@backstage/plugin-scaffolder-backend 1.22.8-next.0 → 1.22.8-next.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @backstage/plugin-scaffolder-backend
 
+## 1.22.8-next.1
+
+### Patch Changes
+
+- bcec60f: added the following new permissions to the scaffolder backend endpoints:
+
+  - `scaffolder.task.create`
+  - `scaffolder.task.cancel`
+  - `scaffolder.task.read`
+
+- Updated dependencies
+  - @backstage/backend-tasks@0.5.24-next.1
+  - @backstage/backend-plugin-api@0.6.19-next.1
+  - @backstage/plugin-permission-node@0.7.30-next.1
+  - @backstage/plugin-scaffolder-backend-module-gitea@0.1.9-next.1
+  - @backstage/backend-common@0.23.0-next.1
+  - @backstage/plugin-scaffolder-backend-module-gitlab@0.4.1-next.1
+  - @backstage/plugin-scaffolder-common@1.5.3-next.0
+  - @backstage/plugin-auth-node@0.4.14-next.1
+  - @backstage/plugin-catalog-backend-module-scaffolder-entity-model@0.1.17-next.1
+  - @backstage/plugin-catalog-node@1.12.1-next.0
+  - @backstage/plugin-scaffolder-backend-module-bitbucket@0.2.9-next.0
+  - @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.1.9-next.0
+  - @backstage/plugin-scaffolder-backend-module-bitbucket-server@0.1.9-next.0
+  - @backstage/plugin-scaffolder-backend-module-gerrit@0.1.11-next.0
+  - @backstage/plugin-scaffolder-backend-module-github@0.2.9-next.1
+  - @backstage/plugin-scaffolder-node@0.4.5-next.1
+
 ## 1.22.8-next.0
 
 ### Patch Changes

package/alpha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-scaffolder-backend",
-  "version": "1.22.8-next.0",
+  "version": "1.22.8-next.1",
   "main": "../dist/alpha.cjs.js",
   "types": "../dist/alpha.d.ts"
 }

package/dist/alpha.cjs.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var alpha = require('@backstage/plugin-scaffolder-common/alpha');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
-var router = require('./cjs/router-CTk9mOV8.cjs.js');
+var router = require('./cjs/router-Czj3wQrV.cjs.js');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var backendCommon = require('@backstage/backend-common');
 var integration = require('@backstage/integration');

package/dist/cjs/{router-CTk9mOV8.cjs.js → router-Czj3wQrV.cjs.js}

@@ -3158,6 +3158,24 @@ async function findTemplate(options) {
   return template;
 }
 
+async function checkPermission(options) {
+  const { permissions, permissionService, credentials } = options;
+  if (permissionService) {
+    const permissionRequest = permissions.map((permission) => ({
+      permission
+    }));
+    const authorizationResponses = await permissionService.authorize(
+      permissionRequest,
+      { credentials }
+    );
+    for (const response of authorizationResponses) {
+      if (response.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+        throw new errors.NotAllowedError();
+      }
+    }
+  }
+}
+
 function isTemplatePermissionRuleInput(permissionRule) {
   return permissionRule.resourceType === alpha.RESOURCE_TYPE_SCAFFOLDER_TEMPLATE;
 }
@@ -3349,7 +3367,8 @@ async function createRouter(options) {
         permissions: alpha.scaffolderActionPermissions,
         rules: actionRules
       }
-    ]
+    ],
+    permissions: alpha.scaffolderTaskPermissions
   });
   router.use(permissionIntegrationRouter);
   router.get(
@@ -3395,6 +3414,11 @@ async function createRouter(options) {
       defaultKind: "template"
     });
     const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskCreatePermission],
+      permissionService: permissions
+    });
     const { token } = await auth.getPluginRequestToken({
       onBehalfOf: credentials,
       targetPluginId: "catalog"
@@ -3454,6 +3478,12 @@ async function createRouter(options) {
     });
     res.status(201).json({ id: result.taskId });
   }).get("/v2/tasks", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const [userEntityRef] = [req.query.createdBy].flat();
     if (typeof userEntityRef !== "string" && typeof userEntityRef !== "undefined") {
       throw new errors.InputError("createdBy query parameter must be a string");
@@ -3468,6 +3498,12 @@ async function createRouter(options) {
     });
     res.status(200).json(tasks);
   }).get("/v2/tasks/:taskId", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     const task = await taskBroker.get(taskId);
     if (!task) {
@@ -3476,10 +3512,22 @@ async function createRouter(options) {
     delete task.secrets;
     res.status(200).json(task);
   }).post("/v2/tasks/:taskId/cancel", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskCancelPermission, alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     await taskBroker.cancel?.(taskId);
     res.status(200).json({ status: "cancelled" });
   }).get("/v2/tasks/:taskId/eventstream", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     const after = req.query.after !== void 0 ? Number(req.query.after) : void 0;
     logger.debug(`Event stream observing taskId '${taskId}' opened`);
@@ -3520,6 +3568,12 @@ data: ${JSON.stringify(event)}
       logger.debug(`Event stream observing taskId '${taskId}' closed`);
     });
   }).get("/v2/tasks/:taskId/events", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     const after = Number(req.query.after) || void 0;
     const timeout = setTimeout(() => {
@@ -3542,6 +3596,12 @@ data: ${JSON.stringify(event)}
       clearTimeout(timeout);
     });
   }).post("/v2/dry-run", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskCreatePermission],
+      permissionService: permissions
+    });
     const bodySchema = zod.z.object({
       template: zod.z.unknown(),
       values: zod.z.record(zod.z.unknown()),
@@ -3557,7 +3617,6 @@ data: ${JSON.stringify(event)}
     if (!await pluginScaffolderCommon.templateEntityV1beta3Validator.check(template)) {
       throw new errors.InputError("Input template is not a template");
     }
-    const credentials = await httpAuth.credentials(req);
     const { token } = await auth.getPluginRequestToken({
       onBehalfOf: credentials,
       targetPluginId: "catalog"
@@ -3658,4 +3717,4 @@ exports.createRouter = createRouter;
 exports.createWaitAction = createWaitAction;
 exports.scaffolderActionRules = scaffolderActionRules;
 exports.scaffolderTemplateRules = scaffolderTemplateRules;
-//# sourceMappingURL=router-CTk9mOV8.cjs.js.map
+//# sourceMappingURL=router-Czj3wQrV.cjs.js.map