[RFC] Component visibility level in backstage

Status: Open for comments

Need

A lot of our teams have apis and components that they(and also our organization) want catalogued in backstage. That being said, some of these apis and components are considered private for the team, and clutter for everyone else.

Proposal

Add a visibleTo option at the component level.

It works simmilar to owner, except it determines who can see the component in the catalog. Only the team set as visibleTo, along with all descendant will be able to see the component.

If the value is missing then backstage should use the current behavior, where the component is visible to everyone.

Alternatives

Add a visiblity option at the component level.

visibility would be public, restricted or private. Simmilar to object oriented programming concepts:

• public - The component is visible to everyone in the org
• restricted - The component is only visible to the owner team and descendants of the owner team
• private - The component is only visible to the owner team

Risks

A big rist is that teams could default to making their components private. This goes against one of the core concepts of backstage. To combat this, i suggest that users should always be able to bypass the visiblity settings(with some work) through an option the the ui.

[joeporpeglia]

Hey @Andrei-Predoiu, documentation for the Backstage permission framework is now available here: https://backstage.io/docs/permission/overview

This should support your need through the use of conditions defined in a PermissionPolicy. Currently supported conditions for catalog entities are defined in the catalogConditions export of @backstage/plugin-catalog-backend (see api-report.md). Please open an issue if you find any problems along the way!

[Andrei-Predoiu]

I would like to have this setting for all components