@gitkraken/core-gitlens 0.4.100 → 0.5.100

package/src/plus/integrations/models/gitHostIntegration.ts

@@ -104,6 +104,21 @@ export type SearchMyPullRequestsOptions = {
 	includeReviewRequested?: boolean;
 };
 
+/**
+ * Rejects a read the provider can't serve as asked: logs the reason and returns it as the `{ error }` half of an
+ * {@link IntegrationResult}, timed from `start`.
+ *
+ * A single builder because these refusals are a contract, not incidental returns — the read cores below reject on
+ * unsupported input, an inexpressible filter set, or an unresolvable filter account, and each one must reach the
+ * caller as an error it can surface as a warning rather than as an empty success. Writing the message once also
+ * keeps the logged text and the thrown text from drifting apart, which is exactly what happened while each site
+ * spelled its message out twice.
+ */
+function unsupportedRead<T>(message: string, start: number, logContext?: string): IntegrationResult<T> {
+	Logger.warn(message, logContext);
+	return { error: new Error(message), duration: performance.now() - start };
+}
+
 export abstract class GitHostIntegration<
 	ID extends IntegrationIds = IntegrationIds,
 	T extends ResourceDescriptor = ResourceDescriptor,
@@ -289,15 +304,6 @@ export abstract class GitHostIntegration<
 		cancellation?: AbortSignal,
 	): Promise<RepositoryMetadata | undefined>;
 
-	/**
-	 * Lists the organizations (orgs/workspaces/groups) the current user belongs to on this host.
-	 * `truncated === true` means the defensive page-drain backstop stopped before the upstream listing
-	 * was exhausted.
-	 */
-	async getOrganizationsForUser(): Promise<ProviderHierarchyResult<ProviderOrganization> | undefined> {
-		return (await this.getOrganizationsForUserResult())?.value;
-	}
-
 	/**
 	 * Whether this git host implements generic org discovery. False for providers that register no
 	 * {@link getProviderOrganizationsForUser} hook (e.g. Bitbucket Data Center) — the facade uses this to
@@ -344,9 +350,13 @@ export abstract class GitHostIntegration<
 	}
 
 	/**
-	 * Result-returning core of {@link getOrganizationsForUser}. Resolves the session for `connectionId`
-	 * (or the primary connection when omitted, honoring multi-account reads) and recovers a thrown error
-	 * into `{ error }` so callers can surface it as a warning instead of swallowing it to `undefined`.
+	 * Lists the organizations (orgs/workspaces/groups) the current user belongs to on this host.
+	 * `truncated === true` means the defensive page-drain backstop stopped before the upstream listing was
+	 * exhausted.
+	 *
+	 * Resolves the session for `connectionId` (or the primary connection when omitted, honoring multi-account
+	 * reads) and recovers a thrown error into `{ error }` so callers can surface it as a warning instead of
+	 * swallowing it to `undefined`.
 	 */
 	@trace()
 	async getOrganizationsForUserResult(
@@ -363,7 +373,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getOrganizationsForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getOrganizationsForUser', ex, { scope: scope });
+			this.handleProviderException('getOrganizationsForUser', ex, {
+				scope: scope,
+				connectionId: connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -399,7 +412,7 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getProjectsForOrg');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getProjectsForOrg', ex, { scope: scope });
+			this.handleProviderException('getProjectsForOrg', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -416,17 +429,9 @@ export abstract class GitHostIntegration<
 	 * every other host ignores it. (Azure without a project can't page its cross-project merge, so it
 	 * returns all matches in a single page.) `truncated === true` means the defensive page-drain
 	 * backstop stopped before the upstream listing was exhausted.
-	 */
-	async getRepositoriesForOrg(
-		org: string,
-		options?: { project?: string; cursor?: string },
-	): Promise<ProviderHierarchyResult<ProviderRepository> | undefined> {
-		return (await this.getRepositoriesForOrgResult(org, options))?.value;
-	}
-
-	/**
-	 * Result-returning core of {@link getRepositoriesForOrg}. Resolves the session for `connectionId`
-	 * (or the primary connection when omitted) and recovers a thrown error into `{ error }` for warnings.
+	 *
+	 * Resolves the session for `connectionId` (or the primary connection when omitted) and recovers a thrown
+	 * error into `{ error }`, so a caller surfaces it as a warning instead of a silent `undefined`.
 	 */
 	@trace()
 	async getRepositoriesForOrgResult(
@@ -444,7 +449,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getRepositoriesForOrg');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getRepositoriesForOrg', ex, { scope: scope });
+			this.handleProviderException('getRepositoriesForOrg', ex, {
+				scope: scope,
+				connectionId: options?.connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -482,7 +490,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getRepositoriesForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getRepositoriesForUser', ex, { scope: scope });
+			this.handleProviderException('getRepositoriesForUser', ex, {
+				scope: scope,
+				connectionId: options?.connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -706,11 +717,7 @@ export abstract class GitHostIntegration<
 				(isAzureDevOpsProvider(providerId) &&
 					!reposOrRepoIds.every(repo => repo.project != null && repo.namespace != null)))
 		) {
-			Logger.warn(`Unsupported input for provider ${providerId}`, 'getIssuesForRepos');
-			return {
-				error: new Error(`Unsupported input for provider ${providerId}`),
-				duration: performance.now() - start,
-			};
+			return unsupportedRead(`Unsupported input for provider ${providerId}`, start, 'getIssuesForRepos');
 		}
 
 		let getIssuesOptions: GetIssuesOptions | undefined;
@@ -723,28 +730,24 @@ export abstract class GitHostIntegration<
 			}
 
 			if (organizations.size > 1) {
-				Logger.warn(`Multiple organizations not supported for provider ${providerId}`, 'getIssuesForRepos');
-				return {
-					error: new Error(`Multiple organizations not supported for provider ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(
+					`Multiple organizations not supported for provider ${providerId}`,
+					start,
+					'getIssuesForRepos',
+				);
 			} else if (organizations.size === 0) {
-				Logger.warn(`No organizations found for provider ${providerId}`, 'getIssuesForRepos');
-				return {
-					error: new Error(`No organizations found for provider ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(`No organizations found for provider ${providerId}`, start, 'getIssuesForRepos');
 			}
 
 			const organization: string = first(organizations.values())!;
 
 			if (options?.filters != null) {
 				if (!api.providerSupportsIssueFilters(providerId, options.filters)) {
-					Logger.warn(`Unsupported filters for provider ${providerId}`, 'getIssuesForRepos');
-					return {
-						error: new Error(`Unsupported filters for provider ${providerId}`),
-						duration: performance.now() - start,
-					};
+					return unsupportedRead(
+						`Unsupported filters for provider ${providerId}`,
+						start,
+						'getIssuesForRepos',
+					);
 				}
 
 				let userAccount: ProviderAccount | undefined;
@@ -756,21 +759,17 @@ export abstract class GitHostIntegration<
 				}
 
 				if (userAccount == null) {
-					Logger.warn(`Unable to get current user for ${providerId}`, 'getIssuesForRepos');
-					return {
-						error: new Error(`Unable to get current user for ${providerId}`),
-						duration: performance.now() - start,
-					};
+					return unsupportedRead(`Unable to get current user for ${providerId}`, start, 'getIssuesForRepos');
 				}
 
 				const userFilterProperty = userAccount.name;
 
 				if (userFilterProperty == null) {
-					Logger.warn(`Unable to get user property for filter for ${providerId}`, 'getIssuesForRepos');
-					return {
-						error: new Error(`Unable to get user property for filter for ${providerId}`),
-						duration: performance.now() - start,
-					};
+					return unsupportedRead(
+						`Unable to get user property for filter for ${providerId}`,
+						start,
+						'getIssuesForRepos',
+					);
 				}
 
 				getIssuesOptions = {
@@ -889,11 +888,7 @@ export abstract class GitHostIntegration<
 			// branch above applies. Without it an unsupported filter (e.g. GitLab has no Mention endpoint) would
 			// resolve to no filter property being set and silently degrade to an unfiltered, project-wide read.
 			if (!api.providerSupportsIssueFilters(providerId, options.filters)) {
-				Logger.warn(`Unsupported filters for provider ${providerId}`, 'getIssuesForRepos');
-				return {
-					error: new Error(`Unsupported filters for provider ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, 'getIssuesForRepos');
 			}
 
 			let userAccount: ProviderAccount | undefined;
@@ -905,20 +900,16 @@ export abstract class GitHostIntegration<
 			}
 
 			if (userAccount == null) {
-				Logger.warn(`Unable to get current user for ${providerId}`, 'getIssuesForRepos');
-				return {
-					error: new Error(`Unable to get current user for ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(`Unable to get current user for ${providerId}`, start, 'getIssuesForRepos');
 			}
 
 			const userFilterProperty = userAccount.username;
 			if (userFilterProperty == null) {
-				Logger.warn(`Unable to get user property for filter for ${providerId}`, 'getIssuesForRepos');
-				return {
-					error: new Error(`Unable to get user property for filter for ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(
+					`Unable to get user property for filter for ${providerId}`,
+					start,
+					'getIssuesForRepos',
+				);
 			}
 
 			getIssuesOptions = {
@@ -1124,21 +1115,17 @@ export abstract class GitHostIntegration<
 				(isAzureDevOpsProvider(providerId) &&
 					!reposOrRepoIds.every(repo => repo.project != null && repo.namespace != null)))
 		) {
-			Logger.warn(`Unsupported input for provider ${providerId}`);
-			return {
-				error: new Error(`Unsupported input for provider ${providerId}`),
-				duration: performance.now() - start,
-			};
+			return unsupportedRead(`Unsupported input for provider ${providerId}`, start);
 		}
 
 		let getPullRequestsOptions: GetPullRequestsOptions | undefined;
 		if (options?.filters != null) {
 			if (!api.providerSupportsPullRequestFilters(providerId, options.filters)) {
-				Logger.warn(`Unsupported filters for provider ${providerId}`, 'getPullRequestsForRepos');
-				return {
-					error: new Error(`Unsupported filters for provider ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(
+					`Unsupported filters for provider ${providerId}`,
+					start,
+					'getPullRequestsForRepos',
+				);
 			}
 
 			let userAccount: ProviderAccount | undefined;
@@ -1158,11 +1145,11 @@ export abstract class GitHostIntegration<
 						duration: performance.now() - start,
 					};
 				} else if (organizations.size === 0) {
-					Logger.warn(`No organizations found for provider ${providerId}`, 'getPullRequestsForRepos');
-					return {
-						error: new Error(`No organizations found for provider ${providerId}`),
-						duration: performance.now() - start,
-					};
+					return unsupportedRead(
+						`No organizations found for provider ${providerId}`,
+						start,
+						'getPullRequestsForRepos',
+					);
 				}
 
 				const organization: string = first(organizations.values())!;
@@ -1182,11 +1169,11 @@ export abstract class GitHostIntegration<
 			}
 
 			if (userAccount == null) {
-				Logger.warn(`Unable to get current user for ${providerId}`, 'getPullRequestsForRepos');
-				return {
-					error: new Error(`Unable to get current user for ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(
+					`Unable to get current user for ${providerId}`,
+					start,
+					'getPullRequestsForRepos',
+				);
 			}
 
 			let userFilterProperty: string | null;
@@ -1202,11 +1189,11 @@ export abstract class GitHostIntegration<
 			}
 
 			if (userFilterProperty == null) {
-				Logger.warn(`Unable to get user property for filter for ${providerId}`, 'getPullRequestsForRepos');
-				return {
-					error: new Error(`Unable to get user property for filter for ${providerId}`),
-					duration: performance.now() - start,
-				};
+				return unsupportedRead(
+					`Unable to get user property for filter for ${providerId}`,
+					start,
+					'getPullRequestsForRepos',
+				);
 			}
 
 			// Route the "review requested from me" filter to the field each provider actually reads:
@@ -1436,6 +1423,7 @@ export abstract class GitHostIntegration<
 			this.handleProviderException('searchMyPullRequests', ex, {
 				scope: scope,
 				silent: true,
+				connectionId: connectionId,
 			});
 			return {
 				error: toError(ex),
@@ -1478,7 +1466,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getMyPullRequestsForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getMyPullRequestsForUser', ex, { scope: scope });
+			this.handleProviderException('getMyPullRequestsForUser', ex, {
+				scope: scope,
+				connectionId: connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -1610,7 +1601,7 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('searchPullRequests');
 			return prs;
 		} catch (ex) {
-			this.handleProviderException('searchPullRequests', ex, { scope: scope });
+			this.handleProviderException('searchPullRequests', ex, { scope: scope, connectionId: connectionId });
 			return undefined;
 		}
 	}

package/src/plus/integrations/models/integration.ts

@@ -20,6 +20,7 @@ import type {
 } from '../authentication/integrationAuthenticationProvider.js';
 import type { IntegrationAuthenticationService } from '../authentication/integrationAuthenticationService.js';
 import type { ProviderAuthenticationSession } from '../authentication/models.js';
+import { RejectedTokenTracker } from '../authentication/rejectedTokenTracker.js';
 import type { IntegrationIds, IssuesCloudHostIntegrationId } from '../constants.js';
 import { GitCloudHostIntegrationId } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
@@ -240,13 +241,18 @@ export abstract class IntegrationBase<
 		// A truthy connectionId targets a specific account; an empty string is not a real target, so it falls
 		// through to the primary path below.
 		if (connectionId) {
+			// A read of this connection previously failed with an AuthenticationError, so the token in
+			// storage is known-refused. Ask for a refresh through the GK cloud before reading again, which
+			// is this branch's equivalent of the primary path's `refreshSessionIfExpired`. Claimed here so
+			// the forced refresh runs at most once per rejection.
+			const refreshRejectedToken = this._rejectedTokens.claimRefresh(connectionId);
 			// Degrade to "no results" on failure, matching the primary path (whose ensureSession/
 			// refreshSessionIfExpired swallow errors) so read methods keep their never-throws contract.
 			try {
 				const authProvider = await this.authenticationService.get(this.authProvider.id);
 				const session = await authProvider.getSession(
 					{ ...this.authProviderDescriptor, connectionId: connectionId, cloud: true },
-					{ source: source },
+					{ source: source, refreshRejectedToken: refreshRejectedToken },
 				);
 				return session != null && this.isSessionForIntegrationHost(session) ? session : undefined;
 			} catch (ex) {
@@ -326,6 +332,10 @@ export abstract class IntegrationBase<
 
 	@debug()
 	async reauthenticate(): Promise<void> {
+		// `forceNewSession` below deletes the stored secrets to reconnect. Ahead of the guard — see
+		// `onStoredTokensReplaced`.
+		this.onStoredTokensReplaced();
+
 		if (this._session === undefined) return;
 
 		this._session = undefined;
@@ -343,6 +353,30 @@ export abstract class IntegrationBase<
 	requestSessionSyncForUsecase(syncReqUsecase: SyncReqUsecase): void {
 		this._syncRequestsPerFailedUsecase.add(syncReqUsecase);
 	}
+
+	/**
+	 * The per-connection counterpart of the primary session's expire-and-resync recovery: a token the
+	 * provider refused is refreshed once through the GK cloud, which exchanges the refresh token server-side
+	 * (the client never holds one). Armed by {@link handleProviderException} and consumed by
+	 * {@link resolveReadSession}; a rejection it declines belongs to {@link trackRequestException} instead.
+	 */
+	private readonly _rejectedTokens = new RejectedTokenTracker();
+
+	/**
+	 * Called by every path that replaces or removes the stored tokens — a disconnect, a forced re-sync, a
+	 * reauthentication, or the connection set changing. A rejection names a specific credential, so once that
+	 * credential is gone the rejection describes nothing and must not force a refresh (or, for a deleted
+	 * connection, outlive it).
+	 *
+	 * Deliberately NOT conditioned on `_session`. A per-connection read resolves through the auth provider and
+	 * never populates the cached primary session, so the connections this recovery exists for are exactly the
+	 * ones with no `_session` to inspect — the same blind spot the recovery itself was added to fix. Callers
+	 * that guard on `_session` therefore invoke this ahead of that guard.
+	 */
+	protected onStoredTokensReplaced(): void {
+		this._rejectedTokens.clear();
+	}
+
 	private static readonly requestExceptionLimit = 5;
 	private requestExceptionCount = 0;
 
@@ -350,6 +384,8 @@ export abstract class IntegrationBase<
 		this.requestExceptionCount = 0;
 		if (syncReqUsecase === 'all') {
 			this._syncRequestsPerFailedUsecase.clear();
+			// 'all' is the whole-integration reset: a disconnect, or a re-sync that produced a new access token.
+			this.onStoredTokensReplaced();
 		} else {
 			this._syncRequestsPerFailedUsecase.delete(syncReqUsecase);
 		}
@@ -374,6 +410,10 @@ export abstract class IntegrationBase<
 	 * `deleteConnection`). Unlike {@link reset}/{@link disconnect}, it deletes nothing from storage.
 	 */
 	switchConnection(): void {
+		// A connection was deleted, or a different one became primary. Ahead of the guard — see
+		// `onStoredTokensReplaced`.
+		this.onStoredTokensReplaced();
+
 		if (this._session === undefined) return;
 
 		const wasConnected = this._session != null;
@@ -419,6 +459,9 @@ export abstract class IntegrationBase<
 					// Reset our stored session so that we get a new one from the cloud
 					const authProvider = await this.authenticationService.get(this.authProvider.id);
 					await authProvider.deleteSession(this.authProviderDescriptor);
+					// The stored token was just deleted. Not left to the token-changed check below, which needs
+					// an `oldSession` — see `onStoredTokensReplaced`.
+					this.onStoredTokensReplaced();
 					// Reset the session and clear our "stay disconnected" flag
 					this._session = undefined;
 					await this.ctx.storage.deleteWorkspace(this.connectedKey);
@@ -474,12 +517,29 @@ export abstract class IntegrationBase<
 	protected handleProviderException(
 		syncReqUsecase: SyncReqUsecase,
 		ex: Error,
-		options?: { scope?: ScopedLogger | undefined; silent?: boolean },
+		options?: { scope?: ScopedLogger | undefined; silent?: boolean; connectionId?: string },
 	): void {
 		if (isCancellationError(ex)) return;
 
 		options?.scope?.error(ex);
 
+		// A per-connection (multi-account) read resolved its session through `resolveReadSession`'s
+		// `connectionId` branch, which deliberately never touches the cached primary `_session`. So the
+		// primary-session recovery below cannot apply to it: expiring `_session` would mark a session this
+		// read never used, while the rejected connection kept its stored token and re-sent it on every
+		// later read — a token the provider has already refused (expired scopes, a revoked grant, an
+		// uninstalled app) is not self-healing, so the read failed identically until the user reconnected
+		// by hand. Record the rejection against the connection instead; `resolveReadSession` consumes it
+		// and forces the cloud `/refresh` on the next read of that connection. When there is nothing to
+		// recover, fall through to the shared failure budget, which disconnects after
+		// `requestExceptionLimit` and surfaces the reconnect prompt.
+		if (ex instanceof AuthenticationError && options?.connectionId) {
+			if (!this._rejectedTokens.recordRejection(options.connectionId)) {
+				this.trackRequestException(options);
+			}
+			return;
+		}
+
 		if (ex instanceof AuthenticationError && this._session?.cloud) {
 			if (!this.hasSessionSyncRequests()) {
 				this.requestSessionSyncForUsecase(syncReqUsecase);
@@ -686,7 +746,7 @@ export abstract class IntegrationBase<
 			this.resetRequestExceptionCount('searchMyIssues');
 			return { value: issues };
 		} catch (ex) {
-			this.handleProviderException('searchMyIssues', ex, { scope: scope });
+			this.handleProviderException('searchMyIssues', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -738,7 +798,7 @@ export abstract class IntegrationBase<
 			this.resetRequestExceptionCount('searchMyIssues');
 			return { value: result };
 		} catch (ex) {
-			this.handleProviderException('searchMyIssues', ex, { scope: scope });
+			this.handleProviderException('searchMyIssues', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -858,7 +918,10 @@ export abstract class IntegrationBase<
 							return undefined;
 						}
 
-						this.handleProviderException('getCurrentAccount', ex, { scope: scope });
+						this.handleProviderException('getCurrentAccount', ex, {
+							scope: scope,
+							connectionId: connectionId,
+						});
 
 						// Invalidate the cache on error, except for auth errors
 						if (!(ex instanceof AuthenticationError)) {

package/src/plus/integrations/models/issuesIntegration.ts

@@ -48,7 +48,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getAccountForResource');
 			return { value: account };
 		} catch (ex) {
-			this.handleProviderException('getAccountForResource', ex);
+			this.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -80,38 +80,20 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getResourcesForUser');
 			return { value: resources };
 		} catch (ex) {
-			this.handleProviderException('getResourcesForUser', ex);
+			this.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
 
 	protected abstract getProviderResourcesForUser(session: ProviderAuthenticationSession): Promise<T[] | undefined>;
 
-	@trace()
-	async getProjectsForResources(resources: T[], connectionId?: string): Promise<T[] | undefined> {
-		return (await this.getProjectsForResourcesResult(resources, connectionId))?.value;
-	}
-
-	/**
-	 * Result-returning core of {@link getProjectsForResources}. Recovers thrown errors into `{ error }` so callers
-	 * can surface them as warnings rather than silently swallowing them to `undefined`. Implemented by unwrapping
-	 * the metadata-aware path's `values` so the array-returning contract stays backward compatible.
-	 */
-	async getProjectsForResourcesResult(
-		resources: T[],
-		connectionId?: string,
-	): Promise<IntegrationResult<T[] | undefined>> {
-		const result = await this.getProjectsForResourcesWithMetadataResult(resources, connectionId);
-		if (result == null) return undefined;
-		if (result.error != null) return { value: result.value?.values, error: result.error };
-		return { value: result.value?.values };
-	}
-
 	/**
-	 * Metadata-aware counterpart of {@link getProjectsForResourcesResult} for ProviderBackend composition:
-	 * returns the SDK collection `{ values, metadata }` (completeness + per-resource failures) so callers can
-	 * warn on failed resources and set `fetchFailed` without discarding the resources that succeeded.
+	 * Project discovery for a set of resources, returning the SDK collection `{ values, metadata }` (completeness
+	 * + per-resource failures) so callers can warn on failed resources and set `fetchFailed` without discarding
+	 * the resources that succeeded. Thrown errors are recovered into `{ error }` for the same reason: a caller
+	 * surfaces them as a warning rather than swallowing them to `undefined`.
 	 */
+	@trace()
 	async getProjectsForResourcesWithMetadataResult(
 		resources: T[],
 		connectionId?: string,
@@ -126,40 +108,11 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getProjectsForResources');
 			return { value: projects };
 		} catch (ex) {
-			this.handleProviderException('getProjectsForResources', ex);
+			this.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
 
-	async getProjectsForUser(connectionId?: string): Promise<T[] | undefined> {
-		return (await this.getProjectsForUserResult(connectionId))?.value;
-	}
-
-	/**
-	 * Result-returning core of {@link getProjectsForUser}. Composes the resource and project result methods so
-	 * callers can surface per-step warnings. Unwraps the metadata-aware path for the array-returning contract.
-	 */
-	async getProjectsForUserResult(connectionId?: string): Promise<IntegrationResult<T[] | undefined>> {
-		const result = await this.getProjectsForUserWithMetadataResult(connectionId);
-		if (result == null) return undefined;
-		if (result.error != null) return { value: result.value?.values, error: result.error };
-		return { value: result.value?.values };
-	}
-
-	/**
-	 * Metadata-aware counterpart of {@link getProjectsForUserResult}: composes resource discovery with the
-	 * metadata-aware project read so ProviderBackend consumers get completeness/failures across resources.
-	 */
-	async getProjectsForUserWithMetadataResult(
-		connectionId?: string,
-	): Promise<IntegrationResult<ProviderApiCollectionResult<T> | undefined>> {
-		const resources = await this.getResourcesForUserResult(connectionId);
-		if (resources?.error != null) return { error: resources.error };
-		if (resources?.value == null) return undefined;
-
-		return this.getProjectsForResourcesWithMetadataResult(resources.value, connectionId);
-	}
-
 	/**
 	 * Metadata-aware provider project discovery. The default wraps the array-returning
 	 * {@link getProviderProjectsForResources} in `{ values }` with no metadata, so providers without a
@@ -208,7 +161,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getIssuesForProject');
 			return { value: issues };
 		} catch (ex) {
-			this.handleProviderException('getIssuesForProject', ex);
+			this.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -235,7 +188,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getIssuesForProject');
 			return { value: result };
 		} catch (ex) {
-			this.handleProviderException('getIssuesForProject', ex);
+			this.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}

package/src/plus/integrations/providers/azureDevOps.ts

@@ -1062,7 +1062,7 @@ export abstract class AzureDevOpsIntegrationBase<
 				{ providerId: this.id, resourceId: p.resourceId, projectId: p.name },
 			);
 			return {
-				issues: result.values.map(i => fromProviderIssue(i, this as any, { project: p })),
+				issues: result.values.map(i => fromProviderIssue(i, this, { project: p })),
 				// Azure work-item ids are organization-scoped. Include both org and project so the
 				// assigned/authored passes dedupe the same item without collapsing another org's item.
 				projectKey: `${p.resourceId}:${p.id}`,