feat(worker): support multiple git platforms in fallback worker

Add platform field to repo query and check platform compatibility.
Add GitLab and Bitbucket token scope fetching in auth callback.
Default to GitHub for legacy repos and throw error for unsupported platforms.

Author: devakone

apps/web/src/app/api/auth/[provider]/callback/route.ts

@@ -23,6 +23,39 @@ async function fetchGithubTokenScopes(token: string): Promise<string[]> {
     .filter(Boolean);
 }
 
+async function fetchGitlabTokenScopes(token: string): Promise<string[]> {
+  // GitLab OAuth tokens have scopes defined at app creation, but we can verify
+  // the token is valid by hitting the user endpoint
+  const res = await fetch("https://gitlab.com/api/v4/user", {
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+    cache: "no-store",
+  });
+
+  if (!res.ok) return [];
+
+  // GitLab doesn't expose scopes in response headers for OAuth tokens
+  // Return the default scopes we requested during OAuth
+  return ["read_user", "read_api", "read_repository"];
+}
+
+async function fetchBitbucketTokenScopes(token: string): Promise<string[]> {
+  // Bitbucket OAuth scopes are defined at app creation time
+  // Verify the token is valid by hitting the user endpoint
+  const res = await fetch("https://api.bitbucket.org/2.0/user", {
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+    cache: "no-store",
+  });
+
+  if (!res.ok) return [];
+
+  // Return the scopes we requested during OAuth
+  return ["account", "repository", "pullrequest"];
+}
+
 export async function GET(
   request: Request,
   { params }: { params: Promise<{ provider: string }> }
@@ -85,8 +118,11 @@ export async function GET(
     let scopes: string[] = [];
     if (provider === "github") {
       scopes = await fetchGithubTokenScopes(providerToken).catch(() => []);
+    } else if (provider === "gitlab") {
+      scopes = await fetchGitlabTokenScopes(providerToken).catch(() => []);
+    } else if (provider === "bitbucket") {
+      scopes = await fetchBitbucketTokenScopes(providerToken).catch(() => []);
     }
-    // TODO: Implement scopes fetching for GitLab/Bitbucket if needed
 
     // Check if we need to set is_primary
     // If the user has no other connections, this one is primary.

apps/worker/src/index.ts

@@ -468,26 +468,35 @@ async function processJob(jobId: string, config: WorkerConfig): Promise<void> {
 
     const { data: repo, error: repoError } = await supabase
       .from("repos")
-      .select("id, owner, name, full_name")
+      .select("id, owner, name, full_name, platform")
       .eq("id", job.repo_id)
       .single();
 
     if (repoError || !repo) throw new Error("Job repo not found");
 
+    // Default to github for legacy repos without platform field
+    const platform = repo.platform ?? "github";
+
+    // This fallback worker only supports GitHub - use Inngest for GitLab/Bitbucket
+    if (platform !== "github") {
+      throw new Error(`Platform "${platform}" not supported by fallback worker. Use Inngest-based processing for GitLab/Bitbucket repos.`);
+    }
+
     if (!config.githubTokenEncryptionKey) {
       throw new Error("Missing GITHUB_TOKEN_ENCRYPTION_KEY");
     }
 
-    const { data: ghAccount, error: ghError } = await supabase
-      .from("github_accounts")
+    const { data: platformConnection, error: connectionError } = await supabase
+      .from("platform_connections")
       .select("encrypted_token")
       .eq("user_id", job.user_id)
+      .eq("platform", platform)
       .single();
 
-    if (ghError || !ghAccount) throw new Error("GitHub account not connected");
+    if (connectionError || !platformConnection) throw new Error(`${platform} account not connected`);
 
     const githubToken = decryptString(
-      ghAccount.encrypted_token,
+      platformConnection.encrypted_token,
       config.githubTokenEncryptionKey
     );