screwdriver-api 8.0.192 → 8.0.194

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.192",
+  "version": "8.0.194",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/events/create.js

@@ -295,10 +295,6 @@ module.exports = () => ({
 
             const event = await createEvent(payload, request.server);
 
-            if (event.builds === null) {
-                return boom.notFound('No jobs to start.');
-            }
-
             // everything succeeded, inform the user
             const location = urlLib.format({
                 host: request.headers.host,
@@ -307,6 +303,15 @@ module.exports = () => ({
                 pathname: `${request.path}/${event.id}`
             });
 
+            if (event.builds === null) {
+                return h
+                    .response(event.toJson())
+                    .header('X-Status-Message', 'No jobs to start.')
+                    .header('Access-Control-Expose-Headers', 'X-Status-Message')
+                    .header('Location', location)
+                    .code(201);
+            }
+
             return h.response(event.toJson()).header('Location', location).code(201);
         },
         validate: {

package/plugins/pipelines/caches/delete.js

@@ -28,9 +28,10 @@ module.exports = () => ({
         },
 
         handler: async (request, h) => {
-            const { pipelineFactory, userFactory } = request.server.app;
+            const { pipelineFactory, userFactory, jobFactory, eventFactory } = request.server.app;
             const { username, scmContext } = request.auth.credentials;
             const pipelineId = request.params.id;
+            const { scope, cacheId } = request.query;
             const { isValidToken } = request.server.plugins.pipelines;
 
             if (!isValidToken(pipelineId, request.auth.credentials)) {
@@ -55,6 +56,25 @@ module.exports = () => ({
             // Check the user's permission
             await getUserPermissions({ user, scmUri, level: 'push' });
 
+            // Ensure the cache resource (scope/cacheId) actually belongs to this pipeline.
+            // The push permission above only authorizes {id}; without this check a caller could
+            // delete another pipeline's cache by passing an unrelated cacheId.
+            let resourcePipelineId = cacheId;
+
+            if (scope === 'jobs') {
+                const job = await jobFactory.get(cacheId);
+
+                resourcePipelineId = job && job.pipelineId;
+            } else if (scope === 'events') {
+                const event = await eventFactory.get(cacheId);
+
+                resourcePipelineId = event && event.pipelineId;
+            }
+
+            if (resourcePipelineId !== pipelineId) {
+                throw boom.forbidden(`Cache ${scope}:${cacheId} does not belong to pipeline ${pipelineId}`);
+            }
+
             const res = await api.invoke(request);
             const statusCode = res.statusCode === 200 ? 204 : res.statusCode;