Merge branch 'heads/main' into daniel/fips-initative

backend/src/server/plugins/secret-scanner-v2.ts

@@ -1,7 +1,9 @@
 import type { EmitterWebhookEventName } from "@octokit/webhooks/dist-types/types";
 import { PushEvent } from "@octokit/webhooks-types";
 import { Probot } from "probot";
+import { z } from "zod";
 
+import { TBitbucketPushEvent } from "@app/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-types";
 import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 import { writeLimit } from "@app/server/config/rateLimiter";
@@ -63,4 +65,52 @@ export const registerSecretScanningV2Webhooks = async (server: FastifyZodProvide
       return res.send("ok");
     }
   });
+
+  // bitbucket push event webhook
+  server.route({
+    method: "POST",
+    url: "/bitbucket",
+    schema: {
+      querystring: z.object({
+        dataSourceId: z.string().min(1, { message: "Data Source ID is required" })
+      }),
+      headers: z
+        .object({
+          "x-hub-signature": z.string().min(1, { message: "X-Hub-Signature header is required" })
+        })
+        .passthrough()
+    },
+    config: {
+      rateLimit: writeLimit
+    },
+    handler: async (req, res) => {
+      const { dataSourceId } = req.query;
+
+      // Verify signature
+      const signature = req.headers["x-hub-signature"];
+      if (!signature) {
+        logger.error("Missing X-Hub-Signature header for Bitbucket webhook");
+        return res.status(401).send({ message: "Unauthorized: Missing signature" });
+      }
+
+      const expectedSignaturePrefix = "sha256=";
+      if (!signature.startsWith(expectedSignaturePrefix)) {
+        logger.error({ signature }, "Invalid X-Hub-Signature format for Bitbucket webhook");
+        return res.status(401).send({ message: "Unauthorized: Invalid signature format" });
+      }
+
+      const receivedSignature = signature.substring(expectedSignaturePrefix.length);
+
+      if (!dataSourceId) return res.status(400).send({ message: "Data Source ID is required" });
+
+      await server.services.secretScanningV2.bitbucket.handlePushEvent({
+        ...(req.body as TBitbucketPushEvent),
+        dataSourceId,
+        receivedSignature,
+        bodyString: JSON.stringify(req.body)
+      });
+
+      return res.send("ok");
+    }
+  });
 };