screwdriver-api 8.0.199 → 8.0.200

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.199",
+  "version": "8.0.200",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/builds/create.js

@@ -66,6 +66,12 @@ module.exports = () => ({
                                     // check if user has push access
                                     // eslint-disable-next-line consistent-return
                                     .then(permissions => {
+                                        if (permissions.archived === true) {
+                                            throw boom.forbidden(
+                                                'Archived repositories cannot be used for this operation'
+                                            );
+                                        }
+
                                         if (!permissions.push) {
                                             // the user who are not permitted is deleted from admins table
                                             const newAdmins = pipeline.admins;

package/plugins/builds/triggers/helpers.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const logger = require('screwdriver-logger');
+const boom = require('@hapi/boom');
 const workflowParser = require('screwdriver-workflow-parser');
 const merge = require('lodash.mergewith');
 const schema = require('screwdriver-data-schema');
@@ -236,6 +237,17 @@ async function createEvent(config) {
 
     // get pipeline admin's token
     const token = await realAdmin.unsealToken();
+    const permissions = await eventFactory.scm.getPermissions({
+        scmContext,
+        scmUri,
+        scmRepo: pipeline.scmRepo,
+        token
+    });
+
+    if (permissions.archived === true) {
+        throw boom.forbidden('Archived repositories cannot be used for this operation');
+    }
+
     const scmConfig = {
         scmContext,
         scmUri,

package/plugins/events/create.js

@@ -170,6 +170,10 @@ module.exports = () => ({
                 throw boom.boomify(err, { statusCode: err.statusCode });
             }
 
+            if (permissions.archived === true) {
+                throw boom.forbidden('Archived repositories cannot be used for this operation');
+            }
+
             // Update admins
             if (!prNum) {
                 try {

package/plugins/pipelines/create.js

@@ -52,7 +52,11 @@ module.exports = () => ({
             }
 
             // get the user permissions for the repo
-            await getUserPermissions({ user, scmUri });
+            const permissions = await getUserPermissions({ user, scmUri });
+
+            if (permissions.archived === true) {
+                throw boom.forbidden('Archived repositories cannot be used for this operation');
+            }
 
             // see if there is already a pipeline
             let pipeline = await pipelineFactory.get({ scmUri });

package/plugins/pipelines/openPr.js

@@ -26,11 +26,16 @@ module.exports = () => ({
         },
 
         handler: async (request, h) => {
-            const { userFactory } = request.server.app;
+            const { pipelineFactory, userFactory } = request.server.app;
             const { username, scmContext } = request.auth.credentials;
             const { files, title, message } = request.payload;
             const checkoutUrl = helper.formatCheckoutUrl(request.payload.checkoutUrl);
             const rootDir = helper.sanitizeRootDir(request.payload.rootDir);
+            const pipeline = await pipelineFactory.get(request.params.id);
+
+            if (!pipeline) {
+                throw boom.notFound('Pipeline does not exist');
+            }
 
             return userFactory
                 .get({ username, scmContext })
@@ -49,10 +54,25 @@ module.exports = () => ({
                                     checkoutUrl,
                                     token
                                 })
-                                .then(scmUri =>
-                                    user
+                                .then(scmUri => {
+                                    if (
+                                        scmUri.split(':').slice(0, 2).join(':') !==
+                                        pipeline.scmUri.split(':').slice(0, 2).join(':')
+                                    ) {
+                                        throw boom.forbidden(
+                                            'Creating pull requests to repositories other than the pipeline is not permitted'
+                                        );
+                                    }
+
+                                    return user
                                         .getPermissions(scmUri)
-                                        .then(permissions => {
+                                        .then(async permissions => {
+                                            if (permissions.archived === true) {
+                                                throw boom.forbidden(
+                                                    'Archived repositories cannot be used for this operation'
+                                                );
+                                            }
+
                                             if (!permissions.push) {
                                                 throw boom.forbidden(
                                                     `User ${user.getFullDisplayName()} does not have push permission for this repo`
@@ -79,8 +99,8 @@ module.exports = () => ({
                                         .catch(error => {
                                             // 404 error throws, if branch name is incorrect
                                             throw boom.boomify(error, { statusCode: error.statusCode });
-                                        })
-                                );
+                                        });
+                                });
                         })
                         .then(async pullRequest => {
                             if (!pullRequest) {

package/plugins/pipelines/startAll.js

@@ -38,7 +38,11 @@ module.exports = () => ({
 
             const user = await userFactory.get({ username, scmContext });
 
-            await getUserPermissions({ user, scmUri: pipeline.scmUri, level: 'push' });
+            const permissions = await getUserPermissions({ user, scmUri: pipeline.scmUri, level: 'push' });
+
+            if (permissions.archived === true) {
+                throw boom.forbidden('Archived repositories cannot be used for this operation');
+            }
 
             const pipelines = await pipelineFactory.list({
                 params: {
@@ -56,8 +60,11 @@ module.exports = () => ({
                         scmUri: p.scmUri,
                         token: pipelineToken
                     });
+                    const childPermissions = await getUserPermissions({ user, scmUri: p.scmUri, level: 'push' });
 
-                    await getUserPermissions({ user, scmUri: p.scmUri, level: 'push' });
+                    if (childPermissions.archived === true) {
+                        throw boom.forbidden('Archived repositories cannot be used for this operation');
+                    }
 
                     await createEvent(
                         {

package/plugins/pipelines/sync.js

@@ -66,6 +66,10 @@ module.exports = () => ({
                 throw boom.boomify(error, { statusCode: error.statusCode });
             }
 
+            if (permissions.archived === true) {
+                throw boom.forbidden('Archived repositories cannot be used for this operation');
+            }
+
             // check if user has push access
             if (!permissions.push) {
                 // user is not permitted, delete from admins table

package/plugins/pipelines/syncPRs.js

@@ -49,7 +49,11 @@ module.exports = () => ({
                 const scmUri = await getScmUri({ pipeline, pipelineFactory });
 
                 // Check the user's permission
-                await getUserPermissions({ user, scmUri, level: 'push' });
+                const permissions = await getUserPermissions({ user, scmUri, level: 'push' });
+
+                if (permissions.archived === true) {
+                    throw boom.forbidden('Archived repositories cannot be used for this operation');
+                }
             }
 
             await pipeline.syncPRs();

package/plugins/pipelines/syncWebhooks.js

@@ -49,7 +49,11 @@ module.exports = () => ({
                 const scmUri = await getScmUri({ pipeline, pipelineFactory });
 
                 // Check the user's permission
-                await getUserPermissions({ user, scmUri, level: 'push' });
+                const permissions = await getUserPermissions({ user, scmUri, level: 'push' });
+
+                if (permissions.archived === true) {
+                    throw boom.forbidden('Archived repositories cannot be used for this operation');
+                }
             }
 
             // user has good permissions, add or update webhooks

package/plugins/pipelines/tokens/create.js

@@ -52,7 +52,11 @@ module.exports = () => ({
             const scmUri = await getScmUri({ pipeline, pipelineFactory });
 
             // Check the user's permission
-            await getUserPermissions({ user, scmUri });
+            const permissions = await getUserPermissions({ user, scmUri });
+
+            if (permissions.archived === true) {
+                throw boom.forbidden('Archived repositories cannot be used for this operation');
+            }
 
             // Make sure the token name is unique
             const tokens = await pipeline.tokens;

package/plugins/webhooks/helper.js

@@ -313,6 +313,29 @@ const uriTrimmer = uri => {
     return uriToArray.join(':');
 };
 
+/**
+ * Check whether a pipeline's repository is archived.
+ * @method isArchivedPipeline
+ * @param {Pipeline}            pipeline
+ * @param {PipelineFactory}     pipelineFactory
+ */
+async function isArchivedPipeline(pipeline, pipelineFactory) {
+    const permissions = await pipelineFactory.scm.getPermissions({
+        scmUri: pipeline.scmUri,
+        scmContext: pipeline.scmContext,
+        scmRepo: pipeline.scmRepo,
+        token: await pipeline.token
+    });
+
+    if (permissions.archived === true) {
+        logger.info(`Skipping pipeline:${pipeline.id} for archived repository`);
+
+        return true;
+    }
+
+    return false;
+}
+
 /**
  * Create metadata by the parsed event
  * @param   {Object}   parsed   It has information to create metadata
@@ -1248,6 +1271,12 @@ async function createEvents(server, userFactory, pipelineFactory, pipelines, par
                     eventConfig.startFrom = '~subscribe';
                     eventConfig.subscribedConfigSha = eventConfig.sha;
 
+                    if (await isArchivedPipeline(pTuple.pipeline, pipelineFactory)) {
+                        logger.info(`skip create event for this subscribed trigger due to archiving repository`);
+
+                        return null;
+                    }
+
                     try {
                         eventConfig.sha = await pipelineFactory.scm.getCommitSha(scmConfig);
                     } catch (err) {
@@ -1255,6 +1284,8 @@ async function createEvents(server, userFactory, pipelineFactory, pipelines, par
                             throw err;
                         } else {
                             logger.info(`skip create event for this subscribed trigger`);
+
+                            return null;
                         }
                     }
 
@@ -1272,6 +1303,8 @@ async function createEvents(server, userFactory, pipelineFactory, pipelines, par
                             throw err;
                         } else {
                             logger.info(`skip create event for this subscribed trigger`);
+
+                            return null;
                         }
                     }
                 }