From 51182944212adf817cb79fb5374e7d7338bff92c Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Thu, 9 Mar 2023 12:27:58 +0100
Subject: [PATCH] scaffolder: validate backstage:permissions in templates

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../src/Template.v1beta3.schema.json          | 44 ++++++++++++++++++-
 .../src/TemplateEntityV1beta3.test.ts         | 20 ++++++++-
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/plugins/scaffolder-common/src/Template.v1beta3.schema.json b/plugins/scaffolder-common/src/Template.v1beta3.schema.json
index 3dc1990401..beb0ca5e31 100644
--- a/plugins/scaffolder-common/src/Template.v1beta3.schema.json
+++ b/plugins/scaffolder-common/src/Template.v1beta3.schema.json
@@ -98,14 +98,42 @@
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "The JSONSchema describing the inputs for the template."
+                  "description": "The JSONSchema describing the inputs for the template.",
+                  "properties": {
+                    "backstage:permissions": {
+                      "type": "object",
+                      "description": "Object used for authorizing the parameter",
+                      "properties": {
+                        "tags": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
                 },
                 {
                   "type": "array",
                   "description": "A list of separate forms to collect parameters.",
                   "items": {
                     "type": "object",
-                    "description": "The JSONSchema describing the inputs for the template."
+                    "description": "The JSONSchema describing the inputs for the template.",
+                    "properties": {
+                      "backstage:permissions": {
+                        "type": "object",
+                        "description": "Object used for authorizing the parameter",
+                        "properties": {
+                          "tags": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        }
+                      }
+                    }
                   }
                 }
               ]
@@ -137,6 +165,18 @@
                   "if": {
                     "type": ["string", "boolean"],
                     "description": "A templated condition that skips the step when evaluated to false. If the condition is true or not defined, the step is executed. The condition is true, if the input is not `false`, `undefined`, `null`, `\"\"`, `0`, or `[]`."
+                  },
+                  "backstage:permissions": {
+                    "type": "object",
+                    "description": "Object used for authorizing the step",
+                    "properties": {
+                      "tags": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      }
+                    }
                   }
                 }
               }
diff --git a/plugins/scaffolder-common/src/TemplateEntityV1beta3.test.ts b/plugins/scaffolder-common/src/TemplateEntityV1beta3.test.ts
index ab5900ab32..a23d72f290 100644
--- a/plugins/scaffolder-common/src/TemplateEntityV1beta3.test.ts
+++ b/plugins/scaffolder-common/src/TemplateEntityV1beta3.test.ts
@@ -15,7 +15,10 @@
  */
 
 import { entityKindSchemaValidator } from '@backstage/catalog-model';
-import type { TemplateEntityV1beta3 } from './TemplateEntityV1beta3';
+import type {
+  TemplateEntityV1beta3,
+  TemplateParameter,
+} from './TemplateEntityV1beta3';
 import schema from './Template.v1beta3.schema.json';
 
 const validator = entityKindSchemaValidator(schema);
@@ -35,6 +38,7 @@ describe('templateEntityV1beta3Validator', () => {
         owner: 'team-b',
         parameters: {
           required: ['owner'],
+          'backstage:permissions': { tags: ['one', 'two'] },
           properties: {
             owner: {
               type: 'string',
@@ -52,6 +56,9 @@ describe('templateEntityV1beta3Validator', () => {
               url: './template',
             },
             if: '${{ parameters.owner }}',
+            'backstage:permissions': {
+              tags: ['one', 'two'],
+            },
           },
         ],
         output: {
@@ -154,4 +161,15 @@ describe('templateEntityV1beta3Validator', () => {
     (entity as any).spec.steps[0].if = 5;
     expect(() => validator(entity)).toThrow(/if/);
   });
+
+  it('rejects parameters with wrong backstage:permissions', async () => {
+    (entity.spec.parameters as TemplateParameter)['backstage:permissions'] =
+      true as {};
+    expect(() => validator(entity)).toThrow(/must be object/);
+  });
+
+  it('rejects steps with wrong backstage:permissions', async () => {
+    entity.spec.steps[0]['backstage:permissions'] = true as {};
+    expect(() => validator(entity)).toThrow(/must be object/);
+  });
 });