[Bug]: Bitbucket merge still fails — removed /user/permissions/repositories endpoint returns 404, not 410
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 23k
- Forks
- 5.9k
- Avg merge
- 11h 14m
- Merged PRs (30d)
- 357
Description
Summary
Merging a Bitbucket Cloud pull request from T3 Code fails with Bitbucket returned HTTP 404. The failure comes from the viewer-permission gate, not the merge call: GET /2.0/user/permissions/repositories was removed by Bitbucket (CHANGE-2770), and production Bitbucket answers 404 for it — but the fallback added in #6525 only recognises 410, so the removed-endpoint path never triggers and every write action is blocked.
Version
- T3 Code
0.0.34-nightly.20260824.1179(trace below) and0.0.35-nightly.20260826.1195;mainstill has the same check atapps/server/src/pullRequest/BitbucketPullRequestApi.ts:118. - Linux (NixOS), AppImage build.
- Bitbucket Cloud, user API token.
GET /2.0/userand all PR listing calls succeed with the same credential.
Trace
From ~/.t3/userdata/logs/server.trace.ndjson:
ws.rpc.pullRequests.runAction -> Failure
PullRequestOperationError: Pull request operation runAction failed: Bitbucket returned HTTP 404.
[cause]: PullRequestProviderError: bitbucket failed in getViewerPermissions: Bitbucket returned HTTP 404.
[cause]: BitbucketResponseError: Bitbucket API failed in request: Bitbucket returned HTTP 404.
The failing HTTP span:
GET https://api.bitbucket.org/2.0/user/permissions/repositories?q=repository.full_name%3D%22<workspace>%2F<repo>%22
http.response.status_code: 404
Confirming the endpoint is gone (not a permission problem)
Unauthenticated probes, so no token is involved:
$ curl -s -o /dev/null -w '%{http_code}\n' https://api.bitbucket.org/2.0/user
401
$ curl -s -o /dev/null -w '%{http_code}\n' 'https://api.bitbucket.org/2.0/user/permissions/repositories?q=repository.full_name%3D%22x%2Fy%22'
404
$ curl -s -o /dev/null -w '%{http_code}\n' https://api.bitbucket.org/2.0/user/permissions/workspaces
404
An existing endpoint answers 401 without auth; the removed ones answer 404 regardless of auth.
Cause
#6525 (closes #6341) added:
function isRepositoryPermissionRemovedError(error) {
return error._tag === "BitbucketResponseError" && error.status === 410;
}
The PR notes it was not exercised against a live Bitbucket account and was coded to the documented 410. Real Bitbucket returns 404, so getRepositoryPermission still hard-fails, getViewerPermissions fails, and PullRequestService.viewerPermissionsOf blocks merge (and other writes) before the merge request is sent.
Suggested fix
Treat 404 from /2.0/user/permissions/repositories the same as 410 in isRepositoryPermissionRemovedError (permission unknown → not blocking), and update the unit test to cover both statuses. Happy to send a PR.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in apps/server/src/pullRequest/BitbucketPullRequestApi.ts at the permission check around line 118, then find its existing unit test. Reproduce the removed-endpoint handling for both HTTP 404 and 410, and run the relevant Bitbucket permission tests to confirm that viewer-permission lookup no longer blocks pull request actions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 86/100