@backstage-community/plugin-rbac-backend 6.2.6 → 7.0.0

package/dist/service/permission-definition-routes.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-definition-routes.cjs.js","sources":["../../src/service/permission-definition-routes.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  PermissionDependentPluginList,\n  policyEntityCreatePermission,\n  policyEntityDeletePermission,\n  policyEntityReadPermission,\n} from '@backstage-community/plugin-rbac-common';\nimport { logAuditorEvent } from '../auditor/rest-interceptor';\nimport { PluginPermissionMetadataCollector } from './plugin-endpoints';\nimport {\n  PermissionDependentPluginDTO,\n  PermissionDependentPluginStore,\n} from '../database/extra-permission-enabled-plugins-storage';\nimport { authorizeConditional } from './policies-rest-api';\nimport {\n  AuditorService,\n  AuthService,\n  HttpAuthService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport { ExtendablePluginIdProvider } from './extendable-id-provider';\nimport {\n  ConflictError,\n  NotAllowedError,\n  NotFoundError,\n} from '@backstage/errors';\nimport { validatePermissionDependentPlugin } from '../validation/plugin-validation';\nimport express from 'express';\n\nexport function registerPermissionDefinitionRoutes(\n  router: express.Router,\n  pluginPermMetaData: PluginPermissionMetadataCollector,\n  pluginIdProvider: ExtendablePluginIdProvider,\n  extraPluginsIdStorage: PermissionDependentPluginStore,\n  deps: {\n    auth: AuthService;\n    httpAuth: HttpAuthService;\n    auditor: AuditorService;\n    permissions: PermissionsService;\n  },\n) {\n  const { auth, auditor } = deps;\n\n  router.get(\n    '/plugins/policies',\n    logAuditorEvent(auditor),\n    async (request, response) => {\n      await authorizeConditional(request, policyEntityReadPermission, deps);\n\n      const body = await pluginPermMetaData.getPluginPolicies(auth);\n\n      response.json(body);\n    },\n  );\n\n  router.get(\n    '/plugins/condition-rules',\n    logAuditorEvent(auditor),\n    async (request, response) => {\n      await authorizeConditional(request, policyEntityReadPermission, deps);\n\n      const body = await pluginPermMetaData.getPluginConditionRules(auth);\n\n      response.json(body);\n    },\n  );\n\n  router.get(\n    '/plugins/id',\n    logAuditorEvent(auditor),\n    async (request, response) => {\n      await authorizeConditional(request, policyEntityReadPermission, deps);\n\n      const actualPluginIds = await pluginIdProvider.getPluginIds();\n      response.status(200).json(pluginIdsToResponse(actualPluginIds));\n    },\n  );\n\n  router.post(\n    '/plugins/id',\n    logAuditorEvent(auditor),\n    async (request, response) => {\n      await authorizeConditional(request, policyEntityCreatePermission, deps);\n      const pluginIds: PermissionDependentPluginList = request.body;\n      validatePermissionDependentPlugin(pluginIds);\n      const pluginDtos = permissionDependentPluginListToDTO(pluginIds);\n\n      let actualPluginIds = await pluginIdProvider.getPluginIds();\n      const conflictedIds = pluginIds.ids.filter(id =>\n        actualPluginIds.includes(id),\n      );\n      if (conflictedIds.length > 0) {\n        throw new ConflictError(\n          `Plugin IDs ${JSON.stringify(conflictedIds)} already exist in the system. Please use a different set of plugin ids.`,\n        );\n      }\n      await extraPluginsIdStorage.addPlugins(pluginDtos);\n      response.locals.meta = pluginIds;\n\n      actualPluginIds = await pluginIdProvider.getPluginIds();\n      response.status(200).json(pluginIdsToResponse(actualPluginIds));\n    },\n  );\n\n  router.delete(\n    '/plugins/id',\n    logAuditorEvent(auditor),\n    async (request, response) => {\n      await authorizeConditional(request, policyEntityDeletePermission, deps);\n      const pluginIds: PermissionDependentPluginList = request.body;\n      validatePermissionDependentPlugin(pluginIds);\n      const configuredPluginIds = pluginIds.ids.filter(pluginId =>\n        pluginIdProvider.isConfiguredPluginId(pluginId),\n      );\n      if (configuredPluginIds.length > 0) {\n        throw new NotAllowedError(\n          `Plugin IDs ${JSON.stringify(pluginIds.ids)} can be removed only with help of configuration.`,\n        );\n      }\n\n      let actualPluginIds = await pluginIdProvider.getPluginIds();\n      const notFoundPlugins = pluginIds.ids.filter(\n        pluginToDel => !actualPluginIds.includes(pluginToDel),\n      );\n      if (notFoundPlugins.length > 0) {\n        throw new NotFoundError(\n          `Plugin IDs ${JSON.stringify(notFoundPlugins)} were not found.`,\n        );\n      }\n\n      await extraPluginsIdStorage.deletePlugins(pluginIds.ids);\n      response.locals.meta = pluginIds;\n\n      actualPluginIds = await pluginIdProvider.getPluginIds();\n      response.status(200).json(pluginIdsToResponse(actualPluginIds));\n    },\n  );\n}\n\nexport function pluginIdsToResponse(\n  pluginIds: string[],\n): PermissionDependentPluginList {\n  return { ids: pluginIds };\n}\n\nexport function permissionDependentPluginListToDTO(\n  pluginList: PermissionDependentPluginList,\n): PermissionDependentPluginDTO[] {\n  return pluginList.ids.map(pluginId => {\n    return { pluginId };\n  });\n}\n"],"names":["logAuditorEvent","authorizeConditional","policyEntityReadPermission","policyEntityCreatePermission","validatePermissionDependentPlugin","ConflictError","policyEntityDeletePermission","NotAllowedError","NotFoundError"],"mappings":";;;;;;;;AA2CO,SAAS,kCACd,CAAA,MAAA,EACA,kBACA,EAAA,gBAAA,EACA,uBACA,IAMA,EAAA;AACA,EAAM,MAAA,EAAE,IAAM,EAAA,OAAA,EAAY,GAAA,IAAA;AAE1B,EAAO,MAAA,CAAA,GAAA;AAAA,IACL,mBAAA;AAAA,IACAA,gCAAgB,OAAO,CAAA;AAAA,IACvB,OAAO,SAAS,QAAa,KAAA;AAC3B,MAAM,MAAAC,oCAAA,CAAqB,OAAS,EAAAC,2CAAA,EAA4B,IAAI,CAAA;AAEpE,MAAA,MAAM,IAAO,GAAA,MAAM,kBAAmB,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAE5D,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA;AACpB,GACF;AAEA,EAAO,MAAA,CAAA,GAAA;AAAA,IACL,0BAAA;AAAA,IACAF,gCAAgB,OAAO,CAAA;AAAA,IACvB,OAAO,SAAS,QAAa,KAAA;AAC3B,MAAM,MAAAC,oCAAA,CAAqB,OAAS,EAAAC,2CAAA,EAA4B,IAAI,CAAA;AAEpE,MAAA,MAAM,IAAO,GAAA,MAAM,kBAAmB,CAAA,uBAAA,CAAwB,IAAI,CAAA;AAElE,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA;AACpB,GACF;AAEA,EAAO,MAAA,CAAA,GAAA;AAAA,IACL,aAAA;AAAA,IACAF,gCAAgB,OAAO,CAAA;AAAA,IACvB,OAAO,SAAS,QAAa,KAAA;AAC3B,MAAM,MAAAC,oCAAA,CAAqB,OAAS,EAAAC,2CAAA,EAA4B,IAAI,CAAA;AAEpE,MAAM,MAAA,eAAA,GAAkB,MAAM,gBAAA,CAAiB,YAAa,EAAA;AAC5D,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,IAAK,CAAA,mBAAA,CAAoB,eAAe,CAAC,CAAA;AAAA;AAChE,GACF;AAEA,EAAO,MAAA,CAAA,IAAA;AAAA,IACL,aAAA;AAAA,IACAF,gCAAgB,OAAO,CAAA;AAAA,IACvB,OAAO,SAAS,QAAa,KAAA;AAC3B,MAAM,MAAAC,oCAAA,CAAqB,OAAS,EAAAE,6CAAA,EAA8B,IAAI,CAAA;AACtE,MAAA,MAAM,YAA2C,OAAQ,CAAA,IAAA;AACzD,MAAAC,kDAAA,CAAkC,SAAS,CAAA;AAC3C,MAAM,MAAA,UAAA,GAAa,mCAAmC,SAAS,CAAA;AAE/D,MAAI,IAAA,eAAA,GAAkB,MAAM,gBAAA,CAAiB,YAAa,EAAA;AAC1D,MAAM,MAAA,aAAA,GAAgB,UAAU,GAAI,CAAA,MAAA;AAAA,QAAO,CAAA,EAAA,KACzC,eAAgB,CAAA,QAAA,CAAS,EAAE;AAAA,OAC7B;AACA,MAAI,IAAA,aAAA,CAAc,SAAS,CAAG,EAAA;AAC5B,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,CAAc,WAAA,EAAA,IAAA,CAAK,SAAU,CAAA,aAAa,CAAC,CAAA,uEAAA;AAAA,SAC7C;AAAA;AAEF,MAAM,MAAA,qBAAA,CAAsB,WAAW,UAAU,CAAA;AACjD,MAAA,QAAA,CAAS,OAAO,IAAO,GAAA,SAAA;AAEvB,MAAkB,eAAA,GAAA,MAAM,iBAAiB,YAAa,EAAA;AACtD,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,IAAK,CAAA,mBAAA,CAAoB,eAAe,CAAC,CAAA;AAAA;AAChE,GACF;AAEA,EAAO,MAAA,CAAA,MAAA;AAAA,IACL,aAAA;AAAA,IACAL,gCAAgB,OAAO,CAAA;AAAA,IACvB,OAAO,SAAS,QAAa,KAAA;AAC3B,MAAM,MAAAC,oCAAA,CAAqB,OAAS,EAAAK,6CAAA,EAA8B,IAAI,CAAA;AACtE,MAAA,MAAM,YAA2C,OAAQ,CAAA,IAAA;AACzD,MAAAF,kDAAA,CAAkC,SAAS,CAAA;AAC3C,MAAM,MAAA,mBAAA,GAAsB,UAAU,GAAI,CAAA,MAAA;AAAA,QAAO,CAAA,QAAA,KAC/C,gBAAiB,CAAA,oBAAA,CAAqB,QAAQ;AAAA,OAChD;AACA,MAAI,IAAA,mBAAA,CAAoB,SAAS,CAAG,EAAA;AAClC,QAAA,MAAM,IAAIG,sBAAA;AAAA,UACR,CAAc,WAAA,EAAA,IAAA,CAAK,SAAU,CAAA,SAAA,CAAU,GAAG,CAAC,CAAA,gDAAA;AAAA,SAC7C;AAAA;AAGF,MAAI,IAAA,eAAA,GAAkB,MAAM,gBAAA,CAAiB,YAAa,EAAA;AAC1D,MAAM,MAAA,eAAA,GAAkB,UAAU,GAAI,CAAA,MAAA;AAAA,QACpC,CAAe,WAAA,KAAA,CAAC,eAAgB,CAAA,QAAA,CAAS,WAAW;AAAA,OACtD;AACA,MAAI,IAAA,eAAA,CAAgB,SAAS,CAAG,EAAA;AAC9B,QAAA,MAAM,IAAIC,oBAAA;AAAA,UACR,CAAc,WAAA,EAAA,IAAA,CAAK,SAAU,CAAA,eAAe,CAAC,CAAA,gBAAA;AAAA,SAC/C;AAAA;AAGF,MAAM,MAAA,qBAAA,CAAsB,aAAc,CAAA,SAAA,CAAU,GAAG,CAAA;AACvD,MAAA,QAAA,CAAS,OAAO,IAAO,GAAA,SAAA;AAEvB,MAAkB,eAAA,GAAA,MAAM,iBAAiB,YAAa,EAAA;AACtD,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,IAAK,CAAA,mBAAA,CAAoB,eAAe,CAAC,CAAA;AAAA;AAChE,GACF;AACF;AAEO,SAAS,oBACd,SAC+B,EAAA;AAC/B,EAAO,OAAA,EAAE,KAAK,SAAU,EAAA;AAC1B;AAEO,SAAS,mCACd,UACgC,EAAA;AAChC,EAAO,OAAA,UAAA,CAAW,GAAI,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACpC,IAAA,OAAO,EAAE,QAAS,EAAA;AAAA,GACnB,CAAA;AACH;;;;;;"}

package/dist/service/plugin-endpoints.cjs.js

@@ -12,7 +12,7 @@ const rbacPermissionMetadata = {
   rules: [rules.rbacRules]
 };
 class PluginPermissionMetadataCollector {
-  pluginIds;
+  pluginIdProvider;
   discovery;
   logger;
   urlReader;
@@ -20,9 +20,9 @@ class PluginPermissionMetadataCollector {
     deps,
     optional
   }) {
-    const { discovery, pluginIdProvider, logger, config } = deps;
-    this.pluginIds = pluginIdProvider.getPluginIds();
+    const { discovery, logger, config, pluginIdProvider } = deps;
     this.discovery = discovery;
+    this.pluginIdProvider = pluginIdProvider;
     this.logger = logger;
     this.urlReader = optional?.urlReader ?? urlReader.UrlReaders.default({
       config,
@@ -55,7 +55,8 @@ class PluginPermissionMetadataCollector {
   };
   async getPluginMetaData(auth) {
     let pluginResponses = [];
-    for (const pluginId of this.pluginIds) {
+    const pluginIds = await this.pluginIdProvider.getPluginIds();
+    for (const pluginId of pluginIds) {
       try {
         const { token } = await auth.getPluginRequestToken({
           onBehalfOf: await auth.getOwnServiceCredentials(),

package/dist/service/plugin-endpoints.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-endpoints.cjs.js","sources":["../../src/service/plugin-endpoints.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  FetchUrlReader,\n  ReaderFactory,\n  UrlReaders,\n} from '@backstage/backend-defaults/urlReader';\nimport type {\n  AuthService,\n  DiscoveryService,\n  LoggerService,\n  UrlReaderService,\n} from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport { isError } from '@backstage/errors';\nimport {\n  isResourcePermission,\n  Permission,\n} from '@backstage/plugin-permission-common';\nimport type {\n  MetadataResponse,\n  MetadataResponseSerializedRule,\n} from '@backstage/plugin-permission-node';\n\nimport {\n  policyEntityPermissions,\n  type PluginPermissionMetaData,\n  type PolicyDetails,\n} from '@backstage-community/plugin-rbac-common';\nimport type { PluginIdProvider } from '@backstage-community/plugin-rbac-node';\nimport { rbacRules } from '../permissions';\n\ntype PluginMetadataResponse = {\n  pluginId: string;\n  metaDataResponse: MetadataResponse;\n};\n\nexport type PluginMetadataResponseSerializedRule = {\n  pluginId: string;\n  rules: MetadataResponseSerializedRule[];\n};\n\nconst rbacPermissionMetadata: MetadataResponse = {\n  permissions: policyEntityPermissions,\n  rules: [rbacRules],\n};\n\nexport class PluginPermissionMetadataCollector {\n  private readonly pluginIds: string[];\n  private readonly discovery: DiscoveryService;\n  private readonly logger: LoggerService;\n  private readonly urlReader: UrlReaderService;\n\n  constructor({\n    deps,\n    optional,\n  }: {\n    deps: {\n      discovery: DiscoveryService;\n      pluginIdProvider: PluginIdProvider;\n      logger: LoggerService;\n      config: Config;\n    };\n    optional?: {\n      urlReader?: UrlReaderService;\n    };\n  }) {\n    const { discovery, pluginIdProvider, logger, config } = deps;\n    this.pluginIds = pluginIdProvider.getPluginIds();\n    this.discovery = discovery;\n    this.logger = logger;\n    this.urlReader =\n      optional?.urlReader ??\n      UrlReaders.default({\n        config,\n        logger,\n        factories: [PluginPermissionMetadataCollector.permissionFactory],\n      });\n  }\n\n  async getPluginConditionRules(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponseSerializedRule[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.rules.length > 0)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          rules: metadata.metaDataResponse.rules,\n        };\n      });\n  }\n\n  async getPluginPolicies(\n    auth: AuthService,\n  ): Promise<PluginPermissionMetaData[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.permissions !== undefined)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          policies: permissionsToCasbinPolicies(\n            metadata.metaDataResponse.permissions!,\n          ),\n        };\n      });\n  }\n\n  private static permissionFactory: ReaderFactory = () => {\n    return [{ reader: new FetchUrlReader(), predicate: (_url: URL) => true }];\n  };\n\n  private async getPluginMetaData(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponse[]> {\n    let pluginResponses: PluginMetadataResponse[] = [];\n\n    for (const pluginId of this.pluginIds) {\n      try {\n        const { token } = await auth.getPluginRequestToken({\n          onBehalfOf: await auth.getOwnServiceCredentials(),\n          targetPluginId: pluginId,\n        });\n\n        const permMetaData = await this.getMetadataByPluginId(pluginId, token);\n        if (permMetaData) {\n          pluginResponses = [\n            ...pluginResponses,\n            {\n              metaDataResponse: permMetaData,\n              pluginId,\n            },\n          ];\n        }\n      } catch (error) {\n        this.logger.error(\n          `Failed to retrieve permission metadata for ${pluginId}. ${error}`,\n        );\n      }\n    }\n\n    return pluginResponses;\n  }\n\n  async getMetadataByPluginId(\n    pluginId: string,\n    token: string | undefined,\n  ): Promise<MetadataResponse | undefined> {\n    let permMetaData: MetadataResponse | undefined;\n\n    // Work around: This is needed for start up whenever a conditional policy for the plugin permission in the yaml file\n    // will make a check to the well known endpoint\n    // However, our plugin has not completely started and as such will throw a 503 error\n    // TODO: see if we are able to remove this after we migrate to the permission registry\n    if (pluginId === 'permission') {\n      return rbacPermissionMetadata;\n    }\n\n    try {\n      const baseEndpoint = await this.discovery.getBaseUrl(pluginId);\n      const wellKnownURL = `${baseEndpoint}/.well-known/backstage/permissions/metadata`;\n\n      const permResp = await this.urlReader.readUrl(wellKnownURL, { token });\n      const permMetaDataRaw = (await permResp.buffer()).toString();\n\n      try {\n        permMetaData = JSON.parse(permMetaDataRaw);\n      } catch (err) {\n        // workaround for https://issues.redhat.com/browse/RHIDP-1456\n        return undefined;\n      }\n    } catch (err) {\n      if (isError(err) && err.name === 'NotFoundError') {\n        this.logger.warn(\n          `No permission metadata found for ${pluginId}. ${err}`,\n        );\n        return undefined;\n      }\n      this.logger.error(\n        `Failed to retrieve permission metadata for ${pluginId}. ${err}`,\n      );\n    }\n    return permMetaData;\n  }\n}\n\nfunction permissionsToCasbinPolicies(\n  permissions: Permission[],\n): PolicyDetails[] {\n  const policies: PolicyDetails[] = [];\n  for (const permission of permissions) {\n    if (isResourcePermission(permission)) {\n      policies.push({\n        resourceType: permission.resourceType,\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    } else {\n      policies.push({\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    }\n  }\n\n  return policies;\n}\n"],"names":["policyEntityPermissions","rbacRules","UrlReaders","FetchUrlReader","isError","isResourcePermission"],"mappings":";;;;;;;;;AAuDA,MAAM,sBAA2C,GAAA;AAAA,EAC/C,WAAa,EAAAA,wCAAA;AAAA,EACb,KAAA,EAAO,CAACC,eAAS;AACnB,CAAA;AAEO,MAAM,iCAAkC,CAAA;AAAA,EAC5B,SAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEjB,WAAY,CAAA;AAAA,IACV,IAAA;AAAA,IACA;AAAA,GAWC,EAAA;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,gBAAkB,EAAA,MAAA,EAAQ,QAAW,GAAA,IAAA;AACxD,IAAK,IAAA,CAAA,SAAA,GAAY,iBAAiB,YAAa,EAAA;AAC/C,IAAA,IAAA,CAAK,SAAY,GAAA,SAAA;AACjB,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA;AACd,IAAA,IAAA,CAAK,SACH,GAAA,QAAA,EAAU,SACV,IAAAC,oBAAA,CAAW,OAAQ,CAAA;AAAA,MACjB,MAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA,EAAW,CAAC,iCAAA,CAAkC,iBAAiB;AAAA,KAChE,CAAA;AAAA;AACL,EAEA,MAAM,wBACJ,IACiD,EAAA;AACjD,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,MAAO,CAAA,CAAA,QAAA,KAAY,QAAS,CAAA,gBAAA,CAAiB,MAAM,MAAS,GAAA,CAAC,CAC7D,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,KAAA,EAAO,SAAS,gBAAiB,CAAA;AAAA,OACnC;AAAA,KACD,CAAA;AAAA;AACL,EAEA,MAAM,kBACJ,IACqC,EAAA;AACrC,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,OAAO,CAAY,QAAA,KAAA,QAAA,CAAS,iBAAiB,WAAgB,KAAA,SAAS,CACtE,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,QAAU,EAAA,2BAAA;AAAA,UACR,SAAS,gBAAiB,CAAA;AAAA;AAC5B,OACF;AAAA,KACD,CAAA;AAAA;AACL,EAEA,OAAe,oBAAmC,MAAM;AACtD,IAAO,OAAA,CAAC,EAAE,MAAA,EAAQ,IAAIC,wBAAA,IAAkB,SAAW,EAAA,CAAC,IAAc,KAAA,IAAA,EAAM,CAAA;AAAA,GAC1E;AAAA,EAEA,MAAc,kBACZ,IACmC,EAAA;AACnC,IAAA,IAAI,kBAA4C,EAAC;AAEjD,IAAW,KAAA,MAAA,QAAA,IAAY,KAAK,SAAW,EAAA;AACrC,MAAI,IAAA;AACF,QAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,UACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,UAChD,cAAgB,EAAA;AAAA,SACjB,CAAA;AAED,QAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,qBAAA,CAAsB,UAAU,KAAK,CAAA;AACrE,QAAA,IAAI,YAAc,EAAA;AAChB,UAAkB,eAAA,GAAA;AAAA,YAChB,GAAG,eAAA;AAAA,YACH;AAAA,cACE,gBAAkB,EAAA,YAAA;AAAA,cAClB;AAAA;AACF,WACF;AAAA;AACF,eACO,KAAO,EAAA;AACd,QAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,UACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,KAAK,CAAA;AAAA,SAClE;AAAA;AACF;AAGF,IAAO,OAAA,eAAA;AAAA;AACT,EAEA,MAAM,qBACJ,CAAA,QAAA,EACA,KACuC,EAAA;AACvC,IAAI,IAAA,YAAA;AAMJ,IAAA,IAAI,aAAa,YAAc,EAAA;AAC7B,MAAO,OAAA,sBAAA;AAAA;AAGT,IAAI,IAAA;AACF,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,QAAQ,CAAA;AAC7D,MAAM,MAAA,YAAA,GAAe,GAAG,YAAY,CAAA,2CAAA,CAAA;AAEpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA,CAAU,QAAQ,YAAc,EAAA,EAAE,OAAO,CAAA;AACrE,MAAA,MAAM,eAAmB,GAAA,CAAA,MAAM,QAAS,CAAA,MAAA,IAAU,QAAS,EAAA;AAE3D,MAAI,IAAA;AACF,QAAe,YAAA,GAAA,IAAA,CAAK,MAAM,eAAe,CAAA;AAAA,eAClC,GAAK,EAAA;AAEZ,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,aACO,GAAK,EAAA;AACZ,MAAA,IAAIC,cAAQ,CAAA,GAAG,CAAK,IAAA,GAAA,CAAI,SAAS,eAAiB,EAAA;AAChD,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAA,iCAAA,EAAoC,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,SACtD;AACA,QAAO,OAAA,SAAA;AAAA;AAET,MAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,QACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,OAChE;AAAA;AAEF,IAAO,OAAA,YAAA;AAAA;AAEX;AAEA,SAAS,4BACP,WACiB,EAAA;AACjB,EAAA,MAAM,WAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AACpC,IAAI,IAAAC,2CAAA,CAAqB,UAAU,CAAG,EAAA;AACpC,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,cAAc,UAAW,CAAA,YAAA;AAAA,QACzB,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA,KACI,MAAA;AACL,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA;AACH;AAGF,EAAO,OAAA,QAAA;AACT;;;;"}
+{"version":3,"file":"plugin-endpoints.cjs.js","sources":["../../src/service/plugin-endpoints.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  FetchUrlReader,\n  ReaderFactory,\n  UrlReaders,\n} from '@backstage/backend-defaults/urlReader';\nimport type {\n  AuthService,\n  DiscoveryService,\n  LoggerService,\n  UrlReaderService,\n} from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport { isError } from '@backstage/errors';\nimport {\n  isResourcePermission,\n  Permission,\n} from '@backstage/plugin-permission-common';\nimport type {\n  MetadataResponse,\n  MetadataResponseSerializedRule,\n} from '@backstage/plugin-permission-node';\n\nimport {\n  policyEntityPermissions,\n  type PluginPermissionMetaData,\n  type PolicyDetails,\n} from '@backstage-community/plugin-rbac-common';\nimport { rbacRules } from '../permissions';\nimport { ExtendablePluginIdProvider } from './extendable-id-provider';\n\ntype PluginMetadataResponse = {\n  pluginId: string;\n  metaDataResponse: MetadataResponse;\n};\n\nexport type PluginMetadataResponseSerializedRule = {\n  pluginId: string;\n  rules: MetadataResponseSerializedRule[];\n};\n\nconst rbacPermissionMetadata: MetadataResponse = {\n  permissions: policyEntityPermissions,\n  rules: [rbacRules],\n};\n\nexport class PluginPermissionMetadataCollector {\n  private readonly pluginIdProvider: ExtendablePluginIdProvider;\n  private readonly discovery: DiscoveryService;\n  private readonly logger: LoggerService;\n  private readonly urlReader: UrlReaderService;\n\n  constructor({\n    deps,\n    optional,\n  }: {\n    deps: {\n      discovery: DiscoveryService;\n      pluginIdProvider: ExtendablePluginIdProvider;\n      logger: LoggerService;\n      config: Config;\n    };\n    optional?: {\n      urlReader?: UrlReaderService;\n    };\n  }) {\n    const { discovery, logger, config, pluginIdProvider } = deps;\n    this.discovery = discovery;\n    this.pluginIdProvider = pluginIdProvider;\n    this.logger = logger;\n    this.urlReader =\n      optional?.urlReader ??\n      UrlReaders.default({\n        config,\n        logger,\n        factories: [PluginPermissionMetadataCollector.permissionFactory],\n      });\n  }\n\n  async getPluginConditionRules(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponseSerializedRule[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.rules.length > 0)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          rules: metadata.metaDataResponse.rules,\n        };\n      });\n  }\n\n  async getPluginPolicies(\n    auth: AuthService,\n  ): Promise<PluginPermissionMetaData[]> {\n    const pluginMetadata = await this.getPluginMetaData(auth);\n\n    return pluginMetadata\n      .filter(metadata => metadata.metaDataResponse.permissions !== undefined)\n      .map(metadata => {\n        return {\n          pluginId: metadata.pluginId,\n          policies: permissionsToCasbinPolicies(\n            metadata.metaDataResponse.permissions!,\n          ),\n        };\n      });\n  }\n\n  private static permissionFactory: ReaderFactory = () => {\n    return [{ reader: new FetchUrlReader(), predicate: (_url: URL) => true }];\n  };\n\n  private async getPluginMetaData(\n    auth: AuthService,\n  ): Promise<PluginMetadataResponse[]> {\n    let pluginResponses: PluginMetadataResponse[] = [];\n\n    const pluginIds = await this.pluginIdProvider.getPluginIds();\n    for (const pluginId of pluginIds) {\n      try {\n        const { token } = await auth.getPluginRequestToken({\n          onBehalfOf: await auth.getOwnServiceCredentials(),\n          targetPluginId: pluginId,\n        });\n\n        const permMetaData = await this.getMetadataByPluginId(pluginId, token);\n        if (permMetaData) {\n          pluginResponses = [\n            ...pluginResponses,\n            {\n              metaDataResponse: permMetaData,\n              pluginId,\n            },\n          ];\n        }\n      } catch (error) {\n        this.logger.error(\n          `Failed to retrieve permission metadata for ${pluginId}. ${error}`,\n        );\n      }\n    }\n\n    return pluginResponses;\n  }\n\n  async getMetadataByPluginId(\n    pluginId: string,\n    token: string | undefined,\n  ): Promise<MetadataResponse | undefined> {\n    let permMetaData: MetadataResponse | undefined;\n\n    // Work around: This is needed for start up whenever a conditional policy for the plugin permission in the yaml file\n    // will make a check to the well known endpoint\n    // However, our plugin has not completely started and as such will throw a 503 error\n    // TODO: see if we are able to remove this after we migrate to the permission registry\n    if (pluginId === 'permission') {\n      return rbacPermissionMetadata;\n    }\n\n    try {\n      const baseEndpoint = await this.discovery.getBaseUrl(pluginId);\n      const wellKnownURL = `${baseEndpoint}/.well-known/backstage/permissions/metadata`;\n\n      const permResp = await this.urlReader.readUrl(wellKnownURL, { token });\n      const permMetaDataRaw = (await permResp.buffer()).toString();\n\n      try {\n        permMetaData = JSON.parse(permMetaDataRaw);\n      } catch (err) {\n        // workaround for https://issues.redhat.com/browse/RHIDP-1456\n        return undefined;\n      }\n    } catch (err) {\n      if (isError(err) && err.name === 'NotFoundError') {\n        this.logger.warn(\n          `No permission metadata found for ${pluginId}. ${err}`,\n        );\n        return undefined;\n      }\n      this.logger.error(\n        `Failed to retrieve permission metadata for ${pluginId}. ${err}`,\n      );\n    }\n    return permMetaData;\n  }\n}\n\nfunction permissionsToCasbinPolicies(\n  permissions: Permission[],\n): PolicyDetails[] {\n  const policies: PolicyDetails[] = [];\n  for (const permission of permissions) {\n    if (isResourcePermission(permission)) {\n      policies.push({\n        resourceType: permission.resourceType,\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    } else {\n      policies.push({\n        name: permission.name,\n        policy: permission.attributes.action || 'use',\n      });\n    }\n  }\n\n  return policies;\n}\n"],"names":["policyEntityPermissions","rbacRules","UrlReaders","FetchUrlReader","isError","isResourcePermission"],"mappings":";;;;;;;;;AAuDA,MAAM,sBAA2C,GAAA;AAAA,EAC/C,WAAa,EAAAA,wCAAA;AAAA,EACb,KAAA,EAAO,CAACC,eAAS;AACnB,CAAA;AAEO,MAAM,iCAAkC,CAAA;AAAA,EAC5B,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEjB,WAAY,CAAA;AAAA,IACV,IAAA;AAAA,IACA;AAAA,GAWC,EAAA;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,MAAQ,EAAA,MAAA,EAAQ,kBAAqB,GAAA,IAAA;AACxD,IAAA,IAAA,CAAK,SAAY,GAAA,SAAA;AACjB,IAAA,IAAA,CAAK,gBAAmB,GAAA,gBAAA;AACxB,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA;AACd,IAAA,IAAA,CAAK,SACH,GAAA,QAAA,EAAU,SACV,IAAAC,oBAAA,CAAW,OAAQ,CAAA;AAAA,MACjB,MAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA,EAAW,CAAC,iCAAA,CAAkC,iBAAiB;AAAA,KAChE,CAAA;AAAA;AACL,EAEA,MAAM,wBACJ,IACiD,EAAA;AACjD,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,MAAO,CAAA,CAAA,QAAA,KAAY,QAAS,CAAA,gBAAA,CAAiB,MAAM,MAAS,GAAA,CAAC,CAC7D,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,KAAA,EAAO,SAAS,gBAAiB,CAAA;AAAA,OACnC;AAAA,KACD,CAAA;AAAA;AACL,EAEA,MAAM,kBACJ,IACqC,EAAA;AACrC,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,iBAAA,CAAkB,IAAI,CAAA;AAExD,IAAO,OAAA,cAAA,CACJ,OAAO,CAAY,QAAA,KAAA,QAAA,CAAS,iBAAiB,WAAgB,KAAA,SAAS,CACtE,CAAA,GAAA,CAAI,CAAY,QAAA,KAAA;AACf,MAAO,OAAA;AAAA,QACL,UAAU,QAAS,CAAA,QAAA;AAAA,QACnB,QAAU,EAAA,2BAAA;AAAA,UACR,SAAS,gBAAiB,CAAA;AAAA;AAC5B,OACF;AAAA,KACD,CAAA;AAAA;AACL,EAEA,OAAe,oBAAmC,MAAM;AACtD,IAAO,OAAA,CAAC,EAAE,MAAA,EAAQ,IAAIC,wBAAA,IAAkB,SAAW,EAAA,CAAC,IAAc,KAAA,IAAA,EAAM,CAAA;AAAA,GAC1E;AAAA,EAEA,MAAc,kBACZ,IACmC,EAAA;AACnC,IAAA,IAAI,kBAA4C,EAAC;AAEjD,IAAA,MAAM,SAAY,GAAA,MAAM,IAAK,CAAA,gBAAA,CAAiB,YAAa,EAAA;AAC3D,IAAA,KAAA,MAAW,YAAY,SAAW,EAAA;AAChC,MAAI,IAAA;AACF,QAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,UACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,UAChD,cAAgB,EAAA;AAAA,SACjB,CAAA;AAED,QAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,qBAAA,CAAsB,UAAU,KAAK,CAAA;AACrE,QAAA,IAAI,YAAc,EAAA;AAChB,UAAkB,eAAA,GAAA;AAAA,YAChB,GAAG,eAAA;AAAA,YACH;AAAA,cACE,gBAAkB,EAAA,YAAA;AAAA,cAClB;AAAA;AACF,WACF;AAAA;AACF,eACO,KAAO,EAAA;AACd,QAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,UACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,KAAK,CAAA;AAAA,SAClE;AAAA;AACF;AAGF,IAAO,OAAA,eAAA;AAAA;AACT,EAEA,MAAM,qBACJ,CAAA,QAAA,EACA,KACuC,EAAA;AACvC,IAAI,IAAA,YAAA;AAMJ,IAAA,IAAI,aAAa,YAAc,EAAA;AAC7B,MAAO,OAAA,sBAAA;AAAA;AAGT,IAAI,IAAA;AACF,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,QAAQ,CAAA;AAC7D,MAAM,MAAA,YAAA,GAAe,GAAG,YAAY,CAAA,2CAAA,CAAA;AAEpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA,CAAU,QAAQ,YAAc,EAAA,EAAE,OAAO,CAAA;AACrE,MAAA,MAAM,eAAmB,GAAA,CAAA,MAAM,QAAS,CAAA,MAAA,IAAU,QAAS,EAAA;AAE3D,MAAI,IAAA;AACF,QAAe,YAAA,GAAA,IAAA,CAAK,MAAM,eAAe,CAAA;AAAA,eAClC,GAAK,EAAA;AAEZ,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,aACO,GAAK,EAAA;AACZ,MAAA,IAAIC,cAAQ,CAAA,GAAG,CAAK,IAAA,GAAA,CAAI,SAAS,eAAiB,EAAA;AAChD,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAA,iCAAA,EAAoC,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,SACtD;AACA,QAAO,OAAA,SAAA;AAAA;AAET,MAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,QACV,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,GAAG,CAAA;AAAA,OAChE;AAAA;AAEF,IAAO,OAAA,YAAA;AAAA;AAEX;AAEA,SAAS,4BACP,WACiB,EAAA;AACjB,EAAA,MAAM,WAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AACpC,IAAI,IAAAC,2CAAA,CAAqB,UAAU,CAAG,EAAA;AACpC,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,cAAc,UAAW,CAAA,YAAA;AAAA,QACzB,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA,KACI,MAAA;AACL,MAAA,QAAA,CAAS,IAAK,CAAA;AAAA,QACZ,MAAM,UAAW,CAAA,IAAA;AAAA,QACjB,MAAA,EAAQ,UAAW,CAAA,UAAA,CAAW,MAAU,IAAA;AAAA,OACzC,CAAA;AAAA;AACH;AAGF,EAAO,OAAA,QAAA;AACT;;;;"}

package/dist/service/policies-rest-api.cjs.js

@@ -1,9 +1,7 @@
 'use strict';
 
 var errors = require('@backstage/errors');
-var pluginPermissionBackend = require('@backstage/plugin-permission-backend');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
-var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var lodash = require('lodash');
 var pluginRbacCommon = require('@backstage-community/plugin-rbac-common');
 var restInterceptor = require('../auditor/rest-interceptor.cjs.js');
@@ -12,76 +10,74 @@ var helper = require('../helper.cjs.js');
 var conditionValidation = require('../validation/condition-validation.cjs.js');
 var policiesValidation = require('../validation/policies-validation.cjs.js');
 var conditions = require('../permissions/conditions.cjs.js');
-var rules = require('../permissions/rules.cjs.js');
+require('../permissions/rules.cjs.js');
+var permissionDefinitionRoutes = require('./permission-definition-routes.cjs.js');
+var router = require('./router.cjs.js');
 
+async function authorizeConditional(request, permission, deps) {
+  const { auth, httpAuth, permissions } = deps;
+  const credentials = await httpAuth.credentials(request, {
+    allow: ["user", "service"]
+  });
+  if (auth.isPrincipal(credentials, "service") && permission !== pluginRbacCommon.policyEntityReadPermission) {
+    throw new errors.NotAllowedError(
+      `Only credential principal with type 'user' permitted to modify permissions`
+    );
+  }
+  let decision;
+  if (permission.type === "resource") {
+    decision = (await permissions.authorizeConditional([{ permission }], {
+      credentials
+    }))[0];
+  } else {
+    decision = (await permissions.authorize([{ permission }], {
+      credentials
+    }))[0];
+  }
+  if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+    throw new errors.NotAllowedError();
+  }
+  return { decision, credentials };
+}
 class PoliciesServer {
-  constructor(permissions, options, enforcer, conditionalStorage, pluginPermMetaData, roleMetadata, auditor, rbacProviders) {
-    this.permissions = permissions;
+  constructor(options, enforcer, conditionalStorage, pluginPermMetaData, roleMetadata, extraPluginsIdStorage, pluginIdProvider, rbacProviders) {
     this.options = options;
     this.enforcer = enforcer;
     this.conditionalStorage = conditionalStorage;
     this.pluginPermMetaData = pluginPermMetaData;
     this.roleMetadata = roleMetadata;
-    this.auditor = auditor;
+    this.extraPluginsIdStorage = extraPluginsIdStorage;
+    this.pluginIdProvider = pluginIdProvider;
     this.rbacProviders = rbacProviders;
   }
-  async authorizeConditional(request, permission) {
-    const credentials = await this.options.httpAuth.credentials(request, {
-      allow: ["user", "service"]
-    });
-    if (this.options.auth.isPrincipal(credentials, "service") && permission !== pluginRbacCommon.policyEntityReadPermission) {
-      throw new errors.NotAllowedError(
-        `Only credential principal with type 'user' permitted to modify permissions`
-      );
-    }
-    let decision;
-    if (permission.type === "resource") {
-      decision = (await this.permissions.authorizeConditional([{ permission }], {
-        credentials
-      }))[0];
-    } else {
-      decision = (await this.permissions.authorize([{ permission }], {
-        credentials
-      }))[0];
-    }
-    if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-      throw new errors.NotAllowedError();
-    }
-    return { decision, credentials };
-  }
   async serve() {
-    const router = await pluginPermissionBackend.createRouter(this.options);
-    const { logger } = this.options;
-    const policyPermissionsIntegrationRouter = pluginPermissionNode.createPermissionIntegrationRouter({
-      resourceType: pluginRbacCommon.RESOURCE_TYPE_POLICY_ENTITY,
-      getResources: (resourceRefs) => Promise.all(
-        resourceRefs.map((ref) => {
-          return this.roleMetadata.findRoleMetadata(ref);
-        })
-      ),
-      permissions: pluginRbacCommon.policyEntityPermissions,
-      rules: Object.values(rules.rules)
-    });
-    router.use(policyPermissionsIntegrationRouter);
+    const router$1 = await router.createRouter(this.options);
+    const { logger, auditor, auth, permissionsRegistry } = this.options;
     const isPluginEnabled = this.options.config.getOptionalBoolean("permission.enabled");
     if (!isPluginEnabled) {
-      return router;
+      return router$1;
     }
-    router.get("/", async (request, response) => {
-      await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
+    const transformConditions = conditions.conditionTransformerFunc(permissionsRegistry);
+    router$1.get("/", async (request, response) => {
+      await authorizeConditional(
+        request,
+        pluginRbacCommon.policyEntityReadPermission,
+        this.options
+      );
       response.send({ status: "Authorized" });
     });
-    router.get(
+    router$1.get(
       "/policies",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         let policies = [];
@@ -117,17 +113,18 @@ class PoliciesServer {
         response.json(body);
       }
     );
-    router.get(
+    router$1.get(
       "/policies/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         const matchedRoleName = roleMetadata.flatMap((role) => {
@@ -151,17 +148,18 @@ class PoliciesServer {
         }
       }
     );
-    router.delete(
+    router$1.delete(
       "/policies/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityDeletePermission
+          pluginRbacCommon.policyEntityDeletePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const entityRef = this.getEntityReference(request);
         const policyRaw = request.body;
@@ -182,11 +180,15 @@ class PoliciesServer {
         response.status(204).end();
       }
     );
-    router.post(
+    router$1.post(
       "/policies",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
+        await authorizeConditional(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
+        );
         const policyRaw = request.body;
         if (lodash.isEmpty(policyRaw)) {
           throw new errors.InputError(`permission policy must be present`);
@@ -206,17 +208,18 @@ class PoliciesServer {
         response.status(201).end();
       }
     );
-    router.put(
+    router$1.put(
       "/policies/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityUpdatePermission
+          pluginRbacCommon.policyEntityUpdatePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const entityRef = this.getEntityReference(request);
         const oldPolicyRaw = request.body.oldPolicy;
@@ -267,34 +270,36 @@ class PoliciesServer {
         response.status(200).end();
       }
     );
-    router.get(
+    router$1.get(
       "/roles",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roles = await this.enforcer.getGroupingPolicy();
         const body = await this.transformRoleArray(conditionsFilter, ...roles);
         response.json(body);
       }
     );
-    router.get(
+    router$1.get(
       "/roles/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleEntityRef = this.getEntityReference(request, true);
         const role = await this.enforcer.getFilteredGroupingPolicy(
@@ -309,14 +314,15 @@ class PoliciesServer {
         }
       }
     );
-    router.post(
+    router$1.post(
       "/roles",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         const uniqueItems = /* @__PURE__ */ new Set();
-        const { credentials } = await this.authorizeConditional(
+        const { credentials } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityCreatePermission
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
         );
         const roleRaw = request.body;
         let err = policiesValidation.validateRole(roleRaw);
@@ -364,18 +370,19 @@ class PoliciesServer {
         response.status(201).end();
       }
     );
-    router.put(
+    router$1.put(
       "/roles/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         const uniqueItems = /* @__PURE__ */ new Set();
         let conditionsFilter;
-        const { decision, credentials } = await this.authorizeConditional(
+        const { decision, credentials } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityUpdatePermission
+          pluginRbacCommon.policyEntityUpdatePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleEntityRef = this.getEntityReference(request, true);
         const oldRoleRaw = request.body.oldRole;
@@ -490,17 +497,18 @@ class PoliciesServer {
         response.status(200).end();
       }
     );
-    router.delete(
+    router$1.delete(
       "/roles/:kind/:namespace/:name",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision, credentials } = await this.authorizeConditional(
+        const { decision, credentials } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityDeletePermission
+          pluginRbacCommon.policyEntityDeletePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleEntityRef = this.getEntityReference(request, true);
         const currentMetadata = await this.roleMetadata.findRoleMetadata(roleEntityRef);
@@ -557,51 +565,30 @@ class PoliciesServer {
         response.status(204).end();
       }
     );
-    router.get(
-      "/plugins/policies",
-      restInterceptor.logAuditorEvent(this.auditor),
-      async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
-        const body = await this.pluginPermMetaData.getPluginPolicies(
-          this.options.auth
-        );
-        response.json(body);
-      }
-    );
-    router.get(
-      "/plugins/condition-rules",
-      restInterceptor.logAuditorEvent(this.auditor),
-      async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityReadPermission);
-        const body = await this.pluginPermMetaData.getPluginConditionRules(
-          this.options.auth
-        );
-        response.json(body);
-      }
-    );
-    router.get(
+    router$1.get(
       "/roles/conditions",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         const matchedRoleName = roleMetadata.flatMap((role) => {
           return role.roleEntityRef;
         });
-        const conditions$1 = await this.conditionalStorage.filterConditions(
+        const conditions = await this.conditionalStorage.filterConditions(
           this.getFirstQuery(request.query.roleEntityRef),
           this.getFirstQuery(request.query.pluginId),
           this.getFirstQuery(request.query.resourceType),
           this.getActionQueries(request.query.actions)
         );
-        const body = conditions$1.map((condition) => {
+        const body = conditions.map((condition) => {
           return {
             ...condition,
             permissionMapping: condition.permissionMapping.map(
@@ -614,17 +601,21 @@ class PoliciesServer {
         response.json(body);
       }
     );
-    router.post(
+    router$1.post(
       "/roles/conditions",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
+        await authorizeConditional(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
+        );
         const roleConditionPolicy = request.body;
         conditionValidation.validateRoleCondition(roleConditionPolicy);
         const conditionToCreate = await helper.processConditionMapping(
           roleConditionPolicy,
           this.pluginPermMetaData,
-          this.options.auth
+          auth
         );
         const id = await this.conditionalStorage.createCondition(conditionToCreate);
         const body = { id };
@@ -632,14 +623,15 @@ class PoliciesServer {
         response.status(201).json(body);
       }
     );
-    router.get(
+    router$1.get(
       "/roles/conditions/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityReadPermission
+          pluginRbacCommon.policyEntityReadPermission,
+          this.options
         );
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
@@ -650,7 +642,7 @@ class PoliciesServer {
           throw new errors.NotFoundError();
         }
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const roleMetadata = await this.roleMetadata.filterForOwnerRoleMetadata(conditionsFilter);
         const matchedRoleName = roleMetadata.flatMap((role) => {
@@ -665,17 +657,18 @@ class PoliciesServer {
         response.json(body);
       }
     );
-    router.delete(
+    router$1.delete(
       "/roles/conditions/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityDeletePermission
+          pluginRbacCommon.policyEntityDeletePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
@@ -700,17 +693,18 @@ class PoliciesServer {
         response.status(204).end();
       }
     );
-    router.put(
+    router$1.put(
       "/roles/conditions/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
         let conditionsFilter;
-        const { decision } = await this.authorizeConditional(
+        const { decision } = await authorizeConditional(
           request,
-          pluginRbacCommon.policyEntityUpdatePermission
+          pluginRbacCommon.policyEntityUpdatePermission,
+          this.options
         );
         if (decision.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
-          conditionsFilter = conditions.transformConditions(decision.conditions);
+          conditionsFilter = transformConditions(decision.conditions);
         }
         const id = parseInt(request.params.id, 10);
         if (isNaN(id)) {
@@ -731,18 +725,22 @@ class PoliciesServer {
         const conditionToUpdate = await helper.processConditionMapping(
           roleConditionPolicy,
           this.pluginPermMetaData,
-          this.options.auth
+          auth
         );
         await this.conditionalStorage.updateCondition(id, conditionToUpdate);
         response.locals.meta = { condition: roleConditionPolicy };
         response.status(200).end();
       }
     );
-    router.post(
+    router$1.post(
       "/refresh/:id",
-      restInterceptor.logAuditorEvent(this.auditor),
+      restInterceptor.logAuditorEvent(auditor),
       async (request, response) => {
-        await this.authorizeConditional(request, pluginRbacCommon.policyEntityCreatePermission);
+        await authorizeConditional(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission,
+          this.options
+        );
         if (!this.rbacProviders) {
           throw new errors.NotFoundError(`No RBAC providers were found`);
         }
@@ -759,8 +757,15 @@ class PoliciesServer {
         response.status(200).end();
       }
     );
-    router.use(restInterceptor.setAuditorError());
-    return router;
+    permissionDefinitionRoutes.registerPermissionDefinitionRoutes(
+      router$1,
+      this.pluginPermMetaData,
+      this.pluginIdProvider,
+      this.extraPluginsIdStorage,
+      this.options
+    );
+    router$1.use(restInterceptor.setAuditorError());
+    return router$1;
   }
   getEntityReference(request, role) {
     const kind = request.params.kind;
@@ -939,4 +944,5 @@ class PoliciesServer {
 }
 
 exports.PoliciesServer = PoliciesServer;
+exports.authorizeConditional = authorizeConditional;
 //# sourceMappingURL=policies-rest-api.cjs.js.map