feat(scaffolder): Migrate scaffolder to use permissions registry (#33740)

* feat(scaffolder-node): add PermissionResourceRef definitions for scaffolder resource types

Signed-off-by: benjdlambert <ben@blam.sh>

* feat(scaffolder-backend): migrate to PermissionsRegistryService with fallback

Signed-off-by: benjdlambert <ben@blam.sh>

* feat(scaffolder-backend): wire permissionsRegistry in ScaffolderPlugin

Signed-off-by: benjdlambert <ben@blam.sh>

* test(scaffolder-backend): verify permissions metadata endpoint returns all scaffolder permissions

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: add changesets for scaffolder permissions registry migration

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: format scaffolder-node alpha exports

Signed-off-by: benjdlambert <ben@blam.sh>

* fix: correct scaffolder-node changeset to patch for sub-1.0 package

Signed-off-by: benjdlambert <ben@blam.sh>

* refactor(scaffolder-backend): simplify by removing fallback path and making permissionsRegistry required

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: update scaffolder-node API report

Signed-off-by: benjdlambert <ben@blam.sh>

---------

Signed-off-by: benjdlambert <ben@blam.sh>

plugins/scaffolder-node/package.json

@@ -63,6 +63,7 @@
     "@backstage/errors": "workspace:^",
     "@backstage/integration": "workspace:^",
     "@backstage/plugin-permission-common": "workspace:^",
+    "@backstage/plugin-permission-node": "workspace:^",
     "@backstage/plugin-scaffolder-common": "workspace:^",
     "@backstage/types": "workspace:^",
     "@isomorphic-git/pgp-plugin": "^0.0.7",

plugins/scaffolder-node/report-alpha.api.md

@@ -4,10 +4,16 @@
 
 ```ts
 import { ExtensionPoint } from '@backstage/backend-plugin-api';
+import type { JsonObject } from '@backstage/types';
 import { JsonValue } from '@backstage/types';
+import { PermissionResourceRef } from '@backstage/plugin-permission-node';
+import type { SerializedTask } from '@backstage/plugin-scaffolder-node';
 import { TaskBroker } from '@backstage/plugin-scaffolder-node';
+import type { TaskFilter } from '@backstage/plugin-scaffolder-node';
+import type { TemplateEntityStepV1beta3 } from '@backstage/plugin-scaffolder-common';
 import { TemplateFilter as TemplateFilter_2 } from '@backstage/plugin-scaffolder-node';
 import { TemplateGlobal as TemplateGlobal_2 } from '@backstage/plugin-scaffolder-node';
+import type { TemplateParametersV1beta3 } from '@backstage/plugin-scaffolder-common';
 import { z } from 'zod/v3';
 
 // @alpha
@@ -118,6 +124,14 @@ export const restoreWorkspace: (opts: {
   buffer?: Buffer;
 }) => Promise<void>;
 
+// @alpha
+export const scaffolderActionPermissionResourceRef: PermissionResourceRef<
+  JsonObject,
+  {},
+  'scaffolder-action',
+  'scaffolder'
+>;
+
 // @alpha
 export interface ScaffolderAutocompleteExtensionPoint {
   // (undocumented)
@@ -139,6 +153,22 @@ export interface ScaffolderTaskBrokerExtensionPoint {
 // @alpha @deprecated
 export const scaffolderTaskBrokerExtensionPoint: ExtensionPoint<ScaffolderTaskBrokerExtensionPoint>;
 
+// @alpha
+export const scaffolderTaskPermissionResourceRef: PermissionResourceRef<
+  SerializedTask,
+  TaskFilter,
+  'scaffolder-task',
+  'scaffolder'
+>;
+
+// @alpha
+export const scaffolderTemplatePermissionResourceRef: PermissionResourceRef<
+  TemplateParametersV1beta3 | TemplateEntityStepV1beta3,
+  {},
+  'scaffolder-template',
+  'scaffolder'
+>;
+
 // @alpha
 export interface ScaffolderTemplatingExtensionPoint {
   // (undocumented)

plugins/scaffolder-node/src/alpha/index.ts

@@ -153,3 +153,54 @@ export const scaffolderWorkspaceProviderExtensionPoint =
   createExtensionPoint<ScaffolderWorkspaceProviderExtensionPoint>({
     id: 'scaffolder.workspace.provider',
   });
+
+import { createPermissionResourceRef } from '@backstage/plugin-permission-node';
+import {
+  RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,
+  RESOURCE_TYPE_SCAFFOLDER_ACTION,
+  RESOURCE_TYPE_SCAFFOLDER_TASK,
+} from '@backstage/plugin-scaffolder-common/alpha';
+import type {
+  TemplateEntityStepV1beta3,
+  TemplateParametersV1beta3,
+} from '@backstage/plugin-scaffolder-common';
+import type { JsonObject } from '@backstage/types';
+import type {
+  SerializedTask,
+  TaskFilter,
+} from '@backstage/plugin-scaffolder-node';
+
+/**
+ * Permission resource ref for scaffolder templates.
+ * @alpha
+ */
+export const scaffolderTemplatePermissionResourceRef =
+  createPermissionResourceRef<
+    TemplateEntityStepV1beta3 | TemplateParametersV1beta3,
+    {}
+  >().with({
+    pluginId: 'scaffolder',
+    resourceType: RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,
+  });
+
+/**
+ * Permission resource ref for scaffolder actions.
+ * @alpha
+ */
+export const scaffolderActionPermissionResourceRef =
+  createPermissionResourceRef<JsonObject, {}>().with({
+    pluginId: 'scaffolder',
+    resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,
+  });
+
+/**
+ * Permission resource ref for scaffolder tasks.
+ * @alpha
+ */
+export const scaffolderTaskPermissionResourceRef = createPermissionResourceRef<
+  SerializedTask,
+  TaskFilter
+>().with({
+  pluginId: 'scaffolder',
+  resourceType: RESOURCE_TYPE_SCAFFOLDER_TASK,
+});