screwdriver-api 8.0.184 → 8.0.186

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.184",
+  "version": "8.0.186",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {
@@ -112,7 +112,7 @@
     "screwdriver-command-validator": "^5.0.0",
     "screwdriver-config-parser": "^12.2.3",
     "screwdriver-coverage-bookend": "^3.0.0",
-    "screwdriver-coverage-sonar": "^5.0.0",
+    "screwdriver-coverage-sonar": "^6.0.0",
     "screwdriver-data-schema": "^26.1.0",
     "screwdriver-datastore-sequelize": "^10.1.0",
     "screwdriver-executor-base": "^11.0.0",

package/plugins/auth/index.js

@@ -4,6 +4,7 @@ const boom = require('@hapi/boom');
 const joi = require('joi');
 const jwt = require('jsonwebtoken');
 const { v4: uuidv4 } = require('uuid');
+const logger = require('screwdriver-logger');
 const contextsRoute = require('./contexts');
 const crumbRoute = require('./crumb');
 const keyRoute = require('./key');
@@ -124,16 +125,19 @@ const authPlugin = {
             const { apiTokenId } = credentials.auth;
 
             if (!apiTokenId) {
+                logger.info(`[API Token Access] Invalid API Token.`);
                 throw boom.forbidden(`Your token is invalid`);
             }
 
             const token = await tokenFactory.get({ id: apiTokenId });
 
             if (!token) {
+                logger.info(`[API Token Access] Invalid API Token.`);
                 throw boom.forbidden(`Your token is invalid`);
             }
 
             if (token.expiresAt && new Date(token.expiresAt) < new Date()) {
+                logger.info(`[API Token Access][TokenId:${apiTokenId}] Expired Token Access.`);
                 throw boom.forbidden(`Your token is expired: token id ${apiTokenId}`);
             }
 
@@ -146,10 +150,17 @@ const authPlugin = {
                 throw boom.badImplementation(`Invalid required permission: "${requiredPermission}"`);
             }
 
+            const endpoint = request.route.path;
+
             if (!actualPermissionLevel || actualPermissionLevel < requiredPermissionLevel) {
+                logger.info(
+                    `[API Token Access][TokenId:${apiTokenId}][${endpoint}] Invalid permission Token Access. This endpoint requires "${requiredPermission}" permission. This token has "${actualPermission}"`
+                );
                 throw boom.forbidden(`This endpoint requires "${requiredPermission}" permission`);
             }
 
+            logger.info(`[API Token Access][TokenId:${apiTokenId}][${endpoint}] Success API Token access.`);
+
             return h.continue;
         });