The Postgres unnest UPDATE uses a fixed-size SQL string; only the array
bindings grow. The planner executes it with an index nested-loop (O(N)),
so batching only adds network round trips without reducing work. Run the
entire backfill in a single statement.
MySQL keeps its MYSQL_BATCH_SIZE=1000 because the UNION ALL SQL text
grows linearly with batch size, so smaller packets are important there.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Switch the migration column type from text to string (varchar(255)),
since entity refs are always short. Also use stringifyEntityRef in
computeLocationEntityRef to handle lowercasing canonically.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Adds a migration that populates a new `location_entity_ref` column on the
`locations` table with the full entity ref of the corresponding
`kind: Location` entity (e.g. `location:default/generated-<sha1hex>`).
Postgres uses an unnest-based batch UPDATE; other engines use a
transaction-wrapped per-row loop.
All code paths in DefaultLocationStore that previously recomputed the hash
from type+target now read `location_entity_ref` directly from the DB row
instead. New rows written by `createLocation` and `#createLocationsByExactUrl`
have the column populated at insert time.
This is step 1 of migrating Location entity names to be based on the stable
row UUID rather than a hash of the mutable target URL.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Replace hand-crafted BackstageCredentials objects with mockCredentials
from @backstage/backend-test-utils, which have proper toString() methods.
Simplify getCacheKey to use String(credentials) directly and remove the
auth service dependency from CachedEntityLoader.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Update links to removed how-to-guides anchors (#how-to-index-techdocs-documents
and #how-to-limit-what-can-be-searched-in-the-software-catalog) to point to the
existing #how-to-customize-fields-in-the-software-catalog-or-techdocs-index
anchor instead. Also update the old frontend system guide to link to the
--old variants of how-to-guides.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Replace `Promise.resolve(...)` with `async` functions in scaffolder
FormFieldBlueprint.make examples, and switch the TechDocs custom home
page example to use the `plugin.withOverrides` pattern instead of
`createFrontendModule`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Reflect the currently selected action in the URL hash so that users can
deep-link to a specific action on the actions page. On load the hash is
read to pre-select and scroll to the matching action.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Move getOwnServiceCredentials() before the pagination loop in DefaultTechDocsCollatorFactory
- Fix stale test comment that referenced the deleted MSW /entities handler
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Migrated `@backstage/plugin-techdocs-backend` and
`@backstage/plugin-search-backend-module-techdocs` to use the stable
`catalogServiceRef` from `@backstage/plugin-catalog-node` instead of
the deprecated one from `@backstage/plugin-catalog-node/alpha`.
This also updates `CachedEntityLoader`, `DefaultTechDocsCollatorFactory`,
and the TechDocs router to use `CatalogService` (credentials-based) instead
of `CatalogApi` (token-based).
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Remove the deprecated alpha exports CatalogPermissionRuleInput,
CatalogPermissionExtensionPoint, and catalogPermissionExtensionPoint
from catalog-node, and remove the corresponding CatalogPermissionExtensionPointImpl,
addPermissions, and addPermissionRules from catalog-backend. Custom permission
rules and permissions are now registered via coreServices.permissionsRegistry.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Adds a new `Badge` component to the Backstage UI library. Badge shares the same visual appearance as `Tag` (size tokens, colors, border radius, icon slot) but renders as a plain non-interactive `<span>` with no React Aria plumbing.
Key characteristics:
- Plain DOM element — accessible text content exposed to screen readers without any role override
- Background consumer — participates in the bg context system and steps up neutral background levels (`neutral-2` → `neutral-3` → `neutral-4`) when placed inside colored containers
- Supports `icon`, `size` (`small` | `medium`, defaults to `small`), `children`, and `className` props
- Fully themeable via `BadgeDefinition`
Also includes Storybook stories and full docs-ui documentation (props table, examples, theming section, changelog).
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
When a Backstage notification is re-sent with the same scope, the
notifications backend updates the existing DB record and sets
notification.updated. Previously, the SlackNotificationProcessor always
called chat.postMessage(), creating duplicate Slack messages.
This adds database-backed scope-based update support:
- New slack_message_timestamps table to persist Slack message ts values
keyed by (scope, channel)
- After each chat.postMessage(), store the response ts in the database
- When postProcess receives a notification with updated set and a
matching stored ts, use chat.update() instead of chat.postMessage()
- Scope context is passed as parameters through the call chain to avoid
race conditions with concurrent postProcess calls
- Scheduled daily cleanup of old timestamp records (24h retention)
- New messagesUpdated metrics counter for observability
- Graceful degradation when no database is provided
- Explicitly picks only supported fields for chat.update calls
Signed-off-by: Erik Miller <erik.miller@gusto.com>
* verify-links: catch broken anchors, directory links, and invisible characters
Enhances the link verification script to catch several categories of
broken links that were previously missed:
- Broken anchors (cross-file and same-file) by extracting heading slugs
from target documents and verifying anchors resolve
- Directory links missing index.md suffix within docs/
- Invisible/zero-width characters in URLs
- Case-sensitive anchor mismatches
Also strips fenced code blocks before scanning for links to avoid false
positives, and handles duplicate heading slug deduplication (GitHub and
Docusaurus append -1, -2, etc.).
Fixes a few newly-caught broken links in existing docs.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* Fix CodeQL incomplete multi-character sanitization alert
Apply HTML tag stripping in a loop so that nested fragments
like <scr<script>ipt> are fully removed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
---------
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Make `permissionsRegistry` required and `permissions` always a
`PermissionsService` in `CatalogEnvironment`. Remove the deprecated
`PermissionAuthorizer` fallback path and the `createPermissionIntegrationRouter`
fallback — catalog now exclusively uses `permissionsRegistry.addResourceType`
to register its permission resource type.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Adds startup warnings to HostDiscovery.fromConfig when backend.baseUrl
is set to a localhost address in a production environment, or when the
value is not a valid URL at all.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
The `toError` utility now converts thrown strings to proper `Error`
objects, changing the cause message format from `unknown error 'boom'`
to `Error: boom`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Remove JSON.stringify fallback from toError, use the same unknown
error messaging as stringifyError for all non-string/non-error values
- Add try/catch to protect against values that throw on string
conversion (e.g. null-prototype objects, symbols)
- Fix no-op `void toError(err)` in DeleteEntityConfirmationDialog
- Fix `${err}` producing [object Object] in UrlReaderProcessor
- Fix double toError call in openStackSwift
- Update JSDoc to accurately describe the behavior
- Add tests for throwing toString and circular objects
- Add changeset for all refactored packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fredrik Adelöw