screwdriver-api 8.0.179 → 8.0.181

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.179",
+  "version": "8.0.181",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/auth/index.js

@@ -115,13 +115,13 @@ const authPlugin = {
                 throw boom.unauthorized();
             }
 
-            const credentials = request.auth.credentials;
+            const { credentials } = request.auth;
 
             if (!credentials.auth || credentials.auth.type !== 'api_token') {
                 return h.continue;
             }
 
-            const apiTokenId = credentials.auth.apiTokenId;
+            const { apiTokenId } = credentials.auth;
 
             if (!apiTokenId) {
                 throw boom.forbidden(`Your token is invalid`);

package/plugins/auth/token.js

@@ -29,13 +29,13 @@ module.exports = () => ({
         },
         handler: async (request, h) => {
             let profile = request.auth.credentials;
-            const { scope, token, username } = profile;
+            const { scope, token, username, permission = 'all' } = profile;
             const { buildFactory, jobFactory, pipelineFactory } = request.server.app;
 
             // Check Build ID impersonate
             if (request.params.buildId) {
-                if (!scope.includes('admin')) {
-                    return boom.forbidden(`User ${username} is not an admin and cannot impersonate`);
+                if (!scope.includes('admin') || permission !== 'all') {
+                    return boom.forbidden(`User ${username} must be an admin with all permission to impersonate`);
                 }
 
                 const build = await buildFactory.get(request.params.buildId);

package/plugins/buildClusters/create.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory, bannerFactory } = request.server.app;

package/plugins/buildClusters/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { name } = request.params;

package/plugins/buildClusters/list.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory } = request.server.app;

package/plugins/buildClusters/remove.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory, userFactory, bannerFactory } = request.server.app;

package/plugins/buildClusters/update.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildClusterFactory, bannerFactory } = request.server.app;

package/plugins/builds/artifacts/get.js

@@ -29,6 +29,11 @@ module.exports = config => ({
             strategies: ['session', 'token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (req, h) => {
             const artifact = req.params.name;

package/plugins/builds/artifacts/getAll.js

@@ -28,6 +28,11 @@ module.exports = config => ({
             strategies: ['session', 'token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (req, h) => {
             const { name: artifact, id: buildId } = req.params;

package/plugins/builds/artifacts/unzip.js

@@ -16,6 +16,11 @@ module.exports = config => ({
             strategies: ['token'],
             scope: ['user', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (req, h) => {
             if (!req.server.app.unzipArtifacts) {

package/plugins/builds/create.js

@@ -19,6 +19,9 @@ module.exports = () => ({
             'hapi-swagger': {
                 security: [{ token: [] }],
                 deprecated: true
+            },
+            authorization: {
+                permission: 'execute'
             }
         },
         handler: async (request, h) => {

package/plugins/builds/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildFactory } = request.server.app;

package/plugins/builds/getBuildStatuses.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildFactory } = request.server.app;

package/plugins/builds/listSecrets.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.buildFactory;

package/plugins/builds/metrics.js

@@ -19,6 +19,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.buildFactory;

package/plugins/builds/steps/get.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stepFactory } = request.server.app;

package/plugins/builds/steps/list.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline', '!guest', 'temporal']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stepFactory } = request.server.app;

package/plugins/builds/steps/logs.js

@@ -289,6 +289,11 @@ module.exports = config => ({
             strategies: ['token', 'session'],
             scope: ['user', 'pipeline', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: (req, h) => {
             const { credentials } = req.auth;

package/plugins/builds/update.js

@@ -90,6 +90,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['build', 'pipeline', 'user', '!guest', 'temporal']
         },
+        plugins: {
+            authorization: {
+                permission: 'execute'
+            }
+        },
 
         handler: async (request, h) => {
             const { buildFactory } = request.server.app;

package/plugins/coverage/info.js

@@ -11,6 +11,11 @@ module.exports = config => ({
             strategies: ['token'],
             scope: ['user', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const data = await config.coveragePlugin.getInfo(request.query);

package/plugins/isAdmin.js

@@ -21,6 +21,9 @@ const isAdminPlugin = {
                 plugins: {
                     'hapi-swagger': {
                         security: [{ token: [] }]
+                    },
+                    authorization: {
+                        permission: 'read'
                     }
                 },
                 handler: async (request, h) =>

package/plugins/jobs/buildCluster/remove.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory, bannerFactory, userFactory, pipelineFactory } = request.server.app;

package/plugins/jobs/buildCluster/update.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
         handler: async (request, h) => {
             const adminAnnotation = 'screwdriver.cd/sdAdminBuildClusterOverride';
             const { payload } = request;

package/plugins/jobs/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/lastSuccessfulMeta.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/latestBuild.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory } = request.server.app;

package/plugins/jobs/listBuilds.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'pipeline', 'build']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/metrics.js

@@ -19,6 +19,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.jobFactory;

package/plugins/jobs/notify.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory, pipelineFactory } = request.server.app;

package/plugins/jobs/update.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'write'
+            }
+        },
 
         handler: async (request, h) => {
             const { jobFactory, pipelineFactory, userFactory, bannerFactory } = request.server.app;

package/plugins/pipelines/badge.js

@@ -22,24 +22,24 @@ module.exports = config => ({
             const { pipelineFactory, eventFactory } = request.server.app;
             const pipelineId = request.params.id;
             const { statusColor } = config;
-            const badgeConfig = {
-                statusColor
-            };
             const contentType = 'image/svg+xml;charset=utf-8';
+            let label;
 
             try {
                 // Get pipeline
                 const pipeline = await pipelineFactory.get(pipelineId);
 
                 if (!pipeline) {
-                    return h.response(getPipelineBadge(badgeConfig)).header('Content-Type', contentType);
+                    return h.response(getPipelineBadge({ statusColor })).header('Content-Type', contentType);
                 }
 
+                label = pipeline.name;
+
                 // Get latest pipeline events
                 const latestEvents = await eventFactory.getPipelineTypeBuildEvents(pipelineId);
 
                 if (!latestEvents || Object.keys(latestEvents).length === 0) {
-                    return h.response(getPipelineBadge(badgeConfig)).header('Content-Type', contentType);
+                    return h.response(getPipelineBadge({ statusColor, label })).header('Content-Type', contentType);
                 }
 
                 // Only care about latest
@@ -47,26 +47,19 @@ module.exports = config => ({
                 const builds = await lastEvent.getBuilds({ readOnly: true, sortBy: 'id', sort: 'descending' });
 
                 if (!builds || builds.length < 1) {
-                    return h.response(getPipelineBadge(badgeConfig)).header('Content-Type', contentType);
+                    return h.response(getPipelineBadge({ statusColor, label })).header('Content-Type', contentType);
                 }
 
                 // Convert build statuses
                 const buildsStatus = builds.map(build => build.status.toLowerCase());
 
                 return h
-                    .response(
-                        getPipelineBadge(
-                            Object.assign(badgeConfig, {
-                                buildsStatus,
-                                label: pipeline.name
-                            })
-                        )
-                    )
+                    .response(getPipelineBadge({ statusColor, label, buildsStatus }))
                     .header('Content-Type', contentType);
             } catch (err) {
                 logger.error(`Failed to get badge for pipeline:${pipelineId}: ${err.message}`);
 
-                return h.response(getPipelineBadge(badgeConfig));
+                return h.response(getPipelineBadge({ statusColor, label }));
             }
         },
         validate: {

package/plugins/pipelines/jobBadge.js

@@ -3,6 +3,7 @@
 const joi = require('joi');
 const schema = require('screwdriver-data-schema');
 const idSchema = schema.models.pipeline.base.extract('id');
+const logger = require('screwdriver-logger');
 const { getJobBadge } = require('./helper');
 
 module.exports = config => ({
@@ -22,61 +23,55 @@ module.exports = config => ({
             const { pipelineFactory } = request.server.app;
             const { id, jobName } = request.params;
             const { statusColor } = config;
-            const badgeConfig = {
-                statusColor
-            };
             const contentType = 'image/svg+xml;charset=utf-8';
+            let label;
 
-            return Promise.all([
-                jobFactory.get({
-                    pipelineId: id,
-                    name: jobName
-                }),
-                pipelineFactory.get(id)
-            ])
-                .then(([job, pipeline]) => {
-                    if (!job) {
-                        return h.response(getJobBadge(badgeConfig)).header('Content-Type', contentType);
-                    }
+            try {
+                const [job, pipeline] = await Promise.all([
+                    jobFactory.get({
+                        pipelineId: id,
+                        name: jobName
+                    }),
+                    pipelineFactory.get(id)
+                ]);
+
+                if (!pipeline) {
+                    return h.response(getJobBadge({ statusColor })).header('Content-Type', contentType);
+                }
+
+                label = pipeline.name;
+
+                if (!job) {
+                    return h.response(getJobBadge({ statusColor, label })).header('Content-Type', contentType);
+                }
 
-                    if (job.state === 'DISABLED') {
-                        return h
-                            .response(
-                                getJobBadge(
-                                    Object.assign(badgeConfig, {
-                                        builds: [
-                                            {
-                                                status: 'DISABLED'
-                                            }
-                                        ],
-                                        label: `${pipeline.name}:${jobName}`
-                                    })
-                                )
-                            )
-                            .header('Content-Type', contentType);
+                label = `${pipeline.name}:${jobName}`;
+
+                if (job.state === 'DISABLED') {
+                    return h
+                        .response(
+                            getJobBadge({
+                                statusColor,
+                                label,
+                                builds: [{ status: 'DISABLED' }]
+                            })
+                        )
+                        .header('Content-Type', contentType);
+                }
+
+                const builds = await job.getBuilds({
+                    paginate: {
+                        page: 1,
+                        count: 1
                     }
+                });
 
-                    const listConfig = {
-                        paginate: {
-                            page: 1,
-                            count: 1
-                        }
-                    };
+                return h.response(getJobBadge({ statusColor, label, builds })).header('Content-Type', contentType);
+            } catch (err) {
+                logger.error(`Failed to get job badge for pipeline:${id}, job:${jobName}: ${err.message}`);
 
-                    return job.getBuilds(listConfig).then(builds => {
-                        return h
-                            .response(
-                                getJobBadge(
-                                    Object.assign(badgeConfig, {
-                                        builds,
-                                        label: `${pipeline.name}:${jobName}`
-                                    })
-                                )
-                            )
-                            .header('Content-Type', contentType);
-                    });
-                })
-                .catch(() => h.response(getJobBadge(badgeConfig)));
+                return h.response(getJobBadge({ statusColor, label })).header('Content-Type', contentType);
+            }
         },
         validate: {
             params: joi.object({

package/plugins/secrets/create.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { pipelineFactory, secretFactory, userFactory } = request.server.app;

package/plugins/secrets/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { secretFactory } = request.server.app;

package/plugins/secrets/remove.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { secretFactory } = request.server.app;

package/plugins/secrets/update.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const factory = request.server.app.secretFactory;

package/plugins/stages/get.js

@@ -17,6 +17,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', 'build', 'pipeline']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stageFactory } = request.server.app;

package/plugins/stages/stageBuilds/list.js

@@ -18,6 +18,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { stageFactory, stageBuildFactory } = request.server.app;

package/plugins/tokens/create.js

@@ -15,6 +15,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;

package/plugins/tokens/list.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'read'
+            }
+        },
 
         handler: async (request, h) => {
             const { userFactory } = request.server.app;

package/plugins/tokens/refresh.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;

package/plugins/tokens/remove.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;

package/plugins/tokens/update.js

@@ -16,6 +16,11 @@ module.exports = () => ({
             strategies: ['token'],
             scope: ['user', '!guest']
         },
+        plugins: {
+            authorization: {
+                permission: 'all'
+            }
+        },
 
         handler: async (request, h) => {
             const { tokenFactory } = request.server.app;