set permission backend policies using an extension point

Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Johan Haals <johan.haals@gmail.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>

plugins/permission-backend/alpha-api-report.md

@@ -4,17 +4,12 @@
 
 ```ts
 import { BackendFeature } from '@backstage/backend-plugin-api';
-import { PermissionPolicy } from '@backstage/plugin-permission-node';
 
 // @alpha
-export const permissionPlugin: (
-  options: PermissionPluginOptions,
-) => BackendFeature;
+export const permissionModuleAllowAllPolicy: () => BackendFeature;
 
 // @alpha
-export type PermissionPluginOptions = {
-  policy: PermissionPolicy;
-};
+export const permissionPlugin: () => BackendFeature;
 
 // (No @packageDocumentation comment for this package)
 ```

plugins/permission-backend/src/alpha.ts

@@ -14,4 +14,4 @@
  * limitations under the License.
  */
 
-export { permissionPlugin, type PermissionPluginOptions } from './plugin';
+export { permissionPlugin, permissionModuleAllowAllPolicy } from './plugin';

plugins/permission-backend/src/plugin.ts

@@ -17,50 +17,102 @@
 import { loggerToWinstonLogger } from '@backstage/backend-common';
 import {
   coreServices,
+  createBackendModule,
   createBackendPlugin,
 } from '@backstage/backend-plugin-api';
-import { PermissionPolicy } from '@backstage/plugin-permission-node';
+import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
+import {
+  AuthorizeResult,
+  PolicyDecision,
+} from '@backstage/plugin-permission-common';
+import {
+  PermissionPolicy,
+  PolicyQuery,
+} from '@backstage/plugin-permission-node';
+import {
+  policyExtensionPoint,
+  PolicyExtensionPoint,
+} from '@backstage/plugin-permission-node/alpha';
 import { createRouter } from './service';
 
+class PolicyExtensionPointImpl implements PolicyExtensionPoint {
+  public policy: PermissionPolicy | undefined;
+
+  setPolicy(policy: PermissionPolicy): void {
+    if (this.policy) {
+      throw new Error('Policy already set');
+    }
+    this.policy = policy;
+  }
+}
+
 /**
- * Permission plugin options
+ * A permission policy module that allows all requests.
  *
  * @alpha
  */
-export type PermissionPluginOptions = {
-  policy: PermissionPolicy;
-};
+export const permissionModuleAllowAllPolicy = createBackendModule({
+  moduleId: 'allowAllPolicy',
+  pluginId: 'permission',
+  register(reg) {
+    class AllowAllPermissionPolicy implements PermissionPolicy {
+      async handle(
+        _request: PolicyQuery,
+        _user?: BackstageIdentityResponse,
+      ): Promise<PolicyDecision> {
+        return {
+          result: AuthorizeResult.ALLOW,
+        };
+      }
+    }
+
+    reg.registerInit({
+      deps: { policy: policyExtensionPoint },
+      async init({ policy }) {
+        policy.setPolicy(new AllowAllPermissionPolicy());
+      },
+    });
+  },
+});
 
 /**
  * Permission plugin
  *
  * @alpha
  */
-export const permissionPlugin = createBackendPlugin(
-  (options: PermissionPluginOptions) => ({
-    pluginId: 'permission',
-    register(env) {
-      env.registerInit({
-        deps: {
-          http: coreServices.httpRouter,
-          config: coreServices.config,
-          logger: coreServices.logger,
-          discovery: coreServices.discovery,
-          identity: coreServices.identity,
-        },
-        async init({ http, config, logger, discovery, identity }) {
-          const winstonLogger = loggerToWinstonLogger(logger);
-          http.use(
-            await createRouter({
-              config,
-              discovery,
-              identity,
-              logger: winstonLogger,
-              policy: options.policy,
-            }),
+export const permissionPlugin = createBackendPlugin(() => ({
+  pluginId: 'permission',
+  register(env) {
+    const policies = new PolicyExtensionPointImpl();
+
+    env.registerExtensionPoint(policyExtensionPoint, policies);
+
+    env.registerInit({
+      deps: {
+        http: coreServices.httpRouter,
+        config: coreServices.config,
+        logger: coreServices.logger,
+        discovery: coreServices.discovery,
+        identity: coreServices.identity,
+      },
+      async init({ http, config, logger, discovery, identity }) {
+        const winstonLogger = loggerToWinstonLogger(logger);
+        if (!policies.policy) {
+          throw new Error(
+            'No policy module installed! Please install a policy module. If you want to allow all requests, use permissionModuleAllowAllPolicy',
           );
-        },
-      });
-    },
-  }),
-);
+        }
+
+        http.use(
+          await createRouter({
+            config,
+            discovery,
+            identity,
+            logger: winstonLogger,
+            policy: policies.policy,
+          }),
+        );
+      },
+    });
+  },
+}));