pact_broker 2.77.0 → 2.80.0

data/lib/pact_broker/api/resources/authentication.rb

@@ -1,4 +1,4 @@
-require 'webmachine/resource/authentication'
+require "webmachine/resource/authentication"
 
 module PactBroker
   module Api

data/lib/pact_broker/api/resources/authorization.rb

@@ -0,0 +1,37 @@
+module PactBroker
+  module Api
+    module Resources
+      module Authorization
+        def action
+          if read_methods.include?(request.method)
+            :read
+          elsif update_methods.include?(request.method)
+            :update
+          elsif create_methods.include?(request.method)
+            :create
+          elsif delete_methods.include?(request.method)
+            :delete
+          else
+            raise "Cannot map #{request.method} to an action"
+          end
+        end
+
+        def read_methods
+          %w{GET HEAD OPTIONS}
+        end
+
+        def update_methods
+          %w{PUT PATCH}
+        end
+
+        def create_methods
+          %w{POST PUT}
+        end
+
+        def delete_methods
+          %w{DELETE}
+        end
+      end
+    end
+  end
+end

data/lib/pact_broker/api/resources/badge.rb

@@ -1,6 +1,6 @@
-require 'pact_broker/api/resources/base_resource'
-require 'pact_broker/verifications/pseudo_branch_status'
-require 'pact_broker/configuration'
+require "pact_broker/api/resources/base_resource"
+require "pact_broker/verifications/pseudo_branch_status"
+require "pact_broker/configuration"
 
 module PactBroker
   module Api
@@ -12,7 +12,7 @@ module PactBroker
         end
 
         def content_types_provided
-          [['image/svg+xml', :to_svg]]
+          [["image/svg+xml", :to_svg]]
         end
 
         def resource_exists?
@@ -33,12 +33,12 @@ module PactBroker
         end
 
         def to_svg
-          response.headers['Cache-Control'] = 'no-cache'
+          response.headers["Cache-Control"] = "no-cache"
           comment + badge_service.pact_verification_badge(pact, label, initials, pseudo_branch_verification_status, tags)
         end
 
         def moved_temporarily?
-          response.headers['Cache-Control'] = 'no-cache'
+          response.headers["Cache-Control"] = "no-cache"
           badge_service.pact_verification_badge_url(pact, label, initials, pseudo_branch_verification_status, tags)
         end
 
@@ -62,11 +62,11 @@ module PactBroker
         end
 
         def label
-          request.query['label']
+          request.query["label"]
         end
 
         def initials
-          request.query['initials'] == 'true'
+          request.query["initials"] == "true"
         end
 
         def comment

data/lib/pact_broker/api/resources/base_resource.rb

@@ -1,4 +1,4 @@
-require 'pact_broker/configuration'
+require "pact_broker/configuration"
 
 module PactBroker
   module Api

data/lib/pact_broker/api/resources/can_i_deploy.rb

@@ -1,7 +1,7 @@
-require 'pact_broker/api/resources/matrix'
-require 'pact_broker/matrix/can_i_deploy_query_schema'
-require 'pact_broker/matrix/parse_can_i_deploy_query'
-require 'pact_broker/messages'
+require "pact_broker/api/resources/matrix"
+require "pact_broker/matrix/can_i_deploy_query_schema"
+require "pact_broker/matrix/parse_can_i_deploy_query"
+require "pact_broker/messages"
 
 module PactBroker
   module Api
@@ -9,18 +9,12 @@ module PactBroker
       class CanIDeploy < Matrix
         include PactBroker::Messages
 
-        def initialize
-          super
-          @query_params = JSON.parse(Rack::Utils.parse_nested_query(request.uri.query).to_json, symbolize_names: true)
-          @selectors, @options = PactBroker::Matrix::ParseCanIDeployQuery.call(query_params)
-        end
-
         def malformed_request?
           if (errors = query_schema.call(query_params)).any?
             set_json_validation_error_messages(errors)
             true
           elsif !pacticipant
-            set_json_validation_error_messages(pacticipant: [message('errors.validation.pacticipant_not_found', name: pacticipant_name)])
+            set_json_validation_error_messages(pacticipant: [message("errors.validation.pacticipant_not_found", name: pacticipant_name)])
             true
           else
             false
@@ -33,8 +27,6 @@ module PactBroker
 
         private
 
-        attr_reader :query_params, :selectors, :options
-
         def query_schema
           PactBroker::Api::Contracts::CanIDeployQuerySchema
         end
@@ -46,6 +38,14 @@ module PactBroker
         def pacticipant_name
           selectors.first.pacticipant_name
         end
+
+        def parsed_query
+          @parsed_query ||= PactBroker::Matrix::ParseCanIDeployQuery.call(query_params)
+        end
+
+        def query_params
+          @query_params ||= JSON.parse(Rack::Utils.parse_nested_query(request.uri.query).to_json, symbolize_names: true)
+        end
       end
     end
   end

data/lib/pact_broker/api/resources/can_i_deploy_badge.rb

@@ -1,5 +1,5 @@
-require 'pact_broker/matrix/can_i_deploy_query_schema'
-require 'pact_broker/matrix/parse_can_i_deploy_query'
+require "pact_broker/matrix/can_i_deploy_query_schema"
+require "pact_broker/matrix/parse_can_i_deploy_query"
 
 module PactBroker
   module Api
@@ -9,7 +9,7 @@ module PactBroker
           super
           selector = PactBroker::Matrix::UnresolvedSelector.new(pacticipant_name: pacticipant_name, latest: true, tag: identifier_from_path[:tag])
           @options = {
-            latestby: 'cvp',
+            latestby: "cvp",
             latest: true,
             tag: identifier_from_path[:to]
           }
@@ -21,7 +21,7 @@ module PactBroker
         end
 
         def content_types_provided
-          [['image/svg+xml', :to_svg]]
+          [["image/svg+xml", :to_svg]]
         end
 
         def resource_exists?
@@ -42,7 +42,7 @@ module PactBroker
         end
 
         def moved_temporarily?
-          response.headers['Cache-Control'] = 'no-cache'
+          response.headers["Cache-Control"] = "no-cache"
           begin
             if pacticipant
               if version
@@ -68,7 +68,7 @@ module PactBroker
         attr_reader :selectors, :options
 
         def results
-          @results ||= matrix_service.find(selectors, options)
+          @results ||= matrix_service.can_i_deploy(selectors, options)
         end
 
         def version
@@ -76,7 +76,7 @@ module PactBroker
         end
 
         def label
-          lab = request.query['label']
+          lab = request.query["label"]
           lab && !lab.empty? ? lab : nil
         end
       end

data/lib/pact_broker/api/resources/can_i_deploy_pacticipant_version.rb

@@ -1,22 +1,11 @@
-require 'pact_broker/api/resources/matrix'
-require 'pact_broker/matrix/can_i_deploy_query_schema'
-require 'pact_broker/matrix/parse_can_i_deploy_query'
+require "pact_broker/api/resources/matrix"
+require "pact_broker/matrix/can_i_deploy_query_schema"
+require "pact_broker/matrix/parse_can_i_deploy_query"
 
 module PactBroker
   module Api
     module Resources
       class CanIDeployPacticipantVersion < Matrix
-        def initialize
-          super
-          selector = PactBroker::Matrix::UnresolvedSelector.new(pacticipant_name: pacticipant_name, latest: true, tag: identifier_from_path[:tag])
-          @options = {
-            latestby: 'cvp',
-            latest: true,
-            tag: identifier_from_path[:to]
-          }
-          @selectors = [selector]
-        end
-
         def resource_exists?
           !!version
         end
@@ -27,12 +16,28 @@ module PactBroker
 
         private
 
-        def version
-          @version ||= version_service.find_by_pacticipant_name_and_latest_tag(identifier_from_path[:pacticipant_name], identifier_from_path[:tag])
+        def selectors
+          @selectors ||= begin
+            [
+              PactBroker::Matrix::UnresolvedSelector.new(
+                pacticipant_name: pacticipant_name,
+                latest: true,
+                tag: identifier_from_path[:tag]
+              )
+            ]
+          end
         end
 
-        def results
-          @results ||= matrix_service.find(selectors, options)
+        def options
+          @options ||= {
+            latestby: "cvp",
+            latest: true,
+            tag: identifier_from_path[:to]
+          }
+        end
+
+        def version
+          @version ||= version_service.find_by_pacticipant_name_and_latest_tag(identifier_from_path[:pacticipant_name], identifier_from_path[:tag])
         end
       end
     end

data/lib/pact_broker/api/resources/clean.rb

@@ -1,6 +1,6 @@
-require 'pact_broker/api/resources/base_resource'
-require 'pact_broker/db/clean'
-require 'pact_broker/matrix/unresolved_selector'
+require "pact_broker/api/resources/base_resource"
+require "pact_broker/db/clean"
+require "pact_broker/matrix/unresolved_selector"
 
 module PactBroker
   module Api

data/lib/pact_broker/api/resources/currently_deployed_versions_for_environment.rb

@@ -0,0 +1,75 @@
+require "pact_broker/api/resources/base_resource"
+require "pact_broker/api/decorators/versions_decorator"
+require "pact_broker/string_refinements"
+
+module PactBroker
+  module Api
+    module Resources
+      class CurrentlyDeployedVersionsForEnvironment < BaseResource
+        using PactBroker::StringRefinements
+
+        def content_types_accepted
+          [["application/json", :from_json]]
+        end
+
+        def content_types_provided
+          [["application/hal+json", :to_json]]
+        end
+
+        def allowed_methods
+          ["GET", "OPTIONS"]
+        end
+
+        def resource_exists?
+          !!environment
+        end
+
+        def to_json
+          decorator_class(decorator_name).new(deployed_versions).to_json(decorator_options(title: title))
+        end
+
+        def policy_name
+          :'deployments::environment'
+        end
+
+        def policy_record
+          environment
+        end
+
+        def decorator_name
+          :deployed_versions_decorator
+        end
+
+        private
+
+        def environment
+          @environment ||= environment_service.find(environment_uuid)
+        end
+
+        def deployed_versions
+          @deployed_versions ||= deployed_version_service.find_currently_deployed_versions_for_environment(environment, query_params)
+        end
+
+        def environment_uuid
+          identifier_from_path[:environment_uuid]
+        end
+
+        def query_params
+          # Webmachine request.query drops parameters with blank values, and we need to know if
+          # a blank target was specified.
+          query = Rack::Utils.parse_query(request.env["QUERY_STRING"])
+          q = {}
+          q[:pacticipant_name] = request.query["pacticipant"] if query["pacticipant"]
+          if query["target"]
+            q[:target] = query["target"].blank? ? nil : query["target"]
+          end
+          q
+        end
+
+        def title
+          "Currently deployed versions for #{environment.display_name}"
+        end
+      end
+    end
+  end
+end

data/lib/pact_broker/api/resources/currently_supported_versions_for_environment.rb

@@ -0,0 +1,70 @@
+require "pact_broker/api/resources/base_resource"
+require "pact_broker/api/decorators/versions_decorator"
+require "pact_broker/string_refinements"
+
+module PactBroker
+  module Api
+    module Resources
+      class CurrentlySupportedVersionsForEnvironment < BaseResource
+        using PactBroker::StringRefinements
+
+        def content_types_accepted
+          [["application/json", :from_json]]
+        end
+
+        def content_types_provided
+          [["application/hal+json", :to_json]]
+        end
+
+        def allowed_methods
+          ["GET", "OPTIONS"]
+        end
+
+        def resource_exists?
+          !!environment
+        end
+
+        def to_json
+          decorator_class(decorator_name).new(released_versions).to_json(decorator_options(title: title))
+        end
+
+        def policy_name
+          :'deployments::environment'
+        end
+
+        def policy_record
+          environment
+        end
+
+        def decorator_name
+          :released_versions_decorator
+        end
+
+        private
+
+        def environment
+          @environment ||= environment_service.find(environment_uuid)
+        end
+
+        def released_versions
+          @released_versions ||= released_version_service.find_currently_supported_versions_for_environment(environment, query_params)
+        end
+
+        def environment_uuid
+          identifier_from_path[:environment_uuid]
+        end
+
+        def query_params
+          {
+            pacticipant_name: request.query["pacticipant"],
+            pacticipant_version_number: request.query["version"]
+          }.compact
+        end
+
+        def title
+          "Currently supported versions in #{environment.display_name}"
+        end
+      end
+    end
+  end
+end

data/lib/pact_broker/api/resources/dashboard.rb

@@ -1,6 +1,6 @@
-require 'pact_broker/api/resources/base_resource'
-require 'pact_broker/api/decorators/dashboard_decorator'
-require 'pact_broker/api/decorators/dashboard_text_decorator'
+require "pact_broker/api/resources/base_resource"
+require "pact_broker/api/decorators/dashboard_decorator"
+require "pact_broker/api/decorators/dashboard_text_decorator"
 
 module PactBroker
   module Api

data/lib/pact_broker/api/resources/default_base_resource.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
-require 'webmachine'
-require 'pact_broker/services'
-require 'pact_broker/api/decorators'
-require 'pact_broker/logging'
-require 'pact_broker/api/pact_broker_urls'
-require 'pact_broker/json'
-require 'pact_broker/pacts/pact_params'
-require 'pact_broker/api/resources/authentication'
-require 'pact_broker/errors'
+require "webmachine"
+require "pact_broker/services"
+require "pact_broker/api/decorators"
+require "pact_broker/logging"
+require "pact_broker/api/pact_broker_urls"
+require "pact_broker/json"
+require "pact_broker/pacts/pact_params"
+require "pact_broker/api/resources/authentication"
+require "pact_broker/api/resources/authorization"
+require "pact_broker/errors"
 
 module PactBroker
   module Api
@@ -18,6 +19,8 @@ module PactBroker
         include PactBroker::Services
         include PactBroker::Api::PactBrokerUrls
         include PactBroker::Api::Resources::Authentication
+        include PactBroker::Api::Resources::Authorization
+
         include PactBroker::Logging
 
         attr_accessor :user
@@ -28,11 +31,11 @@ module PactBroker
         end
 
         def options
-          { 'Access-Control-Allow-Methods' => allowed_methods.join(", ")}
+          { "Access-Control-Allow-Methods" => allowed_methods.join(", ")}
         end
 
         def known_methods
-          super + ['PATCH']
+          super + ["PATCH"]
         end
 
         def finish_request
@@ -68,12 +71,17 @@ module PactBroker
         alias_method :path_info, :identifier_from_path
 
         def base_url
-          request.env["pactbroker.base_url"] || request.base_uri.to_s.chomp('/')
+          # Have to use something for the base URL here - we can't use an empty string as we can in the UI.
+          # Can't work out if cache poisoning is a vulnerability for APIs or not.
+          # Using the request base URI as a fallback if the base_url is not configured may be a vulnerability,
+          # but the documentation recommends that the
+          # base_url should be set in the configuration to mitigate this.
+          request.env["pactbroker.base_url"] || request.base_uri.to_s.chomp("/")
         end
 
         # See comments for base_url in lib/pact_broker/doc/controllers/app.rb
         def ui_base_url
-          request.env["pactbroker.base_url"] || ''
+          request.env["pactbroker.base_url"] || ""
         end
 
         def charsets_provided
@@ -86,7 +94,7 @@ module PactBroker
         end
 
         def resource_url
-          request.uri.to_s.gsub(/\?.*/, '').chomp('/')
+          request.uri.to_s.gsub(/\?.*/, "").chomp("/")
         end
 
         def decorator_context options = {}
@@ -99,13 +107,14 @@ module PactBroker
 
         def handle_exception(error)
           error_reference = PactBroker::Errors.generate_error_reference
-          application_context.error_logger.call(error, error_reference, request)
+          application_context.error_logger.call(error, error_reference, request.env)
           if PactBroker::Errors.reportable_error?(error)
-            PactBroker::Errors.report(error, error_reference, request)
+            PactBroker::Errors.report(error, error_reference, request.env)
           end
-          response.body = application_context.error_response_body_generator.call(error, error_reference, request)
+          response.body = application_context.error_response_body_generator.call(error, error_reference, request.env)
         end
 
+        # rubocop: disable Metrics/CyclomaticComplexity
         def params(options = {})
           return options[:default] if options.key?(:default) && request_body.empty?
 
@@ -118,6 +127,7 @@ module PactBroker
         rescue JSON::JSONError => e
           raise InvalidJsonError.new("Error parsing JSON - #{e.message}")
         end
+        # rubocop: enable Metrics/CyclomaticComplexity
 
         def params_with_string_keys
           params(symbolize_names: false)
@@ -128,12 +138,12 @@ module PactBroker
         end
 
         def set_json_error_message message
-          response.headers['Content-Type'] = 'application/hal+json;charset=utf-8'
+          response.headers["Content-Type"] = "application/hal+json;charset=utf-8"
           response.body = { error: message }.to_json
         end
 
         def set_json_validation_error_messages errors
-          response.headers['Content-Type'] = 'application/hal+json;charset=utf-8'
+          response.headers["Content-Type"] = "application/hal+json;charset=utf-8"
           response.body = { errors: errors }.to_json
         end
 
@@ -180,7 +190,7 @@ module PactBroker
           rescue StandardError => e
             logger.info "Error parsing JSON #{e} - #{request_body}"
             set_json_error_message "Error parsing JSON - #{e.message}"
-            response.headers['Content-Type'] = 'application/hal+json;charset=utf-8'
+            response.headers["Content-Type"] = "application/hal+json;charset=utf-8"
             true
           end
         end
@@ -243,6 +253,23 @@ module PactBroker
         def decorator_class(name)
           application_context.decorator_configuration.class_for(name)
         end
+
+        def schema
+          nil
+        end
+
+        def validation_errors_for_schema?(schema_to_use = schema, params_to_validate = params)
+          if (errors = schema_to_use.call(params_to_validate)).any?
+            set_json_validation_error_messages(errors)
+            true
+          else
+            false
+          end
+        end
+
+        def malformed_request_for_json_with_schema?(schema_to_use = schema, params_to_validate = params)
+          invalid_json? || validation_errors_for_schema?(schema_to_use, params_to_validate)
+        end
       end
     end
   end