Merge pull request #9840 from nodify-at/master

Integrate permissions to Jenkins plugin

plugins/jenkins-backend/src/service/jenkinsApi.test.ts

@@ -18,6 +18,8 @@ import { JenkinsApiImpl } from './jenkinsApi';
 import jenkins from 'jenkins';
 import { JenkinsInfo } from './jenkinsInfoProvider';
 import { JenkinsBuild, JenkinsProject } from '../types';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
+import { NotAllowedError } from '@backstage/errors';
 
 jest.mock('jenkins');
 const mockedJenkinsClient = {
@@ -40,8 +42,16 @@ const jenkinsInfo: JenkinsInfo = {
   jobFullName: 'example-jobName',
 };
 
+const fakePermissionApi = {
+  authorize: jest.fn().mockResolvedValue([
+    {
+      result: AuthorizeResult.ALLOW,
+    },
+  ]),
+};
+
 describe('JenkinsApi', () => {
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(fakePermissionApi);
 
   describe('getProjects', () => {
     const project: JenkinsProject = {
@@ -413,6 +423,34 @@ describe('JenkinsApi', () => {
     expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
   });
 
+  it('buildProject should fail if it does not have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.DENY,
+      },
+    ]);
+
+    await expect(() =>
+      jenkinsApi.buildProject(jenkinsInfo, jobFullName),
+    ).rejects.toThrow(NotAllowedError);
+  });
+
+  it('buildProject should succeed if it have required permissions', async () => {
+    fakePermissionApi.authorize.mockResolvedValueOnce([
+      {
+        result: AuthorizeResult.ALLOW,
+      },
+    ]);
+
+    await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+    expect(mockedJenkins).toHaveBeenCalledWith({
+      baseUrl: jenkinsInfo.baseUrl,
+      headers: jenkinsInfo.headers,
+      promisify: true,
+    });
+    expect(mockedJenkinsClient.job.build).toBeCalledWith(jobFullName);
+  });
+
   it('buildProject with crumbIssuer option', async () => {
     const info: JenkinsInfo = { ...jenkinsInfo, crumbIssuer: true };
     await jenkinsApi.buildProject(info, jobFullName);

plugins/jenkins-backend/src/service/jenkinsApi.ts

@@ -14,15 +14,21 @@
  * limitations under the License.
  */
 
-import { JenkinsInfo } from './jenkinsInfoProvider';
+import type { JenkinsInfo } from './jenkinsInfoProvider';
 import jenkins from 'jenkins';
-import {
+import type {
   BackstageBuild,
   BackstageProject,
   JenkinsBuild,
   JenkinsProject,
   ScmDetails,
 } from '../types';
+import {
+  AuthorizeResult,
+  PermissionAuthorizer,
+} from '@backstage/plugin-permission-common';
+import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common';
+import { NotAllowedError } from '@backstage/errors';
 
 export class JenkinsApiImpl {
   private static readonly lastBuildTreeSpec = `lastBuild[
@@ -58,6 +64,8 @@ export class JenkinsApiImpl {
                    ${JenkinsApiImpl.jobTreeSpec}
                  ]{0,50}`;
 
+  constructor(private readonly permissionApi?: PermissionAuthorizer) {}
+
   /**
    * Get a list of projects for the given JenkinsInfo.
    * @see ../../../jenkins/src/api/JenkinsApi.ts#getProjects
@@ -128,9 +136,26 @@ export class JenkinsApiImpl {
    * Trigger a build of a project
    * @see ../../../jenkins/src/api/JenkinsApi.ts#retry
    */
-  async buildProject(jenkinsInfo: JenkinsInfo, jobFullName: string) {
+  async buildProject(
+    jenkinsInfo: JenkinsInfo,
+    jobFullName: string,
+    resourceRef?: string,
+    options?: { token?: string },
+  ) {
     const client = await JenkinsApiImpl.getClient(jenkinsInfo);
 
+    if (this.permissionApi) {
+      const response = await this.permissionApi.authorize(
+        [{ permission: jenkinsExecutePermission, resourceRef }],
+        { token: options?.token },
+      );
+      // permission api returns always at least one item, we need to check only one result since we do not expect any additional results
+      const { result } = response[0];
+      if (result === AuthorizeResult.DENY) {
+        throw new NotAllowedError();
+      }
+    }
+
     // looks like the current SDK only supports triggering a new build
     // can't see any support for replay (re-running the specific build with the same SCM info)
 

plugins/jenkins-backend/src/service/router.ts

@@ -20,10 +20,14 @@ import Router from 'express-promise-router';
 import { Logger } from 'winston';
 import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
+import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
+import { stringifyEntityRef } from '@backstage/catalog-model';
 
 export interface RouterOptions {
   logger: Logger;
   jenkinsInfoProvider: JenkinsInfoProvider;
+  permissions?: PermissionAuthorizer;
 }
 
 export async function createRouter(
@@ -31,7 +35,7 @@ export async function createRouter(
 ): Promise<express.Router> {
   const { jenkinsInfoProvider } = options;
 
-  const jenkinsApi = new JenkinsApiImpl();
+  const jenkinsApi = new JenkinsApiImpl(options.permissions);
 
   const router = Router();
   router.use(express.json());
@@ -103,7 +107,6 @@ export async function createRouter(
     '/v1/entity/:namespace/:kind/:name/job/:jobFullName/:buildNumber::rebuild',
     async (request, response) => {
       const { namespace, kind, name, jobFullName } = request.params;
-
       const jenkinsInfo = await jenkinsInfoProvider.getInstance({
         entityRef: {
           kind,
@@ -112,12 +115,17 @@ export async function createRouter(
         },
         jobFullName,
       });
+      const token = getBearerTokenFromAuthorizationHeader(
+        request.header('authorization'),
+      );
 
-      await jenkinsApi.buildProject(jenkinsInfo, jobFullName);
+      const resourceRef = stringifyEntityRef({ kind, namespace, name });
+      await jenkinsApi.buildProject(jenkinsInfo, jobFullName, resourceRef, {
+        token,
+      });
       response.json({});
     },
   );
-
   router.use(errorHandler());
   return router;
 }