From ef73f971589a33624431f39f08e72178b2f59114 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Thu, 30 Jan 2025 10:04:19 +0100 Subject: [PATCH] catalog-backend: update to use permission resource ref Signed-off-by: Patrik Oldsberg --- .changeset/hungry-chefs-relax.md | 5 ++++ .../src/permissions/conditionExports.ts | 5 ++-- .../permissions/rules/createPropertyRule.ts | 8 +++---- .../src/permissions/rules/hasAnnotation.ts | 8 +++---- .../src/permissions/rules/hasLabel.ts | 8 +++---- .../src/permissions/rules/isEntityKind.ts | 8 +++---- .../src/permissions/rules/isEntityOwner.ts | 8 +++---- .../src/service/CatalogBuilder.ts | 23 ++++++++++++++----- 8 files changed, 44 insertions(+), 29 deletions(-) create mode 100644 .changeset/hungry-chefs-relax.md diff --git a/.changeset/hungry-chefs-relax.md b/.changeset/hungry-chefs-relax.md new file mode 100644 index 0000000000..05235d4f47 --- /dev/null +++ b/.changeset/hungry-chefs-relax.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-catalog-backend': patch +--- + +Updated permission integration to use new permission resource ref. diff --git a/plugins/catalog-backend/src/permissions/conditionExports.ts b/plugins/catalog-backend/src/permissions/conditionExports.ts index c9406cdc0e..446ab1fb57 100644 --- a/plugins/catalog-backend/src/permissions/conditionExports.ts +++ b/plugins/catalog-backend/src/permissions/conditionExports.ts @@ -14,13 +14,12 @@ * limitations under the License. */ -import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha'; import { createConditionExports } from '@backstage/plugin-permission-node'; import { permissionRules } from './rules'; +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; const { conditions, createConditionalDecision } = createConditionExports({ - pluginId: 'catalog', - resourceType: RESOURCE_TYPE_CATALOG_ENTITY, + resourceRef: catalogEntityPermissionResourceRef, rules: permissionRules, }); diff --git a/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts b/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts index 73f40da8c8..d0a37802e0 100644 --- a/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts +++ b/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts @@ -14,16 +14,16 @@ * limitations under the License. */ +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; +import { createPermissionRule } from '@backstage/plugin-permission-node'; import { get } from 'lodash'; -import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha'; -import { createCatalogPermissionRule } from './util'; import { z } from 'zod'; export const createPropertyRule = (propertyType: 'metadata' | 'spec') => - createCatalogPermissionRule({ + createPermissionRule({ name: `HAS_${propertyType.toUpperCase()}`, description: `Allow entities with the specified ${propertyType} subfield`, - resourceType: RESOURCE_TYPE_CATALOG_ENTITY, + resourceRef: catalogEntityPermissionResourceRef, paramsSchema: z.object({ key: z .string() diff --git a/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts b/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts index 315d7fa8d0..32e0019715 100644 --- a/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts +++ b/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts @@ -14,9 +14,9 @@ * limitations under the License. */ -import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha'; +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; +import { createPermissionRule } from '@backstage/plugin-permission-node'; import { z } from 'zod'; -import { createCatalogPermissionRule } from './util'; /** * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which @@ -26,10 +26,10 @@ import { createCatalogPermissionRule } from './util'; * * @alpha */ -export const hasAnnotation = createCatalogPermissionRule({ +export const hasAnnotation = createPermissionRule({ name: 'HAS_ANNOTATION', description: 'Allow entities with the specified annotation', - resourceType: RESOURCE_TYPE_CATALOG_ENTITY, + resourceRef: catalogEntityPermissionResourceRef, paramsSchema: z.object({ annotation: z.string().describe('Name of the annotation to match on'), value: z diff --git a/plugins/catalog-backend/src/permissions/rules/hasLabel.ts b/plugins/catalog-backend/src/permissions/rules/hasLabel.ts index 2d6289dd26..e825b05b04 100644 --- a/plugins/catalog-backend/src/permissions/rules/hasLabel.ts +++ b/plugins/catalog-backend/src/permissions/rules/hasLabel.ts @@ -14,19 +14,19 @@ * limitations under the License. */ -import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha'; +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; +import { createPermissionRule } from '@backstage/plugin-permission-node'; import { z } from 'zod'; -import { createCatalogPermissionRule } from './util'; /** * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which * filters for entities with a specified label in its metadata. * @alpha */ -export const hasLabel = createCatalogPermissionRule({ +export const hasLabel = createPermissionRule({ name: 'HAS_LABEL', description: 'Allow entities with the specified label', - resourceType: RESOURCE_TYPE_CATALOG_ENTITY, + resourceRef: catalogEntityPermissionResourceRef, paramsSchema: z.object({ label: z.string().describe('Name of the label to match on'), }), diff --git a/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts b/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts index 568aae4838..6291692556 100644 --- a/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts +++ b/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts @@ -14,19 +14,19 @@ * limitations under the License. */ -import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha'; +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; +import { createPermissionRule } from '@backstage/plugin-permission-node'; import { z } from 'zod'; -import { createCatalogPermissionRule } from './util'; /** * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which * filters for entities with a specified kind. * @alpha */ -export const isEntityKind = createCatalogPermissionRule({ +export const isEntityKind = createPermissionRule({ name: 'IS_ENTITY_KIND', description: 'Allow entities matching a specified kind', - resourceType: RESOURCE_TYPE_CATALOG_ENTITY, + resourceRef: catalogEntityPermissionResourceRef, paramsSchema: z.object({ kinds: z .array(z.string()) diff --git a/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts b/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts index 86493315dc..de336ba966 100644 --- a/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts +++ b/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts @@ -15,9 +15,9 @@ */ import { RELATION_OWNED_BY } from '@backstage/catalog-model'; -import { RESOURCE_TYPE_CATALOG_ENTITY } from '@backstage/plugin-catalog-common/alpha'; +import { createPermissionRule } from '@backstage/plugin-permission-node'; import { z } from 'zod'; -import { createCatalogPermissionRule } from './util'; +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; /** * A catalog {@link @backstage/plugin-permission-node#PermissionRule} which @@ -25,10 +25,10 @@ import { createCatalogPermissionRule } from './util'; * * @alpha */ -export const isEntityOwner = createCatalogPermissionRule({ +export const isEntityOwner = createPermissionRule({ name: 'IS_ENTITY_OWNER', description: 'Allow entities owned by a specified claim', - resourceType: RESOURCE_TYPE_CATALOG_ENTITY, + resourceRef: catalogEntityPermissionResourceRef, paramsSchema: z.object({ claims: z .array(z.string()) diff --git a/plugins/catalog-backend/src/service/CatalogBuilder.ts b/plugins/catalog-backend/src/service/CatalogBuilder.ts index bf7f31919c..7e00d6dc62 100644 --- a/plugins/catalog-backend/src/service/CatalogBuilder.ts +++ b/plugins/catalog-backend/src/service/CatalogBuilder.ts @@ -34,7 +34,7 @@ import { import { ScmIntegrations } from '@backstage/integration'; import { createHash } from 'crypto'; import { Router } from 'express'; -import lodash, { keyBy } from 'lodash'; +import lodash from 'lodash'; import { AuditorService, @@ -118,6 +118,7 @@ import { DefaultLocationService } from './DefaultLocationService'; import { DefaultRefreshService } from './DefaultRefreshService'; import { basicEntityFilter } from './request'; import { entitiesResponseToObjects } from './response'; +import { catalogEntityPermissionResourceRef } from '@backstage/plugin-catalog-node/alpha'; /** * This is a duplicate of the alpha `CatalogPermissionRule` type, for use in the stable API. @@ -558,7 +559,13 @@ export class CatalogBuilder { const entitiesCatalog = new AuthorizedEntitiesCatalog( unauthorizedEntitiesCatalog, permissionsService, - createConditionTransformer(this.permissionRules), + permissionsRegistry + ? createConditionTransformer( + permissionsRegistry.getRuleAccessor( + catalogEntityPermissionResourceRef, + ), + ) + : createConditionTransformer(this.permissionRules), ); const catalogPermissionResource = { @@ -579,9 +586,10 @@ export class CatalogBuilder { }, }); - const entitiesByRef = keyBy( - entitiesResponseToObjects(entities), - stringifyEntityRef, + const entitiesByRef = Object.fromEntries( + entitiesResponseToObjects(entities) + .filter((x): x is Entity => Boolean(x)) + .map(entity => [stringifyEntityRef(entity), entity]), ); return resourceRefs.map( @@ -597,7 +605,10 @@ export class CatalogBuilder { | ReturnType | undefined; if (permissionsRegistry) { - permissionsRegistry.addResourceType(catalogPermissionResource); + permissionsRegistry.addResourceType({ + ...catalogPermissionResource, + resourceRef: catalogEntityPermissionResourceRef, + }); } else { permissionIntegrationRouter = createPermissionIntegrationRouter( catalogPermissionResource,