feat: add Azure DevOps enterprise integration support

This commit adds enterprise-grade Azure DevOps support with webhook-based automation
and service principal authentication for multi-tenant SaaS deployments.

Key changes:
- Implemented webhook event processing for work items and pull requests
- Added service principal authentication for automated operations
- Implemented Azure DevOps manager for handling webhook events
- Added work item and PR comment support with @mention detection
- Created callback processor for asynchronous webhook responses
- Added webhook registration and management endpoints
- Implemented Azure DevOps user enrichment and token management
- Added database schema for webhook storage
- Fixed API response format handling for comments and field values
- Removed linter suppressions for cleaner code

The implementation enables:
- Automated responses to work item assignments and @mentions
- Pull request comment handling with inline code review support
- Service principal-based API operations for scalability
- Multi-organization support with webhook deduplication
- Integration with Keycloak for user management
- Webhook-driven conversation creation and management

Author: zerofltexx

enterprise/allhands-realm-github-provider.json.tmpl

@@ -1771,6 +1771,47 @@
         "sendIdTokenOnLogout": "true",
         "passMaxAge": "false"
       }
+    },
+    {
+      "alias": "azure_devops",
+      "displayName": "Azure DevOps",
+      "internalId": "7e42c8f1-9d3a-4f1e-b5c7-2a8f6e9d4c1b",
+      "providerId": "oidc",
+      "enabled": true,
+      "updateProfileFirstLoginMode": "on",
+      "trustEmail": true,
+      "storeToken": true,
+      "addReadTokenRoleOnCreate": true,
+      "authenticateByDefault": false,
+      "linkOnly": false,
+      "hideOnLogin": false,
+      "config": {
+        "acceptsPromptNoneForwardFromClient": "false",
+        "tokenUrl": "https://login.microsoftonline.com/$AZURE_DEVOPS_TENANT_ID/oauth2/v2.0/token",
+        "isAccessTokenJWT": "true",
+        "jwksUrl": "https://login.microsoftonline.com/$AZURE_DEVOPS_TENANT_ID/discovery/v2.0/keys",
+        "filteredByClaim": "false",
+        "backchannelSupported": "false",
+        "caseSensitiveOriginalUsername": "false",
+        "loginHint": "false",
+        "clientAuthMethod": "client_secret_post",
+        "syncMode": "IMPORT",
+        "clientSecret": "$AZURE_DEVOPS_CLIENT_SECRET",
+        "allowedClockSkew": "0",
+        "defaultScope": "openid email profile offline_access 499b84ac-1321-427f-aa17-267ca6975798/.default",
+        "userInfoUrl": "https://graph.microsoft.com/oidc/userinfo",
+        "validateSignature": "false",
+        "clientId": "$AZURE_DEVOPS_CLIENT_ID",
+        "uiLocales": "false",
+        "disableNonce": "false",
+        "useJwksUrl": "true",
+        "sendClientIdOnLogout": "false",
+        "pkceEnabled": "false",
+        "authorizationUrl": "https://login.microsoftonline.com/$AZURE_DEVOPS_TENANT_ID/oauth2/v2.0/authorize",
+        "disableUserInfo": "true",
+        "sendIdTokenOnLogout": "true",
+        "passMaxAge": "false"
+      }
     }
   ],
   "identityProviderMappers": [
@@ -1818,6 +1859,17 @@
         "attribute": "identity_provider"
       }
     },
+    {
+      "id": "9e8d7c6b-5a4f-3e2d-1c0b-9a8e7d6c5b4a",
+      "name": "identity-provider",
+      "identityProviderAlias": "azure_devops",
+      "identityProviderMapper": "hardcoded-attribute-idp-mapper",
+      "config": {
+        "attribute.value": "azure_devops",
+        "syncMode": "FORCE",
+        "attribute": "identity_provider"
+      }
+    },
     {
       "id": "37238720-ccd7-4d91-a6a0-476851851d0f",
       "name": "identity-provider",
@@ -1945,7 +1997,7 @@
         "subComponents": {},
         "config": {
           "kc.user.profile.config": [
-            "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"github_id\",\"displayName\":\"GitHub ID\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false},{\"name\":\"identity_provider\",\"displayName\":\"Identity Provider\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false},{\"name\":\"gitlab_id\",\"displayName\":\"GitLab ID\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}]}"
+            "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"github_id\",\"displayName\":\"GitHub ID\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false},{\"name\":\"identity_provider\",\"displayName\":\"Identity Provider\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false},{\"name\":\"gitlab_id\",\"displayName\":\"GitLab ID\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false},{\"name\":\"azure_devops_id\",\"displayName\":\"Azure DevOps ID\",\"validations\":{},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}]}"
           ]
         }
       }

enterprise/enterprise_local/convert_to_env.py

@@ -109,6 +109,9 @@ def convert_yaml_to_env(yaml_file, target_parameters, output_env_file, prefix):
 lines.append(
     'OPENHANDS_BITBUCKET_SERVICE_CLS=integrations.bitbucket.bitbucket_service.SaaSBitBucketService'
 )
+lines.append(
+    'OPENHANDS_AZURE_DEVOPS_SERVICE_CLS=integrations.azure_devops.azure_devops_service.SaaSAzureDevOpsService'
+)
 lines.append(
     'OPENHANDS_CONVERSATION_VALIDATOR_CLS=storage.saas_conversation_validator.SaasConversationValidator'
 )

enterprise/integrations/azure_devops/__init__.py

@@ -0,0 +1,5 @@
+"""Azure DevOps enterprise integration module."""
+
+from integrations.azure_devops.azure_devops_service import SaaSAzureDevOpsService
+
+__all__ = ['SaaSAzureDevOpsService']