Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions workspaces/dcm/app-config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,23 @@ auth:
providers:
guest: {}

permission:
enabled: true
rbac:
policyFileReload: true
pluginsWithPermission:
- catalog
- scaffolder
- permission
- dcm
admin:
users:
- name: group:default/admins
- name: user:default/guest
superUsers:
- name: group:default/admins
- name: user:default/guest
Comment on lines +46 to +61

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Guest rbac superuser 🐞 Bug ⛨ Security

Guest auth is enabled and auto-sign-in is configured, but the guest user is also configured as an
RBAC admin and superUser, effectively bypassing authorization for anyone who can access the app.
Agent Prompt
### Issue description
`user:default/guest` is configured as an RBAC admin and superUser while guest auth + auto sign-in is enabled, making the instance effectively admin-by-default.

### Issue Context
This is a configuration chain issue: guest provider + auto sign-in + guest listed in RBAC admin/superUsers.

### Fix Focus Areas
- workspaces/dcm/app-config.yaml[42-61]
- workspaces/dcm/packages/app/src/App.tsx[79-81]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


scaffolder: {}

catalog:
Expand Down
41 changes: 41 additions & 0 deletions workspaces/dcm/examples/entities.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
---
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-system
apiVersion: backstage.io/v1alpha1
kind: System
metadata:
name: examples
spec:
owner: guests
---
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-component
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: example-website
spec:
type: website
lifecycle: experimental
owner: guests
system: examples
providesApis: [example-grpc-api]
---
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-api
apiVersion: backstage.io/v1alpha1
kind: API
metadata:
name: example-grpc-api
spec:
type: grpc
lifecycle: experimental
owner: guests
system: examples
definition: |
syntax = "proto3";

service Exampler {
rpc Example (ExampleMessage) returns (ExampleMessage) {};
}

message ExampleMessage {
string example = 1;
};
17 changes: 17 additions & 0 deletions workspaces/dcm/examples/org.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
---
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-user
apiVersion: backstage.io/v1alpha1
kind: User
metadata:
name: guest
spec:
memberOf: [guests]
---
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-group
apiVersion: backstage.io/v1alpha1
kind: Group
metadata:
name: guests
spec:
type: team
children: []
8 changes: 8 additions & 0 deletions workspaces/dcm/examples/template/content/catalog-info.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: ${{ values.name | dump }}
spec:
type: service
owner: user:guest
lifecycle: experimental
17 changes: 17 additions & 0 deletions workspaces/dcm/examples/template/content/index.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

console.log('Hello from ${{ values.name }}!');
5 changes: 5 additions & 0 deletions workspaces/dcm/examples/template/content/package.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"name": "${{ values.name }}",
"private": true,
"dependencies": {}
}
74 changes: 74 additions & 0 deletions workspaces/dcm/examples/template/template.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
apiVersion: scaffolder.backstage.io/v1beta3
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-template
kind: Template
metadata:
name: example-nodejs-template
title: Example Node.js Template
description: An example template for the scaffolder that creates a simple Node.js service
spec:
owner: user:guest
type: service

# These parameters are used to generate the input form in the frontend, and are
# used to gather input data for the execution of the template.
parameters:
- title: Fill in some steps
required:
- name
properties:
name:
title: Name
type: string
description: Unique name of the component
ui:autofocus: true
ui:options:
rows: 5
- title: Choose a location
required:
- repoUrl
properties:
repoUrl:
title: Repository Location
type: string
ui:field: RepoUrlPicker
ui:options:
allowedHosts:
- github.com

# These steps are executed in the scaffolder backend, using data that we gathered
# via the parameters above.
steps:
# Each step executes an action, in this case one templates files into the working directory.
- id: fetch-base
name: Fetch Base
action: fetch:template
input:
url: ./content
values:
name: ${{ parameters.name }}

# This step publishes the contents of the working directory to GitHub.
- id: publish
name: Publish
action: publish:github
input:
allowedHosts: ['github.com']
description: This is ${{ parameters.name }}
repoUrl: ${{ parameters.repoUrl }}

# The final step is to register our new component in the catalog.
- id: register
name: Register
action: catalog:register
input:
repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }}
catalogInfoPath: '/catalog-info.yaml'

# Outputs are displayed to the user after a successful execution of the template.
output:
links:
- title: Repository
url: ${{ steps['publish'].output.remoteUrl }}
- title: Open in catalog
icon: catalog
entityRef: ${{ steps['register'].output.entityRef }}
6 changes: 4 additions & 2 deletions workspaces/dcm/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"tsc:full": "tsc --skipLibCheck true --incremental false",
"build:all": "backstage-cli repo build --all",
"build:api-reports": "yarn build:api-reports:only --tsc",
"build:api-reports:only": "backstage-repo-tools api-reports -o ae-wrong-input-file-type --validate-release-tags",
"build:api-reports:only": "backstage-repo-tools api-reports -o ae-wrong-input-file-type,ae-missing-release-tag --validate-release-tags",
"build:knip-reports": "backstage-repo-tools knip-reports",
"clean": "backstage-cli repo clean",
"test": "backstage-cli repo test",
Expand Down Expand Up @@ -55,7 +55,9 @@
"resolutions": {
"@types/react": "^18",
"@types/react-dom": "^18",
"fsevents": "~2.3.2"
"fsevents": "~2.3.2",
"@backstage/backend-app-api": "1.4.1",
"@backstage/backend-plugin-api": "1.6.2"
},
"prettier": "@spotify/prettier-config",
"lint-staged": {
Expand Down
Loading