@backstage/plugin-catalog-backend 0.0.0-nightly-202201323044 → 0.0.0-nightly-202201422556

package/CHANGELOG.md

@@ -1,6 +1,15 @@
 # @backstage/plugin-catalog-backend
 
-## 0.0.0-nightly-202201323044
+## 0.0.0-nightly-202201422556
+
+### Patch Changes
+
+- 68edbbeafd: Fix bug with resource loading in permission integration
+- Updated dependencies
+  - @backstage/backend-common@0.0.0-nightly-202201422556
+  - @backstage/config@0.0.0-nightly-202201422556
+
+## 0.20.0
 
 ### Minor Changes
 
@@ -12,20 +21,19 @@
 
 - 0ae759dad4: Add catalog permission rules.
 - 3b4d8caff6: Allow a custom GithubCredentialsProvider to be passed to the GitHub processors.
+- 6fd70f8bc8: Provide support for Bitbucket servers with custom BaseURLs.
 - 5333451def: Cleaned up API exports
 - 730d01ab1a: Add apply-conditions endpoint for evaluating conditional permissions in catalog backend.
+- 0a6c68582a: Add authorization to catalog-backend entities GET endpoints
 - Updated dependencies
-  - @backstage/config@0.0.0-nightly-202201323044
-  - @backstage/integration@0.0.0-nightly-202201323044
-  - @backstage/backend-common@0.0.0-nightly-202201323044
-  - @backstage/plugin-permission-node@0.0.0-nightly-202201323044
-  - @backstage/errors@0.0.0-nightly-202201323044
-  - @backstage/catalog-client@0.0.0-nightly-202201323044
-  - @backstage/catalog-model@0.0.0-nightly-202201323044
-  - @backstage/search-common@0.0.0-nightly-202201323044
-  - @backstage/types@0.0.0-nightly-202201323044
-  - @backstage/plugin-catalog-common@0.0.0-nightly-202201323044
-  - @backstage/plugin-permission-common@0.0.0-nightly-202201323044
+  - @backstage/config@0.1.12
+  - @backstage/integration@0.7.1
+  - @backstage/backend-common@0.10.3
+  - @backstage/plugin-permission-node@0.3.0
+  - @backstage/errors@0.2.0
+  - @backstage/catalog-client@0.5.4
+  - @backstage/catalog-model@0.9.9
+  - @backstage/plugin-permission-common@0.3.1
 
 ## 0.19.4
 

package/dist/index.cjs.js

@@ -22,8 +22,6 @@ var backendCommon = require('@backstage/backend-common');
 var yaml = require('yaml');
 var uuid = require('uuid');
 var knexFactory = require('knex');
-var pluginCatalogCommon = require('@backstage/plugin-catalog-common');
-var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
 var Router = require('express-promise-router');
 var yn = require('yn');
@@ -32,7 +30,9 @@ var luxon = require('luxon');
 var promClient = require('prom-client');
 var stableStringify = require('fast-json-stable-stringify');
 var catalogClient = require('@backstage/catalog-client');
+var pluginCatalogCommon = require('@backstage/plugin-catalog-common');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
+var pluginPermissionNode = require('@backstage/plugin-permission-node');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
@@ -607,12 +607,13 @@ async function readBitbucketCloud(client, target) {
 }
 function parseUrl$3(urlString) {
   const url = new URL(urlString);
-  const path = url.pathname.substr(1).split("/");
+  const indexOfProjectSegment = url.pathname.toLowerCase().indexOf("/projects/") + 1;
+  const path = url.pathname.substr(indexOfProjectSegment).split("/");
   if (path.length > 3 && path[1].length && path[3].length) {
     return {
       projectSearchPath: escapeRegExp$1(decodeURIComponent(path[1])),
       repoSearchPath: escapeRegExp$1(decodeURIComponent(path[3])),
-      catalogPath: `/${decodeURIComponent(path.slice(4).join("/"))}`
+      catalogPath: `/${decodeURIComponent(path.slice(4).join("/") + url.search)}`
     };
   }
   throw new Error(`Failed to parse ${urlString}`);
@@ -3110,7 +3111,7 @@ async function createNextRouter(options) {
     refreshService,
     config,
     logger,
-    permissionRules
+    permissionIntegrationRouter
   } = options;
   const router = Router__default["default"]();
   router.use(express__default["default"].json());
@@ -3126,16 +3127,16 @@ async function createNextRouter(options) {
       res.status(200).send();
     });
   }
+  if (permissionIntegrationRouter) {
+    router.use(permissionIntegrationRouter);
+  }
   if (entitiesCatalog) {
-    router.use(pluginPermissionNode.createPermissionIntegrationRouter({
-      resourceType: pluginCatalogCommon.RESOURCE_TYPE_CATALOG_ENTITY,
-      getResource: (resourceRef) => getEntityResource(resourceRef, entitiesCatalog),
-      rules: permissionRules != null ? permissionRules : []
-    })).get("/entities", async (req, res) => {
+    router.get("/entities", async (req, res) => {
       const { entities, pageInfo } = await entitiesCatalog.entities({
         filter: parseEntityFilterParams(req.query),
         fields: parseEntityTransformParams(req.query),
-        pagination: parseEntityPaginationParams(req.query)
+        pagination: parseEntityPaginationParams(req.query),
+        authorizationToken: getBearerToken(req.header("authorization"))
       });
       if (pageInfo.hasNextPage) {
         const url = new URL(`http://ignored${req.url}`);
@@ -3147,7 +3148,8 @@ async function createNextRouter(options) {
     }).get("/entities/by-uid/:uid", async (req, res) => {
       const { uid } = req.params;
       const { entities } = await entitiesCatalog.entities({
-        filter: basicEntityFilter({ "metadata.uid": uid })
+        filter: basicEntityFilter({ "metadata.uid": uid }),
+        authorizationToken: getBearerToken(req.header("authorization"))
       });
       if (!entities.length) {
         throw new errors.NotFoundError(`No entity with uid ${uid}`);
@@ -3164,7 +3166,8 @@ async function createNextRouter(options) {
           kind,
           "metadata.namespace": namespace,
           "metadata.name": name
-        })
+        }),
+        authorizationToken: getBearerToken(req.header("authorization"))
       });
       if (!entities.length) {
         throw new errors.NotFoundError(`No entity named '${name}' found, with kind '${kind}' in namespace '${namespace}'`);
@@ -3210,17 +3213,6 @@ async function createNextRouter(options) {
   router.use(backendCommon.errorHandler());
   return router;
 }
-async function getEntityResource(resourceRef, entitiesCatalog) {
-  const parsed = catalogModel.parseEntityRef(resourceRef);
-  const { entities } = await entitiesCatalog.entities({
-    filter: basicEntityFilter({
-      kind: parsed.kind,
-      "metadata.namespace": parsed.namespace,
-      "metadata.name": parsed.name
-    })
-  });
-  return entities[0];
-}
 function getBearerToken(authorizationHeader) {
   if (typeof authorizationHeader !== "string") {
     return void 0;
@@ -5042,6 +5034,37 @@ const permissionRules = {
   isEntityOwner
 };
 
+class AuthorizedEntitiesCatalog {
+  constructor(entitiesCatalog, permissionApi, transformConditions) {
+    this.entitiesCatalog = entitiesCatalog;
+    this.permissionApi = permissionApi;
+    this.transformConditions = transformConditions;
+  }
+  async entities(request) {
+    const authorizeResponse = (await this.permissionApi.authorize([{ permission: pluginCatalogCommon.catalogEntityReadPermission }], { token: request == null ? void 0 : request.authorizationToken }))[0];
+    if (authorizeResponse.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+      return {
+        entities: [],
+        pageInfo: { hasNextPage: false }
+      };
+    }
+    if (authorizeResponse.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
+      const permissionFilter = this.transformConditions(authorizeResponse.conditions);
+      return this.entitiesCatalog.entities({
+        ...request,
+        filter: (request == null ? void 0 : request.filter) ? { allOf: [permissionFilter, request.filter] } : permissionFilter
+      });
+    }
+    return this.entitiesCatalog.entities(request);
+  }
+  removeEntityByUid(uid) {
+    return this.entitiesCatalog.removeEntityByUid(uid);
+  }
+  entityAncestry(entityRef) {
+    return this.entitiesCatalog.entityAncestry(entityRef);
+  }
+}
+
 class NextCatalogBuilder {
   constructor(env) {
     this.refreshInterval = createRandomRefreshInterval({
@@ -5161,7 +5184,28 @@ class NextCatalogBuilder {
       parser,
       policy
     });
-    const entitiesCatalog = new NextEntitiesCatalog(dbClient);
+    const unauthorizedEntitiesCatalog = new NextEntitiesCatalog(dbClient);
+    const entitiesCatalog = new AuthorizedEntitiesCatalog(unauthorizedEntitiesCatalog, permissions, pluginPermissionNode.createConditionTransformer(this.permissionRules));
+    const permissionIntegrationRouter = pluginPermissionNode.createPermissionIntegrationRouter({
+      resourceType: pluginCatalogCommon.RESOURCE_TYPE_CATALOG_ENTITY,
+      getResources: async (resourceRefs) => {
+        const { entities } = await unauthorizedEntitiesCatalog.entities({
+          filter: {
+            anyOf: resourceRefs.map((resourceRef) => {
+              const { kind, namespace, name } = catalogModel.parseEntityRef(resourceRef);
+              return basicEntityFilter({
+                kind,
+                "metadata.namespace": namespace,
+                "metadata.name": name
+              });
+            })
+          }
+        });
+        const entitiesByRef = lodash.keyBy(entities, catalogModel.stringifyEntityRef);
+        return resourceRefs.map((resourceRef) => entitiesByRef[catalogModel.stringifyEntityRef(catalogModel.parseEntityRef(resourceRef))]);
+      },
+      rules: this.permissionRules
+    });
     const stitcher = new Stitcher(dbClient, logger);
     const locationStore = new DefaultLocationStore(dbClient);
     const configLocationProvider = new ConfigLocationEntityProvider(config);
@@ -5178,7 +5222,7 @@ class NextCatalogBuilder {
       refreshService,
       logger,
       config,
-      permissionRules: this.permissionRules
+      permissionIntegrationRouter
     });
     await connectEntityProviders(processingDatabase, entityProviders);
     return {