From 766298715c70418114c3b1d17ee49237fbde56eb Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Wed, 11 Jan 2023 11:21:13 +0100
Subject: [PATCH] backend: permission policy scaffolder example

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 packages/backend/package.json              |  1 +
 packages/backend/src/plugins/permission.ts | 21 +++++++++++++--------
 yarn.lock                                  |  4 ++++
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/packages/backend/package.json b/packages/backend/package.json
index 54dbe640df..aa4e660fdd 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -60,6 +60,7 @@
     "@backstage/plugin-rollbar-backend": "workspace:^",
     "@backstage/plugin-scaffolder-backend": "workspace:^",
     "@backstage/plugin-scaffolder-backend-module-rails": "workspace:^",
+    "@backstage/plugin-scaffolder-common": "workspace:^",
     "@backstage/plugin-search-backend": "workspace:^",
     "@backstage/plugin-search-backend-module-elasticsearch": "workspace:^",
     "@backstage/plugin-search-backend-module-pg": "workspace:^",
diff --git a/packages/backend/src/plugins/permission.ts b/packages/backend/src/plugins/permission.ts
index 7192a1ddec..708f342265 100644
--- a/packages/backend/src/plugins/permission.ts
+++ b/packages/backend/src/plugins/permission.ts
@@ -18,28 +18,33 @@ import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
 import { createRouter } from '@backstage/plugin-permission-backend';
 import {
   AuthorizeResult,
+  isPermission,
   PolicyDecision,
 } from '@backstage/plugin-permission-common';
 import {
   PermissionPolicy,
   PolicyQuery,
 } from '@backstage/plugin-permission-node';
+
 import {
-  DefaultPlaylistPermissionPolicy,
-  isPlaylistPermission,
-} from '@backstage/plugin-playlist-backend';
+  createScaffolderConditionalDecision,
+  scaffolderConditions,
+} from '@backstage/plugin-scaffolder-backend';
+import { templateSchemaExecutePermission } from '@backstage/plugin-scaffolder-common';
 import { Router } from 'express';
 import { PluginEnvironment } from '../types';
 
 class ExamplePermissionPolicy implements PermissionPolicy {
-  private playlistPermissionPolicy = new DefaultPlaylistPermissionPolicy();
-
   async handle(
     request: PolicyQuery,
-    user?: BackstageIdentityResponse,
+    _user?: BackstageIdentityResponse,
   ): Promise<PolicyDecision> {
-    if (isPlaylistPermission(request.permission)) {
-      return this.playlistPermissionPolicy.handle(request, user);
+    if (isPermission(request.permission, templateSchemaExecutePermission)) {
+      return createScaffolderConditionalDecision(request.permission, [
+        scaffolderConditions.allowCapabilities({
+          capabilities: ['example'],
+        }),
+      ]);
     }
 
     return {
diff --git a/yarn.lock b/yarn.lock
index 542918e285..0d63604827 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7585,6 +7585,8 @@ __metadata:
     "@backstage/plugin-catalog-backend": "workspace:^"
     "@backstage/plugin-catalog-common": "workspace:^"
     "@backstage/plugin-catalog-node": "workspace:^"
+    "@backstage/plugin-permission-common": "workspace:^"
+    "@backstage/plugin-permission-node": "workspace:^"
     "@backstage/plugin-scaffolder-common": "workspace:^"
     "@backstage/plugin-scaffolder-node": "workspace:^"
     "@backstage/types": "workspace:^"
@@ -7644,6 +7646,7 @@ __metadata:
   dependencies:
     "@backstage/catalog-model": "workspace:^"
     "@backstage/cli": "workspace:^"
+    "@backstage/plugin-permission-common": "workspace:^"
     "@backstage/types": "workspace:^"
   languageName: unknown
   linkType: soft
@@ -22940,6 +22943,7 @@ __metadata:
     "@backstage/plugin-rollbar-backend": "workspace:^"
     "@backstage/plugin-scaffolder-backend": "workspace:^"
     "@backstage/plugin-scaffolder-backend-module-rails": "workspace:^"
+    "@backstage/plugin-scaffolder-common": "workspace:^"
     "@backstage/plugin-search-backend": "workspace:^"
     "@backstage/plugin-search-backend-module-elasticsearch": "workspace:^"
     "@backstage/plugin-search-backend-module-pg": "workspace:^"