Implement log access settings

Author: AndriiMysko

lib/travis.rb

@@ -31,6 +31,8 @@ class GithubApiError    < StandardError; end
   class AdminMissing      < StandardError; end
   class RepositoryMissing < StandardError; end
   class LogAlreadyRemoved < StandardError; end
+  class LogExpired        < StandardError; end
+  class LogAccessDenied   < StandardError; end
   class AuthorizationDenied < StandardError; end
   class JobUnfinished     < StandardError; end
 

lib/travis/api/v3.rb

@@ -39,6 +39,8 @@ def location(env)
       JobNotCancelable    = ClientError        .create('job is not running, cannot cancel', status: 409)
       JobUnfinished       = ClientError        .create('job still running, cannot remove log yet', status: 409)
       LogAlreadyRemoved   = ClientError        .create('log has already been removed', status: 409)
+      LogExpired          = ClientError        .create("We're sorry, but this data is not available anymore. Please check the repository settings in Travis CI.", status: 403)
+      LogAccessDenied     = ClientError        .create("We're sorry, but this data is not available. Please check the repository settings in Travis CI.", status: 403)
       LoginRequired       = ClientError        .create('login required', status: 403)
       MethodNotAllowed    = ClientError        .create('method not allowed', status: 405)
       NotImplemented      = ServerError        .create('request not (yet) implemented', status: 501)

lib/travis/api/v3/models/user_settings.rb

@@ -12,6 +12,9 @@ class Models::UserSettings < Models::JsonSlice
     attribute :config_validation, Boolean, default: lambda { |us, _| us.config_validation? }
     attribute :share_encrypted_env_with_forks, Boolean, default: false
     attribute :share_ssh_keys_with_forks, Boolean, default: lambda { |us, _| us.share_ssh_keys_with_forks? }
+    attribute :job_log_time_based_limit, Boolean, default: lambda { |s, _| s.job_log_access_permissions[:time_based_limit] }
+    attribute :job_log_access_based_limit, Boolean, default: lambda { |s, _| s.job_log_access_permissions[:access_based_limit] }
+    attribute :job_log_access_older_than_days, Integer, default: lambda { |s, _| s.job_log_access_permissions[:older_than_days] }
 
     attr_reader :repo
 
@@ -57,5 +60,9 @@ def cutoff_date
     def days_since_jan_15
       Date.today.mjd - JAN_15.mjd + 1
     end
+
+    def job_log_access_permissions
+      Travis.config.to_h.fetch(:job_log_access_permissions) { {} }
+    end
   end
 end

lib/travis/api/v3/queries/log.rb

@@ -1,11 +1,14 @@
 module Travis::API::V3
   class Queries::Log < RemoteQuery
-    def find_by_job_id(job_id)
-      find Models::Job.find(job_id)
+    def find_by_job_id(repo_can_write, job_id)
+      find repo_can_write, Models::Job.find(job_id)
     end
 
-    def find(job)
+    def find(repo_can_write, job)
       @job = job
+      raise LogExpired if !job.repository.user_settings.job_log_time_based_limit && job.started_at < Time.now - job.repository.user_settings.job_log_access_older_than_days.days
+      raise LogAccessDenied if job.repository.user_settings.job_log_access_based_limit && !repo_can_write
+
       remote_log = Travis::RemoteLog::Remote.new(platform: platform).find_by_job_id(platform_job_id)
       raise EntityMissing, 'log not found'.freeze if remote_log.nil?
       log = Travis::API::V3::Models::Log.new(remote_log: remote_log, job: job)

lib/travis/api/v3/services/log/find.rb

@@ -3,7 +3,10 @@ class Services::Log::Find < Service
     params 'log.token'
 
     def run!
-      log = query.find_by_job_id(params['job.id'])
+      job = Models::Job.find(params['job.id'])
+      repo_can_write = !!job.repository.users.where(id: access_control.user.id, permissions: { push: true }).first
+
+      log = query.find(repo_can_write, job)
       raise(NotFound, :log) unless access_control.visible? log
       result log
     end

lib/travis/config/defaults.rb

@@ -88,7 +88,8 @@ def fallback_logs_api_auth_token
             force_authentication: false,
             yml:                  { url: 'https://yml.travis-ci.org', token: 'secret', auth_key: 'abc123' },
             read_only:            ENV['READ_ONLY'] || false,
-            vcs: {}
+            vcs: {},
+            job_log_access_permissions: { time_based_limit: false, access_based_limit: false, older_than_days: 365, max_days_value: 730, min_days_value: 30 }
 
     default :_access => [:key]
 

lib/travis/model/repository/settings.rb

@@ -101,13 +101,20 @@ def custom_timeouts?(settings)
   attribute :allow_config_imports, Boolean, default: false
   attribute :share_encrypted_env_with_forks, Boolean, default: false
   attribute :share_ssh_keys_with_forks, Boolean, default: nil
+  attribute :job_log_time_based_limit, Boolean, default: lambda { |s, _| s.job_log_access_permissions[:time_based_limit] }
+  attribute :job_log_access_based_limit, Boolean, default: lambda { |s, _| s.job_log_access_permissions[:access_based_limit] }
+  attribute :job_log_access_older_than_days, Integer, default: lambda { |s, _| s.job_log_access_permissions[:older_than_days] }
 
   validates :maximum_number_of_builds, numericality: true
 
   validate :api_builds_rate_limit_restriction
 
   validates_with TimeoutsValidator
 
+  def job_log_access_permissions
+    Travis.config.to_h.fetch(:job_log_access_permissions) { {} }
+  end
+
   def auto_cancel_default?
     ENV.fetch('AUTO_CANCEL_DEFAULT', 'false') == 'true'
   end