backstage / backstage

Backstage is an open framework for building developer portals
https://backstage.io/
Apache License 2.0
26.89k stars 5.58k forks source link

Implement the access restrictions feature of external access service tokens #24702

Closed freben closed 3 weeks ago

freben commented 1 month ago

As part of BEP-0007.

The config format is a little different from the internal names of things, for convenience. Open to suggestions here.

I put it as a visible type on the service principal, even though I really originally intended for it to be hidden on the internal credential type instead. This would let us iterate more easily on it in secrecy. But reaching that field becomes cumbersome since the types involved are only in backend-app-api, but need to be consumed from plugin-permission-node. In the end, I decided to hope that these interfaces are stable enough, that there isn't significant risk in setting this in stone in backend-plugin-api. Again, feedback is welcome.

Another potential middle ground could be to make the scope type something semi opaque like Record<string, string[]> and have different subsystems use keys in that as they see fit.

Regard this as being up for early review, as I'm away for a little bit now.

backstage-goalie[bot] commented 1 month ago

Changed Packages

Package Name Package Path Changeset Bump Current Version
@backstage/backend-app-api packages/backend-app-api patch v0.7.6-next.0
@backstage/backend-plugin-api packages/backend-plugin-api patch v0.6.19-next.0
@backstage/backend-test-utils packages/backend-test-utils patch v0.3.9-next.0
@backstage/plugin-permission-node plugins/permission-node patch v0.7.30-next.0
github-actions[bot] commented 3 weeks ago

Thank you for contributing to Backstage! The changes in this pull request will be part of the 1.28.0 release, scheduled for Tue, 18 Jun 2024.

github-actions[bot] commented 3 weeks ago

Uffizzi Cluster pr-24702 was deleted.