;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AAGA,MAAA,MAAM,SAAA,GAAY,KAAK,UAAA,IAAc,IAAA;AACrC,MAAA,MAAM,SAAA,GAAYD,cAAA,CAAS,GAAA,EAAI,CAC5B,KAAK,EAAE,OAAA,EAAS,SAAA,EAAW,CAAA,CAC3B,KAAA,CAAM,EAAE,OAAA,EAAS,IAAI,CAAA;AAGxB,MAAA,WAAA,GAAc;AAAA,QACZ,OAAO,IAAA,CAAK,YAAA;AAAA,QACZ;AAAA,OACF;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oDAAoD,KAAK,CAAA;AAAA,OAC3D;AAAA,IACF,CAAA,SAAE;AAEA,MAAA,cAAA,GAAiB,MAAA;AAAA,IACnB;AAAA,EACF,CAAA,GAAG;AAEH,EAAA,OAAO,cAAA;AACT;AASA,eAAsB,8BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAIE,6BAAY,GAAG,CAAA;AAE1D,EAAA,MAAM,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,OAAO,IAAI,QAAQ,CAAA,CAAA;AAC1E,EAAA,MAAM,WAAW,MAAMD,sBAAA;AAAA,IACrB,SAAA;AAAA,IACA,MAAM,gCAAgC,MAAM;AAAA,GAC9C;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AACrC,EAAA,MAAM,aAAA,GAAgB,SAAS,UAAA,CAAW,IAAA;AAC1C,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,4BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF,GAAIC,6BAAY,GAAG,CAAA;AAEnB,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,8BAAA,CAA+B,GAAA,EAAK,MAAM,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,QAAQ,IAAI,OAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,KAAA,EAAQ,MAAM,CAAA,OAAA,CAAA;AACvE;AAgBO,SAAS,6BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAIA,6BAAY,GAAG,CAAA;AACpE,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAS,YAAA,KAAiB,KAAA,IAAS,iBAAiB,KAAA,EAAQ;AACzE,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEnD,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,KAAK,IAAI,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EAC1F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAUA,eAAsB,gCACpB,MAAA,EAGC;AACD,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,YAAA,EAAc;AAC1C,IAAA,MAAM,QAAQ,MAAM,2BAAA;AAAA,MAClB,MAAA,CAAO,QAAA;AAAA,MACP,MAAA,CAAO;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,UAAU,KAAK,CAAA,CAAA;AACvC,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB;AAKA,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,KAAA,IAAS,OAAO,WAAA,CAAA,EAAc;AAC3D,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AAAA,MACpB,GAAG,MAAA,CAAO,QAAQ,IAAI,MAAA,CAAO,KAAA,IAAS,OAAO,WAAW,CAAA,CAAA;AAAA,MACxD;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB;;;;;;;;"}
+{"version":3,"file":"core.cjs.js","sources":["../../src/bitbucketCloud/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { parseGitUrlSafe } from '../helpers';\nimport { BitbucketCloudIntegrationConfig } from './config';\nimport { DateTime } from 'luxon';\n\ntype OAuthTokenData = {\n  token: string;\n  expiresAt: DateTime;\n};\n\n// In-memory token cache (single entry since there's only one Bitbucket Cloud integration)\nlet cachedToken: OAuthTokenData | undefined;\n\n// Track in-flight token refresh request to prevent concurrent fetches\nlet refreshPromise: Promise<string> | undefined;\n\n/**\n * Fetches an OAuth access token from Bitbucket Cloud using client credentials flow.\n * Tokens are cached with a 10-minute grace period to account for clock skew.\n * Implements concurrent refresh protection to prevent multiple simultaneous token requests.\n *\n * @param clientId - OAuth client ID\n * @param clientSecret - OAuth client secret\n * @public\n */\nexport async function getBitbucketCloudOAuthToken(\n  clientId: string,\n  clientSecret: string,\n): Promise<string> {\n  // Check cache\n  if (cachedToken && DateTime.now() < cachedToken.expiresAt) {\n    return cachedToken.token;\n  }\n\n  // Check if there's already a refresh in progress\n  if (refreshPromise) {\n    return refreshPromise;\n  }\n\n  // Start a new token fetch and track it\n  refreshPromise = (async () => {\n    try {\n      // Fetch new token\n      const credentials = Buffer.from(\n        `${clientId}:${clientSecret}`,\n        'utf8',\n      ).toString('base64');\n\n      const response = await fetch(\n        'https://bitbucket.org/site/oauth2/access_token',\n        {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            Authorization: `Basic ${credentials}`,\n          },\n          body: 'grant_type=client_credentials',\n        },\n      );\n\n      if (!response.ok) {\n        throw new Error(\n          `Failed to fetch OAuth token from Bitbucket Cloud: ${response.status} ${response.statusText}`,\n        );\n      }\n\n      const data = await response.json();\n\n      if (!data.access_token) {\n        throw new Error('OAuth token response missing access_token field');\n      }\n\n      // Calculate expiration with 10-minute grace period\n      const expiresIn = data.expires_in || 3600; // Default to 1 hour\n      const expiresAt = DateTime.now()\n        .plus({ seconds: expiresIn })\n        .minus({ minutes: 10 });\n\n      // Cache the token\n      cachedToken = {\n        token: data.access_token,\n        expiresAt,\n      };\n\n      return data.access_token;\n    } catch (error) {\n      throw new Error(\n        `Failed to fetch OAuth token for Bitbucket Cloud: ${error}`,\n      );\n    } finally {\n      // Clean up the in-flight promise tracking\n      refreshPromise = undefined;\n    }\n  })();\n\n  return refreshPromise;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDefaultBranch(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  const branchUrl = `${config.apiBaseUrl}/repositories/${project}/${repoName}`;\n  const response = await fetch(\n    branchUrl,\n    await getBitbucketCloudRequestOptions(config),\n  );\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const repoInfo = await response.json();\n  const defaultBranch = repoInfo.mainbranch.name;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDownloadUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const {\n    name: repoName,\n    owner: project,\n    ref,\n    protocol,\n    resource,\n  } = parseGitUrlSafe(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketCloudDefaultBranch(url, config);\n  }\n  return `${protocol}://${resource}/${project}/${repoName}/get/${branch}.tar.gz`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.org/orgname/reponame/src/master/file.yaml\n * to:   https://api.bitbucket.org/2.0/repositories/orgname/reponame/src/master/file.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketCloudFileFetchUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);\n    if (!owner || !name || (filepathtype !== 'src' && filepathtype !== 'raw')) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n\n    if (!ref) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n    return `${config.apiBaseUrl}/repositories/${owner}/${name}/src/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n * Returns headers for authenticating with Bitbucket Cloud.\n * Supports OAuth (clientId/clientSecret), username/token, and username/appPassword auth.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudRequestOptions(\n  config: BitbucketCloudIntegrationConfig,\n): Promise<{\n  headers: Record<string, string>;\n}> {\n  const headers: Record<string, string> = {};\n\n  // OAuth authentication (clientId/clientSecret)\n  if (config.clientId && config.clientSecret) {\n    const token = await getBitbucketCloudOAuthToken(\n      config.clientId,\n      config.clientSecret,\n    );\n    headers.Authorization = `Bearer ${token}`;\n    return { headers };\n  }\n\n  // Basic authentication (username + token/appPassword)\n  // TODO: appPassword can be removed once fully\n  // deprecated by BitBucket on 9th June 2026.\n  if (config.username && (config.token ?? config.appPassword)) {\n    const buffer = Buffer.from(\n      `${config.username}:${config.token ?? config.appPassword}`,\n      'utf8',\n    );\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return { headers };\n}\n"],"names":["DateTime","fetch","parseGitUrl","parseGitUrlSafe"],"mappings":";;;;;;;;;;;;AA4BA,IAAI,WAAA;AAGJ,IAAI,cAAA;AAWJ,eAAsB,2BAAA,CACpB,UACA,YAAA,EACiB;AAEjB,EAAA,IAAI,WAAA,IAAeA,cAAA,CAAS,GAAA,EAAI,GAAI,YAAY,SAAA,EAAW;AACzD,IAAA,OAAO,WAAA,CAAY,KAAA;AAAA,EACrB;AAGA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA;AAAA,EACT;AAGA,EAAA,cAAA,GAAA,CAAkB,YAAY;AAC5B,IAAA,IAAI;AAEF,MAAA,MAAM,cAAc,MAAA,CAAO,IAAA;AAAA,QACzB,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AAAA,QAC3B;AAAA,OACF,CAAE,SAAS,QAAQ,CAAA;AAEnB,MAAA,MAAM,WAAW,MAAMC,sBAAA;AAAA,QACrB,gDAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,cAAA,EAAgB,mCAAA;AAAA,YAChB,aAAA,EAAe,SAAS,WAAW,CAAA;AAAA,WACrC;AAAA,UACA,IAAA,EAAM;AAAA;AACR,OACF;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,kDAAA,EAAqD,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA;AAAA,SAC7F;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AAGA,MAAA,MAAM,SAAA,GAAY,KAAK,UAAA,IAAc,IAAA;AACrC,MAAA,MAAM,SAAA,GAAYD,cAAA,CAAS,GAAA,EAAI,CAC5B,KAAK,EAAE,OAAA,EAAS,SAAA,EAAW,CAAA,CAC3B,KAAA,CAAM,EAAE,OAAA,EAAS,IAAI,CAAA;AAGxB,MAAA,WAAA,GAAc;AAAA,QACZ,OAAO,IAAA,CAAK,YAAA;AAAA,QACZ;AAAA,OACF;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oDAAoD,KAAK,CAAA;AAAA,OAC3D;AAAA,IACF,CAAA,SAAE;AAEA,MAAA,cAAA,GAAiB,MAAA;AAAA,IACnB;AAAA,EACF,CAAA,GAAG;AAEH,EAAA,OAAO,cAAA;AACT;AASA,eAAsB,8BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAIE,6BAAY,GAAG,CAAA;AAE1D,EAAA,MAAM,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,OAAO,IAAI,QAAQ,CAAA,CAAA;AAC1E,EAAA,MAAM,WAAW,MAAMD,sBAAA;AAAA,IACrB,SAAA;AAAA,IACA,MAAM,gCAAgC,MAAM;AAAA,GAC9C;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AACrC,EAAA,MAAM,aAAA,GAAgB,SAAS,UAAA,CAAW,IAAA;AAC1C,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,4BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF,GAAIE,wBAAgB,GAAG,CAAA;AAEvB,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,8BAAA,CAA+B,GAAA,EAAK,MAAM,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,QAAQ,IAAI,OAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,KAAA,EAAQ,MAAM,CAAA,OAAA,CAAA;AACvE;AAgBO,SAAS,6BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAIA,wBAAgB,GAAG,CAAA;AACxE,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAS,YAAA,KAAiB,KAAA,IAAS,iBAAiB,KAAA,EAAQ;AACzE,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEnD,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,KAAK,IAAI,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EAC1F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAUA,eAAsB,gCACpB,MAAA,EAGC;AACD,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,YAAA,EAAc;AAC1C,IAAA,MAAM,QAAQ,MAAM,2BAAA;AAAA,MAClB,MAAA,CAAO,QAAA;AAAA,MACP,MAAA,CAAO;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,UAAU,KAAK,CAAA,CAAA;AACvC,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB;AAKA,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,KAAA,IAAS,OAAO,WAAA,CAAA,EAAc;AAC3D,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AAAA,MACpB,GAAG,MAAA,CAAO,QAAQ,IAAI,MAAA,CAAO,KAAA,IAAS,OAAO,WAAW,CAAA,CAAA;AAAA,MACxD;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB;;;;;;;;"}

package/dist/bitbucketCloud/core.esm.js

@@ -1,5 +1,6 @@
 import fetch from 'cross-fetch';
 import parseGitUrl from 'git-url-parse';
+import { parseGitUrlSafe } from '../helpers.esm.js';
 import { DateTime } from 'luxon';
 
 let cachedToken;
@@ -81,7 +82,7 @@ async function getBitbucketCloudDownloadUrl(url, config) {
     ref,
     protocol,
     resource
-  } = parseGitUrl(url);
+  } = parseGitUrlSafe(url);
   let branch = ref;
   if (!branch) {
     branch = await getBitbucketCloudDefaultBranch(url, config);
@@ -90,7 +91,7 @@ async function getBitbucketCloudDownloadUrl(url, config) {
 }
 function getBitbucketCloudFileFetchUrl(url, config) {
   try {
-    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);
+    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);
     if (!owner || !name || filepathtype !== "src" && filepathtype !== "raw") {
       throw new Error("Invalid Bitbucket Cloud URL or file path");
     }

package/dist/bitbucketCloud/core.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.esm.js","sources":["../../src/bitbucketCloud/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { BitbucketCloudIntegrationConfig } from './config';\nimport { DateTime } from 'luxon';\n\ntype OAuthTokenData = {\n  token: string;\n  expiresAt: DateTime;\n};\n\n// In-memory token cache (single entry since there's only one Bitbucket Cloud integration)\nlet cachedToken: OAuthTokenData | undefined;\n\n// Track in-flight token refresh request to prevent concurrent fetches\nlet refreshPromise: Promise<string> | undefined;\n\n/**\n * Fetches an OAuth access token from Bitbucket Cloud using client credentials flow.\n * Tokens are cached with a 10-minute grace period to account for clock skew.\n * Implements concurrent refresh protection to prevent multiple simultaneous token requests.\n *\n * @param clientId - OAuth client ID\n * @param clientSecret - OAuth client secret\n * @public\n */\nexport async function getBitbucketCloudOAuthToken(\n  clientId: string,\n  clientSecret: string,\n): Promise<string> {\n  // Check cache\n  if (cachedToken && DateTime.now() < cachedToken.expiresAt) {\n    return cachedToken.token;\n  }\n\n  // Check if there's already a refresh in progress\n  if (refreshPromise) {\n    return refreshPromise;\n  }\n\n  // Start a new token fetch and track it\n  refreshPromise = (async () => {\n    try {\n      // Fetch new token\n      const credentials = Buffer.from(\n        `${clientId}:${clientSecret}`,\n        'utf8',\n      ).toString('base64');\n\n      const response = await fetch(\n        'https://bitbucket.org/site/oauth2/access_token',\n        {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            Authorization: `Basic ${credentials}`,\n          },\n          body: 'grant_type=client_credentials',\n        },\n      );\n\n      if (!response.ok) {\n        throw new Error(\n          `Failed to fetch OAuth token from Bitbucket Cloud: ${response.status} ${response.statusText}`,\n        );\n      }\n\n      const data = await response.json();\n\n      if (!data.access_token) {\n        throw new Error('OAuth token response missing access_token field');\n      }\n\n      // Calculate expiration with 10-minute grace period\n      const expiresIn = data.expires_in || 3600; // Default to 1 hour\n      const expiresAt = DateTime.now()\n        .plus({ seconds: expiresIn })\n        .minus({ minutes: 10 });\n\n      // Cache the token\n      cachedToken = {\n        token: data.access_token,\n        expiresAt,\n      };\n\n      return data.access_token;\n    } catch (error) {\n      throw new Error(\n        `Failed to fetch OAuth token for Bitbucket Cloud: ${error}`,\n      );\n    } finally {\n      // Clean up the in-flight promise tracking\n      refreshPromise = undefined;\n    }\n  })();\n\n  return refreshPromise;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDefaultBranch(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  const branchUrl = `${config.apiBaseUrl}/repositories/${project}/${repoName}`;\n  const response = await fetch(\n    branchUrl,\n    await getBitbucketCloudRequestOptions(config),\n  );\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const repoInfo = await response.json();\n  const defaultBranch = repoInfo.mainbranch.name;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDownloadUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const {\n    name: repoName,\n    owner: project,\n    ref,\n    protocol,\n    resource,\n  } = parseGitUrl(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketCloudDefaultBranch(url, config);\n  }\n  return `${protocol}://${resource}/${project}/${repoName}/get/${branch}.tar.gz`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.org/orgname/reponame/src/master/file.yaml\n * to:   https://api.bitbucket.org/2.0/repositories/orgname/reponame/src/master/file.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketCloudFileFetchUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);\n    if (!owner || !name || (filepathtype !== 'src' && filepathtype !== 'raw')) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n\n    if (!ref) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n    return `${config.apiBaseUrl}/repositories/${owner}/${name}/src/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n * Returns headers for authenticating with Bitbucket Cloud.\n * Supports OAuth (clientId/clientSecret), username/token, and username/appPassword auth.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudRequestOptions(\n  config: BitbucketCloudIntegrationConfig,\n): Promise<{\n  headers: Record<string, string>;\n}> {\n  const headers: Record<string, string> = {};\n\n  // OAuth authentication (clientId/clientSecret)\n  if (config.clientId && config.clientSecret) {\n    const token = await getBitbucketCloudOAuthToken(\n      config.clientId,\n      config.clientSecret,\n    );\n    headers.Authorization = `Bearer ${token}`;\n    return { headers };\n  }\n\n  // Basic authentication (username + token/appPassword)\n  // TODO: appPassword can be removed once fully\n  // deprecated by BitBucket on 9th June 2026.\n  if (config.username && (config.token ?? config.appPassword)) {\n    const buffer = Buffer.from(\n      `${config.username}:${config.token ?? config.appPassword}`,\n      'utf8',\n    );\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return { headers };\n}\n"],"names":[],"mappings":";;;;AA2BA,IAAI,WAAA;AAGJ,IAAI,cAAA;AAWJ,eAAsB,2BAAA,CACpB,UACA,YAAA,EACiB;AAEjB,EAAA,IAAI,WAAA,IAAe,QAAA,CAAS,GAAA,EAAI,GAAI,YAAY,SAAA,EAAW;AACzD,IAAA,OAAO,WAAA,CAAY,KAAA;AAAA,EACrB;AAGA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA;AAAA,EACT;AAGA,EAAA,cAAA,GAAA,CAAkB,YAAY;AAC5B,IAAA,IAAI;AAEF,MAAA,MAAM,cAAc,MAAA,CAAO,IAAA;AAAA,QACzB,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AAAA,QAC3B;AAAA,OACF,CAAE,SAAS,QAAQ,CAAA;AAEnB,MAAA,MAAM,WAAW,MAAM,KAAA;AAAA,QACrB,gDAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,cAAA,EAAgB,mCAAA;AAAA,YAChB,aAAA,EAAe,SAAS,WAAW,CAAA;AAAA,WACrC;AAAA,UACA,IAAA,EAAM;AAAA;AACR,OACF;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,kDAAA,EAAqD,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA;AAAA,SAC7F;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AAGA,MAAA,MAAM,SAAA,GAAY,KAAK,UAAA,IAAc,IAAA;AACrC,MAAA,MAAM,SAAA,GAAY,QAAA,CAAS,GAAA,EAAI,CAC5B,KAAK,EAAE,OAAA,EAAS,SAAA,EAAW,CAAA,CAC3B,KAAA,CAAM,EAAE,OAAA,EAAS,IAAI,CAAA;AAGxB,MAAA,WAAA,GAAc;AAAA,QACZ,OAAO,IAAA,CAAK,YAAA;AAAA,QACZ;AAAA,OACF;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oDAAoD,KAAK,CAAA;AAAA,OAC3D;AAAA,IACF,CAAA,SAAE;AAEA,MAAA,cAAA,GAAiB,MAAA;AAAA,IACnB;AAAA,EACF,CAAA,GAAG;AAEH,EAAA,OAAO,cAAA;AACT;AASA,eAAsB,8BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAI,YAAY,GAAG,CAAA;AAE1D,EAAA,MAAM,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,OAAO,IAAI,QAAQ,CAAA,CAAA;AAC1E,EAAA,MAAM,WAAW,MAAM,KAAA;AAAA,IACrB,SAAA;AAAA,IACA,MAAM,gCAAgC,MAAM;AAAA,GAC9C;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AACrC,EAAA,MAAM,aAAA,GAAgB,SAAS,UAAA,CAAW,IAAA;AAC1C,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,4BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF,GAAI,YAAY,GAAG,CAAA;AAEnB,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,8BAAA,CAA+B,GAAA,EAAK,MAAM,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,QAAQ,IAAI,OAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,KAAA,EAAQ,MAAM,CAAA,OAAA,CAAA;AACvE;AAgBO,SAAS,6BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAI,YAAY,GAAG,CAAA;AACpE,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAS,YAAA,KAAiB,KAAA,IAAS,iBAAiB,KAAA,EAAQ;AACzE,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEnD,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,KAAK,IAAI,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EAC1F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAUA,eAAsB,gCACpB,MAAA,EAGC;AACD,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,YAAA,EAAc;AAC1C,IAAA,MAAM,QAAQ,MAAM,2BAAA;AAAA,MAClB,MAAA,CAAO,QAAA;AAAA,MACP,MAAA,CAAO;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,UAAU,KAAK,CAAA,CAAA;AACvC,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB;AAKA,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,KAAA,IAAS,OAAO,WAAA,CAAA,EAAc;AAC3D,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AAAA,MACpB,GAAG,MAAA,CAAO,QAAQ,IAAI,MAAA,CAAO,KAAA,IAAS,OAAO,WAAW,CAAA,CAAA;AAAA,MACxD;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB;;;;"}
+{"version":3,"file":"core.esm.js","sources":["../../src/bitbucketCloud/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { parseGitUrlSafe } from '../helpers';\nimport { BitbucketCloudIntegrationConfig } from './config';\nimport { DateTime } from 'luxon';\n\ntype OAuthTokenData = {\n  token: string;\n  expiresAt: DateTime;\n};\n\n// In-memory token cache (single entry since there's only one Bitbucket Cloud integration)\nlet cachedToken: OAuthTokenData | undefined;\n\n// Track in-flight token refresh request to prevent concurrent fetches\nlet refreshPromise: Promise<string> | undefined;\n\n/**\n * Fetches an OAuth access token from Bitbucket Cloud using client credentials flow.\n * Tokens are cached with a 10-minute grace period to account for clock skew.\n * Implements concurrent refresh protection to prevent multiple simultaneous token requests.\n *\n * @param clientId - OAuth client ID\n * @param clientSecret - OAuth client secret\n * @public\n */\nexport async function getBitbucketCloudOAuthToken(\n  clientId: string,\n  clientSecret: string,\n): Promise<string> {\n  // Check cache\n  if (cachedToken && DateTime.now() < cachedToken.expiresAt) {\n    return cachedToken.token;\n  }\n\n  // Check if there's already a refresh in progress\n  if (refreshPromise) {\n    return refreshPromise;\n  }\n\n  // Start a new token fetch and track it\n  refreshPromise = (async () => {\n    try {\n      // Fetch new token\n      const credentials = Buffer.from(\n        `${clientId}:${clientSecret}`,\n        'utf8',\n      ).toString('base64');\n\n      const response = await fetch(\n        'https://bitbucket.org/site/oauth2/access_token',\n        {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/x-www-form-urlencoded',\n            Authorization: `Basic ${credentials}`,\n          },\n          body: 'grant_type=client_credentials',\n        },\n      );\n\n      if (!response.ok) {\n        throw new Error(\n          `Failed to fetch OAuth token from Bitbucket Cloud: ${response.status} ${response.statusText}`,\n        );\n      }\n\n      const data = await response.json();\n\n      if (!data.access_token) {\n        throw new Error('OAuth token response missing access_token field');\n      }\n\n      // Calculate expiration with 10-minute grace period\n      const expiresIn = data.expires_in || 3600; // Default to 1 hour\n      const expiresAt = DateTime.now()\n        .plus({ seconds: expiresIn })\n        .minus({ minutes: 10 });\n\n      // Cache the token\n      cachedToken = {\n        token: data.access_token,\n        expiresAt,\n      };\n\n      return data.access_token;\n    } catch (error) {\n      throw new Error(\n        `Failed to fetch OAuth token for Bitbucket Cloud: ${error}`,\n      );\n    } finally {\n      // Clean up the in-flight promise tracking\n      refreshPromise = undefined;\n    }\n  })();\n\n  return refreshPromise;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDefaultBranch(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  const branchUrl = `${config.apiBaseUrl}/repositories/${project}/${repoName}`;\n  const response = await fetch(\n    branchUrl,\n    await getBitbucketCloudRequestOptions(config),\n  );\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const repoInfo = await response.json();\n  const defaultBranch = repoInfo.mainbranch.name;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudDownloadUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): Promise<string> {\n  const {\n    name: repoName,\n    owner: project,\n    ref,\n    protocol,\n    resource,\n  } = parseGitUrlSafe(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketCloudDefaultBranch(url, config);\n  }\n  return `${protocol}://${resource}/${project}/${repoName}/get/${branch}.tar.gz`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.org/orgname/reponame/src/master/file.yaml\n * to:   https://api.bitbucket.org/2.0/repositories/orgname/reponame/src/master/file.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketCloudFileFetchUrl(\n  url: string,\n  config: BitbucketCloudIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);\n    if (!owner || !name || (filepathtype !== 'src' && filepathtype !== 'raw')) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n\n    if (!ref) {\n      throw new Error('Invalid Bitbucket Cloud URL or file path');\n    }\n    return `${config.apiBaseUrl}/repositories/${owner}/${name}/src/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n * Returns headers for authenticating with Bitbucket Cloud.\n * Supports OAuth (clientId/clientSecret), username/token, and username/appPassword auth.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketCloudRequestOptions(\n  config: BitbucketCloudIntegrationConfig,\n): Promise<{\n  headers: Record<string, string>;\n}> {\n  const headers: Record<string, string> = {};\n\n  // OAuth authentication (clientId/clientSecret)\n  if (config.clientId && config.clientSecret) {\n    const token = await getBitbucketCloudOAuthToken(\n      config.clientId,\n      config.clientSecret,\n    );\n    headers.Authorization = `Bearer ${token}`;\n    return { headers };\n  }\n\n  // Basic authentication (username + token/appPassword)\n  // TODO: appPassword can be removed once fully\n  // deprecated by BitBucket on 9th June 2026.\n  if (config.username && (config.token ?? config.appPassword)) {\n    const buffer = Buffer.from(\n      `${config.username}:${config.token ?? config.appPassword}`,\n      'utf8',\n    );\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return { headers };\n}\n"],"names":[],"mappings":";;;;;AA4BA,IAAI,WAAA;AAGJ,IAAI,cAAA;AAWJ,eAAsB,2BAAA,CACpB,UACA,YAAA,EACiB;AAEjB,EAAA,IAAI,WAAA,IAAe,QAAA,CAAS,GAAA,EAAI,GAAI,YAAY,SAAA,EAAW;AACzD,IAAA,OAAO,WAAA,CAAY,KAAA;AAAA,EACrB;AAGA,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA;AAAA,EACT;AAGA,EAAA,cAAA,GAAA,CAAkB,YAAY;AAC5B,IAAA,IAAI;AAEF,MAAA,MAAM,cAAc,MAAA,CAAO,IAAA;AAAA,QACzB,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AAAA,QAC3B;AAAA,OACF,CAAE,SAAS,QAAQ,CAAA;AAEnB,MAAA,MAAM,WAAW,MAAM,KAAA;AAAA,QACrB,gDAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,cAAA,EAAgB,mCAAA;AAAA,YAChB,aAAA,EAAe,SAAS,WAAW,CAAA;AAAA,WACrC;AAAA,UACA,IAAA,EAAM;AAAA;AACR,OACF;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,kDAAA,EAAqD,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA;AAAA,SAC7F;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MACnE;AAGA,MAAA,MAAM,SAAA,GAAY,KAAK,UAAA,IAAc,IAAA;AACrC,MAAA,MAAM,SAAA,GAAY,QAAA,CAAS,GAAA,EAAI,CAC5B,KAAK,EAAE,OAAA,EAAS,SAAA,EAAW,CAAA,CAC3B,KAAA,CAAM,EAAE,OAAA,EAAS,IAAI,CAAA;AAGxB,MAAA,WAAA,GAAc;AAAA,QACZ,OAAO,IAAA,CAAK,YAAA;AAAA,QACZ;AAAA,OACF;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oDAAoD,KAAK,CAAA;AAAA,OAC3D;AAAA,IACF,CAAA,SAAE;AAEA,MAAA,cAAA,GAAiB,MAAA;AAAA,IACnB;AAAA,EACF,CAAA,GAAG;AAEH,EAAA,OAAO,cAAA;AACT;AASA,eAAsB,8BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAI,YAAY,GAAG,CAAA;AAE1D,EAAA,MAAM,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,OAAO,IAAI,QAAQ,CAAA,CAAA;AAC1E,EAAA,MAAM,WAAW,MAAM,KAAA;AAAA,IACrB,SAAA;AAAA,IACA,MAAM,gCAAgC,MAAM;AAAA,GAC9C;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AACrC,EAAA,MAAM,aAAA,GAAgB,SAAS,UAAA,CAAW,IAAA;AAC1C,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,4BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF,GAAI,gBAAgB,GAAG,CAAA;AAEvB,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,8BAAA,CAA+B,GAAA,EAAK,MAAM,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,QAAQ,IAAI,OAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,KAAA,EAAQ,MAAM,CAAA,OAAA,CAAA;AACvE;AAgBO,SAAS,6BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAI,gBAAgB,GAAG,CAAA;AACxE,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAS,YAAA,KAAiB,KAAA,IAAS,iBAAiB,KAAA,EAAQ;AACzE,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEnD,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,cAAA,EAAiB,KAAK,IAAI,IAAI,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EAC1F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAUA,eAAsB,gCACpB,MAAA,EAGC;AACD,EAAA,MAAM,UAAkC,EAAC;AAGzC,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,YAAA,EAAc;AAC1C,IAAA,MAAM,QAAQ,MAAM,2BAAA;AAAA,MAClB,MAAA,CAAO,QAAA;AAAA,MACP,MAAA,CAAO;AAAA,KACT;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,UAAU,KAAK,CAAA,CAAA;AACvC,IAAA,OAAO,EAAE,OAAA,EAAQ;AAAA,EACnB;AAKA,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,KAAA,IAAS,OAAO,WAAA,CAAA,EAAc;AAC3D,IAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AAAA,MACpB,GAAG,MAAA,CAAO,QAAQ,IAAI,MAAA,CAAO,KAAA,IAAS,OAAO,WAAW,CAAA,CAAA;AAAA,MACxD;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO,EAAE,OAAA,EAAQ;AACnB;;;;"}

package/dist/bitbucketServer/core.cjs.js

@@ -2,6 +2,7 @@
 
 var fetch = require('cross-fetch');
 var parseGitUrl = require('git-url-parse');
+var helpers = require('../helpers.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -33,7 +34,12 @@ async function getBitbucketServerDefaultBranch(url, config) {
   return defaultBranch;
 }
 async function getBitbucketServerDownloadUrl(url, config) {
-  const { name: repoName, owner: project, ref, filepath } = parseGitUrl__default.default(url);
+  const {
+    name: repoName,
+    owner: project,
+    ref,
+    filepath
+  } = helpers.parseGitUrlSafe(url);
   let branch = ref;
   if (!branch) {
     branch = await getBitbucketServerDefaultBranch(url, config);
@@ -43,7 +49,7 @@ async function getBitbucketServerDownloadUrl(url, config) {
 }
 function getBitbucketServerFileFetchUrl(url, config) {
   try {
-    const { owner, name, ref, filepathtype, filepath } = parseGitUrl__default.default(url);
+    const { owner, name, ref, filepathtype, filepath } = helpers.parseGitUrlSafe(url);
     if (!owner || !name || filepathtype !== "browse" && filepathtype !== "raw" && filepathtype !== "src") {
       throw new Error("Invalid Bitbucket Server URL or file path");
     }

package/dist/bitbucketServer/core.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.cjs.js","sources":["../../src/bitbucketServer/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { BitbucketServerIntegrationConfig } from './config';\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDefaultBranch(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  // Bitbucket Server https://docs.atlassian.com/bitbucket-server/rest/7.9.0/bitbucket-rest.html#idp184\n  let branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/default-branch`;\n\n  let response = await fetch(\n    branchUrl,\n    getBitbucketServerRequestOptions(config),\n  );\n\n  if (response.status === 404) {\n    // First try the new format, and then if it gets specifically a 404 it should try the old format\n    // (to support old  Atlassian Bitbucket Server v5.11.1 format )\n    branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/branches/default`;\n    response = await fetch(branchUrl, getBitbucketServerRequestOptions(config));\n  }\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const { displayId } = await response.json();\n  const defaultBranch = displayId;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDownloadUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project, ref, filepath } = parseGitUrl(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketServerDefaultBranch(url, config);\n  }\n  // path will limit the downloaded content\n  // /docs will only download the docs folder and everything below it\n  // /docs/index.md will download the docs folder and everything below it\n  const path = filepath\n    ? `&path=${encodeURIComponent(decodeURIComponent(filepath))}`\n    : '';\n  return `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/archive?format=tgz&at=${branch}&prefix=${project}-${repoName}${path}`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.company.com/projectname/reponame/src/main/file.yaml\n * to:   https://bitbucket.company.com/rest/api/1.0/project/projectname/reponame/raw/file.yaml?at=main\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerFileFetchUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);\n    if (\n      !owner ||\n      !name ||\n      (filepathtype !== 'browse' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'src')\n    ) {\n      throw new Error('Invalid Bitbucket Server URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    return `${config.apiBaseUrl}/projects/${owner}/repos/${name}/raw/${pathWithoutSlash}?at=${ref}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerRequestOptions(\n  config: BitbucketServerIntegrationConfig,\n): { headers: Record<string, string> } {\n  const headers: Record<string, string> = {};\n\n  if (config.token) {\n    headers.Authorization = `Bearer ${config.token}`;\n  } else if (config.username && config.password) {\n    const buffer = Buffer.from(`${config.username}:${config.password}`, 'utf8');\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return {\n    headers,\n  };\n}\n"],"names":["parseGitUrl","fetch"],"mappings":";;;;;;;;;;AA2BA,eAAsB,+BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAIA,6BAAY,GAAG,CAAA;AAG1D,EAAA,IAAI,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,eAAA,CAAA;AAE1E,EAAA,IAAI,WAAW,MAAMC,sBAAA;AAAA,IACnB,SAAA;AAAA,IACA,iCAAiC,MAAM;AAAA,GACzC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAG3B,IAAA,SAAA,GAAY,GAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,iBAAA,CAAA;AACtE,IAAA,QAAA,GAAW,MAAMA,sBAAA,CAAM,SAAA,EAAW,gCAAA,CAAiC,MAAM,CAAC,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,SAAS,IAAA,EAAK;AAC1C,EAAA,MAAM,aAAA,GAAgB,SAAA;AACtB,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,6BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,SAAS,GAAA,EAAK,QAAA,EAAS,GAAID,4BAAA,CAAY,GAAG,CAAA;AAEzE,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,+BAAA,CAAgC,GAAA,EAAK,MAAM,CAAA;AAAA,EAC5D;AAIA,EAAA,MAAM,IAAA,GAAO,WACT,CAAA,MAAA,EAAS,kBAAA,CAAmB,mBAAmB,QAAQ,CAAC,CAAC,CAAA,CAAA,GACzD,EAAA;AACJ,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,uBAAA,EAA0B,MAAM,CAAA,QAAA,EAAW,OAAO,CAAA,CAAA,EAAI,QAAQ,GAAG,IAAI,CAAA,CAAA;AACxI;AAgBO,SAAS,8BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAIA,6BAAY,GAAG,CAAA;AACpE,IAAA,IACE,CAAC,SACD,CAAC,IAAA,IACA,iBAAiB,QAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,YAAA,KAAiB,KAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,KAAK,UAAU,IAAI,CAAA,KAAA,EAAQ,gBAAgB,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA;AAAA,EAC/F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAQO,SAAS,iCACd,MAAA,EACqC;AACrC,EAAA,MAAM,UAAkC,EAAC;AAEzC,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,EAChD,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AAC7C,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA;AAC1E,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF;;;;;;;"}
+{"version":3,"file":"core.cjs.js","sources":["../../src/bitbucketServer/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { parseGitUrlSafe } from '../helpers';\nimport { BitbucketServerIntegrationConfig } from './config';\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDefaultBranch(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  // Bitbucket Server https://docs.atlassian.com/bitbucket-server/rest/7.9.0/bitbucket-rest.html#idp184\n  let branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/default-branch`;\n\n  let response = await fetch(\n    branchUrl,\n    getBitbucketServerRequestOptions(config),\n  );\n\n  if (response.status === 404) {\n    // First try the new format, and then if it gets specifically a 404 it should try the old format\n    // (to support old  Atlassian Bitbucket Server v5.11.1 format )\n    branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/branches/default`;\n    response = await fetch(branchUrl, getBitbucketServerRequestOptions(config));\n  }\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const { displayId } = await response.json();\n  const defaultBranch = displayId;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDownloadUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const {\n    name: repoName,\n    owner: project,\n    ref,\n    filepath,\n  } = parseGitUrlSafe(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketServerDefaultBranch(url, config);\n  }\n  // path will limit the downloaded content\n  // /docs will only download the docs folder and everything below it\n  // /docs/index.md will download the docs folder and everything below it\n  const path = filepath\n    ? `&path=${encodeURIComponent(decodeURIComponent(filepath))}`\n    : '';\n  return `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/archive?format=tgz&at=${branch}&prefix=${project}-${repoName}${path}`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.company.com/projectname/reponame/src/main/file.yaml\n * to:   https://bitbucket.company.com/rest/api/1.0/project/projectname/reponame/raw/file.yaml?at=main\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerFileFetchUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);\n    if (\n      !owner ||\n      !name ||\n      (filepathtype !== 'browse' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'src')\n    ) {\n      throw new Error('Invalid Bitbucket Server URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    return `${config.apiBaseUrl}/projects/${owner}/repos/${name}/raw/${pathWithoutSlash}?at=${ref}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerRequestOptions(\n  config: BitbucketServerIntegrationConfig,\n): { headers: Record<string, string> } {\n  const headers: Record<string, string> = {};\n\n  if (config.token) {\n    headers.Authorization = `Bearer ${config.token}`;\n  } else if (config.username && config.password) {\n    const buffer = Buffer.from(`${config.username}:${config.password}`, 'utf8');\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return {\n    headers,\n  };\n}\n"],"names":["parseGitUrl","fetch","parseGitUrlSafe"],"mappings":";;;;;;;;;;;AA4BA,eAAsB,+BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAIA,6BAAY,GAAG,CAAA;AAG1D,EAAA,IAAI,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,eAAA,CAAA;AAE1E,EAAA,IAAI,WAAW,MAAMC,sBAAA;AAAA,IACnB,SAAA;AAAA,IACA,iCAAiC,MAAM;AAAA,GACzC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAG3B,IAAA,SAAA,GAAY,GAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,iBAAA,CAAA;AACtE,IAAA,QAAA,GAAW,MAAMA,sBAAA,CAAM,SAAA,EAAW,gCAAA,CAAiC,MAAM,CAAC,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,SAAS,IAAA,EAAK;AAC1C,EAAA,MAAM,aAAA,GAAgB,SAAA;AACtB,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,6BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA;AAAA,GACF,GAAIC,wBAAgB,GAAG,CAAA;AAEvB,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,+BAAA,CAAgC,GAAA,EAAK,MAAM,CAAA;AAAA,EAC5D;AAIA,EAAA,MAAM,IAAA,GAAO,WACT,CAAA,MAAA,EAAS,kBAAA,CAAmB,mBAAmB,QAAQ,CAAC,CAAC,CAAA,CAAA,GACzD,EAAA;AACJ,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,uBAAA,EAA0B,MAAM,CAAA,QAAA,EAAW,OAAO,CAAA,CAAA,EAAI,QAAQ,GAAG,IAAI,CAAA,CAAA;AACxI;AAgBO,SAAS,8BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAIA,wBAAgB,GAAG,CAAA;AACxE,IAAA,IACE,CAAC,SACD,CAAC,IAAA,IACA,iBAAiB,QAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,YAAA,KAAiB,KAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,KAAK,UAAU,IAAI,CAAA,KAAA,EAAQ,gBAAgB,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA;AAAA,EAC/F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAQO,SAAS,iCACd,MAAA,EACqC;AACrC,EAAA,MAAM,UAAkC,EAAC;AAEzC,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,EAChD,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AAC7C,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA;AAC1E,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF;;;;;;;"}

package/dist/bitbucketServer/core.esm.js

@@ -1,5 +1,6 @@
 import fetch from 'cross-fetch';
 import parseGitUrl from 'git-url-parse';
+import { parseGitUrlSafe } from '../helpers.esm.js';
 
 async function getBitbucketServerDefaultBranch(url, config) {
   const { name: repoName, owner: project } = parseGitUrl(url);
@@ -26,7 +27,12 @@ async function getBitbucketServerDefaultBranch(url, config) {
   return defaultBranch;
 }
 async function getBitbucketServerDownloadUrl(url, config) {
-  const { name: repoName, owner: project, ref, filepath } = parseGitUrl(url);
+  const {
+    name: repoName,
+    owner: project,
+    ref,
+    filepath
+  } = parseGitUrlSafe(url);
   let branch = ref;
   if (!branch) {
     branch = await getBitbucketServerDefaultBranch(url, config);
@@ -36,7 +42,7 @@ async function getBitbucketServerDownloadUrl(url, config) {
 }
 function getBitbucketServerFileFetchUrl(url, config) {
   try {
-    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);
+    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);
     if (!owner || !name || filepathtype !== "browse" && filepathtype !== "raw" && filepathtype !== "src") {
       throw new Error("Invalid Bitbucket Server URL or file path");
     }

package/dist/bitbucketServer/core.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.esm.js","sources":["../../src/bitbucketServer/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { BitbucketServerIntegrationConfig } from './config';\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDefaultBranch(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  // Bitbucket Server https://docs.atlassian.com/bitbucket-server/rest/7.9.0/bitbucket-rest.html#idp184\n  let branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/default-branch`;\n\n  let response = await fetch(\n    branchUrl,\n    getBitbucketServerRequestOptions(config),\n  );\n\n  if (response.status === 404) {\n    // First try the new format, and then if it gets specifically a 404 it should try the old format\n    // (to support old  Atlassian Bitbucket Server v5.11.1 format )\n    branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/branches/default`;\n    response = await fetch(branchUrl, getBitbucketServerRequestOptions(config));\n  }\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const { displayId } = await response.json();\n  const defaultBranch = displayId;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDownloadUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project, ref, filepath } = parseGitUrl(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketServerDefaultBranch(url, config);\n  }\n  // path will limit the downloaded content\n  // /docs will only download the docs folder and everything below it\n  // /docs/index.md will download the docs folder and everything below it\n  const path = filepath\n    ? `&path=${encodeURIComponent(decodeURIComponent(filepath))}`\n    : '';\n  return `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/archive?format=tgz&at=${branch}&prefix=${project}-${repoName}${path}`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.company.com/projectname/reponame/src/main/file.yaml\n * to:   https://bitbucket.company.com/rest/api/1.0/project/projectname/reponame/raw/file.yaml?at=main\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerFileFetchUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);\n    if (\n      !owner ||\n      !name ||\n      (filepathtype !== 'browse' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'src')\n    ) {\n      throw new Error('Invalid Bitbucket Server URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    return `${config.apiBaseUrl}/projects/${owner}/repos/${name}/raw/${pathWithoutSlash}?at=${ref}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerRequestOptions(\n  config: BitbucketServerIntegrationConfig,\n): { headers: Record<string, string> } {\n  const headers: Record<string, string> = {};\n\n  if (config.token) {\n    headers.Authorization = `Bearer ${config.token}`;\n  } else if (config.username && config.password) {\n    const buffer = Buffer.from(`${config.username}:${config.password}`, 'utf8');\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return {\n    headers,\n  };\n}\n"],"names":[],"mappings":";;;AA2BA,eAAsB,+BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAI,YAAY,GAAG,CAAA;AAG1D,EAAA,IAAI,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,eAAA,CAAA;AAE1E,EAAA,IAAI,WAAW,MAAM,KAAA;AAAA,IACnB,SAAA;AAAA,IACA,iCAAiC,MAAM;AAAA,GACzC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAG3B,IAAA,SAAA,GAAY,GAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,iBAAA,CAAA;AACtE,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,EAAW,gCAAA,CAAiC,MAAM,CAAC,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,SAAS,IAAA,EAAK;AAC1C,EAAA,MAAM,aAAA,GAAgB,SAAA;AACtB,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,6BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,MAAM,QAAA,EAAU,KAAA,EAAO,SAAS,GAAA,EAAK,QAAA,EAAS,GAAI,WAAA,CAAY,GAAG,CAAA;AAEzE,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,+BAAA,CAAgC,GAAA,EAAK,MAAM,CAAA;AAAA,EAC5D;AAIA,EAAA,MAAM,IAAA,GAAO,WACT,CAAA,MAAA,EAAS,kBAAA,CAAmB,mBAAmB,QAAQ,CAAC,CAAC,CAAA,CAAA,GACzD,EAAA;AACJ,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,uBAAA,EAA0B,MAAM,CAAA,QAAA,EAAW,OAAO,CAAA,CAAA,EAAI,QAAQ,GAAG,IAAI,CAAA,CAAA;AACxI;AAgBO,SAAS,8BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAI,YAAY,GAAG,CAAA;AACpE,IAAA,IACE,CAAC,SACD,CAAC,IAAA,IACA,iBAAiB,QAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,YAAA,KAAiB,KAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,KAAK,UAAU,IAAI,CAAA,KAAA,EAAQ,gBAAgB,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA;AAAA,EAC/F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAQO,SAAS,iCACd,MAAA,EACqC;AACrC,EAAA,MAAM,UAAkC,EAAC;AAEzC,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,EAChD,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AAC7C,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA;AAC1E,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF;;;;"}
+{"version":3,"file":"core.esm.js","sources":["../../src/bitbucketServer/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'cross-fetch';\nimport parseGitUrl from 'git-url-parse';\nimport { parseGitUrlSafe } from '../helpers';\nimport { BitbucketServerIntegrationConfig } from './config';\n\n/**\n * Given a URL pointing to a path on a provider, returns the default branch.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDefaultBranch(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const { name: repoName, owner: project } = parseGitUrl(url);\n\n  // Bitbucket Server https://docs.atlassian.com/bitbucket-server/rest/7.9.0/bitbucket-rest.html#idp184\n  let branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/default-branch`;\n\n  let response = await fetch(\n    branchUrl,\n    getBitbucketServerRequestOptions(config),\n  );\n\n  if (response.status === 404) {\n    // First try the new format, and then if it gets specifically a 404 it should try the old format\n    // (to support old  Atlassian Bitbucket Server v5.11.1 format )\n    branchUrl = `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/branches/default`;\n    response = await fetch(branchUrl, getBitbucketServerRequestOptions(config));\n  }\n\n  if (!response.ok) {\n    const message = `Failed to retrieve default branch from ${branchUrl}, ${response.status} ${response.statusText}`;\n    throw new Error(message);\n  }\n\n  const { displayId } = await response.json();\n  const defaultBranch = displayId;\n  if (!defaultBranch) {\n    throw new Error(\n      `Failed to read default branch from ${branchUrl}. ` +\n        `Response ${response.status} ${response.json()}`,\n    );\n  }\n  return defaultBranch;\n}\n\n/**\n * Given a URL pointing to a path on a provider, returns a URL that is suitable\n * for downloading the subtree.\n *\n * @param url - A URL pointing to a path\n * @param config - The relevant provider config\n * @public\n */\nexport async function getBitbucketServerDownloadUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): Promise<string> {\n  const {\n    name: repoName,\n    owner: project,\n    ref,\n    filepath,\n  } = parseGitUrlSafe(url);\n\n  let branch = ref;\n  if (!branch) {\n    branch = await getBitbucketServerDefaultBranch(url, config);\n  }\n  // path will limit the downloaded content\n  // /docs will only download the docs folder and everything below it\n  // /docs/index.md will download the docs folder and everything below it\n  const path = filepath\n    ? `&path=${encodeURIComponent(decodeURIComponent(filepath))}`\n    : '';\n  return `${config.apiBaseUrl}/projects/${project}/repos/${repoName}/archive?format=tgz&at=${branch}&prefix=${project}-${repoName}${path}`;\n}\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://bitbucket.company.com/projectname/reponame/src/main/file.yaml\n * to:   https://bitbucket.company.com/rest/api/1.0/project/projectname/reponame/raw/file.yaml?at=main\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerFileFetchUrl(\n  url: string,\n  config: BitbucketServerIntegrationConfig,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);\n    if (\n      !owner ||\n      !name ||\n      (filepathtype !== 'browse' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'src')\n    ) {\n      throw new Error('Invalid Bitbucket Server URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    return `${config.apiBaseUrl}/projects/${owner}/repos/${name}/raw/${pathWithoutSlash}?at=${ref}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\n/**\n * Gets the request options necessary to make requests to a given provider.\n *\n * @param config - The relevant provider config\n * @public\n */\nexport function getBitbucketServerRequestOptions(\n  config: BitbucketServerIntegrationConfig,\n): { headers: Record<string, string> } {\n  const headers: Record<string, string> = {};\n\n  if (config.token) {\n    headers.Authorization = `Bearer ${config.token}`;\n  } else if (config.username && config.password) {\n    const buffer = Buffer.from(`${config.username}:${config.password}`, 'utf8');\n    headers.Authorization = `Basic ${buffer.toString('base64')}`;\n  }\n\n  return {\n    headers,\n  };\n}\n"],"names":[],"mappings":";;;;AA4BA,eAAsB,+BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,OAAO,OAAA,EAAQ,GAAI,YAAY,GAAG,CAAA;AAG1D,EAAA,IAAI,YAAY,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,eAAA,CAAA;AAE1E,EAAA,IAAI,WAAW,MAAM,KAAA;AAAA,IACnB,SAAA;AAAA,IACA,iCAAiC,MAAM;AAAA,GACzC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAG3B,IAAA,SAAA,GAAY,GAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,UAAU,QAAQ,CAAA,iBAAA,CAAA;AACtE,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,EAAW,gCAAA,CAAiC,MAAM,CAAC,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,0CAA0C,SAAS,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAC9G,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAEA,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,SAAS,IAAA,EAAK;AAC1C,EAAA,MAAM,aAAA,GAAgB,SAAA;AACtB,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,SAAS,CAAA,WAAA,EACjC,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,OAAO,aAAA;AACT;AAUA,eAAsB,6BAAA,CACpB,KACA,MAAA,EACiB;AACjB,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,GAAA;AAAA,IACA;AAAA,GACF,GAAI,gBAAgB,GAAG,CAAA;AAEvB,EAAA,IAAI,MAAA,GAAS,GAAA;AACb,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,MAAM,+BAAA,CAAgC,GAAA,EAAK,MAAM,CAAA;AAAA,EAC5D;AAIA,EAAA,MAAM,IAAA,GAAO,WACT,CAAA,MAAA,EAAS,kBAAA,CAAmB,mBAAmB,QAAQ,CAAC,CAAC,CAAA,CAAA,GACzD,EAAA;AACJ,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,uBAAA,EAA0B,MAAM,CAAA,QAAA,EAAW,OAAO,CAAA,CAAA,EAAI,QAAQ,GAAG,IAAI,CAAA,CAAA;AACxI;AAgBO,SAAS,8BAAA,CACd,KACA,MAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAI,gBAAgB,GAAG,CAAA;AACxE,IAAA,IACE,CAAC,SACD,CAAC,IAAA,IACA,iBAAiB,QAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,YAAA,KAAiB,KAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,UAAA,EAAa,KAAK,UAAU,IAAI,CAAA,KAAA,EAAQ,gBAAgB,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA;AAAA,EAC/F,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAQO,SAAS,iCACd,MAAA,EACqC;AACrC,EAAA,MAAM,UAAkC,EAAC;AAEzC,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,EAChD,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AAC7C,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA;AAC1E,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF;;;;"}

package/dist/github/core.cjs.js

@@ -1,14 +1,10 @@
 'use strict';
 
-var parseGitUrl = require('git-url-parse');
-
-function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
-
-var parseGitUrl__default = /*#__PURE__*/_interopDefaultCompat(parseGitUrl);
+var helpers = require('../helpers.cjs.js');
 
 function getGithubFileFetchUrl(url, config, credentials) {
   try {
-    const { owner, name, ref, filepathtype, filepath } = parseGitUrl__default.default(url);
+    const { owner, name, ref, filepathtype, filepath } = helpers.parseGitUrlSafe(url);
     if (!owner || !name || !ref || // GitHub is automatically redirecting tree urls to blob urls so it's
     // fine to pass a tree url.
     filepathtype !== "blob" && filepathtype !== "raw" && filepathtype !== "tree") {

package/dist/github/core.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.cjs.js","sources":["../../src/github/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport parseGitUrl from 'git-url-parse';\nimport { GithubIntegrationConfig } from './config';\nimport { GithubCredentials } from './types';\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://github.com/a/b/blob/branchname/path/to/c.yaml\n * to:   https://api.github.com/repos/a/b/contents/path/to/c.yaml?ref=branchname\n * or:   https://raw.githubusercontent.com/a/b/branchname/c.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getGithubFileFetchUrl(\n  url: string,\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);\n    if (\n      !owner ||\n      !name ||\n      !ref ||\n      // GitHub is automatically redirecting tree urls to blob urls so it's\n      // fine to pass a tree url.\n      (filepathtype !== 'blob' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'tree')\n    ) {\n      throw new Error('Invalid GitHub URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    if (chooseEndpoint(config, credentials) === 'api') {\n      return `${config.apiBaseUrl}/repos/${owner}/${name}/contents/${pathWithoutSlash}?ref=${ref}`;\n    }\n    return `${config.rawBaseUrl}/${owner}/${name}/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\nexport function chooseEndpoint(\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): 'api' | 'raw' {\n  if (config.apiBaseUrl && (credentials.token || !config.rawBaseUrl)) {\n    return 'api';\n  }\n  return 'raw';\n}\n"],"names":["parseGitUrl"],"mappings":";;;;;;;;AAmCO,SAAS,qBAAA,CACd,GAAA,EACA,MAAA,EACA,WAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAIA,6BAAY,GAAG,CAAA;AACpE,IAAA,IACE,CAAC,KAAA,IACD,CAAC,IAAA,IACD,CAAC,GAAA;AAAA;AAAA,IAGA,YAAA,KAAiB,MAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,iBAAiB,MAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,IAAI,cAAA,CAAe,MAAA,EAAQ,WAAW,CAAA,KAAM,KAAA,EAAO;AACjD,MAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,OAAA,EAAU,KAAK,IAAI,IAAI,CAAA,UAAA,EAAa,gBAAgB,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,CAAA,EAAI,KAAK,IAAI,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EACzE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAEO,SAAS,cAAA,CACd,QACA,WAAA,EACe;AACf,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,CAAY,KAAA,IAAS,CAAC,OAAO,UAAA,CAAA,EAAa;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;;;;;"}
+{"version":3,"file":"core.cjs.js","sources":["../../src/github/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { GithubIntegrationConfig } from './config';\nimport { parseGitUrlSafe } from '../helpers';\nimport { GithubCredentials } from './types';\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://github.com/a/b/blob/branchname/path/to/c.yaml\n * to:   https://api.github.com/repos/a/b/contents/path/to/c.yaml?ref=branchname\n * or:   https://raw.githubusercontent.com/a/b/branchname/c.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getGithubFileFetchUrl(\n  url: string,\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);\n    if (\n      !owner ||\n      !name ||\n      !ref ||\n      // GitHub is automatically redirecting tree urls to blob urls so it's\n      // fine to pass a tree url.\n      (filepathtype !== 'blob' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'tree')\n    ) {\n      throw new Error('Invalid GitHub URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    if (chooseEndpoint(config, credentials) === 'api') {\n      return `${config.apiBaseUrl}/repos/${owner}/${name}/contents/${pathWithoutSlash}?ref=${ref}`;\n    }\n    return `${config.rawBaseUrl}/${owner}/${name}/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\nexport function chooseEndpoint(\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): 'api' | 'raw' {\n  if (config.apiBaseUrl && (credentials.token || !config.rawBaseUrl)) {\n    return 'api';\n  }\n  return 'raw';\n}\n"],"names":["parseGitUrlSafe"],"mappings":";;;;AAmCO,SAAS,qBAAA,CACd,GAAA,EACA,MAAA,EACA,WAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAIA,wBAAgB,GAAG,CAAA;AACxE,IAAA,IACE,CAAC,KAAA,IACD,CAAC,IAAA,IACD,CAAC,GAAA;AAAA;AAAA,IAGA,YAAA,KAAiB,MAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,iBAAiB,MAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,IAAI,cAAA,CAAe,MAAA,EAAQ,WAAW,CAAA,KAAM,KAAA,EAAO;AACjD,MAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,OAAA,EAAU,KAAK,IAAI,IAAI,CAAA,UAAA,EAAa,gBAAgB,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,CAAA,EAAI,KAAK,IAAI,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EACzE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAEO,SAAS,cAAA,CACd,QACA,WAAA,EACe;AACf,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,CAAY,KAAA,IAAS,CAAC,OAAO,UAAA,CAAA,EAAa;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;;;;;"}

package/dist/github/core.esm.js

@@ -1,8 +1,8 @@
-import parseGitUrl from 'git-url-parse';
+import { parseGitUrlSafe } from '../helpers.esm.js';
 
 function getGithubFileFetchUrl(url, config, credentials) {
   try {
-    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);
+    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);
     if (!owner || !name || !ref || // GitHub is automatically redirecting tree urls to blob urls so it's
     // fine to pass a tree url.
     filepathtype !== "blob" && filepathtype !== "raw" && filepathtype !== "tree") {

package/dist/github/core.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.esm.js","sources":["../../src/github/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport parseGitUrl from 'git-url-parse';\nimport { GithubIntegrationConfig } from './config';\nimport { GithubCredentials } from './types';\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://github.com/a/b/blob/branchname/path/to/c.yaml\n * to:   https://api.github.com/repos/a/b/contents/path/to/c.yaml?ref=branchname\n * or:   https://raw.githubusercontent.com/a/b/branchname/c.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getGithubFileFetchUrl(\n  url: string,\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrl(url);\n    if (\n      !owner ||\n      !name ||\n      !ref ||\n      // GitHub is automatically redirecting tree urls to blob urls so it's\n      // fine to pass a tree url.\n      (filepathtype !== 'blob' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'tree')\n    ) {\n      throw new Error('Invalid GitHub URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    if (chooseEndpoint(config, credentials) === 'api') {\n      return `${config.apiBaseUrl}/repos/${owner}/${name}/contents/${pathWithoutSlash}?ref=${ref}`;\n    }\n    return `${config.rawBaseUrl}/${owner}/${name}/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\nexport function chooseEndpoint(\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): 'api' | 'raw' {\n  if (config.apiBaseUrl && (credentials.token || !config.rawBaseUrl)) {\n    return 'api';\n  }\n  return 'raw';\n}\n"],"names":[],"mappings":";;AAmCO,SAAS,qBAAA,CACd,GAAA,EACA,MAAA,EACA,WAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAI,YAAY,GAAG,CAAA;AACpE,IAAA,IACE,CAAC,KAAA,IACD,CAAC,IAAA,IACD,CAAC,GAAA;AAAA;AAAA,IAGA,YAAA,KAAiB,MAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,iBAAiB,MAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,IAAI,cAAA,CAAe,MAAA,EAAQ,WAAW,CAAA,KAAM,KAAA,EAAO;AACjD,MAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,OAAA,EAAU,KAAK,IAAI,IAAI,CAAA,UAAA,EAAa,gBAAgB,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,CAAA,EAAI,KAAK,IAAI,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EACzE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAEO,SAAS,cAAA,CACd,QACA,WAAA,EACe;AACf,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,CAAY,KAAA,IAAS,CAAC,OAAO,UAAA,CAAA,EAAa;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;;;;"}
+{"version":3,"file":"core.esm.js","sources":["../../src/github/core.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { GithubIntegrationConfig } from './config';\nimport { parseGitUrlSafe } from '../helpers';\nimport { GithubCredentials } from './types';\n\n/**\n * Given a URL pointing to a file on a provider, returns a URL that is suitable\n * for fetching the contents of the data.\n *\n * @remarks\n *\n * Converts\n * from: https://github.com/a/b/blob/branchname/path/to/c.yaml\n * to:   https://api.github.com/repos/a/b/contents/path/to/c.yaml?ref=branchname\n * or:   https://raw.githubusercontent.com/a/b/branchname/c.yaml\n *\n * @param url - A URL pointing to a file\n * @param config - The relevant provider config\n * @public\n */\nexport function getGithubFileFetchUrl(\n  url: string,\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): string {\n  try {\n    const { owner, name, ref, filepathtype, filepath } = parseGitUrlSafe(url);\n    if (\n      !owner ||\n      !name ||\n      !ref ||\n      // GitHub is automatically redirecting tree urls to blob urls so it's\n      // fine to pass a tree url.\n      (filepathtype !== 'blob' &&\n        filepathtype !== 'raw' &&\n        filepathtype !== 'tree')\n    ) {\n      throw new Error('Invalid GitHub URL or file path');\n    }\n\n    const pathWithoutSlash = filepath.replace(/^\\//, '');\n    if (chooseEndpoint(config, credentials) === 'api') {\n      return `${config.apiBaseUrl}/repos/${owner}/${name}/contents/${pathWithoutSlash}?ref=${ref}`;\n    }\n    return `${config.rawBaseUrl}/${owner}/${name}/${ref}/${pathWithoutSlash}`;\n  } catch (e) {\n    throw new Error(`Incorrect URL: ${url}, ${e}`);\n  }\n}\n\nexport function chooseEndpoint(\n  config: GithubIntegrationConfig,\n  credentials: GithubCredentials,\n): 'api' | 'raw' {\n  if (config.apiBaseUrl && (credentials.token || !config.rawBaseUrl)) {\n    return 'api';\n  }\n  return 'raw';\n}\n"],"names":[],"mappings":";;AAmCO,SAAS,qBAAA,CACd,GAAA,EACA,MAAA,EACA,WAAA,EACQ;AACR,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,IAAA,EAAM,GAAA,EAAK,cAAc,QAAA,EAAS,GAAI,gBAAgB,GAAG,CAAA;AACxE,IAAA,IACE,CAAC,KAAA,IACD,CAAC,IAAA,IACD,CAAC,GAAA;AAAA;AAAA,IAGA,YAAA,KAAiB,MAAA,IAChB,YAAA,KAAiB,KAAA,IACjB,iBAAiB,MAAA,EACnB;AACA,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnD,IAAA,IAAI,cAAA,CAAe,MAAA,EAAQ,WAAW,CAAA,KAAM,KAAA,EAAO;AACjD,MAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,OAAA,EAAU,KAAK,IAAI,IAAI,CAAA,UAAA,EAAa,gBAAgB,CAAA,KAAA,EAAQ,GAAG,CAAA,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,CAAA,EAAI,KAAK,IAAI,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA,CAAA;AAAA,EACzE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;AAEO,SAAS,cAAA,CACd,QACA,WAAA,EACe;AACf,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,CAAY,KAAA,IAAS,CAAC,OAAO,UAAA,CAAA,EAAa;AAClE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;;;;"}

package/dist/helpers.cjs.js

@@ -7,6 +7,27 @@ function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'defau
 
 var parseGitUrl__default = /*#__PURE__*/_interopDefaultCompat(parseGitUrl);
 
+function parseGitUrlSafe(url) {
+  const parsed = parseGitUrl__default.default(url);
+  if (parsed.filepath) {
+    let decoded = parsed.filepath;
+    let previous;
+    do {
+      previous = decoded;
+      try {
+        decoded = decodeURIComponent(decoded);
+      } catch {
+        break;
+      }
+    } while (decoded !== previous);
+    if (decoded.split("/").some((segment) => segment === ".." || segment === ".")) {
+      throw new Error(
+        "Invalid SCM URL: path traversal is not allowed in the URL"
+      );
+    }
+  }
+  return parsed;
+}
 function isValidHost(host) {
   const check = new URL("http://example.com");
   check.host = host;
@@ -47,7 +68,7 @@ function defaultScmResolveUrl(options) {
   }
   let updated;
   if (url.startsWith("/")) {
-    const { href, filepath } = parseGitUrl__default.default(base);
+    const { href, filepath } = parseGitUrlSafe(base);
     updated = new URL(href);
     const repoRootPath = lodash.trimEnd(
       updated.pathname.substring(0, updated.pathname.length - filepath.length),
@@ -68,4 +89,5 @@ exports.basicIntegrations = basicIntegrations;
 exports.defaultScmResolveUrl = defaultScmResolveUrl;
 exports.isValidHost = isValidHost;
 exports.isValidUrl = isValidUrl;
+exports.parseGitUrlSafe = parseGitUrlSafe;
 //# sourceMappingURL=helpers.cjs.js.map

package/dist/helpers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.cjs.js","sources":["../src/helpers.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport parseGitUrl from 'git-url-parse';\nimport { trimEnd } from 'lodash';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\n\n/** Checks whether the given argument is a valid URL hostname */\nexport function isValidHost(host: string): boolean {\n  const check = new URL('http://example.com');\n  check.host = host;\n  return check.host === host;\n}\n\n/** Checks whether the given argument is a valid URL */\nexport function isValidUrl(url: string): boolean {\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function basicIntegrations<T extends ScmIntegration>(\n  integrations: T[],\n  getHost: (integration: T) => string,\n): ScmIntegrationsGroup<T> {\n  return {\n    list(): T[] {\n      return integrations;\n    },\n    byUrl(url: string | URL): T | undefined {\n      try {\n        const parsed = typeof url === 'string' ? new URL(url) : url;\n        return integrations.find(i => getHost(i) === parsed.host);\n      } catch {\n        return undefined;\n      }\n    },\n    byHost(host: string): T | undefined {\n      return integrations.find(i => getHost(i) === host);\n    },\n  };\n}\n\n/**\n * Default implementation of {@link ScmIntegration} `resolveUrl`, that only\n * works with URL pathname based providers.\n *\n * @public\n */\nexport function defaultScmResolveUrl(options: {\n  url: string;\n  base: string;\n  lineNumber?: number;\n}): string {\n  const { url, base, lineNumber } = options;\n\n  // If it is a fully qualified URL - then return it verbatim\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return url;\n  } catch {\n    // ignore intentionally\n  }\n\n  let updated: URL;\n\n  if (url.startsWith('/')) {\n    // If it is an absolute path, move relative to the repo root\n    const { href, filepath } = parseGitUrl(base);\n\n    updated = new URL(href);\n\n    const repoRootPath = trimEnd(\n      updated.pathname.substring(0, updated.pathname.length - filepath.length),\n      '/',\n    );\n    updated.pathname = `${repoRootPath}${url}`;\n  } else {\n    // For relative URLs, just let the default URL constructor handle the\n    // resolving. Note that this essentially will treat the last segment of the\n    // base as a file - NOT a folder - unless the url ends in a slash.\n    updated = new URL(url, base);\n  }\n\n  updated.search = new URL(base).search;\n  if (lineNumber) {\n    updated.hash = `L${lineNumber}`;\n  }\n  return updated.toString();\n}\n\n/**\n * Sets up handlers for request mocking\n *\n * Copied from test-utils, as that is a frontend-only package\n *\n * @param worker - service worker\n */\nexport function registerMswTestHooks(worker: {\n  listen: (t: any) => void;\n  close: () => void;\n  resetHandlers: () => void;\n}) {\n  beforeAll(() => worker.listen({ onUnhandledRequest: 'error' }));\n  afterAll(() => worker.close());\n  afterEach(() => worker.resetHandlers());\n}\n"],"names":["parseGitUrl","trimEnd"],"mappings":";;;;;;;;;AAqBO,SAAS,YAAY,IAAA,EAAuB;AACjD,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,oBAAoB,CAAA;AAC1C,EAAA,KAAA,CAAM,IAAA,GAAO,IAAA;AACb,EAAA,OAAO,MAAM,IAAA,KAAS,IAAA;AACxB;AAGO,SAAS,WAAW,GAAA,EAAsB;AAC/C,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,iBAAA,CACd,cACA,OAAA,EACyB;AACzB,EAAA,OAAO;AAAA,IACL,IAAA,GAAY;AACV,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,GAAA,EAAkC;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAO,GAAA,KAAQ,WAAW,IAAI,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AACxD,QAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,QAAQ,CAAC,CAAA,KAAM,OAAO,IAAI,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IACA,OAAO,IAAA,EAA6B;AAClC,MAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,CAAC,MAAM,IAAI,CAAA;AAAA,IACnD;AAAA,GACF;AACF;AAQO,SAAS,qBAAqB,OAAA,EAI1B;AACT,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,UAAA,EAAW,GAAI,OAAA;AAGlC,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AAEvB,IAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAIA,6BAAY,IAAI,CAAA;AAE3C,IAAA,OAAA,GAAU,IAAI,IAAI,IAAI,CAAA;AAEtB,IAAA,MAAM,YAAA,GAAeC,cAAA;AAAA,MACnB,OAAA,CAAQ,SAAS,SAAA,CAAU,CAAA,EAAG,QAAQ,QAAA,CAAS,MAAA,GAAS,SAAS,MAAM,CAAA;AAAA,MACvE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,YAAY,CAAA,EAAG,GAAG,CAAA,CAAA;AAAA,EAC1C,CAAA,MAAO;AAIL,IAAA,OAAA,GAAU,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,GAAA,CAAI,IAAI,CAAA,CAAE,MAAA;AAC/B,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAA,CAAQ,IAAA,GAAO,IAAI,UAAU,CAAA,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;;;;;;;"}
+{"version":3,"file":"helpers.cjs.js","sources":["../src/helpers.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport parseGitUrl from 'git-url-parse';\nimport { trimEnd } from 'lodash';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\n\n/**\n * Wraps git-url-parse and rejects URLs whose filepath contains path traversal\n * segments. Without this check, a URL like\n * `https://github.com/o/r/blob/main/%2e%2e%2f%2e%2e%2fuser/repos` would be\n * decoded to `../../user/repos` and could escape the expected API path when\n * interpolated into provider API URLs.\n */\nexport function parseGitUrlSafe(url: string) {\n  const parsed = parseGitUrl(url);\n  if (parsed.filepath) {\n    let decoded = parsed.filepath;\n    let previous;\n    do {\n      previous = decoded;\n      try {\n        decoded = decodeURIComponent(decoded);\n      } catch {\n        break;\n      }\n    } while (decoded !== previous);\n\n    if (\n      decoded.split('/').some(segment => segment === '..' || segment === '.')\n    ) {\n      throw new Error(\n        'Invalid SCM URL: path traversal is not allowed in the URL',\n      );\n    }\n  }\n  return parsed;\n}\n\n/** Checks whether the given argument is a valid URL hostname */\nexport function isValidHost(host: string): boolean {\n  const check = new URL('http://example.com');\n  check.host = host;\n  return check.host === host;\n}\n\n/** Checks whether the given argument is a valid URL */\nexport function isValidUrl(url: string): boolean {\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function basicIntegrations<T extends ScmIntegration>(\n  integrations: T[],\n  getHost: (integration: T) => string,\n): ScmIntegrationsGroup<T> {\n  return {\n    list(): T[] {\n      return integrations;\n    },\n    byUrl(url: string | URL): T | undefined {\n      try {\n        const parsed = typeof url === 'string' ? new URL(url) : url;\n        return integrations.find(i => getHost(i) === parsed.host);\n      } catch {\n        return undefined;\n      }\n    },\n    byHost(host: string): T | undefined {\n      return integrations.find(i => getHost(i) === host);\n    },\n  };\n}\n\n/**\n * Default implementation of {@link ScmIntegration} `resolveUrl`, that only\n * works with URL pathname based providers.\n *\n * @public\n */\nexport function defaultScmResolveUrl(options: {\n  url: string;\n  base: string;\n  lineNumber?: number;\n}): string {\n  const { url, base, lineNumber } = options;\n\n  // If it is a fully qualified URL - then return it verbatim\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return url;\n  } catch {\n    // ignore intentionally\n  }\n\n  let updated: URL;\n\n  if (url.startsWith('/')) {\n    // If it is an absolute path, move relative to the repo root\n    const { href, filepath } = parseGitUrlSafe(base);\n\n    updated = new URL(href);\n\n    const repoRootPath = trimEnd(\n      updated.pathname.substring(0, updated.pathname.length - filepath.length),\n      '/',\n    );\n    updated.pathname = `${repoRootPath}${url}`;\n  } else {\n    // For relative URLs, just let the default URL constructor handle the\n    // resolving. Note that this essentially will treat the last segment of the\n    // base as a file - NOT a folder - unless the url ends in a slash.\n    updated = new URL(url, base);\n  }\n\n  updated.search = new URL(base).search;\n  if (lineNumber) {\n    updated.hash = `L${lineNumber}`;\n  }\n  return updated.toString();\n}\n\n/**\n * Sets up handlers for request mocking\n *\n * Copied from test-utils, as that is a frontend-only package\n *\n * @param worker - service worker\n */\nexport function registerMswTestHooks(worker: {\n  listen: (t: any) => void;\n  close: () => void;\n  resetHandlers: () => void;\n}) {\n  beforeAll(() => worker.listen({ onUnhandledRequest: 'error' }));\n  afterAll(() => worker.close());\n  afterEach(() => worker.resetHandlers());\n}\n"],"names":["parseGitUrl","trimEnd"],"mappings":";;;;;;;;;AA2BO,SAAS,gBAAgB,GAAA,EAAa;AAC3C,EAAA,MAAM,MAAA,GAASA,6BAAY,GAAG,CAAA;AAC9B,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,IAAI,UAAU,MAAA,CAAO,QAAA;AACrB,IAAA,IAAI,QAAA;AACJ,IAAA,GAAG;AACD,MAAA,QAAA,GAAW,OAAA;AACX,MAAA,IAAI;AACF,QAAA,OAAA,GAAU,mBAAmB,OAAO,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AAAA,IACF,SAAS,OAAA,KAAY,QAAA;AAErB,IAAA,IACE,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,IAAA,CAAK,aAAW,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,GAAG,CAAA,EACtE;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,YAAY,IAAA,EAAuB;AACjD,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,oBAAoB,CAAA;AAC1C,EAAA,KAAA,CAAM,IAAA,GAAO,IAAA;AACb,EAAA,OAAO,MAAM,IAAA,KAAS,IAAA;AACxB;AAGO,SAAS,WAAW,GAAA,EAAsB;AAC/C,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,iBAAA,CACd,cACA,OAAA,EACyB;AACzB,EAAA,OAAO;AAAA,IACL,IAAA,GAAY;AACV,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,GAAA,EAAkC;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAO,GAAA,KAAQ,WAAW,IAAI,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AACxD,QAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,QAAQ,CAAC,CAAA,KAAM,OAAO,IAAI,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IACA,OAAO,IAAA,EAA6B;AAClC,MAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,CAAC,MAAM,IAAI,CAAA;AAAA,IACnD;AAAA,GACF;AACF;AAQO,SAAS,qBAAqB,OAAA,EAI1B;AACT,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,UAAA,EAAW,GAAI,OAAA;AAGlC,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AAEvB,IAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,gBAAgB,IAAI,CAAA;AAE/C,IAAA,OAAA,GAAU,IAAI,IAAI,IAAI,CAAA;AAEtB,IAAA,MAAM,YAAA,GAAeC,cAAA;AAAA,MACnB,OAAA,CAAQ,SAAS,SAAA,CAAU,CAAA,EAAG,QAAQ,QAAA,CAAS,MAAA,GAAS,SAAS,MAAM,CAAA;AAAA,MACvE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,YAAY,CAAA,EAAG,GAAG,CAAA,CAAA;AAAA,EAC1C,CAAA,MAAO;AAIL,IAAA,OAAA,GAAU,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,GAAA,CAAI,IAAI,CAAA,CAAE,MAAA;AAC/B,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAA,CAAQ,IAAA,GAAO,IAAI,UAAU,CAAA,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;;;;;;;;"}

package/dist/helpers.esm.js

@@ -1,6 +1,27 @@
 import parseGitUrl from 'git-url-parse';
 import { trimEnd } from 'lodash';
 
+function parseGitUrlSafe(url) {
+  const parsed = parseGitUrl(url);
+  if (parsed.filepath) {
+    let decoded = parsed.filepath;
+    let previous;
+    do {
+      previous = decoded;
+      try {
+        decoded = decodeURIComponent(decoded);
+      } catch {
+        break;
+      }
+    } while (decoded !== previous);
+    if (decoded.split("/").some((segment) => segment === ".." || segment === ".")) {
+      throw new Error(
+        "Invalid SCM URL: path traversal is not allowed in the URL"
+      );
+    }
+  }
+  return parsed;
+}
 function isValidHost(host) {
   const check = new URL("http://example.com");
   check.host = host;
@@ -41,7 +62,7 @@ function defaultScmResolveUrl(options) {
   }
   let updated;
   if (url.startsWith("/")) {
-    const { href, filepath } = parseGitUrl(base);
+    const { href, filepath } = parseGitUrlSafe(base);
     updated = new URL(href);
     const repoRootPath = trimEnd(
       updated.pathname.substring(0, updated.pathname.length - filepath.length),
@@ -58,5 +79,5 @@ function defaultScmResolveUrl(options) {
   return updated.toString();
 }
 
-export { basicIntegrations, defaultScmResolveUrl, isValidHost, isValidUrl };
+export { basicIntegrations, defaultScmResolveUrl, isValidHost, isValidUrl, parseGitUrlSafe };
 //# sourceMappingURL=helpers.esm.js.map

package/dist/helpers.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.esm.js","sources":["../src/helpers.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport parseGitUrl from 'git-url-parse';\nimport { trimEnd } from 'lodash';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\n\n/** Checks whether the given argument is a valid URL hostname */\nexport function isValidHost(host: string): boolean {\n  const check = new URL('http://example.com');\n  check.host = host;\n  return check.host === host;\n}\n\n/** Checks whether the given argument is a valid URL */\nexport function isValidUrl(url: string): boolean {\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function basicIntegrations<T extends ScmIntegration>(\n  integrations: T[],\n  getHost: (integration: T) => string,\n): ScmIntegrationsGroup<T> {\n  return {\n    list(): T[] {\n      return integrations;\n    },\n    byUrl(url: string | URL): T | undefined {\n      try {\n        const parsed = typeof url === 'string' ? new URL(url) : url;\n        return integrations.find(i => getHost(i) === parsed.host);\n      } catch {\n        return undefined;\n      }\n    },\n    byHost(host: string): T | undefined {\n      return integrations.find(i => getHost(i) === host);\n    },\n  };\n}\n\n/**\n * Default implementation of {@link ScmIntegration} `resolveUrl`, that only\n * works with URL pathname based providers.\n *\n * @public\n */\nexport function defaultScmResolveUrl(options: {\n  url: string;\n  base: string;\n  lineNumber?: number;\n}): string {\n  const { url, base, lineNumber } = options;\n\n  // If it is a fully qualified URL - then return it verbatim\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return url;\n  } catch {\n    // ignore intentionally\n  }\n\n  let updated: URL;\n\n  if (url.startsWith('/')) {\n    // If it is an absolute path, move relative to the repo root\n    const { href, filepath } = parseGitUrl(base);\n\n    updated = new URL(href);\n\n    const repoRootPath = trimEnd(\n      updated.pathname.substring(0, updated.pathname.length - filepath.length),\n      '/',\n    );\n    updated.pathname = `${repoRootPath}${url}`;\n  } else {\n    // For relative URLs, just let the default URL constructor handle the\n    // resolving. Note that this essentially will treat the last segment of the\n    // base as a file - NOT a folder - unless the url ends in a slash.\n    updated = new URL(url, base);\n  }\n\n  updated.search = new URL(base).search;\n  if (lineNumber) {\n    updated.hash = `L${lineNumber}`;\n  }\n  return updated.toString();\n}\n\n/**\n * Sets up handlers for request mocking\n *\n * Copied from test-utils, as that is a frontend-only package\n *\n * @param worker - service worker\n */\nexport function registerMswTestHooks(worker: {\n  listen: (t: any) => void;\n  close: () => void;\n  resetHandlers: () => void;\n}) {\n  beforeAll(() => worker.listen({ onUnhandledRequest: 'error' }));\n  afterAll(() => worker.close());\n  afterEach(() => worker.resetHandlers());\n}\n"],"names":[],"mappings":";;;AAqBO,SAAS,YAAY,IAAA,EAAuB;AACjD,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,oBAAoB,CAAA;AAC1C,EAAA,KAAA,CAAM,IAAA,GAAO,IAAA;AACb,EAAA,OAAO,MAAM,IAAA,KAAS,IAAA;AACxB;AAGO,SAAS,WAAW,GAAA,EAAsB;AAC/C,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,iBAAA,CACd,cACA,OAAA,EACyB;AACzB,EAAA,OAAO;AAAA,IACL,IAAA,GAAY;AACV,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,GAAA,EAAkC;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAO,GAAA,KAAQ,WAAW,IAAI,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AACxD,QAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,QAAQ,CAAC,CAAA,KAAM,OAAO,IAAI,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IACA,OAAO,IAAA,EAA6B;AAClC,MAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,CAAC,MAAM,IAAI,CAAA;AAAA,IACnD;AAAA,GACF;AACF;AAQO,SAAS,qBAAqB,OAAA,EAI1B;AACT,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,UAAA,EAAW,GAAI,OAAA;AAGlC,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AAEvB,IAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,YAAY,IAAI,CAAA;AAE3C,IAAA,OAAA,GAAU,IAAI,IAAI,IAAI,CAAA;AAEtB,IAAA,MAAM,YAAA,GAAe,OAAA;AAAA,MACnB,OAAA,CAAQ,SAAS,SAAA,CAAU,CAAA,EAAG,QAAQ,QAAA,CAAS,MAAA,GAAS,SAAS,MAAM,CAAA;AAAA,MACvE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,YAAY,CAAA,EAAG,GAAG,CAAA,CAAA;AAAA,EAC1C,CAAA,MAAO;AAIL,IAAA,OAAA,GAAU,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,GAAA,CAAI,IAAI,CAAA,CAAE,MAAA;AAC/B,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAA,CAAQ,IAAA,GAAO,IAAI,UAAU,CAAA,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;;;;"}
+{"version":3,"file":"helpers.esm.js","sources":["../src/helpers.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport parseGitUrl from 'git-url-parse';\nimport { trimEnd } from 'lodash';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\n\n/**\n * Wraps git-url-parse and rejects URLs whose filepath contains path traversal\n * segments. Without this check, a URL like\n * `https://github.com/o/r/blob/main/%2e%2e%2f%2e%2e%2fuser/repos` would be\n * decoded to `../../user/repos` and could escape the expected API path when\n * interpolated into provider API URLs.\n */\nexport function parseGitUrlSafe(url: string) {\n  const parsed = parseGitUrl(url);\n  if (parsed.filepath) {\n    let decoded = parsed.filepath;\n    let previous;\n    do {\n      previous = decoded;\n      try {\n        decoded = decodeURIComponent(decoded);\n      } catch {\n        break;\n      }\n    } while (decoded !== previous);\n\n    if (\n      decoded.split('/').some(segment => segment === '..' || segment === '.')\n    ) {\n      throw new Error(\n        'Invalid SCM URL: path traversal is not allowed in the URL',\n      );\n    }\n  }\n  return parsed;\n}\n\n/** Checks whether the given argument is a valid URL hostname */\nexport function isValidHost(host: string): boolean {\n  const check = new URL('http://example.com');\n  check.host = host;\n  return check.host === host;\n}\n\n/** Checks whether the given argument is a valid URL */\nexport function isValidUrl(url: string): boolean {\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function basicIntegrations<T extends ScmIntegration>(\n  integrations: T[],\n  getHost: (integration: T) => string,\n): ScmIntegrationsGroup<T> {\n  return {\n    list(): T[] {\n      return integrations;\n    },\n    byUrl(url: string | URL): T | undefined {\n      try {\n        const parsed = typeof url === 'string' ? new URL(url) : url;\n        return integrations.find(i => getHost(i) === parsed.host);\n      } catch {\n        return undefined;\n      }\n    },\n    byHost(host: string): T | undefined {\n      return integrations.find(i => getHost(i) === host);\n    },\n  };\n}\n\n/**\n * Default implementation of {@link ScmIntegration} `resolveUrl`, that only\n * works with URL pathname based providers.\n *\n * @public\n */\nexport function defaultScmResolveUrl(options: {\n  url: string;\n  base: string;\n  lineNumber?: number;\n}): string {\n  const { url, base, lineNumber } = options;\n\n  // If it is a fully qualified URL - then return it verbatim\n  try {\n    // eslint-disable-next-line no-new\n    new URL(url);\n    return url;\n  } catch {\n    // ignore intentionally\n  }\n\n  let updated: URL;\n\n  if (url.startsWith('/')) {\n    // If it is an absolute path, move relative to the repo root\n    const { href, filepath } = parseGitUrlSafe(base);\n\n    updated = new URL(href);\n\n    const repoRootPath = trimEnd(\n      updated.pathname.substring(0, updated.pathname.length - filepath.length),\n      '/',\n    );\n    updated.pathname = `${repoRootPath}${url}`;\n  } else {\n    // For relative URLs, just let the default URL constructor handle the\n    // resolving. Note that this essentially will treat the last segment of the\n    // base as a file - NOT a folder - unless the url ends in a slash.\n    updated = new URL(url, base);\n  }\n\n  updated.search = new URL(base).search;\n  if (lineNumber) {\n    updated.hash = `L${lineNumber}`;\n  }\n  return updated.toString();\n}\n\n/**\n * Sets up handlers for request mocking\n *\n * Copied from test-utils, as that is a frontend-only package\n *\n * @param worker - service worker\n */\nexport function registerMswTestHooks(worker: {\n  listen: (t: any) => void;\n  close: () => void;\n  resetHandlers: () => void;\n}) {\n  beforeAll(() => worker.listen({ onUnhandledRequest: 'error' }));\n  afterAll(() => worker.close());\n  afterEach(() => worker.resetHandlers());\n}\n"],"names":[],"mappings":";;;AA2BO,SAAS,gBAAgB,GAAA,EAAa;AAC3C,EAAA,MAAM,MAAA,GAAS,YAAY,GAAG,CAAA;AAC9B,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,IAAI,UAAU,MAAA,CAAO,QAAA;AACrB,IAAA,IAAI,QAAA;AACJ,IAAA,GAAG;AACD,MAAA,QAAA,GAAW,OAAA;AACX,MAAA,IAAI;AACF,QAAA,OAAA,GAAU,mBAAmB,OAAO,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AAAA,IACF,SAAS,OAAA,KAAY,QAAA;AAErB,IAAA,IACE,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,IAAA,CAAK,aAAW,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,GAAG,CAAA,EACtE;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,YAAY,IAAA,EAAuB;AACjD,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,oBAAoB,CAAA;AAC1C,EAAA,KAAA,CAAM,IAAA,GAAO,IAAA;AACb,EAAA,OAAO,MAAM,IAAA,KAAS,IAAA;AACxB;AAGO,SAAS,WAAW,GAAA,EAAsB;AAC/C,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,iBAAA,CACd,cACA,OAAA,EACyB;AACzB,EAAA,OAAO;AAAA,IACL,IAAA,GAAY;AACV,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,GAAA,EAAkC;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAO,GAAA,KAAQ,WAAW,IAAI,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AACxD,QAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,QAAQ,CAAC,CAAA,KAAM,OAAO,IAAI,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IACA,OAAO,IAAA,EAA6B;AAClC,MAAA,OAAO,aAAa,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,CAAC,MAAM,IAAI,CAAA;AAAA,IACnD;AAAA,GACF;AACF;AAQO,SAAS,qBAAqB,OAAA,EAI1B;AACT,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,UAAA,EAAW,GAAI,OAAA;AAGlC,EAAA,IAAI;AAEF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AAEvB,IAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,gBAAgB,IAAI,CAAA;AAE/C,IAAA,OAAA,GAAU,IAAI,IAAI,IAAI,CAAA;AAEtB,IAAA,MAAM,YAAA,GAAe,OAAA;AAAA,MACnB,OAAA,CAAQ,SAAS,SAAA,CAAU,CAAA,EAAG,QAAQ,QAAA,CAAS,MAAA,GAAS,SAAS,MAAM,CAAA;AAAA,MACvE;AAAA,KACF;AACA,IAAA,OAAA,CAAQ,QAAA,GAAW,CAAA,EAAG,YAAY,CAAA,EAAG,GAAG,CAAA,CAAA;AAAA,EAC1C,CAAA,MAAO;AAIL,IAAA,OAAA,GAAU,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,GAAA,CAAI,IAAI,CAAA,CAAE,MAAA;AAC/B,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAA,CAAQ,IAAA,GAAO,IAAI,UAAU,CAAA,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/integration",
-  "version": "2.0.0-next.1",
+  "version": "2.0.0",
   "description": "Helpers for managing integrations towards external systems",
   "backstage": {
     "role": "common-library"
@@ -39,8 +39,8 @@
   "dependencies": {
     "@azure/identity": "^4.0.0",
     "@azure/storage-blob": "^12.5.0",
-    "@backstage/config": "1.3.6",
-    "@backstage/errors": "1.2.7",
+    "@backstage/config": "^1.3.6",
+    "@backstage/errors": "^1.2.7",
     "@octokit/auth-app": "^4.0.0",
     "@octokit/rest": "^19.0.3",
     "cross-fetch": "^4.0.0",
@@ -50,8 +50,8 @@
     "p-throttle": "^4.1.1"
   },
   "devDependencies": {
-    "@backstage/cli": "0.36.0-next.1",
-    "@backstage/config-loader": "1.10.9-next.0",
+    "@backstage/cli": "^0.36.0",
+    "@backstage/config-loader": "^1.10.9",
     "msw": "^1.0.0"
   },
   "configSchema": "config.d.ts",