Merge pull request #8357 from backstage/example-app-permission-integration

Example app permission integration

packages/backend/package.json

@@ -39,6 +39,9 @@
     "@backstage/plugin-jenkins-backend": "^0.1.9",
     "@backstage/plugin-kubernetes-backend": "^0.4.0",
     "@backstage/plugin-kafka-backend": "^0.2.12",
+    "@backstage/plugin-permission-backend": "^0.2.0",
+    "@backstage/plugin-permission-common": "^0.2.0",
+    "@backstage/plugin-permission-node": "^0.2.0",
     "@backstage/plugin-proxy-backend": "^0.2.14",
     "@backstage/plugin-rollbar-backend": "^0.1.16",
     "@backstage/plugin-scaffolder-backend": "^0.15.17",

packages/backend/src/index.ts

@@ -55,13 +55,19 @@ import graphql from './plugins/graphql';
 import app from './plugins/app';
 import badges from './plugins/badges';
 import jenkins from './plugins/jenkins';
+import permission from './plugins/permission';
 import { PluginEnvironment } from './types';
+import { ServerPermissionClient } from '@backstage/plugin-permission-node';
 
 function makeCreateEnv(config: Config) {
   const root = getRootLogger();
   const reader = UrlReaders.default({ logger: root, config });
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const tokenManager = ServerTokenManager.noop();
+  const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
+  const permissions = ServerPermissionClient.fromConfig(config, {
+    discovery,
+    tokenManager,
+  });
 
   root.info(`Created UrlReader ${reader}`);
 
@@ -72,7 +78,16 @@ function makeCreateEnv(config: Config) {
     const logger = root.child({ type: 'plugin', plugin });
     const database = databaseManager.forPlugin(plugin);
     const cache = cacheManager.forPlugin(plugin);
-    return { logger, cache, database, config, reader, discovery, tokenManager };
+    return {
+      logger,
+      cache,
+      database,
+      config,
+      reader,
+      discovery,
+      tokenManager,
+      permissions,
+    };
   };
 }
 
@@ -114,6 +129,7 @@ async function main() {
   const techInsightsEnv = useHotMemoize(module, () =>
     createEnv('tech-insights'),
   );
+  const permissionEnv = useHotMemoize(module, () => createEnv('permission'));
 
   const apiRouter = Router();
   apiRouter.use('/catalog', await catalog(catalogEnv));
@@ -132,6 +148,7 @@ async function main() {
   apiRouter.use('/graphql', await graphql(graphqlEnv));
   apiRouter.use('/badges', await badges(badgesEnv));
   apiRouter.use('/jenkins', await jenkins(jenkinsEnv));
+  apiRouter.use('/permission', await permission(permissionEnv));
   apiRouter.use(notFoundHandler());
 
   const service = createServiceBuilder(module)

packages/backend/src/plugins/permission.ts

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2021 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { IdentityClient } from '@backstage/plugin-auth-backend';
+import { createRouter } from '@backstage/plugin-permission-backend';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
+import {
+  PermissionPolicy,
+  PolicyDecision,
+} from '@backstage/plugin-permission-node';
+import { Router } from 'express';
+import { PluginEnvironment } from '../types';
+
+class AllowAllPermissionPolicy implements PermissionPolicy {
+  async handle(): Promise<PolicyDecision> {
+    return {
+      result: AuthorizeResult.ALLOW,
+    };
+  }
+}
+
+export default async function createPlugin(
+  env: PluginEnvironment,
+): Promise<Router> {
+  const { logger, discovery } = env;
+  return await createRouter({
+    logger,
+    discovery,
+    policy: new AllowAllPermissionPolicy(),
+    identity: new IdentityClient({
+      discovery,
+      issuer: await discovery.getExternalBaseUrl('auth'),
+    }),
+  });
+}

packages/backend/src/types.ts

@@ -23,6 +23,7 @@ import {
   TokenManager,
   UrlReader,
 } from '@backstage/backend-common';
+import { ServerPermissionClient } from '@backstage/plugin-permission-node';
 
 export type PluginEnvironment = {
   logger: Logger;
@@ -32,4 +33,5 @@ export type PluginEnvironment = {
   reader: UrlReader;
   discovery: PluginEndpointDiscovery;
   tokenManager: TokenManager;
+  permissions: ServerPermissionClient;
 };