@backstage-community/plugin-rbac-backend 5.6.1 → 6.0.1

package/dist/helper.cjs.js

@@ -1,7 +1,7 @@
 'use strict';
 
 var lodash = require('lodash');
-var auditLogger = require('./audit-log/audit-logger.cjs.js');
+var auditor = require('./auditor/auditor.cjs.js');
 
 function policyToString(policy) {
   return `[${policy.join(", ")}]`;
@@ -24,7 +24,7 @@ function typedPoliciesToString(policies, type) {
 function metadataStringToPolicy(policy) {
   return policy.replace("[", "").replace("]", "").split(", ");
 }
-async function removeTheDifference(originalGroup, addedGroup, source, roleEntityRef, enf, auditLogger$1, modifiedBy) {
+async function removeTheDifference(originalGroup, addedGroup, source, roleEntityRef, enf, auditor$1, modifiedBy) {
   originalGroup.sort((a, b) => a.localeCompare(b));
   addedGroup.sort((a, b) => a.localeCompare(b));
   const missing = lodash.difference(originalGroup, addedGroup);
@@ -36,24 +36,27 @@ async function removeTheDifference(originalGroup, addedGroup, source, roleEntity
     return;
   }
   const roleMetadata = { source, modifiedBy, roleEntityRef };
-  await enf.removeGroupingPolicies(groupPolicies, roleMetadata, false);
-  const remainingMembers = await enf.getFilteredGroupingPolicy(
-    1,
-    roleEntityRef
-  );
-  const message = remainingMembers.length > 0 ? "Updated role: deleted members" : "Deleted role";
-  const eventName = remainingMembers.length > 0 ? auditLogger.RoleEvents.UPDATE_ROLE : auditLogger.RoleEvents.DELETE_ROLE;
-  await auditLogger$1.auditLog({
-    actorId: auditLogger.RBAC_BACKEND,
-    message,
-    eventName,
-    metadata: {
-      ...roleMetadata,
-      members: groupPolicies.map((gp) => gp[0])
-    },
-    stage: auditLogger.HANDLE_RBAC_DATA_STAGE,
-    status: "succeeded"
+  const existingMembers = await enf.getFilteredGroupingPolicy(1, roleEntityRef);
+  const actionType = existingMembers.length === missing.length ? auditor.ActionType.DELETE : auditor.ActionType.UPDATE;
+  const auditorMeta = {
+    ...roleMetadata,
+    members: groupPolicies.map((gp) => gp[0])
+  };
+  const auditorEvent = await auditor$1.createEvent({
+    eventId: auditor.RoleEvents.ROLE_WRITE,
+    severityLevel: "medium",
+    meta: { actionType, source: auditorMeta.source }
   });
+  try {
+    await enf.removeGroupingPolicies(groupPolicies, roleMetadata, false);
+    await auditorEvent.success({ meta: auditorMeta });
+  } catch (error) {
+    await auditorEvent.fail({
+      error,
+      meta: auditorMeta
+    });
+    throw error;
+  }
 }
 function transformArrayToPolicy(policyArray) {
   const [entityReference, permission, policy, effect] = policyArray;

package/dist/helper.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.cjs.js","sources":["../src/helper.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { AuthService } from '@backstage/backend-plugin-api';\nimport type { MetadataResponse } from '@backstage/plugin-permission-node';\n\nimport { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport {\n  difference,\n  fromPairs,\n  isArray,\n  isEqual,\n  isPlainObject,\n  omitBy,\n  sortBy,\n  toPairs,\n  ValueKeyIteratee,\n} from 'lodash';\n\nimport {\n  PermissionAction,\n  PermissionInfo,\n  RoleBasedPolicy,\n  RoleConditionalPolicyDecision,\n  Source,\n} from '@backstage-community/plugin-rbac-common';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from './audit-log/audit-logger';\nimport { RoleMetadataDao, RoleMetadataStorage } from './database/role-metadata';\nimport { EnforcerDelegate } from './service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from './service/plugin-endpoints';\n\nexport function policyToString(policy: string[]): string {\n  return `[${policy.join(', ')}]`;\n}\n\nexport function typedPolicyToString(policy: string[], type: string): string {\n  return `${type}, ${policy.join(', ')}`;\n}\n\nexport function policiesToString(policies: string[][]): string {\n  const policiesString = policies\n    .map(policy => policyToString(policy))\n    .join(',');\n  return `[${policiesString}]`;\n}\n\nexport function typedPoliciesToString(\n  policies: string[][],\n  type: string,\n): string {\n  const policiesString = policies\n    .map(policy => {\n      return policy.length !== 0 ? typedPolicyToString(policy, type) : '';\n    })\n    .join('\\n');\n  return `\n    ${policiesString}\n  `;\n}\n\nexport function metadataStringToPolicy(policy: string): string[] {\n  return policy.replace('[', '').replace(']', '').split(', ');\n}\n\nexport async function removeTheDifference(\n  originalGroup: string[],\n  addedGroup: string[],\n  source: Source,\n  roleEntityRef: string,\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n  modifiedBy: string,\n): Promise<void> {\n  originalGroup.sort((a, b) => a.localeCompare(b));\n  addedGroup.sort((a, b) => a.localeCompare(b));\n  const missing = difference(originalGroup, addedGroup);\n\n  const groupPolicies: string[][] = [];\n  for (const missingRole of missing) {\n    groupPolicies.push([missingRole, roleEntityRef]);\n  }\n\n  if (groupPolicies.length === 0) {\n    return;\n  }\n\n  const roleMetadata = { source, modifiedBy, roleEntityRef };\n  await enf.removeGroupingPolicies(groupPolicies, roleMetadata, false);\n\n  const remainingMembers = await enf.getFilteredGroupingPolicy(\n    1,\n    roleEntityRef,\n  );\n  const message =\n    remainingMembers.length > 0\n      ? 'Updated role: deleted members'\n      : 'Deleted role';\n  const eventName =\n    remainingMembers.length > 0\n      ? RoleEvents.UPDATE_ROLE\n      : RoleEvents.DELETE_ROLE;\n  await auditLogger.auditLog<RoleAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message,\n    eventName,\n    metadata: {\n      ...roleMetadata,\n      members: groupPolicies.map(gp => gp[0]),\n    },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n}\n\nexport function transformArrayToPolicy(policyArray: string[]): RoleBasedPolicy {\n  const [entityReference, permission, policy, effect] = policyArray;\n  return { entityReference, permission, policy, effect };\n}\n\nexport function transformPolicyGroupToLowercase(policyArray: string[]) {\n  if (\n    policyArray.length > 1 &&\n    policyArray[0].startsWith('g') &&\n    (policyArray[1].startsWith('user') || policyArray[1].startsWith('group'))\n  ) {\n    policyArray[1] = policyArray[1].toLocaleLowerCase('en-US');\n  }\n}\n\nexport function transformRolesGroupToLowercase(roles: string[][]) {\n  return roles.map(role =>\n    role.length >= 1\n      ? [role[0].toLocaleLowerCase('en-US'), ...role.slice(1)]\n      : role,\n  );\n}\n\nexport function deepSortedEqual(\n  obj1: Record<string, any>,\n  obj2: Record<string, any>,\n  excludeFields?: string[],\n): boolean {\n  let copyObj1;\n  let copyObj2;\n  if (excludeFields) {\n    const excludeFieldsPredicate: ValueKeyIteratee<any> = (_value, key) => {\n      for (const field of excludeFields) {\n        if (key === field) {\n          return true;\n        }\n      }\n      return false;\n    };\n    copyObj1 = omitBy(obj1, excludeFieldsPredicate);\n    copyObj2 = omitBy(obj2, excludeFieldsPredicate);\n  }\n\n  const sortedObj1 = sortBy(toPairs(copyObj1 || obj1), ([key]) => key);\n  const sortedObj2 = sortBy(toPairs(copyObj2 || obj2), ([key]) => key);\n\n  return isEqual(sortedObj1, sortedObj2);\n}\n\nexport function isPermissionAction(action: string): action is PermissionAction {\n  return ['create', 'read', 'update', 'delete', 'use'].includes(\n    action as PermissionAction,\n  );\n}\n\nexport async function buildRoleSourceMap(\n  policies: string[][],\n  roleMetadata: RoleMetadataStorage,\n): Promise<Map<string, Source | undefined>> {\n  return await policies.reduce(\n    async (\n      acc: Promise<Map<string, Source | undefined>>,\n      policy: string[],\n    ): Promise<Map<string, Source | undefined>> => {\n      const roleEntityRef = policy[0];\n      const acummulator = await acc;\n      if (!acummulator.has(roleEntityRef)) {\n        const metadata = await roleMetadata.findRoleMetadata(roleEntityRef);\n        acummulator.set(roleEntityRef, metadata?.source);\n      }\n      return acummulator;\n    },\n    Promise.resolve(new Map<string, Source | undefined>()),\n  );\n}\n\nexport function mergeRoleMetadata(\n  currentMetadata: RoleMetadataDao,\n  newMetadata: RoleMetadataDao,\n): RoleMetadataDao {\n  const mergedMetaData: RoleMetadataDao = { ...currentMetadata };\n  mergedMetaData.lastModified =\n    newMetadata.lastModified ?? new Date().toUTCString();\n  mergedMetaData.modifiedBy = newMetadata.modifiedBy;\n  mergedMetaData.description =\n    newMetadata.description ?? currentMetadata.description;\n  mergedMetaData.roleEntityRef = newMetadata.roleEntityRef;\n  mergedMetaData.source = newMetadata.source;\n  return mergedMetaData;\n}\n\nexport async function processConditionMapping(\n  roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction>,\n  pluginPermMetaData: PluginPermissionMetadataCollector,\n  auth: AuthService,\n): Promise<RoleConditionalPolicyDecision<PermissionInfo>> {\n  const { token } = await auth.getPluginRequestToken({\n    onBehalfOf: await auth.getOwnServiceCredentials(),\n    targetPluginId: roleConditionPolicy.pluginId,\n  });\n\n  const rule: MetadataResponse | undefined =\n    await pluginPermMetaData.getMetadataByPluginId(\n      roleConditionPolicy.pluginId,\n      token,\n    );\n  if (!rule?.permissions) {\n    throw new Error(\n      `Unable to get permission list for plugin ${roleConditionPolicy.pluginId}`,\n    );\n  }\n\n  const permInfo: PermissionInfo[] = [];\n  for (const action of roleConditionPolicy.permissionMapping) {\n    const perm = rule.permissions.find(\n      permission =>\n        permission.type === 'resource' &&\n        (action === permission.attributes.action ||\n          (action === 'use' && permission.attributes.action === undefined)),\n    );\n    if (!perm) {\n      throw new Error(\n        `Unable to find permission to get permission name for resource type '${\n          roleConditionPolicy.resourceType\n        }' and action ${JSON.stringify(action)}`,\n      );\n    }\n    permInfo.push({ name: perm.name, action });\n  }\n\n  return {\n    ...roleConditionPolicy,\n    permissionMapping: permInfo,\n  };\n}\n\nexport function deepSort(value: any): any {\n  if (isArray(value)) {\n    return sortBy(value.map(deepSort));\n  } else if (isPlainObject(value)) {\n    return fromPairs(\n      sortBy(\n        toPairs(value).map(([k, v]: [string, any]) => [k, deepSort(v)]),\n        0,\n      ),\n    );\n  }\n  return value;\n}\n\nexport function deepSortEqual(obj1: any, obj2: any): boolean {\n  return isEqual(deepSort(obj1), deepSort(obj2));\n}\n"],"names":["auditLogger","difference","RoleEvents","RBAC_BACKEND","HANDLE_RBAC_DATA_STAGE","omitBy","sortBy","toPairs","isEqual","isArray","isPlainObject","fromPairs"],"mappings":";;;;;AAiDO,SAAS,eAAe,MAA0B,EAAA;AACvD,EAAA,OAAO,CAAI,CAAA,EAAA,MAAA,CAAO,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA,CAAA;AAC9B;AAEgB,SAAA,mBAAA,CAAoB,QAAkB,IAAsB,EAAA;AAC1E,EAAA,OAAO,GAAG,IAAI,CAAA,EAAA,EAAK,MAAO,CAAA,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACtC;AAEO,SAAS,iBAAiB,QAA8B,EAAA;AAC7D,EAAM,MAAA,cAAA,GAAiB,SACpB,GAAI,CAAA,CAAA,MAAA,KAAU,eAAe,MAAM,CAAC,CACpC,CAAA,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,IAAI,cAAc,CAAA,CAAA,CAAA;AAC3B;AAEgB,SAAA,qBAAA,CACd,UACA,IACQ,EAAA;AACR,EAAM,MAAA,cAAA,GAAiB,QACpB,CAAA,GAAA,CAAI,CAAU,MAAA,KAAA;AACb,IAAA,OAAO,OAAO,MAAW,KAAA,CAAA,GAAI,mBAAoB,CAAA,MAAA,EAAQ,IAAI,CAAI,GAAA,EAAA;AAAA,GAClE,CACA,CAAA,IAAA,CAAK,IAAI,CAAA;AACZ,EAAO,OAAA;AAAA,IAAA,EACH,cAAc;AAAA,EAAA,CAAA;AAEpB;AAEO,SAAS,uBAAuB,MAA0B,EAAA;AAC/D,EAAO,OAAA,MAAA,CAAO,OAAQ,CAAA,GAAA,EAAK,EAAE,CAAA,CAAE,QAAQ,GAAK,EAAA,EAAE,CAAE,CAAA,KAAA,CAAM,IAAI,CAAA;AAC5D;AAEA,eAAsB,oBACpB,aACA,EAAA,UAAA,EACA,QACA,aACA,EAAA,GAAA,EACAA,eACA,UACe,EAAA;AACf,EAAA,aAAA,CAAc,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/C,EAAA,UAAA,CAAW,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC5C,EAAM,MAAA,OAAA,GAAUC,iBAAW,CAAA,aAAA,EAAe,UAAU,CAAA;AAEpD,EAAA,MAAM,gBAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,eAAe,OAAS,EAAA;AACjC,IAAA,aAAA,CAAc,IAAK,CAAA,CAAC,WAAa,EAAA,aAAa,CAAC,CAAA;AAAA;AAGjD,EAAI,IAAA,aAAA,CAAc,WAAW,CAAG,EAAA;AAC9B,IAAA;AAAA;AAGF,EAAA,MAAM,YAAe,GAAA,EAAE,MAAQ,EAAA,UAAA,EAAY,aAAc,EAAA;AACzD,EAAA,MAAM,GAAI,CAAA,sBAAA,CAAuB,aAAe,EAAA,YAAA,EAAc,KAAK,CAAA;AAEnE,EAAM,MAAA,gBAAA,GAAmB,MAAM,GAAI,CAAA,yBAAA;AAAA,IACjC,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OACJ,GAAA,gBAAA,CAAiB,MAAS,GAAA,CAAA,GACtB,+BACA,GAAA,cAAA;AACN,EAAA,MAAM,YACJ,gBAAiB,CAAA,MAAA,GAAS,CACtB,GAAAC,sBAAA,CAAW,cACXA,sBAAW,CAAA,WAAA;AACjB,EAAA,MAAMF,cAAY,QAAwB,CAAA;AAAA,IACxC,OAAS,EAAAG,wBAAA;AAAA,IACT,OAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAU,EAAA;AAAA,MACR,GAAG,YAAA;AAAA,MACH,SAAS,aAAc,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,KACxC;AAAA,IACA,KAAO,EAAAC,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AACH;AAEO,SAAS,uBAAuB,WAAwC,EAAA;AAC7E,EAAA,MAAM,CAAC,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAM,CAAI,GAAA,WAAA;AACtD,EAAA,OAAO,EAAE,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAO,EAAA;AACvD;AAEO,SAAS,gCAAgC,WAAuB,EAAA;AACrE,EACE,IAAA,WAAA,CAAY,SAAS,CACrB,IAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,GAAG,CAC5B,KAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,MAAM,CAAK,IAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,OAAO,CACvE,CAAA,EAAA;AACA,IAAA,WAAA,CAAY,CAAC,CAAI,GAAA,WAAA,CAAY,CAAC,CAAA,CAAE,kBAAkB,OAAO,CAAA;AAAA;AAE7D;AAEO,SAAS,+BAA+B,KAAmB,EAAA;AAChE,EAAA,OAAO,KAAM,CAAA,GAAA;AAAA,IAAI,UACf,IAAK,CAAA,MAAA,IAAU,CACX,GAAA,CAAC,KAAK,CAAC,CAAA,CAAE,iBAAkB,CAAA,OAAO,GAAG,GAAG,IAAA,CAAK,KAAM,CAAA,CAAC,CAAC,CACrD,GAAA;AAAA,GACN;AACF;AAEgB,SAAA,eAAA,CACd,IACA,EAAA,IAAA,EACA,aACS,EAAA;AACT,EAAI,IAAA,QAAA;AACJ,EAAI,IAAA,QAAA;AACJ,EAAA,IAAI,aAAe,EAAA;AACjB,IAAM,MAAA,sBAAA,GAAgD,CAAC,MAAA,EAAQ,GAAQ,KAAA;AACrE,MAAA,KAAA,MAAW,SAAS,aAAe,EAAA;AACjC,QAAA,IAAI,QAAQ,KAAO,EAAA;AACjB,UAAO,OAAA,IAAA;AAAA;AACT;AAEF,MAAO,OAAA,KAAA;AAAA,KACT;AACA,IAAW,QAAA,GAAAC,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAC9C,IAAW,QAAA,GAAAA,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAAA;AAGhD,EAAM,MAAA,UAAA,GAAaC,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AACnE,EAAM,MAAA,UAAA,GAAaD,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AAEnE,EAAO,OAAAC,cAAA,CAAQ,YAAY,UAAU,CAAA;AACvC;AAEO,SAAS,mBAAmB,MAA4C,EAAA;AAC7E,EAAA,OAAO,CAAC,QAAU,EAAA,MAAA,EAAQ,QAAU,EAAA,QAAA,EAAU,KAAK,CAAE,CAAA,QAAA;AAAA,IACnD;AAAA,GACF;AACF;AAEsB,eAAA,kBAAA,CACpB,UACA,YAC0C,EAAA;AAC1C,EAAA,OAAO,MAAM,QAAS,CAAA,MAAA;AAAA,IACpB,OACE,KACA,MAC6C,KAAA;AAC7C,MAAM,MAAA,aAAA,GAAgB,OAAO,CAAC,CAAA;AAC9B,MAAA,MAAM,cAAc,MAAM,GAAA;AAC1B,MAAA,IAAI,CAAC,WAAA,CAAY,GAAI,CAAA,aAAa,CAAG,EAAA;AACnC,QAAA,MAAM,QAAW,GAAA,MAAM,YAAa,CAAA,gBAAA,CAAiB,aAAa,CAAA;AAClE,QAAY,WAAA,CAAA,GAAA,CAAI,aAAe,EAAA,QAAA,EAAU,MAAM,CAAA;AAAA;AAEjD,MAAO,OAAA,WAAA;AAAA,KACT;AAAA,IACA,OAAQ,CAAA,OAAA,iBAAY,IAAA,GAAA,EAAiC;AAAA,GACvD;AACF;AAEgB,SAAA,iBAAA,CACd,iBACA,WACiB,EAAA;AACjB,EAAM,MAAA,cAAA,GAAkC,EAAE,GAAG,eAAgB,EAAA;AAC7D,EAAA,cAAA,CAAe,eACb,WAAY,CAAA,YAAA,IAAA,iBAAoB,IAAA,IAAA,IAAO,WAAY,EAAA;AACrD,EAAA,cAAA,CAAe,aAAa,WAAY,CAAA,UAAA;AACxC,EAAe,cAAA,CAAA,WAAA,GACb,WAAY,CAAA,WAAA,IAAe,eAAgB,CAAA,WAAA;AAC7C,EAAA,cAAA,CAAe,gBAAgB,WAAY,CAAA,aAAA;AAC3C,EAAA,cAAA,CAAe,SAAS,WAAY,CAAA,MAAA;AACpC,EAAO,OAAA,cAAA;AACT;AAEsB,eAAA,uBAAA,CACpB,mBACA,EAAA,kBAAA,EACA,IACwD,EAAA;AACxD,EAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,IACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,IAChD,gBAAgB,mBAAoB,CAAA;AAAA,GACrC,CAAA;AAED,EAAM,MAAA,IAAA,GACJ,MAAM,kBAAmB,CAAA,qBAAA;AAAA,IACvB,mBAAoB,CAAA,QAAA;AAAA,IACpB;AAAA,GACF;AACF,EAAI,IAAA,CAAC,MAAM,WAAa,EAAA;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,oBAAoB,QAAQ,CAAA;AAAA,KAC1E;AAAA;AAGF,EAAA,MAAM,WAA6B,EAAC;AACpC,EAAW,KAAA,MAAA,MAAA,IAAU,oBAAoB,iBAAmB,EAAA;AAC1D,IAAM,MAAA,IAAA,GAAO,KAAK,WAAY,CAAA,IAAA;AAAA,MAC5B,CACE,UAAA,KAAA,UAAA,CAAW,IAAS,KAAA,UAAA,KACnB,MAAW,KAAA,UAAA,CAAW,UAAW,CAAA,MAAA,IAC/B,MAAW,KAAA,KAAA,IAAS,UAAW,CAAA,UAAA,CAAW,MAAW,KAAA,SAAA;AAAA,KAC5D;AACA,IAAA,IAAI,CAAC,IAAM,EAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,uEACE,mBAAoB,CAAA,YACtB,gBAAgB,IAAK,CAAA,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,OACxC;AAAA;AAEF,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,IAAK,CAAA,IAAA,EAAM,QAAQ,CAAA;AAAA;AAG3C,EAAO,OAAA;AAAA,IACL,GAAG,mBAAA;AAAA,IACH,iBAAmB,EAAA;AAAA,GACrB;AACF;AAEO,SAAS,SAAS,KAAiB,EAAA;AACxC,EAAI,IAAAC,cAAA,CAAQ,KAAK,CAAG,EAAA;AAClB,IAAA,OAAOH,aAAO,CAAA,KAAA,CAAM,GAAI,CAAA,QAAQ,CAAC,CAAA;AAAA,GACnC,MAAA,IAAWI,oBAAc,CAAA,KAAK,CAAG,EAAA;AAC/B,IAAO,OAAAC,gBAAA;AAAA,MACLL,aAAA;AAAA,QACEC,cAAQ,CAAA,KAAK,CAAE,CAAA,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAqB,CAAC,CAAA,EAAG,QAAS,CAAA,CAAC,CAAC,CAAC,CAAA;AAAA,QAC9D;AAAA;AACF,KACF;AAAA;AAEF,EAAO,OAAA,KAAA;AACT;AAEgB,SAAA,aAAA,CAAc,MAAW,IAAoB,EAAA;AAC3D,EAAA,OAAOC,eAAQ,QAAS,CAAA,IAAI,CAAG,EAAA,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/C;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"helper.cjs.js","sources":["../src/helper.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { AuditorService, AuthService } from '@backstage/backend-plugin-api';\nimport type { MetadataResponse } from '@backstage/plugin-permission-node';\n\nimport {\n  difference,\n  fromPairs,\n  isArray,\n  isEqual,\n  isPlainObject,\n  omitBy,\n  sortBy,\n  toPairs,\n  ValueKeyIteratee,\n} from 'lodash';\n\nimport {\n  PermissionAction,\n  PermissionInfo,\n  RoleBasedPolicy,\n  RoleConditionalPolicyDecision,\n  Source,\n} from '@backstage-community/plugin-rbac-common';\n\nimport { ActionType, RoleEvents } from './auditor/auditor';\nimport { RoleMetadataDao, RoleMetadataStorage } from './database/role-metadata';\nimport { EnforcerDelegate } from './service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from './service/plugin-endpoints';\n\nexport function policyToString(policy: string[]): string {\n  return `[${policy.join(', ')}]`;\n}\n\nexport function typedPolicyToString(policy: string[], type: string): string {\n  return `${type}, ${policy.join(', ')}`;\n}\n\nexport function policiesToString(policies: string[][]): string {\n  const policiesString = policies\n    .map(policy => policyToString(policy))\n    .join(',');\n  return `[${policiesString}]`;\n}\n\nexport function typedPoliciesToString(\n  policies: string[][],\n  type: string,\n): string {\n  const policiesString = policies\n    .map(policy => {\n      return policy.length !== 0 ? typedPolicyToString(policy, type) : '';\n    })\n    .join('\\n');\n  return `\n    ${policiesString}\n  `;\n}\n\nexport function metadataStringToPolicy(policy: string): string[] {\n  return policy.replace('[', '').replace(']', '').split(', ');\n}\n\nexport async function removeTheDifference(\n  originalGroup: string[],\n  addedGroup: string[],\n  source: Source,\n  roleEntityRef: string,\n  enf: EnforcerDelegate,\n  auditor: AuditorService,\n  modifiedBy: string,\n): Promise<void> {\n  originalGroup.sort((a, b) => a.localeCompare(b));\n  addedGroup.sort((a, b) => a.localeCompare(b));\n  const missing = difference(originalGroup, addedGroup);\n\n  const groupPolicies: string[][] = [];\n  for (const missingRole of missing) {\n    groupPolicies.push([missingRole, roleEntityRef]);\n  }\n\n  if (groupPolicies.length === 0) {\n    return;\n  }\n\n  const roleMetadata = { source, modifiedBy, roleEntityRef };\n  const existingMembers = await enf.getFilteredGroupingPolicy(1, roleEntityRef);\n  const actionType =\n    existingMembers.length === missing.length\n      ? ActionType.DELETE\n      : ActionType.UPDATE;\n  const auditorMeta = {\n    ...roleMetadata,\n    members: groupPolicies.map(gp => gp[0]),\n  };\n  const auditorEvent = await auditor.createEvent({\n    eventId: RoleEvents.ROLE_WRITE,\n    severityLevel: 'medium',\n    meta: { actionType, source: auditorMeta.source },\n  });\n\n  try {\n    await enf.removeGroupingPolicies(groupPolicies, roleMetadata, false);\n    await auditorEvent.success({ meta: auditorMeta });\n  } catch (error) {\n    await auditorEvent.fail({\n      error,\n      meta: auditorMeta,\n    });\n    throw error;\n  }\n}\n\nexport function transformArrayToPolicy(policyArray: string[]): RoleBasedPolicy {\n  const [entityReference, permission, policy, effect] = policyArray;\n  return { entityReference, permission, policy, effect };\n}\n\nexport function transformPolicyGroupToLowercase(policyArray: string[]) {\n  if (\n    policyArray.length > 1 &&\n    policyArray[0].startsWith('g') &&\n    (policyArray[1].startsWith('user') || policyArray[1].startsWith('group'))\n  ) {\n    policyArray[1] = policyArray[1].toLocaleLowerCase('en-US');\n  }\n}\n\nexport function transformRolesGroupToLowercase(roles: string[][]) {\n  return roles.map(role =>\n    role.length >= 1\n      ? [role[0].toLocaleLowerCase('en-US'), ...role.slice(1)]\n      : role,\n  );\n}\n\nexport function deepSortedEqual(\n  obj1: Record<string, any>,\n  obj2: Record<string, any>,\n  excludeFields?: string[],\n): boolean {\n  let copyObj1;\n  let copyObj2;\n  if (excludeFields) {\n    const excludeFieldsPredicate: ValueKeyIteratee<any> = (_value, key) => {\n      for (const field of excludeFields) {\n        if (key === field) {\n          return true;\n        }\n      }\n      return false;\n    };\n    copyObj1 = omitBy(obj1, excludeFieldsPredicate);\n    copyObj2 = omitBy(obj2, excludeFieldsPredicate);\n  }\n\n  const sortedObj1 = sortBy(toPairs(copyObj1 || obj1), ([key]) => key);\n  const sortedObj2 = sortBy(toPairs(copyObj2 || obj2), ([key]) => key);\n\n  return isEqual(sortedObj1, sortedObj2);\n}\n\nexport function isPermissionAction(action: string): action is PermissionAction {\n  return ['create', 'read', 'update', 'delete', 'use'].includes(\n    action as PermissionAction,\n  );\n}\n\nexport async function buildRoleSourceMap(\n  policies: string[][],\n  roleMetadata: RoleMetadataStorage,\n): Promise<Map<string, Source | undefined>> {\n  return await policies.reduce(\n    async (\n      acc: Promise<Map<string, Source | undefined>>,\n      policy: string[],\n    ): Promise<Map<string, Source | undefined>> => {\n      const roleEntityRef = policy[0];\n      const acummulator = await acc;\n      if (!acummulator.has(roleEntityRef)) {\n        const metadata = await roleMetadata.findRoleMetadata(roleEntityRef);\n        acummulator.set(roleEntityRef, metadata?.source);\n      }\n      return acummulator;\n    },\n    Promise.resolve(new Map<string, Source | undefined>()),\n  );\n}\n\nexport function mergeRoleMetadata(\n  currentMetadata: RoleMetadataDao,\n  newMetadata: RoleMetadataDao,\n): RoleMetadataDao {\n  const mergedMetaData: RoleMetadataDao = { ...currentMetadata };\n  mergedMetaData.lastModified =\n    newMetadata.lastModified ?? new Date().toUTCString();\n  mergedMetaData.modifiedBy = newMetadata.modifiedBy;\n  mergedMetaData.description =\n    newMetadata.description ?? currentMetadata.description;\n  mergedMetaData.roleEntityRef = newMetadata.roleEntityRef;\n  mergedMetaData.source = newMetadata.source;\n  return mergedMetaData;\n}\n\nexport async function processConditionMapping(\n  roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction>,\n  pluginPermMetaData: PluginPermissionMetadataCollector,\n  auth: AuthService,\n): Promise<RoleConditionalPolicyDecision<PermissionInfo>> {\n  const { token } = await auth.getPluginRequestToken({\n    onBehalfOf: await auth.getOwnServiceCredentials(),\n    targetPluginId: roleConditionPolicy.pluginId,\n  });\n\n  const rule: MetadataResponse | undefined =\n    await pluginPermMetaData.getMetadataByPluginId(\n      roleConditionPolicy.pluginId,\n      token,\n    );\n  if (!rule?.permissions) {\n    throw new Error(\n      `Unable to get permission list for plugin ${roleConditionPolicy.pluginId}`,\n    );\n  }\n\n  const permInfo: PermissionInfo[] = [];\n  for (const action of roleConditionPolicy.permissionMapping) {\n    const perm = rule.permissions.find(\n      permission =>\n        permission.type === 'resource' &&\n        (action === permission.attributes.action ||\n          (action === 'use' && permission.attributes.action === undefined)),\n    );\n    if (!perm) {\n      throw new Error(\n        `Unable to find permission to get permission name for resource type '${\n          roleConditionPolicy.resourceType\n        }' and action ${JSON.stringify(action)}`,\n      );\n    }\n    permInfo.push({ name: perm.name, action });\n  }\n\n  return {\n    ...roleConditionPolicy,\n    permissionMapping: permInfo,\n  };\n}\n\nexport function deepSort(value: any): any {\n  if (isArray(value)) {\n    return sortBy(value.map(deepSort));\n  } else if (isPlainObject(value)) {\n    return fromPairs(\n      sortBy(\n        toPairs(value).map(([k, v]: [string, any]) => [k, deepSort(v)]),\n        0,\n      ),\n    );\n  }\n  return value;\n}\n\nexport function deepSortEqual(obj1: any, obj2: any): boolean {\n  return isEqual(deepSort(obj1), deepSort(obj2));\n}\n"],"names":["auditor","difference","ActionType","RoleEvents","omitBy","sortBy","toPairs","isEqual","isArray","isPlainObject","fromPairs"],"mappings":";;;;;AA2CO,SAAS,eAAe,MAA0B,EAAA;AACvD,EAAA,OAAO,CAAI,CAAA,EAAA,MAAA,CAAO,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA,CAAA;AAC9B;AAEgB,SAAA,mBAAA,CAAoB,QAAkB,IAAsB,EAAA;AAC1E,EAAA,OAAO,GAAG,IAAI,CAAA,EAAA,EAAK,MAAO,CAAA,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACtC;AAEO,SAAS,iBAAiB,QAA8B,EAAA;AAC7D,EAAM,MAAA,cAAA,GAAiB,SACpB,GAAI,CAAA,CAAA,MAAA,KAAU,eAAe,MAAM,CAAC,CACpC,CAAA,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,IAAI,cAAc,CAAA,CAAA,CAAA;AAC3B;AAEgB,SAAA,qBAAA,CACd,UACA,IACQ,EAAA;AACR,EAAM,MAAA,cAAA,GAAiB,QACpB,CAAA,GAAA,CAAI,CAAU,MAAA,KAAA;AACb,IAAA,OAAO,OAAO,MAAW,KAAA,CAAA,GAAI,mBAAoB,CAAA,MAAA,EAAQ,IAAI,CAAI,GAAA,EAAA;AAAA,GAClE,CACA,CAAA,IAAA,CAAK,IAAI,CAAA;AACZ,EAAO,OAAA;AAAA,IAAA,EACH,cAAc;AAAA,EAAA,CAAA;AAEpB;AAEO,SAAS,uBAAuB,MAA0B,EAAA;AAC/D,EAAO,OAAA,MAAA,CAAO,OAAQ,CAAA,GAAA,EAAK,EAAE,CAAA,CAAE,QAAQ,GAAK,EAAA,EAAE,CAAE,CAAA,KAAA,CAAM,IAAI,CAAA;AAC5D;AAEA,eAAsB,oBACpB,aACA,EAAA,UAAA,EACA,QACA,aACA,EAAA,GAAA,EACAA,WACA,UACe,EAAA;AACf,EAAA,aAAA,CAAc,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/C,EAAA,UAAA,CAAW,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC5C,EAAM,MAAA,OAAA,GAAUC,iBAAW,CAAA,aAAA,EAAe,UAAU,CAAA;AAEpD,EAAA,MAAM,gBAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,eAAe,OAAS,EAAA;AACjC,IAAA,aAAA,CAAc,IAAK,CAAA,CAAC,WAAa,EAAA,aAAa,CAAC,CAAA;AAAA;AAGjD,EAAI,IAAA,aAAA,CAAc,WAAW,CAAG,EAAA;AAC9B,IAAA;AAAA;AAGF,EAAA,MAAM,YAAe,GAAA,EAAE,MAAQ,EAAA,UAAA,EAAY,aAAc,EAAA;AACzD,EAAA,MAAM,eAAkB,GAAA,MAAM,GAAI,CAAA,yBAAA,CAA0B,GAAG,aAAa,CAAA;AAC5E,EAAA,MAAM,aACJ,eAAgB,CAAA,MAAA,KAAW,QAAQ,MAC/B,GAAAC,kBAAA,CAAW,SACXA,kBAAW,CAAA,MAAA;AACjB,EAAA,MAAM,WAAc,GAAA;AAAA,IAClB,GAAG,YAAA;AAAA,IACH,SAAS,aAAc,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,GACxC;AACA,EAAM,MAAA,YAAA,GAAe,MAAMF,SAAA,CAAQ,WAAY,CAAA;AAAA,IAC7C,SAASG,kBAAW,CAAA,UAAA;AAAA,IACpB,aAAe,EAAA,QAAA;AAAA,IACf,IAAM,EAAA,EAAE,UAAY,EAAA,MAAA,EAAQ,YAAY,MAAO;AAAA,GAChD,CAAA;AAED,EAAI,IAAA;AACF,IAAA,MAAM,GAAI,CAAA,sBAAA,CAAuB,aAAe,EAAA,YAAA,EAAc,KAAK,CAAA;AACnE,IAAA,MAAM,YAAa,CAAA,OAAA,CAAQ,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,WACzC,KAAO,EAAA;AACd,IAAA,MAAM,aAAa,IAAK,CAAA;AAAA,MACtB,KAAA;AAAA,MACA,IAAM,EAAA;AAAA,KACP,CAAA;AACD,IAAM,MAAA,KAAA;AAAA;AAEV;AAEO,SAAS,uBAAuB,WAAwC,EAAA;AAC7E,EAAA,MAAM,CAAC,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAM,CAAI,GAAA,WAAA;AACtD,EAAA,OAAO,EAAE,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAO,EAAA;AACvD;AAEO,SAAS,gCAAgC,WAAuB,EAAA;AACrE,EACE,IAAA,WAAA,CAAY,SAAS,CACrB,IAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,GAAG,CAC5B,KAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,MAAM,CAAK,IAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,OAAO,CACvE,CAAA,EAAA;AACA,IAAA,WAAA,CAAY,CAAC,CAAI,GAAA,WAAA,CAAY,CAAC,CAAA,CAAE,kBAAkB,OAAO,CAAA;AAAA;AAE7D;AAEO,SAAS,+BAA+B,KAAmB,EAAA;AAChE,EAAA,OAAO,KAAM,CAAA,GAAA;AAAA,IAAI,UACf,IAAK,CAAA,MAAA,IAAU,CACX,GAAA,CAAC,KAAK,CAAC,CAAA,CAAE,iBAAkB,CAAA,OAAO,GAAG,GAAG,IAAA,CAAK,KAAM,CAAA,CAAC,CAAC,CACrD,GAAA;AAAA,GACN;AACF;AAEgB,SAAA,eAAA,CACd,IACA,EAAA,IAAA,EACA,aACS,EAAA;AACT,EAAI,IAAA,QAAA;AACJ,EAAI,IAAA,QAAA;AACJ,EAAA,IAAI,aAAe,EAAA;AACjB,IAAM,MAAA,sBAAA,GAAgD,CAAC,MAAA,EAAQ,GAAQ,KAAA;AACrE,MAAA,KAAA,MAAW,SAAS,aAAe,EAAA;AACjC,QAAA,IAAI,QAAQ,KAAO,EAAA;AACjB,UAAO,OAAA,IAAA;AAAA;AACT;AAEF,MAAO,OAAA,KAAA;AAAA,KACT;AACA,IAAW,QAAA,GAAAC,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAC9C,IAAW,QAAA,GAAAA,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAAA;AAGhD,EAAM,MAAA,UAAA,GAAaC,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AACnE,EAAM,MAAA,UAAA,GAAaD,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AAEnE,EAAO,OAAAC,cAAA,CAAQ,YAAY,UAAU,CAAA;AACvC;AAEO,SAAS,mBAAmB,MAA4C,EAAA;AAC7E,EAAA,OAAO,CAAC,QAAU,EAAA,MAAA,EAAQ,QAAU,EAAA,QAAA,EAAU,KAAK,CAAE,CAAA,QAAA;AAAA,IACnD;AAAA,GACF;AACF;AAEsB,eAAA,kBAAA,CACpB,UACA,YAC0C,EAAA;AAC1C,EAAA,OAAO,MAAM,QAAS,CAAA,MAAA;AAAA,IACpB,OACE,KACA,MAC6C,KAAA;AAC7C,MAAM,MAAA,aAAA,GAAgB,OAAO,CAAC,CAAA;AAC9B,MAAA,MAAM,cAAc,MAAM,GAAA;AAC1B,MAAA,IAAI,CAAC,WAAA,CAAY,GAAI,CAAA,aAAa,CAAG,EAAA;AACnC,QAAA,MAAM,QAAW,GAAA,MAAM,YAAa,CAAA,gBAAA,CAAiB,aAAa,CAAA;AAClE,QAAY,WAAA,CAAA,GAAA,CAAI,aAAe,EAAA,QAAA,EAAU,MAAM,CAAA;AAAA;AAEjD,MAAO,OAAA,WAAA;AAAA,KACT;AAAA,IACA,OAAQ,CAAA,OAAA,iBAAY,IAAA,GAAA,EAAiC;AAAA,GACvD;AACF;AAEgB,SAAA,iBAAA,CACd,iBACA,WACiB,EAAA;AACjB,EAAM,MAAA,cAAA,GAAkC,EAAE,GAAG,eAAgB,EAAA;AAC7D,EAAA,cAAA,CAAe,eACb,WAAY,CAAA,YAAA,IAAA,iBAAoB,IAAA,IAAA,IAAO,WAAY,EAAA;AACrD,EAAA,cAAA,CAAe,aAAa,WAAY,CAAA,UAAA;AACxC,EAAe,cAAA,CAAA,WAAA,GACb,WAAY,CAAA,WAAA,IAAe,eAAgB,CAAA,WAAA;AAC7C,EAAA,cAAA,CAAe,gBAAgB,WAAY,CAAA,aAAA;AAC3C,EAAA,cAAA,CAAe,SAAS,WAAY,CAAA,MAAA;AACpC,EAAO,OAAA,cAAA;AACT;AAEsB,eAAA,uBAAA,CACpB,mBACA,EAAA,kBAAA,EACA,IACwD,EAAA;AACxD,EAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,IACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,IAChD,gBAAgB,mBAAoB,CAAA;AAAA,GACrC,CAAA;AAED,EAAM,MAAA,IAAA,GACJ,MAAM,kBAAmB,CAAA,qBAAA;AAAA,IACvB,mBAAoB,CAAA,QAAA;AAAA,IACpB;AAAA,GACF;AACF,EAAI,IAAA,CAAC,MAAM,WAAa,EAAA;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,oBAAoB,QAAQ,CAAA;AAAA,KAC1E;AAAA;AAGF,EAAA,MAAM,WAA6B,EAAC;AACpC,EAAW,KAAA,MAAA,MAAA,IAAU,oBAAoB,iBAAmB,EAAA;AAC1D,IAAM,MAAA,IAAA,GAAO,KAAK,WAAY,CAAA,IAAA;AAAA,MAC5B,CACE,UAAA,KAAA,UAAA,CAAW,IAAS,KAAA,UAAA,KACnB,MAAW,KAAA,UAAA,CAAW,UAAW,CAAA,MAAA,IAC/B,MAAW,KAAA,KAAA,IAAS,UAAW,CAAA,UAAA,CAAW,MAAW,KAAA,SAAA;AAAA,KAC5D;AACA,IAAA,IAAI,CAAC,IAAM,EAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,uEACE,mBAAoB,CAAA,YACtB,gBAAgB,IAAK,CAAA,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,OACxC;AAAA;AAEF,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,IAAK,CAAA,IAAA,EAAM,QAAQ,CAAA;AAAA;AAG3C,EAAO,OAAA;AAAA,IACL,GAAG,mBAAA;AAAA,IACH,iBAAmB,EAAA;AAAA,GACrB;AACF;AAEO,SAAS,SAAS,KAAiB,EAAA;AACxC,EAAI,IAAAC,cAAA,CAAQ,KAAK,CAAG,EAAA;AAClB,IAAA,OAAOH,aAAO,CAAA,KAAA,CAAM,GAAI,CAAA,QAAQ,CAAC,CAAA;AAAA,GACnC,MAAA,IAAWI,oBAAc,CAAA,KAAK,CAAG,EAAA;AAC/B,IAAO,OAAAC,gBAAA;AAAA,MACLL,aAAA;AAAA,QACEC,cAAQ,CAAA,KAAK,CAAE,CAAA,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAqB,CAAC,CAAA,EAAG,QAAS,CAAA,CAAC,CAAC,CAAC,CAAA;AAAA,QAC9D;AAAA;AACF,KACF;AAAA;AAEF,EAAO,OAAA,KAAA;AACT;AAEgB,SAAA,aAAA,CAAc,MAAW,IAAoB,EAAA;AAC3D,EAAA,OAAOC,eAAQ,QAAS,CAAA,IAAI,CAAG,EAAA,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/C;;;;;;;;;;;;;;;;;;;"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
-import { LoggerService, DiscoveryService, AuthService, HttpAuthService, UserInfoService, LifecycleService } from '@backstage/backend-plugin-api';
+import { LoggerService, DiscoveryService, AuthService, HttpAuthService, AuditorService, UserInfoService, LifecycleService } from '@backstage/backend-plugin-api';
 import { Config } from '@backstage/config';
 import express, { Router } from 'express';
 import { PermissionEvaluator } from '@backstage/plugin-permission-common';
@@ -29,6 +29,7 @@ type EnvOptions = {
     permissions: PermissionEvaluator;
     auth: AuthService;
     httpAuth: HttpAuthService;
+    auditor: AuditorService;
     userInfo: UserInfoService;
     lifecycle: LifecycleService;
 };

package/dist/plugin.cjs.js

@@ -32,6 +32,7 @@ const rbacPlugin = backendPluginApi.createBackendPlugin({
         permissions: backendPluginApi.coreServices.permissions,
         auth: backendPluginApi.coreServices.auth,
         httpAuth: backendPluginApi.coreServices.httpAuth,
+        auditor: backendPluginApi.coreServices.auditor,
         userInfo: backendPluginApi.coreServices.userInfo,
         lifecycle: backendPluginApi.coreServices.lifecycle
       },
@@ -43,6 +44,7 @@ const rbacPlugin = backendPluginApi.createBackendPlugin({
         permissions,
         auth,
         httpAuth,
+        auditor,
         userInfo,
         lifecycle
       }) {
@@ -55,6 +57,7 @@ const rbacPlugin = backendPluginApi.createBackendPlugin({
               permissions,
               auth,
               httpAuth,
+              auditor,
               userInfo,
               lifecycle
             },

package/dist/plugin.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\n\nimport { PolicyBuilder } from '@backstage-community/plugin-rbac-backend';\nimport {\n  PluginIdProvider,\n  PluginIdProviderExtensionPoint,\n  pluginIdProviderExtensionPoint,\n  RBACProvider,\n  rbacProviderExtensionPoint,\n} from '@backstage-community/plugin-rbac-node';\n\n/**\n * @public\n * RBAC plugin\n *\n */\nexport const rbacPlugin = createBackendPlugin({\n  pluginId: 'permission',\n  register(env) {\n    const pluginIdProviderExtensionPointImpl = new (class PluginIdProviderImpl\n      implements PluginIdProviderExtensionPoint\n    {\n      pluginIdProviders: PluginIdProvider[] = [];\n\n      addPluginIdProvider(pluginIdProvider: PluginIdProvider): void {\n        this.pluginIdProviders.push(pluginIdProvider);\n      }\n    })();\n\n    env.registerExtensionPoint(\n      pluginIdProviderExtensionPoint,\n      pluginIdProviderExtensionPointImpl,\n    );\n\n    const rbacProviders = new Array<RBACProvider>();\n\n    env.registerExtensionPoint(rbacProviderExtensionPoint, {\n      addRBACProvider(\n        ...providers: Array<RBACProvider | Array<RBACProvider>>\n      ): void {\n        rbacProviders.push(...providers.flat());\n      },\n    });\n\n    env.registerInit({\n      deps: {\n        http: coreServices.httpRouter,\n        config: coreServices.rootConfig,\n        logger: coreServices.logger,\n        discovery: coreServices.discovery,\n        permissions: coreServices.permissions,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        userInfo: coreServices.userInfo,\n        lifecycle: coreServices.lifecycle,\n      },\n      async init({\n        http,\n        config,\n        logger,\n        discovery,\n        permissions,\n        auth,\n        httpAuth,\n        userInfo,\n        lifecycle,\n      }) {\n        http.use(\n          await PolicyBuilder.build(\n            {\n              config,\n              logger,\n              discovery,\n              permissions,\n              auth,\n              httpAuth,\n              userInfo,\n              lifecycle,\n            },\n            {\n              getPluginIds: () =>\n                Array.from(\n                  new Set(\n                    pluginIdProviderExtensionPointImpl.pluginIdProviders.flatMap(\n                      p => p.getPluginIds(),\n                    ),\n                  ),\n                ),\n            },\n            rbacProviders,\n          ),\n        );\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","pluginIdProviderExtensionPoint","rbacProviderExtensionPoint","coreServices","PolicyBuilder"],"mappings":";;;;;;AAkCO,MAAM,aAAaA,oCAAoB,CAAA;AAAA,EAC5C,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAM,MAAA,kCAAA,GAAqC,IAAK,MAAM,oBAEtD,CAAA;AAAA,MACE,oBAAwC,EAAC;AAAA,MAEzC,oBAAoB,gBAA0C,EAAA;AAC5D,QAAK,IAAA,CAAA,iBAAA,CAAkB,KAAK,gBAAgB,CAAA;AAAA;AAC9C,KACC,EAAA;AAEH,IAAI,GAAA,CAAA,sBAAA;AAAA,MACFC,6CAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAM,MAAA,aAAA,GAAgB,IAAI,KAAoB,EAAA;AAE9C,IAAA,GAAA,CAAI,uBAAuBC,yCAA4B,EAAA;AAAA,MACrD,mBACK,SACG,EAAA;AACN,QAAA,aAAA,CAAc,IAAK,CAAA,GAAG,SAAU,CAAA,IAAA,EAAM,CAAA;AAAA;AACxC,KACD,CAAA;AAED,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,MAAMC,6BAAa,CAAA,UAAA;AAAA,QACnB,QAAQA,6BAAa,CAAA,UAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA,MAAA;AAAA,QACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,QACxB,aAAaA,6BAAa,CAAA,WAAA;AAAA,QAC1B,MAAMA,6BAAa,CAAA,IAAA;AAAA,QACnB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,WAAWA,6BAAa,CAAA;AAAA,OAC1B;AAAA,MACA,MAAM,IAAK,CAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,WAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACC,EAAA;AACD,QAAK,IAAA,CAAA,GAAA;AAAA,UACH,MAAMC,+BAAc,CAAA,KAAA;AAAA,YAClB;AAAA,cACE,MAAA;AAAA,cACA,MAAA;AAAA,cACA,SAAA;AAAA,cACA,WAAA;AAAA,cACA,IAAA;AAAA,cACA,QAAA;AAAA,cACA,QAAA;AAAA,cACA;AAAA,aACF;AAAA,YACA;AAAA,cACE,YAAA,EAAc,MACZ,KAAM,CAAA,IAAA;AAAA,gBACJ,IAAI,GAAA;AAAA,kBACF,mCAAmC,iBAAkB,CAAA,OAAA;AAAA,oBACnD,CAAA,CAAA,KAAK,EAAE,YAAa;AAAA;AACtB;AACF;AACF,aACJ;AAAA,YACA;AAAA;AACF,SACF;AAAA;AACF,KACD,CAAA;AAAA;AAEL,CAAC;;;;"}
+{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\n\nimport { PolicyBuilder } from '@backstage-community/plugin-rbac-backend';\nimport {\n  PluginIdProvider,\n  PluginIdProviderExtensionPoint,\n  pluginIdProviderExtensionPoint,\n  RBACProvider,\n  rbacProviderExtensionPoint,\n} from '@backstage-community/plugin-rbac-node';\n\n/**\n * @public\n * RBAC plugin\n *\n */\nexport const rbacPlugin = createBackendPlugin({\n  pluginId: 'permission',\n  register(env) {\n    const pluginIdProviderExtensionPointImpl = new (class PluginIdProviderImpl\n      implements PluginIdProviderExtensionPoint\n    {\n      pluginIdProviders: PluginIdProvider[] = [];\n\n      addPluginIdProvider(pluginIdProvider: PluginIdProvider): void {\n        this.pluginIdProviders.push(pluginIdProvider);\n      }\n    })();\n\n    env.registerExtensionPoint(\n      pluginIdProviderExtensionPoint,\n      pluginIdProviderExtensionPointImpl,\n    );\n\n    const rbacProviders = new Array<RBACProvider>();\n\n    env.registerExtensionPoint(rbacProviderExtensionPoint, {\n      addRBACProvider(\n        ...providers: Array<RBACProvider | Array<RBACProvider>>\n      ): void {\n        rbacProviders.push(...providers.flat());\n      },\n    });\n\n    env.registerInit({\n      deps: {\n        http: coreServices.httpRouter,\n        config: coreServices.rootConfig,\n        logger: coreServices.logger,\n        discovery: coreServices.discovery,\n        permissions: coreServices.permissions,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        auditor: coreServices.auditor,\n        userInfo: coreServices.userInfo,\n        lifecycle: coreServices.lifecycle,\n      },\n      async init({\n        http,\n        config,\n        logger,\n        discovery,\n        permissions,\n        auth,\n        httpAuth,\n        auditor,\n        userInfo,\n        lifecycle,\n      }) {\n        http.use(\n          await PolicyBuilder.build(\n            {\n              config,\n              logger,\n              discovery,\n              permissions,\n              auth,\n              httpAuth,\n              auditor,\n              userInfo,\n              lifecycle,\n            },\n            {\n              getPluginIds: () =>\n                Array.from(\n                  new Set(\n                    pluginIdProviderExtensionPointImpl.pluginIdProviders.flatMap(\n                      p => p.getPluginIds(),\n                    ),\n                  ),\n                ),\n            },\n            rbacProviders,\n          ),\n        );\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","pluginIdProviderExtensionPoint","rbacProviderExtensionPoint","coreServices","PolicyBuilder"],"mappings":";;;;;;AAkCO,MAAM,aAAaA,oCAAoB,CAAA;AAAA,EAC5C,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAM,MAAA,kCAAA,GAAqC,IAAK,MAAM,oBAEtD,CAAA;AAAA,MACE,oBAAwC,EAAC;AAAA,MAEzC,oBAAoB,gBAA0C,EAAA;AAC5D,QAAK,IAAA,CAAA,iBAAA,CAAkB,KAAK,gBAAgB,CAAA;AAAA;AAC9C,KACC,EAAA;AAEH,IAAI,GAAA,CAAA,sBAAA;AAAA,MACFC,6CAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAM,MAAA,aAAA,GAAgB,IAAI,KAAoB,EAAA;AAE9C,IAAA,GAAA,CAAI,uBAAuBC,yCAA4B,EAAA;AAAA,MACrD,mBACK,SACG,EAAA;AACN,QAAA,aAAA,CAAc,IAAK,CAAA,GAAG,SAAU,CAAA,IAAA,EAAM,CAAA;AAAA;AACxC,KACD,CAAA;AAED,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,MAAMC,6BAAa,CAAA,UAAA;AAAA,QACnB,QAAQA,6BAAa,CAAA,UAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA,MAAA;AAAA,QACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,QACxB,aAAaA,6BAAa,CAAA,WAAA;AAAA,QAC1B,MAAMA,6BAAa,CAAA,IAAA;AAAA,QACnB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,SAASA,6BAAa,CAAA,OAAA;AAAA,QACtB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,WAAWA,6BAAa,CAAA;AAAA,OAC1B;AAAA,MACA,MAAM,IAAK,CAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,WAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACC,EAAA;AACD,QAAK,IAAA,CAAA,GAAA;AAAA,UACH,MAAMC,+BAAc,CAAA,KAAA;AAAA,YAClB;AAAA,cACE,MAAA;AAAA,cACA,MAAA;AAAA,cACA,SAAA;AAAA,cACA,WAAA;AAAA,cACA,IAAA;AAAA,cACA,QAAA;AAAA,cACA,OAAA;AAAA,cACA,QAAA;AAAA,cACA;AAAA,aACF;AAAA,YACA;AAAA,cACE,YAAA,EAAc,MACZ,KAAM,CAAA,IAAA;AAAA,gBACJ,IAAI,GAAA;AAAA,kBACF,mCAAmC,iBAAkB,CAAA,OAAA;AAAA,oBACnD,CAAA,CAAA,KAAK,EAAE,YAAa;AAAA;AACtB;AACF;AACF,aACJ;AAAA,YACA;AAAA;AACF,SACF;AAAA;AACF,KACD,CAAA;AAAA;AAEL,CAAC;;;;"}

package/dist/policies/permission-policy.cjs.js

@@ -3,21 +3,20 @@
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var pluginRbacCommon = require('@backstage-community/plugin-rbac-common');
 var adminCreation = require('../admin-permissions/admin-creation.cjs.js');
-var auditLogger = require('../audit-log/audit-logger.cjs.js');
+var auditor = require('../auditor/auditor.cjs.js');
 var aliasResolver = require('../conditional-aliases/alias-resolver.cjs.js');
 var csvFileWatcher = require('../file-permissions/csv-file-watcher.cjs.js');
 var yamlConditionalFileWatcher = require('../file-permissions/yaml-conditional-file-watcher.cjs.js');
 
-const evaluatePermMsg = (userEntityRef, result, permission) => `${userEntityRef} is ${result} for permission '${permission.name}'${pluginPermissionCommon.isResourcePermission(permission) ? `, resource type '${permission.resourceType}'` : ""} and action '${pluginRbacCommon.toPermissionAction(permission.attributes)}'`;
 class RBACPermissionPolicy {
-  constructor(enforcer, auditLogger, conditionStorage, superUserList) {
+  constructor(enforcer, auditor, conditionStorage, superUserList) {
     this.enforcer = enforcer;
-    this.auditLogger = auditLogger;
+    this.auditor = auditor;
     this.conditionStorage = conditionStorage;
     this.superUserList = superUserList;
   }
   superUserList;
-  static async build(logger, auditLogger, configApi, conditionalStorage, enforcerDelegate, roleMetadataStorage, knex, pluginMetadataCollector, auth) {
+  static async build(logger, auditor, configApi, conditionalStorage, enforcerDelegate, roleMetadataStorage, knex, pluginMetadataCollector, auth) {
     const superUserList = [];
     const adminUsers = configApi.getOptionalConfigArray(
       "permission.rbac.admin.users"
@@ -41,11 +40,11 @@ class RBACPermissionPolicy {
     await adminCreation.useAdminsFromConfig(
       adminUsers || [],
       enforcerDelegate,
-      auditLogger,
+      auditor,
       roleMetadataStorage,
       knex
     );
-    await adminCreation.setAdminPermissions(enforcerDelegate, auditLogger);
+    await adminCreation.setAdminPermissions(enforcerDelegate, auditor);
     if ((!adminUsers || adminUsers.length === 0) && (!superUsers || superUsers.length === 0)) {
       logger.warn(
         "There are no admins or super admins configured for the RBAC-backend plugin."
@@ -57,7 +56,7 @@ class RBACPermissionPolicy {
       logger,
       enforcerDelegate,
       roleMetadataStorage,
-      auditLogger
+      auditor
     );
     await csvFile.initialize();
     const conditionalFile = new yamlConditionalFileWatcher.YamlConditinalPoliciesFileWatcher(
@@ -65,7 +64,7 @@ class RBACPermissionPolicy {
       allowReload,
       logger,
       conditionalStorage,
-      auditLogger,
+      auditor,
       auth,
       pluginMetadataCollector,
       roleMetadataStorage,
@@ -82,50 +81,31 @@ class RBACPermissionPolicy {
     }
     return new RBACPermissionPolicy(
       enforcerDelegate,
-      auditLogger,
+      auditor,
       conditionalStorage,
       superUserList
     );
   }
   async handle(request, user) {
     const userEntityRef = user?.info.userEntityRef ?? `user without entity`;
-    let auditOptions = auditLogger.createPermissionEvaluationOptions(
-      `Policy check for ${userEntityRef}`,
+    const auditorEvent = await auditor.createPermissionEvaluationAuditorEvent(
+      this.auditor,
       userEntityRef,
       request
     );
-    await this.auditLogger.auditLog(auditOptions);
     try {
       let status = false;
       const action = pluginRbacCommon.toPermissionAction(request.permission.attributes);
       if (!user) {
-        const msg2 = evaluatePermMsg(
-          userEntityRef,
-          pluginPermissionCommon.AuthorizeResult.DENY,
-          request.permission
-        );
-        auditOptions = auditLogger.createPermissionEvaluationOptions(
-          msg2,
-          userEntityRef,
-          request,
-          { result: pluginPermissionCommon.AuthorizeResult.DENY }
-        );
-        await this.auditLogger.auditLog(auditOptions);
+        await auditorEvent.success({
+          meta: { result: pluginPermissionCommon.AuthorizeResult.DENY }
+        });
         return { result: pluginPermissionCommon.AuthorizeResult.DENY };
       }
       if (this.superUserList.includes(userEntityRef)) {
-        const msg2 = evaluatePermMsg(
-          userEntityRef,
-          pluginPermissionCommon.AuthorizeResult.ALLOW,
-          request.permission
-        );
-        auditOptions = auditLogger.createPermissionEvaluationOptions(
-          msg2,
-          userEntityRef,
-          request,
-          { result: pluginPermissionCommon.AuthorizeResult.ALLOW }
-        );
-        await this.auditLogger.auditLog(auditOptions);
+        await auditorEvent.success({
+          meta: { result: pluginPermissionCommon.AuthorizeResult.ALLOW }
+        });
         return { result: pluginPermissionCommon.AuthorizeResult.ALLOW };
       }
       const permissionName = request.permission.name;
@@ -134,6 +114,7 @@ class RBACPermissionPolicy {
         const resourceType = request.permission.resourceType;
         if (user) {
           const conditionResult = await this.handleConditions(
+            auditorEvent,
             userEntityRef,
             request,
             roles,
@@ -159,22 +140,12 @@ class RBACPermissionPolicy {
         );
       }
       const result = status ? pluginPermissionCommon.AuthorizeResult.ALLOW : pluginPermissionCommon.AuthorizeResult.DENY;
-      const msg = evaluatePermMsg(userEntityRef, result, request.permission);
-      auditOptions = auditLogger.createPermissionEvaluationOptions(
-        msg,
-        userEntityRef,
-        request,
-        { result }
-      );
-      await this.auditLogger.auditLog(auditOptions);
+      await auditorEvent.success({ meta: { result } });
       return { result };
     } catch (error) {
-      await this.auditLogger.auditLog({
-        message: "Permission policy check failed",
-        eventName: auditLogger.EvaluationEvents.PERMISSION_EVALUATION_FAILED,
-        stage: auditLogger.EVALUATE_PERMISSION_ACCESS_STAGE,
-        status: "failed",
-        errors: [error]
+      await auditorEvent.fail({
+        error,
+        meta: { result: pluginPermissionCommon.AuthorizeResult.DENY }
       });
       return { result: pluginPermissionCommon.AuthorizeResult.DENY };
     }
@@ -196,7 +167,7 @@ class RBACPermissionPolicy {
   isAuthorized = async (userIdentity, permission, action, roles) => {
     return await this.enforcer.enforce(userIdentity, permission, action, roles);
   };
-  async handleConditions(userEntityRef, request, roles, userInfo) {
+  async handleConditions(auditorEvent, userEntityRef, request, roles, userInfo) {
     const permissionName = request.permission.name;
     const resourceType = request.permission.resourceType;
     const action = pluginRbacCommon.toPermissionAction(request.permission.attributes);
@@ -215,16 +186,14 @@ class RBACPermissionPolicy {
         conditions.push(conditionalDecisions[0].conditions);
       }
       if (conditionalDecisions.length > 1) {
-        const msg = `Detected ${JSON.stringify(
-          conditionalDecisions
-        )} collisions for conditional policies. Expected to find a stored single condition for permission with name ${permissionName}, resource type ${resourceType}, action ${action} for user ${userEntityRef}`;
-        const auditOptions = auditLogger.createPermissionEvaluationOptions(
-          msg,
-          userEntityRef,
-          request,
-          { result: pluginPermissionCommon.AuthorizeResult.DENY }
-        );
-        await this.auditLogger.auditLog(auditOptions);
+        await auditorEvent.fail({
+          error: new Error(
+            `Detected ${JSON.stringify(
+              conditionalDecisions
+            )} collisions for conditional policies. Expected to find a stored single condition for permission with name ${permissionName}, resource type ${resourceType}, action ${action} for user ${userEntityRef}`
+          ),
+          meta: { result: pluginPermissionCommon.AuthorizeResult.DENY }
+        });
         return {
           result: pluginPermissionCommon.AuthorizeResult.DENY
         };
@@ -240,14 +209,7 @@ class RBACPermissionPolicy {
         }
       };
       aliasResolver.replaceAliases(result.conditions, userInfo);
-      const msg = `Send condition to plugin with id ${pluginId} to evaluate permission ${permissionName} with resource type ${resourceType} and action ${action} for user ${userEntityRef}`;
-      const auditOptions = auditLogger.createPermissionEvaluationOptions(
-        msg,
-        userEntityRef,
-        request,
-        result
-      );
-      await this.auditLogger.auditLog(auditOptions);
+      await auditorEvent.success({ meta: { ...result } });
       return result;
     }
     return undefined;

package/dist/policies/permission-policy.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-policy.cjs.js","sources":["../../src/policies/permission-policy.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type {\n  AuthService,\n  BackstageUserInfo,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport type { ConfigApi } from '@backstage/core-plugin-api';\nimport {\n  AuthorizeResult,\n  ConditionalPolicyDecision,\n  isResourcePermission,\n  Permission,\n  PermissionCondition,\n  PermissionCriteria,\n  PermissionRuleParams,\n  PolicyDecision,\n  ResourcePermission,\n} from '@backstage/plugin-permission-common';\nimport type {\n  PermissionPolicy,\n  PolicyQuery,\n  PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport type { Knex } from 'knex';\n\nimport {\n  NonEmptyArray,\n  toPermissionAction,\n} from '@backstage-community/plugin-rbac-common';\n\nimport {\n  setAdminPermissions,\n  useAdminsFromConfig,\n} from '../admin-permissions/admin-creation';\nimport {\n  createPermissionEvaluationOptions,\n  EVALUATE_PERMISSION_ACCESS_STAGE,\n  EvaluationEvents,\n} from '../audit-log/audit-logger';\nimport { replaceAliases } from '../conditional-aliases/alias-resolver';\nimport { ConditionalStorage } from '../database/conditional-storage';\nimport { RoleMetadataStorage } from '../database/role-metadata';\nimport { CSVFileWatcher } from '../file-permissions/csv-file-watcher';\nimport { YamlConditinalPoliciesFileWatcher } from '../file-permissions/yaml-conditional-file-watcher';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from '../service/plugin-endpoints';\n\nconst evaluatePermMsg = (\n  userEntityRef: string | undefined,\n  result: AuthorizeResult,\n  permission: Permission,\n) =>\n  `${userEntityRef} is ${result} for permission '${permission.name}'${\n    isResourcePermission(permission)\n      ? `, resource type '${permission.resourceType}'`\n      : ''\n  } and action '${toPermissionAction(permission.attributes)}'`;\n\nexport class RBACPermissionPolicy implements PermissionPolicy {\n  private readonly superUserList?: string[];\n\n  public static async build(\n    logger: LoggerService,\n    auditLogger: AuditLogger,\n    configApi: ConfigApi,\n    conditionalStorage: ConditionalStorage,\n    enforcerDelegate: EnforcerDelegate,\n    roleMetadataStorage: RoleMetadataStorage,\n    knex: Knex,\n    pluginMetadataCollector: PluginPermissionMetadataCollector,\n    auth: AuthService,\n  ): Promise<RBACPermissionPolicy> {\n    const superUserList: string[] = [];\n    const adminUsers = configApi.getOptionalConfigArray(\n      'permission.rbac.admin.users',\n    );\n\n    const superUsers = configApi.getOptionalConfigArray(\n      'permission.rbac.admin.superUsers',\n    );\n\n    const policiesFile = configApi.getOptionalString(\n      'permission.rbac.policies-csv-file',\n    );\n\n    const allowReload =\n      configApi.getOptionalBoolean('permission.rbac.policyFileReload') || false;\n\n    const conditionalPoliciesFile = configApi.getOptionalString(\n      'permission.rbac.conditionalPoliciesFile',\n    );\n\n    if (superUsers && superUsers.length > 0) {\n      for (const user of superUsers) {\n        const userName = user.getString('name');\n        superUserList.push(userName);\n      }\n    }\n\n    await useAdminsFromConfig(\n      adminUsers || [],\n      enforcerDelegate,\n      auditLogger,\n      roleMetadataStorage,\n      knex,\n    );\n    await setAdminPermissions(enforcerDelegate, auditLogger);\n\n    if (\n      (!adminUsers || adminUsers.length === 0) &&\n      (!superUsers || superUsers.length === 0)\n    ) {\n      logger.warn(\n        'There are no admins or super admins configured for the RBAC-backend plugin.',\n      );\n    }\n\n    const csvFile = new CSVFileWatcher(\n      policiesFile,\n      allowReload,\n      logger,\n      enforcerDelegate,\n      roleMetadataStorage,\n      auditLogger,\n    );\n    await csvFile.initialize();\n\n    const conditionalFile = new YamlConditinalPoliciesFileWatcher(\n      conditionalPoliciesFile,\n      allowReload,\n      logger,\n      conditionalStorage,\n      auditLogger,\n      auth,\n      pluginMetadataCollector,\n      roleMetadataStorage,\n      enforcerDelegate,\n    );\n    await conditionalFile.initialize();\n\n    if (!conditionalPoliciesFile) {\n      // clean up conditional policies corresponding to roles from csv file\n      logger.info('conditional policies file feature was disabled');\n      await conditionalFile.cleanUpConditionalPolicies();\n    }\n    if (!policiesFile) {\n      // remove roles and policies from csv file\n      logger.info('csv policies file feature was disabled');\n      await csvFile.cleanUpRolesAndPolicies();\n    }\n\n    return new RBACPermissionPolicy(\n      enforcerDelegate,\n      auditLogger,\n      conditionalStorage,\n      superUserList,\n    );\n  }\n\n  private constructor(\n    private readonly enforcer: EnforcerDelegate,\n    private readonly auditLogger: AuditLogger,\n    private readonly conditionStorage: ConditionalStorage,\n    superUserList?: string[],\n  ) {\n    this.superUserList = superUserList;\n  }\n\n  async handle(\n    request: PolicyQuery,\n    user?: PolicyQueryUser,\n  ): Promise<PolicyDecision> {\n    const userEntityRef = user?.info.userEntityRef ?? `user without entity`;\n\n    let auditOptions = createPermissionEvaluationOptions(\n      `Policy check for ${userEntityRef}`,\n      userEntityRef,\n      request,\n    );\n    await this.auditLogger.auditLog(auditOptions);\n\n    try {\n      let status = false;\n\n      const action = toPermissionAction(request.permission.attributes);\n      if (!user) {\n        const msg = evaluatePermMsg(\n          userEntityRef,\n          AuthorizeResult.DENY,\n          request.permission,\n        );\n        auditOptions = createPermissionEvaluationOptions(\n          msg,\n          userEntityRef,\n          request,\n          { result: AuthorizeResult.DENY },\n        );\n        await this.auditLogger.auditLog(auditOptions);\n        return { result: AuthorizeResult.DENY };\n      }\n\n      if (this.superUserList!.includes(userEntityRef)) {\n        const msg = evaluatePermMsg(\n          userEntityRef,\n          AuthorizeResult.ALLOW,\n          request.permission,\n        );\n\n        auditOptions = createPermissionEvaluationOptions(\n          msg,\n          userEntityRef,\n          request,\n          { result: AuthorizeResult.ALLOW },\n        );\n        await this.auditLogger.auditLog(auditOptions);\n\n        return { result: AuthorizeResult.ALLOW };\n      }\n\n      const permissionName = request.permission.name;\n      const roles = await this.enforcer.getRolesForUser(userEntityRef);\n\n      if (isResourcePermission(request.permission)) {\n        const resourceType = request.permission.resourceType;\n\n        // handle conditions if they are present\n        if (user) {\n          const conditionResult = await this.handleConditions(\n            userEntityRef,\n            request,\n            roles,\n            user.info,\n          );\n          if (conditionResult) {\n            return conditionResult;\n          }\n        }\n\n        // handle permission with 'resource' type\n        const hasNamedPermission =\n          await this.hasImplicitPermissionSpecifiedByName(\n            permissionName,\n            action,\n            roles,\n          );\n        // Let's set up higher priority for permission specified by name, than by resource type\n        const obj = hasNamedPermission ? permissionName : resourceType;\n\n        status = await this.isAuthorized(userEntityRef, obj, action, roles);\n      } else {\n        // handle permission with 'basic' type\n        status = await this.isAuthorized(\n          userEntityRef,\n          permissionName,\n          action,\n          roles,\n        );\n      }\n\n      const result = status ? AuthorizeResult.ALLOW : AuthorizeResult.DENY;\n\n      const msg = evaluatePermMsg(userEntityRef, result, request.permission);\n      auditOptions = createPermissionEvaluationOptions(\n        msg,\n        userEntityRef,\n        request,\n        { result },\n      );\n      await this.auditLogger.auditLog(auditOptions);\n      return { result };\n    } catch (error) {\n      await this.auditLogger.auditLog({\n        message: 'Permission policy check failed',\n        eventName: EvaluationEvents.PERMISSION_EVALUATION_FAILED,\n        stage: EVALUATE_PERMISSION_ACCESS_STAGE,\n        status: 'failed',\n        errors: [error],\n      });\n      return { result: AuthorizeResult.DENY };\n    }\n  }\n\n  private async hasImplicitPermissionSpecifiedByName(\n    permissionName: string,\n    action: string,\n    roles: string[],\n  ): Promise<boolean> {\n    for (const role of roles) {\n      const perms = await this.enforcer.getFilteredPolicy(\n        0,\n        role,\n        permissionName,\n        action,\n      );\n      if (perms.length > 0) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  private isAuthorized = async (\n    userIdentity: string,\n    permission: string,\n    action: string,\n    roles: string[],\n  ): Promise<boolean> => {\n    return await this.enforcer.enforce(userIdentity, permission, action, roles);\n  };\n\n  private async handleConditions(\n    userEntityRef: string,\n    request: PolicyQuery,\n    roles: string[],\n    userInfo: BackstageUserInfo,\n  ): Promise<PolicyDecision | undefined> {\n    const permissionName = request.permission.name;\n    const resourceType = (request.permission as ResourcePermission)\n      .resourceType;\n    const action = toPermissionAction(request.permission.attributes);\n\n    const conditions: PermissionCriteria<\n      PermissionCondition<string, PermissionRuleParams>\n    >[] = [];\n    let pluginId = '';\n    for (const role of roles) {\n      const conditionalDecisions = await this.conditionStorage.filterConditions(\n        role,\n        undefined,\n        resourceType,\n        [action],\n        [permissionName],\n      );\n\n      if (conditionalDecisions.length === 1) {\n        pluginId = conditionalDecisions[0].pluginId;\n        conditions.push(conditionalDecisions[0].conditions);\n      }\n\n      // this error is unexpected and should not happen, but just in case handle it.\n      if (conditionalDecisions.length > 1) {\n        const msg = `Detected ${JSON.stringify(\n          conditionalDecisions,\n        )} collisions for conditional policies. Expected to find a stored single condition for permission with name ${permissionName}, resource type ${resourceType}, action ${action} for user ${userEntityRef}`;\n        const auditOptions = createPermissionEvaluationOptions(\n          msg,\n          userEntityRef,\n          request,\n          { result: AuthorizeResult.DENY },\n        );\n        await this.auditLogger.auditLog(auditOptions);\n        return {\n          result: AuthorizeResult.DENY,\n        };\n      }\n    }\n\n    if (conditions.length > 0) {\n      const result: ConditionalPolicyDecision = {\n        pluginId,\n        result: AuthorizeResult.CONDITIONAL,\n        resourceType,\n        conditions: {\n          anyOf: conditions as NonEmptyArray<\n            PermissionCriteria<\n              PermissionCondition<string, PermissionRuleParams>\n            >\n          >,\n        },\n      };\n\n      replaceAliases(result.conditions, userInfo);\n\n      const msg = `Send condition to plugin with id ${pluginId} to evaluate permission ${permissionName} with resource type ${resourceType} and action ${action} for user ${userEntityRef}`;\n      const auditOptions = createPermissionEvaluationOptions(\n        msg,\n        userEntityRef,\n        request,\n        result,\n      );\n      await this.auditLogger.auditLog(auditOptions);\n      return result;\n    }\n    return undefined;\n  }\n}\n"],"names":["isResourcePermission","toPermissionAction","useAdminsFromConfig","setAdminPermissions","CSVFileWatcher","YamlConditinalPoliciesFileWatcher","createPermissionEvaluationOptions","msg","AuthorizeResult","EvaluationEvents","EVALUATE_PERMISSION_ACCESS_STAGE","replaceAliases"],"mappings":";;;;;;;;;;AA+DA,MAAM,eAAA,GAAkB,CACtB,aAAA,EACA,MACA,EAAA,UAAA,KAEA,GAAG,aAAa,CAAA,IAAA,EAAO,MAAM,CAAA,iBAAA,EAAoB,UAAW,CAAA,IAAI,IAC9DA,2CAAqB,CAAA,UAAU,CAC3B,GAAA,CAAA,iBAAA,EAAoB,UAAW,CAAA,YAAY,CAC3C,CAAA,CAAA,GAAA,EACN,CAAgB,aAAA,EAAAC,mCAAA,CAAmB,UAAW,CAAA,UAAU,CAAC,CAAA,CAAA,CAAA;AAEpD,MAAM,oBAAiD,CAAA;AAAA,EAqGpD,WACW,CAAA,QAAA,EACA,WACA,EAAA,gBAAA,EACjB,aACA,EAAA;AAJiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAGjB,IAAA,IAAA,CAAK,aAAgB,GAAA,aAAA;AAAA;AACvB,EA3GiB,aAAA;AAAA,EAEjB,aAAoB,KAClB,CAAA,MAAA,EACA,WACA,EAAA,SAAA,EACA,oBACA,gBACA,EAAA,mBAAA,EACA,IACA,EAAA,uBAAA,EACA,IAC+B,EAAA;AAC/B,IAAA,MAAM,gBAA0B,EAAC;AACjC,IAAA,MAAM,aAAa,SAAU,CAAA,sBAAA;AAAA,MAC3B;AAAA,KACF;AAEA,IAAA,MAAM,aAAa,SAAU,CAAA,sBAAA;AAAA,MAC3B;AAAA,KACF;AAEA,IAAA,MAAM,eAAe,SAAU,CAAA,iBAAA;AAAA,MAC7B;AAAA,KACF;AAEA,IAAA,MAAM,WACJ,GAAA,SAAA,CAAU,kBAAmB,CAAA,kCAAkC,CAAK,IAAA,KAAA;AAEtE,IAAA,MAAM,0BAA0B,SAAU,CAAA,iBAAA;AAAA,MACxC;AAAA,KACF;AAEA,IAAI,IAAA,UAAA,IAAc,UAAW,CAAA,MAAA,GAAS,CAAG,EAAA;AACvC,MAAA,KAAA,MAAW,QAAQ,UAAY,EAAA;AAC7B,QAAM,MAAA,QAAA,GAAW,IAAK,CAAA,SAAA,CAAU,MAAM,CAAA;AACtC,QAAA,aAAA,CAAc,KAAK,QAAQ,CAAA;AAAA;AAC7B;AAGF,IAAM,MAAAC,iCAAA;AAAA,MACJ,cAAc,EAAC;AAAA,MACf,gBAAA;AAAA,MACA,WAAA;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAM,MAAAC,iCAAA,CAAoB,kBAAkB,WAAW,CAAA;AAEvD,IACG,IAAA,CAAA,CAAC,cAAc,UAAW,CAAA,MAAA,KAAW,OACrC,CAAC,UAAA,IAAc,UAAW,CAAA,MAAA,KAAW,CACtC,CAAA,EAAA;AACA,MAAO,MAAA,CAAA,IAAA;AAAA,QACL;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,UAAU,IAAIC,6BAAA;AAAA,MAClB,YAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA;AAAA,MACA,gBAAA;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,QAAQ,UAAW,EAAA;AAEzB,IAAA,MAAM,kBAAkB,IAAIC,4DAAA;AAAA,MAC1B,uBAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA;AAAA,MACA,uBAAA;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,gBAAgB,UAAW,EAAA;AAEjC,IAAA,IAAI,CAAC,uBAAyB,EAAA;AAE5B,MAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAC5D,MAAA,MAAM,gBAAgB,0BAA2B,EAAA;AAAA;AAEnD,IAAA,IAAI,CAAC,YAAc,EAAA;AAEjB,MAAA,MAAA,CAAO,KAAK,wCAAwC,CAAA;AACpD,MAAA,MAAM,QAAQ,uBAAwB,EAAA;AAAA;AAGxC,IAAA,OAAO,IAAI,oBAAA;AAAA,MACT,gBAAA;AAAA,MACA,WAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACF;AAAA;AACF,EAWA,MAAM,MACJ,CAAA,OAAA,EACA,IACyB,EAAA;AACzB,IAAM,MAAA,aAAA,GAAgB,IAAM,EAAA,IAAA,CAAK,aAAiB,IAAA,CAAA,mBAAA,CAAA;AAElD,IAAA,IAAI,YAAe,GAAAC,6CAAA;AAAA,MACjB,oBAAoB,aAAa,CAAA,CAAA;AAAA,MACjC,aAAA;AAAA,MACA;AAAA,KACF;AACA,IAAM,MAAA,IAAA,CAAK,WAAY,CAAA,QAAA,CAAS,YAAY,CAAA;AAE5C,IAAI,IAAA;AACF,MAAA,IAAI,MAAS,GAAA,KAAA;AAEb,MAAA,MAAM,MAAS,GAAAL,mCAAA,CAAmB,OAAQ,CAAA,UAAA,CAAW,UAAU,CAAA;AAC/D,MAAA,IAAI,CAAC,IAAM,EAAA;AACT,QAAA,MAAMM,IAAM,GAAA,eAAA;AAAA,UACV,aAAA;AAAA,UACAC,sCAAgB,CAAA,IAAA;AAAA,UAChB,OAAQ,CAAA;AAAA,SACV;AACA,QAAe,YAAA,GAAAF,6CAAA;AAAA,UACbC,IAAAA;AAAA,UACA,aAAA;AAAA,UACA,OAAA;AAAA,UACA,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,IAAK;AAAA,SACjC;AACA,QAAM,MAAA,IAAA,CAAK,WAAY,CAAA,QAAA,CAAS,YAAY,CAAA;AAC5C,QAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,IAAK,EAAA;AAAA;AAGxC,MAAA,IAAI,IAAK,CAAA,aAAA,CAAe,QAAS,CAAA,aAAa,CAAG,EAAA;AAC/C,QAAA,MAAMD,IAAM,GAAA,eAAA;AAAA,UACV,aAAA;AAAA,UACAC,sCAAgB,CAAA,KAAA;AAAA,UAChB,OAAQ,CAAA;AAAA,SACV;AAEA,QAAe,YAAA,GAAAF,6CAAA;AAAA,UACbC,IAAAA;AAAA,UACA,aAAA;AAAA,UACA,OAAA;AAAA,UACA,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,KAAM;AAAA,SAClC;AACA,QAAM,MAAA,IAAA,CAAK,WAAY,CAAA,QAAA,CAAS,YAAY,CAAA;AAE5C,QAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,KAAM,EAAA;AAAA;AAGzC,MAAM,MAAA,cAAA,GAAiB,QAAQ,UAAW,CAAA,IAAA;AAC1C,MAAA,MAAM,KAAQ,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,gBAAgB,aAAa,CAAA;AAE/D,MAAI,IAAAR,2CAAA,CAAqB,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC5C,QAAM,MAAA,YAAA,GAAe,QAAQ,UAAW,CAAA,YAAA;AAGxC,QAAA,IAAI,IAAM,EAAA;AACR,UAAM,MAAA,eAAA,GAAkB,MAAM,IAAK,CAAA,gBAAA;AAAA,YACjC,aAAA;AAAA,YACA,OAAA;AAAA,YACA,KAAA;AAAA,YACA,IAAK,CAAA;AAAA,WACP;AACA,UAAA,IAAI,eAAiB,EAAA;AACnB,YAAO,OAAA,eAAA;AAAA;AACT;AAIF,QAAM,MAAA,kBAAA,GACJ,MAAM,IAAK,CAAA,oCAAA;AAAA,UACT,cAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACF;AAEF,QAAM,MAAA,GAAA,GAAM,qBAAqB,cAAiB,GAAA,YAAA;AAElD,QAAA,MAAA,GAAS,MAAM,IAAK,CAAA,YAAA,CAAa,aAAe,EAAA,GAAA,EAAK,QAAQ,KAAK,CAAA;AAAA,OAC7D,MAAA;AAEL,QAAA,MAAA,GAAS,MAAM,IAAK,CAAA,YAAA;AAAA,UAClB,aAAA;AAAA,UACA,cAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACF;AAAA;AAGF,MAAA,MAAM,MAAS,GAAA,MAAA,GAASQ,sCAAgB,CAAA,KAAA,GAAQA,sCAAgB,CAAA,IAAA;AAEhE,MAAA,MAAM,GAAM,GAAA,eAAA,CAAgB,aAAe,EAAA,MAAA,EAAQ,QAAQ,UAAU,CAAA;AACrE,MAAe,YAAA,GAAAF,6CAAA;AAAA,QACb,GAAA;AAAA,QACA,aAAA;AAAA,QACA,OAAA;AAAA,QACA,EAAE,MAAO;AAAA,OACX;AACA,MAAM,MAAA,IAAA,CAAK,WAAY,CAAA,QAAA,CAAS,YAAY,CAAA;AAC5C,MAAA,OAAO,EAAE,MAAO,EAAA;AAAA,aACT,KAAO,EAAA;AACd,MAAM,MAAA,IAAA,CAAK,YAAY,QAAS,CAAA;AAAA,QAC9B,OAAS,EAAA,gCAAA;AAAA,QACT,WAAWG,4BAAiB,CAAA,4BAAA;AAAA,QAC5B,KAAO,EAAAC,4CAAA;AAAA,QACP,MAAQ,EAAA,QAAA;AAAA,QACR,MAAA,EAAQ,CAAC,KAAK;AAAA,OACf,CAAA;AACD,MAAO,OAAA,EAAE,MAAQ,EAAAF,sCAAA,CAAgB,IAAK,EAAA;AAAA;AACxC;AACF,EAEA,MAAc,oCAAA,CACZ,cACA,EAAA,MAAA,EACA,KACkB,EAAA;AAClB,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAM,MAAA,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA;AAAA,QAChC,CAAA;AAAA,QACA,IAAA;AAAA,QACA,cAAA;AAAA,QACA;AAAA,OACF;AACA,MAAI,IAAA,KAAA,CAAM,SAAS,CAAG,EAAA;AACpB,QAAO,OAAA,IAAA;AAAA;AACT;AAGF,IAAO,OAAA,KAAA;AAAA;AACT,EAEQ,YAAe,GAAA,OACrB,YACA,EAAA,UAAA,EACA,QACA,KACqB,KAAA;AACrB,IAAA,OAAO,MAAM,IAAK,CAAA,QAAA,CAAS,QAAQ,YAAc,EAAA,UAAA,EAAY,QAAQ,KAAK,CAAA;AAAA,GAC5E;AAAA,EAEA,MAAc,gBAAA,CACZ,aACA,EAAA,OAAA,EACA,OACA,QACqC,EAAA;AACrC,IAAM,MAAA,cAAA,GAAiB,QAAQ,UAAW,CAAA,IAAA;AAC1C,IAAM,MAAA,YAAA,GAAgB,QAAQ,UAC3B,CAAA,YAAA;AACH,IAAA,MAAM,MAAS,GAAAP,mCAAA,CAAmB,OAAQ,CAAA,UAAA,CAAW,UAAU,CAAA;AAE/D,IAAA,MAAM,aAEA,EAAC;AACP,IAAA,IAAI,QAAW,GAAA,EAAA;AACf,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAM,MAAA,oBAAA,GAAuB,MAAM,IAAA,CAAK,gBAAiB,CAAA,gBAAA;AAAA,QACvD,IAAA;AAAA,QACA,SAAA;AAAA,QACA,YAAA;AAAA,QACA,CAAC,MAAM,CAAA;AAAA,QACP,CAAC,cAAc;AAAA,OACjB;AAEA,MAAI,IAAA,oBAAA,CAAqB,WAAW,CAAG,EAAA;AACrC,QAAW,QAAA,GAAA,oBAAA,CAAqB,CAAC,CAAE,CAAA,QAAA;AACnC,QAAA,UAAA,CAAW,IAAK,CAAA,oBAAA,CAAqB,CAAC,CAAA,CAAE,UAAU,CAAA;AAAA;AAIpD,MAAI,IAAA,oBAAA,CAAqB,SAAS,CAAG,EAAA;AACnC,QAAM,MAAA,GAAA,GAAM,YAAY,IAAK,CAAA,SAAA;AAAA,UAC3B;AAAA,SACD,6GAA6G,cAAc,CAAA,gBAAA,EAAmB,YAAY,CAAY,SAAA,EAAA,MAAM,aAAa,aAAa,CAAA,CAAA;AACvM,QAAA,MAAM,YAAe,GAAAK,6CAAA;AAAA,UACnB,GAAA;AAAA,UACA,aAAA;AAAA,UACA,OAAA;AAAA,UACA,EAAE,MAAQ,EAAAE,sCAAA,CAAgB,IAAK;AAAA,SACjC;AACA,QAAM,MAAA,IAAA,CAAK,WAAY,CAAA,QAAA,CAAS,YAAY,CAAA;AAC5C,QAAO,OAAA;AAAA,UACL,QAAQA,sCAAgB,CAAA;AAAA,SAC1B;AAAA;AACF;AAGF,IAAI,IAAA,UAAA,CAAW,SAAS,CAAG,EAAA;AACzB,MAAA,MAAM,MAAoC,GAAA;AAAA,QACxC,QAAA;AAAA,QACA,QAAQA,sCAAgB,CAAA,WAAA;AAAA,QACxB,YAAA;AAAA,QACA,UAAY,EAAA;AAAA,UACV,KAAO,EAAA;AAAA;AAKT,OACF;AAEA,MAAeG,4BAAA,CAAA,MAAA,CAAO,YAAY,QAAQ,CAAA;AAE1C,MAAM,MAAA,GAAA,GAAM,CAAoC,iCAAA,EAAA,QAAQ,CAA2B,wBAAA,EAAA,cAAc,uBAAuB,YAAY,CAAA,YAAA,EAAe,MAAM,CAAA,UAAA,EAAa,aAAa,CAAA,CAAA;AACnL,MAAA,MAAM,YAAe,GAAAL,6CAAA;AAAA,QACnB,GAAA;AAAA,QACA,aAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAM,MAAA,IAAA,CAAK,WAAY,CAAA,QAAA,CAAS,YAAY,CAAA;AAC5C,MAAO,OAAA,MAAA;AAAA;AAET,IAAO,OAAA,SAAA;AAAA;AAEX;;;;"}
+{"version":3,"file":"permission-policy.cjs.js","sources":["../../src/policies/permission-policy.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type {\n  AuditorService,\n  AuditorServiceEvent,\n  AuthService,\n  BackstageUserInfo,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport type { ConfigApi } from '@backstage/core-plugin-api';\nimport {\n  AuthorizeResult,\n  ConditionalPolicyDecision,\n  isResourcePermission,\n  PermissionCondition,\n  PermissionCriteria,\n  PermissionRuleParams,\n  PolicyDecision,\n  ResourcePermission,\n} from '@backstage/plugin-permission-common';\nimport type {\n  PermissionPolicy,\n  PolicyQuery,\n  PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nimport type { Knex } from 'knex';\n\nimport {\n  NonEmptyArray,\n  toPermissionAction,\n} from '@backstage-community/plugin-rbac-common';\n\nimport {\n  setAdminPermissions,\n  useAdminsFromConfig,\n} from '../admin-permissions/admin-creation';\nimport { createPermissionEvaluationAuditorEvent } from '../auditor/auditor';\nimport { replaceAliases } from '../conditional-aliases/alias-resolver';\nimport { ConditionalStorage } from '../database/conditional-storage';\nimport { RoleMetadataStorage } from '../database/role-metadata';\nimport { CSVFileWatcher } from '../file-permissions/csv-file-watcher';\nimport { YamlConditinalPoliciesFileWatcher } from '../file-permissions/yaml-conditional-file-watcher';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from '../service/plugin-endpoints';\n\nexport class RBACPermissionPolicy implements PermissionPolicy {\n  private readonly superUserList?: string[];\n\n  public static async build(\n    logger: LoggerService,\n    auditor: AuditorService,\n    configApi: ConfigApi,\n    conditionalStorage: ConditionalStorage,\n    enforcerDelegate: EnforcerDelegate,\n    roleMetadataStorage: RoleMetadataStorage,\n    knex: Knex,\n    pluginMetadataCollector: PluginPermissionMetadataCollector,\n    auth: AuthService,\n  ): Promise<RBACPermissionPolicy> {\n    const superUserList: string[] = [];\n    const adminUsers = configApi.getOptionalConfigArray(\n      'permission.rbac.admin.users',\n    );\n\n    const superUsers = configApi.getOptionalConfigArray(\n      'permission.rbac.admin.superUsers',\n    );\n\n    const policiesFile = configApi.getOptionalString(\n      'permission.rbac.policies-csv-file',\n    );\n\n    const allowReload =\n      configApi.getOptionalBoolean('permission.rbac.policyFileReload') || false;\n\n    const conditionalPoliciesFile = configApi.getOptionalString(\n      'permission.rbac.conditionalPoliciesFile',\n    );\n\n    if (superUsers && superUsers.length > 0) {\n      for (const user of superUsers) {\n        const userName = user.getString('name');\n        superUserList.push(userName);\n      }\n    }\n\n    await useAdminsFromConfig(\n      adminUsers || [],\n      enforcerDelegate,\n      auditor,\n      roleMetadataStorage,\n      knex,\n    );\n    await setAdminPermissions(enforcerDelegate, auditor);\n\n    if (\n      (!adminUsers || adminUsers.length === 0) &&\n      (!superUsers || superUsers.length === 0)\n    ) {\n      logger.warn(\n        'There are no admins or super admins configured for the RBAC-backend plugin.',\n      );\n    }\n\n    const csvFile = new CSVFileWatcher(\n      policiesFile,\n      allowReload,\n      logger,\n      enforcerDelegate,\n      roleMetadataStorage,\n      auditor,\n    );\n    await csvFile.initialize();\n\n    const conditionalFile = new YamlConditinalPoliciesFileWatcher(\n      conditionalPoliciesFile,\n      allowReload,\n      logger,\n      conditionalStorage,\n      auditor,\n      auth,\n      pluginMetadataCollector,\n      roleMetadataStorage,\n      enforcerDelegate,\n    );\n    await conditionalFile.initialize();\n\n    if (!conditionalPoliciesFile) {\n      // clean up conditional policies corresponding to roles from csv file\n      logger.info('conditional policies file feature was disabled');\n      await conditionalFile.cleanUpConditionalPolicies();\n    }\n    if (!policiesFile) {\n      // remove roles and policies from csv file\n      logger.info('csv policies file feature was disabled');\n      await csvFile.cleanUpRolesAndPolicies();\n    }\n\n    return new RBACPermissionPolicy(\n      enforcerDelegate,\n      auditor,\n      conditionalStorage,\n      superUserList,\n    );\n  }\n\n  private constructor(\n    private readonly enforcer: EnforcerDelegate,\n    private readonly auditor: AuditorService,\n    private readonly conditionStorage: ConditionalStorage,\n    superUserList?: string[],\n  ) {\n    this.superUserList = superUserList;\n  }\n\n  async handle(\n    request: PolicyQuery,\n    user?: PolicyQueryUser,\n  ): Promise<PolicyDecision> {\n    const userEntityRef = user?.info.userEntityRef ?? `user without entity`;\n\n    const auditorEvent = await createPermissionEvaluationAuditorEvent(\n      this.auditor,\n      userEntityRef,\n      request,\n    );\n\n    try {\n      let status = false;\n      const action = toPermissionAction(request.permission.attributes);\n\n      if (!user) {\n        await auditorEvent.success({\n          meta: { result: AuthorizeResult.DENY },\n        });\n        return { result: AuthorizeResult.DENY };\n      }\n\n      if (this.superUserList!.includes(userEntityRef)) {\n        await auditorEvent.success({\n          meta: { result: AuthorizeResult.ALLOW },\n        });\n        return { result: AuthorizeResult.ALLOW };\n      }\n\n      const permissionName = request.permission.name;\n      const roles = await this.enforcer.getRolesForUser(userEntityRef);\n\n      if (isResourcePermission(request.permission)) {\n        const resourceType = request.permission.resourceType;\n\n        // handle conditions if they are present\n        if (user) {\n          const conditionResult = await this.handleConditions(\n            auditorEvent,\n            userEntityRef,\n            request,\n            roles,\n            user.info,\n          );\n          if (conditionResult) {\n            return conditionResult;\n          }\n        }\n\n        // handle permission with 'resource' type\n        const hasNamedPermission =\n          await this.hasImplicitPermissionSpecifiedByName(\n            permissionName,\n            action,\n            roles,\n          );\n        // Let's set up higher priority for permission specified by name, than by resource type\n        const obj = hasNamedPermission ? permissionName : resourceType;\n\n        status = await this.isAuthorized(userEntityRef, obj, action, roles);\n      } else {\n        // handle permission with 'basic' type\n        status = await this.isAuthorized(\n          userEntityRef,\n          permissionName,\n          action,\n          roles,\n        );\n      }\n\n      const result = status ? AuthorizeResult.ALLOW : AuthorizeResult.DENY;\n\n      await auditorEvent.success({ meta: { result } });\n      return { result };\n    } catch (error) {\n      await auditorEvent.fail({\n        error,\n        meta: { result: AuthorizeResult.DENY },\n      });\n      return { result: AuthorizeResult.DENY };\n    }\n  }\n\n  private async hasImplicitPermissionSpecifiedByName(\n    permissionName: string,\n    action: string,\n    roles: string[],\n  ): Promise<boolean> {\n    for (const role of roles) {\n      const perms = await this.enforcer.getFilteredPolicy(\n        0,\n        role,\n        permissionName,\n        action,\n      );\n      if (perms.length > 0) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  private isAuthorized = async (\n    userIdentity: string,\n    permission: string,\n    action: string,\n    roles: string[],\n  ): Promise<boolean> => {\n    return await this.enforcer.enforce(userIdentity, permission, action, roles);\n  };\n\n  private async handleConditions(\n    auditorEvent: AuditorServiceEvent,\n    userEntityRef: string,\n    request: PolicyQuery,\n    roles: string[],\n    userInfo: BackstageUserInfo,\n  ): Promise<PolicyDecision | undefined> {\n    const permissionName = request.permission.name;\n    const resourceType = (request.permission as ResourcePermission)\n      .resourceType;\n    const action = toPermissionAction(request.permission.attributes);\n\n    const conditions: PermissionCriteria<\n      PermissionCondition<string, PermissionRuleParams>\n    >[] = [];\n    let pluginId = '';\n    for (const role of roles) {\n      const conditionalDecisions = await this.conditionStorage.filterConditions(\n        role,\n        undefined,\n        resourceType,\n        [action],\n        [permissionName],\n      );\n\n      if (conditionalDecisions.length === 1) {\n        pluginId = conditionalDecisions[0].pluginId;\n        conditions.push(conditionalDecisions[0].conditions);\n      }\n\n      // this error is unexpected and should not happen, but just in case handle it.\n      if (conditionalDecisions.length > 1) {\n        await auditorEvent.fail({\n          error: new Error(\n            `Detected ${JSON.stringify(\n              conditionalDecisions,\n            )} collisions for conditional policies. Expected to find a stored single condition for permission with name ${permissionName}, resource type ${resourceType}, action ${action} for user ${userEntityRef}`,\n          ),\n          meta: { result: AuthorizeResult.DENY },\n        });\n        return {\n          result: AuthorizeResult.DENY,\n        };\n      }\n    }\n\n    if (conditions.length > 0) {\n      const result: ConditionalPolicyDecision = {\n        pluginId,\n        result: AuthorizeResult.CONDITIONAL,\n        resourceType,\n        conditions: {\n          anyOf: conditions as NonEmptyArray<\n            PermissionCriteria<\n              PermissionCondition<string, PermissionRuleParams>\n            >\n          >,\n        },\n      };\n\n      replaceAliases(result.conditions, userInfo);\n\n      await auditorEvent.success({ meta: { ...result } });\n      return result;\n    }\n    return undefined;\n  }\n}\n"],"names":["useAdminsFromConfig","setAdminPermissions","CSVFileWatcher","YamlConditinalPoliciesFileWatcher","createPermissionEvaluationAuditorEvent","toPermissionAction","AuthorizeResult","isResourcePermission","replaceAliases"],"mappings":";;;;;;;;;;AA2DO,MAAM,oBAAiD,CAAA;AAAA,EAqGpD,WACW,CAAA,QAAA,EACA,OACA,EAAA,gBAAA,EACjB,aACA,EAAA;AAJiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAGjB,IAAA,IAAA,CAAK,aAAgB,GAAA,aAAA;AAAA;AACvB,EA3GiB,aAAA;AAAA,EAEjB,aAAoB,KAClB,CAAA,MAAA,EACA,OACA,EAAA,SAAA,EACA,oBACA,gBACA,EAAA,mBAAA,EACA,IACA,EAAA,uBAAA,EACA,IAC+B,EAAA;AAC/B,IAAA,MAAM,gBAA0B,EAAC;AACjC,IAAA,MAAM,aAAa,SAAU,CAAA,sBAAA;AAAA,MAC3B;AAAA,KACF;AAEA,IAAA,MAAM,aAAa,SAAU,CAAA,sBAAA;AAAA,MAC3B;AAAA,KACF;AAEA,IAAA,MAAM,eAAe,SAAU,CAAA,iBAAA;AAAA,MAC7B;AAAA,KACF;AAEA,IAAA,MAAM,WACJ,GAAA,SAAA,CAAU,kBAAmB,CAAA,kCAAkC,CAAK,IAAA,KAAA;AAEtE,IAAA,MAAM,0BAA0B,SAAU,CAAA,iBAAA;AAAA,MACxC;AAAA,KACF;AAEA,IAAI,IAAA,UAAA,IAAc,UAAW,CAAA,MAAA,GAAS,CAAG,EAAA;AACvC,MAAA,KAAA,MAAW,QAAQ,UAAY,EAAA;AAC7B,QAAM,MAAA,QAAA,GAAW,IAAK,CAAA,SAAA,CAAU,MAAM,CAAA;AACtC,QAAA,aAAA,CAAc,KAAK,QAAQ,CAAA;AAAA;AAC7B;AAGF,IAAM,MAAAA,iCAAA;AAAA,MACJ,cAAc,EAAC;AAAA,MACf,gBAAA;AAAA,MACA,OAAA;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAM,MAAAC,iCAAA,CAAoB,kBAAkB,OAAO,CAAA;AAEnD,IACG,IAAA,CAAA,CAAC,cAAc,UAAW,CAAA,MAAA,KAAW,OACrC,CAAC,UAAA,IAAc,UAAW,CAAA,MAAA,KAAW,CACtC,CAAA,EAAA;AACA,MAAO,MAAA,CAAA,IAAA;AAAA,QACL;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,UAAU,IAAIC,6BAAA;AAAA,MAClB,YAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA;AAAA,MACA,gBAAA;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,QAAQ,UAAW,EAAA;AAEzB,IAAA,MAAM,kBAAkB,IAAIC,4DAAA;AAAA,MAC1B,uBAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,uBAAA;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,gBAAgB,UAAW,EAAA;AAEjC,IAAA,IAAI,CAAC,uBAAyB,EAAA;AAE5B,MAAA,MAAA,CAAO,KAAK,gDAAgD,CAAA;AAC5D,MAAA,MAAM,gBAAgB,0BAA2B,EAAA;AAAA;AAEnD,IAAA,IAAI,CAAC,YAAc,EAAA;AAEjB,MAAA,MAAA,CAAO,KAAK,wCAAwC,CAAA;AACpD,MAAA,MAAM,QAAQ,uBAAwB,EAAA;AAAA;AAGxC,IAAA,OAAO,IAAI,oBAAA;AAAA,MACT,gBAAA;AAAA,MACA,OAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACF;AAAA;AACF,EAWA,MAAM,MACJ,CAAA,OAAA,EACA,IACyB,EAAA;AACzB,IAAM,MAAA,aAAA,GAAgB,IAAM,EAAA,IAAA,CAAK,aAAiB,IAAA,CAAA,mBAAA,CAAA;AAElD,IAAA,MAAM,eAAe,MAAMC,8CAAA;AAAA,MACzB,IAAK,CAAA,OAAA;AAAA,MACL,aAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAI,IAAA;AACF,MAAA,IAAI,MAAS,GAAA,KAAA;AACb,MAAA,MAAM,MAAS,GAAAC,mCAAA,CAAmB,OAAQ,CAAA,UAAA,CAAW,UAAU,CAAA;AAE/D,MAAA,IAAI,CAAC,IAAM,EAAA;AACT,QAAA,MAAM,aAAa,OAAQ,CAAA;AAAA,UACzB,IAAM,EAAA,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,IAAK;AAAA,SACtC,CAAA;AACD,QAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,IAAK,EAAA;AAAA;AAGxC,MAAA,IAAI,IAAK,CAAA,aAAA,CAAe,QAAS,CAAA,aAAa,CAAG,EAAA;AAC/C,QAAA,MAAM,aAAa,OAAQ,CAAA;AAAA,UACzB,IAAM,EAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,KAAM;AAAA,SACvC,CAAA;AACD,QAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,KAAM,EAAA;AAAA;AAGzC,MAAM,MAAA,cAAA,GAAiB,QAAQ,UAAW,CAAA,IAAA;AAC1C,MAAA,MAAM,KAAQ,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,gBAAgB,aAAa,CAAA;AAE/D,MAAI,IAAAC,2CAAA,CAAqB,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC5C,QAAM,MAAA,YAAA,GAAe,QAAQ,UAAW,CAAA,YAAA;AAGxC,QAAA,IAAI,IAAM,EAAA;AACR,UAAM,MAAA,eAAA,GAAkB,MAAM,IAAK,CAAA,gBAAA;AAAA,YACjC,YAAA;AAAA,YACA,aAAA;AAAA,YACA,OAAA;AAAA,YACA,KAAA;AAAA,YACA,IAAK,CAAA;AAAA,WACP;AACA,UAAA,IAAI,eAAiB,EAAA;AACnB,YAAO,OAAA,eAAA;AAAA;AACT;AAIF,QAAM,MAAA,kBAAA,GACJ,MAAM,IAAK,CAAA,oCAAA;AAAA,UACT,cAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACF;AAEF,QAAM,MAAA,GAAA,GAAM,qBAAqB,cAAiB,GAAA,YAAA;AAElD,QAAA,MAAA,GAAS,MAAM,IAAK,CAAA,YAAA,CAAa,aAAe,EAAA,GAAA,EAAK,QAAQ,KAAK,CAAA;AAAA,OAC7D,MAAA;AAEL,QAAA,MAAA,GAAS,MAAM,IAAK,CAAA,YAAA;AAAA,UAClB,aAAA;AAAA,UACA,cAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACF;AAAA;AAGF,MAAA,MAAM,MAAS,GAAA,MAAA,GAASD,sCAAgB,CAAA,KAAA,GAAQA,sCAAgB,CAAA,IAAA;AAEhE,MAAA,MAAM,aAAa,OAAQ,CAAA,EAAE,MAAM,EAAE,MAAA,IAAU,CAAA;AAC/C,MAAA,OAAO,EAAE,MAAO,EAAA;AAAA,aACT,KAAO,EAAA;AACd,MAAA,MAAM,aAAa,IAAK,CAAA;AAAA,QACtB,KAAA;AAAA,QACA,IAAM,EAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,IAAK;AAAA,OACtC,CAAA;AACD,MAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,IAAK,EAAA;AAAA;AACxC;AACF,EAEA,MAAc,oCAAA,CACZ,cACA,EAAA,MAAA,EACA,KACkB,EAAA;AAClB,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAM,MAAA,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA;AAAA,QAChC,CAAA;AAAA,QACA,IAAA;AAAA,QACA,cAAA;AAAA,QACA;AAAA,OACF;AACA,MAAI,IAAA,KAAA,CAAM,SAAS,CAAG,EAAA;AACpB,QAAO,OAAA,IAAA;AAAA;AACT;AAGF,IAAO,OAAA,KAAA;AAAA;AACT,EAEQ,YAAe,GAAA,OACrB,YACA,EAAA,UAAA,EACA,QACA,KACqB,KAAA;AACrB,IAAA,OAAO,MAAM,IAAK,CAAA,QAAA,CAAS,QAAQ,YAAc,EAAA,UAAA,EAAY,QAAQ,KAAK,CAAA;AAAA,GAC5E;AAAA,EAEA,MAAc,gBACZ,CAAA,YAAA,EACA,aACA,EAAA,OAAA,EACA,OACA,QACqC,EAAA;AACrC,IAAM,MAAA,cAAA,GAAiB,QAAQ,UAAW,CAAA,IAAA;AAC1C,IAAM,MAAA,YAAA,GAAgB,QAAQ,UAC3B,CAAA,YAAA;AACH,IAAA,MAAM,MAAS,GAAAD,mCAAA,CAAmB,OAAQ,CAAA,UAAA,CAAW,UAAU,CAAA;AAE/D,IAAA,MAAM,aAEA,EAAC;AACP,IAAA,IAAI,QAAW,GAAA,EAAA;AACf,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAM,MAAA,oBAAA,GAAuB,MAAM,IAAA,CAAK,gBAAiB,CAAA,gBAAA;AAAA,QACvD,IAAA;AAAA,QACA,SAAA;AAAA,QACA,YAAA;AAAA,QACA,CAAC,MAAM,CAAA;AAAA,QACP,CAAC,cAAc;AAAA,OACjB;AAEA,MAAI,IAAA,oBAAA,CAAqB,WAAW,CAAG,EAAA;AACrC,QAAW,QAAA,GAAA,oBAAA,CAAqB,CAAC,CAAE,CAAA,QAAA;AACnC,QAAA,UAAA,CAAW,IAAK,CAAA,oBAAA,CAAqB,CAAC,CAAA,CAAE,UAAU,CAAA;AAAA;AAIpD,MAAI,IAAA,oBAAA,CAAqB,SAAS,CAAG,EAAA;AACnC,QAAA,MAAM,aAAa,IAAK,CAAA;AAAA,UACtB,OAAO,IAAI,KAAA;AAAA,YACT,YAAY,IAAK,CAAA,SAAA;AAAA,cACf;AAAA,aACD,6GAA6G,cAAc,CAAA,gBAAA,EAAmB,YAAY,CAAY,SAAA,EAAA,MAAM,aAAa,aAAa,CAAA;AAAA,WACzM;AAAA,UACA,IAAM,EAAA,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,IAAK;AAAA,SACtC,CAAA;AACD,QAAO,OAAA;AAAA,UACL,QAAQA,sCAAgB,CAAA;AAAA,SAC1B;AAAA;AACF;AAGF,IAAI,IAAA,UAAA,CAAW,SAAS,CAAG,EAAA;AACzB,MAAA,MAAM,MAAoC,GAAA;AAAA,QACxC,QAAA;AAAA,QACA,QAAQA,sCAAgB,CAAA,WAAA;AAAA,QACxB,YAAA;AAAA,QACA,UAAY,EAAA;AAAA,UACV,KAAO,EAAA;AAAA;AAKT,OACF;AAEA,MAAeE,4BAAA,CAAA,MAAA,CAAO,YAAY,QAAQ,CAAA;AAE1C,MAAM,MAAA,YAAA,CAAa,QAAQ,EAAE,IAAA,EAAM,EAAE,GAAG,MAAA,IAAU,CAAA;AAClD,MAAO,OAAA,MAAA;AAAA;AAET,IAAO,OAAA,SAAA;AAAA;AAEX;;;;"}