From 10974de8d9daad411ade8aa1e5a3fdc415b33718 Mon Sep 17 00:00:00 2001 From: Dominika Zemanovicova Date: Thu, 9 Jan 2025 20:10:18 +0100 Subject: [PATCH] Rename permissions Co-authored-by: Vincenzo Scamporlino Signed-off-by: Dominika Zemanovicova --- .changeset/real-foxes-film.md | 6 +++--- .../src/routes/resourcesRoutes.ts | 6 +++--- .../src/service/KubernetesBuilder.test.ts | 4 ++-- .../src/service/KubernetesBuilder.ts | 8 ++++---- .../KubernetesClusterContent.tsx | 6 +++--- plugins/kubernetes-common/report.api.md | 4 ++-- plugins/kubernetes-common/src/index.ts | 4 ++-- plugins/kubernetes-common/src/permissions.ts | 20 +++++++++++-------- .../src/RequireKubernetesPermissions.tsx | 10 +++++----- 9 files changed, 36 insertions(+), 32 deletions(-) diff --git a/.changeset/real-foxes-film.md b/.changeset/real-foxes-film.md index e7cb2d141a..16f0f0cbd9 100644 --- a/.changeset/real-foxes-film.md +++ b/.changeset/real-foxes-film.md @@ -5,6 +5,6 @@ '@backstage/plugin-kubernetes': minor --- -**BREAKING** The `/clusters` endpoint is now protected by the `kubernetes.clusters` permission. -**BREAKING** The `/services/:serviceId` endpoint is now protected by the `kubernetes.resources` permission. -**BREAKING** The `/resources` endpoints are now protected by the `kubernetes.resources` permission. +**BREAKING** The `/clusters` endpoint is now protected by the `kubernetes.clusters.read` permission. +**BREAKING** The `/services/:serviceId` endpoint is now protected by the `kubernetes.resources.read` permission. +**BREAKING** The `/resources` endpoints are now protected by the `kubernetes.resources.read` permission. diff --git a/plugins/kubernetes-backend/src/routes/resourcesRoutes.ts b/plugins/kubernetes-backend/src/routes/resourcesRoutes.ts index 6e737a1e4f..d500d3cb8b 100644 --- a/plugins/kubernetes-backend/src/routes/resourcesRoutes.ts +++ b/plugins/kubernetes-backend/src/routes/resourcesRoutes.ts @@ -25,7 +25,7 @@ import { KubernetesObjectsProvider } from '@backstage/plugin-kubernetes-node'; import { AuthService, HttpAuthService } from '@backstage/backend-plugin-api'; import { PermissionEvaluator } from '@backstage/plugin-permission-common'; import { requirePermission } from '../auth/requirePermission'; -import { kubernetesResourcesPermission } from '@backstage/plugin-kubernetes-common'; +import { kubernetesResourcesReadPermission } from '@backstage/plugin-kubernetes-common'; export const addResourceRoutesToRouter = ( router: express.Router, @@ -68,7 +68,7 @@ export const addResourceRoutesToRouter = ( router.post('/resources/workloads/query', async (req, res) => { await requirePermission( permissionApi, - kubernetesResourcesPermission, + kubernetesResourcesReadPermission, httpAuth, req, ); @@ -86,7 +86,7 @@ export const addResourceRoutesToRouter = ( router.post('/resources/custom/query', async (req, res) => { await requirePermission( permissionApi, - kubernetesResourcesPermission, + kubernetesResourcesReadPermission, httpAuth, req, ); diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts index 8814e729a6..3046232bad 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts @@ -795,8 +795,8 @@ metadata: expect(response.body).toMatchObject({ permissions: [ { type: 'basic', name: 'kubernetes.proxy', attributes: {} }, - { type: 'basic', name: 'kubernetes.resources', attributes: {} }, - { type: 'basic', name: 'kubernetes.clusters', attributes: {} }, + { type: 'basic', name: 'kubernetes.resources.read', attributes: {} }, + { type: 'basic', name: 'kubernetes.clusters.read', attributes: {} }, ], rules: [], }); diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts index de301b7969..2d2c592f53 100644 --- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts +++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts @@ -18,9 +18,9 @@ import { Config } from '@backstage/config'; import { ANNOTATION_KUBERNETES_AUTH_PROVIDER, ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER, - kubernetesClustersPermission, + kubernetesClustersReadPermission, kubernetesPermissions, - kubernetesResourcesPermission, + kubernetesResourcesReadPermission, } from '@backstage/plugin-kubernetes-common'; import { PermissionEvaluator } from '@backstage/plugin-permission-common'; import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node'; @@ -398,7 +398,7 @@ export class KubernetesBuilder { router.post('/services/:serviceId', async (req, res) => { await requirePermission( permissionApi, - kubernetesResourcesPermission, + kubernetesResourcesReadPermission, httpAuth, req, ); @@ -424,7 +424,7 @@ export class KubernetesBuilder { router.get('/clusters', async (req, res) => { await requirePermission( permissionApi, - kubernetesClustersPermission, + kubernetesClustersReadPermission, httpAuth, req, ); diff --git a/plugins/kubernetes-cluster/src/components/KubernetesClusterContent/KubernetesClusterContent.tsx b/plugins/kubernetes-cluster/src/components/KubernetesClusterContent/KubernetesClusterContent.tsx index d47e28d294..3f53f7022b 100644 --- a/plugins/kubernetes-cluster/src/components/KubernetesClusterContent/KubernetesClusterContent.tsx +++ b/plugins/kubernetes-cluster/src/components/KubernetesClusterContent/KubernetesClusterContent.tsx @@ -24,7 +24,7 @@ import { useKubernetesClusterError, } from '../KubernetesClusterErrorContext/KubernetesClusterErrorContext'; import { WarningPanel } from '@backstage/core-components'; -import { kubernetesClustersPermission } from '@backstage/plugin-kubernetes-common'; +import { kubernetesClustersReadPermission } from '@backstage/plugin-kubernetes-common'; import { RequirePermission } from '@backstage/plugin-permission-react'; const ContentGrid = () => { @@ -61,12 +61,12 @@ const ContentGrid = () => { export const KubernetesClusterContent = () => { return ( } > diff --git a/plugins/kubernetes-common/report.api.md b/plugins/kubernetes-common/report.api.md index b7a5e68ea2..cc99e5063d 100644 --- a/plugins/kubernetes-common/report.api.md +++ b/plugins/kubernetes-common/report.api.md @@ -318,7 +318,7 @@ export interface JobsFetchResponse { } // @public -export const kubernetesClustersPermission: BasicPermission; +export const kubernetesClustersReadPermission: BasicPermission; // @public (undocumented) export type KubernetesErrorTypes = @@ -351,7 +351,7 @@ export interface KubernetesRequestBody { } // @public -export const kubernetesResourcesPermission: BasicPermission; +export const kubernetesResourcesReadPermission: BasicPermission; // @public (undocumented) export interface LimitRangeFetchResponse { diff --git a/plugins/kubernetes-common/src/index.ts b/plugins/kubernetes-common/src/index.ts index d8eaaaf083..8378ac8199 100644 --- a/plugins/kubernetes-common/src/index.ts +++ b/plugins/kubernetes-common/src/index.ts @@ -25,8 +25,8 @@ export * from './catalog-entity-constants'; export * from './certificate-authority-constants'; export { kubernetesProxyPermission, - kubernetesClustersPermission, - kubernetesResourcesPermission, + kubernetesClustersReadPermission, + kubernetesResourcesReadPermission, kubernetesPermissions, } from './permissions'; export * from './error-detection'; diff --git a/plugins/kubernetes-common/src/permissions.ts b/plugins/kubernetes-common/src/permissions.ts index 7e57d93c93..718251567c 100644 --- a/plugins/kubernetes-common/src/permissions.ts +++ b/plugins/kubernetes-common/src/permissions.ts @@ -27,17 +27,21 @@ export const kubernetesProxyPermission = createPermission({ /** This permission is used to check access to the /resources and /services/:serviceId endpoints * @public */ -export const kubernetesResourcesPermission = createPermission({ - name: 'kubernetes.resources', - attributes: {}, +export const kubernetesResourcesReadPermission = createPermission({ + name: 'kubernetes.resources.read', + attributes: { + action: 'read', + }, }); /** This permission is used to check access to the /clusters endpoint * @public */ -export const kubernetesClustersPermission = createPermission({ - name: 'kubernetes.clusters', - attributes: {}, +export const kubernetesClustersReadPermission = createPermission({ + name: 'kubernetes.clusters.read', + attributes: { + action: 'read', + }, }); /** @@ -46,6 +50,6 @@ export const kubernetesClustersPermission = createPermission({ */ export const kubernetesPermissions = [ kubernetesProxyPermission, - kubernetesResourcesPermission, - kubernetesClustersPermission, + kubernetesResourcesReadPermission, + kubernetesClustersReadPermission, ]; diff --git a/plugins/kubernetes/src/RequireKubernetesPermissions.tsx b/plugins/kubernetes/src/RequireKubernetesPermissions.tsx index 36f802b127..071a5aa4f9 100644 --- a/plugins/kubernetes/src/RequireKubernetesPermissions.tsx +++ b/plugins/kubernetes/src/RequireKubernetesPermissions.tsx @@ -15,8 +15,8 @@ */ import React, { ReactNode } from 'react'; import { - kubernetesClustersPermission, - kubernetesResourcesPermission, + kubernetesClustersReadPermission, + kubernetesResourcesReadPermission, } from '@backstage/plugin-kubernetes-common'; import { usePermission } from '@backstage/plugin-permission-react'; import { Content, Page, WarningPanel } from '@backstage/core-components'; @@ -29,10 +29,10 @@ export function RequireKubernetesPermissions( props: RequireKubernetesPermissionProps, ): JSX.Element | null { const kubernetesClustersPermissionResult = usePermission({ - permission: kubernetesClustersPermission, + permission: kubernetesClustersReadPermission, }); const kubernetesResourcesPermissionResult = usePermission({ - permission: kubernetesResourcesPermission, + permission: kubernetesResourcesReadPermission, }); if ( @@ -55,7 +55,7 @@ export function RequireKubernetesPermissions(