feat(rbac): use knex casbin adapter instread of typeorm

.github/workflows/rbac-perf-test.yml

@@ -29,6 +29,7 @@ env:
   TREE_HEIGHT: ${{ github.event.inputs.tree_height || '9' }}
   COMPOSE_DISABLE_LINUX: '1'
   CI: 'true'
+  YARN_ENABLE_HARDENED_MODE: '0'
 
 jobs:
   perf-test:
@@ -95,8 +96,8 @@ jobs:
         if: github.event_name == 'pull_request'
         working-directory: community-plugins
         run: |
-          git checkout ${{ steps.base-ref.outputs.ref }} -- workspaces/rbac/
-          echo "Checked out base branch RBAC plugin"
+          git checkout ${{ steps.base-ref.outputs.ref }} -- workspaces/rbac/ yarn.lock
+          echo "Checked out base branch RBAC plugin + lockfile"
 
       - name: Build baseline Backstage image
         working-directory: backstage-rbac-performance
@@ -141,8 +142,8 @@ jobs:
         if: github.event_name == 'pull_request'
         working-directory: community-plugins
         run: |
-          git checkout ${{ github.sha }} -- workspaces/rbac/
-          echo "Restored PR branch RBAC plugin"
+          git checkout ${{ github.sha }} -- workspaces/rbac/ yarn.lock
+          echo "Restored PR branch RBAC plugin + lockfile"
 
       - name: Rebuild patch Backstage image
         if: github.event_name == 'pull_request'

workspaces/rbac/package.json

@@ -69,6 +69,9 @@
   "dependenciesMeta": {
     "better-sqlite3": {
       "built": true
+    },
+    "isolated-vm": {
+      "built": true
     }
   },
   "prettier": "@backstage/cli/config/prettier",

workspaces/rbac/plugins/rbac-backend/__fixtures__/mock-utils.ts

@@ -24,13 +24,12 @@ import { AuthorizeResult } from '@backstage/plugin-permission-common';
 
 import type { Enforcer } from 'casbin';
 import * as Knex from 'knex';
-import { MockClient } from 'knex-mock-client';
+import { createTracker, MockClient } from 'knex-mock-client';
 import { resolve } from 'path';
-import type TypeORMAdapter from 'typeorm-adapter';
 
 import type { RBACProvider } from '@backstage-community/plugin-rbac-node';
 
-import { CasbinDBAdapterFactory } from '../src/database/casbin-adapter-factory';
+import type { CasbinKnexAdapter } from '../src/database/casbin-knex-adapter';
 import { ConditionalStorage } from '../src/database/conditional-storage';
 import { RoleMetadataStorage } from '../src/database/role-metadata';
 import {
@@ -124,9 +123,9 @@ export const enforcerDelegateMock: Partial<EnforcerDelegate> = {
   updateGroupingPolicies: jest.fn().mockImplementation(),
 };
 
-export const dataBaseAdapterFactoryMock: Partial<CasbinDBAdapterFactory> = {
-  createAdapter: jest.fn((): Promise<TypeORMAdapter> => {
-    return Promise.resolve({} as TypeORMAdapter);
+export const casbinKnexAdapterMock = {
+  newAdapter: jest.fn((): Promise<CasbinKnexAdapter> => {
+    return Promise.resolve({} as CasbinKnexAdapter);
   }),
 };
 
@@ -138,6 +137,33 @@ export const providerMock: RBACProvider = {
 
 export const mockClientKnex = Knex.knex({ client: MockClient });
 
+export function setupMockCasbinRuleTracker(): ReturnType<typeof createTracker> {
+  const tracker = createTracker(mockClientKnex);
+  tracker.on.select('casbin_rule').response([]);
+  tracker.on.insert('casbin_rule').response([]);
+  tracker.on.delete('casbin_rule').response(0);
+  return tracker;
+}
+
+export async function createTestCasbinKnex(): Promise<Knex.Knex> {
+  const testKnex = Knex.knex({
+    client: 'better-sqlite3',
+    connection: { filename: ':memory:' },
+    useNullAsDefault: true,
+  });
+  await testKnex.schema.createTable('casbin_rule', table => {
+    table.increments('id').primary();
+    table.string('ptype').nullable();
+    table.string('v0').nullable();
+    table.string('v1').nullable();
+    table.string('v2').nullable();
+    table.string('v3').nullable();
+    table.string('v4').nullable();
+    table.string('v5').nullable();
+  });
+  return testKnex;
+}
+
 export const mockHttpAuth = mockServices.httpAuth();
 export const mockAuthService = mockServices.auth();
 export const mockUserInfoService = mockServices.userInfo.mock();

workspaces/rbac/plugins/rbac-backend/__fixtures__/test-utils.ts

@@ -27,7 +27,7 @@ import {
 import * as Knex from 'knex';
 import { MockClient } from 'knex-mock-client';
 
-import { CasbinDBAdapterFactory } from '../src/database/casbin-adapter-factory';
+import { CasbinKnexAdapter } from '../src/database/casbin-knex-adapter';
 import { RoleMetadataStorage } from '../src/database/role-metadata';
 import { RBACPermissionPolicy } from '../src/policies/permission-policy';
 import { BackstageRoleManager } from '../src/role-manager/role-manager';
@@ -38,6 +38,7 @@ import { PluginPermissionMetadataCollector } from '../src/service/plugin-endpoin
 import {
   mockAuditorService,
   conditionalStorageMock,
+  createTestCasbinKnex,
   csvPermFile,
   mockAuthService,
   mockUserInfoService,
@@ -91,11 +92,9 @@ export function newConfig(
   });
 }
 
-export async function newAdapter(config: Config): Promise<Adapter> {
-  return await new CasbinDBAdapterFactory(
-    config,
-    mockClientKnex,
-  ).createAdapter();
+export async function newAdapter(_config: Config): Promise<Adapter> {
+  const testKnex = await createTestCasbinKnex();
+  return await CasbinKnexAdapter.newAdapter(testKnex);
 }
 
 export async function createEnforcer(

workspaces/rbac/plugins/rbac-backend/migrations/20250614000000_migrations.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2024 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Creates the casbin_rule table if it does not already exist.
+ * For existing installations, the TypeORM adapter created this table.
+ * For new installations, this migration creates it.
+ *
+ * @param {import('knex').Knex} knex
+ * @returns {Promise<void>}
+ */
+exports.up = async function up(knex) {
+  const exists = await knex.schema.hasTable('casbin_rule');
+  if (!exists) {
+    await knex.schema.createTable('casbin_rule', table => {
+      table.increments('id').primary();
+      table.string('ptype').nullable();
+      table.string('v0').nullable();
+      table.string('v1').nullable();
+      table.string('v2').nullable();
+      table.string('v3').nullable();
+      table.string('v4').nullable();
+      table.string('v5').nullable();
+    });
+  }
+};
+
+/**
+ * @param {import('knex').Knex} _knex
+ * @returns {Promise<void>}
+ */
+exports.down = async function down(_knex) {
+  // Intentionally empty — casbin_rule contains live policy data.
+};

workspaces/rbac/plugins/rbac-backend/package.json

@@ -55,7 +55,6 @@
     "js-yaml": "^4.1.0",
     "knex": "^3.0.0",
     "lodash": "^4.17.21",
-    "typeorm-adapter": "^1.6.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {