screwdriver-api 4.1.203 → 4.1.207

package/Dockerfile.local

@@ -1,4 +1,4 @@
-FROM node:8
+FROM node:12
 
 # Create our application directory
 RUN mkdir -p /usr/src/app

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "4.1.203",
+  "version": "4.1.207",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {
@@ -23,7 +23,7 @@
     "url": "git@github.com:screwdriver-cd/screwdriver.git"
   },
   "engines": {
-    "node": ">=8.9.0"
+    "node": ">=12.0.0"
   },
   "greenkeeper": {
     "ignore": [

package/plugins/builds/artifacts/unzip.js

@@ -14,7 +14,7 @@ module.exports = config => ({
         tags: ['api', 'builds', 'artifacts'],
         auth: {
             strategies: ['token'],
-            scope: ['build']
+            scope: ['user', 'build']
         },
 
         handler: async (req, h) => {
@@ -26,9 +26,15 @@ module.exports = config => ({
                 return h.response(data).code(200);
             }
             const buildId = req.params.id;
-            const { username, scope } = req.auth.credentials;
+            const { username, scope, scmContext } = req.auth.credentials;
             const isBuild = scope.includes('build');
             const { buildFactory } = req.server.app;
+            const scmDisplayName = buildFactory.scm.getDisplayName({ scmContext })
+            const adminDetails = req.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+
+            if (scope.includes('user') && !adminDetails.isAdmin) {
+                return boom.forbidden(`User ${adminDetails.userDisplayName} does not have Screwdriver administrative privileges.`)
+            }
 
             if (isBuild && username !== buildId) {
                 return boom.forbidden(`Credential only valid for ${username}`);

package/plugins/builds/index.js

@@ -410,11 +410,6 @@ function parseJobInfo({ joinObj = {}, current, nextJobName, nextPipelineId }) {
  * @return {Promise}                            All finished builds
  */
 async function getFinishedBuilds(event, buildFactory) {
-    if (!event.parentEventId) {
-        // FIXME: remove this flow to always use buildFactory.getLatestBuilds
-        return event.getBuilds();
-    }
-
     // FIXME: buildFactory.getLatestBuilds doesn't return build model
     const builds = await buildFactory.getLatestBuilds({ groupEventId: event.groupEventId });