Merge pull request #25604 from backstage/rugvip/policyuser

permission-node: update policy handler to work with new auth system

docs/features/kubernetes/proxy.md

@@ -60,7 +60,6 @@ This feature assumes your backstage instance has enabled the [permissions framew
 A sample policy like:
 
 ```typescript
-import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
 import {
   AuthorizeResult,
   PolicyDecision,
@@ -68,12 +67,13 @@ import {
 import {
   PermissionPolicy,
   PolicyQuery,
+  PolicyQueryUser,
 } from '@backstage/plugin-permission-node';
 
 class KubernetesDenyAllProxyEndpointPolicy implements PermissionPolicy {
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     if (request.permission.name === 'kubernetes.proxy') {
       return {

docs/features/software-templates/authorizing-scaffolder-template-details.md

@@ -66,14 +66,14 @@ import {
 class ExamplePermissionPolicy implements PermissionPolicy {
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     /* highlight-add-start */
     if (
       isPermission(request.permission, templateParameterReadPermission) ||
       isPermission(request.permission, templateStepReadPermission)
     ) {
-      if (user?.identity.userEntityRef === 'user:default/spiderman')
+      if (user?.info.userEntityRef === 'user:default/spiderman')
         return createScaffolderTemplateConditionalDecision(request.permission, {
           not: scaffolderTemplateConditions.hasTag({ tag: 'secret' }),
         });
@@ -109,11 +109,11 @@ import {
 class ExamplePermissionPolicy implements PermissionPolicy {
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     /* highlight-add-start */
     if (isPermission(request.permission, actionExecutePermission)) {
-      if (user?.identity.userEntityRef === 'user:default/spiderman') {
+      if (user?.info.userEntityRef === 'user:default/spiderman') {
         return createScaffolderActionConditionalDecision(request.permission, {
           not: scaffolderActionConditions.hasActionId({
             actionId: 'debug:log',
@@ -147,11 +147,11 @@ import {
 class ExamplePermissionPolicy implements PermissionPolicy {
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     /* highlight-add-start */
     if (isPermission(request.permission, actionExecutePermission)) {
-      if (user?.identity.userEntityRef === 'user:default/spiderman') {
+      if (user?.info.userEntityRef === 'user:default/spiderman') {
         return createScaffolderActionConditionalDecision(request.permission, {
           not: {
             allOf: [
@@ -190,25 +190,25 @@ import {
 class ExamplePermissionPolicy implements PermissionPolicy {
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     /* highlight-add-start */
     if (isPermission(request.permission, taskCreatePermission)) {
-      if (user?.identity.userEntityRef === 'user:default/spiderman') {
+      if (user?.info.userEntityRef === 'user:default/spiderman') {
         return {
           result: AuthorizeResult.ALLOW,
         };
       }
     }
     if (isPermission(request.permission, taskCancelPermission)) {
-      if (user?.identity.userEntityRef === 'user:default/spiderman') {
+      if (user?.info.userEntityRef === 'user:default/spiderman') {
         return {
           result: AuthorizeResult.ALLOW,
         };
       }
     }
     if (isPermission(request.permission, taskReadPermission)) {
-      if (user?.identity.userEntityRef === 'user:default/spiderman') {
+      if (user?.info.userEntityRef === 'user:default/spiderman') {
         return {
           result: AuthorizeResult.ALLOW,
         };
@@ -239,7 +239,6 @@ Instead of the changes in `permission.ts` noted in the above example you will ma
 
 ```ts title="packages/backend/src/index.ts"
 import { createBackendModule } from '@backstage/backend-plugin-api';
-import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
 import {
   PolicyDecision,
   AuthorizeResult,
@@ -247,13 +246,14 @@ import {
 import {
   PermissionPolicy,
   PolicyQuery,
+  PolicyQueryUser,
 } from '@backstage/plugin-permission-node';
 import { policyExtensionPoint } from '@backstage/plugin-permission-node/alpha';
 
 class ExamplePermissionPolicy implements PermissionPolicy {
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     // Various scaffolder permission checks ...