Depreciation of BitbucketCloud teams and users endpoints

[piroux]

Problem Summary

The /2.0/users and /2.0/teams endpoints are being deprecated but not the /2.0/user, so there is a probability that the current BitbucketCloud connector won't be working anymore from October 14th. Note that I don't know enough of the internal logic of the connector and dex, so maybe with only /2.0/user, the login might still work, but not sure.

https://developer.atlassian.com/cloud/bitbucket/bitbucket-api-teams-deprecation/

On October 14, 2020 all of the /2.0/teams/ and most of the /2.0/users/ API endpoints will be removed. You need to update your Bitbucket Cloud integrations to use the new /2.0/workspaces/ endpoints. These endpoints are available today, so you can start updating your code immediately.

Resolution

The api call /2.0/user/emails can be kept.

The api call /2.0/teams?role=member shall be transitioned to /2.0/user/permissions/teams.

I do not know if the scope should be changed or kept as-is, to access the /2.0/user/permissions/teams endpoint , as there is no mention of any new workspace scope in the docs. So maybe it does not need to be changed.

[sagikazarmark]

Maybe @nabokihms could take a look at this?

[nabokihms]

@sagikazarmark yeah, I will take a look.

[sagikazarmark]

Awesome! Thanks!

How does this affect your other PR (#1688)?

[nabokihms]

In #1688 I use legacy API, but I will research if it is already possible to use other endpoints to get team groups.

[nabokihms]

1. Atlassian suggests to use /workspaces endpoint instead of a /teams, but we can't get whether a workspace is a team or not. Thus we can't use this approach.

2. Endpoint /user/permissions/teams looks good, and you only need Read account permissions to access it. After switching to a new endpoint, we will be able to remove note about giving Read Team membership access rights (team scope) to oauth2 consumers from dex documentation. Now it is called Workspace membership, so the dex documentation is already not accurate.

3. The only problem is that /user/permissions/teams is not a drop-in replacement for /teams. We need to adjust the code a little. I think it's not a big deal.

4. It has nothing to do with feat: Add team groups support to bitbucket connector #1688. According to Atlassian documentation, we still have no API 2.0 endpoints to work with groups (no announcements, no plans).

This issue looks urgent. I will open PR ASAP.