@backstage-community/plugin-rbac-backend 6.2.1 → 6.2.3

package/dist/service/policies-rest-api.cjs.js

@@ -31,7 +31,7 @@ class PoliciesServer {
     });
     if (this.options.auth.isPrincipal(credentials, "service") && permission !== pluginRbacCommon.policyEntityReadPermission) {
       throw new errors.NotAllowedError(
-        `Only creadential principal with type 'user' permitted to modify permissions`
+        `Only credential principal with type 'user' permitted to modify permissions`
       );
     }
     let decision;
@@ -44,16 +44,14 @@ class PoliciesServer {
         credentials
       }))[0];
     }
-    return decision;
+    if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+      throw new errors.NotAllowedError();
+    }
+    return { decision, credentials };
   }
   async serve() {
     const router = await pluginPermissionBackend.createRouter(this.options);
-    const { httpAuth, logger } = this.options;
-    if (!httpAuth) {
-      throw new errors.ServiceUnavailableError(
-        "httpAuth not found, ensure the correct configuration for the RBAC plugin"
-      );
-    }
+    const { logger } = this.options;
     const policyPermissionsIntegrationRouter = pluginPermissionNode.createPermissionIntegrationRouter({
       resourceType: pluginRbacCommon.RESOURCE_TYPE_POLICY_ENTITY,
       getResources: (resourceRefs) => Promise.all(
@@ -70,13 +68,7 @@ class PoliciesServer {
       return router;
     }
     router.get("/", async (request, response) => {
-      const decision = await this.authorizeConditional(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
+      await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
       response.send({ status: "Authorized" });
     });
     router.get(
@@ -84,13 +76,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityReadPermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -133,13 +122,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityReadPermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -170,13 +156,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityDeletePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -203,13 +186,7 @@ class PoliciesServer {
       "/policies",
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
-        const decision = await this.authorizeConditional(
-          request,
-          pluginRbacCommon.policyEntityCreatePermission
-        );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
+        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
         const policyRaw = request.body;
         if (lodash.isEmpty(policyRaw)) {
           throw new errors.InputError(`permission policy must be present`);
@@ -234,13 +211,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityUpdatePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -298,13 +272,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityReadPermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -318,13 +289,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityReadPermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -346,13 +314,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         const uniqueItems = /* @__PURE__ */ new Set();
-        const decision = await this.authorizeConditional(
+        const { credentials } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityCreatePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         const roleRaw = request.body;
         let err = policiesValidation.validateRole(roleRaw);
         if (err) {
@@ -385,9 +350,6 @@ class PoliciesServer {
             uniqueItems.add(roleString);
           }
         }
-        const credentials = await httpAuth.credentials(request, {
-          allow: ["user"]
-        });
         const modifiedBy = credentials.principal.userEntityRef;
         const metadata = {
           roleEntityRef: roleRaw.name,
@@ -408,13 +370,10 @@ class PoliciesServer {
       async (request, response) => {
         const uniqueItems = /* @__PURE__ */ new Set();
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision, credentials } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityUpdatePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -446,14 +405,12 @@ class PoliciesServer {
         this.transformMemberReferencesToLowercase(newRoleRaw);
         const oldRole = this.transformRoleToArray(oldRoleRaw);
         const newRole = this.transformRoleToArray(newRoleRaw);
-        const credentials = await httpAuth.credentials(request, {
-          allow: ["user"]
-        });
+        const modifiedBy = credentials.principal.userEntityRef;
         const newMetadata = {
           ...newRoleRaw.metadata,
           source: newRoleRaw.metadata?.source ?? "rest",
           roleEntityRef: newRoleRaw.name,
-          modifiedBy: credentials.principal.userEntityRef,
+          modifiedBy,
           owner: newRoleRaw.metadata?.owner ?? ""
         };
         const oldMetadata = await this.roleMetadata.findRoleMetadata(roleEntityRef);
@@ -538,13 +495,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision, credentials } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityDeletePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -585,13 +539,11 @@ class PoliciesServer {
             throw new errors.NotFoundError(`role member '${role[0]}' was not found`);
           }
         }
-        const credentials = await httpAuth.credentials(request, {
-          allow: ["user"]
-        });
+        const modifiedBy = credentials.principal.userEntityRef;
         const metadata = {
           roleEntityRef,
           source: "rest",
-          modifiedBy: credentials.principal.userEntityRef
+          modifiedBy
         };
         await this.enforcer.removeGroupingPolicies(
           roleMembers,
@@ -609,13 +561,7 @@ class PoliciesServer {
       "/plugins/policies",
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
-        const decision = await this.authorizeConditional(
-          request,
-          pluginRbacCommon.policyEntityReadPermission
-        );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
+        await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
         const body = await this.pluginPermMetaData.getPluginPolicies(
           this.options.auth
         );
@@ -626,13 +572,7 @@ class PoliciesServer {
       "/plugins/condition-rules",
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
-        const decision = await this.authorizeConditional(
-          request,
-          pluginRbacCommon.policyEntityReadPermission
-        );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
+        await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
         const body = await this.pluginPermMetaData.getPluginConditionRules(
           this.options.auth
         );
@@ -644,13 +584,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityReadPermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -681,13 +618,7 @@ class PoliciesServer {
       "/roles/conditions",
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
-        const decision = await this.authorizeConditional(
-          request,
-          pluginRbacCommon.policyEntityCreatePermission
-        );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
+        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
         const roleConditionPolicy = request.body;
         conditionValidation.validateRoleCondition(roleConditionPolicy);
         const conditionToCreate = await helper.processConditionMapping(
@@ -706,13 +637,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityReadPermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
           throw new errors.InputError("Id is not a valid number.");
@@ -742,13 +670,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityDeletePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -780,13 +705,10 @@ class PoliciesServer {
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         let conditionsFilter;
-        const decision = await this.authorizeConditional(
+        const { decision } = await this.authorizeConditional(
           request,
           pluginRbacCommon.policyEntityUpdatePermission
         );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
           conditionsFilter = conditions.transformConditions(decision.conditions);
         }
@@ -820,13 +742,7 @@ class PoliciesServer {
       "/refresh/:id",
       restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
-        const decision = await this.authorizeConditional(
-          request,
-          pluginRbacCommon.policyEntityCreatePermission
-        );
-        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-          throw new errors.NotAllowedError();
-        }
+        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
         if (!this.rbacProviders) {
           throw new errors.NotFoundError(`No RBAC providers were found`);
         }