feat(bitbucket): add webhook secret on each repository creation

src/sentry/integrations/bitbucket/integration.py

@@ -27,6 +27,7 @@
     IntegrationPipelineViewEvent,
     IntegrationPipelineViewType,
 )
+from sentry.models.apitoken import generate_token
 from sentry.models.repository import Repository
 from sentry.organizations.services.organization import RpcOrganizationSummary
 from sentry.pipeline import NestedPipelineView, PipelineView
@@ -224,6 +225,7 @@ def build_integration(self, state):
             username = principal_data.get("username", principal_data["display_name"])
             account_type = principal_data["type"]
             domain = f"{base_url}/{username}" if account_type == "team" else username
+            secret = generate_token()
 
             return {
                 "provider": self.key,
@@ -232,6 +234,7 @@ def build_integration(self, state):
                 "metadata": {
                     "public_key": state["publicKey"],
                     "shared_secret": state["sharedSecret"],
+                    "webhook_secret": secret,
                     "base_url": state["baseApiUrl"],
                     "domain_name": domain,
                     "icon": principal_data["links"]["avatar"]["href"],

src/sentry/integrations/bitbucket/repository.py

@@ -46,6 +46,7 @@ def build_repository_config(self, organization: RpcOrganization, data):
         installation = self.get_installation(data.get("installation"), organization.id)
         client = installation.get_client()
         try:
+            secret = installation.model.metadata.get("webhook_secret", "")
             resp = client.create_hook(
                 data["identifier"],
                 {
@@ -54,6 +55,7 @@ def build_repository_config(self, organization: RpcOrganization, data):
                         f"/extensions/bitbucket/organizations/{organization.id}/webhook/"
                     ),
                     "active": True,
+                    "secret": secret,
                     "events": ["repo:push", "pullrequest:fulfilled"],
                 },
             )

tests/sentry/integrations/bitbucket/test_installed.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from typing import Any
+from unittest import mock
 
 import responses
 
@@ -107,6 +108,7 @@ def test_installed_with_public_key(self):
         assert response.status_code == 200
         integration = Integration.objects.get(provider=self.provider, external_id=self.client_key)
         assert integration.name == self.username
+        del integration.metadata["webhook_secret"]
         assert integration.metadata == self.metadata
 
     def test_installed_without_public_key(self):
@@ -124,6 +126,7 @@ def test_installed_without_public_key(self):
             provider=self.provider, external_id=self.client_key
         )
         assert integration.name == integration_after.name
+        del integration_after.metadata["webhook_secret"]
         assert integration.metadata == integration_after.metadata
 
     def test_installed_without_username(self):
@@ -136,8 +139,18 @@ def test_installed_without_username(self):
         assert response.status_code == 200
         integration = Integration.objects.get(provider=self.provider, external_id=self.client_key)
         assert integration.name == self.user_display_name
+        del integration.metadata["webhook_secret"]
         assert integration.metadata == self.user_metadata
 
+    @mock.patch("sentry.integrations.bitbucket.integration.generate_token", return_value="0" * 64)
+    def test_installed_with_secret(self, mock_generate_token):
+        response = self.client.post(self.path, data=self.team_data_from_bitbucket)
+        assert mock_generate_token.called
+        assert response.status_code == 200
+        integration = Integration.objects.get(provider=self.provider, external_id=self.client_key)
+        assert integration.name == self.username
+        assert integration.metadata["webhook_secret"] == "0" * 64
+
     @responses.activate
     def test_plugin_migration(self):
         with assume_test_silo_mode(SiloMode.REGION):

tests/sentry/integrations/bitbucket/test_repository.py

@@ -84,25 +84,39 @@ def test_compare_commits(self):
     def test_build_repository_config(self):
         full_repo_name = "laurynsentry/helloworld"
         webhook_id = "web-hook-id"
+
+        organization = self.create_organization()
+
         responses.add(
             responses.GET,
             "https://api.bitbucket.org/2.0/repositories/%s" % full_repo_name,
             json=REPO,
         )
+        expected_post_payload = {
+            "active": True,
+            "description": "sentry-bitbucket-repo-hook",
+            "events": ["repo:push", "pullrequest:fulfilled"],
+            "secret": "supersecret",
+            "url": f"http://testserver/extensions/bitbucket/organizations/{organization.id}/webhook/",
+        }
         responses.add(
             responses.POST,
             "https://api.bitbucket.org/2.0/repositories/%s/hooks" % full_repo_name,
             json={"uuid": webhook_id},
             status=201,
+            match=[responses.matchers.json_params_matcher(expected_post_payload)],
         )
 
-        organization = self.create_organization()
         with assume_test_silo_mode(SiloMode.CONTROL):
             integration = self.create_provider_integration(
                 provider="bitbucket",
                 external_id="bitbucket_external_id",
                 name="Hello world",
-                metadata={"base_url": "https://api.bitbucket.org", "shared_secret": "23456789"},
+                metadata={
+                    "base_url": "https://api.bitbucket.org",
+                    "shared_secret": "23456789",
+                    "webhook_secret": "supersecret",
+                },
             )
             integration.add_organization(organization)
         data = {