diff --git a/plugins/jenkins-backend/api-report.md b/plugins/jenkins-backend/api-report.md index 6f9ec10cf4..41bebb1061 100644 --- a/plugins/jenkins-backend/api-report.md +++ b/plugins/jenkins-backend/api-report.md @@ -12,6 +12,7 @@ import { Entity } from '@backstage/catalog-model'; import { EntityName } from '@backstage/catalog-model'; import express from 'express'; import { Logger as Logger_2 } from 'winston'; +import { PermissionAuthorizer } from '@backstage/plugin-permission-common'; import { PermissionCondition } from '@backstage/plugin-permission-common'; import { PermissionCriteria } from '@backstage/plugin-permission-common'; import { PermissionRule } from '@backstage/plugin-permission-node'; @@ -140,5 +141,7 @@ export interface RouterOptions { jenkinsInfoProvider: JenkinsInfoProvider; // (undocumented) logger: Logger_2; + // (undocumented) + permissions?: PermissionAuthorizer; } ``` diff --git a/plugins/jenkins-backend/package.json b/plugins/jenkins-backend/package.json index 72ebc1ee2b..f0659f42d8 100644 --- a/plugins/jenkins-backend/package.json +++ b/plugins/jenkins-backend/package.json @@ -29,8 +29,12 @@ "@backstage/catalog-client": "^0.7.2", "@backstage/catalog-model": "^0.11.0", "@backstage/config": "^0.1.15", + "@backstage/errors": "^0.2.2", + "@backstage/plugin-auth-node": "^0.1.3", "@backstage/plugin-catalog-backend": "^0.22.0", + "@backstage/plugin-catalog-common": "^0.1.4", "@backstage/plugin-jenkins-common": "^0.1.0", + "@backstage/plugin-permission-common": "^0.5.1", "@backstage/plugin-permission-node": "^0.5.2", "@types/express": "^4.17.6", "express": "^4.17.1", diff --git a/plugins/jenkins-backend/src/permissions/conditionExports.ts b/plugins/jenkins-backend/src/permissions/conditionExports.ts index 5266b1b091..197f2cb0ec 100644 --- a/plugins/jenkins-backend/src/permissions/conditionExports.ts +++ b/plugins/jenkins-backend/src/permissions/conditionExports.ts @@ -15,11 +15,11 @@ */ import { jenkinsPermissionRules } from './rules'; import { createConditionExports } from '@backstage/plugin-permission-node'; -import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common'; +import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common'; const { conditions, createPolicyDecision } = createConditionExports({ pluginId: 'jenkins', - resourceType: RESOURCE_TYPE_JENKINS, + resourceType: RESOURCE_TYPE_CATALOG_ENTITY, rules: jenkinsPermissionRules, }); diff --git a/plugins/jenkins-backend/src/permissions/permission-router-factory.ts b/plugins/jenkins-backend/src/permissions/permission-router-factory.ts deleted file mode 100644 index 1959eb24a7..0000000000 --- a/plugins/jenkins-backend/src/permissions/permission-router-factory.ts +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright 2022 The Backstage Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node'; -import { jenkinsPermissionRules } from './rules'; -import { parseEntityRef } from '@backstage/catalog-model'; -import type { PluginEndpointDiscovery } from '@backstage/backend-common'; -import { CatalogClient } from '@backstage/catalog-client'; -import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common'; - -export const jenkinsPermissionIntegrationRouterFactory = ( - discoveryApi: PluginEndpointDiscovery, - fetchApi?: { fetch: typeof fetch }, -) => { - const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi }); - return createPermissionIntegrationRouter({ - resourceType: RESOURCE_TYPE_JENKINS, - rules: Object.values(jenkinsPermissionRules), - getResources: resourceRefs => { - const entities = resourceRefs.map(async resourceRef => { - const { kind, namespace, name } = parseEntityRef(resourceRef); - return catalogApi.getEntityByName({ kind, name, namespace }); - }); - // combine the promises to return entities as any array, getResources expects a single promise with all entities - return Promise.all(entities); - }, - }); -}; diff --git a/plugins/jenkins-backend/src/service/jenkinsApi.test.ts b/plugins/jenkins-backend/src/service/jenkinsApi.test.ts index 683b9334bc..350ec996ca 100644 --- a/plugins/jenkins-backend/src/service/jenkinsApi.test.ts +++ b/plugins/jenkins-backend/src/service/jenkinsApi.test.ts @@ -18,6 +18,8 @@ import { JenkinsApiImpl } from './jenkinsApi'; import jenkins from 'jenkins'; import { JenkinsInfo } from './jenkinsInfoProvider'; import { JenkinsBuild, JenkinsProject } from '../types'; +import { AuthorizeResult } from '@backstage/plugin-permission-common'; +import { NotAllowedError } from '@backstage/errors'; jest.mock('jenkins'); const mockedJenkinsClient = { @@ -40,8 +42,16 @@ const jenkinsInfo: JenkinsInfo = { jobFullName: 'example-jobName', }; +const fakePermissionApi = { + authorize: jest.fn().mockResolvedValue([ + { + result: AuthorizeResult.ALLOW, + }, + ]), +}; + describe('JenkinsApi', () => { - const jenkinsApi = new JenkinsApiImpl(); + const jenkinsApi = new JenkinsApiImpl(fakePermissionApi); describe('getProjects', () => { const project: JenkinsProject = { @@ -413,6 +423,34 @@ describe('JenkinsApi', () => { expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName); }); + it('buildProject should fail if it does not have required permissions', async () => { + fakePermissionApi.authorize.mockResolvedValueOnce([ + { + result: AuthorizeResult.DENY, + }, + ]); + + await expect(() => + jenkinsApi.buildProject(jenkinsInfo, jobFullName), + ).rejects.toThrow(NotAllowedError); + }); + + it('buildProject should success if it have required permissions', async () => { + fakePermissionApi.authorize.mockResolvedValueOnce([ + { + result: AuthorizeResult.ALLOW, + }, + ]); + + await jenkinsApi.buildProject(jenkinsInfo, jobFullName); + expect(mockedJenkins).toHaveBeenCalledWith({ + baseUrl: jenkinsInfo.baseUrl, + headers: jenkinsInfo.headers, + promisify: true, + }); + expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName); + }); + it('buildProject with crumbIssuer option', async () => { const info: JenkinsInfo = { ...jenkinsInfo, crumbIssuer: true }; await jenkinsApi.buildProject(info, jobFullName); diff --git a/plugins/jenkins-backend/src/service/jenkinsApi.ts b/plugins/jenkins-backend/src/service/jenkinsApi.ts index 3dbba13db6..c0b1c63112 100644 --- a/plugins/jenkins-backend/src/service/jenkinsApi.ts +++ b/plugins/jenkins-backend/src/service/jenkinsApi.ts @@ -23,6 +23,12 @@ import { JenkinsProject, ScmDetails, } from '../types'; +import { + AuthorizeResult, + PermissionAuthorizer, +} from '@backstage/plugin-permission-common'; +import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common'; +import { NotAllowedError } from '@backstage/errors'; export class JenkinsApiImpl { private static readonly lastBuildTreeSpec = `lastBuild[ @@ -58,6 +64,8 @@ export class JenkinsApiImpl { ${JenkinsApiImpl.jobTreeSpec} ]{0,50}`; + constructor(private readonly permissionApi?: PermissionAuthorizer) {} + /** * Get a list of projects for the given JenkinsInfo. * @see ../../../jenkins/src/api/JenkinsApi.ts#getProjects @@ -128,9 +136,25 @@ export class JenkinsApiImpl { * Trigger a build of a project * @see ../../../jenkins/src/api/JenkinsApi.ts#retry */ - async buildProject(jenkinsInfo: JenkinsInfo, jobFullName: string) { + async buildProject( + jenkinsInfo: JenkinsInfo, + jobFullName: string, + options?: { token?: string }, + ) { const client = await JenkinsApiImpl.getClient(jenkinsInfo); + if (this.permissionApi) { + const response = await this.permissionApi.authorize( + [{ permission: jenkinsExecutePermission }], + { token: options?.token }, + ); + // permission api returns always at least one item, we need to check only one result since we do not expect any additional results + const { result } = response[0]; + if (result === AuthorizeResult.DENY) { + throw new NotAllowedError(); + } + } + // looks like the current SDK only supports triggering a new build // can't see any support for replay (re-running the specific build with the same SCM info) diff --git a/plugins/jenkins-backend/src/service/router.ts b/plugins/jenkins-backend/src/service/router.ts index 85320bb520..89d755efed 100644 --- a/plugins/jenkins-backend/src/service/router.ts +++ b/plugins/jenkins-backend/src/service/router.ts @@ -24,7 +24,8 @@ import { Logger } from 'winston'; import { JenkinsInfoProvider } from './jenkinsInfoProvider'; import { JenkinsApiImpl } from './jenkinsApi'; import { Config } from '@backstage/config'; -import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory'; +import { PermissionAuthorizer } from '@backstage/plugin-permission-common'; +import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node'; export interface RouterOptions { logger: Logger; @@ -32,6 +33,7 @@ export interface RouterOptions { config?: Config; discovery?: PluginEndpointDiscovery; fetchApi?: { fetch: typeof fetch }; + permissions?: PermissionAuthorizer; } export async function createRouter( @@ -39,7 +41,7 @@ export async function createRouter( ): Promise { const { jenkinsInfoProvider } = options; - const jenkinsApi = new JenkinsApiImpl(); + const jenkinsApi = new JenkinsApiImpl(options.permissions); const router = Router(); router.use(express.json()); @@ -111,7 +113,6 @@ export async function createRouter( '/v1/entity/:namespace/:kind/:name/job/:jobFullName/:buildNumber::rebuild', async (request, response) => { const { namespace, kind, name, jobFullName } = request.params; - const jenkinsInfo = await jenkinsInfoProvider.getInstance({ entityRef: { kind, @@ -120,23 +121,14 @@ export async function createRouter( }, jobFullName, }); + const token = getBearerTokenFromAuthorizationHeader( + request.header('authorization'), + ); - await jenkinsApi.buildProject(jenkinsInfo, jobFullName); + await jenkinsApi.buildProject(jenkinsInfo, jobFullName, { token }); response.json({}); }, ); router.use(errorHandler()); - - if (options.config?.getOptionalBoolean('permission.enabled')) { - if (!options.discovery) { - throw new Error('Discovery API is required if permissions are enabled.'); - } - router.use( - jenkinsPermissionIntegrationRouterFactory( - options.discovery, - options.fetchApi, - ), - ); - } return router; } diff --git a/plugins/jenkins-common/api-report.md b/plugins/jenkins-common/api-report.md index b63cc94374..7b0d3759ba 100644 --- a/plugins/jenkins-common/api-report.md +++ b/plugins/jenkins-common/api-report.md @@ -8,8 +8,5 @@ import { Permission } from '@backstage/plugin-permission-common'; // @public export const jenkinsExecutePermission: Permission; -// @public (undocumented) -export const RESOURCE_TYPE_JENKINS = 'jenkins'; - // (No @packageDocumentation comment for this package) ``` diff --git a/plugins/jenkins-common/package.json b/plugins/jenkins-common/package.json index 5739794197..08f12960bc 100644 --- a/plugins/jenkins-common/package.json +++ b/plugins/jenkins-common/package.json @@ -22,6 +22,7 @@ "clean": "backstage-cli package clean" }, "dependencies": { + "@backstage/plugin-catalog-common": "^0.1.4", "@backstage/plugin-permission-common": "^0.5.1" }, "devDependencies": { diff --git a/plugins/jenkins-common/src/permissions.ts b/plugins/jenkins-common/src/permissions.ts index f521e0454b..2fa8c14232 100644 --- a/plugins/jenkins-common/src/permissions.ts +++ b/plugins/jenkins-common/src/permissions.ts @@ -13,13 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common'; import { Permission } from '@backstage/plugin-permission-common'; -/** - * @public - */ -export const RESOURCE_TYPE_JENKINS = 'jenkins'; - /** * This permission is used to determine if a user is allowed to execute an action in jenkins plugin * @@ -30,5 +26,5 @@ export const jenkinsExecutePermission: Permission = { attributes: { action: 'update', }, - resourceType: RESOURCE_TYPE_JENKINS, + resourceType: RESOURCE_TYPE_CATALOG_ENTITY, }; diff --git a/yarn.lock b/yarn.lock index 17489d9bb1..997e55c9e9 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11929,7 +11929,6 @@ evp_bytestokey@^1.0.0, evp_bytestokey@^1.0.3: "@backstage/plugin-graphiql" "^0.2.32" "@backstage/plugin-home" "^0.4.16" "@backstage/plugin-jenkins" "^0.6.0" - "@backstage/plugin-jenkins-common" "^0.1.0" "@backstage/plugin-kafka" "^0.3.0" "@backstage/plugin-kubernetes" "^0.6.0" "@backstage/plugin-lighthouse" "^0.3.0"