(feature): remove integration router and use catalog resource type since we use the same resources required by the catalog entity

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>

plugins/jenkins-backend/src/permissions/conditionExports.ts

@@ -15,11 +15,11 @@
  */
 import { jenkinsPermissionRules } from './rules';
 import { createConditionExports } from '@backstage/plugin-permission-node';
-import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
 
 const { conditions, createPolicyDecision } = createConditionExports({
   pluginId: 'jenkins',
-  resourceType: RESOURCE_TYPE_JENKINS,
+  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
   rules: jenkinsPermissionRules,
 });
 

plugins/jenkins-backend/src/permissions/permission-router-factory.ts

@@ -1,40 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
-import { jenkinsPermissionRules } from './rules';
-import { parseEntityRef } from '@backstage/catalog-model';
-import type { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { CatalogClient } from '@backstage/catalog-client';
-import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
-
-export const jenkinsPermissionIntegrationRouterFactory = (
-  discoveryApi: PluginEndpointDiscovery,
-  fetchApi?: { fetch: typeof fetch },
-) => {
-  const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi });
-  return createPermissionIntegrationRouter({
-    resourceType: RESOURCE_TYPE_JENKINS,
-    rules: Object.values(jenkinsPermissionRules),
-    getResources: resourceRefs => {
-      const entities = resourceRefs.map(async resourceRef => {
-        const { kind, namespace, name } = parseEntityRef(resourceRef);
-        return catalogApi.getEntityByName({ kind, name, namespace });
-      });
-      // combine the promises to return entities as any array, getResources expects a single promise with all entities
-      return Promise.all(entities);
-    },
-  });
-};

plugins/jenkins-backend/src/service/jenkinsApi.test.ts

@@ -18,6 +18,8 @@ import { JenkinsApiImpl } from './jenkinsApi';
 import jenkins from 'jenkins';
 import { JenkinsInfo } from './jenkinsInfoProvider';
 import { JenkinsBuild, JenkinsProject } from '../types';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
+import { NotAllowedError } from '@backstage/errors';
 
 jest.mock('jenkins');
 const mockedJenkinsClient = {
@@ -40,8 +42,16 @@ const jenkinsInfo: JenkinsInfo = {
   jobFullName: 'example-jobName',
 };
 
+const fakePermissionApi = {
+  authorize: jest.fn().mockResolvedValue([
+    {
+      result: AuthorizeResult.ALLOW,
+    },
+  ]),
+};
+
 describe('JenkinsApi', () => {
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(fakePermissionApi);
 
   describe('getProjects', () => {
     const project: JenkinsProject = {
@@ -413,6 +423,34 @@ describe('JenkinsApi', () => {
     expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
   });
 
+  it('buildProject should fail if it does not have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.DENY,
+      },
+    ]);
+
+    await expect(() =>
+      jenkinsApi.buildProject(jenkinsInfo, jobFullName),
+    ).rejects.toThrow(NotAllowedError);
+  });
+
+  it('buildProject should success if it have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.ALLOW,
+      },
+    ]);
+
+    await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+    expect(mockedJenkins).toHaveBeenCalledWith({
+      baseUrl: jenkinsInfo.baseUrl,
+      headers: jenkinsInfo.headers,
+      promisify: true,
+    });
+    expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
+  });
+
   it('buildProject with crumbIssuer option', async () => {
     const info: JenkinsInfo = { ...jenkinsInfo, crumbIssuer: true };
     await jenkinsApi.buildProject(info, jobFullName);

plugins/jenkins-backend/src/service/jenkinsApi.ts

@@ -23,6 +23,12 @@ import {
   JenkinsProject,
   ScmDetails,
 } from '../types';
+import {
+  AuthorizeResult,
+  PermissionAuthorizer,
+} from '@backstage/plugin-permission-common';
+import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common';
+import { NotAllowedError } from '@backstage/errors';
 
 export class JenkinsApiImpl {
   private static readonly lastBuildTreeSpec = `lastBuild[
@@ -58,6 +64,8 @@ export class JenkinsApiImpl {
                    ${JenkinsApiImpl.jobTreeSpec}
                  ]{0,50}`;
 
+  constructor(private readonly permissionApi?: PermissionAuthorizer) {}
+
   /**
    * Get a list of projects for the given JenkinsInfo.
    * @see ../../../jenkins/src/api/JenkinsApi.ts#getProjects
@@ -128,9 +136,25 @@ export class JenkinsApiImpl {
    * Trigger a build of a project
    * @see ../../../jenkins/src/api/JenkinsApi.ts#retry
    */
-  async buildProject(jenkinsInfo: JenkinsInfo, jobFullName: string) {
+  async buildProject(
+    jenkinsInfo: JenkinsInfo,
+    jobFullName: string,
+    options?: { token?: string },
+  ) {
     const client = await JenkinsApiImpl.getClient(jenkinsInfo);
 
+    if (this.permissionApi) {
+      const response = await this.permissionApi.authorize(
+        [{ permission: jenkinsExecutePermission }],
+        { token: options?.token },
+      );
+      // permission api returns always at least one item, we need to check only one result since we do not expect any additional results
+      const { result } = response[0];
+      if (result === AuthorizeResult.DENY) {
+        throw new NotAllowedError();
+      }
+    }
+
     // looks like the current SDK only supports triggering a new build
     // can't see any support for replay (re-running the specific build with the same SCM info)
 

plugins/jenkins-backend/src/service/router.ts

@@ -24,7 +24,8 @@ import { Logger } from 'winston';
 import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
 import { Config } from '@backstage/config';
-import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
 
 export interface RouterOptions {
   logger: Logger;
@@ -32,6 +33,7 @@ export interface RouterOptions {
   config?: Config;
   discovery?: PluginEndpointDiscovery;
   fetchApi?: { fetch: typeof fetch };
+  permissions?: PermissionAuthorizer;
 }
 
 export async function createRouter(
@@ -39,7 +41,7 @@ export async function createRouter(
 ): Promise<express.Router> {
   const { jenkinsInfoProvider } = options;
 
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(options.permissions);
 
   const router = Router();
   router.use(express.json());
@@ -111,7 +113,6 @@ export async function createRouter(
     '/v1/entity/:namespace/:kind/:name/job/:jobFullName/:buildNumber::rebuild',
     async (request, response) => {
       const { namespace, kind, name, jobFullName } = request.params;
-
       const jenkinsInfo = await jenkinsInfoProvider.getInstance({
         entityRef: {
           kind,
@@ -120,23 +121,14 @@ export async function createRouter(
         },
         jobFullName,
       });
+      const token = getBearerTokenFromAuthorizationHeader(
+        request.header('authorization'),
+      );
 
-      await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+      await jenkinsApi.buildProject(jenkinsInfo, jobFullName, { token });
       response.json({});
     },
   );
   router.use(errorHandler());
-
-  if (options.config?.getOptionalBoolean('permission.enabled')) {
-    if (!options.discovery) {
-      throw new Error('Discovery API is required if permissions are enabled.');
-    }
-    router.use(
-      jenkinsPermissionIntegrationRouterFactory(
-        options.discovery,
-        options.fetchApi,
-      ),
-    );
-  }
   return router;
 }