Add Announcement read permissions and (possibly) attach announcementCreatePermission to the CategoriesPage element about backstage-plugin-announcements HOT 1 OPEN

As per my understanding, a separate read permission is not required. Permissions framework allows specific features on a page to be restricted and that's how announcements page is built. Only the action buttons are removed/disabled if user does not have proper access.

Create, update & delete actions can be restricted with below permissions. Users not belonging to backstageAdminGroup can still see the announcements.

if (
  isPermission(request.permission, announcementCreatePermission) ||
  isPermission(request.permission, announcementUpdatePermission) ||
  isPermission(request.permission, announcementDeletePermission)
) {
  if (user?.identity.ownershipEntityRefs.includes(this.config.getConfig('permission').getString('backstageAdminGroup'))) {
     return { result: AuthorizeResult.ALLOW };
  }
  return { result: AuthorizeResult.DENY };
}

Do agree on the second point though. Categories page needs to be restricted for read only users. IMO, the categories button on the announcements page & the route itself can be restricted as I don't see a use case where category list will be of value to read only users.

from backstage-plugin-announcements.