Merge pull request #12882 from backstage/vinzscam/fix-catalog-permissions-metadata-array-support

Catalog: fix conditional decision based on properties of type array

.changeset/strange-moles-design.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Fix issue for conditional decisions based on properties stored as arrays, like tags.
+
+Before this change, having a permission policy returning conditional decisions based on metadata like tags, such like `createCatalogConditionalDecision(permission, catalogConditions.hasMetadata('tags', 'java'),)`, was producing wrong results. The issue occurred when authorizing entities already loaded from the database, for example when authorizing `catalogEntityDeletePermission`.

plugins/catalog-backend/src/permissions/rules/createPropertyRule.test.ts

@@ -46,6 +46,22 @@ describe('createPropertyRule', () => {
         ).toBe(false);
       });
 
+      it('returns false when specified key is an empty array', () => {
+        expect(
+          apply(
+            {
+              apiVersion: 'backstage.io/v1alpha1',
+              kind: 'Component',
+              metadata: {
+                name: 'test-component',
+                tags: [],
+              },
+            },
+            'tags',
+          ),
+        ).toBe(false);
+      });
+
       it('returns true when specified key is present', () => {
         expect(
           apply(
@@ -63,6 +79,22 @@ describe('createPropertyRule', () => {
           ),
         ).toBe(true);
       });
+
+      it('returns true when specified key is an array containing more than an element', () => {
+        expect(
+          apply(
+            {
+              apiVersion: 'backstage.io/v1alpha1',
+              kind: 'Component',
+              metadata: {
+                name: 'test-component',
+                tags: ['java'],
+              },
+            },
+            'tags',
+          ),
+        ).toBe(true);
+      });
     });
 
     describe('key and value', () => {
@@ -101,6 +133,23 @@ describe('createPropertyRule', () => {
         ).toBe(false);
       });
 
+      it(`returns false when key is an array and doesn't contain the specified value`, () => {
+        expect(
+          apply(
+            {
+              apiVersion: 'backstage.io/v1alpha1',
+              kind: 'Component',
+              metadata: {
+                name: 'test-component',
+                tags: ['java'],
+              },
+            },
+            'tags',
+            'python',
+          ),
+        ).toBe(false);
+      });
+
       it('returns true when specified key and value is present', () => {
         expect(
           apply(
@@ -119,6 +168,23 @@ describe('createPropertyRule', () => {
           ),
         ).toBe(true);
       });
+
+      it(`returns true when key is an array and contains the specified value`, () => {
+        expect(
+          apply(
+            {
+              apiVersion: 'backstage.io/v1alpha1',
+              kind: 'Component',
+              metadata: {
+                name: 'test-component',
+                tags: ['java', 'java11'],
+              },
+            },
+            'tags',
+            'java',
+          ),
+        ).toBe(true);
+      });
     });
   });
 

plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts

@@ -26,6 +26,13 @@ export const createPropertyRule = (propertyType: 'metadata' | 'spec') =>
     resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
     apply: (resource: Entity, key: string, value?: string) => {
       const foundValue = get(resource[propertyType], key);
+
+      if (Array.isArray(foundValue)) {
+        if (value !== undefined) {
+          return foundValue.includes(value);
+        }
+        return foundValue.length > 0;
+      }
       if (value !== undefined) {
         return value === foundValue;
       }