Merge pull request #8357 from backstage/example-app-permission-integration

Example app permission integration

.changeset/bright-ears-visit.md

@@ -0,0 +1,5 @@
+---
+'@backstage/app-defaults': patch
+---
+
+Added an instance of PermissionApi to the apis included by default in createApp.

.changeset/famous-icons-pump.md

@@ -0,0 +1,17 @@
+---
+'@backstage/plugin-permission-react': minor
+---
+
+Breaking Changes:
+
+- Remove "api" suffixes from constructor parameters in IdentityPermissionApi.create
+
+```diff
+  const { config, discovery, identity } = options;
+-  const permissionApi = IdentityPermissionApi.create({
+-    configApi: config,
+-    discoveryApi: discovery,
+-    identityApi: identity
+-  });
++  const permissionApi = IdentityPermissionApi.create({ config, discovery, identity });
+```

.changeset/lazy-files-check.md

@@ -0,0 +1,14 @@
+---
+'@backstage/backend-common': minor
+---
+
+Auto-generate secrets for backend-to-backend auth in local development environments.
+
+When NODE_ENV is 'development', the ServerTokenManager will now generate a secret for backend-to-backend auth to make it simpler to work locally on Backstage instances that use backend-to-backend auth. For production deployments, a secret must still be manually configured as described in [the backend-to-backend auth tutorial](https://backstage.io/docs/tutorials/backend-to-backend-auth).
+
+After the change, the static `fromConfig` method on the `ServerTokenManager` requires a logger.
+
+```diff
+-  const tokenManager = ServerTokenManager.fromConfig(config);
++  const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
+```

.changeset/real-geckos-work.md

@@ -0,0 +1,15 @@
+---
+'@backstage/plugin-permission-common': minor
+---
+
+- Add `PermissionAuthorizer` interface matching `PermissionClient` to allow alternative implementations like the `ServerPermissionClient` in @backstage/plugin-permission-node.
+
+Breaking Changes:
+
+- Remove "api" suffixes from constructor parameters in PermissionClient
+
+```diff
+  const { config, discovery } = options;
+-  const permissionClient = new PermissionClient({ discoveryApi: discovery, configApi: config });
++  const permissionClient = new PermissionClient({ discovery, config });
+```

.changeset/wet-bikes-pull.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-permission-node': patch
+---
+
+Add `ServerPermissionClient`, which implements `PermissionAuthorizer` from @backstage/plugin-permission-common. This implementation skips authorization entirely when the supplied token is a valid backend-to-backend token, thereby allowing backend-to-backend systems to communicate without authorization.
+
+The `ServerPermissionClient` should always be used over the standard `PermissionClient` in plugin backends.