From 6551d2364229bcd5775d3979ee6e6178a7eb0405 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Mon, 7 Sep 2026 15:04:36 +0200 Subject: [PATCH] fix: do not claim a managed credential for a url the client cannot resolve Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01C1xHmkxuxYb1GYvth1BS75 --- backend/ee-repo-ref.txt | 2 +- .../src/lib/components/git_sync/managedCredential.ts | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt index 56ef0b00b6..608773d2df 100644 --- a/backend/ee-repo-ref.txt +++ b/backend/ee-repo-ref.txt @@ -1 +1 @@ -b705a9be1c4294851f534bab7a7cdfa75303d715 \ No newline at end of file +5d9cd2b60b286840d1647103f89cf7953b8b2065 \ No newline at end of file diff --git a/frontend/src/lib/components/git_sync/managedCredential.ts b/frontend/src/lib/components/git_sync/managedCredential.ts index 3eccc8767a..39e3c2fc50 100644 --- a/frontend/src/lib/components/git_sync/managedCredential.ts +++ b/frontend/src/lib/components/git_sync/managedCredential.ts @@ -17,9 +17,16 @@ function urlCarriesCredential(url: string | undefined): boolean { * have the UI promise renewal for a token nothing renews. That happens whenever * someone puts a token back in the URL without clearing the marker, which is why * this is checked rather than trusting the marker alone. + * + * A `$var:` URL is treated the same way. Only the server can resolve it, so + * whether it carries a token is unknowable here, and claiming a managed + * credential would be a guess: the picker always writes a plain URL, so nothing + * this marker legitimately describes reaches us as a variable reference. */ export function managedCredentialHost(value: GitRepositoryValue): string | undefined { const host = value?.managed_credential if (!host || host === 'none') return undefined - return urlCarriesCredential(value?.url) ? undefined : host + const url = value?.url + if (url?.startsWith('$var:')) return undefined + return urlCarriesCredential(url) ? undefined : host }