Add user mapping for improved permission checks

Author: Taucher2003

bin/discord

@@ -110,8 +110,10 @@ bot.interaction_create do |event|
   event.defer(ephemeral: false)
 
   begin
+    user_id = event.interaction.user.id
     command = build_command_from_event(event.interaction.data)
-    SemanticLogger['DiscordBot'].info('Executing command', command: command)
+    SemanticLogger['DiscordBot'].info('Executing command', command: command, user_id: user_id)
+    ENV['DISCORD_USER_ID'] = user_id.to_s
     result = Pyxis::Cli.start(command, { debug: true })
     color = '#4caf50'
   rescue Pyxis::MessageError => e
@@ -120,6 +122,8 @@ bot.interaction_create do |event|
   rescue Thor::Error, Pyxis::Error => e
     result = "#{e.class}\n#{e.message}"
     color = '#f44336'
+  ensure
+    ENV.delete('DISCORD_USER_ID')
   end
 
   event.edit_response(embeds: [Discordrb::Webhooks::Embed.new(description: result, color: color)])

config/users.yml

@@ -0,0 +1,29 @@
+users:
+  - github: Taucher2003
+    gitlab: Taucher2003
+    discord: "444889694002741249"
+
+  - github: nicosammito
+    gitlab: nicosammito
+    discord: "456437986238791701"
+
+  - github: raphael-goetz
+    gitlab: raphael.goetz.7
+    discord: "329279009298841600"
+
+  - github: Knerio
+    gitlab: knerio
+    discord: "639416958923702292"
+
+  - github: mvriu5
+    discord: "388405725929406472"
+
+  - github: 1chroniks
+    discord: "572808505304809502"
+
+  - github: Nicuschgifthub
+    discord: "380808844093292555"
+
+  - github: code0-release-tools[bot]
+    gitlab: code0-release-tools
+    discord: "1465083247296905299"

lib/pyxis/commands/components.rb

@@ -26,6 +26,8 @@ def info
       method_option :sculptor_sha, desc: 'Commit SHA of sculptor to build', type: :string
       method_option :taurus_sha, desc: 'Commit SHA of taurus to build', type: :string
       def build
+        assert_executed_by_known_team_member!
+
         version_overrides = {
           aquila: options[:aquila_sha],
           draco: options[:draco_sha],

lib/pyxis/permission_helper.rb

@@ -13,5 +13,28 @@ def assert_executed_by_schedule!
 
       raise PermissionError, 'This operation can only be run by a pipeline schedule'
     end
+
+    def assert_executed_by_known_team_member!
+      return unless checks_active?
+      return unless find_current_user.nil?
+
+      raise PermissionError, 'This operation can only be run by a known team member'
+    end
+
+    def find_current_user
+      if ENV['GITLAB_USER_LOGIN']
+        users.find { |user| user['gitlab'] == ENV['GITLAB_USER_LOGIN'] }
+      elsif ENV['DISCORD_USER_ID']
+        users.find { |user| user['discord'] == ENV['DISCORD_USER_ID'] }
+      else
+        raise PermissionError, 'Missing data for permission checks'
+      end
+    end
+
+    private
+
+    def users
+      YAML.safe_load_file(File.absolute_path(File.join(__FILE__, '../../../config/users.yml')))['users']
+    end
   end
 end