App password not working on uploading download artifact

[alcramer]

Hi --

I have a 50meg windows installer for my product, that sits in the Downloads page of my project. I think this is what Bitbucket calls a "download artifact". Last year -- before Bitbucket started requiring app passwords -- I had no trouble uploading the installer to my Downloads page (I used Insomnia to send the HTML post),

After Bitbucket switched to app passwords, I generated an app password for my project and am able to git my code up/down from the server. But the upload of the download artifact fails. In an effort to solve that, I gave up on Insomnia and wrote a python script. Here's the script:

import requests

#url = 'http://httpbin.org/post'
url = 'https://api.bitbucket.org/2.0/repositories/alcramer/comiola/downloads'

headers = {
"Authorization": "Bearer MY_APP_PASSWORD"
}

files = {'file': open('test.txt', 'rb')}

r = requests.post(url, headers=headers, files=files)
print(r.text)

Bitbucket gives this response:

{"type": "error", "error": {"message": "Access token expired."}}

How do I fix this?

Thanks!

Al Cramer

[alcramer · Accepted solution]

I fixed my problem. When you open an account on Bitbucket, it asks that you enter a "Name" (I entered "Al Cramer", as that happens to be my name). When it creates depositories, it mangles the string you entered to create a string that they call your "username" (mangling seems to be: convert to lower case and kill spaces). That mangled string is the one that's used to create paths. 

BUT it's also the  string you need to specify as user if you do an HTTP POST.  This curl upload command fails:

curl -v -u "Al Cramer:MY_APP_PASSWORD" -X POST https://api.bitbucket.org/2.0/repositories/alcramer/comiola/downloads -F files=@test.txt

But this upload works:

curl -v -u "alcramer:MY_APP_PASSWORD" -X POST https://api.bitbucket.org/2.0/repositories/alcramer/comiola/downloads -F files=@test.txt

I leave it to minds more powerful than mine to consider Bitbucket's handling of "Name" vs "username", and how that impacted on their decision to switch from email addresses to mangled names on file uploads of depository artifacts.