Merge pull request #8506 from backstage/authz-search-backend

search: filter unauthorized results

packages/backend/src/plugins/search.ts

@@ -56,6 +56,7 @@ async function createSearchEngine({
 
 export default async function createPlugin({
   logger,
+  permissions,
   discovery,
   config,
   database,
@@ -95,6 +96,9 @@ export default async function createPlugin({
 
   return await createRouter({
     engine: indexBuilder.getSearchEngine(),
+    types: indexBuilder.getDocumentTypes(),
+    permissions,
+    config,
     logger,
   });
 }

packages/create-app/templates/default-app/packages/backend/src/plugins/search.ts

@@ -10,6 +10,7 @@ import { DefaultTechDocsCollator } from '@backstage/plugin-techdocs-backend';
 
 export default async function createPlugin({
   logger,
+  permissions,
   discovery,
   config,
   tokenManager,
@@ -49,6 +50,9 @@ export default async function createPlugin({
 
   return await createRouter({
     engine: indexBuilder.getSearchEngine(),
+    types: indexBuilder.getDocumentTypes(),
+    permissions,
+    config,
     logger,
   });
 }

packages/search-common/api-report.md

@@ -4,6 +4,7 @@
 
 ```ts
 import { JsonObject } from '@backstage/types';
+import { Permission } from '@backstage/plugin-permission-common';
 
 // Warning: (ae-missing-release-tag) "DocumentCollator" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -12,6 +13,7 @@ export interface DocumentCollator {
   // (undocumented)
   execute(): Promise<IndexableDocument[]>;
   readonly type: string;
+  readonly visibilityPermission?: Permission;
 }
 
 // Warning: (ae-missing-release-tag) "DocumentDecorator" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -23,15 +25,32 @@ export interface DocumentDecorator {
   readonly types?: string[];
 }
 
+// Warning: (ae-missing-release-tag) "DocumentTypeInfo" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public
+export type DocumentTypeInfo = {
+  visibilityPermission?: Permission;
+};
+
 // Warning: (ae-missing-release-tag) "IndexableDocument" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
 export interface IndexableDocument {
+  authorization?: {
+    resourceRef: string;
+  };
   location: string;
   text: string;
   title: string;
 }
 
+// Warning: (ae-missing-release-tag) "QueryRequestOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export type QueryRequestOptions = {
+  token?: string;
+};
+
 // Warning: (ae-missing-release-tag) "QueryTranslator" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -42,7 +61,10 @@ export type QueryTranslator = (query: SearchQuery) => unknown;
 // @public
 export interface SearchEngine {
   index(type: string, documents: IndexableDocument[]): Promise<void>;
-  query(query: SearchQuery): Promise<SearchResultSet>;
+  query(
+    query: SearchQuery,
+    options?: QueryRequestOptions,
+  ): Promise<SearchResultSet>;
   setTranslator(translator: QueryTranslator): void;
 }
 

packages/search-common/package.json

@@ -36,7 +36,8 @@
     "url": "https://github.com/backstage/backstage/issues"
   },
   "dependencies": {
-    "@backstage/types": "^0.1.1"
+    "@backstage/types": "^0.1.1",
+    "@backstage/plugin-permission-common": "^0.4.0-next.0"
   },
   "devDependencies": {
     "@backstage/cli": "^0.12.0-next.0"

packages/search-common/src/types.ts

@@ -13,6 +13,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
+import { Permission } from '@backstage/plugin-permission-common';
 import { JsonObject } from '@backstage/types';
 
 export interface SearchQuery {
@@ -53,8 +55,32 @@ export interface IndexableDocument {
    * is clicked).
    */
   location: string;
+
+  /**
+   * Optional authorization information to be used when determining whether this
+   * search result should be visible to a given user.
+   */
+  authorization?: {
+    /**
+     * Identifier for the resource.
+     */
+    resourceRef: string;
+  };
 }
 
+/**
+ * Information about a specific document type. Intended to be used in the
+ * {@link @backstage/search-backend-node#IndexBuilder} to collect information
+ * about the types stored in the index.
+ */
+export type DocumentTypeInfo = {
+  /**
+   * The {@link @backstage/plugin-permission-common#Permission} that controls
+   * visibility of resources associated with this collator's documents.
+   */
+  visibilityPermission?: Permission;
+};
+
 /**
  * Interface that must be implemented in order to expose new documents to
  * search.
@@ -65,6 +91,13 @@ export interface DocumentCollator {
    * index name by Search Engines.
    */
   readonly type: string;
+
+  /**
+   * The {@link @backstage/plugin-permission-common#Permission} that controls
+   * visibility of resources associated with this collator's documents.
+   */
+  readonly visibilityPermission?: Permission;
+
   execute(): Promise<IndexableDocument[]>;
 }
 
@@ -88,6 +121,10 @@ export interface DocumentDecorator {
  */
 export type QueryTranslator = (query: SearchQuery) => unknown;
 
+export type QueryRequestOptions = {
+  token?: string;
+};
+
 /**
  * Interface that must be implemented by specific search engines, responsible
  * for performing indexing and querying and translating abstract queries into
@@ -107,5 +144,8 @@ export interface SearchEngine {
   /**
    * Perform a search query against the SearchEngine.
    */
-  query(query: SearchQuery): Promise<SearchResultSet>;
+  query(
+    query: SearchQuery,
+    options?: QueryRequestOptions,
+  ): Promise<SearchResultSet>;
 }