Remove hasTemplateEntityRefs and only keep hasCreatedBy

Signed-off-by: Kashish Mittal <kmittal@redhat.com>

docs/features/software-templates/authorizing-scaffolder-template-details.md

@@ -176,7 +176,7 @@ class ExamplePermissionPolicy implements PermissionPolicy {
 
 ### Authorizing scaffolder tasks
 
-The scaffolder plugin also exposes permissions that can restrict access to tasks, task logs, task creation, and task cancellation. This can be useful if you want to control who has access to these areas of the scaffolder. You can configure policies to restrict access to tasks to only their creators, while also granting specific users the permission to view all tasks. Additionally, template owners can be granted permissions to view all runs of their templates.
+The scaffolder plugin also exposes permissions that can restrict access to tasks, task logs, task creation, and task cancellation. This can be useful if you want to control who has access to these areas of the scaffolder. You can configure policies to restrict access to tasks to only their creators, while also granting specific users the permission to view all tasks.
 
 The following is a simple example of how to do this:
 
@@ -201,35 +201,9 @@ import {
   createScaffolderTaskConditionalDecision,
   scaffolderTaskConditions,
 } from '@backstage/plugin-scaffolder-backend/alpha';
-import { CatalogClient } from '@backstage/catalog-client';
 /* highlight-add-end */
 
 class ExamplePermissionPolicy implements PermissionPolicy {
-  private readonly catalogClient: CatalogClient;
-
-  constructor(catalogClient: CatalogClient) {
-    this.catalogClient = catalogClient;
-  }
-
-  // Fetches all templates owned by the user from the catalog API.
-  async getUserOwnedTemplates(userRef: string): Promise<string[]> {
-    if (!userRef) return [];
-
-    const response = await this.catalogClient.getEntities({
-      filter: {
-        kind: ['Template'],
-        'relations.ownedBy': [userRef],
-      },
-    });
-
-    return response.items.map(
-      item =>
-        `${item.kind.toLocaleLowerCase()}:${item.metadata.namespace}/${
-          item.metadata.name
-        }`,
-    );
-  }
-
   async handle(
     request: PolicyQuery,
     user?: PolicyQueryUser,
@@ -243,24 +217,13 @@ class ExamplePermissionPolicy implements PermissionPolicy {
         };
       }
 
-      // Retrieve templates that the user owns
-      const userOwnedTemplates = await this.getUserOwnedTemplates(
-        user?.info.userEntityRef || '',
+      // Allow users to read tasks they created
+      return createScaffolderTaskConditionalDecision(
+        request.permission,
+        scaffolderTaskConditions.hasCreatedBy({
+          createdBy: user?.info.userEntityRef ? [user?.info.userEntityRef] : [],
+        }),
       );
-
-      // Allow users to read tasks they created or task runs of templates they own
-      return createScaffolderTaskConditionalDecision(request.permission, {
-        anyOf: [
-          scaffolderTaskConditions.hasCreatedBy({
-            createdBy: user?.info.userEntityRef
-              ? [user?.info.userEntityRef]
-              : [],
-          }),
-          scaffolderTaskConditions.hasTemplateEntityRefs({
-            templateEntityRefs: userOwnedTemplates,
-          }),
-        ],
-      });
     }
 
     if (isPermission(request.permission, taskCreatePermission)) {
@@ -311,7 +274,6 @@ class ExamplePermissionPolicy implements PermissionPolicy {
 In the provided example permission policy, we only grant the user `bob` permissions to perform/access the following actions/resources:
 
 - Read scaffolder tasks and their associated events/logs for tasks created by `bob`.
-- Read scaffolder task runs of templates owned by `bob`
 - Cancel ongoing scaffolder tasks created by `bob`.
 - Trigger software templates, which effectively creates new scaffolder tasks.
 
@@ -324,7 +286,6 @@ On the other hand, the user `alice` is granted:
 All other users are granted permissions to perform/access the following actions/resources:
 
 - Read scaffolder tasks and their associated events/logs for tasks created by the user.
-- Read scaffolder task runs of the templates owned by the user
 
 Although the rules exported by the scaffolder are simple, combining them can help you achieve more complex use cases.