diff --git a/.changeset/big-mayflies-sin.md b/.changeset/big-mayflies-sin.md new file mode 100644 index 0000000000..6aa18fc9c5 --- /dev/null +++ b/.changeset/big-mayflies-sin.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-search-backend': patch +--- + +Check for non-resource permissions when authorizing result-by-result in AuthorizedSearchEngine. diff --git a/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts b/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts index 76b3cf5184..4198730947 100644 --- a/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts +++ b/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts @@ -82,24 +82,28 @@ describe('AuthorizedSearchEngine', () => { visibilityPermission: createPermission({ name: 'search.users.read', attributes: { action: 'read' }, + resourceType: 'test-user', }), }, [typeTemplates]: { visibilityPermission: createPermission({ name: 'search.templates.read', attributes: { action: 'read' }, + resourceType: 'test-template', }), }, [typeServices]: { visibilityPermission: createPermission({ name: 'search.services.read', attributes: { action: 'read' }, + resourceType: 'test-service', }), }, [typeGroups]: { visibilityPermission: createPermission({ name: 'search.groups.read', attributes: { action: 'read' }, + resourceType: 'test-group', }), }, }; diff --git a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts index 2a5fc471f5..cba5f0eca8 100644 --- a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts +++ b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts @@ -21,6 +21,7 @@ import { AuthorizeDecision, AuthorizeQuery, AuthorizeResult, + isResourcePermission, PermissionAuthorizer, } from '@backstage/plugin-permission-common'; import { @@ -197,7 +198,11 @@ export class AuthorizedSearchEngine implements SearchEngine { const permission = this.types[result.type]?.visibilityPermission; const resourceRef = result.document.authorization?.resourceRef; - if (!permission || !resourceRef) { + if ( + !permission || + !isResourcePermission(permission) || + !resourceRef + ) { return result; }