## @backstage-community/plugin-rbac-common [1.8.2](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.8.1...@backstage-community/plugin-rbac-common@1.8.2) (2024-08-06) ## 2.1.1 ### Patch Changes - 2501a41: Backstage version bump to v1.54.7 ## 2.1.0 ### Minor Changes - 23625ae: Backstage version bump to v1.54.5 ## 2.0.0 ### Major Changes - 05a0161: ### Conditional policies: eliminate HTTP metadata dependency and support broad matching **Fixed:** - **`.find()` arbitrary name selection:** `processConditionMapping()` used `.find()` to resolve `(resourceType, action)` to a permission name, picking the first match arbitrarily when a plugin registers multiple permissions with the same pair (named variants). The function has been removed entirely — users now control the format directly. - **`checkConflictedConditions` for named variants:** Updated conflict detection to allow separate conditional policies for different permission names with the same action and resourceType. For example, `playlist.list.update` and `playlist.followers.update` can now have independent conditions for the same role. - **Frontend sends `{name, action}`:** The frontend now sends the permission name the user selected in the UI instead of discarding it and sending only the action string. - **Startup race condition (#9429):** Eliminated HTTP calls to plugin metadata endpoints during conditional policy reconciliation. The YAML file watcher no longer calls `processConditionMapping()` — conditions are stored directly without server-side name resolution. This removes the dependency on target plugins being ready at startup. **Added:** - **`permissionMapping` accepts two formats:** - Action-only `['read']` — broad match, applies to all permissions with this action for the resourceType. Available in YAML conditional policies file and provider extension point (read-only in frontend UI). - Named `[{name: 'catalog.entity.read', action: 'read'}]` — specific match, targets exactly the named permission. Available in all entry points including REST API and frontend UI. - **New types** exported from `@backstage-community/plugin-rbac-common`: - `PermissionMapping` — union type `PermissionAction | PermissionInfo` - `isPermissionInfo()` — type guard - `permissionMappingAction()` — extracts action from either format - **REST API validation:** POST/PUT endpoints require `{name, action}` format for `permissionMapping` entries. Plain action strings are rejected with `InputError`. This ensures conditions created via REST API (editable in frontend UI) always have explicit permission names. Broad (action-only) format is supported in YAML and provider extension point where conditions are read-only in the UI. - **Validation:** `{name, action}` entries are validated — empty permission names are rejected. **Changed:** - YAML conditional policies with action-only `permissionMapping` (e.g., `['read']`) are now stored as-is and match ALL permissions with that action for the given resourceType. Previously, the backend resolved the action to a single arbitrary permission name via HTTP. This affects only plugins with named variants — multiple permissions sharing the same `(resourceType, action)` pair (scaffolder, playlist). For most plugins where each action maps to one permission, behavior is unchanged. To target a specific permission, use the `{name, action}` format. - Frontend and backend must be upgraded together — older frontend versions sending `['read']` to REST API will receive `InputError`. **No DB migration required.** Existing `{name, action}` data in the database is already valid in the new `PermissionMapping` union type and continues to work unchanged. ## 1.29.1 ### Patch Changes - a231ec3: Add CI bump-trust coverage and contributor dev harness documentation for the RBAC plugin family. **`@backstage-community/plugin-rbac-backend`** - Add backend `dev/` harness config (`app-config.yaml`) that no longer depends on the workspace root `app-config.yaml` - Add `startTestBackend` smoke test for `GET /api/permission/roles` - Add policy contract test locking the documented `superUsers` direct-membership rule - Add backend-only multi-user manual test fixtures/config under `plugins/rbac-backend/__fixtures__/` and `app-config.multi-user.yaml` (Keycloak realm import, catalog entities, CSV policies) - Add `CONTRIBUTING.md` with harness, test, and REST smoke guidance **`@backstage-community/plugin-rbac-common`** - Add minimal public API contract tests - Add `CONTRIBUTING.md` **`@backstage-community/plugin-rbac`** - Add `CONTRIBUTING.md` and link it from the plugin README **Workspace** - Remove non-functional root `yarn start` and `yarn start:alpha` scripts that paired separate plugin dev servers ## 1.29.0 ### Minor Changes - 845383a: Backstage version bump to v1.52.0 ## 1.28.0 ### Minor Changes - 091ec86: Backstage version bump to v1.51.0. The RBAC backend plugin now resolves user identity through Backstage's `UserInfoService` when evaluating conditional permissions, as part of aligning with the Backstage 1.51 permission framework. **No action is required** if you install RBAC with `backend.add(import('@backstage-community/plugin-rbac-backend'))` and manage access through app-config as documented. If you extend RBAC at a lower level (for example by constructing `PolicyBuilder` directly), ensure `UserInfoService` is wired through your backend integration. ## 1.27.0 ### Minor Changes - 6a916a1: Backstage version bump to v1.50.4 ## 1.26.1 ### Patch Changes - 170f85d: Migrate to Jest 30 and fix backend test assertion compatibility ## 1.26.0 ### Minor Changes - 8993474: Backstage version bump to v1.49.2 ## 1.25.0 ### Minor Changes - 50e194d: Add support for a default role and permissions for authenticated users in RBAC backend - Introduced a new `defaultRole` and `basicPermissions` configuration options to assign a default role to all authenticated users. ```diff permission: rbac: + defaultPermissions: + defaultRole: role:default/my-default-role + basicPermissions: + - permission: catalog.entity.read + action: read ``` - Updated the RBAC permission policy to include the default role in user roles if not already present. ## 1.24.1 ### Patch Changes - d737494: Backstage version bump to v1.48.5 ## 1.24.0 ### Minor Changes - 843bbe2: Backstage version bump to v1.48.4 ## 1.23.0 ### Minor Changes - e6dbf70: Backstage version bump to v1.47.2 ## 1.22.0 ### Minor Changes - e2d17e1: Backstage version bump to v1.45.1 ## 1.21.0 ### Minor Changes - 2d1f63f: Backstage version bump to v1.44.2 ## 1.20.0 ### Minor Changes - 232a84d: Backstage version bump to v1.42.5 ## 1.19.0 ### Minor Changes - 2f4d9ff: Backstage version bump to v1.41.1 ## 1.18.0 ### Minor Changes - 4b58a1d: Backstage version bump to v1.39.0 ### Patch Changes - 6a59fcf: remove support and lifecycle keywords in package.json ## 1.17.0 ### Minor Changes - a42945e: Introduce a type that defines an additional list of plugin IDs. ## 1.16.1 ### Patch Changes - 658c51c: chore: Remove usage of @spotify/prettier-config ## 1.16.0 ### Minor Changes - e8755f6: Backstage version bump to v1.38.1 ## 1.15.0 ### Minor Changes - d278b4c: Adds the ability to assign ownership to roles that can then be used to conditionally filter roles, permission policies, and conditional policies. The conditional filter can now be accomplished through the use of the new RBAC conditional rule `IS_OWNER`. `IS_OWNER` can be used to grant limited access to the RBAC plugins where in admins might want leads to control their own team's access. Removed the resource type from the `policy.entity.create` permission to prevent conditional rules being applied to the permission. At the moment, the plugins will still continue to work as expected. However, it is strongly recommended updating all permission policies that utilize the resource type `policy-entity` with the action `create` (ex. `role:default/some_role, policy-entity, create, allow` to `role:default/some_role, policy.entity.create, create, allow`) to prevent any future degradation in service. A migration has been supplied to automatically update all permission policies that have not originated from the CSV file. The CSV file was skipped as a duplication event could happen during reloads / restarts. This means that the CSV file will need to be updated manually to ensure that all references to the old permission policy, resource type `policy-entity` with an action of `create`, have been updated to the named permission `policy.entity.create` with an action of `create`. ## 1.14.1 ### Patch Changes - f84ad73: chore: remove homepage field from package.json ## 1.14.0 ### Minor Changes - 0253db6: Backstage version bump to v1.36.1 ## 1.13.0 ### Minor Changes - 5d5c02a: Backstage version bump to v1.35.0 ## 1.12.3 ### Patch Changes - 4b3653a: Clean up api report warnings and remove unnecessary files ## 1.12.2 ### Patch Changes - b7c2fa1: Updated supported-versions to ^1.28.4. ## 1.12.1 ### Patch Changes - 019f010: Migrated from [janus-idp/backstage-plugins](https://github.com/janus-idp/backstage-plugins). ## 1.12.0 ### Minor Changes - 8244f28: chore(deps): update to backstage 1.32 ## 1.11.0 ### Minor Changes - d9551ae: feat(deps): update to backstage 1.31 ### Patch Changes - d9551ae: change deps to peer deps in common packages - d9551ae: upgrade to yarn v3 ### Bug Fixes - **rbac:** implement conditional aliases ([#1847](https://github.com/janus-idp/backstage-plugins/issues/1847)) ([dbc9a0b](https://github.com/janus-idp/backstage-plugins/commit/dbc9a0bc92f19a4382e406f83b4889905dc6e33d)) ## @backstage-community/plugin-rbac-common [1.8.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.8.0...@backstage-community/plugin-rbac-common@1.8.1) (2024-08-05) ### Bug Fixes - **rbac:** add additional validation for permission policies ([#1908](https://github.com/janus-idp/backstage-plugins/issues/1908)) ([592498f](https://github.com/janus-idp/backstage-plugins/commit/592498f34a3b605162d3c242184aa6877b0360e8)), closes [#1939](https://github.com/janus-idp/backstage-plugins/issues/1939) ## @backstage-community/plugin-rbac-common [1.8.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.7.2...@backstage-community/plugin-rbac-common@1.8.0) (2024-07-26) ### Features - **deps:** update to backstage 1.29 ([#1900](https://github.com/janus-idp/backstage-plugins/issues/1900)) ([f53677f](https://github.com/janus-idp/backstage-plugins/commit/f53677fb02d6df43a9de98c43a9f101a6db76802)) ## @backstage-community/plugin-rbac-common [1.7.2](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.7.1...@backstage-community/plugin-rbac-common@1.7.2) (2024-07-24) ### Bug Fixes - **deps:** rollback unreleased plugins ([#1951](https://github.com/janus-idp/backstage-plugins/issues/1951)) ([8b77969](https://github.com/janus-idp/backstage-plugins/commit/8b779694f02f8125587296305276b84cdfeeaebe)) ## @backstage-community/plugin-rbac-common [1.7.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.7.0...@backstage-community/plugin-rbac-common@1.7.1) (2024-07-19) ## @backstage-community/plugin-rbac-common [1.7.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.6.1...@backstage-community/plugin-rbac-common@1.7.0) (2024-07-17) ### Features - **deps:** update to backstage 1.28 ([#1891](https://github.com/janus-idp/backstage-plugins/issues/1891)) ([1ba1108](https://github.com/janus-idp/backstage-plugins/commit/1ba11088e0de60e90d138944267b83600dc446e5)) ## @backstage-community/plugin-rbac-common [1.6.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.6.0...@backstage-community/plugin-rbac-common@1.6.1) (2024-06-28) ### Bug Fixes - **rbac:** correct plugin ID matching to permission policy ([#1795](https://github.com/janus-idp/backstage-plugins/issues/1795)) ([6dc4b1c](https://github.com/janus-idp/backstage-plugins/commit/6dc4b1c23d22252f394eecd8b795ac15507ecc50)) ## @backstage-community/plugin-rbac-common [1.6.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.5.0...@backstage-community/plugin-rbac-common@1.6.0) (2024-06-13) ### Features - **deps:** update to backstage 1.27 ([#1683](https://github.com/janus-idp/backstage-plugins/issues/1683)) ([a14869c](https://github.com/janus-idp/backstage-plugins/commit/a14869c3f4177049cb8d6552b36c3ffd17e7997d)) ## @backstage-community/plugin-rbac-common [1.5.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.4.2...@backstage-community/plugin-rbac-common@1.5.0) (2024-06-04) ### Features - **rbac:** add audit log for RBAC backend ([#1726](https://github.com/janus-idp/backstage-plugins/issues/1726)) ([e50464b](https://github.com/janus-idp/backstage-plugins/commit/e50464bcb38e9897ddfe208fdeef699e4bfeda3a)) ## @backstage-community/plugin-rbac-common [1.4.2](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.4.1...@backstage-community/plugin-rbac-common@1.4.2) (2024-05-09) ## @backstage-community/plugin-rbac-common [1.4.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.4.0...@backstage-community/plugin-rbac-common@1.4.1) (2024-04-17) ### Bug Fixes - **rbac:** reduce the number of permissions returned, add isResourced flag ([#1474](https://github.com/janus-idp/backstage-plugins/issues/1474)) ([e5dda95](https://github.com/janus-idp/backstage-plugins/commit/e5dda95bfc87d1d5d404726cbbe05c8bfdb73845)) ## @backstage-community/plugin-rbac-common [1.4.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.3.2...@backstage-community/plugin-rbac-common@1.4.0) (2024-04-05) ### Features - **rbac:** save role modification information to the metadata ([#1280](https://github.com/janus-idp/backstage-plugins/issues/1280)) ([0454509](https://github.com/janus-idp/backstage-plugins/commit/0454509e41db2ae332d1b2bf8f72d34241483efd)) ## @backstage-community/plugin-rbac-common [1.3.2](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.3.1...@backstage-community/plugin-rbac-common@1.3.2) (2024-04-04) ### Bug Fixes - **rbac:** rework condition policies to bound them to RBAC roles ([#1330](https://github.com/janus-idp/backstage-plugins/issues/1330)) ([55c00b2](https://github.com/janus-idp/backstage-plugins/commit/55c00b21b27b449cb0e5100c7b64a6ae742536ac)) ## @backstage-community/plugin-rbac-common [1.3.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.3.0...@backstage-community/plugin-rbac-common@1.3.1) (2024-03-29) ## @backstage-community/plugin-rbac-common [1.3.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.2.1...@backstage-community/plugin-rbac-common@1.3.0) (2024-02-21) ### Features - **rbac:** backend part - store role description to the database ([#1178](https://github.com/janus-idp/backstage-plugins/issues/1178)) ([ec8b1c2](https://github.com/janus-idp/backstage-plugins/commit/ec8b1c27cce5c36997f84a068dc4cc5cc542f428)) ## @backstage-community/plugin-rbac-common [1.2.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.2.0...@backstage-community/plugin-rbac-common@1.2.1) (2024-02-02) ### Bug Fixes - **rbac:** split policies and roles by source ([#1042](https://github.com/janus-idp/backstage-plugins/issues/1042)) ([03a678d](https://github.com/janus-idp/backstage-plugins/commit/03a678d96deeb1d42448e94ac95d735e61393a40)), closes [#1103](https://github.com/janus-idp/backstage-plugins/issues/1103) ## @backstage-community/plugin-rbac-common [1.2.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.1.0...@backstage-community/plugin-rbac-common@1.2.0) (2023-12-05) ### Features - **rbac:** role overview ([#972](https://github.com/janus-idp/backstage-plugins/issues/972)) ([43c1906](https://github.com/janus-idp/backstage-plugins/commit/43c19064e9477a5449ff5d56b00efe27cf640c27)) ## @backstage-community/plugin-rbac-common [1.1.0](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.0.1...@backstage-community/plugin-rbac-common@1.1.0) (2023-10-27) ### Features - **rbac:** implement the concept of roles in rbac ([#867](https://github.com/janus-idp/backstage-plugins/issues/867)) ([4d878a2](https://github.com/janus-idp/backstage-plugins/commit/4d878a29babd86bd7896d69e6b2b63392b6e6cc8)) ## @backstage-community/plugin-rbac-common [1.0.1](https://github.com/janus-idp/backstage-plugins/compare/@backstage-community/plugin-rbac-common@1.0.0...@backstage-community/plugin-rbac-common@1.0.1) (2023-10-19) ## @backstage-community/plugin-rbac-common 1.0.0 (2023-09-29) ### Bug Fixes - **rbac:** remove private package ([#809](https://github.com/janus-idp/backstage-plugins/issues/809)) ([cf59d6d](https://github.com/janus-idp/backstage-plugins/commit/cf59d6d1c5a65363a7ccdd7490d3148d665e7d46))