feat(scaffolder): add permission for template management features #26946

stephenglass · 2024-10-03T03:21:36Z

Hey, I just made a Pull Request!

I have a need to disable the template management features (dry runner, playground, field explorer, etc). I've found in the Backstage Discord there are others with this same ask as well.

This PR adds a new permission that can be used to disable the template management routes and the "Manage Templates" option from appearing in the scaffolder page context menu.

✔️ Checklist

A changeset describing the change and affected packages. (more info)
Added or updated documentation
Tests for new functionality and regression tests for bug fixes
Screenshots attached (for UI changes)
All your commits have a Signed-off-by line in the message. (more info)

backstage-goalie · 2024-10-03T03:22:04Z

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage/plugin-scaffolder-common	plugins/scaffolder-common	patch	`v1.5.6`
@backstage/plugin-scaffolder-react	plugins/scaffolder-react	patch	`v1.13.3-next.2`
@backstage/plugin-scaffolder	plugins/scaffolder	minor	`v1.26.3-next.2`

Signed-off-by: Stephen Glass <stephen@stephen.glass>

benjdlambert · 2024-10-07T06:36:40Z

@stephenglass thanks for raising this PR!

I think that this is one of many improvement PR's that have been raised over the last few weeks with regards to permissions.

My concern with all of those permission PR's is that they're released in a way that they're not backwards compatible as theres no default policy option for new permissions, so users if using permissions will lose functionality like this until they implement the permissions necessary.

I really want to try and push through us coming up with a fix for providing default policy responses like ALLOW instead of them being DENY so that we can ship these safely without breaking functionality for end users.

Me and @Rugvip spoke about this last week, and thinking that we might get some chance to fix that up this week, so if you don't mind I'd like to get that in before proceeding with this and #25969 and #26947 🙏

vinzscam · 2024-10-11T10:31:52Z

@stephenglass thanks for raising this PR!

I think that this is one of many improvement PR's that have been raised over the last few weeks with regards to permissions.

My concern with all of those permission PR's is that they're released in a way that they're not backwards compatible as theres no default policy option for new permissions, so users if using permissions will lose functionality like this until they implement the permissions necessary.

I really want to try and push through us coming up with a fix for providing default policy responses like ALLOW instead of them being DENY so that we can ship these safely without breaking functionality for end users.

Me and @Rugvip spoke about this last week, and thinking that we might get some chance to fix that up this week, so if you don't mind I'd like to get that in before proceeding with this and #25969 and #26947 🙏

mmm I don't think this is a concern as the recommendation is to ALLOW unknown permissions and this is usually the pattern that people take. So in this case, people won't loose functionalities if a new permission is added.

...scaffolder-react/src/next/components/ScaffolderPageContextMenu/ScaffolderPageContextMenu.tsx

Signed-off-by: Stephen Glass <stephen@stephen.glass>

stephenglass · 2024-10-14T18:39:41Z

Added templateManagementPermission permission check to the /v2/dry-run endpoint since IMO it makes sense if the only way you can call the endpoint via the UI is using the template dry runner, which is being protected under the same permission check.

acierto · 2024-10-19T08:14:36Z

Hey @stephenglass 👋

Can you please solve conflicts?

…scaffolder-permission-manage1 Signed-off-by: Stephen Glass <stephen@stephen.glass>

stephenglass · 2024-10-19T20:42:36Z

Hey @stephenglass 👋

Can you please solve conflicts?

@acierto Done! Thanks!

vinzscam · 2024-10-23T11:53:25Z

plugins/scaffolder-backend/src/service/router.ts

@@ -766,7 +767,7 @@ export async function createRouter(
      const credentials = await httpAuth.credentials(req);
      await checkPermission({
        credentials,
-        permissions: [taskCreatePermission],
+        permissions: [taskCreatePermission, templateManagementPermission],


let's keep the two concept separated as you suggested!

Suggested change

permissions: [taskCreatePermission, templateManagementPermission],

permissions: [taskCreatePermission],

vinzscam · 2024-10-23T11:54:52Z

.changeset/lemon-gifts-crash.md

+---
+'@backstage/plugin-scaffolder-common': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder-backend': patch


then this one should go away if we don't make any changes to scaffolder-backend

Suggested change

'@backstage/plugin-scaffolder-backend': patch

vinzscam · 2024-10-23T11:55:25Z

.changeset/lemon-gifts-crash.md

+'@backstage/plugin-scaffolder-common': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/plugin-scaffolder': patch


@acierto would this be a minor then? 🤔

Suggested change

'@backstage/plugin-scaffolder': patch

'@backstage/plugin-scaffolder': minor

Signed-off-by: Stephen Glass <stephen@stephen.glass>

stephenglass · 2024-10-28T20:24:55Z

@vinzscam I've addressed the comments 👍

plugins/scaffolder-common/src/permissions.ts

Co-authored-by: Vincenzo Scamporlino <vincenzos@spotify.com> Signed-off-by: Stephen Glass <stephen@stephen.glass>

Signed-off-by: Stephen Glass <stephen@stephen.glass>

vinzscam

🚀

benjdlambert

Thanks @stephenglass! 🎉

github-actions · 2024-11-07T15:35:53Z

Thank you for contributing to Backstage! The changes in this pull request will be part of the 1.33.0 release, scheduled for Tue, 19 Nov 2024.

awanlin · 2024-11-07T16:24:31Z

Hi @stephenglass, a little late here but any chance you could submit a follow up PR with some documentation around the new permissions, please? This isn't a great spot for them but for now it's the one that makes the most sense to me: https://backstage.io/docs/features/software-templates/authorizing-scaffolder-template-details

stephenglass requested review from a team as code owners October 3, 2024 03:21

stephenglass requested review from Rugvip, camilaibs and acierto October 3, 2024 03:21

github-actions bot added the area:scaffolder Everything and all things related to the scaffolder project area label Oct 3, 2024

add scaffolder permission for template management

f61d4cc

Signed-off-by: Stephen Glass <stephen@stephen.glass>

stephenglass force-pushed the scaffolder-permission-manage1 branch from cab58a3 to f61d4cc Compare October 7, 2024 00:19

This was referenced Oct 7, 2024

Granular scaffolder permissions #25969

Closed

🚀 Feature: Make current task id available as a variable in templates #25553

Closed

vinzscam requested changes Oct 11, 2024

View reviewed changes

...scaffolder-react/src/next/components/ScaffolderPageContextMenu/ScaffolderPageContextMenu.tsx Show resolved Hide resolved

stephenglass added 2 commits October 14, 2024 14:30

add template management permission check to dry run endpoint

15a6a96

Signed-off-by: Stephen Glass <stephen@stephen.glass>

fix changeset

a3b10fa

Signed-off-by: Stephen Glass <stephen@stephen.glass>

Merge branch 'master' of https://github.com/backstage/backstage into …

d8fe965

…scaffolder-permission-manage1 Signed-off-by: Stephen Glass <stephen@stephen.glass>

vinzscam reviewed Oct 23, 2024

View reviewed changes

address comments

db507dd

Signed-off-by: Stephen Glass <stephen@stephen.glass>

vinzscam requested changes Nov 6, 2024

View reviewed changes

plugins/scaffolder-common/src/permissions.ts Outdated Show resolved Hide resolved

plugins/scaffolder-common/src/permissions.ts Outdated Show resolved Hide resolved

stephenglass and others added 2 commits November 6, 2024 15:45

Apply suggestions from code review

28e222b

Co-authored-by: Vincenzo Scamporlino <vincenzos@spotify.com> Signed-off-by: Stephen Glass <stephen@stephen.glass>

Update report-alpha.api.md

71bb422

Signed-off-by: Stephen Glass <stephen@stephen.glass>

vinzscam approved these changes Nov 6, 2024

View reviewed changes

benjdlambert approved these changes Nov 7, 2024

View reviewed changes

benjdlambert merged commit f969062 into backstage:master Nov 7, 2024
24 checks passed

apc-kamezaki mentioned this pull request Nov 8, 2024

add new definition for 'scaffolder.template.management' ap-communications/platt-policy-template#17

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(scaffolder): add permission for template management features #26946

feat(scaffolder): add permission for template management features #26946

stephenglass commented Oct 3, 2024 •

edited

Loading

backstage-goalie bot commented Oct 3, 2024 •

edited

Loading

benjdlambert commented Oct 7, 2024 •

edited

Loading

vinzscam commented Oct 11, 2024

stephenglass commented Oct 14, 2024

acierto commented Oct 19, 2024

stephenglass commented Oct 19, 2024

vinzscam Oct 23, 2024

vinzscam Oct 23, 2024

vinzscam Oct 23, 2024

stephenglass commented Oct 28, 2024

vinzscam left a comment

benjdlambert left a comment

github-actions bot commented Nov 7, 2024

awanlin commented Nov 7, 2024

	permissions: [taskCreatePermission, templateManagementPermission],
	permissions: [taskCreatePermission],

	'@backstage/plugin-scaffolder': patch
	'@backstage/plugin-scaffolder': minor

feat(scaffolder): add permission for template management features #26946

feat(scaffolder): add permission for template management features #26946

Conversation

stephenglass commented Oct 3, 2024 • edited Loading

Hey, I just made a Pull Request!

✔️ Checklist

backstage-goalie bot commented Oct 3, 2024 • edited Loading

Changed Packages

benjdlambert commented Oct 7, 2024 • edited Loading

vinzscam commented Oct 11, 2024

stephenglass commented Oct 14, 2024

acierto commented Oct 19, 2024

stephenglass commented Oct 19, 2024

vinzscam Oct 23, 2024

Choose a reason for hiding this comment

vinzscam Oct 23, 2024

Choose a reason for hiding this comment

vinzscam Oct 23, 2024

Choose a reason for hiding this comment

stephenglass commented Oct 28, 2024

vinzscam left a comment

Choose a reason for hiding this comment

benjdlambert left a comment

Choose a reason for hiding this comment

github-actions bot commented Nov 7, 2024

awanlin commented Nov 7, 2024

stephenglass commented Oct 3, 2024 •

edited

Loading

backstage-goalie bot commented Oct 3, 2024 •

edited

Loading

benjdlambert commented Oct 7, 2024 •

edited

Loading