Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
run: async () => {
const auth = new taskcluster.Auth(taskcluster.fromEnvVars());
const randomId = taskcluster.slugid();
let clientId = `project/taskcluster/smoketest/${randomId}`;
const payload = {
"expires": taskcluster.fromNowJSON('1 hour'),
"description": `Create a client and use it ${clientId}`,
"scopes": [`auth:reset-access-token:project/taskcluster/smoketest/${randomId}`],
};
const created = await auth.createClient(clientId, payload);
// try using that new client
const accessToken = created.accessToken;
const auth2 = new taskcluster.Auth({
rootUrl: process.env.TASKCLUSTER_ROOT_URL,
credentials: {clientId, accessToken},
});
await auth2.resetAccessToken(clientId);
function decorateTask(task, options) {
task = template(task, options);
// Shallow copy the task...
var output = {};
for (var key in task) {
output[key] = task[key];
}
// Each task must have its own unique task id unless this is an
// external hook. In the external case we expect
// external systems to generate a taskId.
if (!options.externalHook) {
output.taskId = output.taskId || taskcluster.slugid();
}
// Taskcluster needs to know how to run the tasks these specify which
// provisioning method and which worker type to run on.
if (!options.externalHook) {
output.task.created = new Date().toJSON();
}
output.task.metadata.source = 'http://todo.com/soon';
// Ensure we are always using the correct scheduler so our tasks are routed
// correctly...
output.task.schedulerId = output.task.schedulerId || options.schedulerId ||
'task-graph-scheduler';
output.task.metadata.owner = 'dev-gaia@lists.mozilla.org';
// Expire all tasks in 24 hours.
}
if (!_.isEqual(registeredClient.scope.sort(), areq.scope.sort())) {
throw new oauth2orize.AuthorizationError(null, 'invalid_scope');
}
if (!registeredClient.redirectUri.some(uri => uri === areq.redirectURI)) {
throw new oauth2orize.AuthorizationError(null, 'access_denied');
}
if (registeredClient.responseType !== 'token') {
throw new oauth2orize.AuthorizationError(null, 'unsupported_response_type');
}
// The access token we give to third parties
const accessToken = new Buffer.from(taskcluster.slugid()).toString('base64');
const currentUser = await strategies[user.identityProviderId].userFromIdentity(user.identity);
const userScopes = (await auth.expandScopes({scopes: currentUser.scopes()})).scopes;
await AccessToken.create({
// OAuth2 client
clientId: registeredClient.clientId,
redirectUri: areq.redirectURI,
identity: user.identity,
identityProviderId: user.identityProviderId,
accessToken: accessToken,
expires: taskcluster.fromNow('10 minutes'),
clientDetails: {
clientId: ares.clientId,
description: ares.description || `Client generated by ${user.identity} for OAuth2 Client ${registeredClient.clientId}`,
scopes: scopeIntersection(ares.scope, userScopes),
exports.pyClientRelease = async ({dir, username, password, logfile, utils}) => {
// override HOME so this doesn't use the user's credentials
const homeDir = path.join(REPO_ROOT, 'temp', taskcluster.slugid());
await mkdirp(homeDir);
try {
await utils.waitFor(new Observable(observer => {
const proc = child_process.spawn('bash', ['./release.sh', '--real'], {
env: {
...process.env,
HOME: homeDir,
TWINE_USERNAME: username,
TWINE_PASSWORD: password,
TWINE_REPOSITORY_URL: 'https://upload.pypi.org/legacy/',
TWINE_NON_INTERACTIVE: '1',
},
cwd: dir,
});
denylist: this.denylist,
});
if (denied) {
return res.reportError('InputError', '{{message}}', {
message: 'One or more of the exchanges below have been denied access to hooks\n' + JSON.stringify(hookDef.bindings),
});
}
// Try to create a Hook entity
try {
await this.Hook.create(
_.defaults({}, hookDef, {
bindings: [],
triggerToken: taskcluster.slugid(),
lastFire: {result: 'no-fire'},
nextTaskId: taskcluster.slugid(),
nextScheduledDate: nextDate(hookDef.schedule),
}));
} catch (err) {
if (err && err.code === 'PropertyTooLarge') {
return res.reportError('InputError', err.toString(), {});
}
if (!err || err.code !== 'EntityAlreadyExists') {
throw err;
}
const existingHook = await this.Hook.load({hookGroupId, hookId}, true);
if (!_.isEqual(hookDef, await existingHook.definition())) {
return res.reportError('RequestConflict',
'hook `' + hookGroupId + '/' + hookId + '` already exists.',
run: async () => {
const auth = new taskcluster.Auth(taskcluster.fromEnvVars());
const randomId = taskcluster.slugid();
const roleId = `project:taskcluster:smoketest:${randomId}:*`;
const payload = {
description: 'smoketest for creating a role and expanding it',
scopes: ['project:taskcluster:smoketest:<..>/*'],
};
await auth.createRole(roleId, payload);
const expandPayload = {
scopes: [`assume:project:taskcluster:smoketest:${randomId}:abc`],
};
const expandedRole = await auth.expandScopes(expandPayload);
const expectedScopes = {
scopes:
[ `assume:project:taskcluster:smoketest:${randomId}:abc`,
run: async () => {
let secrets = new taskcluster.Secrets(taskcluster.fromEnvVars());
let secretName = taskcluster.slugid();
let secretPrefix = `project/taskcluster/smoketest/${secretName}`;
const payload = {
"expires": taskcluster.fromNowJSON('2 minutes'),
"secret": {
"description": `Secret ${secretName}`,
"type": "object",
},
};
await secrets.set(secretPrefix, payload);
const getSecret = await secrets.get(secretPrefix);
assert.deepEqual(getSecret.secret, payload.secret);
await secrets.remove(secretPrefix);
await assert.rejects(
() => secrets.get(secretPrefix),
err => assert.equal(err.code, 404)
);
server.grant(oauth2orize.grant.code(unpromisify(async (client, redirectURI, user, ares, areq) => {
const code = taskcluster.slugid();
const registeredClient = findRegisteredClient(client.clientId);
if (!registeredClient) {
throw new oauth2orize.AuthorizationError(null, 'unauthorized_client');
}
if (!_.isEqual(registeredClient.scope.sort(), areq.scope.sort())) {
throw new oauth2orize.AuthorizationError(null, 'invalid_scope');
}
if (!registeredClient.redirectUri.some(uri => uri === redirectURI)) {
throw new oauth2orize.AuthorizationError(null, 'access_denied');
}
if (registeredClient.responseType !== 'code') {
throw new oauth2orize.AuthorizationError(null, 'unsupported_response_type');
subscribe(subscriptions, handleMessage, handleError) {
const subscriptionId = slugid();
this.subscriptions.set(
subscriptionId,
new Subscription({
subscriptionId,
handleMessage,
handleError,
monitor: this.monitor,
subscriptions,
})
);
this.reconcileSubscriptions();
return subscriptionId;
}
this.fireCalls.push({
hookGroupId: hook.hookGroupId,
hookId: hook.hookId,
context,
options});
if (this.shouldNotProduceTask) {
return;
}
const taskId = options.taskId || taskcluster.slugid();
return {
status: {
taskId: taskId,
provisionerId: hook.task.provisionerId,
workerType: hook.task.workerType,
schedulerId: '-',
taskGroupId: taskcluster.slugid(),
deadline: '2015-10-18T22:32:59.706Z',
expires: '2016-10-18T22:32:59.706Z',
retriesLeft: 5,
state: 'completed',
runs: [],
},
};
}
}