Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict Repository Creation and Removal in Backstage to SF GitHub Users and Project Administrators #149

Open
maxmurphySF opened this issue May 24, 2024 · 0 comments
Open

Restrict Repository Creation and Removal in Backstage to SF GitHub Users and Project Administrators #149

maxmurphySF opened this issue May 24, 2024 · 0 comments
Assignees
@sadarunnisa-sf @maxmurphySF
Labels
backstage
Milestone
Backstage GA

Comments

@maxmurphySF
Copy link

Current Issue:

Currently, anyone can create repositories in Backstage, which leads to several issues:

  • Incomplete or improperly formatted repositories
  • Repositories being deleted before they should be removed
  • Potential security concerns due to unrestricted access

Remediation

  • Implement access controls in Backstage to restrict repository creation and removal to authorized users only.
  • Only SourceFuse GitHub users should be allowed to create new repositories in Backstage.
  • Within the SourceFuse GitHub users, only designated Project Administrators should have the ability to edit or remove an existing repository once it has been created.
  • This solution will mitigate security concerns by limiting repository management actions to trusted and authorized personnel, ensuring proper formatting and preventing accidental or unauthorized deletions.
@maxmurphySF maxmurphySF added this to the Backstage GA milestone May 24, 2024
@sadarunnisa-sf sadarunnisa-sf mentioned this issue Jun 4, 2024
Merged
12 tasks
a-ganguly pushed a commit that referenced this issue Jun 20, 2024
@sadarunnisa-sf
feat(plugins): validate user access for scaffold (#157)
b4bfab8 
Restrict Repository Creation and Removal in Backstage to SF GitHub Users
and Project Administrators

ARC-149

## Description

Currently, anyone can create repositories in Backstage, which leads to
several issues.
To resolve this issue, implemented solution as below.
Created github team in Sourcefuse organization. We can configure the
team name by env var and SSM parameter.
Users with admin and member role from this team can scaffold the
template and eventually repo would be created.
Other users would be able to view template list but won't be able to
scaffold.
Made required changes in terraform code to add environment variables
Created **custom backend plugin** which would take care of validating
user access.

Fixes # (issue)
#149

## Type of change

Please delete options that are not relevant.

- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Intermediate change (work in progress)

## How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration

- [ ] Test A
- [ ] Test B

## Checklist:

- [X] Performed a self-review of my own code
- [X] npm test passes on your machine
- [ ] New tests added or existing tests modified to cover all changes
- [ ] Code conforms with the style guide
- [ ] API Documentation in code was updated
- [ ] Any dependent changes have been merged and published in downstream
modules
@sadarunnisa-sf sadarunnisa-sf mentioned this issue Jun 24, 2024
Open
12 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sadarunnisa-sf sadarunnisa-sf

@maxmurphySF maxmurphySF

Labels
backstage
Projects
None yet
Milestone
Backstage GA
Development

No branches or pull requests
2 participants
@sadarunnisa-sf @maxmurphySF