fix: wire Bitbucket App secrets manager, OAuth connect was permanently broken

[thegdsks]

Summary

cmd/levelrail/main.go wired api.WithGitHubAppSecrets and api.WithGitLabAppSecrets into the real server's option list, but the equivalent api.WithBitbucketAppSecrets call was missing, leaving rt.bitbucketAppSecrets nil on every real deployment.

Traced the actual runtime impact: PUT /api/v1/bitbucket-app (save OAuth consumer key/secret) hard-failed with a 501 "requires a master key to be configured" error, and the connect/callback/repo-browsing routes failed the same way. GET /api/v1/bitbucket-app (status) didn't 501 but silently always reported authorized: false regardless of real state. The full Bitbucket App CLI and web UI already existed and were fully wired to these routes, they were completely non-functional in any real deployment.

Verified live against a real running instance: PUT /api/v1/bitbucket-app went from 501 to 200, correctly saving and reflecting the connection.

What this does not do

• Does not touch the separate, unmerged Gitea git-provider branch. Confirmed it already correctly includes the equivalent api.WithGiteaAppSecrets call, so this specific bug class doesn't apply there. Expect a trivial textual (not semantic) merge conflict when that branch rebases past this one, since both touch the same three-line region.

Test plan

• go build ./..., go vet ./...: clean
• golangci-lint run ./cmd/levelrail/...: 0 issues
• New regression test (TestRootHandler_GitProviderAppSecretsWired) calls the real rootHandler wiring path (not a directly-constructed Router), confirmed to actually catch this bug class by reverting the fix and observing the exact original 501 error
• Real Docker validation: built and ran the actual binary, confirmed PUT /api/v1/bitbucket-app behavior before and after the fix

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f490e4ba-30b5-4b8f-915e-b8989b69fdaa

📥 Commits

Reviewing files that changed from the base of the PR and between 798b102 and aff50d3.

📒 Files selected for processing (2)

• cmd/levelrail/main.go
• cmd/levelrail/root_handler_wiring_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations remain.

Summary

The PR restores the missing production dependency injection for Bitbucket App secrets and adds a regression test covering GitHub, GitLab, and Bitbucket wiring through the real root handler.

• Passes the existing secrets manager to api.WithBitbucketAppSecrets.
• Exercises authenticated provider connection endpoints through rootHandler.
• Reliably detects an omitted provider secrets option because each handler checks that dependency before request validation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[rootHandler] --> B[Shared secrets manager]
  B --> C[GitHub App router option]
  B --> D[GitLab App router option]
  B --> E[Bitbucket App router option]
  E --> F[Bitbucket OAuth connect and repository routes]

Loading

_{Reviews (2) · Last reviewed commit: "fix: wire Bitbucket App secrets manager,..."}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud