screwdriver-api 8.0.198 → 8.0.199

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.198",
+  "version": "8.0.199",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/pipelines/get.js

@@ -6,6 +6,37 @@ const schema = require('screwdriver-data-schema');
 const getSchema = schema.models.pipeline.get;
 const idSchema = schema.models.pipeline.base.extract('id');
 
+/**
+ * Get a pipeline when the current user is an explicitly registered admin from another SCM context.
+ *
+ * @param {Object} credentials            Request credentials
+ * @param {String} pipelineId             Target pipeline ID
+ * @param {Object} app                    Server app object
+ * @return {Promise<Object|null>}          Pipeline when access is allowed, otherwise null
+ */
+async function canAccessPipelineForScmMigration(credentials, pipelineId, app) {
+    const { username, scmContext, scope } = credentials;
+    const { pipelineFactory, userFactory } = app;
+
+    if (!scope.includes('user')) {
+        return null;
+    }
+
+    const [pipeline, user] = await Promise.all([
+        pipelineFactory.get(pipelineId),
+        userFactory.get({ username, scmContext })
+    ]);
+
+    if (!pipeline || !user) {
+        return null;
+    }
+
+    const isDifferentScm = user.scmContext !== pipeline.scmContext;
+    const isExplicitAdmin = (pipeline.adminUserIds || []).includes(user.id);
+
+    return isDifferentScm && isExplicitAdmin ? pipeline : null;
+}
+
 module.exports = () => ({
     method: 'GET',
     path: '/pipelines/{id}',
@@ -26,18 +57,28 @@ module.exports = () => ({
         handler: async (request, h) => {
             const { canAccessPipeline } = request.server.plugins.pipelines;
             const { credentials } = request.auth;
+            const pipelineId = request.params.id;
+            let pipeline;
+
+            try {
+                pipeline = await canAccessPipeline(credentials, pipelineId, 'pull', request.server.app);
+            } catch (err) {
+                if (!boom.isBoom(err, 403)) {
+                    throw err;
+                }
 
-            return canAccessPipeline(credentials, request.params.id, 'pull', request.server.app)
-                .then(pipeline => {
-                    if (!pipeline) {
-                        throw boom.notFound('Pipeline does not exist');
-                    }
+                pipeline = await canAccessPipelineForScmMigration(credentials, pipelineId, request.server.app);
 
-                    return h.response(pipeline.toJson());
-                })
-                .catch(err => {
+                if (!pipeline) {
                     throw err;
-                });
+                }
+            }
+
+            if (!pipeline) {
+                throw boom.notFound('Pipeline does not exist');
+            }
+
+            return h.response(pipeline.toJson());
         },
         response: {
             schema: getSchema