[Bitbucket] merge PR button invalidates my credentials, merge fails

[jeremyfiel]

Describe the bug
When clicking the merge button, the merge fails with an error for invalid credentials.

The log indicates my credentials were invalidated and it literally removes them from my settings. It forces me to input them again to continue working on other BB related things.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'open a pr and try to merge it'
2. Click on 'merge'
3. See error

Expected behavior
I have sufficient privileges to merge a pr on this repo. the pr should be merged successfully!

Screenshots
If applicable, add screenshots to help explain your problem.

Environment and Version (please complete the following information):

• Atlassian Plugin Version (x.x.x)
• Visual Studio Code Version (x.x.x)
• Is this a local or cloud environment? Local
• If Cloud, Browser (chrome, safari)
• If Local, OS: Win 11
• JIRA DC
• BB Server 9.4.x

Additional context

[2026-03-16 18:25:43:672] ---------------------------------------------------------------------- 
[2026-03-16 18:25:43:672] curl -X POST "https://<customdomain>.com/rest/api/1.0/projects/aal/repos/<repo>>/pull-requests/253/merge?version=1&markup=true&avatarSize=64" -H "Accept:application/json, text/plain, */*" -H "Content-Type:application/json" -H "User-Agent:atlascode/2.x axios/0.19.2" -H "Authorization:Bearer <token>>" --data '{"autoSubject":false,"strategyId":"no-ff","message":"Merged in feature/APIDESGN-3745-Lyric-Update-Organization-Positions-APIs-to-include-workerTypeCode (pull request #253)\n\nAPIDESGN-3745 Lyric - Update Organization Positions APIs to include workerTypeCode\n\nApproved-by: Fiel, Jeremy"}' 
[2026-03-16 18:25:43:672] ---------------------------------------------------------------------- 
[2026-03-16 18:25:43:864] Received 401 - marking credentials as invalid 
[2026-03-16 18:25:43:864] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:865] Saving auth info for site: https://<customdomain>.com credentialID: <token> 
[2026-03-16 18:25:43:865] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:865] Retrieving secretstorage info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:865] Error merging pull request [object Object]
[2026-03-16 18:25:43:881] Saving new information to secretstorage. 
[2026-03-16 18:25:43:882] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:883] Agent changed. Creating a new client 
[2026-03-16 18:25:43:883] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:883] Retrieving secretstorage info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:883] Retrieving auth info for product: jira credentialID: <token> 
[2026-03-16 18:25:43:883] Clearing notifications for uri file:///Please%20login%20to%20Jira 
[2026-03-16 18:25:43:883] No notifications for delegate [object Object] 
[2026-03-16 18:25:43:883] No notifications for delegate [object Object] 
[2026-03-16 18:25:43:884] Retrieving RovoDev auth info 
[2026-03-16 18:25:43:885] Retrieving secretstorage info for product: RovoDev credentialID: rovodev-single 
[2026-03-16 18:25:43:887] Using PAT Auth 
[2026-03-16 18:25:43:888] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:888] Using PAT Auth 
[2026-03-16 18:25:43:888] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:25:43:888] ---------------------------------------------------------------------- 
[2026-03-16 18:25:43:888] curl -X GET "https://<customdomain>.com/rest/mirroring/1.0/mirrorServers?limit=100" -H "Accept:application/json, text/plain, */*" -H "Content-Type:application/json" -H "User-Agent:atlascode/2.x axios/0.19.2" -H "Authorization:Bearer <token>>" 
[2026-03-16 18:25:43:888] ---------------------------------------------------------------------- 
[2026-03-16 18:25:43:888] Credentials are already marked as invalid. 
[2026-03-16 18:25:43:888] Credentials are already marked as invalid. 
[2026-03-16 18:25:43:898] FeatureGates atlascode-require-dedicated-rovodev-auth -> false 
[2026-03-16 18:25:43:899] FeatureGates atlascode-rovodev-entitlement-notification -> true 
[2026-03-16 18:25:43:899] No credentials found for Rovo Dev entitlement check 
[2026-03-16 18:25:43:899] Rovo Dev entitlement check result: CREDENTIAL_ERROR 
[2026-03-16 18:25:43:900] ---------------------------------------------------------------------- 
[2026-03-16 18:25:43:900] curl -X GET "https://<customdomain>.com/rest/api/2/issue/APIDESGN-3745?expand=transitions%2CrenderedFields%2Ceditmeta%2Ctransitions.fields&fields=*all" -H "Accept:application/json, text/plain, */*" -H "Content-Type:application/json" -H "User-Agent:atlascode/2.x axios/0.19.2" -H "X-Atlassian-Token:no-check" -H "Authorization:Bearer <token>" 
[2026-03-16 18:25:43:900] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:087] Blocking request due to previous 40[1|3] 
[2026-03-16 18:25:44:284] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:284] curl -X GET "https://<customdomain>.com/rest/api/2/issue/APIDESGN-3618?expand=transitions%2CrenderedFields%2Ctransitions.fields&fields=summary%2Ccustomfield_10003" -H "Accept:application/json, text/plain, */*" -H "Content-Type:application/json" -H "User-Agent:atlascode/2.x axios/0.19.2" -H "X-Atlassian-Token:no-check" -H "Authorization:Bearer <token>" 
[2026-03-16 18:25:44:284] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:562] Blocking request due to previous 40[1|3] 
[2026-03-16 18:25:44:563] Blocking request due to previous 40[1|3] 
[2026-03-16 18:25:44:563] Blocking request due to previous 40[1|3] 
[2026-03-16 18:25:44:563] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:563] curl -X GET "https://<customdomain>.com/rest/api/2/myself" -H "Accept:application/json, text/plain, */*" -H "Content-Type:application/json" -H "User-Agent:atlascode/2.x axios/0.19.2" -H "X-Atlassian-Token:no-check" -H "Authorization:Bearer <token>" 
[2026-03-16 18:25:44:563] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:565] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:565] curl -X GET "https://<customdomain>.com/rest/api/2/issue/APIDESGN-3745/watchers" -H "Accept:application/json, text/plain, */*" -H "Content-Type:application/json" -H "User-Agent:atlascode/2.x axios/0.19.2" -H "X-Atlassian-Token:no-check" -H "Authorization:Bearer <token>" 
[2026-03-16 18:25:44:565] ---------------------------------------------------------------------- 
[2026-03-16 18:25:44:593] Error updating development info Error: Credentials are invalid. Please update your credentials.
[2026-03-16 18:25:44:898] Blocking request due to previous 40[1|3] 
[2026-03-16 18:25:44:898] Blocking request due to previous 40[1|3] 
[2026-03-16 18:25:44:899] Could not fetch repo details for file:///c%3A/Users/fieljere/repos/<repo>> Error: Credentials are invalid. Please update your credentials.
[2026-03-16 18:25:50:469] Retrieving auth info for product: jira credentialID: <token>> 
[2026-03-16 18:25:50:469] Clearing notifications for uri file:///Please%20login%20to%20Jira 
[2026-03-16 18:25:50:469] No notifications for delegate [object Object] 
[2026-03-16 18:25:50:469] No notifications for delegate [object Object] 
[2026-03-16 18:25:54:559] Retrieving auth info for product: jira credentialID: <token>> 
[2026-03-16 18:25:54:559] Clearing notifications for uri file:///Please%20login%20to%20Jira 
[2026-03-16 18:25:54:559] No notifications for delegate [object Object] 
[2026-03-16 18:25:54:559] No notifications for delegate [object Object] 
[2026-03-16 18:26:54:218] Retrieving auth info for product: bitbucket credentialID: <token> 
[2026-03-16 18:26:54:219] Skipping Bitbucket refresh - no authenticated Bitbucket sites

[jeremyfiel]

I believe this issue is related to "approving" and "merging" without refreshing the PR between actions. The version increments but the UI is stale if the user doesn't refresh prior to pressing "merge" so it returns 403 which I assume is returned because the PR is not in approved state??

[teg-atlassian]

removing 403 from invalidating cred's

[jeremyfiel]

I had Claude review it and it seems to think the basicInterceptor.ts file should also be modified

[teg-atlassian]

that is a different path... that only is UI...

we may have to address that separately but it has nothing to do with refreshing tokens

[jeremyfiel]

here are those changes summarized with a patch

we are using PAT tokens

# Fix: PR Merge 403 Incorrectly Invalidates Credentials

## Context

When clicking "Merge" on a pull request, Bitbucket may return a **403 Forbidden** for non-auth reasons (e.g., merge checks failing, branch restrictions). The `BasicInterceptor` treats all 401 and 403 responses as credential failures, which:

1. Sets `_invalidCredentials = true`, blocking **all** future API requests
2. Persists `AuthInfoState.Invalid` to the credential store
3. Shows a "Credentials refused" error to the user

This only affects **basic-auth and PAT users** (Bitbucket Server / Jira). OAuth/Cloud clients don't use `BasicInterceptor`.

## Fix

Handle 401 and 403 separately in `BasicInterceptor._errorInterceptor`:

- **401** — credentials are invalid. Invalidate and block future requests *(unchanged)*
- **403** — permission denied. Log a warning, propagate the error, but **do not** invalidate credentials

## Files Modified

| File | Change |
|------|--------|
| `src/atlclients/basicInterceptor.ts` | Split 401/403 handling; 403 no longer invalidates credentials |
| `src/atlclients/basicInterceptor.test.ts` | Updated 403 test to assert credentials remain valid; added test that requests aren't blocked after 403 |

## Verification

1. Run `npm test -- --testPathPattern=basicInterceptor`
2. Confirm 403 test asserts credentials remain valid
3. Confirm 401 test still invalidates credentials
4. Manual test: merge a PR blocked by merge checks — error should appear but credentials should stay valid

fix-merge-403-credential-invalidation.patch

[teg-atlassian]

do you have the same issue now? @jeremyfiel

[jeremyfiel]

Yes, because we are using PAT and only the oauthRefresher was updated