From 92103db5373b8219df7d064a6352906529b7c9ee Mon Sep 17 00:00:00 2001
From: Joon Park <joonp@spotify.com>
Date: Mon, 1 Aug 2022 11:07:05 +0100
Subject: [PATCH] Aggregate catalog permissions (#12832)

As a follow up to https://github.com/backstage/backstage/pull/11695, the catalog permissions will now be aggregated and made available on the `/.well-known/backstage/permissions/metadata/` endpoint.

Signed-off-by: Joon Park <joonp@spotify.com>
---
 .changeset/lovely-walls-brush.md                   |  5 +++++
 .../catalog-backend/src/service/CatalogBuilder.ts  |  6 +++++-
 plugins/catalog-common/api-report.md               |  6 ++++++
 plugins/catalog-common/src/index.ts                |  1 +
 plugins/catalog-common/src/permissions.ts          | 14 ++++++++++++++
 5 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/lovely-walls-brush.md

diff --git a/.changeset/lovely-walls-brush.md b/.changeset/lovely-walls-brush.md
new file mode 100644
index 0000000000..8834673d3b
--- /dev/null
+++ b/.changeset/lovely-walls-brush.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-common': patch
+---
+
+Export aggregated list of all catalog permissions
diff --git a/plugins/catalog-backend/src/service/CatalogBuilder.ts b/plugins/catalog-backend/src/service/CatalogBuilder.ts
index a9ba5bbb23..e9e35301c3 100644
--- a/plugins/catalog-backend/src/service/CatalogBuilder.ts
+++ b/plugins/catalog-backend/src/service/CatalogBuilder.ts
@@ -91,7 +91,10 @@ import {
 } from '@backstage/plugin-permission-node';
 import { AuthorizedEntitiesCatalog } from './AuthorizedEntitiesCatalog';
 import { basicEntityFilter } from './request/basicEntityFilter';
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common';
+import {
+  catalogPermissions,
+  RESOURCE_TYPE_CATALOG_ENTITY,
+} from '@backstage/plugin-catalog-common';
 import { AuthorizedLocationService } from './AuthorizedLocationService';
 
 /** @public */
@@ -435,6 +438,7 @@ export class CatalogBuilder {
             entitiesByRef[stringifyEntityRef(parseEntityRef(resourceRef))],
         );
       },
+      permissions: catalogPermissions,
       rules: this.permissionRules,
     });
     const stitcher = new Stitcher(dbClient, logger);
diff --git a/plugins/catalog-common/api-report.md b/plugins/catalog-common/api-report.md
index ab540d446b..b7eaf99d8b 100644
--- a/plugins/catalog-common/api-report.md
+++ b/plugins/catalog-common/api-report.md
@@ -49,6 +49,12 @@ export const catalogLocationDeletePermission: BasicPermission;
 // @alpha
 export const catalogLocationReadPermission: BasicPermission;
 
+// @alpha
+export const catalogPermissions: (
+  | BasicPermission
+  | ResourcePermission<'catalog-entity'>
+)[];
+
 // @alpha
 export const RESOURCE_TYPE_CATALOG_ENTITY = 'catalog-entity';
 ```
diff --git a/plugins/catalog-common/src/index.ts b/plugins/catalog-common/src/index.ts
index dfa90c448b..614948e56c 100644
--- a/plugins/catalog-common/src/index.ts
+++ b/plugins/catalog-common/src/index.ts
@@ -30,6 +30,7 @@ export {
   catalogLocationReadPermission,
   catalogLocationCreatePermission,
   catalogLocationDeletePermission,
+  catalogPermissions,
 } from './permissions';
 export type { CatalogEntityPermission } from './permissions';
 
diff --git a/plugins/catalog-common/src/permissions.ts b/plugins/catalog-common/src/permissions.ts
index aa95e8c00f..615f02a7fb 100644
--- a/plugins/catalog-common/src/permissions.ts
+++ b/plugins/catalog-common/src/permissions.ts
@@ -129,3 +129,17 @@ export const catalogLocationDeletePermission = createPermission({
     action: 'delete',
   },
 });
+
+/**
+ * List of all catalog permissions.
+ * @alpha
+ */
+export const catalogPermissions = [
+  catalogEntityReadPermission,
+  catalogEntityCreatePermission,
+  catalogEntityDeletePermission,
+  catalogEntityRefreshPermission,
+  catalogLocationReadPermission,
+  catalogLocationCreatePermission,
+  catalogLocationDeletePermission,
+];