catalog-backend: update to use permission resource ref

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

.changeset/hungry-chefs-relax.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Updated permission integration to use new permission resource ref.

plugins/catalog-backend/src/permissions/conditionExports.ts

@@ -14,13 +14,12 @@
  * limitations under the License.
  */
 
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha';
 import { createConditionExports } from '@backstage/plugin-permission-node';
 import { permissionRules } from './rules';
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
 
 const { conditions, createConditionalDecision } = createConditionExports({
-  pluginId: 'catalog',
-  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
+  resourceRef: catalogEntityPermissionResourceRef,
   rules: permissionRules,
 });
 

plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts

@@ -14,16 +14,16 @@
  * limitations under the License.
  */
 
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
+import { createPermissionRule } from '@backstage/plugin-permission-node';
 import { get } from 'lodash';
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha';
-import { createCatalogPermissionRule } from './util';
 import { z } from 'zod';
 
 export const createPropertyRule = (propertyType: 'metadata' | 'spec') =>
-  createCatalogPermissionRule({
+  createPermissionRule({
     name: `HAS_${propertyType.toUpperCase()}`,
     description: `Allow entities with the specified ${propertyType} subfield`,
-    resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
+    resourceRef: catalogEntityPermissionResourceRef,
     paramsSchema: z.object({
       key: z
         .string()

plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts

@@ -14,9 +14,9 @@
  * limitations under the License.
  */
 
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha';
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
+import { createPermissionRule } from '@backstage/plugin-permission-node';
 import { z } from 'zod';
-import { createCatalogPermissionRule } from './util';
 
 /**
  * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which
@@ -26,10 +26,10 @@ import { createCatalogPermissionRule } from './util';
  *
  * @alpha
  */
-export const hasAnnotation = createCatalogPermissionRule({
+export const hasAnnotation = createPermissionRule({
   name: 'HAS_ANNOTATION',
   description: 'Allow entities with the specified annotation',
-  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
+  resourceRef: catalogEntityPermissionResourceRef,
   paramsSchema: z.object({
     annotation: z.string().describe('Name of the annotation to match on'),
     value: z

plugins/catalog-backend/src/permissions/rules/hasLabel.ts

@@ -14,19 +14,19 @@
  * limitations under the License.
  */
 
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha';
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
+import { createPermissionRule } from '@backstage/plugin-permission-node';
 import { z } from 'zod';
-import { createCatalogPermissionRule } from './util';
 
 /**
  * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which
  * filters for entities with a specified label in its metadata.
  * @alpha
  */
-export const hasLabel = createCatalogPermissionRule({
+export const hasLabel = createPermissionRule({
   name: 'HAS_LABEL',
   description: 'Allow entities with the specified label',
-  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
+  resourceRef: catalogEntityPermissionResourceRef,
   paramsSchema: z.object({
     label: z.string().describe('Name of the label to match on'),
   }),

plugins/catalog-backend/src/permissions/rules/isEntityKind.ts

@@ -14,19 +14,19 @@
  * limitations under the License.
  */
 
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha';
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
+import { createPermissionRule } from '@backstage/plugin-permission-node';
 import { z } from 'zod';
-import { createCatalogPermissionRule } from './util';
 
 /**
  * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which
  * filters for entities with a specified kind.
  * @alpha
  */
-export const isEntityKind = createCatalogPermissionRule({
+export const isEntityKind = createPermissionRule({
   name: 'IS_ENTITY_KIND',
   description: 'Allow entities matching a specified kind',
-  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
+  resourceRef: catalogEntityPermissionResourceRef,
   paramsSchema: z.object({
     kinds: z
       .array(z.string())

plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts

@@ -15,9 +15,9 @@
  */
 
 import { RELATION_OWNED_BY } from '@backstage/catalog-model';
-import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha';
+import { createPermissionRule } from '@backstage/plugin-permission-node';
 import { z } from 'zod';
-import { createCatalogPermissionRule } from './util';
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
 
 /**
  * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which
@@ -25,10 +25,10 @@ import { createCatalogPermissionRule } from './util';
  *
  * @alpha
  */
-export const isEntityOwner = createCatalogPermissionRule({
+export const isEntityOwner = createPermissionRule({
   name: 'IS_ENTITY_OWNER',
   description: 'Allow entities owned by a specified claim',
-  resourceType: RESOURCE_TYPE_CATALOG_ENTITY,
+  resourceRef: catalogEntityPermissionResourceRef,
   paramsSchema: z.object({
     claims: z
       .array(z.string())

plugins/catalog-backend/src/service/CatalogBuilder.ts

@@ -34,7 +34,7 @@ import {
 import { ScmIntegrations } from '@backstage/integration';
 import { createHash } from 'crypto';
 import { Router } from 'express';
-import lodash, { keyBy } from 'lodash';
+import lodash from 'lodash';
 
 import {
   AuditorService,
@@ -118,6 +118,7 @@ import { DefaultLocationService } from './DefaultLocationService';
 import { DefaultRefreshService } from './DefaultRefreshService';
 import { basicEntityFilter } from './request';
 import { entitiesResponseToObjects } from './response';
+import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha';
 
 /**
  * This is a duplicate of the alpha `CatalogPermissionRule` type, for use in the stable API.
@@ -558,7 +559,13 @@ export class CatalogBuilder {
     const entitiesCatalog = new AuthorizedEntitiesCatalog(
       unauthorizedEntitiesCatalog,
       permissionsService,
-      createConditionTransformer(this.permissionRules),
+      permissionsRegistry
+        ? createConditionTransformer(
+            permissionsRegistry.getRuleAccessor(
+              catalogEntityPermissionResourceRef,
+            ),
+          )
+        : createConditionTransformer(this.permissionRules),
     );
 
     const catalogPermissionResource = {
@@ -579,9 +586,10 @@ export class CatalogBuilder {
           },
         });
 
-        const entitiesByRef = keyBy(
-          entitiesResponseToObjects(entities),
-          stringifyEntityRef,
+        const entitiesByRef = Object.fromEntries(
+          entitiesResponseToObjects(entities)
+            .filter((x): x is Entity => Boolean(x))
+            .map(entity => [stringifyEntityRef(entity), entity]),
         );
 
         return resourceRefs.map(
@@ -597,7 +605,10 @@ export class CatalogBuilder {
       | ReturnType<typeof createPermissionIntegrationRouter>
       | undefined;
     if (permissionsRegistry) {
-      permissionsRegistry.addResourceType(catalogPermissionResource);
+      permissionsRegistry.addResourceType({
+        ...catalogPermissionResource,
+        resourceRef: catalogEntityPermissionResourceRef,
+      });
     } else {
       permissionIntegrationRouter = createPermissionIntegrationRouter(
         catalogPermissionResource,