[mm 52] Resolve OAuth bug with KVStore (#53)

Co-authored-by: siba <[email protected]>

server/api.go

@@ -184,7 +184,7 @@ func (p *Plugin) connectUserToBitbucket(w http.ResponseWriter, r *http.Request,
 		return
 	}
 
-	appErr := p.API.KVSetWithExpiry(state.Token, stateBytes, TokenTTL)
+	appErr := p.API.KVSetWithExpiry(BitbucketOauthKey+state.Token, stateBytes, TokenTTL)
 	if appErr != nil {
 		http.Error(w, "error setting stored state", http.StatusBadRequest)
 		return
@@ -204,25 +204,26 @@ func (p *Plugin) completeConnectUserToBitbucket(w http.ResponseWriter, r *http.R
 
 	stateToken := r.URL.Query().Get("state")
 
-	storedState, appErr := p.API.KVGet(stateToken)
+	storedState, appErr := p.API.KVGet(BitbucketOauthKey + stateToken)
 	if appErr != nil {
 		p.API.LogError("Missing stored state", "appErr", appErr.Error())
 		http.Error(w, "missing stored state", http.StatusBadRequest)
 		return
 	}
-	appErr = p.API.KVDelete(stateToken)
-	if appErr != nil {
-		p.API.LogError("Error deleting stored state", "appErr", appErr.Error())
-		http.Error(w, "error deleting stored state", http.StatusBadRequest)
-		return
-	}
 
 	var state OAuthState
 	if err := json.Unmarshal(storedState, &state); err != nil {
 		http.Error(w, "json unmarshal failed", http.StatusBadRequest)
 		return
 	}
 
+	appErr = p.API.KVDelete(BitbucketOauthKey + stateToken)
+	if appErr != nil {
+		p.API.LogError("Error deleting stored state", "appErr", appErr.Error())
+		http.Error(w, "error deleting stored state", http.StatusBadRequest)
+		return
+	}
+
 	if state.Token != stateToken {
 		http.Error(w, "invalid state token", http.StatusBadRequest)
 		return

server/plugin.go

@@ -29,6 +29,7 @@ import (
 
 const (
 	BitbucketTokenKey     = "_bitbuckettoken"
+	BitbucketOauthKey     = "bitbucketoauthkey_"
 	BitbucketAccountIDKey = "_bitbucketaccountid"
 
 	BitbucketBaseURL = "https://bitbucket.org/"