gerrit-oauth-provider
gerrit-oauth-provider copied to clipboard
Use BitBucket UUID instead of username
https://github.com/davido/gerrit-oauth-provider/blob/90b66bbf374fe4575b829eb41d940556060fda31/src/main/java/com/googlesource/gerrit/plugins/oauth/BitbucketOAuthService.java#L98
Grabs the "username" and "display_name" and might fix up the old numeric ids.
But, BitBucket allows users to change these fields, so UUIDs need to be used in prevent spoofing: https://confluence.atlassian.com/bitbucket/rest-apis-222724129.html#RESTAPIs-uuid-mainUniversallyUniqueIdentifier(UUID)
If we will do that change, we would need some kind of data migration.
Because we did not do this change, #120 and #127 are currently preventing some users from logging in.
So yes, now the problem is even more serious, because we have to change first to API v2 to start getting the data again. We have this PR, that I closed without merging, because the canonical repository is googlesource.com.