From d6f90e934d9e685be5364ef90c556b43add38e42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 21 Sep 2021 16:49:54 +0200 Subject: [PATCH] Apply the rules enforcer, based on origin location MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/dirty-spoons-scream.md | 43 +++++++++++++++++++ plugins/catalog-backend/api-report.md | 2 + .../src/ingestion/CatalogRules.ts | 11 ++++- .../src/next/NextCatalogBuilder.ts | 3 ++ .../DefaultCatalogProcessingOrchestrator.ts | 29 ++++++++++++- 5 files changed, 85 insertions(+), 3 deletions(-) create mode 100644 .changeset/dirty-spoons-scream.md diff --git a/.changeset/dirty-spoons-scream.md b/.changeset/dirty-spoons-scream.md new file mode 100644 index 0000000000..8d8d50a6eb --- /dev/null +++ b/.changeset/dirty-spoons-scream.md @@ -0,0 +1,43 @@ +--- +'@backstage/plugin-catalog-backend': minor +--- + +Apply the catalog rules enforcer, based on origin location. + +This is a breaking change, in the sense that this was not properly checked in earlier versions of the new catalog engine. You may see ingestion of certain entities start to be rejected after this update, if the following conditions apply to you: + +- You are using the configuration key `catalog.rules.[].allow`, and +- Your registered locations point (directly or transitively) to entities whose kinds are not listed in `catalog.rules.[].allow` + +and/or + +- You are using the configuration key `catalog.locations.[].rules.[].allow` +- The config locations point (directly or transitively) to entities whose kinds are not listed neither `catalog.rules.[].allow`, nor in the corresponding `.rules.[].allow` of that config location + +This is an example of what the configuration might look like: + +```yaml +catalog: + # These do not list Template as a valid kind; users are therefore unable to + # manually register entities of the Template kind + rules: + - allow: + - Component + - API + - Resource + - Group + - User + - System + - Domain + - Location + locations: + # This lists Template as valid only for that specific config location + - type: file + target: ../../plugins/scaffolder-backend/sample-templates/all-templates.yaml + rules: + - allow: [Template] +``` + +If you are not using any of those `rules` section, you should not be affected by this change. + +If you do use any of those `rules` sections, make sure that they are complete and list all of the kinds that are in active use in your Backstage installation. diff --git a/plugins/catalog-backend/api-report.md b/plugins/catalog-backend/api-report.md index 89ef2c09d1..c8c77c7514 100644 --- a/plugins/catalog-backend/api-report.md +++ b/plugins/catalog-backend/api-report.md @@ -751,6 +751,7 @@ export class DefaultCatalogProcessingOrchestrator logger: Logger_2; parser: CatalogProcessorParser; policy: EntityPolicy; + rulesEnforcer: CatalogRulesEnforcer; }); // (undocumented) process(request: EntityProcessingRequest): Promise; @@ -1497,4 +1498,5 @@ export class UrlReaderProcessor implements CatalogProcessor { // src/ingestion/processors/types.d.ts:58:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen // src/ingestion/types.d.ts:17:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen // src/ingestion/types.d.ts:41:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen +// src/next/processing/DefaultCatalogProcessingOrchestrator.d.ts:15:9 - (ae-forgotten-export) The symbol "CatalogRulesEnforcer" needs to be exported by the entry point index.d.ts ``` diff --git a/plugins/catalog-backend/src/ingestion/CatalogRules.ts b/plugins/catalog-backend/src/ingestion/CatalogRules.ts index 97ee2a942b..4902a3655d 100644 --- a/plugins/catalog-backend/src/ingestion/CatalogRules.ts +++ b/plugins/catalog-backend/src/ingestion/CatalogRules.ts @@ -16,6 +16,7 @@ import { Config } from '@backstage/config'; import { LocationSpec, Entity } from '@backstage/catalog-model'; +import path from 'path'; /** * A structure for matching entities to a given rule. @@ -104,7 +105,7 @@ export class CatalogRulesEnforcer { return []; } const type = locConf.getString('type'); - const target = locConf.getString('target'); + const target = resolveTarget(type, locConf.getString('target')); return locConf.getConfigArray('rules').map(ruleConf => ({ allow: ruleConf.getStringArray('allow').map(kind => ({ kind })), @@ -175,3 +176,11 @@ export class CatalogRulesEnforcer { return false; } } + +function resolveTarget(type: string, target: string): string { + if (type !== 'file') { + return target; + } + + return path.resolve(target); +} diff --git a/plugins/catalog-backend/src/next/NextCatalogBuilder.ts b/plugins/catalog-backend/src/next/NextCatalogBuilder.ts index a34be2ca6a..3e281e4e38 100644 --- a/plugins/catalog-backend/src/next/NextCatalogBuilder.ts +++ b/plugins/catalog-backend/src/next/NextCatalogBuilder.ts @@ -78,6 +78,7 @@ import { import { CatalogEnvironment } from '../service/CatalogBuilder'; import { createNextRouter } from './NextRouter'; import { DefaultRefreshService } from './DefaultRefreshService'; +import { CatalogRulesEnforcer } from '../ingestion/CatalogRules'; /** * A builder that helps wire up all of the component parts of the catalog. @@ -304,9 +305,11 @@ export class NextCatalogBuilder { refreshInterval: this.refreshInterval, }); const integrations = ScmIntegrations.fromConfig(config); + const rulesEnforcer = CatalogRulesEnforcer.fromConfig(config); const orchestrator = new DefaultCatalogProcessingOrchestrator({ processors, integrations, + rulesEnforcer, logger, parser, policy, diff --git a/plugins/catalog-backend/src/next/processing/DefaultCatalogProcessingOrchestrator.ts b/plugins/catalog-backend/src/next/processing/DefaultCatalogProcessingOrchestrator.ts index d7f51807a3..384060125e 100644 --- a/plugins/catalog-backend/src/next/processing/DefaultCatalogProcessingOrchestrator.ts +++ b/plugins/catalog-backend/src/next/processing/DefaultCatalogProcessingOrchestrator.ts @@ -21,8 +21,9 @@ import { LocationSpec, parseLocationReference, stringifyEntityRef, + stringifyLocationReference, } from '@backstage/catalog-model'; -import { ConflictError, InputError } from '@backstage/errors'; +import { ConflictError, InputError, NotAllowedError } from '@backstage/errors'; import { ScmIntegrationRegistry } from '@backstage/integration'; import path from 'path'; import { Logger } from 'winston'; @@ -45,6 +46,7 @@ import { validateEntity, validateEntityEnvelope, } from './util'; +import { CatalogRulesEnforcer } from '../../ingestion/CatalogRules'; type Context = { entityRef: string; @@ -63,6 +65,7 @@ export class DefaultCatalogProcessingOrchestrator logger: Logger; parser: CatalogProcessorParser; policy: EntityPolicy; + rulesEnforcer: CatalogRulesEnforcer; }, ) {} @@ -117,8 +120,30 @@ export class DefaultCatalogProcessingOrchestrator } entity = await this.runPostProcessStep(entity, context); + // Check that any emitted entities are permitted to originate from that + // particular location according to the catalog rules + const collectorResults = context.collector.results(); + for (const deferredEntity of collectorResults.deferredEntities) { + if ( + !this.options.rulesEnforcer.isAllowed( + deferredEntity.entity, + context.originLocation, + ) + ) { + throw new NotAllowedError( + `Entity ${stringifyEntityRef( + deferredEntity.entity, + )} at ${stringifyLocationReference( + context.location, + )}, originated at ${stringifyLocationReference( + context.originLocation, + )}, is not of an allowed kind for that location`, + ); + } + } + return { - ...context.collector.results(), + ...collectorResults, completedEntity: entity, state: new Map(), ok: true,