From 63e8b8605e41638a36aa9e6ee02ff5b1f766b390 Mon Sep 17 00:00:00 2001
From: Joe Porpeglia <josephp@spotify.com>
Date: Tue, 11 Jan 2022 18:51:07 -0500
Subject: [PATCH] Disable catalog permission middleware unless
 permission.enabled = true

Signed-off-by: Joe Porpeglia <josephp@spotify.com>
---
 .../src/service/router.test.ts                | 33 +++++++++++++++++++
 .../techdocs-backend/src/service/router.ts    | 29 +++++++++-------
 2 files changed, 50 insertions(+), 12 deletions(-)

diff --git a/plugins/techdocs-backend/src/service/router.test.ts b/plugins/techdocs-backend/src/service/router.test.ts
index dfe3bd417e..43e9641efb 100644
--- a/plugins/techdocs-backend/src/service/router.test.ts
+++ b/plugins/techdocs-backend/src/service/router.test.ts
@@ -413,6 +413,20 @@ data: {"updated":true}
   });
 
   describe('GET /static/docs', () => {
+    it('should delegate to the publisher handler', async () => {
+      const docsRouter = jest.fn((_req, res) => res.sendStatus(200));
+      publisher.docsRouter.mockReturnValue(docsRouter);
+
+      const app = await createApp(outOfTheBoxOptions);
+
+      const response = await request(app)
+        .get('/static/docs/default/component/test')
+        .send();
+
+      expect(response.status).toBe(200);
+      expect(docsRouter).toBeCalled();
+    });
+
     it('should return assets from cache', async () => {
       const app = await createApp(outOfTheBoxOptions);
 
@@ -428,6 +442,25 @@ data: {"updated":true}
       expect(MockTechDocsCache.get).toBeCalled();
     });
 
+    it('should check entity access when permissions are enabled', async () => {
+      MockedConfigReader.prototype.getOptionalBoolean.mockImplementation(key =>
+        key === 'permission.enabled' ? true : undefined,
+      );
+      const docsRouter = jest.fn((_req, res) => res.sendStatus(200));
+      publisher.docsRouter.mockReturnValue(docsRouter);
+
+      const app = await createApp(outOfTheBoxOptions);
+
+      MockCachedEntityLoader.prototype.load.mockResolvedValue(entity);
+
+      const response = await request(app)
+        .get('/static/docs/default/component/test')
+        .send();
+
+      expect(response.status).toBe(200);
+      expect(MockCachedEntityLoader.prototype.load).toBeCalled();
+    });
+
     it('should not return assets without corresponding entity access', async () => {
       MockedConfigReader.prototype.getOptionalBoolean.mockImplementation(key =>
         key === 'permission.enabled' ? true : undefined,
diff --git a/plugins/techdocs-backend/src/service/router.ts b/plugins/techdocs-backend/src/service/router.ts
index 7a07b74fa9..fcb7a17757 100644
--- a/plugins/techdocs-backend/src/service/router.ts
+++ b/plugins/techdocs-backend/src/service/router.ts
@@ -237,21 +237,26 @@ export async function createRouter(
   });
 
   // Ensures that the related entity exists and the current user has permission to view it.
-  router.use('/static/docs/:namespace/:kind/:name', async (req, _res, next) => {
-    const { kind, namespace, name } = req.params;
-    const entityName = { kind, namespace, name };
-    const token = getBearerToken(req.headers.authorization);
+  if (config.getOptionalBoolean('permission.enabled')) {
+    router.use(
+      '/static/docs/:namespace/:kind/:name',
+      async (req, _res, next) => {
+        const { kind, namespace, name } = req.params;
+        const entityName = { kind, namespace, name };
+        const token = getBearerToken(req.headers.authorization);
 
-    const entity = await entityLoader.load(entityName, token);
+        const entity = await entityLoader.load(entityName, token);
 
-    if (!entity) {
-      throw new NotFoundError(
-        `Entity not found for ${stringifyEntityRef(entityName)}`,
-      );
-    }
+        if (!entity) {
+          throw new NotFoundError(
+            `Entity not found for ${stringifyEntityRef(entityName)}`,
+          );
+        }
 
-    next();
-  });
+        next();
+      },
+    );
+  }
 
   // If a cache manager was provided, attach the cache middleware.
   if (cache) {