feat(integrations): Azure DevOps models, serializer, configuration viewset (PR 2/N)

api/app/settings/common.py

@@ -157,6 +157,7 @@
     "integrations.launch_darkly",
     "integrations.github",
     "integrations.gitlab",
+    "integrations.azure_devops",
     "integrations.grafana",
     "integrations.vcs",
     # Rate limiting admin endpoints

api/integrations/azure_devops/apps.py

@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class AzureDevOpsIntegrationConfig(AppConfig):
+    name = "integrations.azure_devops"

api/integrations/azure_devops/migrations/0001_initial.py

@@ -0,0 +1,111 @@
+# Generated by Django 5.2.14 on 2026-05-28 11:57
+
+import django.db.models.deletion
+import uuid
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ("projects", "0029_bump_default_project_limits"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="AzureDevOpsConfiguration",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "deleted_at",
+                    models.DateTimeField(
+                        blank=True,
+                        db_index=True,
+                        default=None,
+                        editable=False,
+                        null=True,
+                    ),
+                ),
+                (
+                    "uuid",
+                    models.UUIDField(default=uuid.uuid4, editable=False, unique=True),
+                ),
+                ("organisation_url", models.URLField(max_length=300)),
+                ("personal_access_token", models.CharField(max_length=300)),
+                ("labeling_enabled", models.BooleanField(default=False)),
+                ("tagging_enabled", models.BooleanField(default=False)),
+                (
+                    "project",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="azure_devops_config",
+                        to="projects.project",
+                    ),
+                ),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.CreateModel(
+            name="AzureDevOpsServiceHook",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "deleted_at",
+                    models.DateTimeField(
+                        blank=True,
+                        db_index=True,
+                        default=None,
+                        editable=False,
+                        null=True,
+                    ),
+                ),
+                (
+                    "uuid",
+                    models.UUIDField(default=uuid.uuid4, editable=False, unique=True),
+                ),
+                ("ado_project_id", models.UUIDField()),
+                ("ado_project_name", models.CharField(max_length=200)),
+                ("event_type", models.CharField(max_length=64)),
+                ("subscription_id", models.UUIDField()),
+                ("secret", models.CharField(max_length=128)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "configuration",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="service_hooks",
+                        to="azure_devops.azuredevopsconfiguration",
+                    ),
+                ),
+            ],
+            options={
+                "constraints": [
+                    models.UniqueConstraint(
+                        condition=models.Q(("deleted_at__isnull", True)),
+                        fields=("configuration", "ado_project_id", "event_type"),
+                        name="unique_azure_devops_service_hook_per_event",
+                    )
+                ],
+            },
+        ),
+    ]

api/integrations/azure_devops/models.py

@@ -0,0 +1,38 @@
+from django.db import models
+
+from core.models import SoftDeleteExportableModel
+
+
+class AzureDevOpsConfiguration(SoftDeleteExportableModel):
+    project = models.OneToOneField(
+        "projects.Project",
+        on_delete=models.CASCADE,
+        related_name="azure_devops_config",
+    )
+    organisation_url = models.URLField(max_length=300)
+    personal_access_token = models.CharField(max_length=300)
+    labeling_enabled = models.BooleanField(default=False)
+    tagging_enabled = models.BooleanField(default=False)
+
+
+class AzureDevOpsServiceHook(SoftDeleteExportableModel):
+    configuration = models.ForeignKey(
+        AzureDevOpsConfiguration,
+        on_delete=models.CASCADE,
+        related_name="service_hooks",
+    )
+    ado_project_id = models.UUIDField()
+    ado_project_name = models.CharField(max_length=200)
+    event_type = models.CharField(max_length=64)
+    subscription_id = models.UUIDField()
+    secret = models.CharField(max_length=128)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(
+                fields=["configuration", "ado_project_id", "event_type"],
+                name="unique_azure_devops_service_hook_per_event",
+                condition=models.Q(deleted_at__isnull=True),
+            ),
+        ]

api/integrations/azure_devops/serializers.py

@@ -0,0 +1,23 @@
+from typing import Any
+
+from integrations.azure_devops.models import AzureDevOpsConfiguration
+from integrations.common.serializers import BaseProjectIntegrationModelSerializer
+
+WRITE_ONLY_PLACEHOLDER = "write-only"
+
+
+class AzureDevOpsConfigurationSerializer(BaseProjectIntegrationModelSerializer):
+    class Meta:
+        model = AzureDevOpsConfiguration
+        fields = (
+            "id",
+            "organisation_url",
+            "personal_access_token",
+            "labeling_enabled",
+            "tagging_enabled",
+        )
+
+    def to_representation(self, instance: AzureDevOpsConfiguration) -> dict[str, Any]:
+        data = super().to_representation(instance)
+        data["personal_access_token"] = WRITE_ONLY_PLACEHOLDER
+        return data

api/integrations/azure_devops/views/__init__.py

@@ -0,0 +1,5 @@
+from integrations.azure_devops.views.configuration import (
+    AzureDevOpsConfigurationViewSet,
+)
+
+__all__ = ["AzureDevOpsConfigurationViewSet"]

api/integrations/azure_devops/views/configuration.py

@@ -0,0 +1,43 @@
+import structlog
+from structlog.typing import FilteringBoundLogger
+
+from integrations.azure_devops.models import AzureDevOpsConfiguration
+from integrations.azure_devops.serializers import (
+    AzureDevOpsConfigurationSerializer,
+)
+from integrations.common.views import ProjectIntegrationBaseViewSet
+
+logger = structlog.get_logger("azure_devops")
+
+
+class AzureDevOpsConfigurationViewSet(ProjectIntegrationBaseViewSet):
+    serializer_class = AzureDevOpsConfigurationSerializer  # type: ignore[assignment]
+    model_class = AzureDevOpsConfiguration  # type: ignore[assignment]
+    pagination_class = None
+
+    def _log_for(self, config: AzureDevOpsConfiguration) -> FilteringBoundLogger:
+        return logger.bind(  # type: ignore[no-any-return]
+            organisation__id=config.project.organisation_id,
+            project__id=config.project.id,
+        )
+
+    def perform_create(self, serializer: AzureDevOpsConfigurationSerializer) -> None:  # type: ignore[override]
+        super().perform_create(serializer)
+        instance: AzureDevOpsConfiguration = serializer.instance  # type: ignore[assignment]
+        self._log_for(instance).info(
+            "configuration.created",
+            ado__organisation__url=instance.organisation_url,
+        )
+
+    def perform_update(self, serializer: AzureDevOpsConfigurationSerializer) -> None:  # type: ignore[override]
+        super().perform_update(serializer)
+        instance: AzureDevOpsConfiguration = serializer.instance  # type: ignore[assignment]
+        self._log_for(instance).info(
+            "configuration.updated",
+            ado__organisation__url=instance.organisation_url,
+        )
+
+    def perform_destroy(self, instance: AzureDevOpsConfiguration) -> None:
+        log = self._log_for(instance)
+        super().perform_destroy(instance)
+        log.info("configuration.deleted")

api/projects/urls.py

@@ -18,6 +18,7 @@
 )
 from features.multivariate.views import MultivariateFeatureOptionViewSet
 from features.views import FeatureViewSet
+from integrations.azure_devops.views import AzureDevOpsConfigurationViewSet
 from integrations.datadog.views import DataDogConfigurationViewSet
 from integrations.gitlab.views import (
     BrowseGitLabIssues,
@@ -76,6 +77,11 @@
     GitLabConfigurationViewSet,
     basename="integrations-gitlab",
 )
+projects_router.register(
+    r"integrations/azure-devops",
+    AzureDevOpsConfigurationViewSet,
+    basename="integrations-azure-devops",
+)
 projects_router.register(
     r"integrations/grafana",
     GrafanaProjectConfigurationViewSet,

api/tests/unit/integrations/azure_devops/conftest.py

@@ -0,0 +1,13 @@
+import pytest
+
+from integrations.azure_devops.models import AzureDevOpsConfiguration
+from projects.models import Project
+
+
+@pytest.fixture()
+def azure_devops_configuration(project: Project) -> AzureDevOpsConfiguration:
+    return AzureDevOpsConfiguration.objects.create(  # type: ignore[no-any-return]
+        project=project,
+        organisation_url="https://dev.azure.com/test-org",
+        personal_access_token="ado-test-token",
+    )

api/tests/unit/integrations/azure_devops/test_apps.py

@@ -0,0 +1,12 @@
+from django.apps import apps
+
+
+def test_azure_devops_app__django_registry__contains_config() -> None:
+    # Given
+    app_label = "azure_devops"
+
+    # When
+    config = apps.get_app_config(app_label)
+
+    # Then
+    assert config.name == "integrations.azure_devops"