From f6b0f94adb31fe3054bb8283fcd616e84b99c340 Mon Sep 17 00:00:00 2001
From: Keisuke Kumada <kekumada@yahoo-corp.jp>
Date: Mon, 3 Jun 2024 14:06:52 +0900
Subject: [PATCH] fix(3123): Restrict overwriting username on create Event

---
 plugins/events/create.js    |  3 +++
 test/plugins/events.test.js | 37 ++++++++++++++++++++++++++++++++++---
 2 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/plugins/events/create.js b/plugins/events/create.js
index 200c5b51a..385f80b26 100644
--- a/plugins/events/create.js
+++ b/plugins/events/create.js
@@ -79,6 +79,9 @@ module.exports = () => ({
 
             if (creator) {
                 payload.creator = creator;
+                if (creator.username !== 'sd:scheduler') {
+                    payload.creator.username = username;
+                }
             } else if (scope.includes('pipeline')) {
                 payload.creator = {
                     name: 'Pipeline Access Token', // Display name
diff --git a/test/plugins/events.test.js b/test/plugins/events.test.js
index c0d721eef..79dffa657 100644
--- a/test/plugins/events.test.js
+++ b/test/plugins/events.test.js
@@ -416,11 +416,11 @@ describe('event plugin test', () => {
             });
         });
 
-        it('returns 201 when it successfully creates an event with causeMessage and creator passed in', () => {
+        it('returns 201 when it successfully creates an event with causeMessage and scheduler creator passed in', () => {
             delete options.payload.parentBuildId;
             delete eventConfig.parentBuildId;
             eventConfig.causeMessage = 'Started by periodic build scheduler';
-            eventConfig.creator = { name: 'Screwdriver scheduler', username: 'scheduler' };
+            eventConfig.creator = { name: 'Screwdriver scheduler', username: 'sd:scheduler' };
             eventConfig.meta = {};
             options.payload = {
                 pipelineId,
@@ -428,7 +428,38 @@ describe('event plugin test', () => {
                 causeMessage: 'Started by periodic build scheduler',
                 creator: {
                     name: 'Screwdriver scheduler',
-                    username: 'scheduler'
+                    username: 'sd:scheduler'
+                }
+            };
+
+            return server.inject(options).then(reply => {
+                expectedLocation = {
+                    host: reply.request.headers.host,
+                    port: reply.request.headers.port,
+                    protocol: reply.request.server.info.protocol,
+                    pathname: `${options.url}/12345`
+                };
+                assert.equal(reply.statusCode, 201);
+                assert.calledWith(eventFactoryMock.create, eventConfig);
+                assert.strictEqual(reply.headers.location, urlLib.format(expectedLocation));
+                assert.calledWith(eventFactoryMock.scm.getCommitSha, scmConfig);
+                assert.notCalled(eventFactoryMock.scm.getPrInfo);
+            });
+        });
+
+        it('returns 201 when it successfully creates an event with creator passed in not overwrite username', () => {
+            delete options.payload.parentBuildId;
+            delete eventConfig.parentBuildId;
+            eventConfig.causeMessage = 'Manually Started by foobar';
+            eventConfig.creator = { name: 'foo bar', username: 'myself' };
+            eventConfig.meta = {};
+            options.payload = {
+                pipelineId,
+                startFrom: '~commit',
+                causeMessage: 'Manually Started by foobar',
+                creator: {
+                    name: 'foo bar',
+                    username: 'foobar'
                 }
             };