screwdriver-api 8.0.116 → 8.0.117

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.116",
+  "version": "8.0.117",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/events/stopBuilds.js

@@ -49,21 +49,24 @@ module.exports = () => ({
 
             // Check permissions
             let permissions;
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmContext,
+                scmUserId
+            );
 
             try {
                 permissions = await user.getPermissions(pipeline.scmUri);
             } catch (err) {
-                if (err.statusCode === 403 && pipeline.scmRepo && pipeline.scmRepo.private) {
-                    throw boom.notFound();
+                // Screwdriver admin can stop all events
+                if (!adminDetails.isAdmin) {
+                    if (err.statusCode === 403 && pipeline.scmRepo && pipeline.scmRepo.private) {
+                        throw boom.notFound();
+                    }
+                    throw boom.boomify(err, { statusCode: err.statusCode });
                 }
-                throw boom.boomify(err, { statusCode: err.statusCode });
             }
 
-            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
-                username,
-                scmContext,
-                scmUserId
-            );
             const isPrOwner = hoek.reach(event, 'commit.author.username') === username;
 
             // PR author should be able to stop their own PR event

package/plugins/helper.js

@@ -48,13 +48,17 @@ async function getUserPermissions({ user, scmUri, level = 'admin', isAdmin = fal
     // Check if user has push access or is a Screwdriver admin
     let permissions;
 
+    if (isAdmin) {
+        return null;
+    }
+
     try {
         permissions = await user.getPermissions(scmUri);
     } catch (err) {
         permissions = null;
     }
 
-    if (!permissions || (!permissions[level] && !isAdmin)) {
+    if (!permissions || !permissions[level]) {
         throw boom.forbidden(`User ${user.getFullDisplayName()} does not have ${level} permission for this repo`);
     }
 

package/plugins/jobs/update.js

@@ -21,7 +21,7 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { jobFactory, pipelineFactory, userFactory } = request.server.app;
             const { id } = request.params;
-            const { username, scmContext } = request.auth.credentials;
+            const { username, scmContext, scmUserId } = request.auth.credentials;
             const { isValidToken } = request.server.plugins.pipelines;
 
             const job = await jobFactory.get(id);
@@ -51,7 +51,13 @@ module.exports = () => ({
             const scmUri = await getScmUri({ pipeline, pipelineFactory });
 
             // Check the user's permission
-            await getUserPermissions({ user, scmUri, level: 'push' });
+            const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                username,
+                scmContext,
+                scmUserId
+            );
+
+            await getUserPermissions({ user, scmUri, level: 'push', isAdmin: adminDetails.isAdmin });
 
             Object.keys(request.payload).forEach(key => {
                 job[key] = request.payload[key];

package/plugins/pipelines/remove.js

@@ -32,16 +32,27 @@ module.exports = () => ({
                     if (pipeline.state === 'DELETING') {
                         throw boom.conflict('This pipeline is already being deleted.');
                     }
-                    if (pipeline.configPipelineId && pipeline.state !== 'INACTIVE') {
-                        throw boom.forbidden(
-                            'Child pipeline can only be removed' +
-                                ` after removing it from scmUrls in config pipeline ${pipeline.configPipelineId}`
-                        );
-                    }
                     if (!user) {
                         throw boom.notFound(`User ${username} does not exist`);
                     }
 
+                    const scmDisplayName = bannerFactory.scm.getDisplayName({ scmContext });
+                    // Lookup whether user is admin
+                    const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
+                        username,
+                        scmDisplayName,
+                        scmUserId
+                    );
+
+                    if (pipeline.configPipelineId && pipeline.state !== 'INACTIVE') {
+                        if (!adminDetails.isAdmin) {
+                            throw boom.forbidden(
+                                'Child pipeline can only be removed' +
+                                    ` after removing it from scmUrls in config pipeline ${pipeline.configPipelineId}`
+                            );
+                        }
+                    }
+
                     // ask the user for permissions on this repo
                     return (
                         user
@@ -55,14 +66,6 @@ module.exports = () => ({
                                 }
                             })
                             .catch(error => {
-                                const scmDisplayName = bannerFactory.scm.getDisplayName({ scmContext });
-                                // Lookup whether user is admin
-                                const adminDetails = request.server.plugins.banners.screwdriverAdminDetails(
-                                    username,
-                                    scmDisplayName,
-                                    scmUserId
-                                );
-
                                 // Allow cluster admins to remove pipeline
                                 if (adminDetails.isAdmin) {
                                     return Promise.resolve(null);