Merge pull request #26839 from RedlineTriad/bitbucket-server-scopes

Fix Bitbucket Cloud OAuth scopes being used for BitbucketServer in ScmAuth

.changeset/pretty-plants-hammer.md

@@ -0,0 +1,5 @@
+---
+'@backstage/integration-react': minor
+---
+
+Added new ScmAuth method `forBitbucketServer` that uses correct OAuth scopes by default. Also updated `forBitbucket` method to allow overriding the default OAuth scopes.

docs/auth/bitbucketServer/provider.md

@@ -31,7 +31,7 @@ auth:
   providers:
     bitbucketServer:
       development:
-        host: bitbucket.org
+        host: bitbucket.example.org
         clientId: ${AUTH_BITBUCKET_SERVER_CLIENT_ID}
         clientSecret: ${AUTH_BITBUCKET_SERVER_CLIENT_SECRET}
 ```
@@ -77,7 +77,14 @@ backend.add(
 //...
 ```
 
-## Adding the provider to the Backstage frontend
+## Frontend Configuration
 
-To add the provider to the frontend, add the `bitbucketServerAuthApi` reference and `SignInPage` component as shown
-in [Adding the provider to the sign-in page](../index.md#sign-in-configuration).
+### Sign-in
+
+To add the provider to the frontend, add the `bitbucketServerAuthApiRef` reference and
+`SignInPage` component as shown in
+[Adding the provider to the sign-in page](../index.md#sign-in-configuration).
+
+### ScmAuth
+
+For backstage to be able to use the oauth token of the logged in user to access the Bitbucket Server API, you need to add it to list of ScmAuth providers as shown in [Custom ScmAuthApi Implementation](../index.md#custom-scmauthapi-implementation) using the `ScmAuth.forBitbucketServer` method.

packages/integration-react/report.api.md

@@ -55,6 +55,20 @@ export class ScmAuth implements ScmAuthApi {
     bitbucketAuthApi: OAuthApi,
     options?: {
       host?: string;
+      scopeMapping?: {
+        default?: string[];
+        repoWrite?: string[];
+      };
+    },
+  ): ScmAuth;
+  static forBitbucketServer(
+    bitbucketAuthApi: OAuthApi,
+    options: {
+      host: string;
+      scopeMapping?: {
+        default?: string[];
+        repoWrite?: string[];
+      };
     },
   ): ScmAuth;
   static forGithub(

packages/integration-react/src/api/ScmAuth.ts

@@ -226,12 +226,63 @@ export class ScmAuth implements ScmAuthApi {
     bitbucketAuthApi: OAuthApi,
     options?: {
       host?: string;
+      scopeMapping?: {
+        default?: string[];
+        repoWrite?: string[];
+      };
     },
   ): ScmAuth {
     const host = options?.host ?? 'bitbucket.org';
+    const defaultScopes = options?.scopeMapping?.default ?? [
+      'account',
+      'team',
+      'pullrequest',
+      'snippet',
+      'issue',
+    ];
+    const repoWriteScopes = options?.scopeMapping?.repoWrite ?? [
+      'pullrequest:write',
+      'snippet:write',
+      'issue:write',
+    ];
     return new ScmAuth('bitbucket', bitbucketAuthApi, host, {
-      default: ['account', 'team', 'pullrequest', 'snippet', 'issue'],
-      repoWrite: ['pullrequest:write', 'snippet:write', 'issue:write'],
+      default: defaultScopes,
+      repoWrite: repoWriteScopes,
+    });
+  }
+
+  /**
+   * Creates a new ScmAuth instance that handles authentication towards Bitbucket Server.
+   *
+   * The host option determines which URLs that are handled by this instance.
+   *
+   * The default scopes are:
+   *
+   * `PUBLIC_REPOS REPOS_READ`
+   *
+   * If the additional `repoWrite` permission is requested, these scopes are added:
+   *
+   * `REPO_WRITE`
+   */
+  static forBitbucketServer(
+    bitbucketAuthApi: OAuthApi,
+    options: {
+      host: string;
+      scopeMapping?: {
+        default?: string[];
+        repoWrite?: string[];
+      };
+    },
+  ): ScmAuth {
+    return this.forBitbucket(bitbucketAuthApi, {
+      host: options.host,
+      scopeMapping: {
+        default: options.scopeMapping?.default ?? [
+          'PUBLIC_REPOS',
+          'REPOS_READ',
+        ],
+        repoWrite: options.scopeMapping?.repoWrite ?? ['REPO_WRITE'],
+      },
     });
   }