René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[BUG] Azure DevOps repository cloning fails due to incorrect authentication method  Description","articleBody":"### Describe the bug\n\nWhen connecting to an Azure DevOps instance, the initial API connection and repository discovery succeed, but the subsequent git clone operation fails with an Authentication failed error.\n\nThis issue stems from the way repoManager constructs the clone URL for Azure DevOps repositories.\n\n**Logs**\n\n```\nThe initial sync job shows a successful API connection:\n\n[backend] | 2025-09-19T06:42:54.369Z info: [connection-manager] Connection sync job for connection azure_devops (id: 5, jobId: 17) completed\n```\n\n\n\nHowever, the cloning process initiated by repoManager fails:\n\n```\n[backend] | 2025-09-19T06:42:54.796Z error: [repo-manager] Failed to sync repository [internal-devops-host]/mpilot_perception/auto-tagging-platform ... Error: Failed to clone repository ...\n[backend] | fatal: could not read Password for 'https://xxxxx@[internal-devops-host]': No such device or address\n```\n\n\n\n\n**Root Cause Analysis**\n\nIncorrect Credential Formatting: In packages/backend/src/repoManager.ts, the getCloneCredentialsForRepo function returns only a password (the PAT) for azuredevops connections.\n\nIncorrect URL Construction: The syncGitRepository function in the same file has a fallback mechanism that incorrectly assigns the password to the username field of the clone URL when username is not provided. This results in an improperly formatted URL like https://\u003cPAT\u003e@[internal-devops-host]/....\n\nAzure DevOps Authentication Mechanism: Azure DevOps does not support authentication via a PAT embedded in the username part of a URL. It requires the PAT to be supplied as the password in a Basic Authentication scheme, typically with an arbitrary (or empty) username.\n\n\u003cimg width=\"897\" height=\"538\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/ca758c95-1002-4af7-959f-3d8e7a788c41\" /\u003e\n\nhttps://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops\u0026tabs=Windows#use-a-pat\n\nManual Verification\n\nWe have confirmed the correct authentication method via the command line.\n\nFailed Attempt (mimicking current behavior):\n\n```\ngit clone https://pat:YOUR_PAT@[internal-devops-host]/...\n# Result: fatal: Authentication failed\n```\n\n\n\n\nSuccessful Attempt (correct method):\nThis method injects the credentials directly into the HTTP header, which is the correct way to authenticate with Azure DevOps.\n\n```\nTOKEN=\"YOUR_PAT\"\nAUTH_HEADER=\"Authorization: Basic $(echo -n \":$TOKEN\" | base64)\"\ngit -c http.extraHeader=\"$AUTH_HEADER\" clone https://[internal-devops-host]/...\n# Result: Success, cloning begins.\n```\n\n\n\nSuggested Solution\n\nThe repoManager needs to be updated to handle Azure DevOps authentication correctly.\n\nModify git.ts: The cloneRepository and fetchRepository functions in packages/backend/src/git.ts should be updated to accept an optional config parameter (a string array) to pass custom configurations like http.extraHeader to the underlying simple-git call.\n\nModify repoManager.ts: In syncGitRepository, add logic to detect if the repository is from an azuredevops connection.\n\nIf it is, construct the Authorization: Basic ... header using the PAT and pass it to cloneRepository/fetchRepository via the new config parameter.\nIf it is not, retain the existing logic of embedding credentials in the URL.\nThis will ensure that Azure DevOps repositories are cloned using the correct, header-based authentication method without affecting other Git providers.\n\n### To reproduce\n\n1. Configure a new code host connection of type azuredevops.\n2. Provide the URL for your Azure DevOps server (e.g., https://[internal-devops-host]) and a valid Personal Access Token (PAT) with at least Code (Read) permissions.\n3. Configure the connection to sync a specific repository.\n4. Trigger a sync for the connection.\n5. Observe the backend logs for the repo-manager service.\n\n### Sourcebot deployment information\n\nSourcebot version (e.g. v3.0.1): 4.7.0\n\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/yurika96","@type":"Person","name":"yurika96"},"datePublished":"2025-09-19T06:59:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/522/sourcebot/issues/522"}