fix(bitbucket): fold only the slug segments Bitbucket canonicalizes

Segment-wise comparison replaces whole-path case folding, so a cursor that recases
a fixed endpoint literal (repositories, commits, pullrequests) fails locally again
instead of being deferred to Bitbucket. Only the workspace and repository segments
of a /2.0/repositories path fold; file paths and literals stay verbatim.

Author: waleedlatif1

apps/sim/tools/bitbucket/merge_pull_request.ts

@@ -11,7 +11,7 @@ import {
   bitbucketHeaders,
   bitbucketJson,
   bitbucketPullRequestPath,
-  equalsIgnoreCase,
+  bitbucketRepositoryPathHasPrefix,
   normalizeBitbucketPullRequest,
   validateBitbucketOpaqueUrl,
 } from '@/tools/bitbucket/utils'
@@ -53,7 +53,7 @@ function mergeTaskLocation(
   )
   const parsed = new URL(taskUrl)
   const expectedPrefix = `/2.0${bitbucketPullRequestPath(params.workspaceSlug, params.repoSlug, params.prId)}/merge/task-status/`
-  if (!equalsIgnoreCase(parsed.pathname.slice(0, expectedPrefix.length), expectedPrefix)) {
+  if (!bitbucketRepositoryPathHasPrefix(parsed.pathname, expectedPrefix)) {
     throw new Error('Bitbucket merge task Location did not match the requested pull request')
   }
   const taskId = decodeURIComponent(parsed.pathname.slice(expectedPrefix.length))

apps/sim/tools/bitbucket/utils.test.ts

@@ -117,6 +117,16 @@ describe('Bitbucket path and pagination safety', () => {
       })
     ).toBe(`https://api.bitbucket.org/2.0/repositories/acme/demo/src/${revision}/src/dir?page=2`)
 
+    for (const recased of [
+      'https://api.bitbucket.org/2.0/Repositories/acme/demo/commits?page=2',
+      'https://api.bitbucket.org/2.0/repositories/acme/demo/Commits?page=2',
+    ]) {
+      expect(
+        () => bitbucketApiUrl('/repositories/ACME/Demo/commits', { nextUrl: recased }),
+        recased
+      ).toThrow(/does not belong to this Bitbucket list endpoint/)
+    }
+
     expect(() =>
       bitbucketApiUrl(`/repositories/acme/demo/src/${revision}/src/Dir`, {
         nextUrl: `https://api.bitbucket.org/2.0/repositories/acme/demo/src/${revision}/src/dir?page=2`,

apps/sim/tools/bitbucket/utils.ts

@@ -320,13 +320,54 @@ export function validateBitbucketOpaqueUrl(value: string): string {
  * Bitbucket resolves workspace and repository slugs case-insensitively but echoes the canonical
  * lowercase form in `next` links, redirect `Location` headers, and merge task URLs. Binding those
  * back to the caller's slug must therefore ignore case, or a mixed-case slug that Bitbucket just
- * accepted fails on the follow-up request. Repository file paths are compared verbatim — git
- * treats those as case-sensitive.
+ * accepted fails on the follow-up request.
+ *
+ * Only those two segments are canonicalized, so only those two are folded. Fixed API literals and
+ * repository file paths compare verbatim, keeping a malformed path a deterministic local failure
+ * rather than one deferred to Bitbucket. Hex revisions are folded by their own dedicated check.
  */
+function isBitbucketSlugSegment(segments: string[], index: number): boolean {
+  return segments[0] === '2.0' && segments[1] === 'repositories' && (index === 2 || index === 3)
+}
+
+function bitbucketSegmentsMatch(candidate: string[], expected: string[]): boolean {
+  if (candidate.length !== expected.length) return false
+  return expected.every(
+    (segment, index) =>
+      candidate[index] === segment ||
+      (isBitbucketSlugSegment(expected, index) && equalsIgnoreCase(candidate[index], segment))
+  )
+}
+
+/** Compares two absolute API paths segment-wise under the slug-only case rule above. */
+function bitbucketPathsMatch(candidatePath: string, expectedPath: string): boolean {
+  return bitbucketSegmentsMatch(
+    candidatePath.replace(/^\//, '').split('/'),
+    expectedPath.replace(/^\//, '').split('/')
+  )
+}
+
+/** True when `candidatePath` begins with every segment of `expectedPrefix`, same case rule. */
+function bitbucketPathHasPrefix(candidatePath: string, expectedPrefix: string): boolean {
+  const expected = expectedPrefix.replace(/^\//, '').replace(/\/$/, '').split('/')
+  const candidate = candidatePath.replace(/^\//, '').split('/')
+  return (
+    candidate.length > expected.length &&
+    bitbucketSegmentsMatch(candidate.slice(0, expected.length), expected)
+  )
+}
+
 export function equalsIgnoreCase(a: string, b: string): boolean {
   return a.toLowerCase() === b.toLowerCase()
 }
 
+export function bitbucketRepositoryPathHasPrefix(
+  candidatePath: string,
+  expectedPrefix: string
+): boolean {
+  return bitbucketPathHasPrefix(candidatePath, expectedPrefix)
+}
+
 export type BitbucketPullRequestRedirectKind = 'diff' | 'diffstat'
 
 export function validateBitbucketPullRequestRedirect(
@@ -338,10 +379,7 @@ export function validateBitbucketPullRequestRedirect(
   const validated = validateBitbucketOpaqueUrl(value)
   const parsed = new URL(validated)
   const expectedPrefix = `/2.0${bitbucketRepositoryPath(workspaceSlug, repoSlug)}/${kind}/`
-  const encodedSpec = equalsIgnoreCase(
-    parsed.pathname.slice(0, expectedPrefix.length),
-    expectedPrefix
-  )
+  const encodedSpec = bitbucketPathHasPrefix(parsed.pathname, expectedPrefix)
     ? parsed.pathname.slice(expectedPrefix.length)
     : ''
   if (!encodedSpec) {
@@ -431,9 +469,7 @@ export function bitbucketApiUrl(
       const prefixSegments = decodePath(prefix)
       if (
         candidateSegments.length <= prefixSegments.length ||
-        !prefixSegments.every((segment, index) =>
-          equalsIgnoreCase(candidateSegments[index], segment)
-        )
+        !bitbucketSegmentsMatch(candidateSegments.slice(0, prefixSegments.length), prefixSegments)
       ) {
         throw new Error('nextUrl does not belong to this Bitbucket list endpoint')
       }
@@ -452,7 +488,7 @@ export function bitbucketApiUrl(
       ) {
         throw new Error('nextUrl does not preserve the requested Bitbucket directory path')
       }
-    } else if (!equalsIgnoreCase(candidatePath.replace(/\/$/, ''), exactPath)) {
+    } else if (!bitbucketPathsMatch(candidatePath.replace(/\/$/, ''), exactPath)) {
       throw new Error('nextUrl does not belong to this Bitbucket list endpoint')
     }
     return validated