permission-node: update policy handler to work with new auth system

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

plugins/permission-backend-module-policy-allow-all/src/policy.ts

@@ -14,7 +14,6 @@
  * limitations under the License.
  */
 
-import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
 import {
   AuthorizeResult,
   PolicyDecision,
@@ -22,12 +21,13 @@ import {
 import {
   PermissionPolicy,
   PolicyQuery,
+  PolicyQueryUser,
 } from '@backstage/plugin-permission-node';
 
 export class AllowAllPermissionPolicy implements PermissionPolicy {
   async handle(
     _request: PolicyQuery,
-    _user?: BackstageIdentityResponse,
+    _user?: PolicyQueryUser,
   ): Promise<PolicyDecision> {
     return {
       result: AuthorizeResult.ALLOW,

plugins/permission-backend/src/service/router.test.ts

@@ -186,6 +186,13 @@ describe('createRouter', () => {
               mockCredentials.user().principal.userEntityRef,
             ],
           },
+          info: {
+            userEntityRef: mockCredentials.user().principal.userEntityRef,
+            ownershipEntityRefs: [
+              mockCredentials.user().principal.userEntityRef,
+            ],
+          },
+          credentials: mockCredentials.user(),
         },
       );
       expect(response.body).toEqual({

plugins/permission-backend/src/service/router.ts

@@ -22,10 +22,7 @@ import {
   errorHandler,
 } from '@backstage/backend-common';
 import { InputError } from '@backstage/errors';
-import {
-  BackstageIdentityResponse,
-  IdentityApi,
-} from '@backstage/plugin-auth-node';
+import { IdentityApi } from '@backstage/plugin-auth-node';
 import {
   AuthorizeResult,
   EvaluatePermissionRequest,
@@ -40,6 +37,7 @@ import {
   ApplyConditionsRequestEntry,
   ApplyConditionsResponseEntry,
   PermissionPolicy,
+  PolicyQueryUser,
 } from '@backstage/plugin-permission-node';
 import { PermissionIntegrationClient } from './PermissionIntegrationClient';
 import { memoize } from 'lodash';
@@ -130,9 +128,9 @@ const handleRequest = async (
     );
   });
 
-  let user: BackstageIdentityResponse | undefined;
+  let user: PolicyQueryUser | undefined;
   if (auth.isPrincipal(credentials, 'user')) {
-    const { ownershipEntityRefs } = await userInfo.getUserInfo(credentials);
+    const info = await userInfo.getUserInfo(credentials);
     const { token } = await auth.getPluginRequestToken({
       onBehalfOf: credentials,
       targetPluginId: 'catalog', // TODO: unknown at this point
@@ -141,9 +139,11 @@ const handleRequest = async (
       identity: {
         type: 'user',
         userEntityRef: credentials.principal.userEntityRef,
-        ownershipEntityRefs,
+        ownershipEntityRefs: info.ownershipEntityRefs,
       },
       token,
+      credentials,
+      info,
     };
   }
 

plugins/permission-node/api-report.md

@@ -8,7 +8,9 @@ import { AnyOfCriteria } from '@backstage/plugin-permission-common';
 import { AuthorizePermissionRequest } from '@backstage/plugin-permission-common';
 import { AuthorizePermissionResponse } from '@backstage/plugin-permission-common';
 import { AuthService } from '@backstage/backend-plugin-api';
-import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
+import { BackstageCredentials } from '@backstage/backend-plugin-api';
+import { BackstageUserIdentity } from '@backstage/plugin-auth-node';
+import { BackstageUserInfo } from '@backstage/backend-plugin-api';
 import { ConditionalPolicyDecision } from '@backstage/plugin-permission-common';
 import { Config } from '@backstage/config';
 import { DefinitivePolicyDecision } from '@backstage/plugin-permission-common';
@@ -246,10 +248,7 @@ export type PermissionIntegrationRouterOptions<
 // @public
 export interface PermissionPolicy {
   // (undocumented)
-  handle(
-    request: PolicyQuery,
-    user?: BackstageIdentityResponse,
-  ): Promise<PolicyDecision>;
+  handle(request: PolicyQuery, user?: PolicyQueryUser): Promise<PolicyDecision>;
 }
 
 // @public
@@ -272,6 +271,15 @@ export type PolicyQuery = {
   permission: Permission;
 };
 
+// @public
+export type PolicyQueryUser = {
+  token: string;
+  expiresInSeconds?: number;
+  identity: BackstageUserIdentity;
+  credentials: BackstageCredentials;
+  info: BackstageUserInfo;
+};
+
 // @public
 export class ServerPermissionClient implements PermissionsService {
   // (undocumented)

plugins/permission-node/src/policy/index.ts

@@ -14,4 +14,4 @@
  * limitations under the License.
  */
 
-export type { PermissionPolicy, PolicyQuery } from './types';
+export type { PermissionPolicy, PolicyQuery, PolicyQueryUser } from './types';

plugins/permission-node/src/policy/types.ts

@@ -18,7 +18,11 @@ import {
   Permission,
   PolicyDecision,
 } from '@backstage/plugin-permission-common';
-import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
+import { BackstageUserIdentity } from '@backstage/plugin-auth-node';
+import {
+  BackstageCredentials,
+  BackstageUserInfo,
+} from '@backstage/backend-plugin-api';
 
 /**
  * A query to be evaluated by the {@link PermissionPolicy}.
@@ -34,6 +38,44 @@ export type PolicyQuery = {
   permission: Permission;
 };
 
+/**
+ * The context within which a policy query is evaluated.
+ *
+ * @public
+ */
+export type PolicyQueryUser = {
+  /**
+   * The token used to authenticate the user within Backstage.
+   *
+   * @deprecated User the `credentials` field in combination with `coreServices.auth` to generate a request token instead.
+   */
+  token: string;
+
+  /**
+   * The number of seconds until the token expires. If not set, it can be assumed that the token does not expire.
+   *
+   * @deprecated This field is deprecated and will be removed in a future release.
+   */
+  expiresInSeconds?: number;
+
+  /**
+   * A plaintext description of the identity that is encapsulated within the token.
+   *
+   * @deprecated Use the `info` field instead.
+   */
+  identity: BackstageUserIdentity;
+
+  /**
+   * The credentials of the user making the request.
+   */
+  credentials: BackstageCredentials;
+
+  /**
+   * The information for the user making the request.
+   */
+  info: BackstageUserInfo;
+};
+
 /**
  * A policy to evaluate authorization requests for any permissioned action performed in Backstage.
  *
@@ -51,8 +93,5 @@ export type PolicyQuery = {
  * @public
  */
 export interface PermissionPolicy {
-  handle(
-    request: PolicyQuery,
-    user?: BackstageIdentityResponse,
-  ): Promise<PolicyDecision>;
+  handle(request: PolicyQuery, user?: PolicyQueryUser): Promise<PolicyDecision>;
 }