screwdriver-api 8.0.173 → 8.0.175

package/lib/server.js

@@ -227,7 +227,13 @@ module.exports = async config => {
         server.app.buildFactory.apiUri = server.info.uri;
         server.app.buildFactory.tokenGen = (buildId, metadata, scmContext, expiresIn, scope = ['temporal']) =>
             server.plugins.auth.generateToken(
-                server.plugins.auth.generateProfile({ username: buildId, scmContext, scope, metadata }),
+                server.plugins.auth.generateProfile({
+                    username: buildId,
+                    scmContext,
+                    scope,
+                    auth: { type: 'temporary' },
+                    metadata
+                }),
                 expiresIn
             );
         server.app.buildFactory.executor.tokenGen = server.app.buildFactory.tokenGen;
@@ -236,7 +242,13 @@ module.exports = async config => {
         server.app.jobFactory.apiUri = server.info.uri;
         server.app.jobFactory.tokenGen = (username, metadata, scmContext, scope = ['user']) =>
             server.plugins.auth.generateToken(
-                server.plugins.auth.generateProfile({ username, scmContext, scope, metadata })
+                server.plugins.auth.generateProfile({
+                    username,
+                    scmContext,
+                    scope,
+                    auth: { type: 'temporary' },
+                    metadata
+                })
             );
         server.app.jobFactory.executor.userTokenGen = server.app.jobFactory.tokenGen;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.173",
+  "version": "8.0.175",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/auth/index.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const boom = require('@hapi/boom');
 const joi = require('joi');
 const jwt = require('jsonwebtoken');
 const { v4: uuidv4 } = require('uuid');
@@ -94,6 +95,64 @@ const authPlugin = {
     async register(server, options) {
         const pluginOptions = joi.attempt(options, AUTH_PLUGIN_SCHEMA, 'Invalid config for plugin-auth');
 
+        server.ext('onPostAuth', async (request, h) => {
+            const { tokenFactory } = request.server.app;
+
+            const permissionLevels = {
+                read: 1,
+                execute: 2,
+                write: 3,
+                all: 4
+            };
+
+            const authSettings = request.route.settings.plugins ? request.route.settings.plugins.authorization : null;
+
+            if (!authSettings) {
+                return h.continue;
+            }
+
+            if (!request.auth.isAuthenticated) {
+                throw boom.unauthorized();
+            }
+
+            const credentials = request.auth.credentials;
+
+            if (!credentials.auth || credentials.auth.type !== 'api_token') {
+                return h.continue;
+            }
+
+            const apiTokenId = credentials.auth.apiTokenId;
+
+            if (!apiTokenId) {
+                throw boom.forbidden(`Your token is invalid`);
+            }
+
+            const token = await tokenFactory.get({ id: apiTokenId });
+
+            if (!token) {
+                throw boom.forbidden(`Your token is invalid`);
+            }
+
+            if (token.expiresAt && new Date(token.expiresAt) < new Date()) {
+                throw boom.forbidden(`Your token is expired: token id ${apiTokenId}`);
+            }
+
+            const actualPermission = credentials.permission || 'all';
+            const requiredPermission = authSettings.permission;
+            const actualPermissionLevel = permissionLevels[actualPermission];
+            const requiredPermissionLevel = permissionLevels[requiredPermission];
+
+            if (!requiredPermissionLevel) {
+                throw boom.badImplementation(`Invalid required permission: "${requiredPermission}"`);
+            }
+
+            if (!actualPermissionLevel || actualPermissionLevel < requiredPermissionLevel) {
+                throw boom.forbidden(`This endpoint requires "${requiredPermission}" permission`);
+            }
+
+            return h.continue;
+        });
+
         /**
          * Generates a profile for storage in cookie and jwt
          * @method generateProfile
@@ -102,12 +161,22 @@ const authPlugin = {
          * @param  {String}   config.scmUserId  User ID in the SCM
          * @param  {String}   config.scmContext Scm to which the person logged in belongs
          * @param  {Array}    config.scope      Scope for this profile (usually build or user)
+         * @param  {Object}   config.auth       Authentication method information
+         * @param  {Object}   config.options    Additional token options
          * @param  {Object}   config.metadata   Additional information to tag along with the login
          * @return {Object}                     The profile to be stored in jwt and/or cookie
          */
         server.expose('generateProfile', config => {
-            const { username, scmUserId, scmContext, scope, metadata } = config;
-            const profile = { username, scmContext, scmUserId, scope, ...(metadata || {}) };
+            const { username, scmUserId, scmContext, scope, auth, options: profileOptions, metadata } = config;
+            const profile = {
+                username,
+                scmContext,
+                scmUserId,
+                scope,
+                auth,
+                ...(profileOptions || {}),
+                ...(metadata || {})
+            };
 
             if (pluginOptions.jwtEnvironment) {
                 profile.environment = pluginOptions.jwtEnvironment;
@@ -228,7 +297,13 @@ const authPlugin = {
                             username: user.username,
                             scmUserId: scmUser.id,
                             scmContext: user.scmContext,
-                            scope: ['user']
+                            scope: ['user'],
+                            auth: {
+                                type: 'api_token',
+                                apiTokenId: token.id,
+                                apiTokenType: 'user'
+                            },
+                            ...(token.options || {})
                         };
 
                         const scmDisplayName = scm.getDisplayName({ scmContext: profile.scmContext });
@@ -256,7 +331,13 @@ const authPlugin = {
                             username: admin.username,
                             scmContext: pipeline.scmContext,
                             pipelineId: token.pipelineId,
-                            scope: ['pipeline']
+                            scope: ['pipeline'],
+                            auth: {
+                                type: 'api_token',
+                                apiTokenId: token.id,
+                                apiTokenType: 'pipeline'
+                            },
+                            ...(token.options || {})
                         };
                     }
                     if (!profile) {

package/plugins/auth/login.js

@@ -35,6 +35,12 @@ function addGuestRoute(config) {
                     const profile = request.server.plugins.auth.generateProfile({
                         username,
                         scope: ['user', 'guest'],
+                        auth: {
+                            type: 'temporary'
+                        },
+                        options: {
+                            permission: 'read'
+                        },
                         metadata: {}
                     });
 
@@ -92,6 +98,12 @@ function addOAuthRoutes(config) {
                     scmUserId,
                     scmContext,
                     scope: ['user'],
+                    auth: {
+                        type: 'oauth'
+                    },
+                    options: {
+                        permission: 'all'
+                    },
                     metadata: {}
                 });
                 const scmDisplayName = await userFactory.scm.getDisplayName({ scmContext });

package/plugins/auth/token.js

@@ -45,7 +45,10 @@ module.exports = () => ({
                 profile = request.server.plugins.auth.generateProfile({
                     username: request.params.buildId,
                     scmContext: pipeline.scmContext,
-                    scope: ['build', 'impersonated']
+                    scope: ['build', 'impersonated'],
+                    auth: {
+                        type: 'temporary'
+                    }
                 });
                 profile.token = request.server.plugins.auth.generateToken(profile);
 

package/plugins/builds/token.js

@@ -58,6 +58,9 @@ module.exports = () => ({
                             username: profile.username,
                             scmContext: profile.scmContext,
                             scope: ['build'],
+                            auth: {
+                                type: 'temporary'
+                            },
                             metadata: jwtInfo
                         }),
                         parseInt(buildTimeout, 10)

package/plugins/pipelines/admins/get.js

@@ -44,7 +44,13 @@ module.exports = () => ({
                     const profile = request.server.plugins.auth.generateProfile({
                         username: admin.username,
                         scmContext: admin.scmContext,
-                        scope: ['user']
+                        scope: ['user'],
+                        auth: {
+                            type: 'temporary'
+                        },
+                        options: {
+                            permission: 'all'
+                        }
                     });
 
                     admin.userToken = request.server.plugins.auth.generateToken(profile);

package/plugins/pipelines/caches/request.js

@@ -40,7 +40,10 @@ async function invoke(request) {
             username,
             scmContext,
             scope: ['sdapi'],
-            metadata: { pipelineId }
+            metadata: { pipelineId },
+            auth: {
+                type: 'temporary'
+            }
         })
     );
 

package/plugins/pipelines/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { canAccessPipeline } = request.server.plugins.pipelines;

package/plugins/users/get.js

@@ -42,7 +42,13 @@ module.exports = () => ({
                 const profile = request.server.plugins.auth.generateProfile({
                     username: user.username,
                     scmContext: user.scmContext,
-                    scope: ['user']
+                    scope: ['user'],
+                    auth: {
+                        type: 'temporary'
+                    },
+                    options: {
+                        permission: 'all'
+                    }
                 });
 
                 user.userToken = request.server.plugins.auth.generateToken(profile);