From f8de73808863e43c29f8b2bec1334a51d06cb2cf Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Tue, 15 Apr 2025 14:24:24 +0200
Subject: [PATCH] permission: validate actor when applying conditions

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../permissionsRegistryServiceFactory.ts      | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts b/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts
index 7ff6eabf03..f599c4906a 100644
--- a/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts
+++ b/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts
@@ -23,6 +23,8 @@ import {
   PermissionResourceRef,
   createPermissionIntegrationRouter,
 } from '@backstage/plugin-permission-node';
+import { NotAllowedError } from '@backstage/errors';
+import Router from 'express-promise-router';
 
 function assertRefPluginId(ref: PermissionResourceRef, pluginId: string) {
   if (ref.pluginId !== pluginId) {
@@ -44,14 +46,34 @@ function assertRefPluginId(ref: PermissionResourceRef, pluginId: string) {
 export const permissionsRegistryServiceFactory = createServiceFactory({
   service: coreServices.permissionsRegistry,
   deps: {
+    auth: coreServices.auth,
+    httpAuth: coreServices.httpAuth,
     lifecycle: coreServices.lifecycle,
     httpRouter: coreServices.httpRouter,
     pluginMetadata: coreServices.pluginMetadata,
   },
-  async factory({ httpRouter, lifecycle, pluginMetadata }) {
+  async factory({ auth, httpAuth, httpRouter, lifecycle, pluginMetadata }) {
     const router = createPermissionIntegrationRouter();
+
     const pluginId = pluginMetadata.getId();
 
+    const applyConditionMiddleware = Router();
+    applyConditionMiddleware.use(
+      '/.well-known/backstage/permissions/apply-conditions',
+      async (req, _res, next) => {
+        const credentials = await httpAuth.credentials(req, {
+          allow: ['user', 'service'],
+        });
+        if (
+          auth.isPrincipal(credentials, 'user') &&
+          !credentials.principal.actor
+        ) {
+          throw new NotAllowedError();
+        }
+        next();
+      },
+    );
+    httpRouter.use(applyConditionMiddleware);
     httpRouter.use(router);
 
     let started = false;