Merge pull request #8506 from backstage/authz-search-backend

search: filter unauthorized results

.changeset/angry-carrots-brush.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend-node': patch
+---
+
+Track visibility permissions by document type in IndexBuilder

.changeset/angry-jeans-bow.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Add support for permissions to the DefaultCatalogCollator.

.changeset/heavy-jars-repair.md

@@ -0,0 +1,25 @@
+---
+'@backstage/create-app': patch
+---
+
+Added three additional required properties to the search-backend `createRouter` function to support filtering search results based on permissions. To make this change to an existing app, add the required parameters to the `createRouter` call in `packages/backend/src/plugins/search.ts`:
+
+```diff
+export default async function createPlugin({
+  logger,
++  permissions,
+  discovery,
+  config,
+  tokenManager,
+}: PluginEnvironment) {
+  /* ... */
+
+  return await createRouter({
+    engine: indexBuilder.getSearchEngine(),
++    types: indexBuilder.getDocumentTypes(),
++    permissions,
++    config,
+    logger,
+  });
+}
+```

.changeset/nasty-dodos-complain.md

@@ -0,0 +1,6 @@
+---
+'@backstage/search-common': patch
+---
+
+- Add optional visibilityPermission property to DocumentCollator type
+- Add new DocumentTypeInfo type for housing information about the document types stored in a search engine.

.changeset/nasty-moose-trade.md

@@ -0,0 +1,5 @@
+---
+'@backstage/search-common': patch
+---
+
+Add optional resourceRef field to the IndexableDocument type for use when authorizing access to documents.

.changeset/nervous-walls-exercise.md

@@ -0,0 +1,5 @@
+---
+'@backstage/search-common': patch
+---
+
+Add optional query request options containing authorization token to SearchEngine#query.

.changeset/pink-spoons-hope.md

@@ -0,0 +1,25 @@
+---
+'@backstage/plugin-search-backend': minor
+---
+
+**BREAKING** Added three additional required properties to `createRouter` to support filtering search results based on permissions. To make this change to an existing app, add the required parameters to the `createRouter` call in `packages/backend/src/plugins/search.ts`:
+
+```diff
+export default async function createPlugin({
+  logger,
++  permissions,
+  discovery,
+  config,
+  tokenManager,
+}: PluginEnvironment) {
+  /* ... */
+
+  return await createRouter({
+    engine: indexBuilder.getSearchEngine(),
++    types: indexBuilder.getDocumentTypes(),
++    permissions,
++    config,
+    logger,
+  });
+}
+```

.changeset/small-avocados-decide.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-backend': patch
+---
+
+Add support for permissions to the DefaultTechDocsCollator.