screwdriver-api 8.0.194 → 8.0.195
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/plugins/commands/remove.js +15 -1
package/package.json
CHANGED
|
@@ -56,7 +56,6 @@ module.exports = () => ({
|
|
|
56
56
|
const { commandFactory, commandTagFactory } = request.server.app;
|
|
57
57
|
const { canRemove } = request.server.plugins.commands;
|
|
58
58
|
const storeUrl = request.server.app.ecosystem.store;
|
|
59
|
-
const authToken = request.headers.authorization;
|
|
60
59
|
|
|
61
60
|
return Promise.all([
|
|
62
61
|
commandFactory.list({ params: { namespace, name } }),
|
|
@@ -69,6 +68,21 @@ module.exports = () => ({
|
|
|
69
68
|
|
|
70
69
|
return canRemove(credentials, commands[0], 'admin', request.server.app)
|
|
71
70
|
.then(() => {
|
|
71
|
+
// Delegate to the store with a service token that attests the
|
|
72
|
+
// ownership check just performed, instead of forwarding the
|
|
73
|
+
// caller's own token. The store has no visibility into SCM
|
|
74
|
+
// permissions and cannot re-derive this decision, so forwarding a
|
|
75
|
+
// bare user/guest-scope token let a caller reach the store
|
|
76
|
+
// directly and skip this check entirely.
|
|
77
|
+
const storeToken = request.server.plugins.auth.generateToken(
|
|
78
|
+
request.server.plugins.auth.generateProfile({
|
|
79
|
+
scope: ['sdapi'],
|
|
80
|
+
metadata: { pipelineId: commands[0].pipelineId, namespace, name },
|
|
81
|
+
auth: { type: 'temporary' }
|
|
82
|
+
})
|
|
83
|
+
);
|
|
84
|
+
const authToken = `Bearer ${storeToken}`;
|
|
85
|
+
|
|
72
86
|
const commandPromises = commands.map(command =>
|
|
73
87
|
removeCommand(command, storeUrl, authToken)
|
|
74
88
|
);
|