HTTP 500 ERROR when applying branch restriction

[John Lawlor]

Using this API:

https://developer.atlassian.com/server/bitbucket/rest/v817/api-group-project/#api-branch-permissions-latest-projects-projectkey-restrictions-post

and this curl request based on the above:

curl -u "johnl:$TOKEN" -X 'POST' \
'https://bitbucket.company.com/rest/branch-permissions/latest/projects/ARCH/restrictions' \
-H 'accept: application/json' \
-H 'Content-Type: application/vnd.atl.bitbucket.bulk+json' \
-d '[
{
"accessKeyIds": [
901
],
"accessKeys": [
{
"key": {
"expiryDays": 30,
"bitLength": 0,
"algorithmType": "string",
"label": "me@127.0.0.1",
"text": "ssh-rsa AAAAB3... me@127.0.0.1"
},
"permission": "USER_ADMIN",
"project": {
"key": "PRJ",
"avatar": "string",
"avatarUrl": "string",
"links": {}
},
"repository": {
"name": "My repo",
"project": {
"key": "PRJ",
"avatar": "string",
"avatarUrl": "string",
"links": {}
},
"scmId": "git",
"slug": "my-repo",
"links": {}
}
}
],
"groupNames": [
"bitbucket-developers"
],
"groups": [
"group_a",
"group_b"
],
"matcher": {
"displayId": "main",
"id": "refs/heads/main",
"type": {
"id": "ANY_REF",
"name": "Branch"
}
},
"type": "pull-request-only",
"userSlugs": [ "bman",
"tstark",
"hulk"
],
"users": [
{
"name": "jcitizen",
"type": "NORMAL",
"displayName": "Jane Citizen",
"emailAddress": "jane@example.com",
"active": true,
"links": {},
"slug": "jcitizen",
"avatarUrl": "string"
}
]
}
]'

This is generated from the swagger definition:

This results in the following error on the server:

2024-04-09 10:49:14,964 ERROR [https-jsse-nio-8443-exec-9683] johnl @1BR5DDUx649x424728246x6 10.15.33.197,10.65.189.43 "POST /rest/branch-permissions/latest/projects/ARCH/restrictions HTTP/1.1" c.a.s.i.r.e.DefaultUnhandledExceptionMapperHelper Unhandled exception while processing REST request: "POST /rest/branch-permissions/latest/projects/ARCH/restrictions HTTP/1.1"
java.lang.NumberFormatException: For input string: "{key={expiryDays=30, bitLength=0, algorithmType=string, label=me@127.0.0.1, text=ssh-rsa AAAAB3... me@127.0.0.1}, permission=USER_ADMIN, project={key=PRJ, avatar=string, avatarUrl=string, links={}}, repository={name=My repo, project={key=PRJ, avatar=string, avatarUrl=string, links={}}, scmId=git, slug=my-repo, links={}}}"
at java.base/java.lang.NumberFormatException.forInputString(Unknown Source)
at java.base/java.lang.Integer.parseInt(Unknown Source)
at java.base/java.lang.Integer.valueOf(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
at com.atlassian.stash.internal.repository.ref.restriction.rest.RestRestrictionRequest.getIntegerCollection(RestRestrictionRequest.java:62)
at com.atlassian.stash.internal.repository.ref.restriction.rest.RestRestrictionRequest.getAccessKeyIds(RestRestrictionRequest.java:47)
at com.atlassian.stash.internal.repository.ref.restriction.rest.RefRestrictionResourceHelper.validateRestrictionRequest(RefRestrictionResourceHelper.java:273)
at com.atlassian.stash.internal.repository.ref.restriction.rest.RefRestrictionResourceHelper.lambda$createRestrictions$0(RefRestrictionResourceHelper.java:116)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
at com.atlassian.stash.internal.repository.ref.restriction.rest.RefRestrictionResourceHelper.createRestrictions(RefRestrictionResourceHelper.java:117)
at com.atlassian.stash.internal.repository.ref.restriction.rest.RefRestrictionProjectResource.createRestrictions(RefRestrictionProjectResource.java:140)
at jdk.internal.reflect.GeneratedMethodAccessor6806.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at com.atlassian.applinks.core.rest.context.ContextFilter.doFilter(ContextFilter.java:24)
at com.atlassian.applinks.core.rest.context.ContextFilter.doFilter(ContextFilter.java:24)
at com.atlassian.applinks.core.rest.context.ContextFilter.doFilter(ContextFilter.java:24)
at com.atlassian.applinks.core.rest.context.ContextFilter.doFilter(ContextFilter.java:24)
at com.atlassian.applinks.core.rest.context.ContextFilter.doFilter(ContextFilter.java:24)
at com.atlassian.analytics.client.filter.UniversalAnalyticsFilter.doFilter(UniversalAnalyticsFilter.java:75)
at com.atlassian.analytics.client.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:33)
at com.atlassian.bitbucket.internal.xcode.web.XcodeUserAgentFilter.doFilter(XcodeUserAgentFilter.java:36)
at com.atlassian.stash.internal.spring.lifecycle.LifecycleJohnsonServletFilterModuleContainerFilter.doFilter(LifecycleJohnsonServletFilterModuleContainerFilter.java:42)
at com.atlassian.bitbucket.internal.ratelimit.servlet.filter.RateLimitFilter.doFilter(RateLimitFilter.java:75)
at com.atlassian.plugin.connect.plugin.auth.scope.ApiScopingFilter.doFilter(ApiScopingFilter.java:81)
at com.atlassian.troubleshooting.thready.filter.AbstractThreadNamingFilter.doFilter(AbstractThreadNamingFilter.java:46)
at com.atlassian.stash.internal.spring.lifecycle.LifecycleJohnsonServletFilterModuleContainerFilter.doFilter(LifecycleJohnsonServletFilterModuleContainerFilter.java:42)
at com.atlassian.stash.internal.web.auth.AuthorizationFailureInterceptor.doFilterInternal(AuthorizationFailureInterceptor.java:39)
at com.atlassian.stash.internal.spring.security.StashAuthenticationFilter.onSuccess(StashAuthenticationFilter.java:219)
at com.atlassian.stash.internal.spring.security.StashAuthenticationFilter.doFilter(StashAuthenticationFilter.java:100)
at com.atlassian.stash.internal.web.auth.BeforeLoginPluginAuthenticationFilter.doInsideSpringSecurityChain(BeforeLoginPluginAuthenticationFilter.java:112)
at com.atlassian.stash.internal.web.auth.BeforeLoginPluginAuthenticationFilter.doFilter(BeforeLoginPluginAuthenticationFilter.java:75)
at com.atlassian.security.auth.trustedapps.filter.TrustedApplicationsFilter.doFilter(TrustedApplicationsFilter.java:94)
at com.atlassian.oauth.serviceprovider.internal.servlet.OAuthFilter.doFilter(OAuthFilter.java:67)
at com.atlassian.oauth2.provider.core.web.AccessTokenFilter.doFilter(AccessTokenFilter.java:81)
at com.atlassian.stash.internal.spring.lifecycle.LifecycleJohnsonServletFilterModuleContainerFilter.doFilter(LifecycleJohnsonServletFilterModuleContainerFilter.java:42)
at com.atlassian.plugin.connect.plugin.auth.oauth2.DefaultSalAuthenticationFilter.doFilter(DefaultSalAuthenticationFilter.java:69)
at com.atlassian.plugin.connect.plugin.auth.user.ThreeLeggedAuthFilter.doFilter(ThreeLeggedAuthFilter.java:109)
at com.atlassian.plugins.authentication.basicauth.filter.DisableBasicAuthFilter.doFilter(DisableBasicAuthFilter.java:70)
at com.atlassian.jwt.internal.servlet.JwtAuthFilter.doFilter(JwtAuthFilter.java:37)
at com.atlassian.analytics.client.filter.DefaultAnalyticsFilter.doFilter(DefaultAnalyticsFilter.java:26)
at com.atlassian.analytics.client.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:33)
at com.atlassian.troubleshooting.thready.filter.AbstractThreadNamingFilter.doFilter(AbstractThreadNamingFilter.java:46)
at com.atlassian.stash.internal.spring.lifecycle.LifecycleJohnsonServletFilterModuleContainerFilter.doFilter(LifecycleJohnsonServletFilterModuleContainerFilter.java:42)
at com.atlassian.stash.internal.web.auth.BeforeLoginPluginAuthenticationFilter.doBeforeBeforeLoginFilters(BeforeLoginPluginAuthenticationFilter.java:90)
at com.atlassian.stash.internal.web.auth.BeforeLoginPluginAuthenticationFilter.doFilter(BeforeLoginPluginAuthenticationFilter.java:73)
at com.atlassian.stash.internal.request.DefaultRequestManager.doAsRequest(DefaultRequestManager.java:84)
at com.atlassian.stash.internal.hazelcast.ConfigurableWebFilter.doFilter(ConfigurableWebFilter.java:38)
at java.base/java.lang.Thread.run(Unknown Source)
... 272 frames trimmed

It seems to be specifically related to getting the access key ids:

com.atlassian.stash.internal.repository.ref.restriction.rest.RestRestrictionRequest.getAccessKeyIds(RestRestrictionRequest.java:47)

The number format exception seems to be caused by an object being returned namely:

"{key={expiryDays=30, bitLength=0, algorithmType=string, label=me@127.0.0.1, text=ssh-rsa AAAAB3... me@127.0.0.1}, permission=USER_ADMIN, project={key=ARCH, avatar=string, avatarUrl=string, links={}}, repository={name=My repo, project={key=PRJ, avatar=string, avatarUrl=string, links={}}, scmId=git, slug=my-repo, links={}}}"

It looks like the code was expecting an integer here, but instead got the whole object.