8354665771

Committed 20 Mar 2024 06:18AM UTC coverage: 95.215% (-0.01%) from 95.226%

Build # 8354665771

Build Type

push

github

Committed by

QubitPi

Commit Message

Use forked template validator (#10)

Run Details

1676 of 1815 branches covered (92.34%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 4 files covered. (100.0%)

5 existing lines in 1 file now uncovered.

4353 of 4517 relevant lines covered (96.37%)

154.08 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.61

/plugins/pipelines/index.js

'use strict';

const boom = require('@hapi/boom');
const createRoute = require('./create');
const updateRoute = require('./update');
const removeRoute = require('./remove');
const syncRoute = require('./sync');
const syncWebhooksRoute = require('./syncWebhooks');
const syncPRsRoute = require('./syncPRs');
const getRoute = require('./get');
const listRoute = require('./list');
const badgeRoute = require('./badge');
const jobBadgeRoute = require('./jobBadge');
const listJobsRoute = require('./listJobs');
const listStagesRoute = require('./listStages');
const listTriggersRoute = require('./listTriggers');
const listSecretsRoute = require('./listSecrets');
const listEventsRoute = require('./listEvents');
const startAllRoute = require('./startAll');
const createToken = require('./tokens/create');
const updateToken = require('./tokens/update');
const refreshToken = require('./tokens/refresh');
const listTokens = require('./tokens/list');
const removeToken = require('./tokens/remove');
const removeAllTokens = require('./tokens/removeAll');
const metricsRoute = require('./metrics');
const latestBuild = require('./latestBuild');
const latestCommitEvent = require('./latestCommitEvent');
const getAdmin = require('./admins/get');
const deleteCache = require('./caches/delete');
const openPrRoute = require('./openPr');
const createTemplateRoute = require('./templates/create');
const validateTemplateRoute = require('./templates/validate');
const listTemplatesRoute = require('./templates/list');
const listTemplateVersionsRoute = require('./templates/listVersions');
const listTagsRoute = require('./templates/listTags');
const getTemplateRoute = require('./templates/get');
const getTemplateByIdRoute = require('./templates/getTemplateById');
const createTagRoute = require('./templates/createTag');
const getVersionRoute = require('./templates/getVersion');
const removeTemplateRoute = require('./templates/remove');
const removeTemplateTagRoute = require('./templates/removeTag');
const removeTemplateVersionRoute = require('./templates/removeVersion');
const updateTrustedRoute = require('./templates/updateTrusted');

/**
 * Pipeline API Plugin
 * @method register
 * @param  {Hapi}     server            Hapi Server
 */
const pipelinesPlugin = {
    name: 'pipelines',
    async register(server) {
        const statusColor = {
            unknown: 'lightgrey',
            disabled: 'lightgrey',
            created: 'lightgrey',
            success: 'green',
            queued: 'blue',
            blocked: 'blue',
            running: 'blue',
            collapsed: 'lightgrey',
            frozen: 'lightgrey',
            unstable: 'yellow',
            failure: 'red',
            aborted: 'red'
        };

        /**
         * Returns an encoded string of subject based on separator of the badge service
         * @method encodeBadgeSubject
         * @param  {String} badgeService           badge service url
         * @param  {String} subject                subject to put in the badge
         * @return {String} encodedSubject
         */
        server.expose('encodeBadgeSubject', ({ badgeService, subject }) => {
            const separator = badgeService.match(/}}(.){{/)[1];

            if (separator === '/') {
                return encodeURIComponent(subject);
            }

            // Reference: https://shields.io/
            if (separator === '-') {
                return subject.replace(/-/g, '--').replace(/_/g, '__');
            }

            return subject;
        });

        /**
         * Returns true if the scope does not include pipeline or includes pipeline
         * and its pipelineId matches the pipeline, otherwise returns false
         * @method isValidToken
         * @param  {String} id                     ID of pipeline
         * @param  {Object} credentials            Credential object from Hapi
         * @param  {String} credentials.pipelineId ID of pipeline which the token is allowed to access
         * @param  {String} credentials.scope      Scope whose token is allowed
         */
        server.expose(
            'isValidToken',
            (id, credentials) =>
                !credentials.scope.includes('pipeline') || parseInt(id, 10) === parseInt(credentials.pipelineId, 10)
        );

        /**
         * Throws error if a credential does not have access to a pipeline
         * If credential has access, returns pipeline
         * @method canAccessPipeline
         * @param {Object}  credentials              Credential object from Hapi
         * @param {String}  credentials.username     Username of the person logged in (or build ID)
         * @param {String}  credentials.scmContext   Scm of the person logged in (or build ID)
         * @param {Array}   credentials.scope        Scope of the credential (user, build, admin)
         * @param {String}  pipelineId               Target pipeline ID
         * @param {String}  permission               Required permission level
         * @param {String}  app                      Server app object
         * @return {Object} pipeline
         */
        server.expose('canAccessPipeline', (credentials, pipelineId, permission, app) => {
            const { username, scmContext, scope, scmUserId } = credentials;
            const { userFactory, pipelineFactory } = app;

            return pipelineFactory.get(pipelineId).then(pipeline => {
                if (!pipeline) {
                    throw boom.notFound(`Pipeline ${pipelineId} does not exist`);
                }

                if (credentials.scope.includes('admin')) {
                    return pipeline;
                }

                if (!pipeline.scmRepo || !pipeline.scmRepo.private || (pipeline.settings && pipeline.settings.public)) {
                    return pipeline;
                }

                if (scope.includes('user')) {
                    return userFactory.get({ username, scmContext }).then(user => {
                        if (!user) {
                            throw boom.notFound(`User ${username} does not exist`);
                        }

                        return user
                            .getPermissions(pipeline.scmUri)
                            .then(permissions => {
                                if (!permissions[permission]) {
                                    throw boom.forbidden(
                                        `User ${username} does not have ${permission} access for this pipeline`
                                    );
                                }

                                return pipeline;
                            })
                            .catch(() => {
                                const scmDisplayName = pipelineFactory.scm.getDisplayName({ scmContext });
                                const adminDetails = server.plugins.banners.screwdriverAdminDetails(
                                    username,
                                    scmDisplayName,
                                    scmUserId
                                );

                                if (adminDetails.isAdmin) {
                                    return pipeline;
                                }

                                throw boom.forbidden(
                                    `User ${username} does not have ${permission} access for this pipeline`
                                );
                            });
                    });
                }

                if (
                    (scope.includes('pipeline') || pipelineId !== credentials.configPipelineId) &&
                    pipelineId !== credentials.pipelineId
                ) {
                    throw boom.forbidden('Token does not have permission for this pipeline');
                }

                return pipeline;
            });
        });

        /**
         * Throws error if a credential does not have permission to remove pipeline template
         * If credential has access, resolves to true
         * @method canRemove
         * @param {Object}  credentials              Credential object from Hapi
         * @param {String}  credentials.username     Username of the person logged in (or build ID)
         * @param {String}  credentials.scmContext   Scm of the person logged in (or build ID)
         * @param {Array}   credentials.scope        Scope of the credential (user, build, admin)
         * @param {String}  [credentials.pipelineId] If credential is a build, this is the pipeline ID
         * @param {Object}  pipelineTemplate         Target pipeline template object
         * @param {String}  permission               Required permission level
         * @param {String}  app                      Server app object
         * @return {Promise}
         */
        server.expose('canRemove', async (credentials, pipelineTemplate, permission, app) => {
            const { username, scmContext, scope } = credentials;
            const { userFactory, pipelineFactory } = app;

            if (credentials.scope.includes('admin')) {
                return true;
            }

            const pipeline = await pipelineFactory.get(pipelineTemplate.pipelineId);

            if (!pipeline) {
                throw boom.notFound(`Pipeline ${pipelineTemplate.pipelineId} does not exist`);
            }

            if (scope.includes('user')) {
                const user = await userFactory.get({ username, scmContext });

                if (!user) {
                    throw boom.notFound(`User ${username} does not exist`);
                }

                const permissions = await user.getPermissions(pipeline.scmUri);

                if (!permissions[permission]) {
                    throw boom.forbidden(
                        `User ${username} does not have ${permission} access for this pipelineTemplate`
                    );
                }

                return true;
            }

            if (pipelineTemplate.pipelineId !== credentials.pipelineId || credentials.isPR) {
                throw boom.forbidden('Not allowed to remove this pipelineTemplate');
            }

            return true;
        });

        server.route([
            createRoute(),
            removeRoute(),
            updateRoute(),
            syncRoute(),
            syncWebhooksRoute(),
            syncPRsRoute(),
            getRoute(),
            listRoute(),
            badgeRoute({ statusColor }),
            jobBadgeRoute({ statusColor }),
            listJobsRoute(),
            listStagesRoute(),
            listTriggersRoute(),
            listSecretsRoute(),
            listEventsRoute(),
            startAllRoute(),
            updateToken(),
            refreshToken(),
            createToken(),
            listTokens(),
            removeToken(),
            removeAllTokens(),
            metricsRoute(),
            latestBuild(),
            latestCommitEvent(),
            getAdmin(),
            deleteCache(),
            openPrRoute(),
            createTemplateRoute(),
            validateTemplateRoute(),
            listTemplatesRoute(),
            listTemplateVersionsRoute(),
            listTagsRoute(),
            getVersionRoute(),
            getTemplateByIdRoute(),
            getTemplateRoute(),
            createTagRoute(),
            removeTemplateRoute(),
            removeTemplateTagRoute(),
            removeTemplateVersionRoute(),
            updateTrustedRoute()
        ]);
    }
};

module.exports = pipelinesPlugin;

1	'use strict';
2
3	const boom = require('@hapi/boom');	20✔
4	const createRoute = require('./create');	20✔
5	const updateRoute = require('./update');	20✔
6	const removeRoute = require('./remove');	20✔
7	const syncRoute = require('./sync');	20✔
8	const syncWebhooksRoute = require('./syncWebhooks');	20✔
9	const syncPRsRoute = require('./syncPRs');	20✔
10	const getRoute = require('./get');	20✔
11	const listRoute = require('./list');	20✔
12	const badgeRoute = require('./badge');	20✔
13	const jobBadgeRoute = require('./jobBadge');	20✔
14	const listJobsRoute = require('./listJobs');	20✔
15	const listStagesRoute = require('./listStages');	20✔
16	const listTriggersRoute = require('./listTriggers');	20✔
17	const listSecretsRoute = require('./listSecrets');	20✔
18	const listEventsRoute = require('./listEvents');	20✔
19	const startAllRoute = require('./startAll');	20✔
20	const createToken = require('./tokens/create');	20✔
21	const updateToken = require('./tokens/update');	20✔
22	const refreshToken = require('./tokens/refresh');	20✔
23	const listTokens = require('./tokens/list');	20✔
24	const removeToken = require('./tokens/remove');	20✔
25	const removeAllTokens = require('./tokens/removeAll');	20✔
26	const metricsRoute = require('./metrics');	20✔
27	const latestBuild = require('./latestBuild');	20✔
28	const latestCommitEvent = require('./latestCommitEvent');	20✔
29	const getAdmin = require('./admins/get');	20✔
30	const deleteCache = require('./caches/delete');	20✔
31	const openPrRoute = require('./openPr');	20✔
32	const createTemplateRoute = require('./templates/create');	20✔
33	const validateTemplateRoute = require('./templates/validate');	20✔
34	const listTemplatesRoute = require('./templates/list');	20✔
35	const listTemplateVersionsRoute = require('./templates/listVersions');	20✔
36	const listTagsRoute = require('./templates/listTags');	20✔
37	const getTemplateRoute = require('./templates/get');	20✔
38	const getTemplateByIdRoute = require('./templates/getTemplateById');	20✔
39	const createTagRoute = require('./templates/createTag');	20✔
40	const getVersionRoute = require('./templates/getVersion');	20✔
41	const removeTemplateRoute = require('./templates/remove');	20✔
42	const removeTemplateTagRoute = require('./templates/removeTag');	20✔
43	const removeTemplateVersionRoute = require('./templates/removeVersion');	20✔
44	const updateTrustedRoute = require('./templates/updateTrusted');	20✔
45
46	/**
47	* Pipeline API Plugin
48	* @method register
49	* @param {Hapi} server Hapi Server
50	*/
51	const pipelinesPlugin = {	20✔
52	name: 'pipelines',
53	async register(server) {
54	const statusColor = {	1,196✔
55	unknown: 'lightgrey',
56	disabled: 'lightgrey',
57	created: 'lightgrey',
58	success: 'green',
59	queued: 'blue',
60	blocked: 'blue',
61	running: 'blue',
62	collapsed: 'lightgrey',
63	frozen: 'lightgrey',
64	unstable: 'yellow',
65	failure: 'red',
66	aborted: 'red'
67	};
68
69	/**
70	* Returns an encoded string of subject based on separator of the badge service
71	* @method encodeBadgeSubject
72	* @param {String} badgeService badge service url
73	* @param {String} subject subject to put in the badge
74	* @return {String} encodedSubject
75	*/
76	server.expose('encodeBadgeSubject', ({ badgeService, subject }) => {	1,196✔
UNCOV 77	const separator = badgeService.match(/}}(.){{/)[1];	×
78
79	if (separator === '/') {	×
UNCOV 80	return encodeURIComponent(subject);	×
81	}
82
83	// Reference: https://shields.io/
84	if (separator === '-') {	×
UNCOV 85	return subject.replace(/-/g, '--').replace(/_/g, '__');	×
86	}
87
UNCOV 88	return subject;	×
89	});
90
91	/**
92	* Returns true if the scope does not include pipeline or includes pipeline
93	* and its pipelineId matches the pipeline, otherwise returns false
94	* @method isValidToken
95	* @param {String} id ID of pipeline
96	* @param {Object} credentials Credential object from Hapi
97	* @param {String} credentials.pipelineId ID of pipeline which the token is allowed to access
98	* @param {String} credentials.scope Scope whose token is allowed
99	*/
100	server.expose(	1,196✔
101	'isValidToken',
102	(id, credentials) =>
103	!credentials.scope.includes('pipeline') \|\| parseInt(id, 10) === parseInt(credentials.pipelineId, 10)	176✔
104	);
105
106	/**
107	* Throws error if a credential does not have access to a pipeline
108	* If credential has access, returns pipeline
109	* @method canAccessPipeline
110	* @param {Object} credentials Credential object from Hapi
111	* @param {String} credentials.username Username of the person logged in (or build ID)
112	* @param {String} credentials.scmContext Scm of the person logged in (or build ID)
113	* @param {Array} credentials.scope Scope of the credential (user, build, admin)
114	* @param {String} pipelineId Target pipeline ID
115	* @param {String} permission Required permission level
116	* @param {String} app Server app object
117	* @return {Object} pipeline
118	*/
119	server.expose('canAccessPipeline', (credentials, pipelineId, permission, app) => {	1,196✔
120	const { username, scmContext, scope, scmUserId } = credentials;	96✔
121	const { userFactory, pipelineFactory } = app;	96✔
122
123	return pipelineFactory.get(pipelineId).then(pipeline => {	96✔
124	if (!pipeline) {	94✔
125	throw boom.notFound(`Pipeline ${pipelineId} does not exist`);	2✔
126	}
127
128	if (credentials.scope.includes('admin')) {	92✔
129	return pipeline;	4✔
130	}
131
132	if (!pipeline.scmRepo \|\| !pipeline.scmRepo.private \|\| (pipeline.settings && pipeline.settings.public)) {	88✔
133	return pipeline;	58✔
134	}
135
136	if (scope.includes('user')) {	30✔
137	return userFactory.get({ username, scmContext }).then(user => {	14✔
138	if (!user) {	14!
UNCOV 139	throw boom.notFound(`User ${username} does not exist`);	×
140	}
141
142	return user	14✔
143	.getPermissions(pipeline.scmUri)
144	.then(permissions => {
145	if (!permissions[permission]) {	14✔
146	throw boom.forbidden(	10✔
147	`User ${username} does not have ${permission} access for this pipeline`
148	);
149	}
150
151	return pipeline;	4✔
152	})
153	.catch(() => {
154	const scmDisplayName = pipelineFactory.scm.getDisplayName({ scmContext });	10✔
155	const adminDetails = server.plugins.banners.screwdriverAdminDetails(	10✔
156	username,
157	scmDisplayName,
158	scmUserId
159	);
160
161	if (adminDetails.isAdmin) {	10✔
162	return pipeline;	4✔
163	}
164
165	throw boom.forbidden(	6✔
166	`User ${username} does not have ${permission} access for this pipeline`
167	);
168	});
169	});
170	}
171
172	if (	16✔
173	(scope.includes('pipeline') \|\| pipelineId !== credentials.configPipelineId) &&	36✔
174	pipelineId !== credentials.pipelineId
175	) {
176	throw boom.forbidden('Token does not have permission for this pipeline');	8✔
177	}
178
179	return pipeline;	8✔
180	});
181	});
182
183	/**
184	* Throws error if a credential does not have permission to remove pipeline template
185	* If credential has access, resolves to true
186	* @method canRemove
187	* @param {Object} credentials Credential object from Hapi
188	* @param {String} credentials.username Username of the person logged in (or build ID)
189	* @param {String} credentials.scmContext Scm of the person logged in (or build ID)
190	* @param {Array} credentials.scope Scope of the credential (user, build, admin)
191	* @param {String} [credentials.pipelineId] If credential is a build, this is the pipeline ID
192	* @param {Object} pipelineTemplate Target pipeline template object
193	* @param {String} permission Required permission level
194	* @param {String} app Server app object
195	* @return {Promise}
196	*/
197	server.expose('canRemove', async (credentials, pipelineTemplate, permission, app) => {	1,196✔
198	const { username, scmContext, scope } = credentials;	30✔
199	const { userFactory, pipelineFactory } = app;	30✔
200
201	if (credentials.scope.includes('admin')) {	30✔
202	return true;	2✔
203	}
204
205	const pipeline = await pipelineFactory.get(pipelineTemplate.pipelineId);	28✔
206
207	if (!pipeline) {	28✔
208	throw boom.notFound(`Pipeline ${pipelineTemplate.pipelineId} does not exist`);	4✔
209	}
210
211	if (scope.includes('user')) {	24✔
212	const user = await userFactory.get({ username, scmContext });	12✔
213
214	if (!user) {	12✔
215	throw boom.notFound(`User ${username} does not exist`);	4✔
216	}
217
218	const permissions = await user.getPermissions(pipeline.scmUri);	8✔
219
220	if (!permissions[permission]) {	8✔
221	throw boom.forbidden(	4✔
222	`User ${username} does not have ${permission} access for this pipelineTemplate`
223	);
224	}
225
226	return true;	4✔
227	}
228
229	if (pipelineTemplate.pipelineId !== credentials.pipelineId \|\| credentials.isPR) {	12✔
230	throw boom.forbidden('Not allowed to remove this pipelineTemplate');	8✔
231	}
232
233	return true;	4✔
234	});
235
236	server.route([	1,196✔
237	createRoute(),
238	removeRoute(),
239	updateRoute(),
240	syncRoute(),
241	syncWebhooksRoute(),
242	syncPRsRoute(),
243	getRoute(),
244	listRoute(),
245	badgeRoute({ statusColor }),
246	jobBadgeRoute({ statusColor }),
247	listJobsRoute(),
248	listStagesRoute(),
249	listTriggersRoute(),
250	listSecretsRoute(),
251	listEventsRoute(),
252	startAllRoute(),
253	updateToken(),
254	refreshToken(),
255	createToken(),
256	listTokens(),
257	removeToken(),
258	removeAllTokens(),
259	metricsRoute(),
260	latestBuild(),
261	latestCommitEvent(),
262	getAdmin(),
263	deleteCache(),
264	openPrRoute(),
265	createTemplateRoute(),
266	validateTemplateRoute(),
267	listTemplatesRoute(),
268	listTemplateVersionsRoute(),
269	listTagsRoute(),
270	getVersionRoute(),
271	getTemplateByIdRoute(),
272	getTemplateRoute(),
273	createTagRoute(),
274	removeTemplateRoute(),
275	removeTemplateTagRoute(),
276	removeTemplateVersionRoute(),
277	updateTrustedRoute()
278	]);
279	}
280	};
281
282	module.exports = pipelinesPlugin;	20✔

QubitPi / screwdriver-cd-screwdriver / 8354665771

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous