@gitkraken/core-gitlens 0.7.0 → 0.7.2

package/dist/plus/integrations/providers/azureDevOps.js

@@ -1,12 +1,13 @@
 import { CancellationError } from "../../../utils/cancellation.js";
 import { mapSettledBounded } from "../../../utils/promise.js";
 import "../../../git/models/pullRequest.js";
-import { toCollectionScopeFailure } from "../collectionMetadata.js";
 import "../constants.js";
+import { toCollectionScopeFailure } from "../collectionMetadata.js";
 import { toTokenWithInfo } from "../authentication/models.js";
 import "../providerFilters.js";
-import { fromProviderIssue, fromProviderPullRequest, getProviderPullRequestIdentity, providerPullRequestMatchesSearch, providersMetadata, toProviderPullRequestStates } from "./models.js";
 import { collectProviderPagedResult, flatSettledResultsOrThrow, mergeCollectionMetadata } from "./utils/providerPaging.js";
+import { decodePathSegment } from "../utils/domain.utils.js";
+import { fromProviderIssue, fromProviderPullRequest, getProviderPullRequestIdentity, providerPullRequestMatchesSearch, providersMetadata, toProviderPullRequestStates } from "./models.js";
 import { GitHostIntegration } from "../models/gitHostIntegration.js";
 //#region ../plus/integrations/src/providers/azureDevOps.ts
 function getAzureRepositoryIdentity(repo) {
@@ -18,10 +19,33 @@ function getAzureRepositoryIdentity(repo) {
 	};
 }
 function getAzureRepositoryApiBaseUrl(baseUrl, repo) {
-	if (repo.virtualDirectory == null) return baseUrl;
-	const segments = repo.virtualDirectory.split("/");
-	if (segments.some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`Invalid Azure virtual directory '${repo.virtualDirectory}'.`);
-	return `${baseUrl.replace(/\/+$/, "")}/${segments.map(encodeURIComponent).join("/")}`;
+	const directory = repo.virtualDirectory?.split("/");
+	if (directory?.some((segment) => !segment || segment === "." || segment === "..")) throw new Error(`Invalid Azure virtual directory '${repo.virtualDirectory}'.`);
+	const url = new URL(baseUrl);
+	const toUrl = (segments) => `${url.protocol}//${url.host}${segments.map((s) => `/${s}`).join("")}`;
+	const configured = url.pathname.split("/").filter(Boolean);
+	if (!configured.length) return toUrl(directory?.map(encodeURIComponent) ?? []);
+	const namesCollection = sameAzurePathSegment(configured.at(-1), repo.owner);
+	const installation = namesCollection ? configured.slice(0, -1) : configured;
+	if (directory == null) return toUrl(installation);
+	for (const candidate of namesCollection ? [configured, installation] : [configured]) if (candidate.length === directory.length && candidate.every((s, i) => sameAzurePathSegment(s, directory[i]))) return toUrl(candidate);
+	throw new Error("Azure repository virtual directory does not match the configured installation");
+}
+function sameAzurePathSegment(encoded, value) {
+	return decodePathSegment(encoded).toLowerCase() === value.toLowerCase();
+}
+/**
+* Whether two collection or project names name the same scope. Azure DevOps treats them case-insensitively, so a
+* name typed by hand must still select the collection or project discovery reported.
+*/
+function sameAzureName(a, b) {
+	return a.toLowerCase() === b.toLowerCase();
+}
+/** The distinct names in `names`, compared as Azure compares them, keeping the first spelling of each. */
+function uniqueAzureNames(names) {
+	const unique = [];
+	for (const name of names) if (!unique.some((n) => sameAzureName(n, name))) unique.push(name);
+	return unique;
 }
 /**
 * Matches an org/project descriptor against a caller-supplied name, mirroring the facade's own
@@ -39,15 +63,51 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			options: { isPAT: usePat }
 		};
 	}
+	/**
+	* The options for a request addressed below one collection (an Azure DevOps Services organization).
+	*
+	* The same as {@link getApiOptions} unless a self-managed address already names the collection, which requests
+	* append themselves: see the server override, which keeps it from being applied twice.
+	*/
+	getCollectionApiOptions(session, _collection) {
+		return this.getApiOptions(session).options;
+	}
+	/** The base a request or link below `collection` appends the collection to; see {@link getCollectionApiOptions}. */
+	collectionApiBaseUrl(session, _collection) {
+		return this.apiBaseUrlFor(session);
+	}
+	/** Reads the organizations (Azure DevOps Server: the collections) the account can see. */
+	async requestResourcesForUser(session, userId) {
+		const api = await this.getProvidersApi();
+		const { tokenWithInfo, options } = this.getApiOptions(session);
+		return api.getAzureResourcesForUser(tokenWithInfo, userId, options);
+	}
+	/**
+	* The identity id a pull-request creator/reviewer filter must carry for `collection`.
+	*
+	* On Azure DevOps Services that is the account id, one per user. The server override resolves it per collection,
+	* since Azure DevOps Server gives one person a different id in each collection than at the server level.
+	*/
+	async getFilterUserId(session, _collection) {
+		return (await this.getProviderCurrentAccount(session))?.id;
+	}
+	/**
+	* What the discovery caches (account, organizations, projects, and their stored copies) are keyed by. Azure DevOps
+	* Services has a single address, so the credential alone identifies what it discovers; the server override adds
+	* the installation address.
+	*/
+	discoveryKey(session) {
+		return session.accessToken;
+	}
 	_accounts;
 	async getProviderCurrentAccount(session) {
-		const { accessToken } = session;
+		const key = this.discoveryKey(session);
 		this._accounts ??= /* @__PURE__ */ new Map();
-		if (this._accounts.get(accessToken) == null) {
+		if (this._accounts.get(key) == null) {
 			const user = await this._requestForCurrentUser(session);
-			this._accounts.set(accessToken, user);
+			this._accounts.set(key, user);
 		}
-		return this._accounts.get(accessToken);
+		return this._accounts.get(key);
 	}
 	async _requestForCurrentUser(session) {
 		const api = await this.getProvidersApi();
@@ -62,22 +122,56 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			username: user.username ?? void 0
 		} : void 0;
 	}
+	/**
+	* The profile request the account cache would otherwise answer; see `IntegrationBase.validateCredential`. No
+	* account proves nothing, since Azure DevOps Server's request answers every failure but a refusal that way.
+	*/
+	async validateCredential(session) {
+		if (await this._requestForCurrentUser(session) == null) throw new Error("Azure DevOps did not confirm the credential");
+	}
+	/**
+	* Names a confirmed credential's refusal from the answers Azure DevOps gives, captured live (#5890):
+	* - `VS403463` in the explanation is a Conditional Access policy;
+	* - a typed `UnauthorizedRequestException` body is an organization or project the account has no access to;
+	* - a `401` to an OAuth token that explains nothing (sent as Basic), or only `TF400813` (sent as Bearer), is an
+	*   organization whose "Third-party application access via OAuth" policy is off. It is the same answer an
+	*   expired token gets, which is why this is only asked once the credential passed. The policy does not govern
+	*   personal access tokens, so a PAT is never given it.
+	*
+	* Any other explanation is left unnamed, so the warning keeps Azure's own words rather than a guess.
+	*/
+	describeRefusal(session, refusal, scope) {
+		const code = /\b(?:TF|VS)\d{6}\b/.exec(refusal.detail ?? "")?.[0];
+		if (code === "VS403463") return {
+			reason: "conditional-access",
+			code
+		};
+		if (refusal.typeKey === "UnauthorizedRequestException") return {
+			reason: "access-denied",
+			...code != null ? { code } : {}
+		};
+		if (this.id !== "azureDevOps" || session.type !== "oauth" || refusal.status !== 401 || refusal.typeKey != null || refusal.detail != null && code !== "TF400813") return;
+		const org = scope.resourceId != null ? this._organizations?.get(this.discoveryKey(session))?.find((o) => o.id === scope.resourceId || o.name === scope.resourceId)?.name : void 0;
+		return {
+			reason: "oauth-app-not-allowed",
+			...code != null ? { code } : {},
+			...org != null ? { remedyUrl: `${this.apiBaseUrlFor(session)}/${encodeURIComponent(org)}/_settings/organizationPolicy` } : {}
+		};
+	}
 	_organizations;
 	async getProviderResourcesForUser(session, force = false) {
 		this._organizations ??= /* @__PURE__ */ new Map();
-		const { accessToken } = session;
-		if (this._organizations.get(accessToken) == null || force) {
-			const api = await this.getProvidersApi();
+		const key = this.discoveryKey(session);
+		if (this._organizations.get(key) == null || force) {
 			const account = await this.getProviderCurrentAccount(session);
 			if (account?.id == null) return void 0;
-			const { tokenWithInfo, options } = this.getApiOptions(session);
-			const resources = await api.getAzureResourcesForUser(tokenWithInfo, account.id, options);
-			this._organizations.set(accessToken, resources != null ? resources.map((r) => ({
+			const resources = await this.requestResourcesForUser(session, account.id);
+			this._organizations.set(key, resources != null ? resources.map((r) => ({
 				...r,
 				key: r.id
 			})) : void 0);
 		}
-		return this._organizations.get(accessToken);
+		return this._organizations.get(key);
 	}
 	_projects;
 	/**
@@ -89,22 +183,22 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 	*/
 	async getProviderProjectsForResources(session, resources, force = false, failures) {
 		this._projects ??= /* @__PURE__ */ new Map();
-		const { accessToken } = session;
+		const discoveryKey = this.discoveryKey(session);
 		let resourcesWithoutProjects = [];
 		if (force) resourcesWithoutProjects = resources;
 		else for (const resource of resources) {
-			const resourceKey = `${accessToken}:${resource.id}`;
+			const resourceKey = `${discoveryKey}:${resource.id}`;
 			if (this._projects.get(resourceKey) == null) resourcesWithoutProjects.push(resource);
 		}
 		const allProjects = [];
 		let resultMetadata;
 		if (resourcesWithoutProjects.length > 0) {
 			const api = await this.getProvidersApi();
-			const { tokenWithInfo, options } = this.getApiOptions(session);
+			const { tokenWithInfo } = this.getApiOptions(session);
 			(await Promise.allSettled(resourcesWithoutProjects.map(async (resource) => ({
 				resource,
 				result: await collectProviderPagedResult((cursor) => api.getAzureProjectsForResource(tokenWithInfo, resource.name, {
-					...options,
+					...this.getCollectionApiOptions(session, resource.name),
 					cursor
 				}), 20, {
 					providerId: this.id,
@@ -149,11 +243,11 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 					allProjects.push(...projects);
 					return;
 				}
-				this._projects.set(`${accessToken}:${resource.id}`, projects);
+				this._projects.set(`${discoveryKey}:${resource.id}`, projects);
 			});
 		}
 		const cachedProjects = resources.reduce((projects, resource) => {
-			const resourceProjects = this._projects.get(`${accessToken}:${resource.id}`);
+			const resourceProjects = this._projects.get(`${discoveryKey}:${resource.id}`);
 			if (resourceProjects != null) projects.push(...resourceProjects);
 			return projects;
 		}, []);
@@ -173,9 +267,9 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		const descriptors = /* @__PURE__ */ new Map();
 		if (projects.length === 0) return descriptors;
 		const api = await this.getProvidersApi();
-		const { tokenWithInfo, options } = this.getApiOptions(session);
+		const { tokenWithInfo } = this.getApiOptions(session);
 		await Promise.all(projects.map(async (project) => {
-			const repos = (await api.getReposForAzureProject(tokenWithInfo, project.resourceName, project.name, options))?.values;
+			const repos = (await api.getReposForAzureProject(tokenWithInfo, project.resourceName, project.name, this.getCollectionApiOptions(session, project.resourceName)))?.values;
 			if (repos != null && repos.length > 0) descriptors.set(project.id, repos.map((r) => ({
 				id: r.id,
 				nodeId: r.graphQLId ?? void 0,
@@ -197,7 +291,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			id: o.id,
 			providerId: this.id,
 			name: o.name,
-			url: `${this.apiBaseUrl}/${o.name}`
+			url: `${this.collectionApiBaseUrl(session, o.name)}/${o.name}`
 		})) };
 	}
 	async getProviderProjectsForOrg(session, org) {
@@ -220,7 +314,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 				providerId: this.id,
 				name: p.name,
 				org: p.resourceName,
-				url: `${this.apiBaseUrl}/${p.resourceName}/${p.name}`
+				url: `${this.collectionApiBaseUrl(session, p.resourceName)}/${p.resourceName}/${p.name}`
 			})),
 			...projects.metadata != null ? { metadata: projects.metadata } : {}
 		};
@@ -234,7 +328,8 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 	*/
 	async getProviderRepositoriesForOrg(session, org, options) {
 		const api = await this.getProvidersApi();
-		const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+		const { tokenWithInfo } = this.getApiOptions(session);
+		const apiOptions = this.getCollectionApiOptions(session, org);
 		if (options?.project) return api.getReposForAzureProject(tokenWithInfo, org, options.project, {
 			...apiOptions,
 			cursor: options.cursor
@@ -276,7 +371,8 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 	async mergeProviderPullRequest(session, pr, options) {
 		const api = await this.getProvidersApi();
 		if (pr.refs == null || pr.project == null) return false;
-		const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+		const { tokenWithInfo } = this.getApiOptions(session);
+		const apiOptions = this.getCollectionApiOptions(session, pr.repository.owner);
 		try {
 			return await api.mergePullRequest(tokenWithInfo, pr, {
 				...options,
@@ -291,17 +387,17 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		this.ctx.hooks?.ui?.onError?.(`${ex.message}. Check branch policies, and ensure you have the necessary permissions to merge the pull request.`);
 	}
 	async getProviderAccountForCommit(session, repo, rev, options) {
-		return (await this.authenticationService.apis.azure)?.getAccountForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo), options);
+		return (await this.authenticationService.apis.azure)?.getAccountForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo), options);
 	}
 	async getProviderAccountForEmail(_session, _repo, _email, _options) {
 		return Promise.resolve(void 0);
 	}
 	async getProviderDefaultBranch(session, repo, cancellation) {
-		return (await this.authenticationService.apis.azure)?.getDefaultBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo) }, cancellation);
+		return (await this.authenticationService.apis.azure)?.getDefaultBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo) }, cancellation);
 	}
 	async getProviderLinkedIssueOrPullRequest(session, repo, { id }, type) {
 		return (await this.authenticationService.apis.azure)?.getIssueOrPullRequest(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, id, {
-			baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo),
+			baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo),
 			type
 		});
 	}
@@ -313,13 +409,13 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		if (projects.values.length === 0) return void 0;
 		const matchingProject = projects.values.find((p) => p.resourceName === project.owner && p.name === project.name);
 		if (matchingProject == null) return void 0;
-		return (await this.authenticationService.apis.azure)?.getIssue(this, toTokenWithInfo(this.id, session), matchingProject, id, { baseUrl: this.apiBaseUrl });
+		return (await this.authenticationService.apis.azure)?.getIssue(this, toTokenWithInfo(this.id, session), matchingProject, id, { baseUrl: this.collectionApiBaseUrl(session, matchingProject.resourceName) });
 	}
 	async getProviderPullRequestForBranch(session, repo, branch, _options) {
-		return (await this.authenticationService.apis.azure)?.getPullRequestForBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, branch, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo) });
+		return (await this.authenticationService.apis.azure)?.getPullRequestForBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, branch, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo) });
 	}
 	async getProviderPullRequestForCommit(session, repo, rev) {
-		return (await this.authenticationService.apis.azure)?.getPullRequestForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo));
+		return (await this.authenticationService.apis.azure)?.getPullRequestForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo));
 	}
 	async getRepoInfo(repo) {
 		const identity = getAzureRepositoryIdentity(repo);
@@ -330,47 +426,53 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		const { tokenWithInfo, options } = this.getApiOptions(session);
 		return api.getRepo(tokenWithInfo, identity.resourceName, identity.repositoryName, identity.projectName, {
 			...options,
-			baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo)
+			baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo)
 		});
 	}
 	async getProviderRepositoryMetadata(session, repo, cancellation) {
-		return (await this.authenticationService.apis.azure)?.getRepositoryMetadata(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrl, repo) }, cancellation);
+		return (await this.authenticationService.apis.azure)?.getRepositoryMetadata(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo) }, cancellation);
 	}
 	async searchProviderMyPullRequests(session, repos, _cancellation, options) {
 		const api = await this.getProvidersApi();
 		if (repos != null) return;
 		const states = toProviderPullRequestStates(options?.state);
-		const user = await this.getProviderCurrentAccount(session);
-		if (user?.id == null) return void 0;
+		if ((await this.getProviderCurrentAccount(session))?.id == null) return void 0;
 		const orgs = await this.getProviderResourcesForUser(session);
 		if (orgs == null || orgs.length === 0) return void 0;
 		const projects = await this.getProviderProjectsForResources(session, orgs);
 		if (projects.values.length === 0) return void 0;
 		const repoDescriptors = [...(await this.getRepoDescriptorsForProjects(session, projects.values) ?? /* @__PURE__ */ new Map()).values()].filter((r) => r != null).flat();
-		const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
-		const projectInputs = projects.values.map((p) => ({
-			namespace: p.resourceName,
-			project: p.name
-		}));
-		const assignedPrs = (await api.getPullRequestsForAzureProjects(tokenWithInfo, projectInputs, {
-			...apiOptions,
-			assigneeLogins: [user.id],
-			states
-		})).values.map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects.values));
-		const authoredPrs = (await api.getPullRequestsForAzureProjects(tokenWithInfo, projectInputs, {
-			...apiOptions,
-			authorLogin: user.id,
-			states
-		})).values.map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects.values));
-		const prsById = /* @__PURE__ */ new Map();
-		for (const pr of authoredPrs) prsById.set(pr.id, pr);
-		for (const pr of assignedPrs) if (prsById.get(pr.id) == null) prsById.set(pr.id, pr);
-		return [...prsById.values()];
+		const { tokenWithInfo } = this.getApiOptions(session);
+		const assignedPrs = [];
+		const authoredPrs = [];
+		for (const org of uniqueAzureNames(projects.values.map((p) => p.resourceName))) {
+			const userId = await this.getFilterUserId(session, org);
+			if (userId == null) continue;
+			const projectInputs = projects.values.filter((p) => sameAzureName(p.resourceName, org)).map((p) => ({
+				namespace: p.resourceName,
+				project: p.name
+			}));
+			const orgOptions = this.getCollectionApiOptions(session, org);
+			const reads = [[{ assigneeLogins: [userId] }, assignedPrs], [{ authorLogin: userId }, authoredPrs]];
+			for (const [filter, into] of reads) {
+				const result = await api.getPullRequestsForAzureProjects(tokenWithInfo, projectInputs, {
+					...orgOptions,
+					...filter,
+					states
+				});
+				into.push(...result.values.map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects.values)));
+			}
+		}
+		const prsByIdentity = /* @__PURE__ */ new Map();
+		for (const pr of [...authoredPrs, ...assignedPrs]) {
+			const identity = `${pr.repository.owner}/${pr.repository.id || pr.repository.repo}#${pr.id}`;
+			if (!prsByIdentity.has(identity)) prsByIdentity.set(identity, pr);
+		}
+		return [...prsByIdentity.values()];
 	}
 	async getProviderMyPullRequestsForUser(session, options) {
 		const api = await this.getProvidersApi();
-		const user = await this.getProviderCurrentAccount(session);
-		if (user?.id == null) return void 0;
+		if ((await this.getProviderCurrentAccount(session))?.id == null) return void 0;
 		const orgs = await this.getProviderResourcesForUser(session);
 		if (orgs == null || orgs.length === 0) return void 0;
 		const failures = [];
@@ -384,7 +486,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			},
 			...projects.metadata != null ? { metadata: projects.metadata } : {}
 		};
-		const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+		const { tokenWithInfo } = this.getApiOptions(session);
 		const states = toProviderPullRequestStates(options?.state);
 		const maxPagesPerProject = 20;
 		let truncated = projects.metadata != null && projects.metadata.completeness !== "complete";
@@ -394,7 +496,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			let page;
 			for (let i = 0; i < maxPagesPerProject; i++) try {
 				const result = await api.getPullRequestsForAzureProject(tokenWithInfo, project, {
-					...apiOptions,
+					...this.getCollectionApiOptions(session, project.namespace),
 					...filter,
 					states,
 					page
@@ -436,6 +538,8 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		const requested = options?.filters?.length ? new Set(options.filters) : void 0;
 		const wantAuthored = requested == null || requested.has("author");
 		const wantReviewed = requested == null || requested.has("assignee") || requested.has("review-requested");
+		const userIds = /* @__PURE__ */ new Map();
+		for (const org of uniqueAzureNames(projects.values.map((p) => p.resourceName))) userIds.set(org.toLowerCase(), await this.getFilterUserId(session, org));
 		const outcomes = await Promise.all(projects.values.flatMap((p) => {
 			const project = {
 				namespace: p.resourceName,
@@ -446,9 +550,15 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 				resourceId: p.resourceId,
 				projectId: p.name
 			};
+			const userId = userIds.get(p.resourceName.toLowerCase());
+			if (userId == null) {
+				failures.push(toCollectionScopeFailure(scope, /* @__PURE__ */ new Error("The current user could not be resolved here")));
+				truncated = true;
+				return [];
+			}
 			const drains = [];
-			if (wantAuthored) drains.push(drainProject(project, scope, { authorLogin: user.id }));
-			if (wantReviewed) drains.push(drainProject(project, scope, { reviewerId: user.id }));
+			if (wantAuthored) drains.push(drainProject(project, scope, { authorLogin: userId }));
+			if (wantReviewed) drains.push(drainProject(project, scope, { reviewerId: userId }));
 			return drains;
 		}));
 		const prsByIdentity = /* @__PURE__ */ new Map();
@@ -488,7 +598,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		const repoInputs = requestedRepos == null ? void 0 : repoDescriptors.filter((r) => requestedRepos.some((repo) => repo.resourceName === r.resourceName && repo.repositoryName === r.name && (repo.projectName == null || repo.projectName === r.projectName)));
 		if (repoInputs?.length === 0) return [];
 		const api = await this.getProvidersApi();
-		const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+		const { tokenWithInfo } = this.getApiOptions(session);
 		const states = toProviderPullRequestStates(options?.include);
 		const searchScopes = repoInputs != null ? repoInputs.flatMap((repo) => repo.projectName == null ? [] : [{
 			project: {
@@ -511,7 +621,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			for (let i = 0; i < 20; i++) {
 				if (cancellation?.aborted) throw new CancellationError();
 				const result = await api.getPullRequestsForAzureProject(tokenWithInfo, scope.project, {
-					...apiOptions,
+					...this.getCollectionApiOptions(session, scope.project.namespace),
 					page,
 					repo: scope.repo,
 					states
@@ -571,10 +681,10 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			values: [],
 			truncated: false
 		};
-		const { tokenWithInfo, options } = this.getApiOptions(session);
+		const { tokenWithInfo } = this.getApiOptions(session);
 		const drain = async (p, filter) => {
 			const result = await collectProviderPagedResult((cursor) => api.getIssuesForAzureProject(tokenWithInfo, p.resourceName, p.name, {
-				...options,
+				...this.getCollectionApiOptions(session, p.resourceName),
 				...filter,
 				cursor,
 				sort: searchOptions?.sort
@@ -623,10 +733,11 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 	}
 	async providerOnConnect() {
 		if (this._session == null) return;
+		const discoveryKey = this.discoveryKey(this._session);
 		const canHydrateStoredProjects = (metadata) => metadata == null || metadata.completeness === "complete";
-		const storedAccount = this.ctx.storage.get(`azure:${this._session.accessToken}:account`);
-		const storedOrganizations = this.ctx.storage.get(`azure:${this._session.accessToken}:organizations`);
-		const storedProjects = this.ctx.storage.get(`azure:${this._session.accessToken}:projects`);
+		const storedAccount = this.ctx.storage.get(`azure:${discoveryKey}:account`);
+		const storedOrganizations = this.ctx.storage.get(`azure:${discoveryKey}:organizations`);
+		const storedProjects = this.ctx.storage.get(`azure:${discoveryKey}:projects`);
 		let account = storedAccount?.data ? {
 			...storedAccount.data,
 			provider: this
@@ -645,7 +756,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			account = await this.getProviderCurrentAccount(this._session);
 			if (account != null) {
 				await this.ctx.storage.deleteWithPrefix("azure");
-				await this.ctx.storage.store(`azure:${this._session.accessToken}:account`, {
+				await this.ctx.storage.store(`azure:${discoveryKey}:account`, {
 					v: 1,
 					timestamp: Date.now(),
 					data: {
@@ -659,29 +770,29 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			}
 		}
 		this._accounts ??= /* @__PURE__ */ new Map();
-		this._accounts.set(this._session.accessToken, account);
+		this._accounts.set(discoveryKey, account);
 		if (storedOrganizations == null) {
 			organizations = await this.getProviderResourcesForUser(this._session, true);
-			await this.ctx.storage.store(`azure:${this._session.accessToken}:organizations`, {
+			await this.ctx.storage.store(`azure:${discoveryKey}:organizations`, {
 				v: 1,
 				timestamp: Date.now(),
 				data: organizations
 			});
 		}
 		this._organizations ??= /* @__PURE__ */ new Map();
-		this._organizations.set(this._session.accessToken, organizations);
+		this._organizations.set(discoveryKey, organizations);
 		if (projects == null && organizations?.length) {
 			projects = await this.getProviderProjectsForResources(this._session, organizations);
-			if (projects != null && canHydrateStoredProjects(projects.metadata)) await this.ctx.storage.store(`azure:${this._session.accessToken}:projects`, {
+			if (projects != null && canHydrateStoredProjects(projects.metadata)) await this.ctx.storage.store(`azure:${discoveryKey}:projects`, {
 				v: 2,
 				timestamp: Date.now(),
 				data: projects
 			});
-			else await this.ctx.storage.delete(`azure:${this._session.accessToken}:projects`);
+			else await this.ctx.storage.delete(`azure:${discoveryKey}:projects`);
 		}
 		this._projects ??= /* @__PURE__ */ new Map();
 		if (projects != null && canHydrateStoredProjects(projects.metadata)) for (const project of projects.values) {
-			const projectKey = `${this._session.accessToken}:${project.resourceId}`;
+			const projectKey = `${discoveryKey}:${project.resourceId}`;
 			const projects = this._projects.get(projectKey);
 			if (projects == null) this._projects.set(projectKey, [project]);
 			else if (!projects.some((p) => p.id === project.id)) projects.push(project);
@@ -729,53 +840,11 @@ var AzureDevOpsIntegration = class extends AzureDevOpsIntegrationBase {
 	get domain() {
 		return cloudMetadata.domain;
 	}
-	get apiBaseUrl() {
+	apiBaseUrlFor(_session) {
 		return "https://dev.azure.com";
 	}
 };
-const serverMetadata = providersMetadata["azure-devops-server"];
-const serverAuthProvider = Object.freeze({
-	id: serverMetadata.id,
-	scopes: serverMetadata.scopes
-});
-var AzureDevOpsServerIntegration = class extends AzureDevOpsIntegrationBase {
-	domain;
-	authProvider = serverAuthProvider;
-	id = "azure-devops-server";
-	key;
-	name = "Azure DevOps Server";
-	constructor(ctx, authenticationService, getProvidersApi, didChangeConnection, domain) {
-		super(ctx, authenticationService, getProvidersApi, didChangeConnection);
-		this.domain = domain;
-		this.key = `${this.id}:${this.domain}`;
-	}
-	get apiBaseUrl() {
-		return `${this._session?.protocol ?? "https:"}//${this.domain}`;
-	}
-	getApiOptions(session, doNotConvertToPat = false) {
-		const { options, ...rest } = super.getApiOptions(session, doNotConvertToPat);
-		return {
-			...rest,
-			options: {
-				...options,
-				baseUrl: this.apiBaseUrl
-			}
-		};
-	}
-	async _requestForCurrentUser(session) {
-		const azure = await this.authenticationService.apis.azure;
-		const user = azure ? await azure.getCurrentUserOnServer(this, toTokenWithInfo(this.id, session), this.apiBaseUrl) : void 0;
-		return user ? {
-			provider: this,
-			id: user.id,
-			name: user.name ?? void 0,
-			email: user.email ?? void 0,
-			avatarUrl: user.avatarUrl ?? void 0,
-			username: user.username ?? void 0
-		} : void 0;
-	}
-};
 //#endregion
-export { AzureDevOpsIntegration, AzureDevOpsIntegrationBase, AzureDevOpsServerIntegration };
+export { AzureDevOpsIntegration, AzureDevOpsIntegrationBase, getAzureRepositoryApiBaseUrl, getAzureRepositoryIdentity, sameAzureName, uniqueAzureNames };
 
 //# sourceMappingURL=azureDevOps.js.map