Skip to content

Commit 8d171f6

Browse files
brendan-kellamclaude
brendan-kellam
and
claude
authored
feat: add Bitbucket Cloud OAuth identity provider (#924)
* feat: add Bitbucket Cloud OAuth identity provider - Add BitbucketCloudIdentityProviderConfig schema (provider: "bitbucket-cloud") - Add createBitbucketCloudProvider() in sso.ts with id override and repository scope - Add bitbucket-cloud token refresh support using HTTP Basic Auth - Add IdentityProviderType derived from schema union for type-safe provider constants - Add PERMISSION_SYNC_SUPPORTED_IDENTITY_PROVIDERS constant - Add Bitbucket Cloud provider info to getAuthProviderInfo() utility - Add idp.mdx docs for Bitbucket Cloud OAuth consumer setup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update CHANGELOG for #924 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feedback --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 5be4667 commit 8d171f6

File tree

17 files changed

+927
-19
lines changed

17 files changed

+927
-19
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
99

1010
### Added
1111
- Added PostHog events for chat UI interactions (details card expand/collapse, copy answer, table of contents toggle) and repo tracking in `wa_chat_message_sent`. [#922](https://github.com/sourcebot-dev/sourcebot/pull/922)
12+
- Added Bitbucket Cloud OAuth identity provider support (`provider: "bitbucket-cloud"`) for SSO and account-linked permission syncing. [#924](https://github.com/sourcebot-dev/sourcebot/pull/924)
1213

1314
## [4.11.7] - 2026-02-23
1415

‎docs/docs/configuration/idp.mdx‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,59 @@ in the GitLab identity provider config.
165165
</Steps>
166166
</Accordion>
167167

168+
### Bitbucket Cloud
169+
170+
[Auth.js Bitbucket Provider Docs](https://authjs.dev/getting-started/providers/bitbucket)
171+
172+
A Bitbucket Cloud connection can be used for [authentication](/docs/configuration/auth) and/or [permission syncing](/docs/features/permission-syncing). This is controlled using the `purpose` field
173+
in the Bitbucket Cloud identity provider config.
174+
175+
<Accordion title="instructions">
176+
<Steps>
177+
<Step title="Register an OAuth Consumer">
178+
To begin, you must register an OAuth consumer in Bitbucket to facilitate the identity provider connection.
179+
180+
Navigate to your Bitbucket workspace settings at `https://bitbucket.org/<your-workspace>/workspace/settings/api` and create a new **OAuth consumer** under the **OAuth consumers** section.
181+
182+
When configuring your consumer:
183+
- Set the callback URL to `<sourcebot_url>/api/auth/callback/bitbucket-cloud` (ex. https://sourcebot.coolcorp.com/api/auth/callback/bitbucket-cloud)
184+
- Enable **Account: Read**
185+
- If using for permission syncing, also enable **Repositories: Read**
186+
187+
The result of creating an OAuth consumer is a `Key` (`CLIENT_ID`) and `Secret` (`CLIENT_SECRET`) which you'll provide to Sourcebot.
188+
</Step>
189+
<Step title="Define environment variables">
190+
To provide Sourcebot the client id and secret for your OAuth consumer you must set them as environment variables. These can be named whatever you like
191+
(ex. `BITBUCKET_CLOUD_IDENTITY_PROVIDER_CLIENT_ID` and `BITBUCKET_CLOUD_IDENTITY_PROVIDER_CLIENT_SECRET`)
192+
</Step>
193+
<Step title="Define the identity provider config">
194+
Finally, pass the client id and secret to Sourcebot by defining a `identityProvider` object in the [config file](/docs/configuration/config-file):
195+
196+
```json wrap icon="code"
197+
{
198+
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
199+
"identityProviders": [
200+
{
201+
"provider": "bitbucket-cloud",
202+
// "sso" for auth + perm sync, "account_linking" for only perm sync
203+
"purpose": "account_linking",
204+
// if purpose == "account_linking" this controls if a user must connect to the IdP
205+
"accountLinkingRequired": true,
206+
"clientId": {
207+
"env": "YOUR_CLIENT_ID_ENV_VAR"
208+
},
209+
"clientSecret": {
210+
"env": "YOUR_CLIENT_SECRET_ENV_VAR"
211+
}
212+
}
213+
]
214+
}
215+
```
216+
</Step>
217+
</Steps>
218+
</Accordion>
219+
220+
168221
### Google
169222

170223
[Auth.js Google Provider Docs](https://authjs.dev/getting-started/providers/google)

‎docs/snippets/schemas/v3/identityProvider.schema.mdx‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,6 +648,91 @@
648648
"audience"
649649
]
650650
},
651+
"BitbucketCloudIdentityProviderConfig": {
652+
"type": "object",
653+
"additionalProperties": false,
654+
"properties": {
655+
"provider": {
656+
"const": "bitbucket-cloud"
657+
},
658+
"purpose": {
659+
"enum": [
660+
"sso",
661+
"account_linking"
662+
]
663+
},
664+
"clientId": {
665+
"anyOf": [
666+
{
667+
"type": "object",
668+
"properties": {
669+
"env": {
670+
"type": "string",
671+
"description": "The name of the environment variable that contains the token."
672+
}
673+
},
674+
"required": [
675+
"env"
676+
],
677+
"additionalProperties": false
678+
},
679+
{
680+
"type": "object",
681+
"properties": {
682+
"googleCloudSecret": {
683+
"type": "string",
684+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
685+
}
686+
},
687+
"required": [
688+
"googleCloudSecret"
689+
],
690+
"additionalProperties": false
691+
}
692+
]
693+
},
694+
"clientSecret": {
695+
"anyOf": [
696+
{
697+
"type": "object",
698+
"properties": {
699+
"env": {
700+
"type": "string",
701+
"description": "The name of the environment variable that contains the token."
702+
}
703+
},
704+
"required": [
705+
"env"
706+
],
707+
"additionalProperties": false
708+
},
709+
{
710+
"type": "object",
711+
"properties": {
712+
"googleCloudSecret": {
713+
"type": "string",
714+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
715+
}
716+
},
717+
"required": [
718+
"googleCloudSecret"
719+
],
720+
"additionalProperties": false
721+
}
722+
]
723+
},
724+
"accountLinkingRequired": {
725+
"type": "boolean",
726+
"default": false
727+
}
728+
},
729+
"required": [
730+
"provider",
731+
"purpose",
732+
"clientId",
733+
"clientSecret"
734+
]
735+
},
651736
"AuthentikIdentityProviderConfig": {
652737
"type": "object",
653738
"additionalProperties": false,
@@ -1511,6 +1596,91 @@
15111596
"clientSecret",
15121597
"issuer"
15131598
]
1599+
},
1600+
{
1601+
"type": "object",
1602+
"additionalProperties": false,
1603+
"properties": {
1604+
"provider": {
1605+
"const": "bitbucket-cloud"
1606+
},
1607+
"purpose": {
1608+
"enum": [
1609+
"sso",
1610+
"account_linking"
1611+
]
1612+
},
1613+
"clientId": {
1614+
"anyOf": [
1615+
{
1616+
"type": "object",
1617+
"properties": {
1618+
"env": {
1619+
"type": "string",
1620+
"description": "The name of the environment variable that contains the token."
1621+
}
1622+
},
1623+
"required": [
1624+
"env"
1625+
],
1626+
"additionalProperties": false
1627+
},
1628+
{
1629+
"type": "object",
1630+
"properties": {
1631+
"googleCloudSecret": {
1632+
"type": "string",
1633+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1634+
}
1635+
},
1636+
"required": [
1637+
"googleCloudSecret"
1638+
],
1639+
"additionalProperties": false
1640+
}
1641+
]
1642+
},
1643+
"clientSecret": {
1644+
"anyOf": [
1645+
{
1646+
"type": "object",
1647+
"properties": {
1648+
"env": {
1649+
"type": "string",
1650+
"description": "The name of the environment variable that contains the token."
1651+
}
1652+
},
1653+
"required": [
1654+
"env"
1655+
],
1656+
"additionalProperties": false
1657+
},
1658+
{
1659+
"type": "object",
1660+
"properties": {
1661+
"googleCloudSecret": {
1662+
"type": "string",
1663+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1664+
}
1665+
},
1666+
"required": [
1667+
"googleCloudSecret"
1668+
],
1669+
"additionalProperties": false
1670+
}
1671+
]
1672+
},
1673+
"accountLinkingRequired": {
1674+
"type": "boolean",
1675+
"default": false
1676+
}
1677+
},
1678+
"required": [
1679+
"provider",
1680+
"purpose",
1681+
"clientId",
1682+
"clientSecret"
1683+
]
15141684
}
15151685
]
15161686
}

0 commit comments

Comments
 (0)