paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

cuts out writing policies and save it for next section

Browse Source 
Signed-off-by: Peter Macdonald <macdonald.peter90@gmail.com>
This commit is contained in:
Peter Macdonald
2024-04-25 15:03:10 +02:00
parent 52cbfae035
commit 30a6ca1617
1 changed files with 1 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/permissions/getting-started.md
+1 -62
View File
@@ -66,65 +66,4 @@ permission:
enabled: true
```
2. Its now all wired up and working, great! But perhaps we don't want to simply allow everything, lets try and create our own policy, to do this you can create a new folder in `packages/backend/src` called `permissions` and create a new file called `policy.ts`, in that file we can add the following to create a policy that denies deleting entities from the catalog:
```ts title="packages/backend/src/permissions/policy.ts"
import {
AuthorizeResult,
PolicyDecision,
} from '@backstage/plugin-permission-common';
import {
PermissionPolicy,
PolicyQuery,
} from '@backstage/plugin-permission-node';
export class DenyCatalogDeletePolicy implements PermissionPolicy {
async handle(request: PolicyQuery): Promise<PolicyDecision> {
if (request.permission.name === 'catalog.entity.delete') {
return {
result: AuthorizeResult.DENY,
};
}
return { result: AuthorizeResult.ALLOW };
}
}
```
3. We then need to use the permissions backend policy extension point to register our policy, to do this we can add the following to `packages/backend/src/index.ts`:
```ts title="packages/backend/src/index.ts"
import { createBackend } from '@backstage/backend-defaults';
import { DenyCatalogDeletePolicy } from './permissions/policy';
const backend = createBackend();
// ...
backend.add(import('@backstage/plugin-permission-backend/alpha'));
/* highlight-remove-next-line */
backend.add(
import('@backstage/plugin-permission-backend-module-allow-all-policy'),
);
/* highlight-add-start */
backend.add(
createBackendModule({
pluginId: 'permission',
moduleId: 'deny-catalog-delete-policy',
register(reg) {
reg.registerInit({
deps: { policy: policyExtensionPoint },
async init({ policy }) {
policy.setPolicy(new DenyCatalogDeletePolicy());
},
});
},
}),
);
/* highlight-add-end */
// ...
backend.start();
```
4. Now that you’ve made this change, you should find that the unregister entity menu option on the catalog entity page is disabled.
![Entity detail page showing disabled unregister entity context menu entry](../assets/permissions/disabled-unregister-entity.png)
Now that the framework is fully configured, you can craft a permission policy that works best for your organization by utilizing a provided authorization method or by [writing your own policy](./writing-a-policy.md)!
Congratulations! Now that the framework is configured, you can craft a permission policy that works best for your organization by utilizing a provided authorization method or by [writing your own policy](./writing-a-policy.md)!