Subchapter 46.6

Gather Atlassian

Perform Preflight

Running Work Transitions

README

Appendix · 10 subchapters

Weekly Recap

Threat Modeling

Triaging Security Findings

Next Gather gh Events

Source

scripts/gather-atlassian.sh

Shell639 lines28 KB

1#!/usr/bin/env bash
2# Pull the authenticated user's Jira and Confluence activity for one workday and emit a
3# compact JSON summary.
4#
5# A workday runs from the cutoff hour on the given date to the cutoff hour on the next
6# date, in local time, so work done after midnight counts toward the day it continues.
7#
8# Usage:
9#   gather-atlassian.sh [YYYY-MM-DD]
10#     The workday to collect, named by the local date it starts on. Defaults to the most
11#     recently completed workday (yesterday once today's cutoff has passed, otherwise
12#     the day before).
13#
14# Environment:
15

gather-atlassian.sh on GitHub

# DAILY_RECAP_CUTOFF_HOUR Local hour (0-23) at which a workday begins. Default: 7.

# TZ Standard timezone override, e.g. America/Los_Angeles.

# ATLASSIAN_CLOUD_ID Atlassian Cloud ID, used to build the gateway base URLs.

# ATLASSIAN_EMAIL Atlassian account email, used for basic auth.

# ATLASSIAN_JIRA_READ_ONLY_TOKEN Atlassian API token scoped for Jira read access.

# ATLASSIAN_CONFLUENCE_READ_ONLY_TOKEN Atlassian API token scoped for Confluence read access.

#

# Output (stdout): a JSON object with "jira" and "confluence" keys. The two are entirely

# independent: each is null (with its own stderr notice) when its credentials are unset

# or its identity check fails, regardless of whether the other succeeded -- the recap

# must not fail, or lose one service's data, because the other is unavailable.

#

# "jira" holds account_id, site_url, window, complete, and issues (each issue carries a

# returned flag when the user moved it backward in status within the window).

# "confluence" holds account_id, site_url, window, complete, and pages (each page: title,

# space_key, space_id, created, version_count, url) when present. The window line for

# both goes to stderr before either credential check, so a recap built without Atlassian

# still has it. "complete" is false, with a matching stderr warning, when the

# MAX_SEARCH_PAGES safety cap truncated that service's search before exhausting all pages.

#

# Requires: curl, jq, and GNU or BSD date. Never prints a token: auth for each service

# goes through its own private, mode-600 netrc file in a temp directory removed on exit,

# rather than on the curl command line where `ps` could see it.

# cspell:ignore issuekey strptime todateiso lastmodified tonumber

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# shellcheck source=SCRIPTDIR/date-utils.sh

source "${SCRIPT_DIR}/date-utils.sh"

die() {

echo "gather-atlassian: $*" >&2

exit 1

}

# Pages of search results, for either service, beyond this are not collected (safety cap

# against unbounded pagination on a very busy window). Overridable only so tests can force

# the cap without needing ten-plus pages of fixture data; not documented as a user-facing

# knob.

readonly MAX_SEARCH_PAGES="${DAILY_RECAP_MAX_SEARCH_PAGES:-10}"

command -v jq >/dev/null 2>&1 || die "'jq' is required but not installed"

cutoff_raw="${DAILY_RECAP_CUTOFF_HOUR:-7}"

if ! [[ "$cutoff_raw" =~ ^[0-9]{1,2}$ ]] || ((10#$cutoff_raw > 23)); then

die "DAILY_RECAP_CUTOFF_HOUR must be a whole hour from 0 to 23 (got '${cutoff_raw}')"

fi

CUTOFF_HOUR=$((10#$cutoff_raw))

CUTOFF_HH="$(printf '%02d' "$CUTOFF_HOUR")"

TODAY="$(date +%Y-%m-%d)"

if [[ $# -ge 1 ]]; then

DATE="$1"

is_valid_date "$DATE" || die "date must be a real calendar date in YYYY-MM-DD form (got '${DATE}')"

elif ((10#$(date +%H) >= CUTOFF_HOUR)); then

DATE="$(add_days "$TODAY" -1)"

else

DATE="$(add_days "$TODAY" -2)"

fi

NEXT_DATE="$(add_days "$DATE" 1)"

START_EPOCH="$(local_to_epoch "${DATE} ${CUTOFF_HH}:00:00")" \

|| die "could not compute the window start for ${DATE} ${CUTOFF_HH}:00 local time"

END_EPOCH="$(local_to_epoch "${NEXT_DATE} ${CUTOFF_HH}:00:00")" \

|| die "could not compute the window end for ${NEXT_DATE} ${CUTOFF_HH}:00 local time"

START_UTC="$(epoch_fmt_utc "$START_EPOCH" '%Y-%m-%dT%H:%M:%SZ')"

END_UTC="$(epoch_fmt_utc "$END_EPOCH" '%Y-%m-%dT%H:%M:%SZ')"

TZ_LABEL="$(epoch_fmt "$START_EPOCH" '%Z')"

echo "# Window: ${START_UTC} -> ${END_UTC} (${CUTOFF_HH}:00 ${TZ_LABEL} boundary)" >&2

# A day-widened JQL/CQL window, shared in spirit by both services: Atlassian query

# languages' date literals are evaluated in a tenant/user timezone that may not match TZ

# here, so both collectors widen their query bounds by a day on each side and then apply

# an exact epoch filter in jq afterward.

WIDE_START="$(add_days "$DATE" -1) 00:00"

WIDE_END="$(add_days "$NEXT_DATE" 1) 23:59"

# report_api_error LABEL RESPONSE_FILE -> prints the response's errorMessages (or

# errors) to stderr, if any, so a future failure is diagnosable without printing the

# whole body (which could echo back request content). Never touches credentials: the

# Atlassian error payload is JSON describing the request, not the auth headers. Jira's

# error shape (errorMessages array, errors object) is covered directly; Confluence v1/v2

# error shapes (message/errors array of objects) are not fully covered by this yet --

# failures still surface the HTTP status even when this extracts no message.

report_api_error() {

local label="$1" resp_file="$2"

local messages

messages="$(jq -r '

[ (.errorMessages // [])[],

((.errors // {}) | to_entries[]? | "\(.key): \(.value)")

] | join("; ")

' "$resp_file" 2>/dev/null || true)"

if [[ -n "$messages" ]]; then

echo "gather-atlassian: ${label}: ${messages}" >&2

fi

}

# write_netrc FILE TOKEN -> writes a mode-600 netrc entry for api.atlassian.com with the

# given token as the password, so the token never appears on a curl command line (where

# `ps` could see it) or in this script's own logging.

write_netrc() {

local file="$1" token="$2"

(

umask 077

{

echo "machine api.atlassian.com"

echo "login ${ATLASSIAN_EMAIL}"

echo "password ${token}"

} >"$file"

)

}

# curl_api NETRC BASE METHOD PATH OUT_FILE [DATA_FILE] -> prints the HTTP status code to

# stdout, writes the response body to OUT_FILE. METHOD is GET or POST. NETRC and BASE

# are passed explicitly so Jira and Confluence calls -- different tokens, different

# gateway paths, same host -- never share a netrc entry.

curl_api() {

local netrc="$1" base="$2" method="$3" path="$4" out="$5" data="${6:-}"

local url="${base}${path}"

if [[ -n "$data" ]]; then

curl -sS --netrc-file "$netrc" \

-H "Accept: application/json" -H "Content-Type: application/json" \

-X "$method" --data-binary "@${data}" \

-o "$out" -w '%{http_code}' "$url"

else

curl -sS --netrc-file "$netrc" \

-H "Accept: application/json" \

-X "$method" \

-o "$out" -w '%{http_code}' "$url"

fi

}

WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/daily-recap-atlassian.XXXXXX")"

trap 'rm -rf "$WORK_DIR"' EXIT INT TERM HUP

# jira_ts_to_epoch "2026-10-20T10:00:00.000+0000" -> epoch seconds.

# Jira's own timestamps carry milliseconds and a numeric (non-colon) UTC offset, which

# neither GNU nor BSD date parses with the Z-only helpers in date-utils.sh.

jira_ts_to_epoch() {

local ts="$1"

date -u -d "$ts" +%s 2>/dev/null && return

date -j -f '%Y-%m-%dT%H:%M:%S%z' "$(sed -E 's/\.[0-9]+//' <<<"$ts")" +%s 2>/dev/null

}

# confluence_ts_to_epoch "2026-10-20T10:00:00.000Z" -> epoch seconds.

# Confluence's v2 timestamps carry milliseconds before the Z, which BSD date's strict

# formatter cannot parse directly.

confluence_ts_to_epoch() {

local ts="$1"

date -u -d "$ts" +%s 2>/dev/null && return

date -j -u -f '%Y-%m-%dT%H:%M:%S' "$(sed -E 's/\.[0-9]+Z$//' <<<"$ts")" +%s 2>/dev/null

}

# =============================================================================

# Jira

# =============================================================================

collect_jira() {

if [[ -z "${ATLASSIAN_CLOUD_ID:-}" || -z "${ATLASSIAN_EMAIL:-}" || -z "${ATLASSIAN_JIRA_READ_ONLY_TOKEN:-}" ]]; then

echo "gather-atlassian: Jira credentials not set; skipping Jira" >&2

echo 'null'

return 0

fi

command -v curl >/dev/null 2>&1 || die "'curl' is required but not installed"

skip_jira() {

echo "gather-atlassian: $*; skipping Jira" >&2

echo 'null'

exit 0

}

local BASE_URL="https://api.atlassian.com/ex/jira/${ATLASSIAN_CLOUD_ID}"

local NETRC_FILE="${WORK_DIR}/jira-netrc"

write_netrc "$NETRC_FILE" "$ATLASSIAN_JIRA_READ_ONLY_TOKEN"

# ---------------------------------------------------------------------------

# Identity check. /search/jql can return 200 on bad credentials, so verify who we are

# first via /myself.

# ---------------------------------------------------------------------------

local MYSELF_FILE="${WORK_DIR}/myself.json"

local status

status="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "/rest/api/3/myself" "$MYSELF_FILE")" || status="000"

if [[ ! "$status" =~ ^2 ]]; then

report_api_error "identity check" "$MYSELF_FILE"

skip_jira "Jira identity check failed (HTTP ${status})"

fi

local ACCOUNT_ID

ACCOUNT_ID="$(jq -r '.accountId // empty' "$MYSELF_FILE" 2>/dev/null || true)"

if [[ -z "$ACCOUNT_ID" ]]; then

skip_jira "Jira identity check returned no accountId"

fi

# Best-effort tenant hostname for human-readable browse URLs. Not fatal if it fails;

# issues just carry a null url.

local SITE_URL=""

local SERVER_INFO_FILE="${WORK_DIR}/server-info.json"

if status="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "/rest/api/3/serverInfo" "$SERVER_INFO_FILE" 2>/dev/null)" && [[ "$status" =~ ^2 ]]; then

SITE_URL="$(jq -r '.baseUrl // empty' "$SERVER_INFO_FILE" 2>/dev/null || true)"

fi

# ---------------------------------------------------------------------------

# Search for candidate issues: assigned to or reported by the user, status-transitioned

# by the user, or otherwise updated (which includes commenting) by the user, within a

# day-widened window (Jira JQL dates are in the user's Jira timezone, which may not

# match TZ here -- widened bounds plus an exact epoch filter in jq below cover that).

#

# `status CHANGED BY ... DURING (...)` and `issuekey IN updatedBy(...)` are what

# surface issues the user transitioned or commented on without being assignee or

# reporter -- validated live against Jira Cloud's /search/jql gateway endpoint.

# updatedBy() is broader than comments alone (any field edit by the user), but the

# per-issue comment fetch below filters precisely to the user's own in-window comments,

# so the extra candidates it pulls in just cost a comment fetch, not a false positive.

# ---------------------------------------------------------------------------

local JQL="(assignee = \"${ACCOUNT_ID}\" OR reporter = \"${ACCOUNT_ID}\" OR status CHANGED BY \"${ACCOUNT_ID}\" DURING (\"${WIDE_START}\", \"${WIDE_END}\") OR issuekey IN updatedBy(\"${ACCOUNT_ID}\", \"${WIDE_START}\", \"${WIDE_END}\")) AND updated >= \"${WIDE_START}\" ORDER BY updated DESC"

local FIELDS_JSON='["summary","status","created","updated","reporter","assignee"]'

local ISSUES_PAGES_DIR="${WORK_DIR}/pages"

mkdir -p "$ISSUES_PAGES_DIR"

local page=1 next_token="" body_file resp_file is_last complete=true

while ((page <= MAX_SEARCH_PAGES)); do

body_file="${WORK_DIR}/search-body-${page}.json"

# `expand` must be the comma-joined string form ("changelog"), not a JSON array, on

# POST /rest/api/3/search/jql -- an array there is rejected with a bare HTTP 400

# "Invalid request payload" (confirmed live against the gateway endpoint).

if [[ -z "$next_token" ]]; then

jq -n --arg jql "$JQL" --argjson fields "$FIELDS_JSON" \

'{jql: $jql, fields: $fields, expand: "changelog", maxResults: 50}' >"$body_file"

else

jq -n --arg jql "$JQL" --argjson fields "$FIELDS_JSON" --arg token "$next_token" \

'{jql: $jql, fields: $fields, expand: "changelog", maxResults: 50, nextPageToken: $token}' >"$body_file"

fi

resp_file="${WORK_DIR}/search-resp-${page}.json"

status="$(curl_api "$NETRC_FILE" "$BASE_URL" POST "/rest/api/3/search/jql" "$resp_file" "$body_file")" || status="000"

if [[ ! "$status" =~ ^2 ]]; then

report_api_error "search" "$resp_file"

skip_jira "Jira search failed (HTTP ${status})"

fi

jq '.issues // []' "$resp_file" >"${ISSUES_PAGES_DIR}/page-${page}.json"

is_last="$(jq -r 'if .isLast == false then "false" else "true" end' "$resp_file")"

next_token="$(jq -r '.nextPageToken // empty' "$resp_file")"

if [[ "$is_last" == "true" || -z "$next_token" ]]; then

break

fi

page=$((page + 1))

done

if [[ "$is_last" == "false" && -n "$next_token" ]]; then

echo "gather-atlassian: the Jira search hit the ${MAX_SEARCH_PAGES}-page safety cap with more results remaining; some issues may be missing." >&2

complete=false

fi

local ISSUES_ALL="${WORK_DIR}/issues-all.json"

jq -s 'add // []' "${ISSUES_PAGES_DIR}"/page-*.json >"$ISSUES_ALL"

# ---------------------------------------------------------------------------

# Attach the user's comments per candidate issue (single page per issue is enough for

# one workday's worth of activity, since we request newest-first ordering so the

# first page always holds the most recent comments).

# ---------------------------------------------------------------------------

local MERGED="${WORK_DIR}/merged.json"

jq -c '.[]' "$ISSUES_ALL" | while IFS= read -r issue; do

key="$(jq -r '.key' <<<"$issue")"

comment_file="${WORK_DIR}/comments-${key}.json"

c_status="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "/rest/api/3/issue/${key}/comment?maxResults=100&orderBy=-created" "$comment_file")" || c_status="000"

# Slim the comment payload down to the two fields the final jq pass below actually

# consumes (created, author.accountId) and pass it through a file via --slurpfile

# rather than argv: a busy issue's full comment history can exceed Linux's

# MAX_ARG_STRLEN (131072 bytes) for a single argv string, which fails execve with

# E2BIG -- silently, since this loop runs inside collect_jira's $(...) subshell

# where errexit is disabled.

comment_slim_file="${WORK_DIR}/comments-slim-${key}.json"

if [[ "$c_status" =~ ^2 ]]; then

jq -c '[.comments[]? | {created, author: {accountId: .author.accountId}}]' "$comment_file" \

>"$comment_slim_file" || echo '[]' >"$comment_slim_file"

else

echo '[]' >"$comment_slim_file"

fi

jq -c --slurpfile c "$comment_slim_file" '. + {comments: $c[0]}' <<<"$issue"

done >"${WORK_DIR}/merged.ndjson"

jq -s '.' "${WORK_DIR}/merged.ndjson" >"$MERGED"

# ---------------------------------------------------------------------------

# Convert every timestamp we might need (changelog entries, issue created/updated,

# comment created) to epoch seconds once, in bash, so window comparisons do not rely

# on jq's platform-dependent strptime.

# ---------------------------------------------------------------------------

local TIMESTAMPS_FILE="${WORK_DIR}/timestamps.txt"

jq -r '

[ .[]

| .fields.created, .fields.updated,

(.changelog.histories[]?.created), (.comments[]?.created)

] | map(select(. != null)) | unique | .[]

' "$MERGED" >"$TIMESTAMPS_FILE"

local TS_MAP_FILE="${WORK_DIR}/ts_map.json"

local TS_EPOCH_PAIRS="${WORK_DIR}/ts_epoch_pairs.tsv"

: >"$TS_EPOCH_PAIRS"

local ts epoch

while IFS= read -r ts; do

[[ -z "$ts" ]] && continue

epoch="$(jira_ts_to_epoch "$ts" 2>/dev/null || true)"

printf '%s\t%s\n' "$ts" "$epoch" >>"$TS_EPOCH_PAIRS"

done <"$TIMESTAMPS_FILE"

jq -Rn '

[ inputs

| select(. != "")

| split("\t")

| {key: .[0], value: (if (.[1] // "") == "" then null else (.[1] | tonumber) end)}

] | from_entries

' "$TS_EPOCH_PAIRS" >"$TS_MAP_FILE"

local FINAL_JQ="${WORK_DIR}/final.jq"

cat >"$FINAL_JQ" <<'JQ_PROGRAM'

# Coarse status-category ranking used only to detect a backward ("returned") status

# transition from changelog fromString/toString names, which carry no category info

# of their own. Unrecognized names are treated as an in-progress-like middle rank.

def rank(name):

if name == null then 1

elif (name == "To Do" or name == "Open" or name == "Backlog" or name == "New" or name == "Blocked") then 0

elif (name == "In Review" or name == "In QA" or name == "QA" or name == "Ready for Review" or name == "In Testing" or name == "Code Review") then 2

elif (name == "Done" or name == "Closed" or name == "Resolved") then 3

else 1

end;

def epoch_of(ts): if ts == null then null else ($ts_map_file[0][ts] // null) end;

def in_window(ts): (epoch_of(ts)) as $e | ($e != null and $e >= $start_epoch and $e < $end_epoch);

( [ .[]

| . as $issue

| ($issue.changelog.histories // []) as $histories

| ($issue.comments // []) as $comments

| {

key: $issue.key,

summary: ($issue.fields.summary // ""),

status: ($issue.fields.status.name // null),

status_category: ($issue.fields.status.statusCategory.name // null),

url: (if $site_url != "" then ($site_url + "/browse/" + $issue.key) else null end),

reporter_id: ($issue.fields.reporter.accountId // null),

assignee_id: ($issue.fields.assignee.accountId // null),

created_in_window: in_window($issue.fields.created),

updated_in_window: in_window($issue.fields.updated),

transitions: [

$histories[]

| select(.author.accountId == $account_id)

| select(in_window(.created))

| . as $h

| .items[]?

| select(.field == "status")

| {from: .fromString, to: .toString, at: (epoch_of($h.created) | todateiso8601)}

],

comment_count: ([

$comments[]

| select(.author.accountId == $account_id)

| select(in_window(.created))

] | length)

}

]

# Transitions TO "Blocked" never count as "returned": blocking your own ticket

# isn't the same as a reviewer bouncing it back, regardless of rank.

| map(. + {returned: ([.transitions[] | select(rank(.to) < rank(.from) and .to != "Blocked")] | length > 0)})

) as $enriched

| {

account_id: $account_id,

site_url: (if $site_url != "" then $site_url else null end),

window: { start_utc: $start_utc, end_utc: $end_utc },

complete: $complete,

issues: [

$enriched[]

| {

key: .key,

summary: .summary,

status: .status,

status_category: .status_category,

url: .url,

involvement: (

[ (if (.created_in_window and .reporter_id == $account_id) then "created" else empty end),

(if (.transitions | length) > 0 then "transitioned" else empty end),

(if .comment_count > 0 then "commented" else empty end),

(if (.assignee_id == $account_id and .updated_in_window) then "assigned" else empty end)

]

),

transitions: .transitions,

comment_count: .comment_count,

returned: .returned

}

| select((.involvement | length) > 0)

]

}

JQ_PROGRAM

jq -f "$FINAL_JQ" \

--slurpfile ts_map_file "$TS_MAP_FILE" \

--arg account_id "$ACCOUNT_ID" \

--arg site_url "${SITE_URL}" \

--argjson start_epoch "$START_EPOCH" \

--argjson end_epoch "$END_EPOCH" \

--arg start_utc "$START_UTC" \

--arg end_utc "$END_UTC" \

--argjson complete "$complete" \

"$MERGED"

}

# =============================================================================

# Confluence

# =============================================================================

collect_confluence() {

if [[ -z "${ATLASSIAN_CLOUD_ID:-}" || -z "${ATLASSIAN_EMAIL:-}" || -z "${ATLASSIAN_CONFLUENCE_READ_ONLY_TOKEN:-}" ]]; then

echo "gather-atlassian: Confluence credentials not set; skipping Confluence" >&2

echo 'null'

return 0

fi

command -v curl >/dev/null 2>&1 || die "'curl' is required but not installed"

skip_confluence() {

echo "gather-atlassian: $*; skipping Confluence" >&2

echo 'null'

exit 0

}

# The gateway's Confluence path includes the "/wiki" segment the product's own REST

# API lives under, same as a self-managed site's https://<site>/wiki.

local BASE_URL="https://api.atlassian.com/ex/confluence/${ATLASSIAN_CLOUD_ID}/wiki"

local NETRC_FILE="${WORK_DIR}/confluence-netrc"

write_netrc "$NETRC_FILE" "$ATLASSIAN_CONFLUENCE_READ_ONLY_TOKEN"

# ---------------------------------------------------------------------------

# Identity check, applying the same precaution as Jira's /myself: verify who we are

# before trusting any search results, in case a bad-credentials request still returns

# a usable-looking 200.

# ---------------------------------------------------------------------------

local MYSELF_FILE="${WORK_DIR}/confluence-myself.json"

local status

status="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "/rest/api/user/current" "$MYSELF_FILE")" || status="000"

if [[ ! "$status" =~ ^2 ]]; then

report_api_error "Confluence identity check" "$MYSELF_FILE"

skip_confluence "Confluence identity check failed (HTTP ${status})"

fi

local ACCOUNT_ID

ACCOUNT_ID="$(jq -r '.accountId // empty' "$MYSELF_FILE" 2>/dev/null || true)"

if [[ -z "$ACCOUNT_ID" ]]; then

skip_confluence "Confluence identity check returned no accountId"

fi

# ---------------------------------------------------------------------------

# CQL search (v1 content search) for candidate pages the user contributed to in a

# day-widened window. "contributor" covers both the page creator and anyone who has

# edited it, so each candidate is confirmed against its version history below before

# being counted as this user's activity.

# ---------------------------------------------------------------------------

local CQL="contributor = \"${ACCOUNT_ID}\" and type = page and lastmodified >= \"${WIDE_START}\" order by lastmodified desc"

local CQL_ENCODED

CQL_ENCODED="$(jq -rn --arg c "$CQL" '$c | @uri')"

local CONFLUENCE_PAGES_DIR="${WORK_DIR}/confluence-pages"

mkdir -p "$CONFLUENCE_PAGES_DIR"

local SITE_BASE=""

local page=1 next_path resp_file next_href complete=true

next_path="/rest/api/search?cql=${CQL_ENCODED}&limit=25&expand=content.version,content.space,content.history"

while ((page <= MAX_SEARCH_PAGES)) && [[ -n "$next_path" ]]; do

resp_file="${WORK_DIR}/confluence-search-${page}.json"

# The expand value here is a comma-joined query-string value, not a JSON array, by

# construction -- GET query parameters are always strings -- so the array-vs-string

# 400 Jira's POST /search/jql hits does not apply to this GET call.

status="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "$next_path" "$resp_file")" || status="000"

if [[ ! "$status" =~ ^2 ]]; then

report_api_error "Confluence search" "$resp_file"

skip_confluence "Confluence search failed (HTTP ${status})"

fi

if [[ "$page" -eq 1 ]]; then

SITE_BASE="$(jq -r '._links.base // empty' "$resp_file" 2>/dev/null || true)"

fi

jq '.results // []' "$resp_file" >"${CONFLUENCE_PAGES_DIR}/page-${page}.json"

next_href="$(jq -r '._links.next // empty' "$resp_file" 2>/dev/null || true)"

if [[ -z "$next_href" ]]; then

next_path=""

else

next_path="$next_href"

fi

page=$((page + 1))

done

if [[ -n "$next_path" ]]; then

echo "gather-atlassian: the Confluence search hit the ${MAX_SEARCH_PAGES}-page safety cap with more results remaining; some pages may be missing." >&2

complete=false

fi

local CONFLUENCE_ALL="${WORK_DIR}/confluence-all.json"

jq -s 'add // []' "${CONFLUENCE_PAGES_DIR}"/page-*.json >"$CONFLUENCE_ALL"

# ---------------------------------------------------------------------------

# spaceId resolution. Confluence v2 endpoints (the page version-history call below)

# key on the numeric spaceId, not the space key the v1 CQL search above returns, so

# each distinct space key found among the candidates is resolved once via

# GET /api/v2/spaces?keys=<key> and cached for the rest of this run.

# ---------------------------------------------------------------------------

local SPACE_ID_MAP_FILE="${WORK_DIR}/space-id-map.json"

echo '{}' >"$SPACE_ID_MAP_FILE"

resolve_space_id() {

local key="$1"

[[ -z "$key" ]] && return 0

local cached

cached="$(jq -r --arg k "$key" '.[$k] // empty' "$SPACE_ID_MAP_FILE" 2>/dev/null || true)"

if [[ -n "$cached" ]]; then

echo "$cached"

return 0

fi

local resp="${WORK_DIR}/confluence-space-${key}.json"

local s id=""

s="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "/api/v2/spaces?keys=${key}" "$resp")" || s="000"

if [[ "$s" =~ ^2 ]]; then

id="$(jq -r '.results[0].id // empty' "$resp" 2>/dev/null || true)"

else

report_api_error "Confluence space lookup for ${key}" "$resp"

fi

jq --arg k "$key" --arg v "$id" '.[$k] = $v' "$SPACE_ID_MAP_FILE" >"${SPACE_ID_MAP_FILE}.tmp" \

&& mv "${SPACE_ID_MAP_FILE}.tmp" "$SPACE_ID_MAP_FILE"

echo "$id"

}

# fetch_version_matches PAGE_ID -> the page's v2 version-history results (JSON array),

# or "[]" on a fetch failure for that page. A single page's version fetch failing does

# not fail the whole collector, matching the reference collector's per-page tolerance.

fetch_version_matches() {

local page_id="$1"

local resp="${WORK_DIR}/confluence-versions-${page_id}.json"

local s

s="$(curl_api "$NETRC_FILE" "$BASE_URL" GET "/api/v2/pages/${page_id}/versions?limit=50" "$resp")" || s="000"

if [[ ! "$s" =~ ^2 ]]; then

echo "gather-atlassian: Confluence version fetch failed for page ${page_id} (HTTP ${s}); skipping page" >&2

echo "[]"

return 0

fi

jq -c '.results // []' "$resp" 2>/dev/null || echo "[]"

}

# ---------------------------------------------------------------------------

# Per-candidate confirmation: only pages where this account authored at least one

# version inside the window are included, same confirm-via-version-history gate the

# reference Python collector uses to filter the CQL search's broader "contributor"

# match down to this user's actual in-window edits.

# ---------------------------------------------------------------------------

jq -c '.[]' "$CONFLUENCE_ALL" | while IFS= read -r item; do

page_id="$(jq -r '.content.id // empty' <<<"$item")"

[[ -z "$page_id" ]] && continue

title="$(jq -r '.content.title // ""' <<<"$item")"

space_key="$(jq -r '.content.space.key // ""' <<<"$item")"

webui="$(jq -r '.content._links.webui // ""' <<<"$item")"

space_id="$(resolve_space_id "$space_key")"

versions_json="$(fetch_version_matches "$page_id")"

in_window_matches="[]"

while IFS= read -r v; do

[[ -z "$v" ]] && continue

author_id="$(jq -r '.authorId // empty' <<<"$v")"

[[ "$author_id" != "$ACCOUNT_ID" ]] && continue

created_at="$(jq -r '.createdAt // empty' <<<"$v")"

epoch="$(confluence_ts_to_epoch "$created_at" 2>/dev/null || true)"

if [[ -n "$epoch" ]] && ((epoch >= START_EPOCH && epoch < END_EPOCH)); then

in_window_matches="$(jq -c --argjson v "$v" '. + [$v]' <<<"$in_window_matches")"

fi

done < <(jq -c '.[]' <<<"$versions_json")

version_count="$(jq 'length' <<<"$in_window_matches")"

# Not confirmed as this user's edit within the window: the CQL "contributor" match

# was stale, out-of-window, or belonged to someone else despite the field name.

((version_count == 0)) && continue

created_flag="$(jq '[ .[] | select(.number == 1) ] | length > 0' <<<"$in_window_matches")"

page_url="$webui"

if [[ -n "$SITE_BASE" && "$webui" != http* ]]; then

page_url="${SITE_BASE}${webui}"

fi

jq -n --arg title "$title" --arg space_key "$space_key" --arg space_id "$space_id" \

--argjson created "$created_flag" --argjson version_count "$version_count" \

--arg url "$page_url" \

'{

title: $title,

space_key: $space_key,

space_id: (if $space_id == "" then null else $space_id end),

created: $created,

version_count: $version_count,

url: (if $url == "" then null else $url end)

}'

done >"${WORK_DIR}/confluence-result.ndjson"

local PAGES_JSON

PAGES_JSON="$(jq -s '.' "${WORK_DIR}/confluence-result.ndjson")"

jq -n --arg account_id "$ACCOUNT_ID" --arg site_url "${SITE_BASE}" \

--arg start_utc "$START_UTC" --arg end_utc "$END_UTC" --argjson pages "$PAGES_JSON" \

--argjson complete "$complete" \

'{

account_id: $account_id,

site_url: (if $site_url == "" then null else $site_url end),

window: { start_utc: $start_utc, end_utc: $end_utc },

complete: $complete,

pages: $pages

}'

}

JIRA_VALUE="$(collect_jira)"

CONFLUENCE_VALUE="$(collect_confluence)"

jq -n -c --argjson jira "$JIRA_VALUE" --argjson confluence "$CONFLUENCE_VALUE" \

'{jira: $jira, confluence: $confluence}'