Integrate permissions into entityAncestry endpoint in catalog-backend

[Joonpark13]

Hey, I just made a Pull Request!

We call the underlying EntityCatalog's entityAncestry method from within the authorized service, and then batch authorize the resulting entities and filter out any unauthorized entities and their parents. Note: entityRefs to unauthorized parents may still appear within the returned results if the root child is authorized, but this was previously discussed as an acceptable tradeoff.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• All your commits have a Signed-off-by line in the message. (more info)

[changeset-bot]

🦋 Changeset detected

Latest commit: 48248e2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@backstage/plugin-catalog-backend	Patch
example-backend	Patch
@backstage/create-app	Patch
@backstage/plugin-catalog-backend-module-ldap	Patch
@backstage/plugin-catalog-backend-module-msgraph	Patch
@backstage/plugin-scaffolder-backend	Patch
@backstage/plugin-scaffolder-backend-module-cookiecutter	Patch
@backstage/plugin-scaffolder-backend-module-rails	Patch
@backstage/plugin-scaffolder-backend-module-yeoman	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[freben]

👍

[freben]

Could have created this set upfront once on line 100.

Should be possible to batch form a single set upfront I think?

// as a matter of fact i'm not entirely sure that there can ever exist a
// parent entity ref that is NOT already among the entities themselves
// so we may not even have to look at the parentEntityRefs here
const allRefs = lodash.uniq(
  ancestryResult.items.flatMap(item => [
    stringifyEntityRef(item.entity),
    ...item.parentEntityRefs,
  ])
);

// Batch check them all
const auth = await this.permissionApi.authorize(
  allRefs.map(item => ({
    permission: catalogEntityReadPermission,
    resourceRef: item
  })),
  { token: options?.authorizationToken },
);

const forbiddenRefs = new Set(
  allRefs.filter((_, i) => auth[i].result === AuthorizeResult.DENY)
);

Feels like after this, we'd have to first check if rootEntityRef was forbidden and then throw immediately, right?

And then filter the results by the forbidden filter, as well as their respective parent refs, in s single .filter.map chain

[Joonpark13]

The thing about this is that if one entity is denied but its parent is allowed, you'd get the parent back but not the entity itself. I'm recursing up the map in order to make sure any parents of a denied entity are not returned, regardless of whether that parent itself is allowed or not.

[freben]

Let's go!