Merge pull request #13452 from Pike/hasAnnotation-value

Add optional value to hasAnnotation

.changeset/famous-rats-heal.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Add optional value to `hasAnnotation` permission rule

plugins/catalog-backend/api-report.md

@@ -177,7 +177,7 @@ export const catalogConditions: Conditions<{
     Entity,
     EntitiesSearchFilter,
     'catalog-entity',
-    [annotation: string]
+    [annotation: string, value?: string | undefined]
   >;
   hasLabel: PermissionRule<
     Entity,
@@ -448,7 +448,7 @@ export const permissionRules: {
     Entity,
     EntitiesSearchFilter,
     'catalog-entity',
-    [annotation: string]
+    [annotation: string, value?: string | undefined]
   >;
   hasLabel: PermissionRule<
     Entity,

plugins/catalog-backend/src/permissions/rules/hasAnnotation.test.ts

@@ -49,6 +49,19 @@ describe('hasAnnotation permission rule', () => {
           'backstage.io/test-annotation',
         ),
       ).toEqual(false);
+      expect(
+        hasAnnotation.apply(
+          {
+            apiVersion: 'backstage.io/v1alpha1',
+            kind: 'Component',
+            metadata: {
+              name: 'test-component',
+            },
+          },
+          'backstage.io/test-annotation',
+          'some value',
+        ),
+      ).toEqual(false);
     });
 
     it('returns true when specified annotation is present', () => {
@@ -69,6 +82,46 @@ describe('hasAnnotation permission rule', () => {
         ),
       ).toEqual(true);
     });
+
+    it('returns false when specified annotation has different than expected value', () => {
+      expect(
+        hasAnnotation.apply(
+          {
+            apiVersion: 'backstage.io/v1alpha1',
+            kind: 'Component',
+            metadata: {
+              name: 'test-component',
+              annotations: {
+                'other-annotation': 'foo',
+                'backstage.io/test-annotation': 'bar',
+              },
+            },
+          },
+          'backstage.io/test-annotation',
+          'baz',
+        ),
+      ).toEqual(false);
+    });
+
+    it('returns true when specified annotation has expected value', () => {
+      expect(
+        hasAnnotation.apply(
+          {
+            apiVersion: 'backstage.io/v1alpha1',
+            kind: 'Component',
+            metadata: {
+              name: 'test-component',
+              annotations: {
+                'other-annotation': 'foo',
+                'backstage.io/test-annotation': 'bar',
+              },
+            },
+          },
+          'backstage.io/test-annotation',
+          'bar',
+        ),
+      ).toEqual(true);
+    });
   });
 
   describe('toQuery', () => {
@@ -78,4 +131,13 @@ describe('hasAnnotation permission rule', () => {
       });
     });
   });
+
+  it('returns an appropriate catalog-backend filter with values', () => {
+    expect(
+      hasAnnotation.toQuery('backstage.io/test-annotation', 'foo'),
+    ).toEqual({
+      key: 'metadata.annotations.backstage.io/test-annotation',
+      values: ['foo'],
+    });
+  });
 });

plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts

@@ -22,6 +22,8 @@ import { createCatalogPermissionRule } from './util';
  * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which
  * filters for the presence of an annotation on a given entity.
  *
+ * If a value is given, it filters for the annotation value, too.
+ *
  * @alpha
  */
 export const hasAnnotation = createCatalogPermissionRule({
@@ -29,9 +31,18 @@ export const hasAnnotation = createCatalogPermissionRule({
   description:
     'Allow entities which are annotated with the specified annotation',
   resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
-  apply: (resource: Entity, annotation: string) =>
-    !!resource.metadata.annotations?.hasOwnProperty(annotation),
-  toQuery: (annotation: string) => ({
-    key: `metadata.annotations.${annotation}`,
-  }),
+  apply: (resource: Entity, annotation: string, value?: string) =>
+    !!resource.metadata.annotations?.hasOwnProperty(annotation) &&
+    (value === undefined
+      ? true
+      : resource.metadata.annotations?.[annotation] === value),
+  toQuery: (annotation: string, value?: string) =>
+    value === undefined
+      ? {
+          key: `metadata.annotations.${annotation}`,
+        }
+      : {
+          key: `metadata.annotations.${annotation}`,
+          values: [value],
+        },
 });