fix(server): treat Bitbucket permissions 404 as a removed endpoint

[iamshadmantaqi]

What Changed

isRepositoryPermissionRemovedError now treats HTTP 404 the same as HTTP 410 on GET /user/permissions/repositories. Merge no longer dies in the permission gate when Bitbucket Cloud answers 404 for the removed endpoint.

401 and other real failures still fail.

Why

#6525 already treats CHANGE-2770's 410 as "endpoint gone, do not block, let the merge call decide." Cloud now returns 404 for the same URL. The catch never fires, so merge fails with Bitbucket returned HTTP 404.

Closes #8328

Blast Radius

Bitbucket permission reads only. GitHub and GitLab are untouched. A 404 on this one retired endpoint is treated as unknown permission, same as 410 already was. A bad token still fails.

Verification

Failing-then-passing regression in apps/server/src/pullRequest/BitbucketPullRequestApi.test.ts.

• Before the fix, the new 404 case failed with Bitbucket returned HTTP 404.
• After the fix, that file is 44/44 passing. The existing 410 and 401 cases still pass.
• vp lint on the two changed files: 0 errors.
• vp run --filter t3 typecheck: no errors in the changed file.

No UI chrome changed, so no screenshots.

Checklist

• This PR is small and focused
• I explained what changed and why
• No UI change (screenshots not applicable)
• No motion change (video not applicable)

---

Note

Low Risk
Scoped to Bitbucket repository permission reads; only widens the “removed endpoint” catch to 404, matching existing 410 semantics without relaxing real auth failures.

Overview
Bitbucket Cloud now returns HTTP 404 (not only 410) for the retired GET /user/permissions/repositories endpoint. isRepositoryPermissionRemovedError treats 404 like 410, so getRepositoryPermission still resolves to granted when the endpoint is gone instead of surfacing Bitbucket returned HTTP 404 and blocking merge.

Comments document the Cloud vs original CHANGE-2770 behavior. A regression test asserts a 404 on that URL yields true; 401 and other failures are unchanged.

^{Reviewed by Cursor Bugbot for commit 8662e6f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Treat Bitbucket permissions endpoint 404 as removed in isRepositoryPermissionRemovedError

Bitbucket Cloud now returns 404 (in addition to the original 410) for the removed repository-permissions endpoint. isRepositoryPermissionRemovedError in BitbucketPullRequestApi.ts is broadened to classify both statuses as the removed-endpoint signal, so getRepositoryPermission still resolves true instead of failing the merge.

• Risk: any unrelated 404 from this Bitbucket endpoint will now be silently treated as "permission granted" rather than surfacing as an error.

^{Macroscope summarized 8662e6f.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d27b99fe-de0d-4b40-8422-82e4672439ae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at 8662e6f

Macroscope's review found this PR approvable — This is a small, well-scoped Bitbucket compatibility fix that broadens the existing retired-endpoint handling from HTTP 410 to HTTP 404. Regression coverage verifies the new case while preserving authentication and other failure behavior.

^{You can add or adjust custom eligibility rules. Learn more.}