@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/src/slack/handlers.ts

@@ -79,8 +79,6 @@ const allowedUserIds = (process.env.SLACK_ALLOWED_USER_IDS || "")
   .map((id) => id.trim())
   .filter(Boolean);
 
-const filteringEnabled = allowedEmailDomains.length > 0 || allowedUserIds.length > 0;
-
 /**
  * Configuration for user filtering.
  */
@@ -89,6 +87,8 @@ export interface UserFilterConfig {
   allowedUserIds: string[];
 }
 
+const envUserFilterConfig: UserFilterConfig = { allowedEmailDomains, allowedUserIds };
+
 /**
  * Core logic for checking if a user is allowed based on email and/or user ID.
  * Exported for testing.
@@ -137,40 +137,31 @@ export function checkUserAccess(
 /**
  * Check if a user is allowed to interact with the swarm.
  * Returns true if filtering is disabled, user is in whitelist, or user's email domain is allowed.
+ * The allow/deny decision is `checkUserAccess`; this wrapper only adds the lazy email lookup
+ * and the deny logs. The config comes from the SLACK_ALLOWED_* env vars, read at module load.
  */
 export async function isUserAllowed(client: WebClient, userId: string): Promise<boolean> {
-  // If no filtering configured, allow all users (backwards compatible)
-  if (!filteringEnabled) {
-    return true;
-  }
-
-  // Check user ID whitelist first (fast path)
-  if (allowedUserIds.includes(userId)) {
-    return true;
-  }
-
-  // No email domains configured and not in user whitelist
-  if (allowedEmailDomains.length === 0) {
-    return false;
+  const config = envUserFilterConfig;
+  // Decide without an email first: filtering off and allowlisted IDs pass, and with no
+  // email domains configured an unlisted ID is denied. Only domain checks need a lookup.
+  const allowedWithoutEmail = checkUserAccess(userId, null, config);
+  if (allowedWithoutEmail || config.allowedEmailDomains.length === 0) {
+    return allowedWithoutEmail;
   }
 
   // Check email domain — uses kv-backed enrichment (24h TTL, only success cached).
   const email = await enrichSlackUserEmail(client, userId);
+  const allowed = checkUserAccess(userId, email, config);
 
-  if (!email) {
-    console.log(`[Slack] User ${userId} has no email, denying access`);
-    return false;
-  }
-
-  const domain = email.split("@")[1]?.toLowerCase();
-  if (!domain) {
-    console.log(`[Slack] User ${userId} has invalid email format, denying access`);
-    return false;
-  }
-
-  const allowed = allowedEmailDomains.includes(domain);
   if (!allowed) {
-    console.log(`[Slack] User ${userId} email domain "${domain}" not in allowed list`);
+    const domain = email?.split("@")[1]?.toLowerCase();
+    if (!email) {
+      console.log(`[Slack] User ${userId} has no email, denying access`);
+    } else if (!domain) {
+      console.log(`[Slack] User ${userId} has invalid email format, denying access`);
+    } else {
+      console.log(`[Slack] User ${userId} email domain "${domain}" not in allowed list`);
+    }
   }
   return allowed;
 }

package/src/tasks/context-key.ts

@@ -21,6 +21,10 @@
  *   task:trackers:gitlab:{projectId}:{mr|issue}:{iid}
  *   task:trackers:azure-devops:{repositoryId}:pr:{pullRequestId}
  *   task:trackers:azure-devops:{organization}:workitem:{workItemId}
+ *   task:trackers:bitbucket:{repoUuid}:pr:{pullRequestId}
+ *                                                 (repo UUID with Bitbucket's `{}` braces
+ *                                                  stripped and lowercased, so renames keep
+ *                                                  task threads)
  *   task:trackers:linear:{issueIdentifier}        (e.g. DES-42 — case preserved)
  *   task:trackers:jira:{issueIdentifier}          (e.g. PROJ-123 — case preserved)
  *   task:schedule:{scheduleId}
@@ -50,7 +54,13 @@ export type ContextKeyFamily =
   | "schedule"
   | "workflow";
 
-export type TrackerProvider = "github" | "gitlab" | "azure-devops" | "linear" | "jira";
+export type TrackerProvider =
+  | "github"
+  | "gitlab"
+  | "azure-devops"
+  | "bitbucket"
+  | "linear"
+  | "jira";
 
 export type ParsedContextKey =
   | { family: "slack"; parts: { channelId: string; threadTs: string } }
@@ -76,6 +86,11 @@ export type ParsedContextKey =
       subFamily: "azure-devops";
       parts: { organization: string; kind: "workitem"; workItemId: number };
     }
+  | {
+      family: "trackers";
+      subFamily: "bitbucket";
+      parts: { repoUuid: string; kind: "pr"; pullRequestId: number };
+    }
   | {
       family: "trackers";
       subFamily: "linear";
@@ -224,6 +239,34 @@ export function azureDevOpsWorkItemContextKey(input: {
   return ["task", "trackers", "azure-devops", organization, "workitem", workItemId].join(SEPARATOR);
 }
 
+/**
+ * Bitbucket Cloud wraps repository UUIDs in braces (`{1a2b...}`). Strip them
+ * and lowercase so the key is stable regardless of which payload field the
+ * UUID came from.
+ */
+export function bitbucketContextKey({
+  repoUuid,
+  pullRequestId,
+}: {
+  repoUuid: string;
+  pullRequestId: number | string;
+}): string {
+  const rawUuid = typeof repoUuid === "string" ? repoUuid.trim().replace(/^\{|\}$/g, "") : repoUuid;
+  const uuid = assertSafePart(rawUuid, "repoUuid").toLowerCase();
+  if (/[{}]/.test(uuid)) {
+    throw new Error(
+      `context-key: bitbucket "repoUuid" has unbalanced braces (got ${JSON.stringify(repoUuid)})`,
+    );
+  }
+  const id = assertSafePart(pullRequestId, "pullRequestId");
+  if (!/^\d+$/.test(id)) {
+    throw new Error(
+      `context-key: bitbucket "pullRequestId" must be a positive integer (got ${JSON.stringify(id)})`,
+    );
+  }
+  return ["task", "trackers", "bitbucket", uuid, "pr", id].join(SEPARATOR);
+}
+
 export function linearContextKey(input: { issueIdentifier: string }): string {
   const issueIdentifier = assertSafePart(input.issueIdentifier, "issueIdentifier");
   return ["task", "trackers", "linear", issueIdentifier].join(SEPARATOR);
@@ -401,6 +444,23 @@ export function parseContextKey(key: string): ParsedContextKey {
           parts: { repositoryId: parts[3] as string, kind: "pr", pullRequestId },
         };
       }
+      if (subFamily === "bitbucket") {
+        if (parts.length !== 6 || parts[4] !== "pr" || !parts[3]) {
+          throw new Error(`context-key: malformed bitbucket key: ${JSON.stringify(key)}`);
+        }
+        const idStr = parts[5] as string;
+        const pullRequestId = Number.parseInt(idStr, 10);
+        if (!/^\d+$/.test(idStr) || !Number.isFinite(pullRequestId)) {
+          throw new Error(
+            `context-key: malformed bitbucket pullRequestId "${idStr}": ${JSON.stringify(key)}`,
+          );
+        }
+        return {
+          family: "trackers",
+          subFamily: "bitbucket",
+          parts: { repoUuid: parts[3] as string, kind: "pr", pullRequestId },
+        };
+      }
       if (subFamily === "linear") {
         if (parts.length !== 4) {
           throw new Error(`context-key: malformed linear key: ${JSON.stringify(key)}`);

package/src/tests/bitbucket-auth.test.ts

@@ -0,0 +1,156 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createHmac } from "node:crypto";
+import { resetBitbucketBotCache, resolveBitbucketBotAccountId } from "../bitbucket/api";
+import {
+  getBitbucketToken,
+  initBitbucket,
+  isBitbucketEnabled,
+  resetBitbucket,
+  verifyBitbucketWebhook,
+} from "../bitbucket/auth";
+
+const ENV_KEYS = [
+  "BITBUCKET_WEBHOOK_SECRET",
+  "BITBUCKET_TOKEN",
+  "BITBUCKET_DISABLE",
+  "BITBUCKET_BOT_ACCOUNT_ID",
+] as const;
+
+function sign(secret: string, body: string): string {
+  return `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+}
+
+afterEach(() => {
+  for (const key of ENV_KEYS) delete process.env[key];
+  resetBitbucket();
+  resetBitbucketBotCache();
+});
+
+describe("isBitbucketEnabled", () => {
+  test("disabled without a webhook secret", () => {
+    expect(isBitbucketEnabled()).toBe(false);
+  });
+
+  test("enabled with a webhook secret", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    expect(isBitbucketEnabled()).toBe(true);
+  });
+
+  test("BITBUCKET_DISABLE wins over the secret", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    process.env.BITBUCKET_DISABLE = "true";
+    expect(isBitbucketEnabled()).toBe(false);
+  });
+});
+
+describe("verifyBitbucketWebhook", () => {
+  test("matches Atlassian's documented test vector", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "It's a Secret to Everybody";
+    initBitbucket();
+    expect(
+      verifyBitbucketWebhook(
+        "Hello World!",
+        "sha256=a4771c39fbe90f317c7824e83ddef3caae9cb3d976c214ace1f2937e133263c9",
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects a signature made with the wrong secret", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    initBitbucket();
+    expect(verifyBitbucketWebhook("{}", sign("other-secret", "{}"))).toBe(false);
+    expect(verifyBitbucketWebhook("{}", sign("example-secret", "{}"))).toBe(true);
+  });
+
+  test("rejects a tampered body", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    initBitbucket();
+    expect(verifyBitbucketWebhook('{"a":2}', sign("example-secret", '{"a":1}'))).toBe(false);
+  });
+
+  test("rejects a missing header", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    initBitbucket();
+    expect(verifyBitbucketWebhook("{}", undefined)).toBe(false);
+  });
+
+  test("rejects a bare hex digest without the sha256= prefix", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    initBitbucket();
+    const bare = sign("example-secret", "{}").slice("sha256=".length);
+    expect(verifyBitbucketWebhook("{}", bare)).toBe(false);
+  });
+
+  test("rejects everything before init and after reset", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    const sig = sign("example-secret", "{}");
+    expect(verifyBitbucketWebhook("{}", sig)).toBe(false);
+    initBitbucket();
+    expect(verifyBitbucketWebhook("{}", sig)).toBe(true);
+    resetBitbucket();
+    expect(verifyBitbucketWebhook("{}", sig)).toBe(false);
+  });
+});
+
+describe("initBitbucket", () => {
+  test("does not initialize when disabled", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    process.env.BITBUCKET_TOKEN = "example-token";
+    process.env.BITBUCKET_DISABLE = "true";
+    initBitbucket();
+    expect(getBitbucketToken()).toBeNull();
+  });
+
+  test("loads the API token", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    process.env.BITBUCKET_TOKEN = "example-token";
+    initBitbucket();
+    expect(getBitbucketToken()).toBe("example-token");
+  });
+});
+
+describe("resolveBitbucketBotAccountId", () => {
+  test("prefers BITBUCKET_BOT_ACCOUNT_ID", async () => {
+    process.env.BITBUCKET_BOT_ACCOUNT_ID = "557058:env-bot";
+    expect(await resolveBitbucketBotAccountId()).toBe("557058:env-bot");
+  });
+
+  test("returns null without a token", async () => {
+    expect(await resolveBitbucketBotAccountId()).toBeNull();
+  });
+
+  test("resolves GET /user with a Bearer token and caches it", async () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    process.env.BITBUCKET_TOKEN = "example-token";
+    initBitbucket();
+    const calls: Array<{ url: string; auth?: string }> = [];
+    const realFetch = globalThis.fetch;
+    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+      const headers = (init?.headers ?? {}) as Record<string, string>;
+      calls.push({ url: String(input), auth: headers.Authorization });
+      return new Response(JSON.stringify({ account_id: "557058:api-bot" }), { status: 200 });
+    }) as typeof fetch;
+    try {
+      expect(await resolveBitbucketBotAccountId()).toBe("557058:api-bot");
+      expect(await resolveBitbucketBotAccountId()).toBe("557058:api-bot");
+    } finally {
+      globalThis.fetch = realFetch;
+    }
+    expect(calls).toEqual([
+      { url: "https://api.bitbucket.org/2.0/user", auth: "Bearer example-token" },
+    ]);
+  });
+
+  test("returns null on a failed lookup", async () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "example-secret";
+    process.env.BITBUCKET_TOKEN = "example-token";
+    initBitbucket();
+    const realFetch = globalThis.fetch;
+    globalThis.fetch = (async () => new Response("nope", { status: 401 })) as typeof fetch;
+    try {
+      expect(await resolveBitbucketBotAccountId()).toBeNull();
+    } finally {
+      globalThis.fetch = realFetch;
+    }
+  });
+});