From 72cddf297160cc1c6f18c6858553695b1268149f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Thu, 30 Jan 2025 09:41:55 +0100 Subject: [PATCH] packages/backend-plugin-api: updated PermissionsRegistryService to use rule accessors and resource refs Signed-off-by: Patrik Oldsberg --- .changeset/gorgeous-shoes-stare.md | 5 +++ .changeset/witty-ducks-cross.md | 6 +++ .../permissionsRegistryServiceFactory.ts | 11 +++++- packages/backend-plugin-api/report.api.md | 23 +++++++++--- .../definitions/PermissionsRegistryService.ts | 37 +++++++++++++++---- .../src/next/services/mockServices.ts | 1 + plugins/permission-node/report.api.md | 3 ++ .../createPermissionIntegrationRouter.ts | 12 +++++- 8 files changed, 83 insertions(+), 15 deletions(-) create mode 100644 .changeset/gorgeous-shoes-stare.md create mode 100644 .changeset/witty-ducks-cross.md diff --git a/.changeset/gorgeous-shoes-stare.md b/.changeset/gorgeous-shoes-stare.md new file mode 100644 index 0000000000..c5748b14bc --- /dev/null +++ b/.changeset/gorgeous-shoes-stare.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-test-utils': patch +--- + +Added the new `getRuleAccessor` method to `mockServices.permissionsRegistry`. diff --git a/.changeset/witty-ducks-cross.md b/.changeset/witty-ducks-cross.md new file mode 100644 index 0000000000..b374f0a116 --- /dev/null +++ b/.changeset/witty-ducks-cross.md @@ -0,0 +1,6 @@ +--- +'@backstage/backend-plugin-api': patch +'@backstage/backend-defaults': patch +--- + +Updated `PermissionsRegistryService` to use `PermissionResourceRef`s and added the `getRuleAccessor` method. diff --git a/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts b/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts index 17bcb21091..4619ff634b 100644 --- a/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts +++ b/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts @@ -15,6 +15,7 @@ */ import { + PermissionsRegistryService, coreServices, createServiceFactory, } from '@backstage/backend-plugin-api'; @@ -52,7 +53,10 @@ export const permissionsRegistryServiceFactory = createServiceFactory({ 'Cannot add permission resource types after the plugin has started', ); } - router.addResourceType(resource); + router.addResourceType({ + ...resource, + resourceType: resource.resourceRef.resourceType, + }); }, addPermissions(permissions) { if (started) { @@ -70,6 +74,9 @@ export const permissionsRegistryServiceFactory = createServiceFactory({ } router.addPermissionRules(rules); }, - }; + getRuleAccessor(resourceRef) { + return router.getRuleAccessor(resourceRef); + }, + } satisfies PermissionsRegistryService; }, }); diff --git a/packages/backend-plugin-api/report.api.md b/packages/backend-plugin-api/report.api.md index a4f9b9fa1d..bb8cd63539 100644 --- a/packages/backend-plugin-api/report.api.md +++ b/packages/backend-plugin-api/report.api.md @@ -19,7 +19,9 @@ import { Knex } from 'knex'; import { Permission } from '@backstage/plugin-permission-common'; import { PermissionAttributes } from '@backstage/plugin-permission-common'; import { PermissionEvaluator } from '@backstage/plugin-permission-common'; +import { PermissionResourceRef } from '@backstage/plugin-permission-node'; import { PermissionRule } from '@backstage/plugin-permission-node'; +import { PermissionRuleAccessor } from '@backstage/plugin-permission-node'; import { QueryPermissionRequest } from '@backstage/plugin-permission-common'; import { QueryPermissionResponse } from '@backstage/plugin-permission-common'; import { Readable } from 'stream'; @@ -466,23 +468,34 @@ export interface LoggerService { export interface PermissionsRegistryService { addPermissionRules(rules: PermissionRule[]): void; addPermissions(permissions: Permission[]): void; - addResourceType( + addResourceType( options: PermissionsRegistryServiceAddResourceTypeOptions< TResourceType, - TResource + TResource, + TQuery >, ): void; + getRuleAccessor( + resourceRef: PermissionResourceRef, + ): PermissionRuleAccessor; } // @public export type PermissionsRegistryServiceAddResourceTypeOptions< TResourceType extends string, TResource, + TQuery, > = { - resourceType: TResourceType; + resourceRef: PermissionResourceRef; permissions?: Array; - rules: PermissionRule>[]; - getResources?(resourceRefs: string[]): Promise>; + rules: PermissionRule< + NoInfer_2, + NoInfer_2, + NoInfer_2 + >[]; + getResources?( + resourceRefs: string[], + ): Promise | undefined>>; }; // @public diff --git a/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts b/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts index 46236aa6cc..bc9d8dd223 100644 --- a/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts +++ b/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts @@ -15,7 +15,11 @@ */ import { Permission } from '@backstage/plugin-permission-common'; -import { PermissionRule } from '@backstage/plugin-permission-node'; +import { + PermissionResourceRef, + PermissionRule, + PermissionRuleAccessor, +} from '@backstage/plugin-permission-node'; /** * Prevent use of type parameter from contributing to type inference. @@ -33,11 +37,12 @@ type NoInfer = T extends infer S ? S : never; export type PermissionsRegistryServiceAddResourceTypeOptions< TResourceType extends string, TResource, + TQuery, > = { /** - * The identifier for the resource type. + * The {@link @backstage/plugin-permission-node#PermissionResourceRef} that identifies the resource type. */ - resourceType: TResourceType; + resourceRef: PermissionResourceRef; /** * Permissions that are available for this resource type. @@ -47,7 +52,11 @@ export type PermissionsRegistryServiceAddResourceTypeOptions< /** * Permission rules that are available for this resource type. */ - rules: PermissionRule>[]; + rules: PermissionRule< + NoInfer, + NoInfer, + NoInfer + >[]; /** * The function used to load associated resources based in the provided @@ -59,7 +68,9 @@ export type PermissionsRegistryServiceAddResourceTypeOptions< * resolve conditional decisions except when requesting resources directly * from the plugin. */ - getResources?(resourceRefs: string[]): Promise>; + getResources?( + resourceRefs: string[], + ): Promise | undefined>>; }; /** @@ -122,10 +133,22 @@ export interface PermissionsRegistryService { * called by the `permission-backend` when authorization conditions relating * to this plugin need to be evaluated. */ - addResourceType( + addResourceType( options: PermissionsRegistryServiceAddResourceTypeOptions< TResourceType, - TResource + TResource, + TQuery >, ): void; + + /** + * Returns a lookup function that can be used to look up rules for the provided resource by name. + * + * @remarks + * + * Primarily intended for use with {@link @backstage/plugin-permission-node#createConditionAuthorizer} and {@link @backstage/plugin-permission-node#createConditionTransformer}. + */ + getRuleAccessor( + resourceRef: PermissionResourceRef, + ): PermissionRuleAccessor; } diff --git a/packages/backend-test-utils/src/next/services/mockServices.ts b/packages/backend-test-utils/src/next/services/mockServices.ts index 15026d5dda..9c6b033505 100644 --- a/packages/backend-test-utils/src/next/services/mockServices.ts +++ b/packages/backend-test-utils/src/next/services/mockServices.ts @@ -489,6 +489,7 @@ export namespace mockServices { addPermissionRules: jest.fn(), addPermissions: jest.fn(), addResourceType: jest.fn(), + getRuleAccessor: jest.fn(), })); } diff --git a/plugins/permission-node/report.api.md b/plugins/permission-node/report.api.md index 2e447ddb1e..3859427ddf 100644 --- a/plugins/permission-node/report.api.md +++ b/plugins/permission-node/report.api.md @@ -173,6 +173,9 @@ export function createPermissionIntegrationRouter< TResource >, ): void; + getRuleAccessor( + resourceRef: PermissionResourceRef, + ): PermissionRuleAccessor; }; // @public diff --git a/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts b/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts index 37973176ed..a85fe2d085 100644 --- a/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts +++ b/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts @@ -30,7 +30,7 @@ import { PermissionCriteria, PolicyDecision, } from '@backstage/plugin-permission-common'; -import { PermissionRule } from '../types'; +import { PermissionRule, PermissionRuleAccessor } from '../types'; import { NoInfer, createGetRule, @@ -439,6 +439,9 @@ export function createPermissionIntegrationRouter< TResource >, ): void; + getRuleAccessor( + resourceRef: PermissionResourceRef, + ): PermissionRuleAccessor; } { const store = new PermissionIntegrationMetadataStore(); @@ -528,5 +531,12 @@ export function createPermissionIntegrationRouter< ) { store.addResourceType(resource); }, + getRuleAccessor( + resourceRef: PermissionResourceRef, + ): PermissionRuleAccessor { + return store.getRuleMapper( + resourceRef.resourceType, + ) as PermissionRuleAccessor; + }, }); }