Bitbucket DC: Use permissions/search Endpoint to support Unlicensed Service Accounts and Improve Auth Efficiency

Summary

Follow-up to #2468. Currently, PAC's Bitbucket Data Center integration requires the service account to be a licensed Bitbucket user (LICENSED_USER global permission) because the vendored go-scm library calls /rest/api/1.0/admin/groups/more-members to resolve group membership. This endpoint requires the LICENSED_USER global permission, which means organizations must consume a Bitbucket license seat for what is essentially a technical/bot account.

Motivation

Cost: A licensed Bitbucket DC user seat costs money. Technical service accounts shouldn't need one.

Current Behavior

IsMember() in go-scm (scm/driver/stash/org.go)

1. GET /projects/{key}/permissions/users — finds directly assigned users
2. GET /projects/{key}/permissions/groups — lists groups with project permissions
3. For each group: GET /admin/groups/more-members?context={group} — requires LICENSED_USER

Step 3 fails if the service account is unlicensed. The error surfaces as "No message available" and aborts the entire auth check. The repo-level and OWNERS file fallbacks never execute.

Desired

Bitbucket Data Center 8.5 added the permissions/search endpoint:

• Project level: GET /projects/{projectKey}/permissions/search?filterText={user}
  • Requires: PROJECT_ADMIN
  • Returns: direct and implied permissions (including group-inherited and global)
• Repo level: GET /projects/{projectKey}/repos/{repoSlug}/permissions/search?filterText={user}
  • Requires: REPO_ADMIN
  • Returns: direct and implied permissions (including group-inherited, project-inherited, and global)

These endpoints:

• Do NOT require LICENSED_USER — they are gated by project/repo-level permissions that the service account already has
• Return effective permissions including group inheritance in a single API call
• Eliminate the need for the /admin/ endpoint entirely

Minimum Bitbucket DC version

Requires Bitbucket Data Center 8.5+ (released mid-2022). Bitbucket 7.x reached end of support in February 2024.

Related

• #2468 PAC service account must be a licensed user (root cause / docs fix)
• jenkins-x/go-scm#521
• jenkins-x/go-scm#315
• jenkins-x/go-scm#310

Start with the Bitbucket membership check in vendored go-scm's scm/driver/stash/org.go and review the permissions/search endpoints and related go-scm issues. Done means Bitbucket Data Center 8.5+ authentication checks use the project or repository search endpoint without requiring LICENSED_USER, while preserving effective permission handling.