feat(extensions): Add extension permissions by debsmita1 · Pull Request #691 · redhat-developer/rhdh-plugins

debsmita1 · 2025-04-24T18:56:39Z

Hey, I just made a Pull Request!

Resolves:

https://issues.redhat.com/browse/RHIDP-6766

How to test:

Install rbac frontend and backend plugins
Add the Github signin page
Add the following in you rbac-policy.csv file

p, role:default/admins, extension-plugin, read, allow
p, role:default/admins, extension-plugin, create, allow

Add the following to your app-config.yaml

permission:
  enabled: true
  rbac:
    pluginsWithPermission:
      - marketplace
      - catalog
      - permission
    policies-csv-file: <path-to-your-csv-file>/rbac-policy.csv
    policyFileReload: true
    admin:
      users:
        - name: user:default/<github-id>
        - name: group:default/admins

Screenshots/GIF:

User with no config read permission

User with only config read permission

Screen.Recording.2025-04-30.at.4.43.57.PM.mov

User with both read and create permissions

Screen.Recording.2025-04-28.at.9.51.56.PM.mov

User with conditional permissions

Screen.Recording.2025-04-28.at.9.53.22.PM.mov

TODO (to be addressed in separate PRs):

Update RBAC documentation to include the newly added Extensions permissions
Update Extensions frontend plugin readme to include the policies to be added when the Permission framework is enabled

✔️ Checklist

A changeset describing the change and affected packages. (more info)
Added or Updated documentation
Tests for new functionality and regression tests for bug fixes
Screenshots attached (for UI changes)

rhdh-gh-app · 2025-04-24T18:57:00Z

Important

This PR includes changes that affect public-facing API. Please ensure you are adding/updating documentation for new features or behavior.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-marketplace-backend	workspaces/marketplace/plugins/marketplace-backend	minor	`v0.3.1`
@red-hat-developer-hub/backstage-plugin-marketplace-common	workspaces/marketplace/plugins/marketplace-common	minor	`v0.3.0`
@red-hat-developer-hub/backstage-plugin-marketplace	workspaces/marketplace/plugins/marketplace	minor	`v0.5.7`

ShiranHi · 2025-04-29T05:31:25Z

Thank you @debsmita1, it looks great!

I have two requests:

For user with no config read permission: let's change the tooltip to be "You don't have permission to install plugins or view their configurations. Contact your administrator to request access or assistance."
For user with only config read permission: let's keep the Install button there, but disabled, and add a tooltip on hover "You don't have permission to install plugins or edit their configurations. Contact your administrator to request access or assistance."

PatAKnight

Left a couple of initial comments but will need to do a deeper dive into the plugin itself to try to understand it a bit better. If you want, we can sync up on this as I recently had to do this for the RBAC plugin and it is still fairly top of mind.

PatAKnight · 2025-04-29T14:37:24Z

I wonder if this should just be the read permission only and then we can use the create permission for post.

@PatAKnight I updated this to create a separate service to determine the privileges, which is then consumed by the UI to show "Install" or "View" plugin configuration based on the access rights

And I converted this one to check only the read access, and eventually it should return the YAML config

PTAL and let me know your thoughts on this

debsmita1 · 2025-04-30T11:33:05Z

Are you suggesting that we remove the 'View' button and instead display a disabled 'Install' button? The idea is to allow users with read-only permissions to access the plugin configuration.

Sorry for the confusion! We have two "Install" buttons. Let me clarify it:

For user with no config read permission: let's change the tooltip text that appears on the drawer when hovering over the Install button to: "You don't have permission to install plugins or view their configurations. Contact your administrator to request access or assistance."

For user with only config read permission: let's keep the Install button on the configuration page, but disabled, and add a tooltip on hover "You don't have permission to install plugins or edit their configurations. Contact your administrator to request access or assistance."

@ShiranHi Addressed your comments and updated the GIF

sonarqubecloud · 2025-05-08T07:09:21Z

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

christoph-jerolimov · 2025-05-08T09:18:41Z

+  }),
+  apply: (plugin: MarketplacePlugin, { pluginNames }) => {
+    return pluginNames && pluginNames.length > 0
+      ? !!pluginNames?.find(


super nit. isn't this the same?

Suggested change

? !!pluginNames?.find(

? pluginNames?.some(

Copilot

Pull Request Overview

This PR adds extension permissions to the marketplace plugins by introducing new API endpoints, permission rules, and updated hooks/components to support permission-based access for installing and configuring extensions. Key changes include:

Adding a new hook (useExtensionConfigPermission) and associated API methods for extension configuration authorization.
Updating the marketplace backend router to handle new permission endpoints for reading and installing plugin configurations.
Introducing permission rules and updating dependency versions to support the new permission framework.

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
workspaces/marketplace/plugins/marketplace/src/hooks/useExtensionConfigPermission.ts	New hook to fetch plugin configuration authorization.
workspaces/marketplace/plugins/marketplace/src/components/MarketplacePluginInstallContent.tsx	Updated installation UI with permission-based disable logic and tooltips.
workspaces/marketplace/plugins/marketplace/src/components/MarketplacePluginContent.tsx	Refactored action button to use permission hook and tooltip.
workspaces/marketplace/plugins/marketplace-backend/src/router.ts	Added endpoints for plugin configuration authorization and configuration access with conditional permissions.
workspaces/marketplace/plugins/marketplace-backend/src/permissions/rules.ts	New permission rules for extensions.
Various package.json and common files	Added new dependencies and API definitions to support extension permissions.

christoph-jerolimov

Some thoughts, please take a look. I'm fine if we want align some of these also later:

christoph-jerolimov · 2025-05-09T07:56:16Z

+  MarketplacePlugin,
+  ExtentionFilter
+>().with({
+  pluginId: 'marketplace',


Next step is to rename the plugin, but we can use the new pluginId here already.

Please change it also in plugins/marketplace/src/plugin.ts

Suggested change

pluginId: 'marketplace',

pluginId: 'extensions',

christoph-jerolimov · 2025-05-09T07:56:36Z

+      .string()
+      .array()
+      .optional()
+      .describe('List of plugin names to match on'),


Suggested change

.describe('List of plugin names to match on'),

.describe('List of plugin names or titles to match on'),

christoph-jerolimov · 2025-05-09T08:03:46Z

+      const [readDecision, installDecision] = await Promise.all([
+        authorizeConditional(req, extensionPluginReadPermission),
+        authorizeConditional(req, extensionPluginCreatePermission),
+      ]);
+      if (
+        readDecision.result === AuthorizeResult.DENY &&
+        installDecision.result === AuthorizeResult.DENY
+      ) {
+        res.status(403);
+        return;
+      }


Isn't it cleaner if the /authorize call return always a successful response but with an access status?

Like

200 OK

{ read: "ALLOW" write: "DENY" }

Or whatever you want return.

Because I see that the MarketplaceClient expects 200 and converts this into an error.

But you don't handle errors when using useExtensionConfigPermission in MarketplacePluginContent.

christoph-jerolimov · 2025-05-09T08:58:29Z

+      if (authorizedActions.length === 0) {
+        res.status(403);
+        return;
+      }


christoph-jerolimov · 2025-05-09T09:06:09Z

+      res.status(403).json({ error: 'Forbidden' });
+      return;


Can we throw an error instead? For all 403 cases.

import { NotAllowedError, } from '@backstage/errors';

Suggested change

res.status(403).json({ error: 'Forbidden' });

return;

throw new NotAllowedError(`Not allowed to configure ${req.params.namespace}:${req.params.name}`);

christoph-jerolimov · 2025-05-09T09:12:09Z

+/** This permission grants access to the endpoint that reads the configuration of the extension plugin
+ * @public
+ */
+export const extensionPluginReadPermission = createPermission({


The variable name should include Configuration as well, to avoid confusing that this is a permission to read the plugin metadata.

IMHO, as long as we don't differentiate between Create update and Delete we should have two permissions:

read

write or update

If you want have separate for enableing and disabling the plugin I personally would use

enable

disable

Actually, that's then maybe not a configuration enable/disable, its then maybe 'extensions.plugin.enable.

But I think we could start here also with extensions.plugin.configuration.write, because it just does this at the moment.

christoph-jerolimov · 2025-05-09T09:17:38Z

+  const params = useRouteRefParams(pluginRouteRef);
  const getIndexPath = useRouteRef(rootRouteRef);
  const getInstallPath = useRouteRef(pluginInstallRouteRef);
+  const canInstallPlugin = useExtensionConfigPermission(


I think this hook should include that its for plugins

Suggested change

const canInstallPlugin = useExtensionConfigPermission(

const pluginConfigPerm = usePluginConfigurationPermissions(

christoph-jerolimov · 2025-05-09T09:19:39Z

-        >
-          Reset
-        </Button>
+        {canInstallPlugin.data?.authorizedActions?.includes('create') && (


Suggested change

{canInstallPlugin.data?.authorizedActions?.includes('create') && (

{pluginConfigPermissions.data?.includes('create') && (

christoph-jerolimov · 2025-05-09T09:20:31Z

+
+import { useMarketplaceApi } from './useMarketplaceApi';
+
+export const useExtensionConfigPermission = (


other hook names are aligned with the MarketplaceApi function they call and just replace get with use

christoph-jerolimov

As discussed, approving this spike but it would be nice if we can address some reviews soon. Esp. renaming all permission names to extensions.* before we release the plugin.

I will set the release on hold until this changes was done!

debsmita1 · 2025-05-09T19:56:37Z

As discussed, approving this spike but it would be nice if we can address some reviews soon. Esp. renaming all permission names to extensions.* before we release the plugin.

I will set the release on hold until this changes was done!

Addressed the review comments here #762

* feat(marketplace): add permissions to extensions * adding conditional policies * add new service to check config authorization

debsmita1 requested review from christoph-jerolimov, ciiay, divyanshiGupta, gashcrumb, its-mitesh-kumar, karthikjeeyar and logonoff as code owners April 24, 2025 18:56

openshift-ci Bot added the do-not-merge/work-in-progress label Apr 24, 2025

debsmita1 requested review from christoph-jerolimov and removed request for christoph-jerolimov April 24, 2025 18:56

debsmita1 force-pushed the marketplace-permissions branch 12 times, most recently from 76326bd to 5c8e59a Compare April 28, 2025 16:11

debsmita1 changed the title ~~[WIP] feat(extensions): Add extension permissions~~ feat(extensions): Add extension permissions Apr 28, 2025

openshift-ci Bot removed the do-not-merge/work-in-progress label Apr 28, 2025

debsmita1 requested a review from ShiranHi April 28, 2025 16:28

debsmita1 force-pushed the marketplace-permissions branch 3 times, most recently from a757c03 to 6013840 Compare April 28, 2025 16:46

openshift-ci Bot added the do-not-merge/work-in-progress label Apr 29, 2025

debsmita1 force-pushed the marketplace-permissions branch from 6013840 to 63afb2f Compare April 29, 2025 13:41

debsmita1 changed the title ~~[WIP] feat(extensions): Add extension permissions~~ feat(extensions): Add extension permissions Apr 29, 2025

openshift-ci Bot removed the do-not-merge/work-in-progress label Apr 29, 2025

debsmita1 force-pushed the marketplace-permissions branch from 63afb2f to e66e1eb Compare April 29, 2025 13:56

debsmita1 requested review from PatAKnight and dzemanov April 29, 2025 14:12

PatAKnight reviewed Apr 29, 2025

View reviewed changes

debsmita1 requested a review from PatAKnight April 30, 2025 11:26

debsmita1 requested a review from logonoff April 30, 2025 11:33

debsmita1 force-pushed the marketplace-permissions branch 3 times, most recently from 285f57c to 6211a8b Compare May 5, 2025 12:26

dzemanov mentioned this pull request May 6, 2025

feat(extensions): Introduce fetch endpoints for configuration #740

Merged

4 tasks

debsmita1 added 3 commits May 8, 2025 12:34

feat(marketplace): add permissions to extensions

3dee7c0

adding conditional policies

8afb01e

add new service to check config authorization

4bf1c56

debsmita1 force-pushed the marketplace-permissions branch from 6211a8b to 4bf1c56 Compare May 8, 2025 07:08

christoph-jerolimov reviewed May 8, 2025

View reviewed changes

logonoff requested a review from Copilot May 8, 2025 13:40

Copilot AI reviewed May 8, 2025

View reviewed changes

christoph-jerolimov reviewed May 9, 2025

View reviewed changes

christoph-jerolimov approved these changes May 9, 2025

View reviewed changes

christoph-jerolimov merged commit 7d138e5 into redhat-developer:main May 9, 2025
10 checks passed

christoph-jerolimov mentioned this pull request May 9, 2025

Version Packages (marketplace) #755

Merged

debsmita1 mentioned this pull request May 9, 2025

feat(extensions): update marketplace pluginId to extensions #762

Merged

4 tasks

	.describe('List of plugin names to match on'),
	.describe('List of plugin names or titles to match on'),

	res.status(403).json({ error: 'Forbidden' });
	return;
	throw new NotAllowedError(`Not allowed to configure ${req.params.namespace}:${req.params.name}`);

	const canInstallPlugin = useExtensionConfigPermission(
	const pluginConfigPerm = usePluginConfigurationPermissions(

	{canInstallPlugin.data?.authorizedActions?.includes('create') && (
	{pluginConfigPermissions.data?.includes('create') && (


		import { useMarketplaceApi } from './useMarketplaceApi';

		export const useExtensionConfigPermission = (

Conversation

debsmita1 commented Apr 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hey, I just made a Pull Request!

✔️ Checklist

Uh oh!

rhdh-gh-app Bot commented Apr 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changed Packages

Uh oh!

ShiranHi commented Apr 29, 2025

Uh oh!

PatAKnight left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

debsmita1 commented Apr 30, 2025

Uh oh!

sonarqubecloud Bot commented May 8, 2025

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

christoph-jerolimov left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christoph-jerolimov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

debsmita1 commented May 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

debsmita1 commented Apr 24, 2025 •

edited

Loading

rhdh-gh-app Bot commented Apr 24, 2025 •

edited

Loading