@backstage-community/plugin-rbac-backend 6.2.5 → 6.3.0

package/dist/service/plugin-endpoints.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-endpoints.cjs.js","sources":["../../src/service/plugin-endpoints.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  FetchUrlReader,\n  ReaderFactory,\n  UrlReaders,\n} from '@backstage/backend-defaults/urlReader';\nimport type {\n  AuthService,\n  DiscoveryService,\n  LoggerService,\n  UrlReaderService,\n} from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport { isError } from '@backstage/errors';\nimport {\n  isResourcePermission,\n  Permission,\n} from '@backstage/plugin-permission-common';\nimport type {\n  MetadataResponse,\n  MetadataResponseSerializedRule,\n} from '@backstage/plugin-permission-node';\n\nimport {\n  policyEntityPermissions,\n  type PluginPermissionMetaData,\n  type PolicyDetails,\n} from '@backstage-community/plugin-rbac-common';\nimport type { PluginIdProvider } from '@backstage-community/plugin-rbac-node';\nimport { rbacRules } from '../permissions';\n\ntype PluginMetadataResponse = {\n  pluginId: string;\n  metaDataResponse: MetadataResponse;\n};\n\nexport type PluginMetadataResponseSerializedRule = {\n  pluginId: string;\n  rules: MetadataResponseSerializedRule[];\n};\n\nconst rbacPermissionMetadata: MetadataResponse = {\n  permissions: policyEntityPermissions,\n  rules: [rbacRules],\n};\n\nexport class PluginPermissionMetadataCollector {\n  private readonly pluginIds: string[];\n  private readonly discovery: DiscoveryService;\n  private readonly logger: LoggerService;\n  private readonly urlReader: UrlReaderService;\n\n  constructor({\n    deps,\n    optional,\n  }: {\n    deps: {\n      discovery: DiscoveryService;\n      pluginIdProvider: PluginIdProvider;\n      logger: LoggerService;\n      config: Config;\n    };\n    optional?: {\n      urlReader?: UrlReaderService;\n    };\n  }) {\n    const { discovery, pluginIdProvider, logger, config } = deps;\n    this.pluginIds = pluginIdProvider.getPluginIds();\n    this.discovery = discovery;\n    this.logger = logger;\n    this.urlReader =\n      optional?.urlReader ??\n      UrlReaders.default({\n        config,\n        logger,\n        factories: [PluginPermissionMetadataCollector.permissionFactory],\n      });\n  }\n\n  async getPluginConditionRules(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponseSerializedRule[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.rules.length > 0)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          rules: metadata.metaDataResponse.rules,\n        };\n      });\n  }\n\n  async getPluginPolicies(\n    auth: AuthService,\n  ): Promise<PluginPermissionMetaData[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.permissions !== undefined)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          policies: permissionsToCasbinPolicies(\n            metadata.metaDataResponse.permissions!,\n          ),\n        };\n      });\n  }\n\n  private static permissionFactory: ReaderFactory = () => {\n    return [{ reader: new FetchUrlReader(), predicate: (_url: URL) => true }];\n  };\n\n  private async getPluginMetaData(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponse[]> {\n    let pluginResponses: PluginMetadataResponse[] = [];\n\n    for (const pluginId of this.pluginIds) {\n      try {\n        const { token } = await auth.getPluginRequestToken({\n          onBehalfOf: await auth.getOwnServiceCredentials(),\n          targetPluginId: pluginId,\n        });\n\n        const permMetaData = await this.getMetadataByPluginId(pluginId, token);\n        if (permMetaData) {\n          pluginResponses = [\n            ...pluginResponses,\n            {\n              metaDataResponse: permMetaData,\n              pluginId,\n            },\n          ];\n        }\n      } catch (error) {\n        this.logger.error(\n          `Failed to retrieve permission metadata for ${pluginId}. ${error}`,\n        );\n      }\n    }\n\n    return pluginResponses;\n  }\n\n  async getMetadataByPluginId(\n    pluginId: string,\n    token: string | undefined,\n  ): Promise<MetadataResponse | undefined> {\n    let permMetaData: MetadataResponse | undefined;\n\n    // Work around: This is needed for start up whenever a conditional policy for the plugin permission in the yaml file\n    // will make a check to the well known endpoint\n    // However, our plugin has not completely started and as such will throw a 503 error\n    // TODO: see if we are able to remove this after we migrate to the permission registry\n    if (pluginId === 'permission') {\n      return rbacPermissionMetadata;\n    }\n\n    try {\n      const baseEndpoint = await this.discovery.getBaseUrl(pluginId);\n      const wellKnownURL = `${baseEndpoint}/.well-known/backstage/permissions/metadata`;\n\n      const permResp = await this.urlReader.readUrl(wellKnownURL, { token });\n      const permMetaDataRaw = (await permResp.buffer()).toString();\n\n      try {\n        permMetaData = JSON.parse(permMetaDataRaw);\n      } catch (err) {\n        // workaround for https://issues.redhat.com/browse/RHIDP-1456\n        return undefined;\n      }\n    } catch (err) {\n      if (isError(err) && err.name === 'NotFoundError') {\n        this.logger.warn(\n          `No permission metadata found for ${pluginId}. ${err}`,\n        );\n        return undefined;\n      }\n      this.logger.error(\n        `Failed to retrieve permission metadata for ${pluginId}. ${err}`,\n      );\n    }\n    return permMetaData;\n  }\n}\n\nfunction permissionsToCasbinPolicies(\n  permissions: Permission[],\n): PolicyDetails[] {\n  const policies: PolicyDetails[] = [];\n  for (const permission of permissions) {\n    if (isResourcePermission(permission)) {\n      policies.push({\n        resourceType: permission.resourceType,\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    } else {\n      policies.push({\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    }\n  }\n\n  return policies;\n}\n"],"names":["policyEntityPermissions","rbacRules","UrlReaders","FetchUrlReader","isError","isResourcePermission"],"mappings":";;;;;;;;;AAuDA,MAAM,sBAA2C,GAAA;AAAA,EAC/C,WAAa,EAAAA,wCAAA;AAAA,EACb,KAAA,EAAO,CAACC,eAAS;AACnB,CAAA;AAEO,MAAM,iCAAkC,CAAA;AAAA,EAC5B,SAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEjB,WAAY,CAAA;AAAA,IACV,IAAA;AAAA,IACA;AAAA,GAWC,EAAA;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,gBAAkB,EAAA,MAAA,EAAQ,QAAW,GAAA,IAAA;AACxD,IAAK,IAAA,CAAA,SAAA,GAAY,iBAAiB,YAAa,EAAA;AAC/C,IAAA,IAAA,CAAK,SAAY,GAAA,SAAA;AACjB,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA;AACd,IAAA,IAAA,CAAK,SACH,GAAA,QAAA,EAAU,SACV,IAAAC,oBAAA,CAAW,OAAQ,CAAA;AAAA,MACjB,MAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA,EAAW,CAAC,iCAAA,CAAkC,iBAAiB;AAAA,KAChE,CAAA;AAAA;AACL,EAEA,MAAM,wBACJ,IACiD,EAAA;AACjD,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,MAAO,CAAA,CAAA,QAAA,KAAY,QAAS,CAAA,gBAAA,CAAiB,MAAM,MAAS,GAAA,CAAC,CAC7D,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,KAAA,EAAO,SAAS,gBAAiB,CAAA;AAAA,OACnC;AAAA,KACD,CAAA;AAAA;AACL,EAEA,MAAM,kBACJ,IACqC,EAAA;AACrC,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,OAAO,CAAY,QAAA,KAAA,QAAA,CAAS,iBAAiB,WAAgB,KAAA,SAAS,CACtE,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,QAAU,EAAA,2BAAA;AAAA,UACR,SAAS,gBAAiB,CAAA;AAAA;AAC5B,OACF;AAAA,KACD,CAAA;AAAA;AACL,EAEA,OAAe,oBAAmC,MAAM;AACtD,IAAO,OAAA,CAAC,EAAE,MAAA,EAAQ,IAAIC,wBAAA,IAAkB,SAAW,EAAA,CAAC,IAAc,KAAA,IAAA,EAAM,CAAA;AAAA,GAC1E;AAAA,EAEA,MAAc,kBACZ,IACmC,EAAA;AACnC,IAAA,IAAI,kBAA4C,EAAC;AAEjD,IAAW,KAAA,MAAA,QAAA,IAAY,KAAK,SAAW,EAAA;AACrC,MAAI,IAAA;AACF,QAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,UACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,UAChD,cAAgB,EAAA;AAAA,SACjB,CAAA;AAED,QAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,qBAAA,CAAsB,UAAU,KAAK,CAAA;AACrE,QAAA,IAAI,YAAc,EAAA;AAChB,UAAkB,eAAA,GAAA;AAAA,YAChB,GAAG,eAAA;AAAA,YACH;AAAA,cACE,gBAAkB,EAAA,YAAA;AAAA,cAClB;AAAA;AACF,WACF;AAAA;AACF,eACO,KAAO,EAAA;AACd,QAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,UACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,KAAK,CAAA;AAAA,SAClE;AAAA;AACF;AAGF,IAAO,OAAA,eAAA;AAAA;AACT,EAEA,MAAM,qBACJ,CAAA,QAAA,EACA,KACuC,EAAA;AACvC,IAAI,IAAA,YAAA;AAMJ,IAAA,IAAI,aAAa,YAAc,EAAA;AAC7B,MAAO,OAAA,sBAAA;AAAA;AAGT,IAAI,IAAA;AACF,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,QAAQ,CAAA;AAC7D,MAAM,MAAA,YAAA,GAAe,GAAG,YAAY,CAAA,2CAAA,CAAA;AAEpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA,CAAU,QAAQ,YAAc,EAAA,EAAE,OAAO,CAAA;AACrE,MAAA,MAAM,eAAmB,GAAA,CAAA,MAAM,QAAS,CAAA,MAAA,IAAU,QAAS,EAAA;AAE3D,MAAI,IAAA;AACF,QAAe,YAAA,GAAA,IAAA,CAAK,MAAM,eAAe,CAAA;AAAA,eAClC,GAAK,EAAA;AAEZ,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,aACO,GAAK,EAAA;AACZ,MAAA,IAAIC,cAAQ,CAAA,GAAG,CAAK,IAAA,GAAA,CAAI,SAAS,eAAiB,EAAA;AAChD,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAA,iCAAA,EAAoC,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,SACtD;AACA,QAAO,OAAA,SAAA;AAAA;AAET,MAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,QACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,OAChE;AAAA;AAEF,IAAO,OAAA,YAAA;AAAA;AAEX;AAEA,SAAS,4BACP,WACiB,EAAA;AACjB,EAAA,MAAM,WAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AACpC,IAAI,IAAAC,2CAAA,CAAqB,UAAU,CAAG,EAAA;AACpC,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,cAAc,UAAW,CAAA,YAAA;AAAA,QACzB,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA,KACI,MAAA;AACL,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA;AACH;AAGF,EAAO,OAAA,QAAA;AACT;;;;"}
+{"version":3,"file":"plugin-endpoints.cjs.js","sources":["../../src/service/plugin-endpoints.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  FetchUrlReader,\n  ReaderFactory,\n  UrlReaders,\n} from '@backstage/backend-defaults/urlReader';\nimport type {\n  AuthService,\n  DiscoveryService,\n  LoggerService,\n  UrlReaderService,\n} from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport { isError } from '@backstage/errors';\nimport {\n  isResourcePermission,\n  Permission,\n} from '@backstage/plugin-permission-common';\nimport type {\n  MetadataResponse,\n  MetadataResponseSerializedRule,\n} from '@backstage/plugin-permission-node';\n\nimport {\n  policyEntityPermissions,\n  type PluginPermissionMetaData,\n  type PolicyDetails,\n} from '@backstage-community/plugin-rbac-common';\nimport { rbacRules } from '../permissions';\nimport { ExtendablePluginIdProvider } from './extendable-id-provider';\n\ntype PluginMetadataResponse = {\n  pluginId: string;\n  metaDataResponse: MetadataResponse;\n};\n\nexport type PluginMetadataResponseSerializedRule = {\n  pluginId: string;\n  rules: MetadataResponseSerializedRule[];\n};\n\nconst rbacPermissionMetadata: MetadataResponse = {\n  permissions: policyEntityPermissions,\n  rules: [rbacRules],\n};\n\nexport class PluginPermissionMetadataCollector {\n  private readonly pluginIdProvider: ExtendablePluginIdProvider;\n  private readonly discovery: DiscoveryService;\n  private readonly logger: LoggerService;\n  private readonly urlReader: UrlReaderService;\n\n  constructor({\n    deps,\n    optional,\n  }: {\n    deps: {\n      discovery: DiscoveryService;\n      pluginIdProvider: ExtendablePluginIdProvider;\n      logger: LoggerService;\n      config: Config;\n    };\n    optional?: {\n      urlReader?: UrlReaderService;\n    };\n  }) {\n    const { discovery, logger, config, pluginIdProvider } = deps;\n    this.discovery = discovery;\n    this.pluginIdProvider = pluginIdProvider;\n    this.logger = logger;\n    this.urlReader =\n      optional?.urlReader ??\n      UrlReaders.default({\n        config,\n        logger,\n        factories: [PluginPermissionMetadataCollector.permissionFactory],\n      });\n  }\n\n  async getPluginConditionRules(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponseSerializedRule[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.rules.length > 0)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          rules: metadata.metaDataResponse.rules,\n        };\n      });\n  }\n\n  async getPluginPolicies(\n    auth: AuthService,\n  ): Promise<PluginPermissionMetaData[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.permissions !== undefined)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          policies: permissionsToCasbinPolicies(\n            metadata.metaDataResponse.permissions!,\n          ),\n        };\n      });\n  }\n\n  private static permissionFactory: ReaderFactory = () => {\n    return [{ reader: new FetchUrlReader(), predicate: (_url: URL) => true }];\n  };\n\n  private async getPluginMetaData(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponse[]> {\n    let pluginResponses: PluginMetadataResponse[] = [];\n\n    const pluginIds = await this.pluginIdProvider.getPluginIds();\n    for (const pluginId of pluginIds) {\n      try {\n        const { token } = await auth.getPluginRequestToken({\n          onBehalfOf: await auth.getOwnServiceCredentials(),\n          targetPluginId: pluginId,\n        });\n\n        const permMetaData = await this.getMetadataByPluginId(pluginId, token);\n        if (permMetaData) {\n          pluginResponses = [\n            ...pluginResponses,\n            {\n              metaDataResponse: permMetaData,\n              pluginId,\n            },\n          ];\n        }\n      } catch (error) {\n        this.logger.error(\n          `Failed to retrieve permission metadata for ${pluginId}. ${error}`,\n        );\n      }\n    }\n\n    return pluginResponses;\n  }\n\n  async getMetadataByPluginId(\n    pluginId: string,\n    token: string | undefined,\n  ): Promise<MetadataResponse | undefined> {\n    let permMetaData: MetadataResponse | undefined;\n\n    // Work around: This is needed for start up whenever a conditional policy for the plugin permission in the yaml file\n    // will make a check to the well known endpoint\n    // However, our plugin has not completely started and as such will throw a 503 error\n    // TODO: see if we are able to remove this after we migrate to the permission registry\n    if (pluginId === 'permission') {\n      return rbacPermissionMetadata;\n    }\n\n    try {\n      const baseEndpoint = await this.discovery.getBaseUrl(pluginId);\n      const wellKnownURL = `${baseEndpoint}/.well-known/backstage/permissions/metadata`;\n\n      const permResp = await this.urlReader.readUrl(wellKnownURL, { token });\n      const permMetaDataRaw = (await permResp.buffer()).toString();\n\n      try {\n        permMetaData = JSON.parse(permMetaDataRaw);\n      } catch (err) {\n        // workaround for https://issues.redhat.com/browse/RHIDP-1456\n        return undefined;\n      }\n    } catch (err) {\n      if (isError(err) && err.name === 'NotFoundError') {\n        this.logger.warn(\n          `No permission metadata found for ${pluginId}. ${err}`,\n        );\n        return undefined;\n      }\n      this.logger.error(\n        `Failed to retrieve permission metadata for ${pluginId}. ${err}`,\n      );\n    }\n    return permMetaData;\n  }\n}\n\nfunction permissionsToCasbinPolicies(\n  permissions: Permission[],\n): PolicyDetails[] {\n  const policies: PolicyDetails[] = [];\n  for (const permission of permissions) {\n    if (isResourcePermission(permission)) {\n      policies.push({\n        resourceType: permission.resourceType,\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    } else {\n      policies.push({\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    }\n  }\n\n  return policies;\n}\n"],"names":["policyEntityPermissions","rbacRules","UrlReaders","FetchUrlReader","isError","isResourcePermission"],"mappings":";;;;;;;;;AAuDA,MAAM,sBAA2C,GAAA;AAAA,EAC/C,WAAa,EAAAA,wCAAA;AAAA,EACb,KAAA,EAAO,CAACC,eAAS;AACnB,CAAA;AAEO,MAAM,iCAAkC,CAAA;AAAA,EAC5B,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEjB,WAAY,CAAA;AAAA,IACV,IAAA;AAAA,IACA;AAAA,GAWC,EAAA;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,MAAQ,EAAA,MAAA,EAAQ,kBAAqB,GAAA,IAAA;AACxD,IAAA,IAAA,CAAK,SAAY,GAAA,SAAA;AACjB,IAAA,IAAA,CAAK,gBAAmB,GAAA,gBAAA;AACxB,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA;AACd,IAAA,IAAA,CAAK,SACH,GAAA,QAAA,EAAU,SACV,IAAAC,oBAAA,CAAW,OAAQ,CAAA;AAAA,MACjB,MAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA,EAAW,CAAC,iCAAA,CAAkC,iBAAiB;AAAA,KAChE,CAAA;AAAA;AACL,EAEA,MAAM,wBACJ,IACiD,EAAA;AACjD,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,MAAO,CAAA,CAAA,QAAA,KAAY,QAAS,CAAA,gBAAA,CAAiB,MAAM,MAAS,GAAA,CAAC,CAC7D,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,KAAA,EAAO,SAAS,gBAAiB,CAAA;AAAA,OACnC;AAAA,KACD,CAAA;AAAA;AACL,EAEA,MAAM,kBACJ,IACqC,EAAA;AACrC,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,OAAO,CAAY,QAAA,KAAA,QAAA,CAAS,iBAAiB,WAAgB,KAAA,SAAS,CACtE,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,QAAU,EAAA,2BAAA;AAAA,UACR,SAAS,gBAAiB,CAAA;AAAA;AAC5B,OACF;AAAA,KACD,CAAA;AAAA;AACL,EAEA,OAAe,oBAAmC,MAAM;AACtD,IAAO,OAAA,CAAC,EAAE,MAAA,EAAQ,IAAIC,wBAAA,IAAkB,SAAW,EAAA,CAAC,IAAc,KAAA,IAAA,EAAM,CAAA;AAAA,GAC1E;AAAA,EAEA,MAAc,kBACZ,IACmC,EAAA;AACnC,IAAA,IAAI,kBAA4C,EAAC;AAEjD,IAAA,MAAM,SAAY,GAAA,MAAM,IAAK,CAAA,gBAAA,CAAiB,YAAa,EAAA;AAC3D,IAAA,KAAA,MAAW,YAAY,SAAW,EAAA;AAChC,MAAI,IAAA;AACF,QAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,UACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,UAChD,cAAgB,EAAA;AAAA,SACjB,CAAA;AAED,QAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,qBAAA,CAAsB,UAAU,KAAK,CAAA;AACrE,QAAA,IAAI,YAAc,EAAA;AAChB,UAAkB,eAAA,GAAA;AAAA,YAChB,GAAG,eAAA;AAAA,YACH;AAAA,cACE,gBAAkB,EAAA,YAAA;AAAA,cAClB;AAAA;AACF,WACF;AAAA;AACF,eACO,KAAO,EAAA;AACd,QAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,UACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,KAAK,CAAA;AAAA,SAClE;AAAA;AACF;AAGF,IAAO,OAAA,eAAA;AAAA;AACT,EAEA,MAAM,qBACJ,CAAA,QAAA,EACA,KACuC,EAAA;AACvC,IAAI,IAAA,YAAA;AAMJ,IAAA,IAAI,aAAa,YAAc,EAAA;AAC7B,MAAO,OAAA,sBAAA;AAAA;AAGT,IAAI,IAAA;AACF,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,QAAQ,CAAA;AAC7D,MAAM,MAAA,YAAA,GAAe,GAAG,YAAY,CAAA,2CAAA,CAAA;AAEpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA,CAAU,QAAQ,YAAc,EAAA,EAAE,OAAO,CAAA;AACrE,MAAA,MAAM,eAAmB,GAAA,CAAA,MAAM,QAAS,CAAA,MAAA,IAAU,QAAS,EAAA;AAE3D,MAAI,IAAA;AACF,QAAe,YAAA,GAAA,IAAA,CAAK,MAAM,eAAe,CAAA;AAAA,eAClC,GAAK,EAAA;AAEZ,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,aACO,GAAK,EAAA;AACZ,MAAA,IAAIC,cAAQ,CAAA,GAAG,CAAK,IAAA,GAAA,CAAI,SAAS,eAAiB,EAAA;AAChD,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAA,iCAAA,EAAoC,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,SACtD;AACA,QAAO,OAAA,SAAA;AAAA;AAET,MAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,QACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,OAChE;AAAA;AAEF,IAAO,OAAA,YAAA;AAAA;AAEX;AAEA,SAAS,4BACP,WACiB,EAAA;AACjB,EAAA,MAAM,WAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AACpC,IAAI,IAAAC,2CAAA,CAAqB,UAAU,CAAG,EAAA;AACpC,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,cAAc,UAAW,CAAA,YAAA;AAAA,QACzB,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA,KACI,MAAA;AACL,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA;AACH;AAGF,EAAO,OAAA,QAAA;AACT;;;;"}

package/dist/service/policies-rest-api.cjs.js

@@ -3,7 +3,6 @@
 var errors = require('@backstage/errors');
 var pluginPermissionBackend = require('@backstage/plugin-permission-backend');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
-var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var lodash = require('lodash');
 var pluginRbacCommon = require('@backstage-community/plugin-rbac-common');
 var restInterceptor = require('../auditor/rest-interceptor.cjs.js');
@@ -12,76 +11,73 @@ var helper = require('../helper.cjs.js');
 var conditionValidation = require('../validation/condition-validation.cjs.js');
 var policiesValidation = require('../validation/policies-validation.cjs.js');
 var conditions = require('../permissions/conditions.cjs.js');
-var rules = require('../permissions/rules.cjs.js');
+require('../permissions/rules.cjs.js');
+var permissionDefinitionRoutes = require('./permission-definition-routes.cjs.js');
 
+async function authorizeConditional(request, permission, deps) {
+  const { auth, httpAuth, permissions } = deps;
+  const credentials = await httpAuth.credentials(request, {
+    allow: ["user", "service"]
+  });
+  if (auth.isPrincipal(credentials, "service") && permission !== pluginRbacCommon.policyEntityReadPermission) {
+    throw new errors.NotAllowedError(
+      `Only credential principal with type 'user' permitted to modify permissions`
+    );
+  }
+  let decision;
+  if (permission.type === "resource") {
+    decision = (await permissions.authorizeConditional([{ permission }], {
+      credentials
+    }))[0];
+  } else {
+    decision = (await permissions.authorize([{ permission }], {
+      credentials
+    }))[0];
+  }
+  if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+    throw new errors.NotAllowedError();
+  }
+  return { decision, credentials };
+}
 class PoliciesServer {
-  constructor(permissions, options, enforcer, conditionalStorage, pluginPermMetaData, roleMetadata, auditor, rbacProviders) {
-    this.permissions = permissions;
+  constructor(options, enforcer, conditionalStorage, pluginPermMetaData, roleMetadata, extraPluginsIdStorage, pluginIdProvider, rbacProviders) {
     this.options = options;
     this.enforcer = enforcer;
     this.conditionalStorage = conditionalStorage;
     this.pluginPermMetaData = pluginPermMetaData;
     this.roleMetadata = roleMetadata;
-    this.auditor = auditor;
+    this.extraPluginsIdStorage = extraPluginsIdStorage;
+    this.pluginIdProvider = pluginIdProvider;
     this.rbacProviders = rbacProviders;
   }
-  async authorizeConditional(request, permission) {
-    const credentials = await this.options.httpAuth.credentials(request, {
-      allow: ["user", "service"]
-    });
-    if (this.options.auth.isPrincipal(credentials, "service") && permission !== pluginRbacCommon.policyEntityReadPermission) {
-      throw new errors.NotAllowedError(
-        `Only credential principal with type 'user' permitted to modify permissions`
-      );
-    }
-    let decision;
-    if (permission.type === "resource") {
-      decision = (await this.permissions.authorizeConditional([{ permission }], {
-        credentials
-      }))[0];
-    } else {
-      decision = (await this.permissions.authorize([{ permission }], {
-        credentials
-      }))[0];
-    }
-    if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-      throw new errors.NotAllowedError();
-    }
-    return { decision, credentials };
-  }
   async serve() {
     const router = await pluginPermissionBackend.createRouter(this.options);
-    const { logger } = this.options;
-    const policyPermissionsIntegrationRouter = pluginPermissionNode.createPermissionIntegrationRouter({
-      resourceType: pluginRbacCommon.RESOURCE_TYPE_POLICY_ENTITY,
-      getResources: (resourceRefs) => Promise.all(
-        resourceRefs.map((ref) => {
-          return this.roleMetadata.findRoleMetadata(ref);
-        })
-      ),
-      permissions: pluginRbacCommon.policyEntityPermissions,
-      rules: Object.values(rules.rules)
-    });
-    router.use(policyPermissionsIntegrationRouter);
+    const { logger, auditor, auth, permissionsRegistry } = this.options;
     const isPluginEnabled = this.options.config.getOptionalBoolean("permission.enabled");
     if (!isPluginEnabled) {
       return router;
     }
+    const transformConditions = conditions.conditionTransformerFunc(permissionsRegistry);
     router.get("/", async (request, response) => {
-      await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
+      await authorizeConditional(
+        request,
+        pluginRbacCommon.policyEntityReadPermission,
+        this.options
+      );
       response.send({ status: "Authorized" });
     });
     router.get(
       "/policies",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         let policies = [];
@@ -119,15 +115,16 @@ class PoliciesServer {
     );
     router.get(
       "/policies/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         const matchedRoleName = roleMetadata.flatMap((role) => {
@@ -153,15 +150,16 @@ class PoliciesServer {
     );
     router.delete(
       "/policies/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityDeletePermission
+          pluginRbacCommon.policyEntityDeletePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const entityRef = this.getEntityReference(request);
         const policyRaw = request.body;
@@ -184,9 +182,13 @@ class PoliciesServer {
     );
     router.post(
       "/policies",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
+        await authorizeConditional(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
+        );
         const policyRaw = request.body;
         if (lodash.isEmpty(policyRaw)) {
           throw new errors.InputError(`permission policy must be present`);
@@ -208,15 +210,16 @@ class PoliciesServer {
     );
     router.put(
       "/policies/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityUpdatePermission
+          pluginRbacCommon.policyEntityUpdatePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const entityRef = this.getEntityReference(request);
         const oldPolicyRaw = request.body.oldPolicy;
@@ -269,15 +272,16 @@ class PoliciesServer {
     );
     router.get(
       "/roles",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roles = await this.enforcer.getGroupingPolicy();
         const body = await this.transformRoleArray(conditionsFilter, ...roles);
@@ -286,15 +290,16 @@ class PoliciesServer {
     );
     router.get(
       "/roles/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleEntityRef = this.getEntityReference(request, true);
         const role = await this.enforcer.getFilteredGroupingPolicy(
@@ -311,12 +316,13 @@ class PoliciesServer {
     );
     router.post(
       "/roles",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         const uniqueItems = /* @__PURE__ */ new Set();
-        const { credentials } = await this.authorizeConditional(
+        const { credentials } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityCreatePermission
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
         );
         const roleRaw = request.body;
         let err = policiesValidation.validateRole(roleRaw);
@@ -366,16 +372,17 @@ class PoliciesServer {
     );
     router.put(
       "/roles/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         const uniqueItems = /* @__PURE__ */ new Set();
         let conditionsFilter;
-        const { decision, credentials } = await this.authorizeConditional(
+        const { decision, credentials } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityUpdatePermission
+          pluginRbacCommon.policyEntityUpdatePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleEntityRef = this.getEntityReference(request, true);
         const oldRoleRaw = request.body.oldRole;
@@ -492,15 +499,16 @@ class PoliciesServer {
     );
     router.delete(
       "/roles/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision, credentials } = await this.authorizeConditional(
+        const { decision, credentials } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityDeletePermission
+          pluginRbacCommon.policyEntityDeletePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleEntityRef = this.getEntityReference(request, true);
         const currentMetadata = await this.roleMetadata.findRoleMetadata(roleEntityRef);
@@ -557,51 +565,30 @@ class PoliciesServer {
         response.status(204).end();
       }
     );
-    router.get(
-      "/plugins/policies",
-      restInterceptor.logAuditorEvent(this.auditor),
-      async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
-        const body = await this.pluginPermMetaData.getPluginPolicies(
-          this.options.auth
-        );
-        response.json(body);
-      }
-    );
-    router.get(
-      "/plugins/condition-rules",
-      restInterceptor.logAuditorEvent(this.auditor),
-      async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
-        const body = await this.pluginPermMetaData.getPluginConditionRules(
-          this.options.auth
-        );
-        response.json(body);
-      }
-    );
     router.get(
       "/roles/conditions",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         const matchedRoleName = roleMetadata.flatMap((role) => {
           return role.roleEntityRef;
         });
-        const conditions$1 = await this.conditionalStorage.filterConditions(
+        const conditions = await this.conditionalStorage.filterConditions(
           this.getFirstQuery(request.query.roleEntityRef),
           this.getFirstQuery(request.query.pluginId),
           this.getFirstQuery(request.query.resourceType),
           this.getActionQueries(request.query.actions)
         );
-        const body = conditions$1.map((condition) => {
+        const body = conditions.map((condition) => {
           return {
             ...condition,
             permissionMapping: condition.permissionMapping.map(
@@ -616,15 +603,19 @@ class PoliciesServer {
     );
     router.post(
       "/roles/conditions",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
+        await authorizeConditional(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
+        );
         const roleConditionPolicy = request.body;
         conditionValidation.validateRoleCondition(roleConditionPolicy);
         const conditionToCreate = await helper.processConditionMapping(
           roleConditionPolicy,
           this.pluginPermMetaData,
-          this.options.auth
+          auth
         );
         const id = await this.conditionalStorage.createCondition(conditionToCreate);
         const body = { id };
@@ -634,12 +625,13 @@ class PoliciesServer {
     );
     router.get(
       "/roles/conditions/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
@@ -650,7 +642,7 @@ class PoliciesServer {
           throw new errors.NotFoundError();
         }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         const matchedRoleName = roleMetadata.flatMap((role) => {
@@ -667,15 +659,16 @@ class PoliciesServer {
     );
     router.delete(
       "/roles/conditions/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityDeletePermission
+          pluginRbacCommon.policyEntityDeletePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
@@ -702,15 +695,16 @@ class PoliciesServer {
     );
     router.put(
       "/roles/conditions/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityUpdatePermission
+          pluginRbacCommon.policyEntityUpdatePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
@@ -731,7 +725,7 @@ class PoliciesServer {
         const conditionToUpdate = await helper.processConditionMapping(
           roleConditionPolicy,
           this.pluginPermMetaData,
-          this.options.auth
+          auth
         );
         await this.conditionalStorage.updateCondition(id, conditionToUpdate);
         response.locals.meta = { condition: roleConditionPolicy };
@@ -740,9 +734,13 @@ class PoliciesServer {
     );
     router.post(
       "/refresh/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
+        await authorizeConditional(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
+        );
         if (!this.rbacProviders) {
           throw new errors.NotFoundError(`No RBAC providers were found`);
         }
@@ -759,6 +757,13 @@ class PoliciesServer {
         response.status(200).end();
       }
     );
+    permissionDefinitionRoutes.registerPermissionDefinitionRoutes(
+      router,
+      this.pluginPermMetaData,
+      this.pluginIdProvider,
+      this.extraPluginsIdStorage,
+      this.options
+    );
     router.use(restInterceptor.setAuditorError());
     return router;
   }
@@ -939,4 +944,5 @@ class PoliciesServer {
 }
 
 exports.PoliciesServer = PoliciesServer;
+exports.authorizeConditional = authorizeConditional;
 //# sourceMappingURL=policies-rest-api.cjs.js.map