{
"$schema": "https://ui.shadcn.com/schema/registry-item.json",
"name": "provider-bitbucket",
"title": "Bitbucket Provider",
"description": "A self-contained form component that emits an OidcPolicy for a Bitbucket Pipelines caller: paste-in identity provider URL and audience from repository settings, plus repository UUID scoping. Note: the discovery document only exists after Pipelines OIDC is enabled and one pipeline has run.",
"registryDependencies": [
"https://ui.shadcn.com/oidc/r/policy.json",
"https://ui.shadcn.com/oidc/r/claims.json",
"button",
"field",
"input",
"alert"
],
"files": [
{
"path": "registry/oidc/components/provider-bitbucket.tsx",
"content": "\"use client\"\n\nimport * as React from \"react\"\n\nimport { cn } from \"@/lib/utils\"\nimport { Button } from \"@/components/ui/button\"\nimport { Field, FieldDescription, FieldLabel } from \"@/components/ui/field\"\nimport { Input } from \"@/components/ui/input\"\nimport { Alert, AlertTitle } from \"@/components/ui/alert\"\nimport {\n ClaimChip,\n ClaimsList,\n claimRowsFromPolicy,\n claimsListValid,\n mergeClaimRows,\n type ClaimRow,\n} from \"@/components/oidc/claims\"\nimport type { OidcPolicy } from \"@/lib/oidc/policy\"\n\nfunction BitbucketIcon({ ...props }: React.ComponentProps<\"svg\">) {\n return (\n \n )\n}\n\ntype Fields = {\n issuer: string\n audience: string\n repositoryUuid: string\n extraClaims: ClaimRow[]\n}\n\nconst DEFAULTS: Fields = {\n issuer: \"\",\n audience: \"\",\n repositoryUuid: \"\",\n extraClaims: [],\n}\n\nconst FIRST_CLASS_CLAIMS = [\"aud\", \"repositoryUuid\"]\n\nconst WORKSPACE_AUD_PREFIX = \"ari:cloud:bitbucket::workspace/\"\n\n// Bitbucket UUID claims are brace-wrapped; accept bare pastes too.\nfunction braced(uuid: string) {\n if (!uuid) {\n return uuid\n }\n return uuid.startsWith(\"{\") ? uuid : `{${uuid.replace(/}$/, \"\")}}`\n}\n\nfunction compile(fields: Fields) {\n const claims: Record = {}\n if (fields.audience) {\n claims.aud = [fields.audience]\n }\n if (fields.repositoryUuid) {\n claims.repositoryUuid = [braced(fields.repositoryUuid)]\n }\n mergeClaimRows(claims, fields.extraClaims, FIRST_CLASS_CLAIMS)\n return { issuer: fields.issuer, claims }\n}\n\nfunction parse(policy: OidcPolicy) {\n if (\n !policy.issuer.startsWith(\"https://api.bitbucket.org/2.0/workspaces/\") ||\n !policy.issuer.endsWith(\"/pipelines-config/identity/oidc\")\n ) {\n return null\n }\n if (\n FIRST_CLASS_CLAIMS.some((name) => (policy.claims[name]?.length ?? 0) > 1)\n ) {\n return null\n }\n const extraClaims = claimRowsFromPolicy(policy.claims, FIRST_CLASS_CLAIMS)\n if (extraClaims === null) {\n return null\n }\n\n return {\n issuer: policy.issuer,\n audience: policy.claims.aud?.[0] ?? \"\",\n repositoryUuid: policy.claims.repositoryUuid?.[0] ?? \"\",\n extraClaims,\n }\n}\n\n/** True when this form can represent the policy — for routing an edit. */\nfunction matchesBitbucketPolicy(policy: OidcPolicy) {\n return parse(policy) !== null\n}\n\nfunction BitbucketPolicyForm({\n defaultValue,\n onChange,\n onSubmit,\n className,\n}: {\n defaultValue?: OidcPolicy\n onChange?: (policy: OidcPolicy) => void\n onSubmit: (policy: OidcPolicy) => void\n className?: string\n}) {\n const [fields, setFields] = React.useState(() =>\n defaultValue ? (parse(defaultValue) ?? DEFAULTS) : DEFAULTS\n )\n\n const apply = (next: Fields) => {\n setFields(next)\n const policy = compile(next)\n onChange?.(\n defaultValue?.label ? { ...policy, label: defaultValue.label } : policy\n )\n }\n\n const handleSubmit = (event: React.FormEvent) => {\n event.preventDefault()\n if (!(\n Boolean(fields.issuer && fields.audience) &&\n claimsListValid(fields.extraClaims, FIRST_CLASS_CLAIMS)\n )) {\n return\n }\n const policy = compile(fields)\n onSubmit(\n defaultValue?.label ? { ...policy, label: defaultValue.label } : policy\n )\n }\n\n return (\n \n \n \n Identity provider URL iss\n \n \n apply({ ...fields, issuer: event.target.value.trim() })\n }\n />\n \n Repository → Settings → Pipelines → OpenID Connect. Copy it exactly.\n \n \n \n \n Audience aud\n \n \n apply({ ...fields, audience: event.target.value.trim() })\n }\n />\n \n Same settings page. Pipelines can also declare custom audiences in the\n step's oidc config.\n \n \n \n \n Repository UUID repositoryUuid\n \n \n apply({ ...fields, repositoryUuid: event.target.value.trim() })\n }\n />\n \n From the example payload on the same page. Optional to narrow trust to\n one repository.\n \n \n {fields.audience &&\n !fields.audience.startsWith(WORKSPACE_AUD_PREFIX) &&\n !fields.repositoryUuid ? (\n \n \n A custom audience doesn't name the workspace — add the\n repository UUID so this rule still pins an identity.\n \n \n ) : null}\n apply({ ...fields, extraClaims: rows })}\n reserved={FIRST_CLASS_CLAIMS}\n />\n \n \n )\n}\n\nexport { BitbucketIcon, BitbucketPolicyForm, matchesBitbucketPolicy }\n",
"type": "registry:component",
"target": "@components/oidc/provider-bitbucket.tsx"
}
],
"meta": {
"tagline": "Trust a workspace's pipelines"
},
"categories": [
"auth",
"forms"
],
"type": "registry:component"
}