Change to store the pull robot on the repository build and only add the credentials to the queue item. This prevents the credentials from being exposed to the end user. Also fixes the restart build option

endpoints/api/build.py

@@ -10,8 +10,10 @@ from endpoints.api import (RepositoryParamResource, parse_args, query_param, nic
 from endpoints.common import start_build
 from endpoints.trigger import BuildTrigger
 from data import model
-from auth.permissions import ModifyRepositoryPermission
+from auth.auth_context import get_authenticated_user
+from auth.permissions import ModifyRepositoryPermission, AdministerOrganizationPermission
 from data.buildlogs import BuildStatusRetrievalError
+from util.names import parse_robot_username
 
 
 logger = logging.getLogger(__name__)
@@ -33,13 +35,14 @@ def get_job_config(build_obj):
     return None
 
 
+def user_view(user):
+  return {
+    'name': user.username,
+    'kind': 'user',
+    'is_robot': user.robot,
+  }
+
 def trigger_view(trigger):
-  def user_view(user):
-    return {
-      'name': user.username,
-      'kind': 'user',
-      'is_robot': user.robot,
-    }
 
   if trigger and trigger.uuid:  
     config_dict = get_trigger_config(trigger)
@@ -50,7 +53,7 @@ def trigger_view(trigger):
       'id': trigger.uuid,
       'connected_user': trigger.connected_user.username,
       'is_active': build_trigger.is_active(config_dict),
-      'pull_user': user_view(trigger.pull_user) if trigger.pull_user else None
+      'pull_robot': user_view(trigger.pull_robot) if trigger.pull_robot else None
     }
 
   return None
@@ -75,6 +78,7 @@ def build_status_view(build_obj, can_write=False):
     'is_writer': can_write,
     'trigger': trigger_view(build_obj.trigger),
     'resource_key': build_obj.resource_key,
+    'pull_robot': user_view(build_obj.pull_robot) if build_obj.pull_robot else None,
   }
 
   if can_write:
@@ -103,28 +107,9 @@ class RepositoryBuildList(RepositoryParamResource):
           'type': 'string',
           'description': 'Subdirectory in which the Dockerfile can be found',
         },
-        'pull_credentials': {
-          'type': 'object',
-          'description': 'Credentials used by the builder when pulling images',
-          'required': [
-            'username',
-            'password',
-            'registry'
-          ],
-          'properties': {
-            'username': {
-              'type': 'string',
-              'description': 'The username for the pull'
-            },
-            'password': {
-              'type': 'string',
-              'description': 'The password for the pull'
-            },
-            'registry': {
-              'type': 'string',
-              'description': 'The registry hostname for the pull'
-            },
-          }
+        'pull_robot': {
+          'type': 'string',
+          'description': 'Username of a Quay robot account to use as pull credentials',
         }
       },
     },
@@ -154,7 +139,22 @@ class RepositoryBuildList(RepositoryParamResource):
 
     dockerfile_id = request_json['file_id']
     subdir = request_json['subdirectory'] if 'subdirectory' in request_json else ''
-    pull_credentials = request_json.get('pull_credentials', None)
+    pull_robot_name = request_json.get('pull_robot', None)
+
+    # Verify the security behind the pull robot.
+    if pull_robot_name:
+      result = parse_robot_username(pull_robot_name)
+      if result:
+        pull_robot = model.lookup_robot(pull_robot_name)
+        if not pull_robot:
+          raise NotFound()
+
+        # Make sure the user has administer permissions for the robot's namespace.
+        (robot_namespace, shortname) = result
+        if not AdministerOrganizationPermission(robot_namespace).can():
+          raise Unauthorized()
+      else:
+        raise Unauthorized()
 
     # Check if the dockerfile resource has already been used. If so, then it
     # can only be reused if the user has access to the repository for which it
@@ -170,7 +170,7 @@ class RepositoryBuildList(RepositoryParamResource):
     display_name = user_files.get_file_checksum(dockerfile_id)
 
     build_request = start_build(repo, dockerfile_id, ['latest'], display_name, subdir, True,
-                                pull_credentials=pull_credentials)
+                                pull_robot_name=pull_robot_name)
 
     resp = build_status_view(build_request, True)
     repo_string = '%s/%s' % (namespace, repository)