From 07efa3a8d87d9cd80f960acdb62b237dc3fd0cc1 Mon Sep 17 00:00:00 2001
From: Dominika Zemanovicova <dzemanov@redhat.com>
Date: Tue, 17 Dec 2024 13:39:23 +0100
Subject: [PATCH] Put /services/:serviceId under resources permission

Signed-off-by: Dominika Zemanovicova <dzemanov@redhat.com>
---
 .changeset/real-foxes-film.md                         |  2 +-
 .../src/service/KubernetesBuilder.test.ts             |  1 -
 .../src/service/KubernetesBuilder.ts                  |  4 ++--
 plugins/kubernetes-common/report.api.md               |  3 ---
 plugins/kubernetes-common/src/index.ts                |  1 -
 plugins/kubernetes-common/src/permissions.ts          | 11 +----------
 6 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/.changeset/real-foxes-film.md b/.changeset/real-foxes-film.md
index 5fabbacd9e..d32585ea7f 100644
--- a/.changeset/real-foxes-film.md
+++ b/.changeset/real-foxes-film.md
@@ -4,5 +4,5 @@
 ---
 
 The `/clusters` endpoint is now protected by the `kubernetes.clusters` permission.
-The `/services` endpoint is now protected by the `kubernetes.services` permission.
+The `/services/:serviceId` endpoint is now protected by the `kubernetes.resources` permission.
 The `/resources` endpoints are now protected by the `kubernetes.resources` permission.
diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts
index 145c9e6a06..8814e729a6 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts
@@ -796,7 +796,6 @@ metadata:
       permissions: [
         { type: 'basic', name: 'kubernetes.proxy', attributes: {} },
         { type: 'basic', name: 'kubernetes.resources', attributes: {} },
-        { type: 'basic', name: 'kubernetes.services', attributes: {} },
         { type: 'basic', name: 'kubernetes.clusters', attributes: {} },
       ],
       rules: [],
diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts
index a8b1deaa9c..de301b7969 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts
@@ -20,7 +20,7 @@ import {
   ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,
   kubernetesClustersPermission,
   kubernetesPermissions,
-  kubernetesServicesPermission,
+  kubernetesResourcesPermission,
 } from '@backstage/plugin-kubernetes-common';
 import { PermissionEvaluator } from '@backstage/plugin-permission-common';
 import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
@@ -398,7 +398,7 @@ export class KubernetesBuilder {
     router.post('/services/:serviceId', async (req, res) => {
       await requirePermission(
         permissionApi,
-        kubernetesServicesPermission,
+        kubernetesResourcesPermission,
         httpAuth,
         req,
       );
diff --git a/plugins/kubernetes-common/report.api.md b/plugins/kubernetes-common/report.api.md
index 079169d8ab..b7a5e68ea2 100644
--- a/plugins/kubernetes-common/report.api.md
+++ b/plugins/kubernetes-common/report.api.md
@@ -353,9 +353,6 @@ export interface KubernetesRequestBody {
 // @public
 export const kubernetesResourcesPermission: BasicPermission;
 
-// @public
-export const kubernetesServicesPermission: BasicPermission;
-
 // @public (undocumented)
 export interface LimitRangeFetchResponse {
   // (undocumented)
diff --git a/plugins/kubernetes-common/src/index.ts b/plugins/kubernetes-common/src/index.ts
index d6e97dc8e6..d8eaaaf083 100644
--- a/plugins/kubernetes-common/src/index.ts
+++ b/plugins/kubernetes-common/src/index.ts
@@ -27,7 +27,6 @@ export {
   kubernetesProxyPermission,
   kubernetesClustersPermission,
   kubernetesResourcesPermission,
-  kubernetesServicesPermission,
   kubernetesPermissions,
 } from './permissions';
 export * from './error-detection';
diff --git a/plugins/kubernetes-common/src/permissions.ts b/plugins/kubernetes-common/src/permissions.ts
index 7c7a087dc5..7e57d93c93 100644
--- a/plugins/kubernetes-common/src/permissions.ts
+++ b/plugins/kubernetes-common/src/permissions.ts
@@ -24,7 +24,7 @@ export const kubernetesProxyPermission = createPermission({
   attributes: {},
 });
 
-/** This permission is used to check access to the /resources endpoints
+/** This permission is used to check access to the /resources and /services/:serviceId endpoints
  * @public
  */
 export const kubernetesResourcesPermission = createPermission({
@@ -32,14 +32,6 @@ export const kubernetesResourcesPermission = createPermission({
   attributes: {},
 });
 
-/** This permission is used to check access to the /services endpoint
- * @public
- */
-export const kubernetesServicesPermission = createPermission({
-  name: 'kubernetes.services',
-  attributes: {},
-});
-
 /** This permission is used to check access to the /clusters endpoint
  * @public
  */
@@ -55,6 +47,5 @@ export const kubernetesClustersPermission = createPermission({
 export const kubernetesPermissions = [
   kubernetesProxyPermission,
   kubernetesResourcesPermission,
-  kubernetesServicesPermission,
   kubernetesClustersPermission,
 ];