paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

scaffolder: validate backstage:permissions in templates

Browse Source 
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
This commit is contained in:
Vincenzo Scamporlino
2023-03-09 12:27:58 +01:00
parent 67edf386c6
commit 5118294421
2 changed files with 61 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/scaffolder-common/src/Template.v1beta3.schema.json
+42 -2
View File
@@ -98,14 +98,42 @@
"oneOf": [
{
"type": "object",
"description": "The JSONSchema describing the inputs for the template."
"description": "The JSONSchema describing the inputs for the template.",
"properties": {
"backstage:permissions": {
"type": "object",
"description": "Object used for authorizing the parameter",
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
{
"type": "array",
"description": "A list of separate forms to collect parameters.",
"items": {
"type": "object",
"description": "The JSONSchema describing the inputs for the template."
"description": "The JSONSchema describing the inputs for the template.",
"properties": {
"backstage:permissions": {
"type": "object",
"description": "Object used for authorizing the parameter",
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
}
}
]
@@ -137,6 +165,18 @@
"if": {
"type": ["string", "boolean"],
"description": "A templated condition that skips the step when evaluated to false. If the condition is true or not defined, the step is executed. The condition is true, if the input is not `false`, `undefined`, `null`, `\"\"`, `0`, or `[]`."
},
"backstage:permissions": {
"type": "object",
"description": "Object used for authorizing the step",
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
}
plugins/scaffolder-common/src/TemplateEntityV1beta3.test.ts
+19 -1
View File
@@ -15,7 +15,10 @@
*/
import { entityKindSchemaValidator } from '@backstage/catalog-model';
import type { TemplateEntityV1beta3 } from './TemplateEntityV1beta3';
import type {
TemplateEntityV1beta3,
TemplateParameter,
} from './TemplateEntityV1beta3';
import schema from './Template.v1beta3.schema.json';
const validator = entityKindSchemaValidator(schema);
@@ -35,6 +38,7 @@ describe('templateEntityV1beta3Validator', () => {
owner: 'team-b',
parameters: {
required: ['owner'],
'backstage:permissions': { tags: ['one', 'two'] },
properties: {
owner: {
type: 'string',
@@ -52,6 +56,9 @@ describe('templateEntityV1beta3Validator', () => {
url: './template',
},
if: '${{ parameters.owner }}',
'backstage:permissions': {
tags: ['one', 'two'],
},
},
],
output: {
@@ -154,4 +161,15 @@ describe('templateEntityV1beta3Validator', () => {
(entity as any).spec.steps[0].if = 5;
expect(() => validator(entity)).toThrow(/if/);
});
it('rejects parameters with wrong backstage:permissions', async () => {
(entity.spec.parameters as TemplateParameter)['backstage:permissions'] =
true as {};
expect(() => validator(entity)).toThrow(/must be object/);
});
it('rejects steps with wrong backstage:permissions', async () => {
entity.spec.steps[0]['backstage:permissions'] = true as {};
expect(() => validator(entity)).toThrow(/must be object/);
});
});