Authentication not working

[derekpovah]

I ran the bb auth login command and entered the requested information and it looks like the API is now returning a 401 for every request. For some context, listing issues in projects with public issue trackers previously worked, but now does not.

I used go get github.com/craftamap/bb to install bb on Pop!_OS 20.10 with go1.16.5 linux/amd64 managed by goenv.

$ bb repo view

:: An error occurred: 401 Unauthorized

$ bb pr list

:: An error occurred: 401 Unauthorized

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0xccf2ce]

goroutine 1 [running]:
github.com/craftamap/bb/cmd/commands/pr/list.Add.func1(0xc0004c6780, 0x160c2a8, 0x0, 0x0)
        /home/derek/.go/1.16.5/pkg/mod/github.com/craftamap/bb@v0.4.0/cmd/commands/pr/list/list.go:60 +0x22e
github.com/spf13/cobra.(*Command).execute(0xc0004c6780, 0x160c2a8, 0x0, 0x0, 0xc0004c6780, 0x160c2a8)
        /home/derek/.go/1.16.5/pkg/mod/github.com/spf13/cobra@v1.1.3/command.go:856 +0x2c2
github.com/spf13/cobra.(*Command).ExecuteC(0x15be680, 0xc000000180, 0xc00063ff78, 0x407d65)
        /home/derek/.go/1.16.5/pkg/mod/github.com/spf13/cobra@v1.1.3/command.go:960 +0x375
github.com/spf13/cobra.(*Command).Execute(...)
        /home/derek/.go/1.16.5/pkg/mod/github.com/spf13/cobra@v1.1.3/command.go:897
github.com/craftamap/bb/cmd.Execute(...)
        /home/derek/.go/1.16.5/pkg/mod/github.com/craftamap/bb@v0.4.0/cmd/root.go:79
main.main()
        /home/derek/.go/1.16.5/pkg/mod/github.com/craftamap/bb@v0.4.0/main.go:11 +0x32

[craftamap]

Hey @derekpovah , thanks for reporting this. :) I'm gonna take a look :)

Edit: @derekpovah do you know which oauth scopes you chose while creating the app password? :)

[derekpovah]

@craftamap I just let it do everything

[craftamap]

Alright, that sounds strange :/ The username and app password should be stored in ~/.config/bb/configuration.toml, You could check if both are set correctly there.

[derekpovah]

It looks like everything gets set up correctly by the bb auth login command

[craftamap]

Alright :) I'm gonna spent some time later on it :)

[craftamap]

I can't reproduce this behavior on my side, sadly.

Do other bb commands still work / is only the issue command affected? bb repo view would be an easy way to get started. :)

[derekpovah]

I found a command that outputs more than just the error message. I've updated the first comment with the output.

[craftamap]

Sorry for not taking a deeper look into this until now - however, it looks like it's related to the access token itself and not the application :/

you can verify this by running:

curl -u username:token -X GET "https://api.bitbucket.org/2.0/repositories/org/repo"

if this works, the application itself should work too :)

[derekpovah]

It looks like the client username is getting set to my shell username and not the value in the config file. bb worked as expected when my shell user matched my Bitbucket username. My guess is something here is finding $USERNAME that's set by my shell and using it in place of the config. I wrote a fish function that always sets the --username flag to get around this for now, but it definitely feels like a hack.

echo $USERNAME
derek

(gdb) run issue list
...
:: An error occurred: 401 Unauthorized
...
(gdb) p c.Username
$1 = "derek"

(gdb) p c.Password
$2 = "xxxxxxxxxxxxxxxxxxxx"

I have never touched Go before, but I had success changing username in the config to something else. This simple solution doesn't account for existing config files that use username, though.

[craftamap]

Ahh, that meakes sense - I'm using https://github.com/spf13/viper to read the configuration and environment variables. It automatically creates them from the config parameters, so if $USERNAME is set, it will take this username instead.

I found an easy fix which will prefix all environment variables with BB_, so this should not happen anymore - I will release it within the next days :)

[craftamap]

Sorry, didn't mean to close this until you tested it - release 0.4.1 should have fixed it, though. Can you confirm?

[derekpovah]

The prefix solution is super clean and it works! Thanks for all your work on this!