(feature): enable permissions in jenkins plugin. Actions (re-build) can be executed only by a user who owns the entity (or related group own the entity)

Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com>

.changeset/gold-garlics-sing.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-jenkins-common': major
+---
+
+Add a new common plugin for jenkins which provides shared isomorphic code for the jenkins plugin.

.changeset/orange-cobras-shave.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-jenkins-backend': minor
+---
+
+Add permissions support for jenkins backend and provide an integration router. You must pass a permission router
+if you want to enable permissions in jenkins plugin.

.changeset/ten-fireants-march.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-jenkins': minor
+---
+
+Integrated the permission plugin, if enabled, the actions can be executed only by owned user (or assigned to related group)

plugins/jenkins-backend/api-report.md

@@ -4,10 +4,25 @@
 
 ```ts
 import { CatalogApi } from '@backstage/catalog-client';
+import { ConditionalPolicyDecision } from '@backstage/plugin-permission-node';
+import { Conditions } from '@backstage/plugin-permission-node';
 import { Config } from '@backstage/config';
+import { EntitiesSearchFilter } from '@backstage/plugin-catalog-backend';
+import { Entity } from '@backstage/catalog-model';
 import { EntityName } from '@backstage/catalog-model';
 import express from 'express';
 import { Logger as Logger_2 } from 'winston';
+import { PermissionCondition } from '@backstage/plugin-permission-common';
+import { PermissionCriteria } from '@backstage/plugin-permission-common';
+import { PermissionRule } from '@backstage/plugin-permission-node';
+import { PluginEndpointDiscovery } from '@backstage/backend-common';
+
+// Warning: (ae-missing-release-tag) "createJenkinsPermissionPolicy" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const createJenkinsPermissionPolicy: (
+  conditions: PermissionCriteria<PermissionCondition<unknown[]>>,
+) => ConditionalPolicyDecision;
 
 // Warning: (ae-missing-release-tag) "createRouter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -34,6 +49,17 @@ export class DefaultJenkinsInfoProvider implements JenkinsInfoProvider {
   static readonly OLD_JENKINS_ANNOTATION = 'jenkins.io/github-folder';
 }
 
+// Warning: (ae-missing-release-tag) "jenkinsConditions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export const jenkinsConditions: Conditions<{
+  isEntityOwner: PermissionRule<
+    Entity,
+    EntitiesSearchFilter,
+    [claims: string[]]
+  >;
+}>;
+
 // Warning: (ae-missing-release-tag) "JenkinsConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -86,10 +112,30 @@ export interface JenkinsInstanceConfig {
   username: string;
 }
 
+// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
+// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
+//
+// @public
+export const jenkinsPermissionRules: {
+  isEntityOwner: PermissionRule<
+    Entity,
+    EntitiesSearchFilter,
+    [claims: string[]]
+  >;
+};
+
 // Warning: (ae-missing-release-tag) "RouterOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
 export interface RouterOptions {
+  // (undocumented)
+  config?: Config;
+  // (undocumented)
+  discovery?: PluginEndpointDiscovery;
+  // (undocumented)
+  fetchApi?: {
+    fetch: typeof fetch;
+  };
   // (undocumented)
   jenkinsInfoProvider: JenkinsInfoProvider;
   // (undocumented)

plugins/jenkins-backend/package.json

@@ -29,6 +29,9 @@
     "@backstage/catalog-client": "^0.7.2",
     "@backstage/catalog-model": "^0.11.0",
     "@backstage/config": "^0.1.15",
+    "@backstage/plugin-catalog-backend": "^0.22.0",
+    "@backstage/plugin-jenkins-common": "^0.1.0",
+    "@backstage/plugin-permission-node": "^0.5.2",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",

plugins/jenkins-backend/src/index.ts

@@ -21,3 +21,4 @@
  */
 
 export * from './service';
+export * from './permissions';

plugins/jenkins-backend/src/permissions/conditionExports.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { jenkinsPermissionRules } from './rules';
+import { createConditionExports } from '@backstage/plugin-permission-node';
+import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+
+const { conditions, createPolicyDecision } = createConditionExports({
+  pluginId: 'jenkins',
+  resourceType: RESOURCE_TYPE_JENKINS,
+  rules: jenkinsPermissionRules,
+});
+
+export const jenkinsConditions = conditions;
+export const createJenkinsPermissionPolicy = createPolicyDecision;

plugins/jenkins-backend/src/permissions/index.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export {
+  createJenkinsPermissionPolicy,
+  jenkinsConditions,
+} from './conditionExports';
+export * from './rules';

plugins/jenkins-backend/src/permissions/permission-router-factory.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
+import { jenkinsPermissionRules } from './rules';
+import { parseEntityRef } from '@backstage/catalog-model';
+import type { PluginEndpointDiscovery } from '@backstage/backend-common';
+import { CatalogClient } from '@backstage/catalog-client';
+import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common';
+
+export const jenkinsPermissionIntegrationRouterFactory = (
+  discoveryApi: PluginEndpointDiscovery,
+  fetchApi?: { fetch: typeof fetch },
+) => {
+  const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi });
+  return createPermissionIntegrationRouter({
+    resourceType: RESOURCE_TYPE_JENKINS,
+    rules: Object.values(jenkinsPermissionRules),
+    getResources: resourceRefs => {
+      const entities = resourceRefs.map(async resourceRef => {
+        const { kind, namespace, name } = parseEntityRef(resourceRef);
+        return catalogApi.getEntityByName({ kind, name, namespace });
+      });
+      // combine the promises to return entities as any array, getResources expects a single promise with all entities
+      return Promise.all(entities);
+    },
+  });
+};

plugins/jenkins-backend/src/permissions/rules/index.ts

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { permissionRules } from '@backstage/plugin-catalog-backend';
+/**
+ *
+ * Jenkins' permission rules can be used to defined different kind of rules to check if the user authorizes an action
+ * (or listing the jobs ever)
+ *
+ * Provided rules:
+ * {isEntityOwner} can be used to determine if a user or the group of the user
+ * owns an entity.
+ *
+ * @public
+ */
+export const jenkinsPermissionRules = {
+  isEntityOwner: permissionRules.isEntityOwner,
+};

plugins/jenkins-backend/src/service/router.ts

@@ -14,16 +14,24 @@
  * limitations under the License.
  */
 
-import { errorHandler } from '@backstage/backend-common';
+import {
+  errorHandler,
+  PluginEndpointDiscovery,
+} from '@backstage/backend-common';
 import express from 'express';
 import Router from 'express-promise-router';
 import { Logger } from 'winston';
 import { JenkinsInfoProvider } from './jenkinsInfoProvider';
 import { JenkinsApiImpl } from './jenkinsApi';
+import { Config } from '@backstage/config';
+import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory';
 
 export interface RouterOptions {
   logger: Logger;
   jenkinsInfoProvider: JenkinsInfoProvider;
+  config?: Config;
+  discovery?: PluginEndpointDiscovery;
+  fetchApi?: { fetch: typeof fetch };
 }
 
 export async function createRouter(
@@ -117,7 +125,18 @@ export async function createRouter(
       response.json({});
     },
   );
-
   router.use(errorHandler());
+
+  if (options.config?.getOptionalBoolean('permission.enabled')) {
+    if (!options.discovery) {
+      throw new Error('Discovery API is required if permissions are enabled.');
+    }
+    router.use(
+      jenkinsPermissionIntegrationRouterFactory(
+        options.discovery,
+        options.fetchApi,
+      ),
+    );
+  }
   return router;
 }

plugins/jenkins-common/.eslintrc.js

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: [require.resolve('@backstage/cli/config/eslint')],
+};

plugins/jenkins-common/README.md

@@ -0,0 +1,3 @@
+# Jenkins Common
+
+Shared isomorphic code for the jenkins plugin.

plugins/jenkins-common/api-report.md

@@ -0,0 +1,15 @@
+## API Report File for "@backstage/plugin-jenkins-common"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+import { Permission } from '@backstage/plugin-permission-common';
+
+// @public
+export const jenkinsExecutePermission: Permission;
+
+// @public (undocumented)
+export const RESOURCE_TYPE_JENKINS = 'jenkins';
+
+// (No @packageDocumentation comment for this package)
+```

plugins/jenkins-common/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@backstage/plugin-jenkins-common",
+  "version": "0.1.0",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "module": "dist/index.esm.js",
+    "types": "dist/index.d.ts"
+  },
+  "backstage": {
+    "role": "common-library"
+  },
+  "scripts": {
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack",
+    "clean": "backstage-cli package clean"
+  },
+  "dependencies": {
+    "@backstage/plugin-permission-common": "^0.5.1"
+  },
+  "devDependencies": {
+    "@backstage/cli": "^0.14.1"
+  },
+  "files": [
+    "dist"
+  ]
+}

plugins/jenkins-common/src/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './permissions';

plugins/jenkins-common/src/permissions.ts

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Permission } from '@backstage/plugin-permission-common';
+
+/**
+ * @public
+ */
+export const RESOURCE_TYPE_JENKINS = 'jenkins';
+
+/**
+ * This permission is used to determine if a user is allowed to execute an action in jenkins plugin
+ *
+ * @public
+ */
+export const jenkinsExecutePermission: Permission = {
+  name: 'jenkins.execute',
+  attributes: {
+    action: 'update',
+  },
+  resourceType: RESOURCE_TYPE_JENKINS,
+};

plugins/jenkins/package.json

@@ -40,6 +40,7 @@
     "@backstage/core-plugin-api": "^0.7.0",
     "@backstage/errors": "^0.2.2",
     "@backstage/plugin-catalog-react": "^0.7.0",
+    "@backstage/plugin-jenkins-common": "^0.1.0",
     "@backstage/theme": "^0.2.15",
     "@material-ui/core": "^4.12.2",
     "@material-ui/icons": "^4.9.1",

plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx

@@ -15,6 +15,7 @@
  */
 import { Link, Progress, Table, TableColumn } from '@backstage/core-components';
 import { alertApiRef, useApi, useRouteRef } from '@backstage/core-plugin-api';
+import { useEntityPermission } from '@backstage/plugin-catalog-react';
 import { Box, IconButton, Tooltip, Typography } from '@material-ui/core';
 import RetryIcon from '@material-ui/icons/Replay';
 import { default as React, useState } from 'react';
@@ -23,6 +24,7 @@ import JenkinsLogo from '../../../../assets/JenkinsLogo.svg';
 import { buildRouteRef } from '../../../../plugin';
 import { useBuilds } from '../../../useBuilds';
 import { JenkinsRunStatus } from '../Status';
+import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common';
 
 const FailCount = ({ count }: { count: number }): JSX.Element | null => {
   if (count !== 0) {
@@ -174,6 +176,10 @@ const generatedColumns: TableColumn[] = [
     render: (row: Partial<Project>) => {
       const ActionWrapper = () => {
         const [isLoadingRebuild, setIsLoadingRebuild] = useState(false);
+        const { allowed, loading } = useEntityPermission(
+          jenkinsExecutePermission,
+        );
+
         const alertApi = useApi(alertApiRef);
 
         const onRebuild = async () => {
@@ -201,7 +207,7 @@ const generatedColumns: TableColumn[] = [
             <>
               {isLoadingRebuild && <Progress />}
               {!isLoadingRebuild && (
-                <IconButton onClick={onRebuild}>
+                <IconButton onClick={onRebuild} disabled={loading || !allowed}>
                   <RetryIcon />
                 </IconButton>
               )}

yarn.lock

@@ -11929,6 +11929,7 @@ evp_bytestokey@^1.0.0, evp_bytestokey@^1.0.3:
     "@backstage/plugin-graphiql" "^0.2.32"
     "@backstage/plugin-home" "^0.4.16"
     "@backstage/plugin-jenkins" "^0.6.0"
+    "@backstage/plugin-jenkins-common" "^0.1.0"
     "@backstage/plugin-kafka" "^0.3.0"
     "@backstage/plugin-kubernetes" "^0.6.0"
     "@backstage/plugin-lighthouse" "^0.3.0"