From 23e1c17bbaccfdbcbfac39f1d17902ec536aaf68 Mon Sep 17 00:00:00 2001 From: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com> Date: Sun, 27 Feb 2022 01:58:56 +0100 Subject: [PATCH] (feature): enable permissions in jenkins plugin. Actions (re-build) can be executed only by a user who owns the entity (or related group own the entity) Signed-off-by: Hasan Oezdemir <21654050+nodify-at@users.noreply.github.com> --- .changeset/gold-garlics-sing.md | 5 ++ .changeset/orange-cobras-shave.md | 6 +++ .changeset/ten-fireants-march.md | 5 ++ plugins/jenkins-backend/api-report.md | 46 +++++++++++++++++++ plugins/jenkins-backend/package.json | 3 ++ plugins/jenkins-backend/src/index.ts | 1 + .../src/permissions/conditionExports.ts | 27 +++++++++++ .../jenkins-backend/src/permissions/index.ts | 20 ++++++++ .../permissions/permission-router-factory.ts | 40 ++++++++++++++++ .../src/permissions/rules/index.ts | 30 ++++++++++++ plugins/jenkins-backend/src/service/router.ts | 23 +++++++++- plugins/jenkins-common/.eslintrc.js | 3 ++ plugins/jenkins-common/README.md | 3 ++ plugins/jenkins-common/api-report.md | 15 ++++++ plugins/jenkins-common/package.json | 33 +++++++++++++ plugins/jenkins-common/src/index.ts | 16 +++++++ plugins/jenkins-common/src/permissions.ts | 34 ++++++++++++++ plugins/jenkins/package.json | 1 + .../BuildsPage/lib/CITable/CITable.tsx | 8 +++- yarn.lock | 1 + 20 files changed, 317 insertions(+), 3 deletions(-) create mode 100644 .changeset/gold-garlics-sing.md create mode 100644 .changeset/orange-cobras-shave.md create mode 100644 .changeset/ten-fireants-march.md create mode 100644 plugins/jenkins-backend/src/permissions/conditionExports.ts create mode 100644 plugins/jenkins-backend/src/permissions/index.ts create mode 100644 plugins/jenkins-backend/src/permissions/permission-router-factory.ts create mode 100644 plugins/jenkins-backend/src/permissions/rules/index.ts create mode 100644 plugins/jenkins-common/.eslintrc.js create mode 100644 plugins/jenkins-common/README.md create mode 100644 plugins/jenkins-common/api-report.md create mode 100644 plugins/jenkins-common/package.json create mode 100644 plugins/jenkins-common/src/index.ts create mode 100644 plugins/jenkins-common/src/permissions.ts diff --git a/.changeset/gold-garlics-sing.md b/.changeset/gold-garlics-sing.md new file mode 100644 index 0000000000..f13229d003 --- /dev/null +++ b/.changeset/gold-garlics-sing.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-jenkins-common': major +--- + +Add a new common plugin for jenkins which provides shared isomorphic code for the jenkins plugin. diff --git a/.changeset/orange-cobras-shave.md b/.changeset/orange-cobras-shave.md new file mode 100644 index 0000000000..c753aecbc6 --- /dev/null +++ b/.changeset/orange-cobras-shave.md @@ -0,0 +1,6 @@ +--- +'@backstage/plugin-jenkins-backend': minor +--- + +Add permissions support for jenkins backend and provide an integration router. You must pass a permission router +if you want to enable permissions in jenkins plugin. diff --git a/.changeset/ten-fireants-march.md b/.changeset/ten-fireants-march.md new file mode 100644 index 0000000000..9376292196 --- /dev/null +++ b/.changeset/ten-fireants-march.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-jenkins': minor +--- + +Integrated the permission plugin, if enabled, the actions can be executed only by owned user (or assigned to related group) diff --git a/plugins/jenkins-backend/api-report.md b/plugins/jenkins-backend/api-report.md index d437a5dd75..6f9ec10cf4 100644 --- a/plugins/jenkins-backend/api-report.md +++ b/plugins/jenkins-backend/api-report.md @@ -4,10 +4,25 @@ ```ts import { CatalogApi } from '@backstage/catalog-client'; +import { ConditionalPolicyDecision } from '@backstage/plugin-permission-node'; +import { Conditions } from '@backstage/plugin-permission-node'; import { Config } from '@backstage/config'; +import { EntitiesSearchFilter } from '@backstage/plugin-catalog-backend'; +import { Entity } from '@backstage/catalog-model'; import { EntityName } from '@backstage/catalog-model'; import express from 'express'; import { Logger as Logger_2 } from 'winston'; +import { PermissionCondition } from '@backstage/plugin-permission-common'; +import { PermissionCriteria } from '@backstage/plugin-permission-common'; +import { PermissionRule } from '@backstage/plugin-permission-node'; +import { PluginEndpointDiscovery } from '@backstage/backend-common'; + +// Warning: (ae-missing-release-tag) "createJenkinsPermissionPolicy" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export const createJenkinsPermissionPolicy: ( + conditions: PermissionCriteria>, +) => ConditionalPolicyDecision; // Warning: (ae-missing-release-tag) "createRouter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // @@ -34,6 +49,17 @@ export class DefaultJenkinsInfoProvider implements JenkinsInfoProvider { static readonly OLD_JENKINS_ANNOTATION = 'jenkins.io/github-folder'; } +// Warning: (ae-missing-release-tag) "jenkinsConditions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export const jenkinsConditions: Conditions<{ + isEntityOwner: PermissionRule< + Entity, + EntitiesSearchFilter, + [claims: string[]] + >; +}>; + // Warning: (ae-missing-release-tag) "JenkinsConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public @@ -86,10 +112,30 @@ export interface JenkinsInstanceConfig { username: string; } +// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag +// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@" +// +// @public +export const jenkinsPermissionRules: { + isEntityOwner: PermissionRule< + Entity, + EntitiesSearchFilter, + [claims: string[]] + >; +}; + // Warning: (ae-missing-release-tag) "RouterOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) export interface RouterOptions { + // (undocumented) + config?: Config; + // (undocumented) + discovery?: PluginEndpointDiscovery; + // (undocumented) + fetchApi?: { + fetch: typeof fetch; + }; // (undocumented) jenkinsInfoProvider: JenkinsInfoProvider; // (undocumented) diff --git a/plugins/jenkins-backend/package.json b/plugins/jenkins-backend/package.json index 66cbe5ba24..72ebc1ee2b 100644 --- a/plugins/jenkins-backend/package.json +++ b/plugins/jenkins-backend/package.json @@ -29,6 +29,9 @@ "@backstage/catalog-client": "^0.7.2", "@backstage/catalog-model": "^0.11.0", "@backstage/config": "^0.1.15", + "@backstage/plugin-catalog-backend": "^0.22.0", + "@backstage/plugin-jenkins-common": "^0.1.0", + "@backstage/plugin-permission-node": "^0.5.2", "@types/express": "^4.17.6", "express": "^4.17.1", "express-promise-router": "^4.1.0", diff --git a/plugins/jenkins-backend/src/index.ts b/plugins/jenkins-backend/src/index.ts index c55335c52d..c584842e07 100644 --- a/plugins/jenkins-backend/src/index.ts +++ b/plugins/jenkins-backend/src/index.ts @@ -21,3 +21,4 @@ */ export * from './service'; +export * from './permissions'; diff --git a/plugins/jenkins-backend/src/permissions/conditionExports.ts b/plugins/jenkins-backend/src/permissions/conditionExports.ts new file mode 100644 index 0000000000..5266b1b091 --- /dev/null +++ b/plugins/jenkins-backend/src/permissions/conditionExports.ts @@ -0,0 +1,27 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import { jenkinsPermissionRules } from './rules'; +import { createConditionExports } from '@backstage/plugin-permission-node'; +import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common'; + +const { conditions, createPolicyDecision } = createConditionExports({ + pluginId: 'jenkins', + resourceType: RESOURCE_TYPE_JENKINS, + rules: jenkinsPermissionRules, +}); + +export const jenkinsConditions = conditions; +export const createJenkinsPermissionPolicy = createPolicyDecision; diff --git a/plugins/jenkins-backend/src/permissions/index.ts b/plugins/jenkins-backend/src/permissions/index.ts new file mode 100644 index 0000000000..522f40aeee --- /dev/null +++ b/plugins/jenkins-backend/src/permissions/index.ts @@ -0,0 +1,20 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +export { + createJenkinsPermissionPolicy, + jenkinsConditions, +} from './conditionExports'; +export * from './rules'; diff --git a/plugins/jenkins-backend/src/permissions/permission-router-factory.ts b/plugins/jenkins-backend/src/permissions/permission-router-factory.ts new file mode 100644 index 0000000000..1959eb24a7 --- /dev/null +++ b/plugins/jenkins-backend/src/permissions/permission-router-factory.ts @@ -0,0 +1,40 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node'; +import { jenkinsPermissionRules } from './rules'; +import { parseEntityRef } from '@backstage/catalog-model'; +import type { PluginEndpointDiscovery } from '@backstage/backend-common'; +import { CatalogClient } from '@backstage/catalog-client'; +import { RESOURCE_TYPE_JENKINS } from '@backstage/plugin-jenkins-common'; + +export const jenkinsPermissionIntegrationRouterFactory = ( + discoveryApi: PluginEndpointDiscovery, + fetchApi?: { fetch: typeof fetch }, +) => { + const catalogApi = new CatalogClient({ discoveryApi, fetchApi: fetchApi }); + return createPermissionIntegrationRouter({ + resourceType: RESOURCE_TYPE_JENKINS, + rules: Object.values(jenkinsPermissionRules), + getResources: resourceRefs => { + const entities = resourceRefs.map(async resourceRef => { + const { kind, namespace, name } = parseEntityRef(resourceRef); + return catalogApi.getEntityByName({ kind, name, namespace }); + }); + // combine the promises to return entities as any array, getResources expects a single promise with all entities + return Promise.all(entities); + }, + }); +}; diff --git a/plugins/jenkins-backend/src/permissions/rules/index.ts b/plugins/jenkins-backend/src/permissions/rules/index.ts new file mode 100644 index 0000000000..0cd07b26a8 --- /dev/null +++ b/plugins/jenkins-backend/src/permissions/rules/index.ts @@ -0,0 +1,30 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import { permissionRules } from '@backstage/plugin-catalog-backend'; +/** + * + * Jenkins' permission rules can be used to defined different kind of rules to check if the user authorizes an action + * (or listing the jobs ever) + * + * Provided rules: + * {isEntityOwner} can be used to determine if a user or the group of the user + * owns an entity. + * + * @public + */ +export const jenkinsPermissionRules = { + isEntityOwner: permissionRules.isEntityOwner, +}; diff --git a/plugins/jenkins-backend/src/service/router.ts b/plugins/jenkins-backend/src/service/router.ts index 8c5852efa9..85320bb520 100644 --- a/plugins/jenkins-backend/src/service/router.ts +++ b/plugins/jenkins-backend/src/service/router.ts @@ -14,16 +14,24 @@ * limitations under the License. */ -import { errorHandler } from '@backstage/backend-common'; +import { + errorHandler, + PluginEndpointDiscovery, +} from '@backstage/backend-common'; import express from 'express'; import Router from 'express-promise-router'; import { Logger } from 'winston'; import { JenkinsInfoProvider } from './jenkinsInfoProvider'; import { JenkinsApiImpl } from './jenkinsApi'; +import { Config } from '@backstage/config'; +import { jenkinsPermissionIntegrationRouterFactory } from '../permissions/permission-router-factory'; export interface RouterOptions { logger: Logger; jenkinsInfoProvider: JenkinsInfoProvider; + config?: Config; + discovery?: PluginEndpointDiscovery; + fetchApi?: { fetch: typeof fetch }; } export async function createRouter( @@ -117,7 +125,18 @@ export async function createRouter( response.json({}); }, ); - router.use(errorHandler()); + + if (options.config?.getOptionalBoolean('permission.enabled')) { + if (!options.discovery) { + throw new Error('Discovery API is required if permissions are enabled.'); + } + router.use( + jenkinsPermissionIntegrationRouterFactory( + options.discovery, + options.fetchApi, + ), + ); + } return router; } diff --git a/plugins/jenkins-common/.eslintrc.js b/plugins/jenkins-common/.eslintrc.js new file mode 100644 index 0000000000..13573efa9c --- /dev/null +++ b/plugins/jenkins-common/.eslintrc.js @@ -0,0 +1,3 @@ +module.exports = { + extends: [require.resolve('@backstage/cli/config/eslint')], +}; diff --git a/plugins/jenkins-common/README.md b/plugins/jenkins-common/README.md new file mode 100644 index 0000000000..71e6db3a16 --- /dev/null +++ b/plugins/jenkins-common/README.md @@ -0,0 +1,3 @@ +# Jenkins Common + +Shared isomorphic code for the jenkins plugin. diff --git a/plugins/jenkins-common/api-report.md b/plugins/jenkins-common/api-report.md new file mode 100644 index 0000000000..b63cc94374 --- /dev/null +++ b/plugins/jenkins-common/api-report.md @@ -0,0 +1,15 @@ +## API Report File for "@backstage/plugin-jenkins-common" + +> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/). + +```ts +import { Permission } from '@backstage/plugin-permission-common'; + +// @public +export const jenkinsExecutePermission: Permission; + +// @public (undocumented) +export const RESOURCE_TYPE_JENKINS = 'jenkins'; + +// (No @packageDocumentation comment for this package) +``` diff --git a/plugins/jenkins-common/package.json b/plugins/jenkins-common/package.json new file mode 100644 index 0000000000..5739794197 --- /dev/null +++ b/plugins/jenkins-common/package.json @@ -0,0 +1,33 @@ +{ + "name": "@backstage/plugin-jenkins-common", + "version": "0.1.0", + "main": "src/index.ts", + "types": "src/index.ts", + "license": "Apache-2.0", + "publishConfig": { + "access": "public", + "main": "dist/index.cjs.js", + "module": "dist/index.esm.js", + "types": "dist/index.d.ts" + }, + "backstage": { + "role": "common-library" + }, + "scripts": { + "build": "backstage-cli package build", + "lint": "backstage-cli package lint", + "test": "backstage-cli package test", + "prepack": "backstage-cli package prepack", + "postpack": "backstage-cli package postpack", + "clean": "backstage-cli package clean" + }, + "dependencies": { + "@backstage/plugin-permission-common": "^0.5.1" + }, + "devDependencies": { + "@backstage/cli": "^0.14.1" + }, + "files": [ + "dist" + ] +} diff --git a/plugins/jenkins-common/src/index.ts b/plugins/jenkins-common/src/index.ts new file mode 100644 index 0000000000..aff3b136bd --- /dev/null +++ b/plugins/jenkins-common/src/index.ts @@ -0,0 +1,16 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +export * from './permissions'; diff --git a/plugins/jenkins-common/src/permissions.ts b/plugins/jenkins-common/src/permissions.ts new file mode 100644 index 0000000000..f521e0454b --- /dev/null +++ b/plugins/jenkins-common/src/permissions.ts @@ -0,0 +1,34 @@ +/* + * Copyright 2022 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import { Permission } from '@backstage/plugin-permission-common'; + +/** + * @public + */ +export const RESOURCE_TYPE_JENKINS = 'jenkins'; + +/** + * This permission is used to determine if a user is allowed to execute an action in jenkins plugin + * + * @public + */ +export const jenkinsExecutePermission: Permission = { + name: 'jenkins.execute', + attributes: { + action: 'update', + }, + resourceType: RESOURCE_TYPE_JENKINS, +}; diff --git a/plugins/jenkins/package.json b/plugins/jenkins/package.json index ada061dba9..e9ea4e5b5c 100644 --- a/plugins/jenkins/package.json +++ b/plugins/jenkins/package.json @@ -40,6 +40,7 @@ "@backstage/core-plugin-api": "^0.7.0", "@backstage/errors": "^0.2.2", "@backstage/plugin-catalog-react": "^0.7.0", + "@backstage/plugin-jenkins-common": "^0.1.0", "@backstage/theme": "^0.2.15", "@material-ui/core": "^4.12.2", "@material-ui/icons": "^4.9.1", diff --git a/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx b/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx index 2c464491c2..c525e297be 100644 --- a/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx +++ b/plugins/jenkins/src/components/BuildsPage/lib/CITable/CITable.tsx @@ -15,6 +15,7 @@ */ import { Link, Progress, Table, TableColumn } from '@backstage/core-components'; import { alertApiRef, useApi, useRouteRef } from '@backstage/core-plugin-api'; +import { useEntityPermission } from '@backstage/plugin-catalog-react'; import { Box, IconButton, Tooltip, Typography } from '@material-ui/core'; import RetryIcon from '@material-ui/icons/Replay'; import { default as React, useState } from 'react'; @@ -23,6 +24,7 @@ import JenkinsLogo from '../../../../assets/JenkinsLogo.svg'; import { buildRouteRef } from '../../../../plugin'; import { useBuilds } from '../../../useBuilds'; import { JenkinsRunStatus } from '../Status'; +import { jenkinsExecutePermission } from '@backstage/plugin-jenkins-common'; const FailCount = ({ count }: { count: number }): JSX.Element | null => { if (count !== 0) { @@ -174,6 +176,10 @@ const generatedColumns: TableColumn[] = [ render: (row: Partial) => { const ActionWrapper = () => { const [isLoadingRebuild, setIsLoadingRebuild] = useState(false); + const { allowed, loading } = useEntityPermission( + jenkinsExecutePermission, + ); + const alertApi = useApi(alertApiRef); const onRebuild = async () => { @@ -201,7 +207,7 @@ const generatedColumns: TableColumn[] = [ <> {isLoadingRebuild && } {!isLoadingRebuild && ( - + )} diff --git a/yarn.lock b/yarn.lock index 6cb525a71e..e0757c196f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11929,6 +11929,7 @@ evp_bytestokey@^1.0.0, evp_bytestokey@^1.0.3: "@backstage/plugin-graphiql" "^0.2.32" "@backstage/plugin-home" "^0.4.16" "@backstage/plugin-jenkins" "^0.6.0" + "@backstage/plugin-jenkins-common" "^0.1.0" "@backstage/plugin-kafka" "^0.3.0" "@backstage/plugin-kubernetes" "^0.6.0" "@backstage/plugin-lighthouse" "^0.3.0"