fix(rbac): implement conditional aliases (#1847)

* fix(rbac): implement conditional aliases

Signed-off-by: Oleksandr Andriienko <[email protected]>

* fix(rbac): fix build

Signed-off-by: Oleksandr Andriienko <[email protected]>

* fix(rbac): rework currentUser alias to cover ownershipEntityRefs

Signed-off-by: Oleksandr Andriienko <[email protected]>

* fix(rbac): add more unit tests

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): make feature working after backstage update to 1.29.2

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): fix compilation and tests

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): Support two aliases: currentUser and ownerRefs

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): add doc about conditional policies aliases

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): clean up unit test

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): clean up

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): clean up

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): fix dependencies

Signed-off-by: Oleksandr Andriienko <[email protected]>

* feat(rbac): update yarn.lock

Signed-off-by: Oleksandr Andriienko <[email protected]>

---------

Signed-off-by: Oleksandr Andriienko <[email protected]>

Author: AndrienkoAleksandr

plugins/rbac-backend/docs/conditions.md

@@ -274,13 +274,49 @@ To utilize this condition to the RBAC REST api you need to wrap it with more inf
 }
 ```
 
+## Conditional Policy Aliases
+
+The RBAC-backend plugin allows for the use of aliases in the conditional policy rule parameters. These aliases are dynamically replaced with corresponding values during the policy evaluation process. Each alias is prefixed with a `$` sign to denote its special function.
+
+### Supported Aliases
+
+1. **`$currentUser`**:
+
+   - **Description**: This alias is replaced with the user entity reference for the user currently requesting access to the resource.
+   - **Example**: If the user "Tom" from the "default" namespace is requesting access, `$currentUser` will be replaced with `user:default/tom`.
+
+2. **`$ownerRefs`**:
+   - **Description**: This alias is replaced with ownership references, typically in the form of an array. The array usually contains the user entity reference and the user's parent group entity reference.
+   - **Example**: For a user "Tom" who belongs to "team-a", `$ownerRefs` will be replaced with `['user:default/tom', 'group:default/team-a']`.
+
+### Example of a Conditional Policy Object with Alias
+
+This condition should allow members of the `role:default/developer` to delete only their own catalogs and no others:
+
+```json
+{
+  "result": "CONDITIONAL",
+  "roleEntityRef": "role:default/developer",
+  "pluginId": "catalog",
+  "resourceType": "catalog-entity",
+  "permissionMapping": ["delete"],
+  "conditions": {
+    "rule": "IS_ENTITY_OWNER",
+    "resourceType": "catalog-entity",
+    "params": {
+      "claims": ["$currentUser"]
+    }
+  }
+}
+```
+
 ## Examples of Conditional Policies
 
 Below are a few examples that can be used on some of the Janus IDP plugins. These can help in determining how based to define conditional policies
 
 ### Keycloak plugin
 
-```JSON
+```json
 {
   "result": "CONDITIONAL",
   "roleEntityRef": "role:default/developer",
@@ -303,7 +339,7 @@ Notice the use of the annotation `keycloak.org/realm` requires the value of `<YO
 
 ### Quay Actions
 
-```JSON
+```json
 {
   "result": "CONDITIONAL",
   "roleEntityRef": "role:default/developer",

plugins/rbac-backend/package.json

@@ -42,10 +42,11 @@
     "@backstage/plugin-permission-backend": "^0.5.46",
     "@backstage/plugin-permission-common": "^0.8.0",
     "@backstage/plugin-permission-node": "^0.8.0",
+    "@backstage/types": "^1.1.1",
     "@dagrejs/graphlib": "^2.1.13",
+    "@janus-idp/backstage-plugin-audit-log-node": "1.4.0",
     "@janus-idp/backstage-plugin-rbac-common": "1.8.1",
     "@janus-idp/backstage-plugin-rbac-node": "1.4.0",
-    "@janus-idp/backstage-plugin-audit-log-node": "1.4.0",
     "casbin": "^5.27.1",
     "chokidar": "^3.6.0",
     "csv-parse": "^5.5.5",
@@ -58,8 +59,8 @@
     "yn": "^4.0.0"
   },
   "devDependencies": {
-    "@backstage/cli": "0.26.11",
     "@backstage/backend-test-utils": "0.4.4",
+    "@backstage/cli": "0.26.11",
     "@types/express": "4.17.21",
     "@types/node": "18.19.34",
     "@types/supertest": "2.0.16",