From dcc5f2b3ccf1807165f9fa34c436426bbdd75638 Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Wed, 9 Apr 2025 15:21:11 +0200
Subject: [PATCH] permission-backend: validate issueBy from credentials

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 plugins/permission-backend/src/service/router.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/plugins/permission-backend/src/service/router.ts b/plugins/permission-backend/src/service/router.ts
index c624947375..dd152d66aa 100644
--- a/plugins/permission-backend/src/service/router.ts
+++ b/plugins/permission-backend/src/service/router.ts
@@ -235,6 +235,18 @@ export async function createRouter(
 
       const body = parseResult.data;
 
+      if (
+        !(credentials.principal as BackstageUserPrincipal).issuedBy &&
+        body.items.some(
+          r =>
+            isResourcePermission(r.permission) && r.resourceRef === undefined,
+        )
+      ) {
+        throw new InputError(
+          'Resource permissions require a resourceRef to be set',
+        );
+      }
+
       res.json({
         items: await handleRequest(
           body.items,