From 23646e51a51065e8773f5fe4b56bbe4e5f1ccbf9 Mon Sep 17 00:00:00 2001 From: Mike Lewis Date: Tue, 8 Mar 2022 13:16:16 +0000 Subject: [PATCH] catalog-backend: use new PermissionAuthorizer#policyDecision method Signed-off-by: Mike Lewis --- .changeset/cuddly-turtles-sleep.md | 5 +++++ .../service/AuthorizedEntitiesCatalog.test.ts | 21 ++++++++++--------- .../src/service/AuthorizedEntitiesCatalog.ts | 6 +++--- .../service/AuthorizedLocationService.test.ts | 1 + .../service/AuthorizedRefreshService.test.ts | 1 + 5 files changed, 21 insertions(+), 13 deletions(-) create mode 100644 .changeset/cuddly-turtles-sleep.md diff --git a/.changeset/cuddly-turtles-sleep.md b/.changeset/cuddly-turtles-sleep.md new file mode 100644 index 0000000000..bb1a925506 --- /dev/null +++ b/.changeset/cuddly-turtles-sleep.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-catalog-backend': patch +--- + +Use new `PermissionEvaluator#query` method when retrieving permission conditions. diff --git a/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.test.ts b/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.test.ts index b29e1121b3..16d3070c6d 100644 --- a/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.test.ts +++ b/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.test.ts @@ -30,6 +30,7 @@ describe('AuthorizedEntitiesCatalog', () => { }; const fakePermissionApi = { authorize: jest.fn(), + policyDecision: jest.fn(), }; const createCatalog = (...rules: CatalogPermissionRule[]) => @@ -45,7 +46,7 @@ describe('AuthorizedEntitiesCatalog', () => { describe('entities', () => { it('returns empty response on DENY', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.DENY }, ]); const catalog = createCatalog(); @@ -61,7 +62,7 @@ describe('AuthorizedEntitiesCatalog', () => { }); it('calls underlying catalog method with correct filter on CONDITIONAL', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.CONDITIONAL, conditions: { rule: 'IS_ENTITY_KIND', params: [['b']] }, @@ -78,7 +79,7 @@ describe('AuthorizedEntitiesCatalog', () => { }); it('calls underlying catalog method on ALLOW', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.ALLOW }, ]); const catalog = createCatalog(); @@ -98,7 +99,7 @@ describe('AuthorizedEntitiesCatalog', () => { { kind: 'component', namespace: 'default', name: 'my-component' }, ], }); - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.DENY }, ]); const catalog = new AuthorizedEntitiesCatalog( @@ -113,7 +114,7 @@ describe('AuthorizedEntitiesCatalog', () => { }); it('throws error on CONDITIONAL authorization that evaluates to 0 entities', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.CONDITIONAL, conditions: { rule: 'IS_ENTITY_KIND', params: [['b']] }, @@ -132,7 +133,7 @@ describe('AuthorizedEntitiesCatalog', () => { }); it('calls underlying catalog method on CONDITIONAL authorization that evaluates to nonzero entities', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.CONDITIONAL, conditions: { rule: 'IS_ENTITY_KIND', params: [['b']] }, @@ -158,7 +159,7 @@ describe('AuthorizedEntitiesCatalog', () => { { kind: 'component', namespace: 'default', name: 'my-component' }, ], }); - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.ALLOW }, ]); const catalog = new AuthorizedEntitiesCatalog( @@ -252,7 +253,7 @@ describe('AuthorizedEntitiesCatalog', () => { describe('facets', () => { it('returns empty response on DENY', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.DENY }, ]); const catalog = createCatalog(); @@ -268,7 +269,7 @@ describe('AuthorizedEntitiesCatalog', () => { }); it('calls underlying catalog method with correct filter on CONDITIONAL', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.CONDITIONAL, conditions: { rule: 'IS_ENTITY_KIND', params: [['b']] }, @@ -286,7 +287,7 @@ describe('AuthorizedEntitiesCatalog', () => { }); it('calls underlying catalog method on ALLOW', async () => { - fakePermissionApi.authorize.mockResolvedValue([ + fakePermissionApi.policyDecision.mockResolvedValue([ { result: AuthorizeResult.ALLOW }, ]); const catalog = createCatalog(); diff --git a/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.ts b/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.ts index 2f94e23303..fe1bb579f5 100644 --- a/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.ts +++ b/plugins/catalog-backend/src/service/AuthorizedEntitiesCatalog.ts @@ -45,7 +45,7 @@ export class AuthorizedEntitiesCatalog implements EntitiesCatalog { async entities(request?: EntitiesRequest): Promise { const authorizeDecision = ( - await this.permissionApi.authorize( + await this.permissionApi.policyDecision( [{ permission: catalogEntityReadPermission }], { token: request?.authorizationToken }, ) @@ -78,7 +78,7 @@ export class AuthorizedEntitiesCatalog implements EntitiesCatalog { options?: { authorizationToken?: string }, ): Promise { const authorizeResponse = ( - await this.permissionApi.authorize( + await this.permissionApi.policyDecision( [{ permission: catalogEntityDeletePermission }], { token: options?.authorizationToken }, ) @@ -155,7 +155,7 @@ export class AuthorizedEntitiesCatalog implements EntitiesCatalog { async facets(request: EntityFacetsRequest): Promise { const authorizeDecision = ( - await this.permissionApi.authorize( + await this.permissionApi.policyDecision( [{ permission: catalogEntityReadPermission }], { token: request?.authorizationToken }, ) diff --git a/plugins/catalog-backend/src/service/AuthorizedLocationService.test.ts b/plugins/catalog-backend/src/service/AuthorizedLocationService.test.ts index b27ca92924..3db6bff208 100644 --- a/plugins/catalog-backend/src/service/AuthorizedLocationService.test.ts +++ b/plugins/catalog-backend/src/service/AuthorizedLocationService.test.ts @@ -27,6 +27,7 @@ describe('AuthorizedLocationService', () => { }; const fakePermissionApi = { authorize: jest.fn(), + policyDecision: jest.fn(), }; const mockAllow = () => { diff --git a/plugins/catalog-backend/src/service/AuthorizedRefreshService.test.ts b/plugins/catalog-backend/src/service/AuthorizedRefreshService.test.ts index 82bedec573..d1c4fe3fc1 100644 --- a/plugins/catalog-backend/src/service/AuthorizedRefreshService.test.ts +++ b/plugins/catalog-backend/src/service/AuthorizedRefreshService.test.ts @@ -25,6 +25,7 @@ describe('AuthorizedRefreshService', () => { }; const permissionApi = { authorize: jest.fn(), + policyDecision: jest.fn(), }; afterEach(() => {