codee-agent 0.1.0__py3-none-any.whl

codee_tasks_azure_devops/test.py

@@ -0,0 +1,462 @@
+import tempfile
+import unittest
+from contextlib import closing
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+from codee_database import oauth_tokens
+from codee_database.database import get_db_connection
+from codee_main_context.context import CodeeMainContext, Settings, TasksProvider
+
+from codee_tasks_azure_devops import oauth
+from codee_tasks_azure_devops.oauth import (
+    AzureDevOpsAuth, AzureDevOpsAuthError, OAuthConfig, is_expired)
+from codee_tasks_azure_devops.provider import AzureDevOpsTasksProvider
+
+
+def _config(**overrides) -> OAuthConfig:
+    values = {
+        "organization_url": "https://dev.azure.com/acme",
+        "project": "Core",
+        "tenant_id": "tenant-1",
+        "client_id": "client-1",
+        "client_secret": "secret-1",
+    }
+    values.update(overrides)
+    return OAuthConfig(**values)
+
+
+def _response(payload: dict, status_code: int = 200) -> Mock:
+    response = Mock()
+    response.status_code = status_code
+    response.json.return_value = payload
+    response.raise_for_status.return_value = None
+    return response
+
+
+def _iso(offset: timedelta) -> str:
+    return (datetime.now(timezone.utc) + offset).isoformat()
+
+
+class OAuthConfigTest(unittest.TestCase):
+    def test_from_settings_reads_provider_credentials(self) -> None:
+        settings = Settings(
+            tasks_provider=TasksProvider.AZURE_DEVOPS,
+            credentials={"azure_devops": {
+                "organization_url": "https://dev.azure.com/acme/",
+                "project": "Core",
+                "client_id": "client-1",
+                "client_secret": "secret-1",
+            }})
+
+        config = OAuthConfig.from_settings(settings)
+
+        # The trailing slash would otherwise double up in every API URL.
+        self.assertEqual(config.organization_url, "https://dev.azure.com/acme")
+        self.assertTrue(config.is_complete())
+
+    def test_is_incomplete_without_a_secret(self) -> None:
+        self.assertFalse(_config(client_secret="").is_complete())
+
+    def test_missing_tenant_falls_back_to_any_work_directory(self) -> None:
+        config = _config(tenant_id="")
+        self.assertIn("/organizations/", config.authorize_endpoint)
+
+
+class AuthorizationUrlTest(unittest.TestCase):
+    def test_url_carries_pkce_challenge_and_read_scope(self) -> None:
+        verifier = "verifier-value"
+
+        url = oauth.build_authorization_url(
+            _config(), "http://localhost:8501/cb", "state-1", verifier)
+
+        self.assertIn("login.microsoftonline.com/tenant-1/oauth2/v2.0/authorize", url)
+        self.assertIn(f"code_challenge={oauth.code_challenge_for(verifier)}", url)
+        self.assertIn("code_challenge_method=S256", url)
+        self.assertIn("offline_access", url)
+        self.assertIn(oauth.AZURE_DEVOPS_RESOURCE_ID, url)
+        # The verifier itself must never leave the backend.
+        self.assertNotIn(verifier, url)
+
+    def test_code_challenge_is_unpadded_url_safe_base64(self) -> None:
+        challenge = oauth.code_challenge_for("verifier-value")
+        self.assertNotIn("=", challenge)
+        self.assertNotIn("+", challenge)
+        self.assertNotIn("/", challenge)
+
+
+class TokenExchangeTest(unittest.TestCase):
+    def test_exchange_converts_expires_in_to_an_absolute_deadline(self) -> None:
+        with patch.object(oauth.requests, "post",
+                          return_value=_response({"access_token": "at", "refresh_token": "rt",
+                                                  "expires_in": 3599})) as post:
+            tokens = oauth.exchange_code(
+                _config(), "http://localhost:8501/cb", "code-1", "verifier-1")
+
+        sent = post.call_args.kwargs["data"]
+        self.assertEqual(sent["grant_type"], "authorization_code")
+        self.assertEqual(sent["code_verifier"], "verifier-1")
+        self.assertEqual(sent["client_secret"], "secret-1")
+        self.assertEqual(tokens["refresh_token"], "rt")
+        deadline = datetime.fromisoformat(tokens["expires_at"])
+        self.assertGreater(deadline, datetime.now(timezone.utc))
+
+    def test_error_response_raises_with_the_first_description_line(self) -> None:
+        payload = {"error": "invalid_client",
+                   "error_description": "AADSTS7000215: Invalid client secret.\r\n"
+                                        "Trace ID: abc\r\nCorrelation ID: def"}
+        with patch.object(oauth.requests, "post",
+                          return_value=_response(payload, status_code=401)):
+            with self.assertRaises(AzureDevOpsAuthError) as raised:
+                oauth.exchange_code(_config(), "http://cb", "code", "verifier")
+
+        self.assertEqual(str(raised.exception),
+                         "AADSTS7000215: Invalid client secret.")
+        # Fixable in Settings; the refresh token is still good.
+        self.assertFalse(raised.exception.terminal)
+
+    def test_revoked_grant_is_terminal(self) -> None:
+        payload = {"error": "invalid_grant",
+                   "error_description": "AADSTS700082: The refresh token has expired."}
+        with patch.object(oauth.requests, "post",
+                          return_value=_response(payload, status_code=400)):
+            with self.assertRaises(AzureDevOpsAuthError) as raised:
+                oauth.refresh_access_token(_config(), "rt")
+
+        self.assertTrue(raised.exception.terminal)
+
+    def test_entra_outage_is_not_terminal(self) -> None:
+        for status_code in (500, 503, 429):
+            with self.subTest(status_code=status_code):
+                with patch.object(oauth.requests, "post",
+                                  return_value=_response({}, status_code=status_code)):
+                    with self.assertRaises(AzureDevOpsAuthError) as raised:
+                        oauth.refresh_access_token(_config(), "rt")
+
+                self.assertFalse(raised.exception.terminal)
+
+    def test_unreachable_entra_is_not_terminal(self) -> None:
+        with patch.object(oauth.requests, "post",
+                          side_effect=oauth.requests.ConnectionError("no route to host")):
+            with self.assertRaises(AzureDevOpsAuthError) as raised:
+                oauth.refresh_access_token(_config(), "rt")
+
+        self.assertFalse(raised.exception.terminal)
+
+
+class ExpiryTest(unittest.TestCase):
+    def test_token_inside_the_safety_margin_counts_as_expired(self) -> None:
+        self.assertTrue(is_expired(_iso(timedelta(seconds=30))))
+
+    def test_token_with_time_to_spare_is_not_expired(self) -> None:
+        self.assertFalse(is_expired(_iso(timedelta(minutes=30))))
+
+    def test_unusable_expiry_forces_a_refresh(self) -> None:
+        self.assertTrue(is_expired(None))
+        self.assertTrue(is_expired("not-a-timestamp"))
+
+    def test_naive_timestamp_is_read_as_utc(self) -> None:
+        naive = (datetime.now(timezone.utc)
+                 + timedelta(minutes=30)).replace(tzinfo=None).isoformat()
+        self.assertFalse(is_expired(naive))
+
+
+class AuthTokenLifecycleTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self._temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self._temporary.cleanup)
+        self.context = CodeeMainContext(data_dir=Path(self._temporary.name))
+        self.auth = AzureDevOpsAuth(_config(), self.context)
+
+    def _store(self, expires_at: str, refresh_token: str | None = "rt") -> None:
+        oauth_tokens.save_tokens(
+            oauth.PROVIDER, access_token="at", refresh_token=refresh_token,
+            expires_at=expires_at, account="dev@acme.com",
+            main_context=self.context)
+
+    def test_unconnected_provider_reports_no_connection(self) -> None:
+        self.assertFalse(self.auth.is_connected())
+        with self.assertRaises(AzureDevOpsAuthError):
+            self.auth.access_token()
+
+    def test_valid_token_is_returned_without_calling_entra(self) -> None:
+        self._store(_iso(timedelta(minutes=30)))
+
+        with patch.object(oauth, "refresh_access_token") as refresh:
+            self.assertEqual(self.auth.access_token(), "at")
+
+        refresh.assert_not_called()
+
+    def test_expired_token_is_refreshed_and_persisted(self) -> None:
+        self._store(_iso(timedelta(seconds=-10)))
+        fresh = {"access_token": "at2", "refresh_token": "rt2",
+                 "expires_at": _iso(timedelta(hours=1)), "scope": oauth.SCOPE}
+
+        with patch.object(oauth, "refresh_access_token", return_value=fresh) as refresh:
+            self.assertEqual(self.auth.access_token(), "at2")
+
+        refresh.assert_called_once()
+        stored = self.auth.connection()
+        self.assertEqual(stored["access_token"], "at2")
+        self.assertEqual(stored["refresh_token"], "rt2")
+        # The account label survives a refresh; Entra doesn't resend it.
+        self.assertEqual(stored["account"], "dev@acme.com")
+
+    def test_refresh_without_a_new_refresh_token_keeps_the_old_one(self) -> None:
+        self._store(_iso(timedelta(seconds=-10)))
+        fresh = {"access_token": "at2", "refresh_token": None,
+                 "expires_at": _iso(timedelta(hours=1))}
+
+        with patch.object(oauth, "refresh_access_token", return_value=fresh):
+            self.auth.access_token()
+
+        self.assertEqual(self.auth.connection()["refresh_token"], "rt")
+
+    def test_rejected_refresh_token_drops_the_connection(self) -> None:
+        self._store(_iso(timedelta(seconds=-10)))
+
+        with patch.object(oauth, "refresh_access_token",
+                          side_effect=AzureDevOpsAuthError("invalid_grant",
+                                                           terminal=True)):
+            with self.assertRaises(AzureDevOpsAuthError):
+                self.auth.access_token()
+
+        # Left connected, every poll would retry a token Entra will never accept.
+        self.assertFalse(self.auth.is_connected())
+
+    def test_transient_refresh_failure_keeps_the_connection(self) -> None:
+        # An Entra outage or a dropped network must not cost a manual reconsent.
+        self._store(_iso(timedelta(seconds=-10)))
+
+        with patch.object(oauth, "refresh_access_token",
+                          side_effect=AzureDevOpsAuthError("Could not reach Entra ID")):
+            with self.assertRaises(AzureDevOpsAuthError):
+                self.auth.access_token()
+
+        self.assertTrue(self.auth.is_connected())
+        self.assertEqual(self.auth.connection()["refresh_token"], "rt")
+
+    def test_connection_survives_a_transient_failure_and_recovers(self) -> None:
+        self._store(_iso(timedelta(seconds=-10)))
+        fresh = {"access_token": "at2", "refresh_token": "rt2",
+                 "expires_at": _iso(timedelta(hours=1))}
+
+        with patch.object(oauth, "refresh_access_token",
+                          side_effect=[AzureDevOpsAuthError("Entra ID is down"), fresh]):
+            with self.assertRaises(AzureDevOpsAuthError):
+                self.auth.access_token()
+            self.assertEqual(self.auth.access_token(), "at2")
+
+    def test_expired_token_without_a_refresh_token_drops_the_connection(self) -> None:
+        self._store(_iso(timedelta(seconds=-10)), refresh_token=None)
+
+        with self.assertRaises(AzureDevOpsAuthError):
+            self.auth.access_token()
+
+        self.assertFalse(self.auth.is_connected())
+
+
+class PendingAuthorizationTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self._temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self._temporary.cleanup)
+        self.context = CodeeMainContext(data_dir=Path(self._temporary.name))
+
+    def test_pending_state_round_trips_once(self) -> None:
+        oauth_tokens.create_pending(
+            oauth.PROVIDER, "state-1", "verifier-1", "http://localhost:8501/cb",
+            main_context=self.context)
+
+        first = oauth_tokens.consume_pending(
+            oauth.PROVIDER, "state-1", main_context=self.context)
+        replayed = oauth_tokens.consume_pending(
+            oauth.PROVIDER, "state-1", main_context=self.context)
+
+        self.assertEqual(first["code_verifier"], "verifier-1")
+        self.assertEqual(first["redirect_uri"], "http://localhost:8501/cb")
+        self.assertIsNone(replayed)
+
+    def test_unknown_state_is_rejected(self) -> None:
+        self.assertIsNone(oauth_tokens.consume_pending(
+            oauth.PROVIDER, "forged-state", main_context=self.context))
+
+    def test_expired_pending_row_is_rejected(self) -> None:
+        oauth_tokens.create_pending(
+            oauth.PROVIDER, "state-1", "verifier-1", "http://cb",
+            main_context=self.context)
+        stale = (datetime.now(timezone.utc)
+                 - oauth_tokens.PENDING_TTL - timedelta(minutes=1)).isoformat()
+        with closing(get_db_connection(self.context)) as conn, conn:
+            conn.execute("UPDATE oauth_pending SET created_at = ?", (stale,))
+
+        self.assertIsNone(oauth_tokens.consume_pending(
+            oauth.PROVIDER, "state-1", main_context=self.context))
+
+
+class TasksProviderTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self._temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self._temporary.cleanup)
+        self.context = CodeeMainContext(data_dir=Path(self._temporary.name))
+        settings = Settings(
+            tasks_provider=TasksProvider.AZURE_DEVOPS,
+            credentials={"azure_devops": {
+                "organization_url": "https://dev.azure.com/acme",
+                "project": "Core",
+                "client_id": "client-1",
+                "client_secret": "secret-1",
+            }})
+        self.provider = AzureDevOpsTasksProvider(settings, self.context)
+
+    def _connect(self) -> None:
+        oauth_tokens.save_tokens(
+            oauth.PROVIDER, access_token="at", refresh_token="rt",
+            expires_at=_iso(timedelta(hours=1)), account="dev@acme.com",
+            main_context=self.context)
+
+    def test_wiql_quotes_statuses_and_orders_by_priority(self) -> None:
+        wiql = self.provider._build_wiql(["Ready", "Bob's queue"])
+
+        self.assertIn("[System.State] IN ('Ready', 'Bob''s queue')", wiql)
+        self.assertIn("[System.AssignedTo] = @Me", wiql)
+        self.assertIn("ORDER BY [Microsoft.VSTS.Common.Priority] ASC", wiql)
+
+    def test_wiql_only_asks_for_codee_work_item_types(self) -> None:
+        wiql = self.provider._build_wiql(["Ready"])
+
+        self.assertIn(
+            "[System.WorkItemType] IN ('Codee Task', 'Codee Story')", wiql)
+
+    def test_not_configured_until_oauth_completes(self) -> None:
+        self.assertFalse(self.provider.is_configured())
+        self._connect()
+        self.assertTrue(self.provider.is_configured())
+
+    def test_no_statuses_means_no_requests(self) -> None:
+        self._connect()
+        with patch.object(oauth.requests, "post") as post:
+            self.assertEqual(self.provider.get_tasks([]), [])
+        post.assert_not_called()
+
+    def test_get_tasks_maps_fields_and_keeps_the_query_order(self) -> None:
+        self._connect()
+        wiql = _response({"workItems": [{"id": 11}, {"id": 12}]})
+        # Deliberately out of order: the batch endpoint doesn't preserve WIQL order.
+        items = _response({"value": [
+            {"id": 12, "fields": {"System.Title": "Second",
+                                  "System.State": "Ready",
+                                  "System.WorkItemType": "Codee Task",
+                                  "Microsoft.VSTS.Common.Priority": 2,
+                                  "System.Tags": "ai; backend"}},
+            {"id": 11, "fields": {"System.Title": "First",
+                                  "System.State": "Ready",
+                                  "System.WorkItemType": "Codee Task",
+                                  "Microsoft.VSTS.Common.Priority": 1,
+                                  "System.Parent": 9}},
+        ]})
+        parents = _response({"value": [
+            {"id": 9, "fields": {"System.Title": "Story",
+                                 "System.State": "Active",
+                                 "System.WorkItemType": "User Story",
+                                 "System.Tags": "epic"}},
+        ]})
+
+        with patch("codee_tasks_azure_devops.provider.requests.post",
+                   side_effect=[wiql, items, parents]):
+            tasks = self.provider.get_tasks(["Ready"])
+
+        self.assertEqual([task.key for task in tasks], ["11", "12"])
+        self.assertEqual(tasks[0].summary, "First")
+        self.assertEqual(tasks[0].priority, "Highest")
+        self.assertEqual(tasks[0].issue_type, "Task")
+        self.assertEqual(tasks[0].parent.key, "9")
+        self.assertEqual(tasks[0].parent.labels, ["epic"])
+        # A parent outside the Codee types keeps whatever Azure DevOps calls it.
+        self.assertEqual(tasks[0].parent.issue_type, "User Story")
+        self.assertEqual(tasks[1].labels, ["ai", "backend"])
+        self.assertEqual(tasks[1].priority, "High")
+
+    def test_codee_story_maps_to_the_story_issue_type(self) -> None:
+        self._connect()
+        wiql = _response({"workItems": [{"id": 21}]})
+        items = _response({"value": [
+            {"id": 21, "fields": {"System.Title": "A story",
+                                  "System.State": "Ready",
+                                  "System.WorkItemType": "Codee Story"}},
+        ]})
+
+        with patch("codee_tasks_azure_devops.provider.requests.post",
+                   side_effect=[wiql, items]):
+            tasks = self.provider.get_tasks(["Ready"])
+
+        self.assertEqual(tasks[0].issue_type, "Story")
+
+    def test_a_child_of_a_codee_story_is_flagged(self) -> None:
+        self._connect()
+        tasks = self._tasks_with_parent_type("Codee Story")
+
+        self.assertTrue(tasks[0].is_parent_codee_story)
+
+    def test_a_child_of_a_plain_story_is_not_flagged(self) -> None:
+        self._connect()
+        # Both types map to the "Story" issue type, so only the raw work item
+        # type separates a Codee story from a story a human owns.
+        tasks = self._tasks_with_parent_type("Story")
+
+        self.assertEqual(tasks[0].parent.issue_type, "Story")
+        self.assertFalse(tasks[0].is_parent_codee_story)
+
+    def test_a_task_without_a_parent_is_not_flagged(self) -> None:
+        self._connect()
+        wiql = _response({"workItems": [{"id": 31}]})
+        items = _response({"value": [
+            {"id": 31, "fields": {"System.Title": "Orphan",
+                                  "System.State": "Ready",
+                                  "System.WorkItemType": "Codee Task"}},
+        ]})
+
+        with patch("codee_tasks_azure_devops.provider.requests.post",
+                   side_effect=[wiql, items]):
+            tasks = self.provider.get_tasks(["Ready"])
+
+        self.assertFalse(tasks[0].is_parent_codee_story)
+
+    def _tasks_with_parent_type(self, parent_type: str) -> list:
+        wiql = _response({"workItems": [{"id": 31}]})
+        items = _response({"value": [
+            {"id": 31, "fields": {"System.Title": "A child",
+                                  "System.State": "Ready",
+                                  "System.WorkItemType": "Codee Task",
+                                  "System.Parent": 30}},
+        ]})
+        parents = _response({"value": [
+            {"id": 30, "fields": {"System.Title": "The parent",
+                                  "System.State": "Active",
+                                  "System.WorkItemType": parent_type}},
+        ]})
+
+        with patch("codee_tasks_azure_devops.provider.requests.post",
+                   side_effect=[wiql, items, parents]):
+            return self.provider.get_tasks(["Ready"])
+
+    def test_empty_result_skips_the_batch_call(self) -> None:
+        self._connect()
+        with patch("codee_tasks_azure_devops.provider.requests.post",
+                   side_effect=[_response({"workItems": []})]) as post:
+            self.assertEqual(self.provider.get_tasks(["Ready"]), [])
+        self.assertEqual(post.call_count, 1)
+
+    def test_expired_authorization_yields_no_tasks_instead_of_raising(self) -> None:
+        # A polling executor must survive a revoked authorization.
+        with patch("codee_tasks_azure_devops.provider.requests.post") as post:
+            self.assertEqual(self.provider.get_tasks(["Ready"]), [])
+        post.assert_not_called()
+
+
+def main():
+    print("OK")
+
+
+if __name__ == "__main__":
+    unittest.main()

codee_tasks_jira/provider.py

@@ -0,0 +1,162 @@
+from typing import Callable
+
+import requests
+
+from codee_main_context.context import Settings, TasksProvider
+from codee_tasks_abstract.provider import AbstractTasksProvider, Task
+
+
+# The label that marks a JIRA story as Codee-owned. Children of such a story
+# are driven by the story's own agent run, so the executor leaves them alone.
+CODEE_STORY_LABEL = "CodeeStory"
+
+
+def _quote_jql(value: str) -> str:
+    escaped = value.replace("\\", "\\\\").replace('"', '\\"')
+    return f'"{escaped}"'
+
+
+class JiraTask(Task):
+    """A JIRA task whose labels are fetched the first time they're read.
+
+    A parent reference in the search response carries no labels, so resolving
+    them eagerly would cost an extra request per tick even when the caller
+    never inspects them. Deferring the fetch keeps the common path request-free;
+    the result is cached so repeated reads don't re-fetch.
+    """
+
+    def __init__(self, labels_loader: Callable[[], list[str]] | None = None, **kwargs):
+        self._labels_loader = labels_loader
+        self._resolved_labels: list[str] | None = None
+        super().__init__(**kwargs)
+
+    @property
+    def labels(self) -> list[str]:
+        if self._resolved_labels is None:
+            if self._raw_labels is not None:
+                self._resolved_labels = self._raw_labels
+            elif self._labels_loader is not None:
+                self._resolved_labels = self._labels_loader()
+            else:
+                self._resolved_labels = []
+        return self._resolved_labels
+
+    @labels.setter
+    def labels(self, value: list[str] | None) -> None:
+        # Set by Task.__init__; None means "not present in the response".
+        self._raw_labels = value
+
+    @property
+    def is_parent_codee_story(self) -> bool:
+        """In JIRA a Codee-owned story is marked with the CodeeStory label."""
+        return (self.parent is not None
+                and CODEE_STORY_LABEL in self.parent.labels)
+
+
+class JiraTasksProvider(AbstractTasksProvider):
+    """Fetches AI-owned issues from JIRA and maps them to provider-agnostic Tasks."""
+
+    def __init__(self, settings: Settings):
+        creds = settings.credentials.get(TasksProvider.JIRA.value, {})
+        self._base_url = creds.get("base_url")
+        self._user_email = creds.get("account_email")
+        self._api_token = creds.get("api_token")
+        # We poll for tasks assigned to the same account we authenticate as.
+        self._assignee_email = self._user_email
+        self._project = creds.get("project")
+
+    def is_configured(self) -> bool:
+        return bool(self._user_email and self._api_token)
+
+    def describe(self) -> str:
+        return (f"JIRA {self._base_url} "
+                f"(project {self._project}, assignee {self._assignee_email})")
+
+    def get_tasks(self, statuses: list[str]) -> list[Task]:
+        """Fetch tasks assigned to the target user in the configured states."""
+        if not statuses:
+            return []
+        url = f"{self._base_url}/rest/api/3/search/jql"
+        params = {
+            "jql": self._build_jql(statuses),
+            "fields": "key,summary,status,issuetype,parent,labels,priority",
+            "maxResults": 50,
+        }
+
+        print("PARAMS", params)
+
+        try:
+            resp = requests.get(
+                url,
+                params=params,
+                auth=(self._user_email, self._api_token),
+                headers={"Accept": "application/json"},
+                timeout=30,
+            )
+            resp.raise_for_status()
+
+            print("RESP", resp)
+
+            data = resp.json()
+        except requests.RequestException as exc:
+            print(f"JIRA API error: {exc}")
+            return []
+
+        return [self._to_task(issue) for issue in data.get("issues", [])]
+
+    def _build_jql(self, statuses: list[str]) -> str:
+        """JQL for AI-owned issues, highest priority first, then oldest."""
+        quoted_statuses = ", ".join(
+            _quote_jql(status) for status in statuses
+        )
+        return (
+            f'project = {self._project} '
+            f'AND assignee = "{self._assignee_email}" '
+            f'AND status in ({quoted_statuses}) '
+            f'ORDER BY priority DESC, created ASC'
+        )
+
+    def _to_task(self, issue: dict) -> Task:
+        fields = issue.get("fields", {})
+        parent_issue = fields.get("parent")
+        return JiraTask(
+            key=issue["key"],
+            summary=fields.get("summary", ""),
+            status=fields.get("status", {}).get("name", ""),
+            issue_type=fields.get("issuetype", {}).get("name", ""),
+            priority=(fields.get("priority") or {}).get("name", "Unknown"),
+            labels=fields.get("labels") or [],
+            parent=self._to_parent_task(
+                parent_issue) if parent_issue else None,
+        )
+
+    def _to_parent_task(self, parent_issue: dict) -> Task:
+        # Labels aren't included for a parent, so defer the fetch until read.
+        key = parent_issue["key"]
+        fields = parent_issue.get("fields", {})
+        return JiraTask(
+            key=key,
+            summary=fields.get("summary", ""),
+            status=fields.get("status", {}).get("name", ""),
+            issue_type=fields.get("issuetype", {}).get("name", ""),
+            priority=(fields.get("priority") or {}).get("name", "Unknown"),
+            labels=fields.get("labels"),
+            labels_loader=lambda: self._fetch_issue_labels(key),
+        )
+
+    def _fetch_issue_labels(self, issue_key: str) -> list[str]:
+        """Fetch labels for a single JIRA issue."""
+        url = f"{self._base_url}/rest/api/3/issue/{issue_key}"
+        try:
+            resp = requests.get(
+                url,
+                params={"fields": "labels"},
+                auth=(self._user_email, self._api_token),
+                headers={"Accept": "application/json"},
+                timeout=30,
+            )
+            resp.raise_for_status()
+            return resp.json().get("fields", {}).get("labels", [])
+        except requests.RequestException as exc:
+            print(f"[cron_jira] Failed to fetch labels for {issue_key}: {exc}")
+            return []