Add optional value to HAS_LABEL permission rule

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>

plugins/catalog-backend/src/permissions/rules/hasLabel.test.ts

@@ -73,6 +73,50 @@ describe('hasLabel permission rule', () => {
         ),
       ).toEqual(true);
     });
+
+    it('returns false when specified label has different than expected value', () => {
+      expect(
+        hasLabel.apply(
+          {
+            apiVersion: 'backstage.io/v1alpha1',
+            kind: 'Component',
+            metadata: {
+              name: 'test-component',
+              labels: {
+                someLabel: 'foo',
+                'backstage.io/testLabel': 'bar',
+              },
+            },
+          },
+          {
+            label: 'backstage.io/testLabel',
+            value: 'baz',
+          },
+        ),
+      ).toEqual(false);
+    });
+
+    it('returns true when specified label has expected value', () => {
+      expect(
+        hasLabel.apply(
+          {
+            apiVersion: 'backstage.io/v1alpha1',
+            kind: 'Component',
+            metadata: {
+              name: 'test-component',
+              labels: {
+                someLabel: 'foo',
+                'backstage.io/testLabel': 'bar',
+              },
+            },
+          },
+          {
+            label: 'backstage.io/testLabel',
+            value: 'bar',
+          },
+        ),
+      ).toEqual(true);
+    });
   });
 
   describe('toQuery', () => {
@@ -85,5 +129,17 @@ describe('hasLabel permission rule', () => {
         key: 'metadata.labels.backstage.io/testlabel',
       });
     });
+
+    it('returns an appropriate catalog-backend filter with values', () => {
+      expect(
+        hasLabel.toQuery({
+          label: 'backstage.io/testLabel',
+          value: 'foo',
+        }),
+      ).toEqual({
+        key: 'metadata.labels.backstage.io/testLabel',
+        values: ['foo'],
+      });
+    });
   });
 });

plugins/catalog-backend/src/permissions/rules/hasLabel.ts

@@ -29,10 +29,18 @@ export const hasLabel = createPermissionRule({
   resourceRef: catalogEntityPermissionResourceRef,
   paramsSchema: z.object({
     label: z.string().describe('Name of the label to match on'),
+    value: z.string().optional().describe('Value of the label to match on'),
   }),
-  apply: (resource, { label }) =>
-    !!resource.metadata.labels?.hasOwnProperty(label),
-  toQuery: ({ label }) => ({
-    key: `metadata.labels.${label}`,
-  }),
+  apply: (resource, { label, value }) =>
+    !!resource.metadata.labels?.hasOwnProperty(label) &&
+    (value === undefined ? true : resource.metadata.labels?.[label] === value),
+  toQuery: ({ label, value }) =>
+    value === undefined
+      ? {
+          key: `metadata.labels.${label}`,
+        }
+      : {
+          key: `metadata.labels.${label}`,
+          values: [value],
+        },
 });