screwdriver-api 6.0.28 → 6.0.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "6.0.28",
+  "version": "6.0.30",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {
@@ -12,7 +12,7 @@
     "profile": "node --prof ./bin/server",
     "functional": "cucumber-js --format=progress --tags '(not @ignore) and (not @beta)' --retry 2 --fail-fast --exit",
     "functional-beta": "cucumber-js --format=progress --tags '(not @ignore) and (not @prod)' --retry 2 --fail-fast --exit",
-    "functional-dev": "cucumber-js --format=./node_modules/cucumber-pretty --tags '(not @ignore) and (not @prod)' --retry 2 --fail-fast --exit",
+    "functional-dev": "cucumber-js --format=progress --tags '(not @ignore) and (not @prod)' --retry 2 --fail-fast --exit",
     "create-test-user": "node -e 'require(\"./features/scripts/create-test-user.js\")()'",
     "diagrams": "find ./design/diagrams -type f -name \\*.puml -print0 | xargs -0 -n 1 -I DIAGRAM puml generate DIAGRAM -o DIAGRAM.png",
     "semantic-release": "semantic-release pre && npm publish && semantic-release post"
@@ -138,13 +138,12 @@
     }
   },
   "devDependencies": {
+    "@cucumber/cucumber": "^9.0.0",
     "@octokit/rest": "^19.0.5",
     "chai": "^4.3.7",
     "chai-as-promised": "^7.1.1",
     "chai-jwt": "^2.0.0",
     "coveralls": "^3.1.1",
-    "cucumber": "^6.0.7",
-    "cucumber-pretty": "^6.0.1",
     "eslint": "^8.28.0",
     "eslint-config-screwdriver": "^7.0.0",
     "form-data": "^4.0.0",

package/plugins/auth/index.js

@@ -107,7 +107,7 @@ const authPlugin = {
          */
         server.expose('generateProfile', config => {
             const { username, scmUserId, scmContext, scope, metadata } = config;
-            const profile = { username, scmContext, scope, ...(metadata || {}) };
+            const profile = { username, scmContext, scmUserId, scope, ...(metadata || {}) };
 
             if (pluginOptions.jwtEnvironment) {
                 profile.environment = pluginOptions.jwtEnvironment;
@@ -190,6 +190,7 @@ const authPlugin = {
                 try {
                     const { tokenFactory, userFactory, pipelineFactory, collectionFactory } = request.server.app;
                     const token = await tokenFactory.get({ value: tokenValue });
+                    const { scm } = pipelineFactory;
 
                     if (!token) {
                         return { isValid: false, credentials: {} };
@@ -204,10 +205,28 @@ const authPlugin = {
                             return { isValid: false, credentials: {} };
                         }
 
+                        let scmUser = {};
+
+                        try {
+                            scmUser = await scm.decorateAuthor({
+                                username: user.username,
+                                scmContext: user.scmContext,
+                                token: await user.unsealToken()
+                            });
+                        } catch (err) {
+                            request.log(
+                                ['auth', 'error'],
+                                `Fails to find the user "${user.username}" in ${user.scmContext}.`
+                            );
+
+                            return { isValid: false, credentials: {} };
+                        }
+
                         await createDefaultCollection(user, collectionFactory);
 
                         profile = {
                             username: user.username,
+                            scmUserId: scmUser.id,
                             scmContext: user.scmContext,
                             scope: ['user']
                         };

package/plugins/banners/create.js

@@ -18,13 +18,16 @@ module.exports = () => ({
 
         handler: async (request, h) => {
             const { bannerFactory } = request.server.app;
-            const { username } = request.auth.credentials;
-            const { scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
             const { scm } = bannerFactory;
             const scmDisplayName = scm.getDisplayName({ scmContext });
 
             // lookup whether user is admin
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmDisplayName,
+                scmUserId
+            );
 
             // verify user is authorized to create banners
             // return unauthorized if not system admin

package/plugins/banners/index.js

@@ -23,21 +23,20 @@ const bannerPlugin = {
          * @param  {String}        scmDisplayName Scm display name of the person
          * @return {Object}                   Details including the display name and admin status of user
          */
-        server.expose('screwdriverAdminDetails', (username, scmDisplayName) => {
+        server.expose('screwdriverAdminDetails', (username, scmDisplayName, scmUserId) => {
             // construct object with defaults to store details
             const adminDetails = {
                 isAdmin: false
             };
 
             if (scmDisplayName) {
-                const adminsList = options.admins;
+                const userDisplayName = options.authCheckById
+                    ? `${scmDisplayName}:${username}:${scmUserId}`
+                    : `${scmDisplayName}:${username}`;
+                const admins = options.authCheckById ? options.sdAdmins : options.admins;
 
-                // construct displayable username string
-                adminDetails.userDisplayName = `${scmDisplayName}:${username}`;
-
-                // Check system configuration for list of system admins
-                // set admin status true if current user is identified to be a system admin
-                if (adminsList.length > 0 && adminsList.includes(adminDetails.userDisplayName)) {
+                // Check admin
+                if (admins.length > 0 && admins.includes(userDisplayName)) {
                     adminDetails.isAdmin = true;
                 }
             }

package/plugins/banners/remove.js

@@ -20,14 +20,16 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { bannerFactory } = request.server.app;
             const { id } = request.params; // id of banner to delete
-
-            const { username } = request.auth.credentials;
-            const { scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
             const { scm } = bannerFactory;
             const scmDisplayName = scm.getDisplayName({ scmContext });
 
             // lookup whether user is admin
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmDisplayName,
+                scmUserId
+            );
 
             // verify user is authorized to remove banners
             // return unauthorized if not system admin

package/plugins/banners/update.js

@@ -20,13 +20,16 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { bannerFactory } = request.server.app;
             const { id } = request.params; // id of banner to update
-            const { username } = request.auth.credentials;
-            const { scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
             const { scm } = bannerFactory;
             const scmDisplayName = scm.getDisplayName({ scmContext });
 
             // lookup whether user is admin
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmDisplayName,
+                scmUserId
+            );
 
             // verify user is authorized to update banners
             // return unauthorized if not system admin

package/plugins/buildClusters/create.js

@@ -18,7 +18,7 @@ module.exports = () => ({
 
         handler: async (request, h) => {
             const { buildClusterFactory, bannerFactory } = request.server.app;
-            const { username, scmContext: userContext } = request.auth.credentials;
+            const { username, scmContext: userContext, scmUserId } = request.auth.credentials;
             const { payload } = request;
             const { managedByScrewdriver, name, scmOrganizations } = payload;
 
@@ -27,7 +27,11 @@ module.exports = () => ({
             // Check permissions
             // Must be Screwdriver admin to add Screwdriver build cluster
             const scmDisplayName = bannerFactory.scm.getDisplayName({ scmContext: payload.scmContext });
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmDisplayName,
+                scmUserId
+            );
 
             if (!adminDetails.isAdmin) {
                 return boom.forbidden(

package/plugins/buildClusters/remove.js

@@ -20,7 +20,7 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { buildClusterFactory, userFactory, bannerFactory } = request.server.app;
             const { name } = request.params;
-            const { username, scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
             const scmDisplayName = bannerFactory.scm.getDisplayName({ scmContext });
 
             // Fetch the buildCluster and user models
@@ -46,7 +46,8 @@ module.exports = () => ({
 
                     const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
                         username,
-                        scmDisplayName
+                        scmDisplayName,
+                        scmUserId
                     );
 
                     if (!adminDetails.isAdmin) {

package/plugins/buildClusters/update.js

@@ -20,7 +20,7 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { buildClusterFactory, bannerFactory } = request.server.app;
             const { name } = request.params; // name of build cluster to update
-            const { username, scmContext: userContext } = request.auth.credentials;
+            const { username, scmContext: userContext, scmUserId } = request.auth.credentials;
             const { payload } = request;
             const { managedByScrewdriver, scmOrganizations } = payload;
 
@@ -29,7 +29,11 @@ module.exports = () => ({
             // Check permissions
             // Must be Screwdriver admin to update Screwdriver build cluster
             const scmDisplayName = bannerFactory.scm.getDisplayName({ scmContext: userContext });
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmDisplayName,
+                scmUserId
+            );
 
             if (!adminDetails.isAdmin) {
                 return boom.forbidden(

package/plugins/builds/artifacts/unzip.js

@@ -26,11 +26,11 @@ module.exports = config => ({
                 return h.response(data).code(200);
             }
             const buildId = req.params.id;
-            const { username, scope, scmContext } = req.auth.credentials;
+            const { username, scope, scmContext, scmUserId } = req.auth.credentials;
             const isBuild = scope.includes('build');
             const { buildFactory } = req.server.app;
             const scmDisplayName = buildFactory.scm.getDisplayName({ scmContext })
-            const adminDetails = req.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+            const adminDetails = req.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName, scmUserId);
 
             if (scope.includes('user') && !adminDetails.isAdmin) {
                 return boom.forbidden(`User ${adminDetails.userDisplayName} does not have Screwdriver administrative privileges.`)

package/plugins/builds/update.js

@@ -93,13 +93,13 @@ async function getBuildToUpdate(id, buildFactory) {
  */
 async function validateUserPermission(build, request) {
     const { jobFactory, userFactory, bannerFactory, pipelineFactory } = request.server.app;
-    const { username, scmContext } = request.auth.credentials;
+    const { username, scmContext, scmUserId } = request.auth.credentials;
 
     const { status: desiredStatus } = request.payload;
 
     const scmDisplayName = bannerFactory.scm.getDisplayName({ scmContext });
     // Check if Screwdriver admin
-    const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+    const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName, scmUserId);
 
     // Check desired status
     if (adminDetails.isAdmin) {

package/plugins/events/stopBuilds.js

@@ -22,7 +22,7 @@ module.exports = () => ({
 
         handler: async (request, h) => {
             const { eventFactory, pipelineFactory, userFactory } = request.server.app;
-            const { username, scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
             const { isValidToken } = request.server.plugins.pipelines;
             const eventId = request.params.id;
             const { updateAdmins } = request.server.plugins.events;
@@ -47,7 +47,11 @@ module.exports = () => ({
 
             // Check permissions
             const permissions = await user.getPermissions(pipeline.scmUri);
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmContext);
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmContext,
+                scmUserId
+            );
             const isPrOwner = hoek.reach(event, 'commit.author.username') === username;
 
             // PR author should be able to stop their own PR event

package/plugins/pipelines/index.js

@@ -104,7 +104,7 @@ const pipelinesPlugin = {
          * @return {Object} pipeline
          */
         server.expose('canAccessPipeline', (credentials, pipelineId, permission, app) => {
-            const { username, scmContext, scope } = credentials;
+            const { username, scmContext, scope, scmUserId } = credentials;
             const { userFactory, pipelineFactory } = app;
 
             return pipelineFactory.get(pipelineId).then(pipeline => {
@@ -141,7 +141,8 @@ const pipelinesPlugin = {
                                 const scmDisplayName = pipelineFactory.scm.getDisplayName({ scmContext });
                                 const adminDetails = server.plugins.banners.screwdriverAdminDetails(
                                     username,
-                                    scmDisplayName
+                                    scmDisplayName,
+                                    scmUserId
                                 );
 
                                 if (adminDetails.isAdmin) {

package/plugins/pipelines/list.js

@@ -81,13 +81,17 @@ module.exports = () => ({
             return Promise.all(pipelineArray)
                 .then(pipelineArrays => [].concat(...pipelineArrays))
                 .then(allPipelines => {
-                    const { username, scope, scmContext } = request.auth.credentials;
+                    const { username, scope, scmContext, scmUserId } = request.auth.credentials;
                     let adminDetails;
 
                     if (scmContext) {
                         const scmDisplayName = pipelineFactory.scm.getDisplayName({ scmContext });
 
-                        adminDetails = request.server.plugins.banners.screwdriverAdminDetails(username, scmDisplayName);
+                        adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                            username,
+                            scmDisplayName,
+                            scmUserId
+                        );
                     }
 
                     if (scope.includes('user') && adminDetails && adminDetails.isAdmin) {

package/plugins/pipelines/remove.js

@@ -21,8 +21,7 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { pipelineFactory, bannerFactory } = request.server.app;
             const { userFactory } = request.server.app;
-            const { username } = request.auth.credentials;
-            const { scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
 
             // Fetch the pipeline and user models
             return Promise.all([pipelineFactory.get(request.params.id), userFactory.get({ username, scmContext })])
@@ -57,7 +56,8 @@ module.exports = () => ({
                                 // Lookup whether user is admin
                                 const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
                                     username,
-                                    scmDisplayName
+                                    scmDisplayName,
+                                    scmUserId
                                 );
 
                                 // Allow cluster admins to remove pipeline