From 9ee832c5a940c97c2f43b9fa0a0cd65efc6527df Mon Sep 17 00:00:00 2001
From: Frank Kong <frkong@redhat.com>
Date: Fri, 19 Apr 2024 16:48:12 -0400
Subject: [PATCH] feat(scaffolder): add additional scaffolder task permissions

Signed-off-by: Frank Kong <frkong@redhat.com>
---
 plugins/scaffolder-common/src/permissions.ts | 61 ++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/plugins/scaffolder-common/src/permissions.ts b/plugins/scaffolder-common/src/permissions.ts
index 5c4c367889..bd548df950 100644
--- a/plugins/scaffolder-common/src/permissions.ts
+++ b/plugins/scaffolder-common/src/permissions.ts
@@ -30,6 +30,13 @@ export const RESOURCE_TYPE_SCAFFOLDER_TEMPLATE = 'scaffolder-template';
  */
 export const RESOURCE_TYPE_SCAFFOLDER_ACTION = 'scaffolder-action';
 
+/**
+ * Permission resource type which corresponds to a scaffolder task.
+ *
+ * @alpha
+ */
+export const RESOURCE_TYPE_SCAFFOLDER_TASK = 'scaffolder-task';
+
 /**
  * This permission is used to authorize actions that involve executing
  * an action from a template.
@@ -78,6 +85,50 @@ export const templateStepReadPermission = createPermission({
   resourceType: RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,
 });
 
+/**
+ * This permission is used to authorize actions that involve reading one or more tasks in the scaffolder,
+ * and reading logs of tasks
+ *
+ * Task cancellation would also require this permission.
+ *
+ * @alpha
+ */
+export const taskReadPermission = createPermission({
+  name: 'scaffolder.task.read',
+  attributes: {
+    action: 'read',
+  },
+  resourceType: RESOURCE_TYPE_SCAFFOLDER_TASK,
+});
+
+/**
+ * This permission is used to authorize actions that involve the creation of tasks in the scaffolder.
+ *
+ * @alpha
+ */
+export const taskCreatePermission = createPermission({
+  name: 'scaffolder.task.create',
+  attributes: {
+    action: 'create',
+  },
+  resourceType: RESOURCE_TYPE_SCAFFOLDER_TASK,
+});
+
+/**
+ * This permission us used to authorize actions that involve the cancellation of tasks in the scaffolder.
+ *
+ * This will require the `scaffolder.task.read` permission to be authorized.
+ *
+ * @alpha
+ */
+export const taskCancelPermission = createPermission({
+  name: 'scaffolder.task.cancel',
+  attributes: {
+    action: 'update',
+  },
+  resourceType: RESOURCE_TYPE_SCAFFOLDER_TASK,
+});
+
 /**
  * List of all the scaffolder permissions
  * @alpha
@@ -102,3 +153,13 @@ export const scaffolderTemplatePermissions = [
  * @alpha
  */
 export const scaffolderActionPermissions = [actionExecutePermission];
+
+/**
+ * List of the scaffolder permissions that are associated with scaffolder tasks.
+ * @alpha
+ */
+export const scaffolderTaskPermissions = [
+  taskCancelPermission,
+  taskCreatePermission,
+  taskReadPermission,
+];