Crate reposix_jira 

JiraBackend — read/write BackendConnector adapter for Atlassian JIRA Cloud REST v3.

Scope

Phase 28 ships the read path: list_records (POST /rest/api/3/search/jql with cursor pagination) and get_record (GET /rest/api/3/issue/{id}). Phase 29 ships the full write path: create_record, update_record, and delete_or_close (via transitions API with DELETE fallback).

Issue → Issue mapping

Issue field	JIRA source
id	fields.id (numeric string → u64)
title	fields.summary
status	Two-field mapping on statusCategory.key + resolution name
body	fields.description (ADF → plain text; null → “”)
created_at	fields.created
updated_at	fields.updated
version	fields.updated as Unix-milliseconds u64
assignee	fields.assignee.displayName
labels	fields.labels
parent_id	fields.parent.id (numeric string → u64)
extensions	jira_key, issue_type, priority, status_name, hierarchy_level

Pagination

Uses POST /rest/api/3/search/jql with cursor-based pagination via nextPageToken + isLast: true as the terminator. The old GET /search endpoint was retired August 2025 and is not used here.

Rate limiting

On HTTP 429 the adapter honors the Retry-After header (seconds) and parks the rate-limit gate. If the header is absent, exponential backoff with jitter is applied (max 4 attempts, base 1 s, cap 60 s).

Security

• SG-01: every HTTP call goes through reposix-core’s sealed HttpClient, which re-checks every target URL against REPOSIX_ALLOWED_ORIGINS before any socket I/O. Callers MUST set the env var to include https://{tenant}.atlassian.net at runtime.
• SG-05: every decoded JIRA issue is wrapped in Tainted::new before translation, documenting the “came from untrusted network” origin.
• T-28-01 (creds leak): JiraCreds has a manual Debug impl that prints api_token: "<redacted>". Same redaction on the backend struct.
• T-28-02 (SSRF via tenant injection): JiraBackend::new validates tenant against DNS-label rules before URL construction.

Module layout

Implementation is split alongside three sibling modules so each concern reads in isolation:

• types — JiraCreds + wire-format response shapes.
• translate — pure DTO → Record translation + validate_tenant.
• client — JiraBackend struct, HTTP plumbing, audit hooks, rate-limit gate.

This file holds the BackendConnector trait impl, which adapts the plumbing in client to the canonical reposix surface.

Re-exports

pub use client::JiraBackend;

pub use translate::basic_auth_header;

pub use translate::validate_tenant;

pub use types::JiraCreds;

pub use types::CAPABILITIES;

pub use types::DEFAULT_BASE_URL_FORMAT;

Modules

adf

ADF (Atlassian Document Format) utilities for JIRA Cloud.

client

HTTP plumbing, audit hooks, and rate-limit gate for JiraBackend.

translate

Pure helpers and DTO → Record translation.

types

JIRA wire types and credentials.