screwdriver-api 8.0.205 → 8.0.207

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/package.json +1 -1
  2. package/plugins/builds/triggers/helpers.js +6 -0
  3. package/plugins/pipelines/helper/updateAdmins.js +20 -10
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "screwdriver-api",
3
- "version": "8.0.205",
3
+ "version": "8.0.207",
4
4
  "description": "API server for the Screwdriver.cd service",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/plugins/builds/triggers/helpers.js CHANGED
@@ -232,6 +232,12 @@ async function createEvent(config) {
232
232
  } = config;
233
233
 
234
234
  const pipeline = await pipelineFactory.get(pipelineId);
235
+
236
+ if (pipeline.state !== 'ACTIVE') {
237
+ // INACTIVE, DELETING, or DISABLED pipeline
238
+ throw boom.badRequest(`Cannot create an event for a(n) ${pipeline.state} pipeline`);
239
+ }
240
+
235
241
  const realAdmin = await pipeline.admin;
236
242
  const { scmContext, scmUri } = pipeline;
237
243
 
package/plugins/pipelines/helper/updateAdmins.js CHANGED
@@ -48,16 +48,26 @@ async function batchUpdatePipelineAdmins(pipelineConfigs, user, isSDAdmin, serve
48
48
  }
49
49
 
50
50
  if (!isSDAdmin) {
51
- await user
52
- .getPermissions(pipeline.scmUri)
53
- // check if user has admin access
54
- .then(permissions => {
55
- if (!permissions.admin) {
56
- throw boom.forbidden(
57
- `User ${user.username} does not have admin permission for the pipeline (id=${pipeline.id}) repo and is not allowed to update admins`
58
- );
59
- }
60
- });
51
+ if (pipeline.scmContext !== user.scmContext) {
52
+ throw boom.forbidden(
53
+ `User ${user.username} and pipeline (id=${pipeline.id}) have different SCM contexts`
54
+ );
55
+ }
56
+
57
+ let permissions;
58
+
59
+ try {
60
+ permissions = await user.getPermissions(pipeline.scmUri);
61
+ } catch (error) {
62
+ throw boom.boomify(error, { statusCode: error.statusCode });
63
+ }
64
+
65
+ // check if user has admin access
66
+ if (!permissions.admin) {
67
+ throw boom.forbidden(
68
+ `User ${user.username} does not have admin permission for the pipeline (id=${pipeline.id}) repo and is not allowed to update admins`
69
+ );
70
+ }
61
71
  }
62
72
 
63
73
  // check if pipeline is being deleted