fix(atlassian): resolve Jira and Confluence selector contexts server-side

[BillLeoutsakosvl346]

Stacked on #7095. Review the diff against the PR1 branch. Do not merge until #7095 lands and this PR is rebased and retargeted to staging.

Summary

• Migrate Jira Project/Issue and Confluence Space/Page dependent selectors to PR1's authorized server-side context resolver.
• Preserve literal or exact {{KEY}} references in browser requests while keeping resolved environment values server-only.
• Support workflowless credential-backed knowledge connectors without weakening workflow requirements for direct-secret selector contexts.
• Keep Jira/Confluence routes, selector definitions, contracts, mappings, and behavior-focused tests isolated in this PR.

Security behavior

• Successful personal/workspace environment mutations invalidate mounted selector, canvas-label, and workflow-search caches through PR1, so an unchanged {{KEY}} refetches without exposing its value.
• Workflow requests use PR1's active-workflow authorization and canonical workspace.
• Workflowless requests require a session principal plus an authorized Jira/Confluence credential.
• Credential/provider and credential/workspace mismatches stop before token or provider access.
• Missing and inaccessible references return the same stable selector error.
• Atlassian provider response bodies and secret-derived domains are neither returned nor logged.

Focused coverage

• One auth-before-parse boundary across the route family.
• Jira and Confluence inaccessible-reference short-circuiting.
• Jira project and Confluence page option mapping.
• Exact sanitized provider-failure mapping.
• Client opt-in metadata, raw-reference transport, dedicated Confluence routes, workflowless connector behavior, option mapping, and query-key domain privacy.
• Compact Jira/Confluence wire-contract coverage for literal/reference domains and optional workflow IDs.

Verification

• Provider-focused Vitest: 3 files, 15 tests passed.
• App type-check passed.
• Root lint/format, strict API validation, client-boundary, React Query, and git diff --check passed on the combined stack.
• Combined full repository tests passed: 19/19 tasks; app 2,365 files passed, 3 skipped; 34,824 tests passed, 46 skipped.
• Combined focused selector suite: 28 files, 153 tests passed.
• All ten pairwise child diff intersections are empty.

Browser verification

• After the freshness restack, a combined Jira smoke confirmed exact raw references still reach dedicated selector routes and provider/authorization failures stay sanitized. The exact mounted same-reference mutation is covered by PR1's real QueryClient regression because this local account cannot edit Secrets through the UI.
• Disposable Jira and Confluence workflow selectors preserved literal, personal-reference, and shared-reference domains without resolving them in the browser.
• A disposable workflowless Confluence connector preserved an exact shared-domain reference with no workflow ID.
• No compatible local Jira/Confluence credential was available for live provider success; successful mappings and authorized reference resolution are covered by route/provider mocks.
• No secret plaintext appeared in visible responses, console output, or server logs.
• Disposable workflow and knowledge-base data were deleted afterward.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 27, 2026 12:31am

[greptile-apps]

Greptile Summary

The PR moves Jira and Confluence selector context and credential resolution to authenticated server routes while preserving raw environment references in browser requests.

• Adds dedicated Confluence page-list and page-detail selector endpoints.
• Updates Jira and Confluence contracts and client providers to send credential IDs and optional workflow IDs instead of browser OAuth tokens.
• Sanitizes provider failures and limits returned selector data to option-facing fields.
• Adds route, provider, and wire-contract coverage for reference handling and workflowless credential-backed selectors.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/confluence/selector-page/route.ts	Adds an authenticated server endpoint that resolves Confluence selector context and returns sanitized page details.
apps/sim/app/api/tools/confluence/selector-pages/route.ts	Adds server-side credential and context resolution for Confluence page option discovery.
apps/sim/app/api/tools/confluence/selector-spaces/route.ts	Migrates space discovery to the authorized selector context and credential helpers with sanitized provider failures.
apps/sim/app/api/tools/jira/issues/route.ts	Replaces browser-provided Jira tokens and cloud IDs with authenticated server-side resolution for issue selectors.
apps/sim/app/api/tools/jira/projects/route.ts	Migrates project discovery and detail lookup to server-resolved credentials and reduced response mappings.
apps/sim/hooks/selectors/providers/confluence/selectors.ts	Sends raw domain references and credential IDs to dedicated Confluence selector routes without exposing OAuth tokens.
apps/sim/hooks/selectors/providers/jira/selectors.ts	Opts Jira selectors into server-resolved domain context and updates their request and option mappings.
apps/sim/lib/api/contracts/selectors/confluence.ts	Defines credential-backed Confluence selector request contracts for server-side context resolution.
apps/sim/lib/api/contracts/selectors/jira.ts	Updates Jira selector wire contracts to accept credential IDs, raw domains, and optional workflow IDs.

Sequence Diagram

sequenceDiagram
  participant Browser
  participant Route as Atlassian Selector Route
  participant Context as Authorized Context Resolver
  participant Credential as Credential Resolver
  participant Atlassian
  Browser->>Route: Raw domain reference + credential ID + optional workflow ID
  Route->>Context: Authenticate and resolve authorized context
  Context-->>Route: Resolved domain and credential owner
  Route->>Credential: Resolve service-bound credential
  Credential-->>Route: Access token and optional cloud ID
  Route->>Atlassian: Fetch selector options
  Atlassian-->>Route: Provider response
  Route-->>Browser: Sanitized option data or stable error

Loading

_{Reviews (2): Last reviewed commit: "fix(atlassian): resolve Jira and Conflue..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 13 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

No issues found across 13 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[BillLeoutsakosvl346]

@greptileai