screwdriver-api 8.0.205 → 8.0.206

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/plugins/pipelines/helper/updateAdmins.js +20 -10
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "screwdriver-api",
3
- "version": "8.0.205",
3
+ "version": "8.0.206",
4
4
  "description": "API server for the Screwdriver.cd service",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/plugins/pipelines/helper/updateAdmins.js CHANGED
@@ -48,16 +48,26 @@ async function batchUpdatePipelineAdmins(pipelineConfigs, user, isSDAdmin, serve
48
48
  }
49
49
 
50
50
  if (!isSDAdmin) {
51
- await user
52
- .getPermissions(pipeline.scmUri)
53
- // check if user has admin access
54
- .then(permissions => {
55
- if (!permissions.admin) {
56
- throw boom.forbidden(
57
- `User ${user.username} does not have admin permission for the pipeline (id=${pipeline.id}) repo and is not allowed to update admins`
58
- );
59
- }
60
- });
51
+ if (pipeline.scmContext !== user.scmContext) {
52
+ throw boom.forbidden(
53
+ `User ${user.username} and pipeline (id=${pipeline.id}) have different SCM contexts`
54
+ );
55
+ }
56
+
57
+ let permissions;
58
+
59
+ try {
60
+ permissions = await user.getPermissions(pipeline.scmUri);
61
+ } catch (error) {
62
+ throw boom.boomify(error, { statusCode: error.statusCode });
63
+ }
64
+
65
+ // check if user has admin access
66
+ if (!permissions.admin) {
67
+ throw boom.forbidden(
68
+ `User ${user.username} does not have admin permission for the pipeline (id=${pipeline.id}) repo and is not allowed to update admins`
69
+ );
70
+ }
61
71
  }
62
72
 
63
73
  // check if pipeline is being deleted