Files
kandev/docs/plans/bitbucket-plugin/task-05-dynamic-composer-reference-sources.md
T
2026-08-24 11:09:03 +00:00

60 lines
2.1 KiB
Markdown

---
id: "05-dynamic-composer-reference-sources"
title: "Dynamic composer reference sources"
status: completed
wave: 2
depends_on: ["01-design-package", "03-protocol-manifest-actions"]
plan: "plan.md"
spec: "../../specs/integrations/requirements/bitbucket-plugin.md"
---
# Task 05: Dynamic composer reference sources
## Intent
Bridge active manifest-declared plugin reference sources into the existing backend
mentions registry, preserving host canonicalization and live authorization at search
and submission.
## Owned paths
- `apps/backend/internal/mentions/service.go`
- `apps/backend/internal/mentions/types.go`
- `apps/backend/internal/mentions/service_test.go`
- `apps/backend/internal/backendapp/mentions.go`
- `apps/backend/internal/backendapp/mentions_test.go`
- `apps/backend/internal/plugins/mentions.go`
- Focused plugin bridge tests under `apps/backend/internal/plugins/`.
- `apps/web/hooks/use-entity-reference-search.test.ts`
- `apps/web/components/task/chat/use-entity-reference-composer.test.ts`
- `apps/web/components/task/chat/entity-reference-menu.test.tsx`
## Dependencies
Tasks 01 and 03.
## Acceptance
1. Plugins dynamically register/unregister only manifest-owned `(source, provider,
kind)` descriptors; source collisions, disabled plugins, timeouts, and cancellation
have deterministic behavior.
2. Host, not plugin, constructs canonical references. Search and message submission
call live plugin authorization with verified workspace and `search`/`submission`
purpose.
3. Generic composer UI renders plugin pull-request groups/icons/chips without a
Bitbucket frontend branch.
## Verification
```sh
cd apps/backend && go test ./internal/mentions ./internal/backendapp ./internal/plugins
cd apps/web && pnpm test -- hooks/use-entity-reference-search.test.ts components/task/chat/use-entity-reference-composer.test.ts components/task/chat/entity-reference-menu.test.tsx
cd apps/web && pnpm run typecheck
```
## Risks
Search results are untrusted presentation data. Submission reauthorization is required
to prevent stale, tampered, cross-workspace, or disabled-plugin references entering
message metadata.