fix(3123): Restrict overwriting username on create Event

plugins/events/create.js

@@ -79,6 +79,9 @@ module.exports = () => ({
 
             if (creator) {
                 payload.creator = creator;
+                if (creator.username !== 'sd:scheduler') {
+                    payload.creator.username = username;
+                }
             } else if (scope.includes('pipeline')) {
                 payload.creator = {
                     name: 'Pipeline Access Token', // Display name

test/plugins/events.test.js

@@ -416,19 +416,50 @@ describe('event plugin test', () => {
             });
         });
 
-        it('returns 201 when it successfully creates an event with causeMessage and creator passed in', () => {
+        it('returns 201 when it successfully creates an event with causeMessage and scheduler creator passed in', () => {
             delete options.payload.parentBuildId;
             delete eventConfig.parentBuildId;
             eventConfig.causeMessage = 'Started by periodic build scheduler';
-            eventConfig.creator = { name: 'Screwdriver scheduler', username: 'scheduler' };
+            eventConfig.creator = { name: 'Screwdriver scheduler', username: 'sd:scheduler' };
             eventConfig.meta = {};
             options.payload = {
                 pipelineId,
                 startFrom: '~commit',
                 causeMessage: 'Started by periodic build scheduler',
                 creator: {
                     name: 'Screwdriver scheduler',
-                    username: 'scheduler'
+                    username: 'sd:scheduler'
+                }
+            };
+
+            return server.inject(options).then(reply => {
+                expectedLocation = {
+                    host: reply.request.headers.host,
+                    port: reply.request.headers.port,
+                    protocol: reply.request.server.info.protocol,
+                    pathname: `${options.url}/12345`
+                };
+                assert.equal(reply.statusCode, 201);
+                assert.calledWith(eventFactoryMock.create, eventConfig);
+                assert.strictEqual(reply.headers.location, urlLib.format(expectedLocation));
+                assert.calledWith(eventFactoryMock.scm.getCommitSha, scmConfig);
+                assert.notCalled(eventFactoryMock.scm.getPrInfo);
+            });
+        });
+
+        it('returns 201 when it successfully creates an event with creator passed in not overwrite username', () => {
+            delete options.payload.parentBuildId;
+            delete eventConfig.parentBuildId;
+            eventConfig.causeMessage = 'Manually Started by foobar';
+            eventConfig.creator = { name: 'foo bar', username: 'myself' };
+            eventConfig.meta = {};
+            options.payload = {
+                pipelineId,
+                startFrom: '~commit',
+                causeMessage: 'Manually Started by foobar',
+                creator: {
+                    name: 'foo bar',
+                    username: 'foobar'
                 }
             };