From ebe9b13b0afd6db18968af558357ca2c6880edb0 Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Wed, 9 Apr 2025 16:01:42 +0200 Subject: [PATCH] permission: clarify resourceRef error Signed-off-by: Vincenzo Scamporlino --- .../permission-backend/src/service/router.ts | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/plugins/permission-backend/src/service/router.ts b/plugins/permission-backend/src/service/router.ts index dd152d66aa..20cfaff285 100644 --- a/plugins/permission-backend/src/service/router.ts +++ b/plugins/permission-backend/src/service/router.ts @@ -236,15 +236,19 @@ export async function createRouter( const body = parseResult.data; if ( - !(credentials.principal as BackstageUserPrincipal).issuedBy && - body.items.some( - r => - isResourcePermission(r.permission) && r.resourceRef === undefined, - ) + auth.isPrincipal(credentials, 'none') || + (auth.isPrincipal(credentials, 'user') && !credentials.principal.actor) ) { - throw new InputError( - 'Resource permissions require a resourceRef to be set', - ); + if ( + body.items.some( + r => + isResourcePermission(r.permission) && r.resourceRef === undefined, + ) + ) { + throw new InputError( + 'Resource permissions require a resourceRef to be set. Direct user requests without a resourceRef are not allowed.', + ); + } } res.json({