Added explicit secrets manager write flag to Bitbucket source (#4403)

Added a field in the proto definition for Bitbucket sources to explicitly allow writing to the user's secrets manager. Initially this will be used to keep new and unused Bitbucket refresh tokens inside of the secret that we pull the config from. This process needed to happen in the first place because Bitbucket as an OAuth authorization server currently revokes any previously issued refresh tokens whenever the newest refresh token is issued with an access token, effectively making refresh tokens in the config file single-use.

pkg/pb/sourcespb/sources.pb.validate.go

@@ -664,6 +664,8 @@ func (m *Bitbucket) validate(all bool) error {
 
 	// no validation rules for OauthTokenEndpoint
 
+	// no validation rules for AllowSecretsManagerWrite
+
 	switch v := m.Credential.(type) {
 	case *Bitbucket_Token:
 		if v == nil {

proto/sources.proto

@@ -116,6 +116,7 @@ message Bitbucket {
   string oauth_authorization_endpoint = 10; // endpoint for OAuth authorization flow in Bitbucket Data Center application links
   string oauth_token_endpoint = 11; // endpoint for getting OAuth access/refresh tokens in Bitbucket Data Center application links
   repeated string oauth_scopes = 12; // list of OAuth scopes that the access token is provided
+  bool allow_secrets_manager_write = 13; // flag to explicitly allow TruffleHog to write to the user's secrets manager
 }
 
 message CircleCI {