From 06af5a617c09392575ded2d79358c6fcc8de4165 Mon Sep 17 00:00:00 2001 From: stanleyn Date: Fri, 24 Nov 2023 13:01:01 +0000 Subject: [PATCH 1/3] Update custom permission rules documentation Signed-off-by: stanleyn --- docs/permissions/custom-rules.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docs/permissions/custom-rules.md b/docs/permissions/custom-rules.md index cab138ed9e..2937978374 100644 --- a/docs/permissions/custom-rules.md +++ b/docs/permissions/custom-rules.md @@ -8,9 +8,9 @@ For some use cases, you may want to define custom [rules](./concepts.md#resource ## Define a custom rule -Plugins should export a rule factory that provides type-safety that ensures compatibility with the plugin's backend. The catalog plugin exports `createCatalogPermissionRule` from `@backstage/plugin-catalog-backend/alpha` for this purpose. Note: the `/alpha` path segment is temporary until this API is marked as stable. For this example, we'll define the rule in `packages/backend/src/plugins/permission.ts`, but you can put it anywhere that's accessible by your `backend` package. +Plugins should export a rule factory that provides type-safety that ensures compatibility with the plugin's backend. The catalog plugin exports `createCatalogPermissionRule` from `@backstage/plugin-catalog-backend/alpha` for this purpose. Note: the `/alpha` path segment is temporary until this API is marked as stable. For this example, we'll define the rule in `packages/backend/src/customPermissionRules/isInSystem`, but you can put it anywhere that's accessible by your `backend` package. -```typescript title="packages/backend/src/plugins/permission.ts" +```typescript title="packages/backend/src/customPermissionRules/isInSystem.ts" import type { Entity } from '@backstage/catalog-model'; import { createCatalogPermissionRule } from '@backstage/plugin-catalog-backend/alpha'; import { createConditionFactory } from '@backstage/plugin-permission-node'; @@ -40,7 +40,7 @@ export const isInSystemRule = createCatalogPermissionRule({ }), }); -const isInSystem = createConditionFactory(isInSystemRule); +export const isInSystemRuleFactory = createConditionFactory(isInSystemRule); ``` For a more detailed explanation on defining rules, refer to the [documentation for plugin authors](./plugin-authors/03-adding-a-resource-permission-check.md#adding-support-for-conditional-decisions). @@ -52,9 +52,8 @@ Now that we have a custom rule defined, we need provide it to the catalog plugin The api for providing custom rules may differ between plugins, but there should typically be some integration point during the creation of the backend router. For the catalog, this integration point is exposed via `CatalogBuilder.addPermissionRules`. ```typescript title="packages/backend/src/plugins/catalog.ts" -import { isInSystemRule } from './permission'; -// The CatalogBuilder with the addPermissionRules function is in the alpha path -import { CatalogBuilder } from '@backstage/plugin-catalog-backend/alpha'; +import { CatalogBuilder } from '@backstage/plugin-catalog-backend'; +import { isInSystemRule } from '../customPermissionRules/isInSystem'; ... @@ -75,8 +74,9 @@ The new rule is now ready for use in a permission policy! Let's bring this all together by extending the example policy from the previous section. ```ts title="packages/backend/src/plugins/permission.ts" +... /* highlight-add-next-line */ -import { isInSystem } from './catalog'; +import { isInSystemRuleFactory } from '../customPermissionRules/isInSystem'; class TestPermissionPolicy implements PermissionPolicy { async handle( @@ -97,7 +97,7 @@ class TestPermissionPolicy implements PermissionPolicy { catalogConditions.isEntityOwner({ claims: user?.identity.ownershipEntityRefs ?? [] }), - isInSystem('interviewing') + isInSystemRuleFactory({ systemRef: 'interviewing' }), ] } /* highlight-add-end */ @@ -106,6 +106,9 @@ class TestPermissionPolicy implements PermissionPolicy { return { result: AuthorizeResult.ALLOW }; } +} + +... ``` The updated policy will allow catalog entity resource permissions if any of the following are true: From 6c21ffdfd56be76d5f91912f38406bcc6c6d0882 Mon Sep 17 00:00:00 2001 From: stanleyn Date: Fri, 24 Nov 2023 13:01:30 +0000 Subject: [PATCH 2/3] Fix typo in Contributing doc Signed-off-by: stanleyn --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 07c2a3d96f..527957677b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -139,7 +139,7 @@ yarn build:api-reports # Build API Reports used for documentation yarn lint # lint packages that have changed since later commit on origin/master yarn lint:all # lint all packages -yarn lind:docs # lint all the Markdown files +yarn lint:docs # lint all the Markdown files yarn lint:type-deps # verify that @types/* dependencies are placed correctly in packages yarn test # test packages that have changed since later commit on origin/master From 3e56dee7564881243daae9d443c80f3e86c147cf Mon Sep 17 00:00:00 2001 From: stanleyn Date: Fri, 24 Nov 2023 14:19:04 +0000 Subject: [PATCH 3/3] Add file extension Signed-off-by: stanleyn --- docs/permissions/custom-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/permissions/custom-rules.md b/docs/permissions/custom-rules.md index 2937978374..76b0f16cfd 100644 --- a/docs/permissions/custom-rules.md +++ b/docs/permissions/custom-rules.md @@ -8,7 +8,7 @@ For some use cases, you may want to define custom [rules](./concepts.md#resource ## Define a custom rule -Plugins should export a rule factory that provides type-safety that ensures compatibility with the plugin's backend. The catalog plugin exports `createCatalogPermissionRule` from `@backstage/plugin-catalog-backend/alpha` for this purpose. Note: the `/alpha` path segment is temporary until this API is marked as stable. For this example, we'll define the rule in `packages/backend/src/customPermissionRules/isInSystem`, but you can put it anywhere that's accessible by your `backend` package. +Plugins should export a rule factory that provides type-safety that ensures compatibility with the plugin's backend. The catalog plugin exports `createCatalogPermissionRule` from `@backstage/plugin-catalog-backend/alpha` for this purpose. Note: the `/alpha` path segment is temporary until this API is marked as stable. For this example, we'll define the rule in `packages/backend/src/customPermissionRules/isInSystem.ts`, but you can put it anywhere that's accessible by your `backend` package. ```typescript title="packages/backend/src/customPermissionRules/isInSystem.ts" import type { Entity } from '@backstage/catalog-model';