screwdriver-api 8.0.178 → 8.0.180

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.178",
+  "version": "8.0.180",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/auth/index.js

@@ -115,13 +115,13 @@ const authPlugin = {
                 throw boom.unauthorized();
             }
 
-            const credentials = request.auth.credentials;
+            const { credentials } = request.auth;
 
             if (!credentials.auth || credentials.auth.type !== 'api_token') {
                 return h.continue;
             }
 
-            const apiTokenId = credentials.auth.apiTokenId;
+            const { apiTokenId } = credentials.auth;
 
             if (!apiTokenId) {
                 throw boom.forbidden(`Your token is invalid`);

package/plugins/auth/token.js

@@ -29,13 +29,13 @@ module.exports = () => ({
         },
         handler: async (request, h) => {
             let profile = request.auth.credentials;
-            const { scope, token, username } = profile;
+            const { scope, token, username, permission = 'all' } = profile;
             const { buildFactory, jobFactory, pipelineFactory } = request.server.app;
 
             // Check Build ID impersonate
             if (request.params.buildId) {
-                if (!scope.includes('admin')) {
-                    return boom.forbidden(`User ${username} is not an admin and cannot impersonate`);
+                if (!scope.includes('admin') || permission !== 'all') {
+                    return boom.forbidden(`User ${username} must be an admin with all permission to impersonate`);
                 }
 
                 const build = await buildFactory.get(request.params.buildId);

package/plugins/buildClusters/create.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory, bannerFactory } = request.server.app;

package/plugins/buildClusters/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { name } = request.params;

package/plugins/buildClusters/list.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory } = request.server.app;

package/plugins/buildClusters/remove.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory, userFactory, bannerFactory } = request.server.app;

package/plugins/buildClusters/update.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory, bannerFactory } = request.server.app;

package/plugins/builds/artifacts/get.js

@@ -29,6 +29,11 @@ module.exports = config => ({
             strategies: ['session', 'token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (req, h) => {
             const artifact = req.params.name;

package/plugins/builds/artifacts/getAll.js

@@ -28,6 +28,11 @@ module.exports = config => ({
             strategies: ['session', 'token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (req, h) => {
             const { name: artifact, id: buildId } = req.params;

package/plugins/builds/artifacts/unzip.js

@@ -16,6 +16,11 @@ module.exports = config => ({
             strategies: ['token'],
             scope: ['user', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (req, h) => {
             if (!req.server.app.unzipArtifacts) {

package/plugins/builds/create.js

@@ -19,6 +19,9 @@ module.exports = () => ({
             'hapi-swagger': {
                 security: [{ token: [] }],
                 deprecated: true
+            },
+            authorization: {
+                permission: 'execute'
             }
         },
         handler: async (request, h) => {

package/plugins/builds/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildFactory } = request.server.app;

package/plugins/builds/getBuildStatuses.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildFactory } = request.server.app;

package/plugins/builds/listSecrets.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.buildFactory;

package/plugins/builds/metrics.js

@@ -19,6 +19,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.buildFactory;

package/plugins/builds/steps/get.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stepFactory } = request.server.app;

package/plugins/builds/steps/list.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline', '!guest', 'temporal']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stepFactory } = request.server.app;

package/plugins/builds/steps/logs.js

@@ -289,6 +289,11 @@ module.exports = config => ({
             strategies: ['token', 'session'],
             scope: ['user', 'pipeline', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: (req, h) => {
             const { credentials } = req.auth;

package/plugins/builds/update.js

@@ -90,6 +90,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['build', 'pipeline', 'user', '!guest', 'temporal']
         },
+        plugins: {
+            authorization: {
+                permission: 'execute'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildFactory } = request.server.app;

package/plugins/coverage/info.js

@@ -11,6 +11,11 @@ module.exports = config => ({
             strategies: ['token'],
             scope: ['user', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const data = await config.coveragePlugin.getInfo(request.query);

package/plugins/isAdmin.js

@@ -21,6 +21,9 @@ const isAdminPlugin = {
                 plugins: {
                     'hapi-swagger': {
                         security: [{ token: [] }]
+                    },
+                    authorization: {
+                        permission: 'read'
                     }
                 },
                 handler: async (request, h) =>

package/plugins/jobs/buildCluster/remove.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory, bannerFactory, userFactory, pipelineFactory } = request.server.app;

package/plugins/jobs/buildCluster/update.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
         handler: async (request, h) => {
             const adminAnnotation = 'screwdriver.cd/sdAdminBuildClusterOverride';
             const { payload } = request;

package/plugins/jobs/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/lastSuccessfulMeta.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/latestBuild.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory } = request.server.app;

package/plugins/jobs/listBuilds.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'pipeline', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/metrics.js

@@ -19,6 +19,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/notify.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory, pipelineFactory } = request.server.app;

package/plugins/jobs/update.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'write'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory, pipelineFactory, userFactory, bannerFactory } = request.server.app;

package/plugins/secrets/create.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { pipelineFactory, secretFactory, userFactory } = request.server.app;

package/plugins/secrets/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { secretFactory } = request.server.app;

package/plugins/secrets/remove.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { secretFactory } = request.server.app;

package/plugins/secrets/update.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.secretFactory;

package/plugins/stages/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stageFactory } = request.server.app;

package/plugins/stages/stageBuilds/list.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stageFactory, stageBuildFactory } = request.server.app;

package/plugins/tokens/create.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;

package/plugins/tokens/list.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { userFactory } = request.server.app;

package/plugins/tokens/refresh.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;

package/plugins/tokens/remove.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;

package/plugins/tokens/update.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;