refactor(homepage): simplify permission checks by moving logic into buildUserContext

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Christoph Jerolimov <jerolimov+git@redhat.com>

Author: christoph-jerolimov

workspaces/homepage/plugins/homepage-backend/README.md

@@ -126,17 +126,6 @@ homepage:
             xl: { w: 12, h: 4 }
 ```
 
-### Three filtering layers
-
-```
-Config (if/unless)  -->  Permission check (ALLOW/DENY/CONDITIONAL)  -->  Conditional rules (HAS_TAG/HAS_WIDGET_ID)
-     Layer 1                        Layer 2                                        Layer 3
-```
-
-- **Layer 1** always runs—identity and group based (`if`/`unless`).
-- **Layer 2**—RBAC returns ALLOW (pass all), DENY (block all), or CONDITIONAL (apply Layer 3).
-- **Layer 3**—rule-based filtering on survivors from Layer 1 using `HAS_TAG` and/or `HAS_WIDGET_ID`.
-
 ### Permission rules
 
 The plugin registers two permission rules for the `homepage-default-widget` resource type:

workspaces/homepage/plugins/homepage-backend/src/defaultWidgets/buildUserContext.ts

@@ -18,17 +18,29 @@ import {
   BackstageCredentials,
   BackstageUserPrincipal,
   LoggerService,
+  PermissionsService,
 } from '@backstage/backend-plugin-api';
 import { RELATION_MEMBER_OF } from '@backstage/catalog-model';
 import { CatalogService } from '@backstage/plugin-catalog-node';
+import {
+  createPermission,
+  PolicyDecision,
+  QueryPermissionRequest,
+} from '@backstage/plugin-permission-common';
+import { homepageDefaultWidgetsReadPermission } from '@red-hat-developer-hub/backstage-plugin-homepage-common';
+import { UserContext } from './types';
 
 export async function buildUserContext(opts: {
   credentials: BackstageCredentials<BackstageUserPrincipal>;
   catalog: CatalogService;
+  permissions: PermissionsService;
+  referencedPermissions: Set<string>;
   logger: LoggerService;
-}): Promise<{ userEntityRef: string; groupEntityRefs: Set<string> }> {
-  const { credentials, catalog, logger } = opts;
+}): Promise<UserContext> {
+  const { credentials, catalog, permissions, referencedPermissions, logger } =
+    opts;
 
+  // user ref
   const userEntityRef = credentials.principal.userEntityRef;
   const userEntity = await catalog.getEntityByRef(userEntityRef, {
     credentials,
@@ -39,11 +51,45 @@ export async function buildUserContext(opts: {
       `User entity '${userEntityRef}' not found in catalog; group-based visibility will fail closed`,
     );
   }
+
+  // group refs
   const groupEntityRefs = new Set<string>(
     (userEntity?.relations ?? [])
       .filter(relation => relation.type === RELATION_MEMBER_OF)
       .map(relation => relation.targetRef),
   );
 
-  return { userEntityRef, groupEntityRefs };
+  // permissions
+  const names = [...referencedPermissions];
+  const conditionalPermissionRequests = [
+    // This default permission will be "removed" below and added as a dedicated
+    // `defaultWidgetsReadDecision` to the user context.
+    {
+      permission: homepageDefaultWidgetsReadPermission,
+    },
+    ...names.map<QueryPermissionRequest>(name => ({
+      permission: createPermission({
+        name,
+        attributes: { action: 'read' },
+        resourceType: 'homepage-default-widget',
+      }),
+    })),
+  ];
+
+  const [defaultWidgetsReadDecision, ...otherConditionalDecisions] =
+    await permissions.authorizeConditional(conditionalPermissionRequests, {
+      credentials,
+    });
+
+  const otherPolicyDecisions = new Map<string, PolicyDecision>();
+  otherConditionalDecisions.forEach((decision, index) => {
+    otherPolicyDecisions.set(names[index], decision);
+  });
+
+  return {
+    userEntityRef,
+    groupEntityRefs,
+    defaultWidgetsReadDecision,
+    otherPolicyDecisions,
+  };
 }