From 23e1c17bbaccfdbcbfac39f1d17902ec536aaf68 Mon Sep 17 00:00:00 2001
From: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
Date: Sun, 27 Feb 2022 01:58:56 +0100
Subject: [PATCH 1/6] (feature): enable permissions in jenkins plugin. Actions
 (re-build) can be executed only by a user who owns the entity (or related
 group own the entity)

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
---
 .changeset/gold-garlics-sing.md               |  5 ++
 .changeset/orange-cobras-shave.md             |  6 +++
 .changeset/ten-fireants-march.md              |  5 ++
 plugins/jenkins-backend/api-report.md         | 46 +++++++++++++++++++
 plugins/jenkins-backend/package.json          |  3 ++
 plugins/jenkins-backend/src/index.ts          |  1 +
 .../src/permissions/conditionExports.ts       | 27 +++++++++++
 .../jenkins-backend/src/permissions/index.ts  | 20 ++++++++
 .../permissions/permission-router-factory.ts  | 40 ++++++++++++++++
 .../src/permissions/rules/index.ts            | 30 ++++++++++++
 plugins/jenkins-backend/src/service/router.ts | 23 +++++++++-
 plugins/jenkins-common/.eslintrc.js           |  3 ++
 plugins/jenkins-common/README.md              |  3 ++
 plugins/jenkins-common/api-report.md          | 15 ++++++
 plugins/jenkins-common/package.json           | 33 +++++++++++++
 plugins/jenkins-common/src/index.ts           | 16 +++++++
 plugins/jenkins-common/src/permissions.ts     | 34 ++++++++++++++
 plugins/jenkins/package.json                  |  1 +
 .../BuildsPage/lib/CITable/CITable.tsx        |  8 +++-
 yarn.lock                                     |  1 +
 20 files changed, 317 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/gold-garlics-sing.md
 create mode 100644 .changeset/orange-cobras-shave.md
 create mode 100644 .changeset/ten-fireants-march.md
 create mode 100644 plugins/jenkins-backend/src/permissions/conditionExports.ts
 create mode 100644 plugins/jenkins-backend/src/permissions/index.ts
 create mode 100644 plugins/jenkins-backend/src/permissions/permission-router-factory.ts
 create mode 100644 plugins/jenkins-backend/src/permissions/rules/index.ts
 create mode 100644 plugins/jenkins-common/.eslintrc.js
 create mode 100644 plugins/jenkins-common/README.md
 create mode 100644 plugins/jenkins-common/api-report.md
 create mode 100644 plugins/jenkins-common/package.json
 create mode 100644 plugins/jenkins-common/src/index.ts
 create mode 100644 plugins/jenkins-common/src/permissions.ts

diff --git a/.changeset/gold-garlics-sing.md b/.changeset/gold-garlics-sing.md
new file mode 100644
index 0000000000..f13229d003
--- /dev/null
+++ b/.changeset/gold-garlics-sing.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-jenkins-common': major
+---
+
+Add a new common plugin for jenkins which provides shared isomorphic code for the jenkins plugin.
diff --git a/.changeset/orange-cobras-shave.md b/.changeset/orange-cobras-shave.md
new file mode 100644
index 0000000000..c753aecbc6
--- /dev/null
+++ b/.changeset/orange-cobras-shave.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-jenkins-backend': minor
+---
+
+Add permissions support for jenkins backend and provide an integration router. You must pass a permission router
+if you want to enable permissions in jenkins plugin.
diff --git a/.changeset/ten-fireants-march.md b/.changeset/ten-fireants-march.md
new file mode 100644
index 0000000000..9376292196
--- /dev/null
+++ b/.changeset/ten-fireants-march.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-jenkins': minor
+---
+
+Integrated the permission plugin, if enabled, the actions can be executed only by owned user (or assigned to related group)
diff --git a/plugins/jenkins-backend/api-report.md b/plugins/jenkins-backend/api-report.md
index d437a5dd75..6f9ec10cf4 100644
--- a/plugins/jenkins-backend/api-report.md
+++ b/plugins/jenkins-backend/api-report.md
@@ -4,10 +4,25 @@
 
 ```ts
 import { CatalogApi } from '@backstage/catalog-client';
+import { ConditionalPolicyDecision } from '@backstage/plugin-permission-node';
+import { Conditions } from '@backstage/plugin-permission-node';
 import { Config } from '@backstage/config';
+import { EntitiesSearchFilter } from '@backstage/plugin-catalog-backend';
+import { Entity } from '@backstage/catalog-model';
 import { EntityName } from '@backstage/catalog-model';
 import express from 'express';
 import { Logger as Logger_2 } from 'winston';
+import { PermissionCondition } from '@backstage/plugin-permission-common';
+import { PermissionCriteria } from '@backstage/plugin-permission-common';
+import { PermissionRule } from '@backstage/plugin-permission-node';
+import { PluginEndpointDiscovery } from '@backstage/backend-common';
+
+// Warning: (ae-missing-release-tag) "createJenkinsPermissionPolicy" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const createJenkinsPermissionPolicy: (
+  conditions: PermissionCriteria<PermissionCondition<unknown[]>>,
+) => ConditionalPolicyDecision;
 
 // Warning: (ae-missing-release-tag) "createRouter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -34,6 +49,17 @@ export class DefaultJenkinsInfoProvider implements JenkinsInfoProvider {
   static readonly OLD_JENKINS_ANNOTATION = 'jenkins.io/github-folder';
 }
 
+// Warning: (ae-missing-release-tag) "jenkinsConditions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const jenkinsConditions: Conditions<{
+  isEntityOwner: PermissionRule<
+    Entity,
+    EntitiesSearchFilter,
+    [claims: string[]]
+  >;
+}>;
+
 // Warning: (ae-missing-release-tag) "JenkinsConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -86,10 +112,30 @@ export interface JenkinsInstanceConfig {
   username: string;
 }
 
+// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
+// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
+//
+// @public
+export const jenkinsPermissionRules: {
+  isEntityOwner: PermissionRule<
+    Entity,
+    EntitiesSearchFilter,
+    [claims: string[]]
+  >;
+};
+
 // Warning: (ae-missing-release-tag) "RouterOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
 export interface RouterOptions {
+  // (undocumented)
+  config?: Config;
+  // (undocumented)
+  discovery?: PluginEndpointDiscovery;
+  // (undocumented)
+  fetchApi?: {
+    fetch: typeof fetch;
+  };
   // (undocumented)
   jenkinsInfoProvider: JenkinsInfoProvider;
   // (undocumented)
diff --git a/plugins/jenkins-backend/package.json b/plugins/jenkins-backend/package.json
index 66cbe5ba24..72ebc1ee2b 100644
--- a/plugins/jenkins-backend/package.json
+++ b/plugins/jenkins-backend/package.json
@@ -29,6 +29,9 @@
     "@backstage/catalog-client": "^0.7.2",
     "@backstage/catalog-model": "^0.11.0",
     "@backstage/config": "^0.1.15",
+    "@backstage/plugin-catalog-backend": "^0.22.0",
+    "@backstage/plugin-jenkins-common": "^0.1.0",
+    "@backstage/plugin-permission-node": "^0.5.2",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
diff --git a/plugins/jenkins-backend/src/index.ts b/plugins/jenkins-backend/src/index.ts
index c55335c52d..c584842e07 100644
--- a/plugins/jenkins-backend/src/index.ts
+++ b/plugins/jenkins-backend/src/index.ts
@@ -21,3 +21,4 @@
  */
 
 export * from './service';
+export * from './permissions';
diff --git a/plugins/jenkins-backend/src/permissions/conditionExports.ts b/plugins/jenkins-backend/src/permissions/conditionExports.ts
new file mode 100644
index 0000000000..5266b1b091
--- /dev/null
+++ b/plugins/jenkins-backend/src/permissions/conditionExports.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { jenkinsPermissionRules } from './rules';
+import { createConditionExports } from '@backstage/plugin-permission-node';
+import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+
+const { conditions, createPolicyDecision } = createConditionExports({
+  pluginId: 'jenkins',
+  resourceType: RESOURCE_TYPE_JENKINS,
+  rules: jenkinsPermissionRules,
+});
+
+export const jenkinsConditions = conditions;
+export const createJenkinsPermissionPolicy = createPolicyDecision;
diff --git a/plugins/jenkins-backend/src/permissions/index.ts b/plugins/jenkins-backend/src/permissions/index.ts
new file mode 100644
index 0000000000..522f40aeee
--- /dev/null
+++ b/plugins/jenkins-backend/src/permissions/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {
+  createJenkinsPermissionPolicy,
+  jenkinsConditions,
+} from './conditionExports';
+export * from './rules';
diff --git a/plugins/jenkins-backend/src/permissions/permission-router-factory.ts b/plugins/jenkins-backend/src/permissions/permission-router-factory.ts
new file mode 100644
index 0000000000..1959eb24a7
--- /dev/null
+++ b/plugins/jenkins-backend/src/permissions/permission-router-factory.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
+import { jenkinsPermissionRules } from './rules';
+import { parseEntityRef } from '@backstage/catalog-model';
+import type { PluginEndpointDiscovery } from '@backstage/backend-common';
+import { CatalogClient } from '@backstage/catalog-client';
+import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+
+export const jenkinsPermissionIntegrationRouterFactory = (
+  discoveryApi: PluginEndpointDiscovery,
+  fetchApi?: { fetch: typeof fetch },
+) => {
+  const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi });
+  return createPermissionIntegrationRouter({
+    resourceType: RESOURCE_TYPE_JENKINS,
+    rules: Object.values(jenkinsPermissionRules),
+    getResources: resourceRefs => {
+      const entities = resourceRefs.map(async resourceRef => {
+        const { kind, namespace, name } = parseEntityRef(resourceRef);
+        return catalogApi.getEntityByName({ kind, name, namespace });
+      });
+      // combine the promises to return entities as any array, getResources expects a single promise with all entities
+      return Promise.all(entities);
+    },
+  });
+};
diff --git a/plugins/jenkins-backend/src/permissions/rules/index.ts b/plugins/jenkins-backend/src/permissions/rules/index.ts
new file mode 100644
index 0000000000..0cd07b26a8
--- /dev/null
+++ b/plugins/jenkins-backend/src/permissions/rules/index.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { permissionRules } from '@backstage/plugin-catalog-backend';
+/**
+ *
+ * Jenkins' permission rules can be used to defined different kind of rules to check if the user authorizes an action
+ * (or listing the jobs ever)
+ *
+ * Provided rules:
+ * {isEntityOwner} can be used to determine if a user or the group of the user
+ * owns an entity.
+ *
+ * @public
+ */
+export const jenkinsPermissionRules = {
+  isEntityOwner: permissionRules.isEntityOwner,
+};
diff --git a/plugins/jenkins-backend/src/service/router.ts b/plugins/jenkins-backend/src/service/router.ts
index 8c5852efa9..85320bb520 100644
--- a/plugins/jenkins-backend/src/service/router.ts
+++ b/plugins/jenkins-backend/src/service/router.ts
@@ -14,16 +14,24 @@
  * limitations under the License.
  */
 
-import { errorHandler } from '@backstage/backend-common';
+import {
+  errorHandler,
+  PluginEndpointDiscovery,
+} from '@backstage/backend-common';
 import express from 'express';
 import Router from 'express-promise-router';
 import { Logger } from 'winston';
 import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
+import { Config } from '@backstage/config';
+import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory';
 
 export interface RouterOptions {
   logger: Logger;
   jenkinsInfoProvider: JenkinsInfoProvider;
+  config?: Config;
+  discovery?: PluginEndpointDiscovery;
+  fetchApi?: { fetch: typeof fetch };
 }
 
 export async function createRouter(
@@ -117,7 +125,18 @@ export async function createRouter(
       response.json({});
     },
   );
-
   router.use(errorHandler());
+
+  if (options.config?.getOptionalBoolean('permission.enabled')) {
+    if (!options.discovery) {
+      throw new Error('Discovery API is required if permissions are enabled.');
+    }
+    router.use(
+      jenkinsPermissionIntegrationRouterFactory(
+        options.discovery,
+        options.fetchApi,
+      ),
+    );
+  }
   return router;
 }
diff --git a/plugins/jenkins-common/.eslintrc.js b/plugins/jenkins-common/.eslintrc.js
new file mode 100644
index 0000000000..13573efa9c
--- /dev/null
+++ b/plugins/jenkins-common/.eslintrc.js
@@ -0,0 +1,3 @@
+module.exports = {
+  extends: [require.resolve('@backstage/cli/config/eslint')],
+};
diff --git a/plugins/jenkins-common/README.md b/plugins/jenkins-common/README.md
new file mode 100644
index 0000000000..71e6db3a16
--- /dev/null
+++ b/plugins/jenkins-common/README.md
@@ -0,0 +1,3 @@
+# Jenkins Common
+
+Shared isomorphic code for the jenkins plugin.
diff --git a/plugins/jenkins-common/api-report.md b/plugins/jenkins-common/api-report.md
new file mode 100644
index 0000000000..b63cc94374
--- /dev/null
+++ b/plugins/jenkins-common/api-report.md
@@ -0,0 +1,15 @@
+## API Report File for "@backstage/plugin-jenkins-common"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+import { Permission } from '@backstage/plugin-permission-common';
+
+// @public
+export const jenkinsExecutePermission: Permission;
+
+// @public (undocumented)
+export const RESOURCE_TYPE_JENKINS = 'jenkins';
+
+// (No @packageDocumentation comment for this package)
+```
diff --git a/plugins/jenkins-common/package.json b/plugins/jenkins-common/package.json
new file mode 100644
index 0000000000..5739794197
--- /dev/null
+++ b/plugins/jenkins-common/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "@backstage/plugin-jenkins-common",
+  "version": "0.1.0",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "module": "dist/index.esm.js",
+    "types": "dist/index.d.ts"
+  },
+  "backstage": {
+    "role": "common-library"
+  },
+  "scripts": {
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack",
+    "clean": "backstage-cli package clean"
+  },
+  "dependencies": {
+    "@backstage/plugin-permission-common": "^0.5.1"
+  },
+  "devDependencies": {
+    "@backstage/cli": "^0.14.1"
+  },
+  "files": [
+    "dist"
+  ]
+}
diff --git a/plugins/jenkins-common/src/index.ts b/plugins/jenkins-common/src/index.ts
new file mode 100644
index 0000000000..aff3b136bd
--- /dev/null
+++ b/plugins/jenkins-common/src/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './permissions';
diff --git a/plugins/jenkins-common/src/permissions.ts b/plugins/jenkins-common/src/permissions.ts
new file mode 100644
index 0000000000..f521e0454b
--- /dev/null
+++ b/plugins/jenkins-common/src/permissions.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Permission } from '@backstage/plugin-permission-common';
+
+/**
+ * @public
+ */
+export const RESOURCE_TYPE_JENKINS = 'jenkins';
+
+/**
+ * This permission is used to determine if a user is allowed to execute an action in jenkins plugin
+ *
+ * @public
+ */
+export const jenkinsExecutePermission: Permission = {
+  name: 'jenkins.execute',
+  attributes: {
+    action: 'update',
+  },
+  resourceType: RESOURCE_TYPE_JENKINS,
+};
diff --git a/plugins/jenkins/package.json b/plugins/jenkins/package.json
index ada061dba9..e9ea4e5b5c 100644
--- a/plugins/jenkins/package.json
+++ b/plugins/jenkins/package.json
@@ -40,6 +40,7 @@
     "@backstage/core-plugin-api": "^0.7.0",
     "@backstage/errors": "^0.2.2",
     "@backstage/plugin-catalog-react": "^0.7.0",
+    "@backstage/plugin-jenkins-common": "^0.1.0",
     "@backstage/theme": "^0.2.15",
     "@material-ui/core": "^4.12.2",
     "@material-ui/icons": "^4.9.1",
diff --git a/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx b/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx
index 2c464491c2..c525e297be 100644
--- a/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx
+++ b/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx
@@ -15,6 +15,7 @@
  */
 import { Link, Progress, Table, TableColumn } from '@backstage/core-components';
 import { alertApiRef, useApi, useRouteRef } from '@backstage/core-plugin-api';
+import { useEntityPermission } from '@backstage/plugin-catalog-react';
 import { Box, IconButton, Tooltip, Typography } from '@material-ui/core';
 import RetryIcon from '@material-ui/icons/Replay';
 import { default as React, useState } from 'react';
@@ -23,6 +24,7 @@ import JenkinsLogo from '../../../../assets/JenkinsLogo.svg';
 import { buildRouteRef } from '../../../../plugin';
 import { useBuilds } from '../../../useBuilds';
 import { JenkinsRunStatus } from '../Status';
+import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common';
 
 const FailCount = ({ count }: { count: number }): JSX.Element | null => {
   if (count !== 0) {
@@ -174,6 +176,10 @@ const generatedColumns: TableColumn[] = [
     render: (row: Partial<Project>) => {
       const ActionWrapper = () => {
         const [isLoadingRebuild, setIsLoadingRebuild] = useState(false);
+        const { allowed, loading } = useEntityPermission(
+          jenkinsExecutePermission,
+        );
+
         const alertApi = useApi(alertApiRef);
 
         const onRebuild = async () => {
@@ -201,7 +207,7 @@ const generatedColumns: TableColumn[] = [
             <>
               {isLoadingRebuild && <Progress />}
               {!isLoadingRebuild && (
-                <IconButton onClick={onRebuild}>
+                <IconButton onClick={onRebuild} disabled={loading || !allowed}>
                   <RetryIcon />
                 </IconButton>
               )}
diff --git a/yarn.lock b/yarn.lock
index 6cb525a71e..e0757c196f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -11929,6 +11929,7 @@ evp_bytestokey@^1.0.0, evp_bytestokey@^1.0.3:
     "@backstage/plugin-graphiql" "^0.2.32"
     "@backstage/plugin-home" "^0.4.16"
     "@backstage/plugin-jenkins" "^0.6.0"
+    "@backstage/plugin-jenkins-common" "^0.1.0"
     "@backstage/plugin-kafka" "^0.3.0"
     "@backstage/plugin-kubernetes" "^0.6.0"
     "@backstage/plugin-lighthouse" "^0.3.0"

From ed2259afcbc94dfbc100a8aa7825e4cd24d76705 Mon Sep 17 00:00:00 2001
From: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
Date: Sun, 27 Feb 2022 02:05:50 +0100
Subject: [PATCH 2/6] (feature): fixed typo. reported by Vale

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
---
 .changeset/gold-garlics-sing.md   | 2 +-
 .changeset/orange-cobras-shave.md | 4 ++--
 plugins/jenkins-common/README.md  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.changeset/gold-garlics-sing.md b/.changeset/gold-garlics-sing.md
index f13229d003..012d6f92fb 100644
--- a/.changeset/gold-garlics-sing.md
+++ b/.changeset/gold-garlics-sing.md
@@ -2,4 +2,4 @@
 '@backstage/plugin-jenkins-common': major
 ---
 
-Add a new common plugin for jenkins which provides shared isomorphic code for the jenkins plugin.
+Add a new common plugin for Jenkins which provides shared isomorphic code for the Jenkins plugin.
diff --git a/.changeset/orange-cobras-shave.md b/.changeset/orange-cobras-shave.md
index c753aecbc6..2b840dab48 100644
--- a/.changeset/orange-cobras-shave.md
+++ b/.changeset/orange-cobras-shave.md
@@ -2,5 +2,5 @@
 '@backstage/plugin-jenkins-backend': minor
 ---
 
-Add permissions support for jenkins backend and provide an integration router. You must pass a permission router
-if you want to enable permissions in jenkins plugin.
+Add permissions support for Jenkins backend and provide an integration router. You must pass a permission router
+if you want to enable permissions in Jenkins plugin.
diff --git a/plugins/jenkins-common/README.md b/plugins/jenkins-common/README.md
index 71e6db3a16..54a79fc287 100644
--- a/plugins/jenkins-common/README.md
+++ b/plugins/jenkins-common/README.md
@@ -1,3 +1,3 @@
 # Jenkins Common
 
-Shared isomorphic code for the jenkins plugin.
+Shared isomorphic code for the Jenkins plugin.

From 1543dcf31a51f206b51567ca7e2f3a902e2bfa58 Mon Sep 17 00:00:00 2001
From: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
Date: Tue, 1 Mar 2022 00:08:35 +0100
Subject: [PATCH 3/6] (feature): remove integration router and use catalog
 resource type since we use the same resources required by the catalog entity

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
---
 plugins/jenkins-backend/api-report.md         |  3 ++
 plugins/jenkins-backend/package.json          |  4 ++
 .../src/permissions/conditionExports.ts       |  4 +-
 .../permissions/permission-router-factory.ts  | 40 -------------------
 .../src/service/jenkinsApi.test.ts            | 40 ++++++++++++++++++-
 .../jenkins-backend/src/service/jenkinsApi.ts | 26 +++++++++++-
 plugins/jenkins-backend/src/service/router.ts | 24 ++++-------
 plugins/jenkins-common/api-report.md          |  3 --
 plugins/jenkins-common/package.json           |  1 +
 plugins/jenkins-common/src/permissions.ts     |  8 +---
 yarn.lock                                     |  1 -
 11 files changed, 84 insertions(+), 70 deletions(-)
 delete mode 100644 plugins/jenkins-backend/src/permissions/permission-router-factory.ts

diff --git a/plugins/jenkins-backend/api-report.md b/plugins/jenkins-backend/api-report.md
index 6f9ec10cf4..41bebb1061 100644
--- a/plugins/jenkins-backend/api-report.md
+++ b/plugins/jenkins-backend/api-report.md
@@ -12,6 +12,7 @@ import { Entity } from '@backstage/catalog-model';
 import { EntityName } from '@backstage/catalog-model';
 import express from 'express';
 import { Logger as Logger_2 } from 'winston';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 import { PermissionCondition } from '@backstage/plugin-permission-common';
 import { PermissionCriteria } from '@backstage/plugin-permission-common';
 import { PermissionRule } from '@backstage/plugin-permission-node';
@@ -140,5 +141,7 @@ export interface RouterOptions {
   jenkinsInfoProvider: JenkinsInfoProvider;
   // (undocumented)
   logger: Logger_2;
+  // (undocumented)
+  permissions?: PermissionAuthorizer;
 }
 ```
diff --git a/plugins/jenkins-backend/package.json b/plugins/jenkins-backend/package.json
index 72ebc1ee2b..f0659f42d8 100644
--- a/plugins/jenkins-backend/package.json
+++ b/plugins/jenkins-backend/package.json
@@ -29,8 +29,12 @@
     "@backstage/catalog-client": "^0.7.2",
     "@backstage/catalog-model": "^0.11.0",
     "@backstage/config": "^0.1.15",
+    "@backstage/errors": "^0.2.2",
+    "@backstage/plugin-auth-node": "^0.1.3",
     "@backstage/plugin-catalog-backend": "^0.22.0",
+    "@backstage/plugin-catalog-common": "^0.1.4",
     "@backstage/plugin-jenkins-common": "^0.1.0",
+    "@backstage/plugin-permission-common": "^0.5.1",
     "@backstage/plugin-permission-node": "^0.5.2",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
diff --git a/plugins/jenkins-backend/src/permissions/conditionExports.ts b/plugins/jenkins-backend/src/permissions/conditionExports.ts
index 5266b1b091..197f2cb0ec 100644
--- a/plugins/jenkins-backend/src/permissions/conditionExports.ts
+++ b/plugins/jenkins-backend/src/permissions/conditionExports.ts
@@ -15,11 +15,11 @@
  */
 import { jenkinsPermissionRules } from './rules';
 import { createConditionExports } from '@backstage/plugin-permission-node';
-import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
 
 const { conditions, createPolicyDecision } = createConditionExports({
   pluginId: 'jenkins',
-  resourceType: RESOURCE_TYPE_JENKINS,
+  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
   rules: jenkinsPermissionRules,
 });
 
diff --git a/plugins/jenkins-backend/src/permissions/permission-router-factory.ts b/plugins/jenkins-backend/src/permissions/permission-router-factory.ts
deleted file mode 100644
index 1959eb24a7..0000000000
--- a/plugins/jenkins-backend/src/permissions/permission-router-factory.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
-import { jenkinsPermissionRules } from './rules';
-import { parseEntityRef } from '@backstage/catalog-model';
-import type { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { CatalogClient } from '@backstage/catalog-client';
-import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
-
-export const jenkinsPermissionIntegrationRouterFactory = (
-  discoveryApi: PluginEndpointDiscovery,
-  fetchApi?: { fetch: typeof fetch },
-) => {
-  const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi });
-  return createPermissionIntegrationRouter({
-    resourceType: RESOURCE_TYPE_JENKINS,
-    rules: Object.values(jenkinsPermissionRules),
-    getResources: resourceRefs => {
-      const entities = resourceRefs.map(async resourceRef => {
-        const { kind, namespace, name } = parseEntityRef(resourceRef);
-        return catalogApi.getEntityByName({ kind, name, namespace });
-      });
-      // combine the promises to return entities as any array, getResources expects a single promise with all entities
-      return Promise.all(entities);
-    },
-  });
-};
diff --git a/plugins/jenkins-backend/src/service/jenkinsApi.test.ts b/plugins/jenkins-backend/src/service/jenkinsApi.test.ts
index 683b9334bc..350ec996ca 100644
--- a/plugins/jenkins-backend/src/service/jenkinsApi.test.ts
+++ b/plugins/jenkins-backend/src/service/jenkinsApi.test.ts
@@ -18,6 +18,8 @@ import { JenkinsApiImpl } from './jenkinsApi';
 import jenkins from 'jenkins';
 import { JenkinsInfo } from './jenkinsInfoProvider';
 import { JenkinsBuild, JenkinsProject } from '../types';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
+import { NotAllowedError } from '@backstage/errors';
 
 jest.mock('jenkins');
 const mockedJenkinsClient = {
@@ -40,8 +42,16 @@ const jenkinsInfo: JenkinsInfo = {
   jobFullName: 'example-jobName',
 };
 
+const fakePermissionApi = {
+  authorize: jest.fn().mockResolvedValue([
+    {
+      result: AuthorizeResult.ALLOW,
+    },
+  ]),
+};
+
 describe('JenkinsApi', () => {
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(fakePermissionApi);
 
   describe('getProjects', () => {
     const project: JenkinsProject = {
@@ -413,6 +423,34 @@ describe('JenkinsApi', () => {
     expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
   });
 
+  it('buildProject should fail if it does not have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.DENY,
+      },
+    ]);
+
+    await expect(() =>
+      jenkinsApi.buildProject(jenkinsInfo, jobFullName),
+    ).rejects.toThrow(NotAllowedError);
+  });
+
+  it('buildProject should success if it have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.ALLOW,
+      },
+    ]);
+
+    await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+    expect(mockedJenkins).toHaveBeenCalledWith({
+      baseUrl: jenkinsInfo.baseUrl,
+      headers: jenkinsInfo.headers,
+      promisify: true,
+    });
+    expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
+  });
+
   it('buildProject with crumbIssuer option', async () => {
     const info: JenkinsInfo = { ...jenkinsInfo, crumbIssuer: true };
     await jenkinsApi.buildProject(info, jobFullName);
diff --git a/plugins/jenkins-backend/src/service/jenkinsApi.ts b/plugins/jenkins-backend/src/service/jenkinsApi.ts
index 3dbba13db6..c0b1c63112 100644
--- a/plugins/jenkins-backend/src/service/jenkinsApi.ts
+++ b/plugins/jenkins-backend/src/service/jenkinsApi.ts
@@ -23,6 +23,12 @@ import {
   JenkinsProject,
   ScmDetails,
 } from '../types';
+import {
+  AuthorizeResult,
+  PermissionAuthorizer,
+} from '@backstage/plugin-permission-common';
+import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common';
+import { NotAllowedError } from '@backstage/errors';
 
 export class JenkinsApiImpl {
   private static readonly lastBuildTreeSpec = `lastBuild[
@@ -58,6 +64,8 @@ export class JenkinsApiImpl {
                    ${JenkinsApiImpl.jobTreeSpec}
                  ]{0,50}`;
 
+  constructor(private readonly permissionApi?: PermissionAuthorizer) {}
+
   /**
    * Get a list of projects for the given JenkinsInfo.
    * @see ../../../jenkins/src/api/JenkinsApi.ts#getProjects
@@ -128,9 +136,25 @@ export class JenkinsApiImpl {
    * Trigger a build of a project
    * @see ../../../jenkins/src/api/JenkinsApi.ts#retry
    */
-  async buildProject(jenkinsInfo: JenkinsInfo, jobFullName: string) {
+  async buildProject(
+    jenkinsInfo: JenkinsInfo,
+    jobFullName: string,
+    options?: { token?: string },
+  ) {
     const client = await JenkinsApiImpl.getClient(jenkinsInfo);
 
+    if (this.permissionApi) {
+      const response = await this.permissionApi.authorize(
+        [{ permission: jenkinsExecutePermission }],
+        { token: options?.token },
+      );
+      // permission api returns always at least one item, we need to check only one result since we do not expect any additional results
+      const { result } = response[0];
+      if (result === AuthorizeResult.DENY) {
+        throw new NotAllowedError();
+      }
+    }
+
     // looks like the current SDK only supports triggering a new build
     // can't see any support for replay (re-running the specific build with the same SCM info)
 
diff --git a/plugins/jenkins-backend/src/service/router.ts b/plugins/jenkins-backend/src/service/router.ts
index 85320bb520..89d755efed 100644
--- a/plugins/jenkins-backend/src/service/router.ts
+++ b/plugins/jenkins-backend/src/service/router.ts
@@ -24,7 +24,8 @@ import { Logger } from 'winston';
 import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
 import { Config } from '@backstage/config';
-import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
 
 export interface RouterOptions {
   logger: Logger;
@@ -32,6 +33,7 @@ export interface RouterOptions {
   config?: Config;
   discovery?: PluginEndpointDiscovery;
   fetchApi?: { fetch: typeof fetch };
+  permissions?: PermissionAuthorizer;
 }
 
 export async function createRouter(
@@ -39,7 +41,7 @@ export async function createRouter(
 ): Promise<express.Router> {
   const { jenkinsInfoProvider } = options;
 
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(options.permissions);
 
   const router = Router();
   router.use(express.json());
@@ -111,7 +113,6 @@ export async function createRouter(
     '/v1/entity/:namespace/:kind/:name/job/:jobFullName/:buildNumber::rebuild',
     async (request, response) => {
       const { namespace, kind, name, jobFullName } = request.params;
-
       const jenkinsInfo = await jenkinsInfoProvider.getInstance({
         entityRef: {
           kind,
@@ -120,23 +121,14 @@ export async function createRouter(
         },
         jobFullName,
       });
+      const token = getBearerTokenFromAuthorizationHeader(
+        request.header('authorization'),
+      );
 
-      await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+      await jenkinsApi.buildProject(jenkinsInfo, jobFullName, { token });
       response.json({});
     },
   );
   router.use(errorHandler());
-
-  if (options.config?.getOptionalBoolean('permission.enabled')) {
-    if (!options.discovery) {
-      throw new Error('Discovery API is required if permissions are enabled.');
-    }
-    router.use(
-      jenkinsPermissionIntegrationRouterFactory(
-        options.discovery,
-        options.fetchApi,
-      ),
-    );
-  }
   return router;
 }
diff --git a/plugins/jenkins-common/api-report.md b/plugins/jenkins-common/api-report.md
index b63cc94374..7b0d3759ba 100644
--- a/plugins/jenkins-common/api-report.md
+++ b/plugins/jenkins-common/api-report.md
@@ -8,8 +8,5 @@ import { Permission } from '@backstage/plugin-permission-common';
 // @public
 export const jenkinsExecutePermission: Permission;
 
-// @public (undocumented)
-export const RESOURCE_TYPE_JENKINS = 'jenkins';
-
 // (No @packageDocumentation comment for this package)
 ```
diff --git a/plugins/jenkins-common/package.json b/plugins/jenkins-common/package.json
index 5739794197..08f12960bc 100644
--- a/plugins/jenkins-common/package.json
+++ b/plugins/jenkins-common/package.json
@@ -22,6 +22,7 @@
     "clean": "backstage-cli package clean"
   },
   "dependencies": {
+    "@backstage/plugin-catalog-common": "^0.1.4",
     "@backstage/plugin-permission-common": "^0.5.1"
   },
   "devDependencies": {
diff --git a/plugins/jenkins-common/src/permissions.ts b/plugins/jenkins-common/src/permissions.ts
index f521e0454b..2fa8c14232 100644
--- a/plugins/jenkins-common/src/permissions.ts
+++ b/plugins/jenkins-common/src/permissions.ts
@@ -13,13 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
 import { Permission } from '@backstage/plugin-permission-common';
 
-/**
- * @public
- */
-export const RESOURCE_TYPE_JENKINS = 'jenkins';
-
 /**
  * This permission is used to determine if a user is allowed to execute an action in jenkins plugin
  *
@@ -30,5 +26,5 @@ export const jenkinsExecutePermission: Permission = {
   attributes: {
     action: 'update',
   },
-  resourceType: RESOURCE_TYPE_JENKINS,
+  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
 };
diff --git a/yarn.lock b/yarn.lock
index 17489d9bb1..997e55c9e9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -11929,7 +11929,6 @@ evp_bytestokey@^1.0.0, evp_bytestokey@^1.0.3:
     "@backstage/plugin-graphiql" "^0.2.32"
     "@backstage/plugin-home" "^0.4.16"
     "@backstage/plugin-jenkins" "^0.6.0"
-    "@backstage/plugin-jenkins-common" "^0.1.0"
     "@backstage/plugin-kafka" "^0.3.0"
     "@backstage/plugin-kubernetes" "^0.6.0"
     "@backstage/plugin-lighthouse" "^0.3.0"

From 70f29c54238823855f10f1a5863fa0d9f90a9f93 Mon Sep 17 00:00:00 2001
From: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
Date: Tue, 1 Mar 2022 23:45:01 +0100
Subject: [PATCH 4/6] (feature): remove unused configuration and improved
 permission management, describe the permission integration in detail.

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
---
 .changeset/orange-cobras-shave.md             | 10 +++-
 .changeset/ten-fireants-march.md              |  5 +-
 plugins/jenkins-backend/api-report.md         | 50 +------------------
 plugins/jenkins-backend/package.json          |  3 --
 plugins/jenkins-backend/src/index.ts          |  1 -
 .../src/permissions/conditionExports.ts       | 27 ----------
 .../jenkins-backend/src/permissions/index.ts  | 20 --------
 .../src/permissions/rules/index.ts            | 30 -----------
 .../jenkins-backend/src/service/jenkinsApi.ts |  7 +--
 plugins/jenkins-backend/src/service/router.ts | 21 ++++----
 10 files changed, 27 insertions(+), 147 deletions(-)
 delete mode 100644 plugins/jenkins-backend/src/permissions/conditionExports.ts
 delete mode 100644 plugins/jenkins-backend/src/permissions/index.ts
 delete mode 100644 plugins/jenkins-backend/src/permissions/rules/index.ts

diff --git a/.changeset/orange-cobras-shave.md b/.changeset/orange-cobras-shave.md
index 2b840dab48..9f54f6d48b 100644
--- a/.changeset/orange-cobras-shave.md
+++ b/.changeset/orange-cobras-shave.md
@@ -2,5 +2,11 @@
 '@backstage/plugin-jenkins-backend': minor
 ---
 
-Add permissions support for Jenkins backend and provide an integration router. You must pass a permission router
-if you want to enable permissions in Jenkins plugin.
+Jenkins plugin supports permissions now. We have added a new permission, so you can manage the permission for the users.
+A new permission `jenkinsExecutePermission` is provided in `jenkins-common` package. This permission rule will be applied to check rebuild actions
+if user is allowed to execute this action.
+
+> We use 'catalog-entity' as a resource type, so you need to integrate a policy to handle catalog-entity resources
+
+> You need to use this permission in your permission policy to check the user role/rights and return
+> `AuthorizeResult.ALLOW` to allow rebuild action to logged user. (e.g: you can check if user or related group owns the entity)
diff --git a/.changeset/ten-fireants-march.md b/.changeset/ten-fireants-march.md
index 9376292196..8283eef5d6 100644
--- a/.changeset/ten-fireants-march.md
+++ b/.changeset/ten-fireants-march.md
@@ -2,4 +2,7 @@
 '@backstage/plugin-jenkins': minor
 ---
 
-Integrated the permission plugin, if enabled, the actions can be executed only by owned user (or assigned to related group)
+Jenkins plugin supports permissions now. We have added a new permission, so you can manage the permission for the users. See relates notes for `jenkins-plugin` for more details.
+
+Rebuild action will be disabled if the user does not have necessary rights to execute rebuild action. A permission policy (defined in backend) must handle and check the identity rights
+and return `AuthorizeResult.ALLOW` if user is allowed to execute rebuild action.
diff --git a/plugins/jenkins-backend/api-report.md b/plugins/jenkins-backend/api-report.md
index 41bebb1061..7af3968897 100644
--- a/plugins/jenkins-backend/api-report.md
+++ b/plugins/jenkins-backend/api-report.md
@@ -4,26 +4,11 @@
 
 ```ts
 import { CatalogApi } from '@backstage/catalog-client';
-import { ConditionalPolicyDecision } from '@backstage/plugin-permission-node';
-import { Conditions } from '@backstage/plugin-permission-node';
 import { Config } from '@backstage/config';
-import { EntitiesSearchFilter } from '@backstage/plugin-catalog-backend';
-import { Entity } from '@backstage/catalog-model';
 import { EntityName } from '@backstage/catalog-model';
 import express from 'express';
-import { Logger as Logger_2 } from 'winston';
-import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
-import { PermissionCondition } from '@backstage/plugin-permission-common';
-import { PermissionCriteria } from '@backstage/plugin-permission-common';
-import { PermissionRule } from '@backstage/plugin-permission-node';
-import { PluginEndpointDiscovery } from '@backstage/backend-common';
-
-// Warning: (ae-missing-release-tag) "createJenkinsPermissionPolicy" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const createJenkinsPermissionPolicy: (
-  conditions: PermissionCriteria<PermissionCondition<unknown[]>>,
-) => ConditionalPolicyDecision;
+import type { Logger as Logger_2 } from 'winston';
+import type { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 
 // Warning: (ae-missing-release-tag) "createRouter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -50,17 +35,6 @@ export class DefaultJenkinsInfoProvider implements JenkinsInfoProvider {
   static readonly OLD_JENKINS_ANNOTATION = 'jenkins.io/github-folder';
 }
 
-// Warning: (ae-missing-release-tag) "jenkinsConditions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const jenkinsConditions: Conditions<{
-  isEntityOwner: PermissionRule<
-    Entity,
-    EntitiesSearchFilter,
-    [claims: string[]]
-  >;
-}>;
-
 // Warning: (ae-missing-release-tag) "JenkinsConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -113,30 +87,10 @@ export interface JenkinsInstanceConfig {
   username: string;
 }
 
-// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
-// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
-//
-// @public
-export const jenkinsPermissionRules: {
-  isEntityOwner: PermissionRule<
-    Entity,
-    EntitiesSearchFilter,
-    [claims: string[]]
-  >;
-};
-
 // Warning: (ae-missing-release-tag) "RouterOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
 export interface RouterOptions {
-  // (undocumented)
-  config?: Config;
-  // (undocumented)
-  discovery?: PluginEndpointDiscovery;
-  // (undocumented)
-  fetchApi?: {
-    fetch: typeof fetch;
-  };
   // (undocumented)
   jenkinsInfoProvider: JenkinsInfoProvider;
   // (undocumented)
diff --git a/plugins/jenkins-backend/package.json b/plugins/jenkins-backend/package.json
index f0659f42d8..64278618af 100644
--- a/plugins/jenkins-backend/package.json
+++ b/plugins/jenkins-backend/package.json
@@ -31,11 +31,8 @@
     "@backstage/config": "^0.1.15",
     "@backstage/errors": "^0.2.2",
     "@backstage/plugin-auth-node": "^0.1.3",
-    "@backstage/plugin-catalog-backend": "^0.22.0",
-    "@backstage/plugin-catalog-common": "^0.1.4",
     "@backstage/plugin-jenkins-common": "^0.1.0",
     "@backstage/plugin-permission-common": "^0.5.1",
-    "@backstage/plugin-permission-node": "^0.5.2",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
diff --git a/plugins/jenkins-backend/src/index.ts b/plugins/jenkins-backend/src/index.ts
index c584842e07..c55335c52d 100644
--- a/plugins/jenkins-backend/src/index.ts
+++ b/plugins/jenkins-backend/src/index.ts
@@ -21,4 +21,3 @@
  */
 
 export * from './service';
-export * from './permissions';
diff --git a/plugins/jenkins-backend/src/permissions/conditionExports.ts b/plugins/jenkins-backend/src/permissions/conditionExports.ts
deleted file mode 100644
index 197f2cb0ec..0000000000
--- a/plugins/jenkins-backend/src/permissions/conditionExports.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { jenkinsPermissionRules } from './rules';
-import { createConditionExports } from '@backstage/plugin-permission-node';
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
-
-const { conditions, createPolicyDecision } = createConditionExports({
-  pluginId: 'jenkins',
-  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
-  rules: jenkinsPermissionRules,
-});
-
-export const jenkinsConditions = conditions;
-export const createJenkinsPermissionPolicy = createPolicyDecision;
diff --git a/plugins/jenkins-backend/src/permissions/index.ts b/plugins/jenkins-backend/src/permissions/index.ts
deleted file mode 100644
index 522f40aeee..0000000000
--- a/plugins/jenkins-backend/src/permissions/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-export {
-  createJenkinsPermissionPolicy,
-  jenkinsConditions,
-} from './conditionExports';
-export * from './rules';
diff --git a/plugins/jenkins-backend/src/permissions/rules/index.ts b/plugins/jenkins-backend/src/permissions/rules/index.ts
deleted file mode 100644
index 0cd07b26a8..0000000000
--- a/plugins/jenkins-backend/src/permissions/rules/index.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright 2022 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { permissionRules } from '@backstage/plugin-catalog-backend';
-/**
- *
- * Jenkins' permission rules can be used to defined different kind of rules to check if the user authorizes an action
- * (or listing the jobs ever)
- *
- * Provided rules:
- * {isEntityOwner} can be used to determine if a user or the group of the user
- * owns an entity.
- *
- * @public
- */
-export const jenkinsPermissionRules = {
-  isEntityOwner: permissionRules.isEntityOwner,
-};
diff --git a/plugins/jenkins-backend/src/service/jenkinsApi.ts b/plugins/jenkins-backend/src/service/jenkinsApi.ts
index c0b1c63112..da16bbc553 100644
--- a/plugins/jenkins-backend/src/service/jenkinsApi.ts
+++ b/plugins/jenkins-backend/src/service/jenkinsApi.ts
@@ -14,9 +14,9 @@
  * limitations under the License.
  */
 
-import { JenkinsInfo } from './jenkinsInfoProvider';
+import type { JenkinsInfo } from './jenkinsInfoProvider';
 import jenkins from 'jenkins';
-import {
+import type {
   BackstageBuild,
   BackstageProject,
   JenkinsBuild,
@@ -139,13 +139,14 @@ export class JenkinsApiImpl {
   async buildProject(
     jenkinsInfo: JenkinsInfo,
     jobFullName: string,
+    resourceRef?: string,
     options?: { token?: string },
   ) {
     const client = await JenkinsApiImpl.getClient(jenkinsInfo);
 
     if (this.permissionApi) {
       const response = await this.permissionApi.authorize(
-        [{ permission: jenkinsExecutePermission }],
+        [{ permission: jenkinsExecutePermission, resourceRef }],
         { token: options?.token },
       );
       // permission api returns always at least one item, we need to check only one result since we do not expect any additional results
diff --git a/plugins/jenkins-backend/src/service/router.ts b/plugins/jenkins-backend/src/service/router.ts
index 89d755efed..dcef2c2e0a 100644
--- a/plugins/jenkins-backend/src/service/router.ts
+++ b/plugins/jenkins-backend/src/service/router.ts
@@ -14,25 +14,19 @@
  * limitations under the License.
  */
 
-import {
-  errorHandler,
-  PluginEndpointDiscovery,
-} from '@backstage/backend-common';
+import { errorHandler } from '@backstage/backend-common';
 import express from 'express';
 import Router from 'express-promise-router';
-import { Logger } from 'winston';
-import { JenkinsInfoProvider } from './jenkinsInfoProvider';
+import type { Logger } from 'winston';
+import type { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
-import { Config } from '@backstage/config';
-import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import type { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
+import { stringifyEntityRef } from '@backstage/catalog-model';
 
 export interface RouterOptions {
   logger: Logger;
   jenkinsInfoProvider: JenkinsInfoProvider;
-  config?: Config;
-  discovery?: PluginEndpointDiscovery;
-  fetchApi?: { fetch: typeof fetch };
   permissions?: PermissionAuthorizer;
 }
 
@@ -125,7 +119,10 @@ export async function createRouter(
         request.header('authorization'),
       );
 
-      await jenkinsApi.buildProject(jenkinsInfo, jobFullName, { token });
+      const resourceRef = stringifyEntityRef({ kind, namespace, name });
+      await jenkinsApi.buildProject(jenkinsInfo, jobFullName, resourceRef, {
+        token,
+      });
       response.json({});
     },
   );

From 950003f5f3cd3764295ead09bc713a768f4b999a Mon Sep 17 00:00:00 2001
From: Hasan Ozdemir <21654050+nodify-at@users.noreply.github.com>
Date: Wed, 2 Mar 2022 13:07:41 +0100
Subject: [PATCH 5/6] Update
 plugins/jenkins-backend/src/service/jenkinsApi.test.ts

Co-authored-by: MT Lewis <mtlewis@users.noreply.github.com>
Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
---
 plugins/jenkins-backend/src/service/jenkinsApi.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/jenkins-backend/src/service/jenkinsApi.test.ts b/plugins/jenkins-backend/src/service/jenkinsApi.test.ts
index 350ec996ca..45f7424e40 100644
--- a/plugins/jenkins-backend/src/service/jenkinsApi.test.ts
+++ b/plugins/jenkins-backend/src/service/jenkinsApi.test.ts
@@ -435,7 +435,7 @@ describe('JenkinsApi', () => {
     ).rejects.toThrow(NotAllowedError);
   });
 
-  it('buildProject should success if it have required permissions', async () => {
+  it('buildProject should succeed if it have required permissions', async () => {
     fakePermissionApi.authorize.mockResolvedValueOnce([
       {
         result: AuthorizeResult.ALLOW,

From 5a74ea82bbbc65a522cd1dd966d532c2a500eb3b Mon Sep 17 00:00:00 2001
From: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
Date: Thu, 3 Mar 2022 15:53:54 +0100
Subject: [PATCH 6/6] (feature): improve the change set and remove typings

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>
---
 .changeset/gold-garlics-sing.md               | 2 +-
 .changeset/orange-cobras-shave.md             | 2 +-
 plugins/jenkins-backend/api-report.md         | 4 ++--
 plugins/jenkins-backend/package.json          | 2 +-
 plugins/jenkins-backend/src/service/router.ts | 6 +++---
 plugins/jenkins-common/package.json           | 2 +-
 plugins/jenkins/package.json                  | 2 +-
 7 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.changeset/gold-garlics-sing.md b/.changeset/gold-garlics-sing.md
index 012d6f92fb..1162cca2d4 100644
--- a/.changeset/gold-garlics-sing.md
+++ b/.changeset/gold-garlics-sing.md
@@ -1,5 +1,5 @@
 ---
-'@backstage/plugin-jenkins-common': major
+'@backstage/plugin-jenkins-common': minor
 ---
 
 Add a new common plugin for Jenkins which provides shared isomorphic code for the Jenkins plugin.
diff --git a/.changeset/orange-cobras-shave.md b/.changeset/orange-cobras-shave.md
index 9f54f6d48b..ad76443c8c 100644
--- a/.changeset/orange-cobras-shave.md
+++ b/.changeset/orange-cobras-shave.md
@@ -1,5 +1,5 @@
 ---
-'@backstage/plugin-jenkins-backend': minor
+'@backstage/plugin-jenkins-backend': patch
 ---
 
 Jenkins plugin supports permissions now. We have added a new permission, so you can manage the permission for the users.
diff --git a/plugins/jenkins-backend/api-report.md b/plugins/jenkins-backend/api-report.md
index 7af3968897..23ee1d11e9 100644
--- a/plugins/jenkins-backend/api-report.md
+++ b/plugins/jenkins-backend/api-report.md
@@ -7,8 +7,8 @@ import { CatalogApi } from '@backstage/catalog-client';
 import { Config } from '@backstage/config';
 import { EntityName } from '@backstage/catalog-model';
 import express from 'express';
-import type { Logger as Logger_2 } from 'winston';
-import type { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import { Logger as Logger_2 } from 'winston';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 
 // Warning: (ae-missing-release-tag) "createRouter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
diff --git a/plugins/jenkins-backend/package.json b/plugins/jenkins-backend/package.json
index 64278618af..14005656ab 100644
--- a/plugins/jenkins-backend/package.json
+++ b/plugins/jenkins-backend/package.json
@@ -31,7 +31,7 @@
     "@backstage/config": "^0.1.15",
     "@backstage/errors": "^0.2.2",
     "@backstage/plugin-auth-node": "^0.1.3",
-    "@backstage/plugin-jenkins-common": "^0.1.0",
+    "@backstage/plugin-jenkins-common": "^0.0.0",
     "@backstage/plugin-permission-common": "^0.5.1",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
diff --git a/plugins/jenkins-backend/src/service/router.ts b/plugins/jenkins-backend/src/service/router.ts
index dcef2c2e0a..08712215e4 100644
--- a/plugins/jenkins-backend/src/service/router.ts
+++ b/plugins/jenkins-backend/src/service/router.ts
@@ -17,10 +17,10 @@
 import { errorHandler } from '@backstage/backend-common';
 import express from 'express';
 import Router from 'express-promise-router';
-import type { Logger } from 'winston';
-import type { JenkinsInfoProvider } from './jenkinsInfoProvider';
+import { Logger } from 'winston';
+import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
-import type { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
 import { stringifyEntityRef } from '@backstage/catalog-model';
 
diff --git a/plugins/jenkins-common/package.json b/plugins/jenkins-common/package.json
index 08f12960bc..41a63298ef 100644
--- a/plugins/jenkins-common/package.json
+++ b/plugins/jenkins-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-jenkins-common",
-  "version": "0.1.0",
+  "version": "0.0.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "license": "Apache-2.0",
diff --git a/plugins/jenkins/package.json b/plugins/jenkins/package.json
index e9ea4e5b5c..74e839f7d1 100644
--- a/plugins/jenkins/package.json
+++ b/plugins/jenkins/package.json
@@ -40,7 +40,7 @@
     "@backstage/core-plugin-api": "^0.7.0",
     "@backstage/errors": "^0.2.2",
     "@backstage/plugin-catalog-react": "^0.7.0",
-    "@backstage/plugin-jenkins-common": "^0.1.0",
+    "@backstage/plugin-jenkins-common": "^0.0.0",
     "@backstage/theme": "^0.2.15",
     "@material-ui/core": "^4.12.2",
     "@material-ui/icons": "^4.9.1",