From 30f98843591195ac92b7f1ba9292fd81572881d1 Mon Sep 17 00:00:00 2001
From: Mike Lewis <mtlewis@users.noreply.github.com>
Date: Tue, 8 Mar 2022 09:48:18 +0000
Subject: [PATCH] search: check for non-resource permissions when authorizing
 results

Now that we can differentiate between ResourcePermissions and other
kinds of permissions, we can skip authorizing result-by-result
when the permission for a given document type is not a
ResourcePermission.

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>
---
 .changeset/big-mayflies-sin.md                             | 5 +++++
 .../src/service/AuthorizedSearchEngine.test.ts             | 4 ++++
 .../search-backend/src/service/AuthorizedSearchEngine.ts   | 7 ++++++-
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/big-mayflies-sin.md

diff --git a/.changeset/big-mayflies-sin.md b/.changeset/big-mayflies-sin.md
new file mode 100644
index 0000000000..6aa18fc9c5
--- /dev/null
+++ b/.changeset/big-mayflies-sin.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend': patch
+---
+
+Check for non-resource permissions when authorizing result-by-result in AuthorizedSearchEngine.
diff --git a/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts b/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts
index 76b3cf5184..4198730947 100644
--- a/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts
+++ b/plugins/search-backend/src/service/AuthorizedSearchEngine.test.ts
@@ -82,24 +82,28 @@ describe('AuthorizedSearchEngine', () => {
       visibilityPermission: createPermission({
         name: 'search.users.read',
         attributes: { action: 'read' },
+        resourceType: 'test-user',
       }),
     },
     [typeTemplates]: {
       visibilityPermission: createPermission({
         name: 'search.templates.read',
         attributes: { action: 'read' },
+        resourceType: 'test-template',
       }),
     },
     [typeServices]: {
       visibilityPermission: createPermission({
         name: 'search.services.read',
         attributes: { action: 'read' },
+        resourceType: 'test-service',
       }),
     },
     [typeGroups]: {
       visibilityPermission: createPermission({
         name: 'search.groups.read',
         attributes: { action: 'read' },
+        resourceType: 'test-group',
       }),
     },
   };
diff --git a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts
index 2a5fc471f5..cba5f0eca8 100644
--- a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts
+++ b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts
@@ -21,6 +21,7 @@ import {
   AuthorizeDecision,
   AuthorizeQuery,
   AuthorizeResult,
+  isResourcePermission,
   PermissionAuthorizer,
 } from '@backstage/plugin-permission-common';
 import {
@@ -197,7 +198,11 @@ export class AuthorizedSearchEngine implements SearchEngine {
           const permission = this.types[result.type]?.visibilityPermission;
           const resourceRef = result.document.authorization?.resourceRef;
 
-          if (!permission || !resourceRef) {
+          if (
+            !permission ||
+            !isResourcePermission(permission) ||
+            !resourceRef
+          ) {
             return result;
           }