@backstage-community/plugin-rbac-backend 5.2.9 → 5.3.0

package/dist/service/enforcer-delegate.cjs.js

@@ -5,18 +5,66 @@ var EventEmitter = require('events');
 var adminCreation = require('../admin-permissions/admin-creation.cjs.js');
 var helper = require('../helper.cjs.js');
 var permissionModel = require('./permission-model.cjs.js');
+var auditLogger = require('../audit-log/audit-logger.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
 var EventEmitter__default = /*#__PURE__*/_interopDefaultCompat(EventEmitter);
 
 class EnforcerDelegate {
-  constructor(enforcer, roleMetadataStorage, knex) {
+  // Queue to track edit operations
+  constructor(enforcer, auditLogger, roleMetadataStorage, knex) {
     this.enforcer = enforcer;
+    this.auditLogger = auditLogger;
     this.roleMetadataStorage = roleMetadataStorage;
     this.knex = knex;
   }
   roleEventEmitter = new EventEmitter__default.default();
+  loadPolicyPromise = null;
+  semaphore = 0;
+  editOperationsQueue = [];
+  async loadPolicy() {
+    if (this.loadPolicyPromise) {
+      return this.loadPolicyPromise;
+    }
+    this.semaphore++;
+    this.loadPolicyPromise = (async () => {
+      try {
+        await this.waitForEditOperationsToFinish();
+        await this.enforcer.loadPolicy();
+      } catch (err) {
+        this.auditLogger.auditLog({
+          message: "Failed to load newer policies from database",
+          eventName: auditLogger.PoliciesData.FAILED_TO_FETCH_NEWER_PERMISSIONS,
+          stage: auditLogger.FETCH_NEWER_PERMISSIONS_STAGE,
+          status: "failed",
+          errors: [err]
+        });
+      } finally {
+        this.semaphore--;
+        this.loadPolicyPromise = null;
+      }
+    })();
+    return this.loadPolicyPromise;
+  }
+  async waitForEditOperationsToFinish() {
+    await Promise.all(this.editOperationsQueue);
+  }
+  async execOperation(operation) {
+    this.editOperationsQueue.push(operation);
+    let result;
+    try {
+      result = await operation;
+    } catch (err) {
+      throw err;
+    } finally {
+      const index = this.editOperationsQueue.indexOf(operation);
+      if (index !== -1) {
+        this.editOperationsQueue.splice(index, 1);
+      }
+    }
+    return result;
+  }
   on(event, listener) {
     this.roleEventEmitter.on(event, listener);
     return this;
@@ -119,110 +167,128 @@ class EnforcerDelegate {
     }
   }
   async addPolicies(policies, externalTrx) {
-    if (policies.length === 0) {
-      return;
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
     }
-    const trx = externalTrx || await this.knex.transaction();
-    try {
-      const ok = await this.enforcer.addPolicies(policies);
-      if (!ok) {
-        throw new Error(
-          `Failed to store policies ${helper.policiesToString(policies)}`
-        );
-      }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
+    const addPoliciesOperation = (async () => {
+      if (policies.length === 0) {
+        return;
+      }
+      const trx = externalTrx || await this.knex.transaction();
+      try {
+        const ok = await this.enforcer.addPolicies(policies);
+        if (!ok) {
+          throw new Error(
+            `Failed to store policies ${helper.policiesToString(policies)}`
+          );
+        }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
       }
-      throw err;
-    }
+    })();
+    await this.execOperation(addPoliciesOperation);
   }
   async addGroupingPolicy(policy, roleMetadata, externalTrx) {
-    const trx = externalTrx ?? await this.knex.transaction();
-    const entityRef = roleMetadata.roleEntityRef;
-    if (await this.hasGroupingPolicy(...policy)) {
-      return;
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
     }
-    try {
-      let currentMetadata;
-      if (entityRef.startsWith(`role:`)) {
-        currentMetadata = await this.roleMetadataStorage.findRoleMetadata(
-          entityRef,
-          trx
-        );
-      }
-      if (currentMetadata) {
-        await this.roleMetadataStorage.updateRoleMetadata(
-          helper.mergeRoleMetadata(currentMetadata, roleMetadata),
-          entityRef,
-          trx
-        );
-      } else {
-        const currentDate = /* @__PURE__ */ new Date();
-        roleMetadata.createdAt = currentDate.toUTCString();
-        roleMetadata.lastModified = currentDate.toUTCString();
-        await this.roleMetadataStorage.createRoleMetadata(roleMetadata, trx);
-      }
-      const ok = await this.enforcer.addGroupingPolicy(...policy);
-      if (!ok) {
-        throw new Error(`failed to create policy ${helper.policyToString(policy)}`);
-      }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-      if (!currentMetadata) {
-        this.roleEventEmitter.emit("roleAdded", roleMetadata.roleEntityRef);
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
+    const addGroupingPolicyOperation = (async () => {
+      const trx = externalTrx ?? await this.knex.transaction();
+      const entityRef = roleMetadata.roleEntityRef;
+      if (await this.hasGroupingPolicy(...policy)) {
+        return;
+      }
+      try {
+        let currentMetadata;
+        if (entityRef.startsWith(`role:`)) {
+          currentMetadata = await this.roleMetadataStorage.findRoleMetadata(
+            entityRef,
+            trx
+          );
+        }
+        if (currentMetadata) {
+          await this.roleMetadataStorage.updateRoleMetadata(
+            helper.mergeRoleMetadata(currentMetadata, roleMetadata),
+            entityRef,
+            trx
+          );
+        } else {
+          const currentDate = /* @__PURE__ */ new Date();
+          roleMetadata.createdAt = currentDate.toUTCString();
+          roleMetadata.lastModified = currentDate.toUTCString();
+          await this.roleMetadataStorage.createRoleMetadata(roleMetadata, trx);
+        }
+        const ok = await this.enforcer.addGroupingPolicy(...policy);
+        if (!ok) {
+          throw new Error(`failed to create policy ${helper.policyToString(policy)}`);
+        }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+        if (!currentMetadata) {
+          this.roleEventEmitter.emit("roleAdded", roleMetadata.roleEntityRef);
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
       }
-      throw err;
-    }
+    })();
+    await this.execOperation(addGroupingPolicyOperation);
   }
   async addGroupingPolicies(policies, roleMetadata, externalTrx) {
-    if (policies.length === 0) {
-      return;
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
     }
-    const trx = externalTrx ?? await this.knex.transaction();
-    try {
-      const currentRoleMetadata = await this.roleMetadataStorage.findRoleMetadata(
-        roleMetadata.roleEntityRef,
-        trx
-      );
-      if (currentRoleMetadata) {
-        await this.roleMetadataStorage.updateRoleMetadata(
-          helper.mergeRoleMetadata(currentRoleMetadata, roleMetadata),
+    const addGroupingPoliciesOperation = (async () => {
+      if (policies.length === 0) {
+        return;
+      }
+      const trx = externalTrx ?? await this.knex.transaction();
+      try {
+        const currentRoleMetadata = await this.roleMetadataStorage.findRoleMetadata(
           roleMetadata.roleEntityRef,
           trx
         );
-      } else {
-        const currentDate = /* @__PURE__ */ new Date();
-        roleMetadata.createdAt = currentDate.toUTCString();
-        roleMetadata.lastModified = currentDate.toUTCString();
-        await this.roleMetadataStorage.createRoleMetadata(roleMetadata, trx);
-      }
-      const ok = await this.enforcer.addGroupingPolicies(policies);
-      if (!ok) {
-        throw new Error(
-          `Failed to store policies ${helper.policiesToString(policies)}`
-        );
-      }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-      if (!currentRoleMetadata) {
-        this.roleEventEmitter.emit("roleAdded", roleMetadata.roleEntityRef);
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
+        if (currentRoleMetadata) {
+          await this.roleMetadataStorage.updateRoleMetadata(
+            helper.mergeRoleMetadata(currentRoleMetadata, roleMetadata),
+            roleMetadata.roleEntityRef,
+            trx
+          );
+        } else {
+          const currentDate = /* @__PURE__ */ new Date();
+          roleMetadata.createdAt = currentDate.toUTCString();
+          roleMetadata.lastModified = currentDate.toUTCString();
+          await this.roleMetadataStorage.createRoleMetadata(roleMetadata, trx);
+        }
+        const ok = await this.enforcer.addGroupingPolicies(policies);
+        if (!ok) {
+          throw new Error(
+            `Failed to store policies ${helper.policiesToString(policies)}`
+          );
+        }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+        if (!currentRoleMetadata) {
+          this.roleEventEmitter.emit("roleAdded", roleMetadata.roleEntityRef);
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
       }
-      throw err;
-    }
+    })();
+    await this.execOperation(addGroupingPoliciesOperation);
   }
   async updateGroupingPolicies(oldRole, newRole, newRoleMetadata) {
     const oldRoleName = oldRole.at(0)?.at(1);
@@ -255,110 +321,134 @@ class EnforcerDelegate {
     }
   }
   async removePolicy(policy, externalTrx) {
-    const trx = externalTrx ?? await this.knex.transaction();
-    try {
-      const ok = await this.enforcer.removePolicy(...policy);
-      if (!ok) {
-        throw new Error(`fail to delete policy ${policy}`);
-      }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
-      }
-      throw err;
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
     }
+    const removePolicyOperation = (async () => {
+      const trx = externalTrx ?? await this.knex.transaction();
+      try {
+        const ok = await this.enforcer.removePolicy(...policy);
+        if (!ok) {
+          throw new Error(`fail to delete policy ${policy}`);
+        }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
+      }
+    })();
+    await this.execOperation(removePolicyOperation);
   }
   async removePolicies(policies, externalTrx) {
-    const trx = externalTrx ?? await this.knex.transaction();
-    try {
-      const ok = await this.enforcer.removePolicies(policies);
-      if (!ok) {
-        throw new Error(
-          `Failed to delete policies ${helper.policiesToString(policies)}`
-        );
-      }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
-      }
-      throw err;
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
     }
+    const removePoliciesOperation = (async () => {
+      const trx = externalTrx ?? await this.knex.transaction();
+      try {
+        const ok = await this.enforcer.removePolicies(policies);
+        if (!ok) {
+          throw new Error(
+            `Failed to delete policies ${helper.policiesToString(policies)}`
+          );
+        }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
+      }
+    })();
+    await this.execOperation(removePoliciesOperation);
   }
   async removeGroupingPolicy(policy, roleMetadata, isUpdate, externalTrx) {
-    const trx = externalTrx ?? await this.knex.transaction();
-    const roleEntity = policy[1];
-    try {
-      const ok = await this.enforcer.removeGroupingPolicy(...policy);
-      if (!ok) {
-        throw new Error(`Failed to delete policy ${helper.policyToString(policy)}`);
-      }
-      if (!isUpdate) {
-        const currentRoleMetadata = await this.roleMetadataStorage.findRoleMetadata(roleEntity, trx);
-        const remainingGroupPolicies = await this.getFilteredGroupingPolicy(
-          1,
-          roleEntity
-        );
-        if (currentRoleMetadata && remainingGroupPolicies.length === 0 && roleEntity !== adminCreation.ADMIN_ROLE_NAME) {
-          await this.roleMetadataStorage.removeRoleMetadata(roleEntity, trx);
-        } else if (currentRoleMetadata) {
-          await this.roleMetadataStorage.updateRoleMetadata(
-            helper.mergeRoleMetadata(currentRoleMetadata, roleMetadata),
-            roleEntity,
-            trx
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
+    }
+    const removeGroupingPolicyOperation = (async () => {
+      const trx = externalTrx ?? await this.knex.transaction();
+      const roleEntity = policy[1];
+      try {
+        const ok = await this.enforcer.removeGroupingPolicy(...policy);
+        if (!ok) {
+          throw new Error(`Failed to delete policy ${helper.policyToString(policy)}`);
+        }
+        if (!isUpdate) {
+          const currentRoleMetadata = await this.roleMetadataStorage.findRoleMetadata(roleEntity, trx);
+          const remainingGroupPolicies = await this.getFilteredGroupingPolicy(
+            1,
+            roleEntity
           );
+          if (currentRoleMetadata && remainingGroupPolicies.length === 0 && roleEntity !== adminCreation.ADMIN_ROLE_NAME) {
+            await this.roleMetadataStorage.removeRoleMetadata(roleEntity, trx);
+          } else if (currentRoleMetadata) {
+            await this.roleMetadataStorage.updateRoleMetadata(
+              helper.mergeRoleMetadata(currentRoleMetadata, roleMetadata),
+              roleEntity,
+              trx
+            );
+          }
         }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
       }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
-      }
-      throw err;
-    }
+    })();
+    await this.execOperation(removeGroupingPolicyOperation);
   }
   async removeGroupingPolicies(policies, roleMetadata, isUpdate, externalTrx) {
-    const trx = externalTrx ?? await this.knex.transaction();
-    const roleEntity = roleMetadata.roleEntityRef;
-    try {
-      const ok = await this.enforcer.removeGroupingPolicies(policies);
-      if (!ok) {
-        throw new Error(
-          `Failed to delete grouping policies: ${helper.policiesToString(policies)}`
-        );
-      }
-      if (!isUpdate) {
-        const currentRoleMetadata = await this.roleMetadataStorage.findRoleMetadata(roleEntity, trx);
-        const remainingGroupPolicies = await this.getFilteredGroupingPolicy(
-          1,
-          roleEntity
-        );
-        if (currentRoleMetadata && remainingGroupPolicies.length === 0 && roleEntity !== adminCreation.ADMIN_ROLE_NAME) {
-          await this.roleMetadataStorage.removeRoleMetadata(roleEntity, trx);
-        } else if (currentRoleMetadata) {
-          await this.roleMetadataStorage.updateRoleMetadata(
-            helper.mergeRoleMetadata(currentRoleMetadata, roleMetadata),
-            roleEntity,
-            trx
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
+    }
+    const removeGroupingPolicyOperation = (async () => {
+      const trx = externalTrx ?? await this.knex.transaction();
+      const roleEntity = roleMetadata.roleEntityRef;
+      try {
+        const ok = await this.enforcer.removeGroupingPolicies(policies);
+        if (!ok) {
+          throw new Error(
+            `Failed to delete grouping policies: ${helper.policiesToString(policies)}`
           );
         }
+        if (!isUpdate) {
+          const currentRoleMetadata = await this.roleMetadataStorage.findRoleMetadata(roleEntity, trx);
+          const remainingGroupPolicies = await this.getFilteredGroupingPolicy(
+            1,
+            roleEntity
+          );
+          if (currentRoleMetadata && remainingGroupPolicies.length === 0 && roleEntity !== adminCreation.ADMIN_ROLE_NAME) {
+            await this.roleMetadataStorage.removeRoleMetadata(roleEntity, trx);
+          } else if (currentRoleMetadata) {
+            await this.roleMetadataStorage.updateRoleMetadata(
+              helper.mergeRoleMetadata(currentRoleMetadata, roleMetadata),
+              roleEntity,
+              trx
+            );
+          }
+        }
+        if (!externalTrx) {
+          await trx.commit();
+        }
+      } catch (err) {
+        if (!externalTrx) {
+          await trx.rollback(err);
+        }
+        throw err;
       }
-      if (!externalTrx) {
-        await trx.commit();
-      }
-    } catch (err) {
-      if (!externalTrx) {
-        await trx.rollback(err);
-      }
-      throw err;
-    }
+    })();
+    await this.execOperation(removeGroupingPolicyOperation);
   }
   /**
    * enforce aims to enforce a particular permission policy based on the user that it receives.
@@ -374,7 +464,8 @@ class EnforcerDelegate {
    * The temporary enforcer has lazy loading of the permission policies enabled to reduce the amount
    * of time it takes to initialize the temporary enforcer.
    * The justification for lazy loading is because permission policies are already present in the
-   * role manager / database and it will be filtered and loaded whenever `loadFilteredPolicy` is called.
+   * role manager / database and it will be filtered and loaded whenever `getFilteredPolicy` is called
+   * and permissions / roles are applied to the temp enforcer
    * @param entityRef The user to enforce
    * @param resourceType The resource type / name of the permission policy
    * @param action The action of the permission policy
@@ -383,31 +474,49 @@ class EnforcerDelegate {
    * @returns True if the user is allowed based on the particular permission
    */
   async enforce(entityRef, resourceType, action, roles) {
-    const filter = [];
-    if (roles.length > 0) {
-      roles.forEach((role) => {
-        filter.push({ ptype: "p", v0: role, v1: resourceType, v2: action });
-      });
-    } else {
-      filter.push({ ptype: "p", v1: resourceType, v2: action });
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
     }
-    const adapt = this.enforcer.getAdapter();
-    const roleManager = this.enforcer.getRoleManager();
-    const tempEnforcer = new casbin.Enforcer();
-    await tempEnforcer.initWithModelAndAdapter(
-      casbin.newModelFromString(permissionModel.MODEL),
-      adapt,
-      true
-    );
-    tempEnforcer.setRoleManager(roleManager);
-    await tempEnforcer.loadFilteredPolicy(filter);
-    return await tempEnforcer.enforce(entityRef, resourceType, action);
+    const evaluatePermissionOperation = (async () => {
+      const filter = [];
+      if (roles.length > 0) {
+        roles.forEach((role) => {
+          filter.push({ ptype: "p", v0: role, v1: resourceType, v2: action });
+        });
+      } else {
+        filter.push({ ptype: "p", v1: resourceType, v2: action });
+      }
+      const adapt = this.enforcer.getAdapter();
+      const roleManager = this.enforcer.getRoleManager();
+      const tempEnforcer = new casbin.Enforcer();
+      await tempEnforcer.initWithModelAndAdapter(
+        casbin.newModelFromString(permissionModel.MODEL),
+        adapt,
+        true
+      );
+      tempEnforcer.setRoleManager(roleManager);
+      await tempEnforcer.loadFilteredPolicy(filter);
+      return await tempEnforcer.enforce(entityRef, resourceType, action);
+    })();
+    return await this.execOperation(evaluatePermissionOperation);
   }
   async getImplicitPermissionsForUser(user) {
-    return this.enforcer.getImplicitPermissionsForUser(user);
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
+    }
+    const getPermissionsForUserOperation = (async () => {
+      return this.enforcer.getImplicitPermissionsForUser(user);
+    })();
+    return await this.execOperation(getPermissionsForUserOperation);
   }
   async getAllRoles() {
-    return this.enforcer.getAllRoles();
+    if (this.loadPolicyPromise) {
+      await this.loadPolicyPromise;
+    }
+    const getRolesOperation = (async () => {
+      return this.enforcer.getAllRoles();
+    })();
+    return await this.execOperation(getRolesOperation);
   }
 }