Merge remote-tracking branch 'origin/master' into allyourbaseimage

endpoints/api.py

@@ -1157,6 +1157,7 @@ def build_status_view(build_obj):
     'started': build_obj.started,
     'display_name': build_obj.display_name,
     'status': status,
+    'resource_key': build_obj.resource_key
   }
 
 
@@ -1221,6 +1222,14 @@ def request_repo_build(namespace, repository):
     logger.debug('User requested repository initialization.')
     dockerfile_id = request.get_json()['file_id']
 
+    # Check if the dockerfile resource has already been used. If so, then it can only be reused if the
+    # user has access to the repository for which it was used.
+    associated_repository = model.get_repository_for_resource(dockerfile_id)
+    if associated_repository:
+      if not ModifyRepositoryPermission(associated_repository.namespace, associated_repository.name):
+        abort(403)
+
+    # Start the build.
     repo = model.get_repository(namespace, repository)
     token = model.create_access_token(repo, 'write')
     display_name = user_files.get_file_checksum(dockerfile_id)