Merge pull request #17241 from backstage/scaffolder-action-permissions

Scaffolder: permissioning actions

plugins/scaffolder-common/alpha-api-report.md

@@ -5,11 +5,20 @@
 ```ts
 import { ResourcePermission } from '@backstage/plugin-permission-common';
 
+// @alpha
+export const actionExecutePermission: ResourcePermission<'scaffolder-action'>;
+
+// @alpha
+export const RESOURCE_TYPE_SCAFFOLDER_ACTION = 'scaffolder-action';
+
 // @alpha
 export const RESOURCE_TYPE_SCAFFOLDER_TEMPLATE = 'scaffolder-template';
 
 // @alpha
-export const scaffolderPermissions: ResourcePermission<'scaffolder-template'>[];
+export const scaffolderPermissions: (
+  | ResourcePermission<'scaffolder-action'>
+  | ResourcePermission<'scaffolder-template'>
+)[];
 
 // @alpha
 export const templateParameterReadPermission: ResourcePermission<'scaffolder-template'>;

plugins/scaffolder-common/src/permissions.ts

@@ -23,6 +23,25 @@ import { createPermission } from '@backstage/plugin-permission-common';
  */
 export const RESOURCE_TYPE_SCAFFOLDER_TEMPLATE = 'scaffolder-template';
 
+/**
+ * Permission resource type which corresponds to a scaffolder action.
+ *
+ * @alpha
+ */
+export const RESOURCE_TYPE_SCAFFOLDER_ACTION = 'scaffolder-action';
+
+/**
+ * This permission is used to authorize actions that involve executing
+ * an action from a template.
+ *
+ * @alpha
+ */
+export const actionExecutePermission = createPermission({
+  name: 'scaffolder.action.execute',
+  attributes: {},
+  resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,
+});
+
 /**
  * This permission is used to authorize actions that involve reading
  * one or more parameters from a template.
@@ -64,6 +83,7 @@ export const templateStepReadPermission = createPermission({
  * @alpha
  */
 export const scaffolderPermissions = [
+  actionExecutePermission,
   templateParameterReadPermission,
   templateStepReadPermission,
 ];