(feature): remove integration router and use catalog resource type since we use the same resources required by the catalog entity

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>

plugins/jenkins-backend/api-report.md

@@ -12,6 +12,7 @@ import { Entity } from '@backstage/catalog-model';
 import { EntityName } from '@backstage/catalog-model';
 import express from 'express';
 import { Logger as Logger_2 } from 'winston';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 import { PermissionCondition } from '@backstage/plugin-permission-common';
 import { PermissionCriteria } from '@backstage/plugin-permission-common';
 import { PermissionRule } from '@backstage/plugin-permission-node';
@@ -140,5 +141,7 @@ export interface RouterOptions {
   jenkinsInfoProvider: JenkinsInfoProvider;
   // (undocumented)
   logger: Logger_2;
+  // (undocumented)
+  permissions?: PermissionAuthorizer;
 }
 ```

plugins/jenkins-backend/package.json

@@ -29,8 +29,12 @@
     "@backstage/catalog-client": "^0.7.2",
     "@backstage/catalog-model": "^0.11.0",
     "@backstage/config": "^0.1.15",
+    "@backstage/errors": "^0.2.2",
+    "@backstage/plugin-auth-node": "^0.1.3",
     "@backstage/plugin-catalog-backend": "^0.22.0",
+    "@backstage/plugin-catalog-common": "^0.1.4",
     "@backstage/plugin-jenkins-common": "^0.1.0",
+    "@backstage/plugin-permission-common": "^0.5.1",
     "@backstage/plugin-permission-node": "^0.5.2",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",

plugins/jenkins-backend/src/permissions/conditionExports.ts

@@ -15,11 +15,11 @@
  */
 import { jenkinsPermissionRules } from './rules';
 import { createConditionExports } from '@backstage/plugin-permission-node';
-import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
 
 const { conditions, createPolicyDecision } = createConditionExports({
   pluginId: 'jenkins',
-  resourceType: RESOURCE_TYPE_JENKINS,
+  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
   rules: jenkinsPermissionRules,
 });
 

plugins/jenkins-backend/src/permissions/permission-router-factory.ts

@@ -1,40 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
-import { jenkinsPermissionRules } from './rules';
-import { parseEntityRef } from '@backstage/catalog-model';
-import type { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { CatalogClient } from '@backstage/catalog-client';
-import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
-
-export const jenkinsPermissionIntegrationRouterFactory = (
-  discoveryApi: PluginEndpointDiscovery,
-  fetchApi?: { fetch: typeof fetch },
-) => {
-  const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi });
-  return createPermissionIntegrationRouter({
-    resourceType: RESOURCE_TYPE_JENKINS,
-    rules: Object.values(jenkinsPermissionRules),
-    getResources: resourceRefs => {
-      const entities = resourceRefs.map(async resourceRef => {
-        const { kind, namespace, name } = parseEntityRef(resourceRef);
-        return catalogApi.getEntityByName({ kind, name, namespace });
-      });
-      // combine the promises to return entities as any array, getResources expects a single promise with all entities
-      return Promise.all(entities);
-    },
-  });
-};

plugins/jenkins-backend/src/service/jenkinsApi.test.ts

@@ -18,6 +18,8 @@ import { JenkinsApiImpl } from './jenkinsApi';
 import jenkins from 'jenkins';
 import { JenkinsInfo } from './jenkinsInfoProvider';
 import { JenkinsBuild, JenkinsProject } from '../types';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
+import { NotAllowedError } from '@backstage/errors';
 
 jest.mock('jenkins');
 const mockedJenkinsClient = {
@@ -40,8 +42,16 @@ const jenkinsInfo: JenkinsInfo = {
   jobFullName: 'example-jobName',
 };
 
+const fakePermissionApi = {
+  authorize: jest.fn().mockResolvedValue([
+    {
+      result: AuthorizeResult.ALLOW,
+    },
+  ]),
+};
+
 describe('JenkinsApi', () => {
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(fakePermissionApi);
 
   describe('getProjects', () => {
     const project: JenkinsProject = {
@@ -413,6 +423,34 @@ describe('JenkinsApi', () => {
     expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
   });
 
+  it('buildProject should fail if it does not have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.DENY,
+      },
+    ]);
+
+    await expect(() =>
+      jenkinsApi.buildProject(jenkinsInfo, jobFullName),
+    ).rejects.toThrow(NotAllowedError);
+  });
+
+  it('buildProject should success if it have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.ALLOW,
+      },
+    ]);
+
+    await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+    expect(mockedJenkins).toHaveBeenCalledWith({
+      baseUrl: jenkinsInfo.baseUrl,
+      headers: jenkinsInfo.headers,
+      promisify: true,
+    });
+    expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
+  });
+
   it('buildProject with crumbIssuer option', async () => {
     const info: JenkinsInfo = { ...jenkinsInfo, crumbIssuer: true };
     await jenkinsApi.buildProject(info, jobFullName);

plugins/jenkins-backend/src/service/jenkinsApi.ts

@@ -23,6 +23,12 @@ import {
   JenkinsProject,
   ScmDetails,
 } from '../types';
+import {
+  AuthorizeResult,
+  PermissionAuthorizer,
+} from '@backstage/plugin-permission-common';
+import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common';
+import { NotAllowedError } from '@backstage/errors';
 
 export class JenkinsApiImpl {
   private static readonly lastBuildTreeSpec = `lastBuild[
@@ -58,6 +64,8 @@ export class JenkinsApiImpl {
                    ${JenkinsApiImpl.jobTreeSpec}
                  ]{0,50}`;
 
+  constructor(private readonly permissionApi?: PermissionAuthorizer) {}
+
   /**
    * Get a list of projects for the given JenkinsInfo.
    * @see ../../../jenkins/src/api/JenkinsApi.ts#getProjects
@@ -128,9 +136,25 @@ export class JenkinsApiImpl {
    * Trigger a build of a project
    * @see ../../../jenkins/src/api/JenkinsApi.ts#retry
    */
-  async buildProject(jenkinsInfo: JenkinsInfo, jobFullName: string) {
+  async buildProject(
+    jenkinsInfo: JenkinsInfo,
+    jobFullName: string,
+    options?: { token?: string },
+  ) {
     const client = await JenkinsApiImpl.getClient(jenkinsInfo);
 
+    if (this.permissionApi) {
+      const response = await this.permissionApi.authorize(
+        [{ permission: jenkinsExecutePermission }],
+        { token: options?.token },
+      );
+      // permission api returns always at least one item, we need to check only one result since we do not expect any additional results
+      const { result } = response[0];
+      if (result === AuthorizeResult.DENY) {
+        throw new NotAllowedError();
+      }
+    }
+
     // looks like the current SDK only supports triggering a new build
     // can't see any support for replay (re-running the specific build with the same SCM info)
 

plugins/jenkins-backend/src/service/router.ts

@@ -24,7 +24,8 @@ import { Logger } from 'winston';
 import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
 import { Config } from '@backstage/config';
-import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
 
 export interface RouterOptions {
   logger: Logger;
@@ -32,6 +33,7 @@ export interface RouterOptions {
   config?: Config;
   discovery?: PluginEndpointDiscovery;
   fetchApi?: { fetch: typeof fetch };
+  permissions?: PermissionAuthorizer;
 }
 
 export async function createRouter(
@@ -39,7 +41,7 @@ export async function createRouter(
 ): Promise<express.Router> {
   const { jenkinsInfoProvider } = options;
 
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(options.permissions);
 
   const router = Router();
   router.use(express.json());
@@ -111,7 +113,6 @@ export async function createRouter(
     '/v1/entity/:namespace/:kind/:name/job/:jobFullName/:buildNumber::rebuild',
     async (request, response) => {
       const { namespace, kind, name, jobFullName } = request.params;
-
       const jenkinsInfo = await jenkinsInfoProvider.getInstance({
         entityRef: {
           kind,
@@ -120,23 +121,14 @@ export async function createRouter(
         },
         jobFullName,
       });
+      const token = getBearerTokenFromAuthorizationHeader(
+        request.header('authorization'),
+      );
 
-      await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+      await jenkinsApi.buildProject(jenkinsInfo, jobFullName, { token });
       response.json({});
     },
   );
   router.use(errorHandler());
-
-  if (options.config?.getOptionalBoolean('permission.enabled')) {
-    if (!options.discovery) {
-      throw new Error('Discovery API is required if permissions are enabled.');
-    }
-    router.use(
-      jenkinsPermissionIntegrationRouterFactory(
-        options.discovery,
-        options.fetchApi,
-      ),
-    );
-  }
   return router;
 }

plugins/jenkins-common/api-report.md

@@ -8,8 +8,5 @@ import { Permission } from '@backstage/plugin-permission-common';
 // @public
 export const jenkinsExecutePermission: Permission;
 
-// @public (undocumented)
-export const RESOURCE_TYPE_JENKINS = 'jenkins';
-
 // (No @packageDocumentation comment for this package)
 ```

plugins/jenkins-common/package.json

@@ -22,6 +22,7 @@
     "clean": "backstage-cli package clean"
   },
   "dependencies": {
+    "@backstage/plugin-catalog-common": "^0.1.4",
     "@backstage/plugin-permission-common": "^0.5.1"
   },
   "devDependencies": {

plugins/jenkins-common/src/permissions.ts

@@ -13,13 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
 import { Permission } from '@backstage/plugin-permission-common';
 
-/**
- * @public
- */
-export const RESOURCE_TYPE_JENKINS = 'jenkins';
-
 /**
  * This permission is used to determine if a user is allowed to execute an action in jenkins plugin
  *
@@ -30,5 +26,5 @@ export const jenkinsExecutePermission: Permission = {
   attributes: {
     action: 'update',
   },
-  resourceType: RESOURCE_TYPE_JENKINS,
+  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
 };

yarn.lock

@@ -11929,7 +11929,6 @@ evp_bytestokey@^1.0.0, evp_bytestokey@^1.0.3:
     "@backstage/plugin-graphiql" "^0.2.32"
     "@backstage/plugin-home" "^0.4.16"
     "@backstage/plugin-jenkins" "^0.6.0"
-    "@backstage/plugin-jenkins-common" "^0.1.0"
     "@backstage/plugin-kafka" "^0.3.0"
     "@backstage/plugin-kubernetes" "^0.6.0"
     "@backstage/plugin-lighthouse" "^0.3.0"