Implement the scope feature of external access service tokens, as per BEP-0007

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

packages/backend-test-utils/api-report.md

@@ -11,6 +11,7 @@ import { Backend } from '@backstage/backend-app-api';
 import { BackendFeature } from '@backstage/backend-plugin-api';
 import { BackstageCredentials } from '@backstage/backend-plugin-api';
 import { BackstageNonePrincipal } from '@backstage/backend-plugin-api';
+import { BackstagePrincipalAccessRestrictions } from '@backstage/backend-plugin-api';
 import { BackstageServicePrincipal } from '@backstage/backend-plugin-api';
 import { BackstageUserInfo } from '@backstage/backend-plugin-api';
 import { BackstageUserPrincipal } from '@backstage/backend-plugin-api';
@@ -68,6 +69,7 @@ export namespace mockCredentials {
   }
   export function service(
     subject?: string,
+    accessRestrictions?: BackstagePrincipalAccessRestrictions,
   ): BackstageCredentials<BackstageServicePrincipal>;
   export namespace service {
     export function header(options?: TokenOptions): string;

packages/backend-test-utils/src/next/services/mockCredentials.test.ts

@@ -134,6 +134,16 @@ describe('mockCredentials', () => {
     expect(mockCredentials.service.invalidHeader()).toBe(
       'Bearer mock-invalid-service-token',
     );
+    expect(
+      mockCredentials.service('test', { permissionNames: ['do.it'] }),
+    ).toEqual({
+      $$type: '@backstage/BackstageCredentials',
+      principal: {
+        type: 'service',
+        subject: 'test',
+        accessRestrictions: { permissionNames: ['do.it'] },
+      },
+    });
   });
 
   it('should throw on invalid user entity refs', () => {

packages/backend-test-utils/src/next/services/mockCredentials.ts

@@ -17,6 +17,7 @@
 import {
   BackstageCredentials,
   BackstageNonePrincipal,
+  BackstagePrincipalAccessRestrictions,
   BackstageServicePrincipal,
   BackstageUserPrincipal,
 } from '@backstage/backend-plugin-api';
@@ -202,14 +203,19 @@ export namespace mockCredentials {
   /**
    * Creates a mocked credentials object for a service principal.
    *
-   * The default subject is 'external:test-service'.
+   * The default subject is 'external:test-service', and no access restrictions.
    */
   export function service(
     subject: string = DEFAULT_MOCK_SERVICE_SUBJECT,
+    accessRestrictions?: BackstagePrincipalAccessRestrictions,
   ): BackstageCredentials<BackstageServicePrincipal> {
     return {
       $$type: '@backstage/BackstageCredentials',
-      principal: { type: 'service', subject },
+      principal: {
+        type: 'service',
+        subject,
+        ...(accessRestrictions ? { accessRestrictions } : {}),
+      },
     };
   }