fix(orchestrator): use conditional policies for orchestrator

workspaces/orchestrator/packages/app/package.json

@@ -19,6 +19,7 @@
     "lint": "backstage-cli package lint"
   },
   "dependencies": {
+    "@backstage-community/plugin-rbac": "1.52.1",
     "@backstage/cli": "^0.36.0",
     "@backstage/core-compat-api": "^0.5.9",
     "@backstage/core-components": "^0.18.8",

workspaces/orchestrator/packages/app/src/App.tsx

@@ -22,6 +22,7 @@ import orchestratorPlugin, {
 } from '@red-hat-developer-hub/backstage-plugin-orchestrator/alpha';
 import orchestratorFormWidgetsPlugin from '@red-hat-developer-hub/backstage-plugin-orchestrator-form-widgets/alpha';
 import { navModule } from './modules/nav';
+import { authSignInPageModule } from './modules/auth';
 
 export default createApp({
   features: [
@@ -31,5 +32,6 @@ export default createApp({
     userSettingsPlugin,
     orchestratorTranslationsModule,
     orchestratorFormWidgetsPlugin,
+    authSignInPageModule,
   ],
 });

workspaces/orchestrator/packages/app/src/modules/auth/index.tsx

@@ -0,0 +1,47 @@
+/*
+ * Copyright Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import React from 'react';
+import { createFrontendModule } from '@backstage/frontend-plugin-api';
+import { SignInPageBlueprint } from '@backstage/plugin-app-react';
+import { githubAuthApiRef } from '@backstage/core-plugin-api';
+
+export const authSignInPageModule = createFrontendModule({
+  pluginId: 'app',
+  extensions: [
+    SignInPageBlueprint.make({
+      params: {
+        loader: async () => {
+          const { SignInPage } = await import('@backstage/core-components');
+
+          return props =>
+            React.createElement(SignInPage, {
+              ...props,
+              providers: [
+                {
+                  id: 'github-auth-provider',
+                  title: 'GitHub',
+                  message: 'Sign in using GitHub',
+                  apiRef: githubAuthApiRef,
+                },
+                'guest',
+              ],
+            });
+        },
+      },
+    }),
+  ],
+});

workspaces/orchestrator/packages/backend/package.json

@@ -21,7 +21,7 @@
     "build-image": "docker build ../.. -f Dockerfile --tag backstage"
   },
   "dependencies": {
-    "@backstage-community/plugin-rbac-backend": "^7.4.0",
+    "@backstage-community/plugin-rbac-backend": "^7.12.3",
     "@backstage/backend-defaults": "^0.16.0",
     "@backstage/config": "^1.3.6",
     "@backstage/plugin-app-backend": "^0.5.12",

workspaces/orchestrator/packages/backend/src/index.ts

@@ -52,6 +52,7 @@ backend.add(import('@backstage/plugin-search-backend-module-catalog'));
 backend.add(import('@backstage/plugin-search-backend-module-techdocs'));
 
 // permission plugin
+backend.add(import('@backstage/plugin-permission-backend'));
 backend.add(import('@backstage-community/plugin-rbac-backend'));
 
 // orchestrator

workspaces/orchestrator/plugins/orchestrator-backend/package.json

@@ -90,10 +90,11 @@
     "lodash": "^4.18.1",
     "luxon": "^3.7.2",
     "openapi-backend": "^5.10.5",
-    "yn": "^5.0.0"
+    "yn": "^5.0.0",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@backstage-community/plugin-rbac-common": "^1.12.1",
+    "@backstage-community/plugin-rbac-common": "^1.26.0",
     "@backstage/backend-test-utils": "^1.11.1",
     "@backstage/cli": "^0.36.0",
     "@janus-idp/backstage-plugin-audit-log-node": "^1.7.1",

workspaces/orchestrator/plugins/orchestrator-backend/src/plugin.ts

@@ -55,6 +55,7 @@ export const orchestratorPlugin = createBackendPlugin({
         catalogApi: catalogServiceRef,
         urlReader: coreServices.urlReader,
         permissions: coreServices.permissions,
+        permissionsRegistry: coreServices.permissionsRegistry,
         scheduler: coreServices.scheduler,
         httpAuth: coreServices.httpAuth,
         http: coreServices.httpRouter,

workspaces/orchestrator/plugins/orchestrator-backend/src/routerWrapper/index.ts

@@ -19,6 +19,7 @@ import type {
   DiscoveryService,
   HttpAuthService,
   LoggerService,
+  PermissionsRegistryService,
   PermissionsService,
   SchedulerService,
   UrlReaderService,
@@ -42,6 +43,7 @@ export interface RouterOptions {
   urlReader: UrlReaderService;
   scheduler: SchedulerService;
   permissions: PermissionsService;
+  permissionsRegistry: PermissionsRegistryService;
   httpAuth: HttpAuthService;
   userInfo: UserInfoService;
   workflowLogsProvidersRegistry: WorkflowLogsProvidersRegistry;
@@ -74,6 +76,7 @@ export async function createRouter(
     urlReader: args.urlReader,
     scheduler: args.scheduler,
     permissions: args.permissions,
+    permissionsRegistry: args.permissionsRegistry,
     httpAuth: args.httpAuth,
     userInfo: args.userInfo,
     workflowLogsProvidersRegistry: args.workflowLogsProvidersRegistry,

workspaces/orchestrator/plugins/orchestrator-backend/src/service/permission-rules.test.ts

@@ -0,0 +1,61 @@
+/*
+ * Copyright Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { isWorkflowId, orchestratorPermissionRules } from './permission-rules';
+
+describe('permission-rules', () => {
+  describe('isWorkflowId', () => {
+    it('should return true when workflow ID is in the allowed list', () => {
+      const resource = { workflowId: 'approval-workflow-123' };
+      const params = {
+        workflowIds: ['approval-workflow-123', 'other-workflow'],
+      };
+
+      const result = isWorkflowId.apply(resource, params);
+
+      expect(result).toBe(true);
+    });
+
+    it('should return false when workflow ID is not in the allowed list', () => {
+      const resource = { workflowId: 'approval-workflow-123' };
+      const params = {
+        workflowIds: ['different-workflow-456', 'another-workflow'],
+      };
+
+      const result = isWorkflowId.apply(resource, params);
+
+      expect(result).toBe(false);
+    });
+
+    it('should have correct metadata', () => {
+      expect(isWorkflowId.name).toBe('IS_ALLOWED_WORKFLOW_ID');
+      expect(isWorkflowId.description).toBe(
+        'Allow workflows matching the specified workflow IDs',
+      );
+      expect(isWorkflowId.resourceType).toBe('orchestrator-workflow');
+    });
+  });
+
+  describe('orchestratorPermissionRules', () => {
+    it('should export isWorkflowId rule', () => {
+      expect(orchestratorPermissionRules).toContain(isWorkflowId);
+    });
+
+    it('should have exactly one rule', () => {
+      expect(orchestratorPermissionRules).toHaveLength(1);
+    });
+  });
+});

workspaces/orchestrator/plugins/orchestrator-backend/src/service/permission-rules.ts

@@ -0,0 +1,77 @@
+/*
+ * Copyright Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {
+  createPermissionResourceRef,
+  createPermissionRule,
+} from '@backstage/plugin-permission-node';
+
+import { z } from 'zod/v3';
+
+import { ORCHESTRATOR_WORKFLOW_RESOURCE_TYPE } from '@red-hat-developer-hub/backstage-plugin-orchestrator-common';
+
+export type OrchestratorFilter = {
+  key: string;
+  values: any[];
+};
+
+/**
+ * The OrchestratorFilters type is a recursive type that can be used to create complex filter structures.
+ * It can be used to create filters that are a combination of other filters, or a negation of a filter.
+ *
+ */
+export type OrchestratorFilters =
+  | { anyOf: OrchestratorFilters[] }
+  | { allOf: OrchestratorFilters[] }
+  | { not: OrchestratorFilters }
+  | OrchestratorFilter;
+
+export type WorkflowIdParam = { workflowId: string };
+
+/**
+ * Resource reference for orchestrator workflows
+ */
+export const orchestratorWorkflowResourceRef = createPermissionResourceRef<
+  WorkflowIdParam,
+  OrchestratorFilters
+>().with({
+  pluginId: 'orchestrator',
+  resourceType: ORCHESTRATOR_WORKFLOW_RESOURCE_TYPE,
+});
+
+/**
+ * Permission rule for orchestrator workflows
+ */
+export const isWorkflowId = createPermissionRule({
+  name: 'IS_ALLOWED_WORKFLOW_ID',
+  description: 'Allow workflows matching the specified workflow IDs',
+  resourceRef: orchestratorWorkflowResourceRef,
+  paramsSchema: z.object({
+    workflowIds: z.string().array().describe('List of workflows IDs to match'),
+  }),
+  apply: (workflow: WorkflowIdParam, { workflowIds }) => {
+    return workflowIds.includes(workflow.workflowId);
+  },
+  toQuery: ({ workflowIds }) => ({
+    key: 'workflowIds',
+    values: workflowIds,
+  }),
+});
+
+/**
+ * All orchestrator permission rules
+ */
+export const orchestratorPermissionRules = [isWorkflowId];