@backstage-community/plugin-rbac-backend 7.4.0 → 7.4.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 ### Dependencies
 
+## 7.4.2
+
+### Patch Changes
+
+- de412d4: Fix issue with extra delimiter in conditional yaml.
+- 93ce408: Compare parent reference in sqlite memo using entity ref
+
+## 7.4.1
+
+### Patch Changes
+
+- db1ab9d: Updated dependency `knex-mock-client` to `3.0.2`.
+
 ## 7.4.0
 
 ### Minor Changes

package/dist/file-permissions/yaml-conditional-file-watcher.cjs.js

@@ -51,7 +51,7 @@ class YamlConditinalPoliciesFileWatcher extends fileWatcher.AbstractFileWatcher
   }
   async onChange() {
     try {
-      const newConds = this.parse().filter((c) => c);
+      const newConds = this.parse();
       const addedConds = [];
       const removedConds = [];
       const csvFileRoles = await this.roleMetadataStorage.filterRoleMetadata("csv-file");
@@ -114,8 +114,8 @@ class YamlConditinalPoliciesFileWatcher extends fileWatcher.AbstractFileWatcher
    */
   parse() {
     const fileContents = this.getCurrentContents();
-    const data = yaml__default.default.loadAll(
-      fileContents
+    const data = yaml__default.default.loadAll(fileContents).filter(
+      (doc) => doc !== null
     );
     for (const condition of data) {
       conditionValidation.validateRoleCondition(condition);

package/dist/file-permissions/yaml-conditional-file-watcher.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"yaml-conditional-file-watcher.cjs.js","sources":["../../src/file-permissions/yaml-conditional-file-watcher.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type {\n  AuditorService,\n  AuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\n\nimport yaml from 'js-yaml';\nimport { omit } from 'lodash';\n\nimport type {\n  PermissionAction,\n  RoleConditionalPolicyDecision,\n} from '@backstage-community/plugin-rbac-common';\n\nimport fs from 'fs';\n\nimport { ActionType, ConditionEvents } from '../auditor/auditor';\nimport { ConditionalStorage } from '../database/conditional-storage';\nimport { RoleMetadataStorage } from '../database/role-metadata';\nimport { deepSortEqual, processConditionMapping } from '../helper';\nimport { RoleEventEmitter, RoleEvents } from '../service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from '../service/plugin-endpoints';\nimport { validateRoleCondition } from '../validation/condition-validation';\nimport { AbstractFileWatcher } from './file-watcher';\n\ntype ConditionalPoliciesDiff = {\n  addedConditions: RoleConditionalPolicyDecision<PermissionAction>[];\n  removedConditions: RoleConditionalPolicyDecision<PermissionAction>[];\n};\n\nexport class YamlConditinalPoliciesFileWatcher extends AbstractFileWatcher<\n  RoleConditionalPolicyDecision<PermissionAction>[]\n> {\n  private conditionsDiff: ConditionalPoliciesDiff;\n\n  constructor(\n    filePath: string | undefined,\n    allowReload: boolean,\n    logger: LoggerService,\n    private readonly conditionalStorage: ConditionalStorage,\n    private readonly auditor: AuditorService,\n    private readonly auth: AuthService,\n    private readonly pluginMetadataCollector: PluginPermissionMetadataCollector,\n    private readonly roleMetadataStorage: RoleMetadataStorage,\n    private readonly roleEventEmitter: RoleEventEmitter<RoleEvents>,\n  ) {\n    super(filePath, allowReload, logger);\n\n    this.conditionsDiff = {\n      addedConditions: [],\n      removedConditions: [],\n    };\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.filePath) {\n      return;\n    }\n    const fileExists = fs.existsSync(this.filePath);\n    if (!fileExists) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITIONAL_POLICIES_FILE_NOT_FOUND,\n        severityLevel: 'medium',\n      });\n      await auditorEvent.fail({\n        error: new Error(`File '${this.filePath}' was not found`),\n      });\n      return;\n    }\n\n    this.roleEventEmitter.on('roleAdded', this.onChange.bind(this));\n    await this.onChange();\n\n    if (this.allowReload) {\n      this.watchFile();\n    }\n  }\n\n  async onChange(): Promise<void> {\n    try {\n      const newConds = this.parse().filter(c => c);\n\n      const addedConds: RoleConditionalPolicyDecision<PermissionAction>[] = [];\n      const removedConds: RoleConditionalPolicyDecision<PermissionAction>[] =\n        [];\n\n      const csvFileRoles =\n        await this.roleMetadataStorage.filterRoleMetadata('csv-file');\n      const existedFileConds = (\n        await this.conditionalStorage.filterConditions(\n          csvFileRoles.map(role => role.roleEntityRef),\n        )\n      ).map(condition => {\n        return {\n          ...condition,\n          permissionMapping: condition.permissionMapping.map(pm => pm.action),\n        };\n      });\n\n      // Find added conditions\n      for (const condition of newConds) {\n        const roleMetadata = csvFileRoles.find(\n          role => condition.roleEntityRef === role.roleEntityRef,\n        );\n        if (!roleMetadata) {\n          this.logger.warn(\n            `skip to add condition for role '${condition.roleEntityRef}'. The role either does not exist or was not created from a CSV file.`,\n          );\n          continue;\n        }\n        if (roleMetadata.source !== 'csv-file') {\n          this.logger.warn(\n            `skip to add condition for role '${condition.roleEntityRef}'. Role is not from csv-file`,\n          );\n          continue;\n        }\n\n        const existingCondition = existedFileConds.find(c =>\n          deepSortEqual(omit(c, ['id']), omit(condition, ['id'])),\n        );\n\n        if (!existingCondition) {\n          addedConds.push(condition);\n        }\n      }\n\n      // Find removed conditions\n      for (const condition of existedFileConds) {\n        if (\n          !newConds.find(c =>\n            deepSortEqual(omit(c, ['id']), omit(condition, ['id'])),\n          )\n        ) {\n          removedConds.push(condition);\n        }\n      }\n\n      this.conditionsDiff = {\n        addedConditions: addedConds,\n        removedConditions: removedConds,\n      };\n\n      await this.handleFileChanges();\n    } catch (error) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITIONAL_POLICIES_FILE_CHANGE,\n        severityLevel: 'medium',\n      });\n      await auditorEvent.fail({\n        error,\n      });\n    }\n  }\n\n  /**\n   * Reads the current contents of the file and parses it.\n   * @returns parsed data.\n   */\n  parse(): RoleConditionalPolicyDecision<PermissionAction>[] {\n    const fileContents = this.getCurrentContents();\n    const data = yaml.loadAll(\n      fileContents,\n    ) as RoleConditionalPolicyDecision<PermissionAction>[];\n\n    for (const condition of data) {\n      validateRoleCondition(condition);\n    }\n\n    return data;\n  }\n\n  private async handleFileChanges(): Promise<void> {\n    await this.removeConditions();\n    await this.addConditions();\n  }\n\n  private async addConditions(): Promise<void> {\n    for (const condition of this.conditionsDiff.addedConditions) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITION_WRITE,\n        severityLevel: 'medium',\n        meta: { actionType: ActionType.CREATE },\n      });\n\n      try {\n        const conditionToCreate = await processConditionMapping(\n          condition,\n          this.pluginMetadataCollector,\n          this.auth,\n        );\n\n        await this.conditionalStorage.createCondition(conditionToCreate);\n        await auditorEvent.success({\n          meta: { condition },\n        });\n      } catch (error) {\n        await auditorEvent.fail({ error, meta: { condition } });\n      }\n    }\n\n    this.conditionsDiff.addedConditions = [];\n  }\n\n  private async removeConditions(): Promise<void> {\n    for (const condition of this.conditionsDiff.removedConditions) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITION_WRITE,\n        severityLevel: 'medium',\n        meta: { actionType: ActionType.DELETE },\n      });\n\n      try {\n        const conditionToDelete = (\n          await this.conditionalStorage.filterConditions(\n            condition.roleEntityRef,\n            condition.pluginId,\n            condition.resourceType,\n            condition.permissionMapping,\n          )\n        )[0];\n        await this.conditionalStorage.deleteCondition(conditionToDelete.id!);\n        await auditorEvent.success({ meta: { condition } });\n      } catch (error) {\n        await auditorEvent.fail({\n          error,\n          meta: { condition },\n        });\n      }\n    }\n\n    this.conditionsDiff.removedConditions = [];\n  }\n\n  async cleanUpConditionalPolicies(): Promise<void> {\n    const csvFileRoles =\n      await this.roleMetadataStorage.filterRoleMetadata('csv-file');\n    const existedFileConds = (\n      await this.conditionalStorage.filterConditions(\n        csvFileRoles.map(role => role.roleEntityRef),\n      )\n    ).map(condition => {\n      return {\n        ...condition,\n        permissionMapping: condition.permissionMapping.map(pm => pm.action),\n      };\n    });\n    this.conditionsDiff.removedConditions = existedFileConds;\n    await this.removeConditions();\n  }\n}\n"],"names":["AbstractFileWatcher","fs","ConditionEvents","deepSortEqual","omit","yaml","validateRoleCondition","ActionType","processConditionMapping"],"mappings":";;;;;;;;;;;;;;;AA6CO,MAAM,0CAA0CA,+BAErD,CAAA;AAAA,EAGA,WAAA,CACE,UACA,WACA,EAAA,MAAA,EACiB,oBACA,OACA,EAAA,IAAA,EACA,uBACA,EAAA,mBAAA,EACA,gBACjB,EAAA;AACA,IAAM,KAAA,CAAA,QAAA,EAAU,aAAa,MAAM,CAAA;AAPlB,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,uBAAA,GAAA,uBAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AACA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAIjB,IAAA,IAAA,CAAK,cAAiB,GAAA;AAAA,MACpB,iBAAiB,EAAC;AAAA,MAClB,mBAAmB;AAAC,KACtB;AAAA;AACF,EAnBQ,cAAA;AAAA,EAqBR,MAAM,UAA4B,GAAA;AAChC,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAA;AAAA;AAEF,IAAA,MAAM,UAAa,GAAAC,mBAAA,CAAG,UAAW,CAAA,IAAA,CAAK,QAAQ,CAAA;AAC9C,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASC,uBAAgB,CAAA,mCAAA;AAAA,QACzB,aAAe,EAAA;AAAA,OAChB,CAAA;AACD,MAAA,MAAM,aAAa,IAAK,CAAA;AAAA,QACtB,OAAO,IAAI,KAAA,CAAM,CAAS,MAAA,EAAA,IAAA,CAAK,QAAQ,CAAiB,eAAA,CAAA;AAAA,OACzD,CAAA;AACD,MAAA;AAAA;AAGF,IAAA,IAAA,CAAK,iBAAiB,EAAG,CAAA,WAAA,EAAa,KAAK,QAAS,CAAA,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9D,IAAA,MAAM,KAAK,QAAS,EAAA;AAEpB,IAAA,IAAI,KAAK,WAAa,EAAA;AACpB,MAAA,IAAA,CAAK,SAAU,EAAA;AAAA;AACjB;AACF,EAEA,MAAM,QAA0B,GAAA;AAC9B,IAAI,IAAA;AACF,MAAA,MAAM,WAAW,IAAK,CAAA,KAAA,EAAQ,CAAA,MAAA,CAAO,OAAK,CAAC,CAAA;AAE3C,MAAA,MAAM,aAAgE,EAAC;AACvE,MAAA,MAAM,eACJ,EAAC;AAEH,MAAA,MAAM,YACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,UAAU,CAAA;AAC9D,MAAM,MAAA,gBAAA,GAAA,CACJ,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,QAC5B,YAAa,CAAA,GAAA,CAAI,CAAQ,IAAA,KAAA,IAAA,CAAK,aAAa;AAAA,OAC7C,EACA,IAAI,CAAa,SAAA,KAAA;AACjB,QAAO,OAAA;AAAA,UACL,GAAG,SAAA;AAAA,UACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,SACpE;AAAA,OACD,CAAA;AAGD,MAAA,KAAA,MAAW,aAAa,QAAU,EAAA;AAChC,QAAA,MAAM,eAAe,YAAa,CAAA,IAAA;AAAA,UAChC,CAAA,IAAA,KAAQ,SAAU,CAAA,aAAA,KAAkB,IAAK,CAAA;AAAA,SAC3C;AACA,QAAA,IAAI,CAAC,YAAc,EAAA;AACjB,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,YACV,CAAA,gCAAA,EAAmC,UAAU,aAAa,CAAA,qEAAA;AAAA,WAC5D;AACA,UAAA;AAAA;AAEF,QAAI,IAAA,YAAA,CAAa,WAAW,UAAY,EAAA;AACtC,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,YACV,CAAA,gCAAA,EAAmC,UAAU,aAAa,CAAA,4BAAA;AAAA,WAC5D;AACA,UAAA;AAAA;AAGF,QAAA,MAAM,oBAAoB,gBAAiB,CAAA,IAAA;AAAA,UAAK,CAC9C,CAAA,KAAAC,oBAAA,CAAcC,WAAK,CAAA,CAAA,EAAG,CAAC,IAAI,CAAC,CAAA,EAAGA,WAAK,CAAA,SAAA,EAAW,CAAC,IAAI,CAAC,CAAC;AAAA,SACxD;AAEA,QAAA,IAAI,CAAC,iBAAmB,EAAA;AACtB,UAAA,UAAA,CAAW,KAAK,SAAS,CAAA;AAAA;AAC3B;AAIF,MAAA,KAAA,MAAW,aAAa,gBAAkB,EAAA;AACxC,QAAA,IACE,CAAC,QAAS,CAAA,IAAA;AAAA,UAAK,CACb,CAAA,KAAAD,oBAAA,CAAcC,WAAK,CAAA,CAAA,EAAG,CAAC,IAAI,CAAC,CAAA,EAAGA,WAAK,CAAA,SAAA,EAAW,CAAC,IAAI,CAAC,CAAC;AAAA,SAExD,EAAA;AACA,UAAA,YAAA,CAAa,KAAK,SAAS,CAAA;AAAA;AAC7B;AAGF,MAAA,IAAA,CAAK,cAAiB,GAAA;AAAA,QACpB,eAAiB,EAAA,UAAA;AAAA,QACjB,iBAAmB,EAAA;AAAA,OACrB;AAEA,MAAA,MAAM,KAAK,iBAAkB,EAAA;AAAA,aACtB,KAAO,EAAA;AACd,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASF,uBAAgB,CAAA,gCAAA;AAAA,QACzB,aAAe,EAAA;AAAA,OAChB,CAAA;AACD,MAAA,MAAM,aAAa,IAAK,CAAA;AAAA,QACtB;AAAA,OACD,CAAA;AAAA;AACH;AACF;AAAA;AAAA;AAAA;AAAA,EAMA,KAA2D,GAAA;AACzD,IAAM,MAAA,YAAA,GAAe,KAAK,kBAAmB,EAAA;AAC7C,IAAA,MAAM,OAAOG,qBAAK,CAAA,OAAA;AAAA,MAChB;AAAA,KACF;AAEA,IAAA,KAAA,MAAW,aAAa,IAAM,EAAA;AAC5B,MAAAC,yCAAA,CAAsB,SAAS,CAAA;AAAA;AAGjC,IAAO,OAAA,IAAA;AAAA;AACT,EAEA,MAAc,iBAAmC,GAAA;AAC/C,IAAA,MAAM,KAAK,gBAAiB,EAAA;AAC5B,IAAA,MAAM,KAAK,aAAc,EAAA;AAAA;AAC3B,EAEA,MAAc,aAA+B,GAAA;AAC3C,IAAW,KAAA,MAAA,SAAA,IAAa,IAAK,CAAA,cAAA,CAAe,eAAiB,EAAA;AAC3D,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASJ,uBAAgB,CAAA,eAAA;AAAA,QACzB,aAAe,EAAA,QAAA;AAAA,QACf,IAAM,EAAA,EAAE,UAAY,EAAAK,kBAAA,CAAW,MAAO;AAAA,OACvC,CAAA;AAED,MAAI,IAAA;AACF,QAAA,MAAM,oBAAoB,MAAMC,8BAAA;AAAA,UAC9B,SAAA;AAAA,UACA,IAAK,CAAA,uBAAA;AAAA,UACL,IAAK,CAAA;AAAA,SACP;AAEA,QAAM,MAAA,IAAA,CAAK,kBAAmB,CAAA,eAAA,CAAgB,iBAAiB,CAAA;AAC/D,QAAA,MAAM,aAAa,OAAQ,CAAA;AAAA,UACzB,IAAA,EAAM,EAAE,SAAU;AAAA,SACnB,CAAA;AAAA,eACM,KAAO,EAAA;AACd,QAAM,MAAA,YAAA,CAAa,KAAK,EAAE,KAAA,EAAO,MAAM,EAAE,SAAA,IAAa,CAAA;AAAA;AACxD;AAGF,IAAK,IAAA,CAAA,cAAA,CAAe,kBAAkB,EAAC;AAAA;AACzC,EAEA,MAAc,gBAAkC,GAAA;AAC9C,IAAW,KAAA,MAAA,SAAA,IAAa,IAAK,CAAA,cAAA,CAAe,iBAAmB,EAAA;AAC7D,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASN,uBAAgB,CAAA,eAAA;AAAA,QACzB,aAAe,EAAA,QAAA;AAAA,QACf,IAAM,EAAA,EAAE,UAAY,EAAAK,kBAAA,CAAW,MAAO;AAAA,OACvC,CAAA;AAED,MAAI,IAAA;AACF,QAAM,MAAA,iBAAA,GAAA,CACJ,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,UAC5B,SAAU,CAAA,aAAA;AAAA,UACV,SAAU,CAAA,QAAA;AAAA,UACV,SAAU,CAAA,YAAA;AAAA,UACV,SAAU,CAAA;AAAA,WAEZ,CAAC,CAAA;AACH,QAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,eAAgB,CAAA,iBAAA,CAAkB,EAAG,CAAA;AACnE,QAAA,MAAM,aAAa,OAAQ,CAAA,EAAE,MAAM,EAAE,SAAA,IAAa,CAAA;AAAA,eAC3C,KAAO,EAAA;AACd,QAAA,MAAM,aAAa,IAAK,CAAA;AAAA,UACtB,KAAA;AAAA,UACA,IAAA,EAAM,EAAE,SAAU;AAAA,SACnB,CAAA;AAAA;AACH;AAGF,IAAK,IAAA,CAAA,cAAA,CAAe,oBAAoB,EAAC;AAAA;AAC3C,EAEA,MAAM,0BAA4C,GAAA;AAChD,IAAA,MAAM,YACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,UAAU,CAAA;AAC9D,IAAM,MAAA,gBAAA,GAAA,CACJ,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,MAC5B,YAAa,CAAA,GAAA,CAAI,CAAQ,IAAA,KAAA,IAAA,CAAK,aAAa;AAAA,KAC7C,EACA,IAAI,CAAa,SAAA,KAAA;AACjB,MAAO,OAAA;AAAA,QACL,GAAG,SAAA;AAAA,QACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,OACpE;AAAA,KACD,CAAA;AACD,IAAA,IAAA,CAAK,eAAe,iBAAoB,GAAA,gBAAA;AACxC,IAAA,MAAM,KAAK,gBAAiB,EAAA;AAAA;AAEhC;;;;"}
+{"version":3,"file":"yaml-conditional-file-watcher.cjs.js","sources":["../../src/file-permissions/yaml-conditional-file-watcher.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type {\n  AuditorService,\n  AuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\n\nimport yaml from 'js-yaml';\nimport { omit } from 'lodash';\n\nimport type {\n  PermissionAction,\n  RoleConditionalPolicyDecision,\n} from '@backstage-community/plugin-rbac-common';\n\nimport fs from 'fs';\n\nimport { ActionType, ConditionEvents } from '../auditor/auditor';\nimport { ConditionalStorage } from '../database/conditional-storage';\nimport { RoleMetadataStorage } from '../database/role-metadata';\nimport { deepSortEqual, processConditionMapping } from '../helper';\nimport { RoleEventEmitter, RoleEvents } from '../service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from '../service/plugin-endpoints';\nimport { validateRoleCondition } from '../validation/condition-validation';\nimport { AbstractFileWatcher } from './file-watcher';\n\ntype ConditionalPoliciesDiff = {\n  addedConditions: RoleConditionalPolicyDecision<PermissionAction>[];\n  removedConditions: RoleConditionalPolicyDecision<PermissionAction>[];\n};\n\nexport class YamlConditinalPoliciesFileWatcher extends AbstractFileWatcher<\n  RoleConditionalPolicyDecision<PermissionAction>[]\n> {\n  private conditionsDiff: ConditionalPoliciesDiff;\n\n  constructor(\n    filePath: string | undefined,\n    allowReload: boolean,\n    logger: LoggerService,\n    private readonly conditionalStorage: ConditionalStorage,\n    private readonly auditor: AuditorService,\n    private readonly auth: AuthService,\n    private readonly pluginMetadataCollector: PluginPermissionMetadataCollector,\n    private readonly roleMetadataStorage: RoleMetadataStorage,\n    private readonly roleEventEmitter: RoleEventEmitter<RoleEvents>,\n  ) {\n    super(filePath, allowReload, logger);\n\n    this.conditionsDiff = {\n      addedConditions: [],\n      removedConditions: [],\n    };\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.filePath) {\n      return;\n    }\n    const fileExists = fs.existsSync(this.filePath);\n    if (!fileExists) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITIONAL_POLICIES_FILE_NOT_FOUND,\n        severityLevel: 'medium',\n      });\n      await auditorEvent.fail({\n        error: new Error(`File '${this.filePath}' was not found`),\n      });\n      return;\n    }\n\n    this.roleEventEmitter.on('roleAdded', this.onChange.bind(this));\n    await this.onChange();\n\n    if (this.allowReload) {\n      this.watchFile();\n    }\n  }\n\n  async onChange(): Promise<void> {\n    try {\n      const newConds = this.parse();\n\n      const addedConds: RoleConditionalPolicyDecision<PermissionAction>[] = [];\n      const removedConds: RoleConditionalPolicyDecision<PermissionAction>[] =\n        [];\n\n      const csvFileRoles =\n        await this.roleMetadataStorage.filterRoleMetadata('csv-file');\n      const existedFileConds = (\n        await this.conditionalStorage.filterConditions(\n          csvFileRoles.map(role => role.roleEntityRef),\n        )\n      ).map(condition => {\n        return {\n          ...condition,\n          permissionMapping: condition.permissionMapping.map(pm => pm.action),\n        };\n      });\n\n      // Find added conditions\n      for (const condition of newConds) {\n        const roleMetadata = csvFileRoles.find(\n          role => condition.roleEntityRef === role.roleEntityRef,\n        );\n        if (!roleMetadata) {\n          this.logger.warn(\n            `skip to add condition for role '${condition.roleEntityRef}'. The role either does not exist or was not created from a CSV file.`,\n          );\n          continue;\n        }\n        if (roleMetadata.source !== 'csv-file') {\n          this.logger.warn(\n            `skip to add condition for role '${condition.roleEntityRef}'. Role is not from csv-file`,\n          );\n          continue;\n        }\n\n        const existingCondition = existedFileConds.find(c =>\n          deepSortEqual(omit(c, ['id']), omit(condition, ['id'])),\n        );\n\n        if (!existingCondition) {\n          addedConds.push(condition);\n        }\n      }\n\n      // Find removed conditions\n      for (const condition of existedFileConds) {\n        if (\n          !newConds.find(c =>\n            deepSortEqual(omit(c, ['id']), omit(condition, ['id'])),\n          )\n        ) {\n          removedConds.push(condition);\n        }\n      }\n\n      this.conditionsDiff = {\n        addedConditions: addedConds,\n        removedConditions: removedConds,\n      };\n\n      await this.handleFileChanges();\n    } catch (error) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITIONAL_POLICIES_FILE_CHANGE,\n        severityLevel: 'medium',\n      });\n      await auditorEvent.fail({\n        error,\n      });\n    }\n  }\n\n  /**\n   * Reads the current contents of the file and parses it.\n   * @returns parsed data.\n   */\n  parse(): RoleConditionalPolicyDecision<PermissionAction>[] {\n    const fileContents = this.getCurrentContents();\n    const data = yaml\n      .loadAll(fileContents)\n      .filter(\n        doc => doc !== null,\n      ) as RoleConditionalPolicyDecision<PermissionAction>[];\n\n    for (const condition of data) {\n      validateRoleCondition(condition);\n    }\n\n    return data;\n  }\n\n  private async handleFileChanges(): Promise<void> {\n    await this.removeConditions();\n    await this.addConditions();\n  }\n\n  private async addConditions(): Promise<void> {\n    for (const condition of this.conditionsDiff.addedConditions) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITION_WRITE,\n        severityLevel: 'medium',\n        meta: { actionType: ActionType.CREATE },\n      });\n\n      try {\n        const conditionToCreate = await processConditionMapping(\n          condition,\n          this.pluginMetadataCollector,\n          this.auth,\n        );\n\n        await this.conditionalStorage.createCondition(conditionToCreate);\n        await auditorEvent.success({\n          meta: { condition },\n        });\n      } catch (error) {\n        await auditorEvent.fail({ error, meta: { condition } });\n      }\n    }\n\n    this.conditionsDiff.addedConditions = [];\n  }\n\n  private async removeConditions(): Promise<void> {\n    for (const condition of this.conditionsDiff.removedConditions) {\n      const auditorEvent = await this.auditor.createEvent({\n        eventId: ConditionEvents.CONDITION_WRITE,\n        severityLevel: 'medium',\n        meta: { actionType: ActionType.DELETE },\n      });\n\n      try {\n        const conditionToDelete = (\n          await this.conditionalStorage.filterConditions(\n            condition.roleEntityRef,\n            condition.pluginId,\n            condition.resourceType,\n            condition.permissionMapping,\n          )\n        )[0];\n        await this.conditionalStorage.deleteCondition(conditionToDelete.id!);\n        await auditorEvent.success({ meta: { condition } });\n      } catch (error) {\n        await auditorEvent.fail({\n          error,\n          meta: { condition },\n        });\n      }\n    }\n\n    this.conditionsDiff.removedConditions = [];\n  }\n\n  async cleanUpConditionalPolicies(): Promise<void> {\n    const csvFileRoles =\n      await this.roleMetadataStorage.filterRoleMetadata('csv-file');\n    const existedFileConds = (\n      await this.conditionalStorage.filterConditions(\n        csvFileRoles.map(role => role.roleEntityRef),\n      )\n    ).map(condition => {\n      return {\n        ...condition,\n        permissionMapping: condition.permissionMapping.map(pm => pm.action),\n      };\n    });\n    this.conditionsDiff.removedConditions = existedFileConds;\n    await this.removeConditions();\n  }\n}\n"],"names":["AbstractFileWatcher","fs","ConditionEvents","deepSortEqual","omit","yaml","validateRoleCondition","ActionType","processConditionMapping"],"mappings":";;;;;;;;;;;;;;;AA6CO,MAAM,0CAA0CA,+BAErD,CAAA;AAAA,EAGA,WAAA,CACE,UACA,WACA,EAAA,MAAA,EACiB,oBACA,OACA,EAAA,IAAA,EACA,uBACA,EAAA,mBAAA,EACA,gBACjB,EAAA;AACA,IAAM,KAAA,CAAA,QAAA,EAAU,aAAa,MAAM,CAAA;AAPlB,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,uBAAA,GAAA,uBAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AACA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAIjB,IAAA,IAAA,CAAK,cAAiB,GAAA;AAAA,MACpB,iBAAiB,EAAC;AAAA,MAClB,mBAAmB;AAAC,KACtB;AAAA;AACF,EAnBQ,cAAA;AAAA,EAqBR,MAAM,UAA4B,GAAA;AAChC,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAA;AAAA;AAEF,IAAA,MAAM,UAAa,GAAAC,mBAAA,CAAG,UAAW,CAAA,IAAA,CAAK,QAAQ,CAAA;AAC9C,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASC,uBAAgB,CAAA,mCAAA;AAAA,QACzB,aAAe,EAAA;AAAA,OAChB,CAAA;AACD,MAAA,MAAM,aAAa,IAAK,CAAA;AAAA,QACtB,OAAO,IAAI,KAAA,CAAM,CAAS,MAAA,EAAA,IAAA,CAAK,QAAQ,CAAiB,eAAA,CAAA;AAAA,OACzD,CAAA;AACD,MAAA;AAAA;AAGF,IAAA,IAAA,CAAK,iBAAiB,EAAG,CAAA,WAAA,EAAa,KAAK,QAAS,CAAA,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9D,IAAA,MAAM,KAAK,QAAS,EAAA;AAEpB,IAAA,IAAI,KAAK,WAAa,EAAA;AACpB,MAAA,IAAA,CAAK,SAAU,EAAA;AAAA;AACjB;AACF,EAEA,MAAM,QAA0B,GAAA;AAC9B,IAAI,IAAA;AACF,MAAM,MAAA,QAAA,GAAW,KAAK,KAAM,EAAA;AAE5B,MAAA,MAAM,aAAgE,EAAC;AACvE,MAAA,MAAM,eACJ,EAAC;AAEH,MAAA,MAAM,YACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,UAAU,CAAA;AAC9D,MAAM,MAAA,gBAAA,GAAA,CACJ,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,QAC5B,YAAa,CAAA,GAAA,CAAI,CAAQ,IAAA,KAAA,IAAA,CAAK,aAAa;AAAA,OAC7C,EACA,IAAI,CAAa,SAAA,KAAA;AACjB,QAAO,OAAA;AAAA,UACL,GAAG,SAAA;AAAA,UACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,SACpE;AAAA,OACD,CAAA;AAGD,MAAA,KAAA,MAAW,aAAa,QAAU,EAAA;AAChC,QAAA,MAAM,eAAe,YAAa,CAAA,IAAA;AAAA,UAChC,CAAA,IAAA,KAAQ,SAAU,CAAA,aAAA,KAAkB,IAAK,CAAA;AAAA,SAC3C;AACA,QAAA,IAAI,CAAC,YAAc,EAAA;AACjB,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,YACV,CAAA,gCAAA,EAAmC,UAAU,aAAa,CAAA,qEAAA;AAAA,WAC5D;AACA,UAAA;AAAA;AAEF,QAAI,IAAA,YAAA,CAAa,WAAW,UAAY,EAAA;AACtC,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,YACV,CAAA,gCAAA,EAAmC,UAAU,aAAa,CAAA,4BAAA;AAAA,WAC5D;AACA,UAAA;AAAA;AAGF,QAAA,MAAM,oBAAoB,gBAAiB,CAAA,IAAA;AAAA,UAAK,CAC9C,CAAA,KAAAC,oBAAA,CAAcC,WAAK,CAAA,CAAA,EAAG,CAAC,IAAI,CAAC,CAAA,EAAGA,WAAK,CAAA,SAAA,EAAW,CAAC,IAAI,CAAC,CAAC;AAAA,SACxD;AAEA,QAAA,IAAI,CAAC,iBAAmB,EAAA;AACtB,UAAA,UAAA,CAAW,KAAK,SAAS,CAAA;AAAA;AAC3B;AAIF,MAAA,KAAA,MAAW,aAAa,gBAAkB,EAAA;AACxC,QAAA,IACE,CAAC,QAAS,CAAA,IAAA;AAAA,UAAK,CACb,CAAA,KAAAD,oBAAA,CAAcC,WAAK,CAAA,CAAA,EAAG,CAAC,IAAI,CAAC,CAAA,EAAGA,WAAK,CAAA,SAAA,EAAW,CAAC,IAAI,CAAC,CAAC;AAAA,SAExD,EAAA;AACA,UAAA,YAAA,CAAa,KAAK,SAAS,CAAA;AAAA;AAC7B;AAGF,MAAA,IAAA,CAAK,cAAiB,GAAA;AAAA,QACpB,eAAiB,EAAA,UAAA;AAAA,QACjB,iBAAmB,EAAA;AAAA,OACrB;AAEA,MAAA,MAAM,KAAK,iBAAkB,EAAA;AAAA,aACtB,KAAO,EAAA;AACd,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASF,uBAAgB,CAAA,gCAAA;AAAA,QACzB,aAAe,EAAA;AAAA,OAChB,CAAA;AACD,MAAA,MAAM,aAAa,IAAK,CAAA;AAAA,QACtB;AAAA,OACD,CAAA;AAAA;AACH;AACF;AAAA;AAAA;AAAA;AAAA,EAMA,KAA2D,GAAA;AACzD,IAAM,MAAA,YAAA,GAAe,KAAK,kBAAmB,EAAA;AAC7C,IAAA,MAAM,IAAO,GAAAG,qBAAA,CACV,OAAQ,CAAA,YAAY,CACpB,CAAA,MAAA;AAAA,MACC,SAAO,GAAQ,KAAA;AAAA,KACjB;AAEF,IAAA,KAAA,MAAW,aAAa,IAAM,EAAA;AAC5B,MAAAC,yCAAA,CAAsB,SAAS,CAAA;AAAA;AAGjC,IAAO,OAAA,IAAA;AAAA;AACT,EAEA,MAAc,iBAAmC,GAAA;AAC/C,IAAA,MAAM,KAAK,gBAAiB,EAAA;AAC5B,IAAA,MAAM,KAAK,aAAc,EAAA;AAAA;AAC3B,EAEA,MAAc,aAA+B,GAAA;AAC3C,IAAW,KAAA,MAAA,SAAA,IAAa,IAAK,CAAA,cAAA,CAAe,eAAiB,EAAA;AAC3D,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASJ,uBAAgB,CAAA,eAAA;AAAA,QACzB,aAAe,EAAA,QAAA;AAAA,QACf,IAAM,EAAA,EAAE,UAAY,EAAAK,kBAAA,CAAW,MAAO;AAAA,OACvC,CAAA;AAED,MAAI,IAAA;AACF,QAAA,MAAM,oBAAoB,MAAMC,8BAAA;AAAA,UAC9B,SAAA;AAAA,UACA,IAAK,CAAA,uBAAA;AAAA,UACL,IAAK,CAAA;AAAA,SACP;AAEA,QAAM,MAAA,IAAA,CAAK,kBAAmB,CAAA,eAAA,CAAgB,iBAAiB,CAAA;AAC/D,QAAA,MAAM,aAAa,OAAQ,CAAA;AAAA,UACzB,IAAA,EAAM,EAAE,SAAU;AAAA,SACnB,CAAA;AAAA,eACM,KAAO,EAAA;AACd,QAAM,MAAA,YAAA,CAAa,KAAK,EAAE,KAAA,EAAO,MAAM,EAAE,SAAA,IAAa,CAAA;AAAA;AACxD;AAGF,IAAK,IAAA,CAAA,cAAA,CAAe,kBAAkB,EAAC;AAAA;AACzC,EAEA,MAAc,gBAAkC,GAAA;AAC9C,IAAW,KAAA,MAAA,SAAA,IAAa,IAAK,CAAA,cAAA,CAAe,iBAAmB,EAAA;AAC7D,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,WAAY,CAAA;AAAA,QAClD,SAASN,uBAAgB,CAAA,eAAA;AAAA,QACzB,aAAe,EAAA,QAAA;AAAA,QACf,IAAM,EAAA,EAAE,UAAY,EAAAK,kBAAA,CAAW,MAAO;AAAA,OACvC,CAAA;AAED,MAAI,IAAA;AACF,QAAM,MAAA,iBAAA,GAAA,CACJ,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,UAC5B,SAAU,CAAA,aAAA;AAAA,UACV,SAAU,CAAA,QAAA;AAAA,UACV,SAAU,CAAA,YAAA;AAAA,UACV,SAAU,CAAA;AAAA,WAEZ,CAAC,CAAA;AACH,QAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,eAAgB,CAAA,iBAAA,CAAkB,EAAG,CAAA;AACnE,QAAA,MAAM,aAAa,OAAQ,CAAA,EAAE,MAAM,EAAE,SAAA,IAAa,CAAA;AAAA,eAC3C,KAAO,EAAA;AACd,QAAA,MAAM,aAAa,IAAK,CAAA;AAAA,UACtB,KAAA;AAAA,UACA,IAAA,EAAM,EAAE,SAAU;AAAA,SACnB,CAAA;AAAA;AACH;AAGF,IAAK,IAAA,CAAA,cAAA,CAAe,oBAAoB,EAAC;AAAA;AAC3C,EAEA,MAAM,0BAA4C,GAAA;AAChD,IAAA,MAAM,YACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,UAAU,CAAA;AAC9D,IAAM,MAAA,gBAAA,GAAA,CACJ,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,MAC5B,YAAa,CAAA,GAAA,CAAI,CAAQ,IAAA,KAAA,IAAA,CAAK,aAAa;AAAA,KAC7C,EACA,IAAI,CAAa,SAAA,KAAA;AACjB,MAAO,OAAA;AAAA,QACL,GAAG,SAAA;AAAA,QACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,OACpE;AAAA,KACD,CAAA;AACD,IAAA,IAAA,CAAK,eAAe,iBAAoB,GAAA,gBAAA;AACxC,IAAA,MAAM,KAAK,gBAAiB,EAAA;AAAA;AAEhC;;;;"}

package/dist/role-manager/ancestor-search-memo-sqlite.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var catalogModel = require('@backstage/catalog-model');
 var ancestorSearchMemo = require('./ancestor-search-memo.cjs.js');
 
 class AncestorSearchMemoSQLite extends ancestorSearchMemo.AncestorSearchMemo {
@@ -18,7 +19,7 @@ class AncestorSearchMemoSQLite extends ancestorSearchMemo.AncestorSearchMemo {
     const { items } = await this.catalogApi.getEntities(
       {
         filter: { kind: "Group" },
-        fields: ["metadata.name", "metadata.namespace", "spec.parent"]
+        fields: ["kind", "metadata.name", "metadata.namespace", "spec.parent"]
       },
       { token }
     );
@@ -32,30 +33,36 @@ class AncestorSearchMemoSQLite extends ancestorSearchMemo.AncestorSearchMemo {
     const { items } = await this.catalogApi.getEntities(
       {
         filter: { kind: "Group", "relations.hasMember": this.userEntityRef },
-        fields: ["metadata.name", "metadata.namespace", "spec.parent"]
+        fields: ["kind", "metadata.name", "metadata.namespace", "spec.parent"]
       },
       { token }
     );
     return items;
   }
   traverse(group, allGroups, current_depth) {
-    const groupName = `group:${group.metadata.namespace?.toLocaleLowerCase(
-      "en-US"
-    )}/${group.metadata.name.toLocaleLowerCase("en-US")}`;
-    if (!super.hasEntityRef(groupName)) {
-      super.setNode(groupName);
+    const groupRef = catalogModel.stringifyEntityRef(group);
+    if (!super.hasEntityRef(groupRef)) {
+      super.setNode(groupRef);
     }
     if (this.maxDepth !== undefined && current_depth >= this.maxDepth) {
       return;
     }
     const depth = current_depth + 1;
     const parent = group.spec?.parent;
-    const parentGroup = allGroups.find((g) => g.metadata.name === parent);
+    if (!parent) {
+      return;
+    }
+    const parentRef = catalogModel.stringifyEntityRef(
+      catalogModel.parseEntityRef(parent, {
+        defaultKind: "group",
+        defaultNamespace: group.metadata.namespace
+      })
+    );
+    const parentGroup = allGroups.find(
+      (g) => catalogModel.stringifyEntityRef(g) === parentRef
+    );
     if (parentGroup) {
-      const parentName = `group:${group.metadata.namespace?.toLocaleLowerCase(
-        "en-US"
-      )}/${parentGroup.metadata.name.toLocaleLowerCase("en-US")}`;
-      super.setEdge(parentName, groupName);
+      super.setEdge(parentRef, groupRef);
       if (super.isAcyclic()) {
         this.traverse(parentGroup, allGroups, depth);
       }

package/dist/role-manager/ancestor-search-memo-sqlite.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"ancestor-search-memo-sqlite.cjs.js","sources":["../../src/role-manager/ancestor-search-memo-sqlite.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { AuthService } from '@backstage/backend-plugin-api';\nimport type { CatalogApi } from '@backstage/catalog-client';\nimport type { Entity } from '@backstage/catalog-model';\n\nimport { AncestorSearchMemo } from './ancestor-search-memo';\n\nexport class AncestorSearchMemoSQLite extends AncestorSearchMemo<Entity> {\n  constructor(\n    private readonly userEntityRef: string,\n    private readonly catalogApi: CatalogApi,\n    private readonly auth: AuthService,\n    private readonly maxDepth?: number,\n  ) {\n    super();\n  }\n\n  async getAllASMGroups(): Promise<Entity[]> {\n    const { token } = await this.auth.getPluginRequestToken({\n      onBehalfOf: await this.auth.getOwnServiceCredentials(),\n      targetPluginId: 'catalog',\n    });\n\n    const { items } = await this.catalogApi.getEntities(\n      {\n        filter: { kind: 'Group' },\n        fields: ['metadata.name', 'metadata.namespace', 'spec.parent'],\n      },\n      { token },\n    );\n    return items;\n  }\n\n  async getUserASMGroups(): Promise<Entity[]> {\n    const { token } = await this.auth.getPluginRequestToken({\n      onBehalfOf: await this.auth.getOwnServiceCredentials(),\n      targetPluginId: 'catalog',\n    });\n    const { items } = await this.catalogApi.getEntities(\n      {\n        filter: { kind: 'Group', 'relations.hasMember': this.userEntityRef },\n        fields: ['metadata.name', 'metadata.namespace', 'spec.parent'],\n      },\n      { token },\n    );\n    return items;\n  }\n\n  traverse(group: Entity, allGroups: Entity[], current_depth: number) {\n    const groupName = `group:${group.metadata.namespace?.toLocaleLowerCase(\n      'en-US',\n    )}/${group.metadata.name.toLocaleLowerCase('en-US')}`;\n    if (!super.hasEntityRef(groupName)) {\n      super.setNode(groupName);\n    }\n\n    if (this.maxDepth !== undefined && current_depth >= this.maxDepth) {\n      return;\n    }\n    const depth = current_depth + 1;\n\n    const parent = group.spec?.parent as string;\n    const parentGroup = allGroups.find(g => g.metadata.name === parent);\n\n    if (parentGroup) {\n      const parentName = `group:${group.metadata.namespace?.toLocaleLowerCase(\n        'en-US',\n      )}/${parentGroup.metadata.name.toLocaleLowerCase('en-US')}`;\n      super.setEdge(parentName, groupName);\n\n      if (super.isAcyclic()) {\n        this.traverse(parentGroup, allGroups, depth);\n      }\n    }\n  }\n\n  async buildUserGraph() {\n    const userGroups = await this.getUserASMGroups();\n    const allGroups = await this.getAllASMGroups();\n    userGroups.forEach(group =>\n      this.traverse(group as Entity, allGroups as Entity[], 0),\n    );\n  }\n}\n"],"names":["AncestorSearchMemo"],"mappings":";;;;AAqBO,MAAM,iCAAiCA,qCAA2B,CAAA;AAAA,EACvE,WACmB,CAAA,aAAA,EACA,UACA,EAAA,IAAA,EACA,QACjB,EAAA;AACA,IAAM,KAAA,EAAA;AALW,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA;AAGnB,EAEA,MAAM,eAAqC,GAAA;AACzC,IAAA,MAAM,EAAE,KAAM,EAAA,GAAI,MAAM,IAAA,CAAK,KAAK,qBAAsB,CAAA;AAAA,MACtD,UAAY,EAAA,MAAM,IAAK,CAAA,IAAA,CAAK,wBAAyB,EAAA;AAAA,MACrD,cAAgB,EAAA;AAAA,KACjB,CAAA;AAED,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,UAAW,CAAA,WAAA;AAAA,MACtC;AAAA,QACE,MAAA,EAAQ,EAAE,IAAA,EAAM,OAAQ,EAAA;AAAA,QACxB,MAAQ,EAAA,CAAC,eAAiB,EAAA,oBAAA,EAAsB,aAAa;AAAA,OAC/D;AAAA,MACA,EAAE,KAAM;AAAA,KACV;AACA,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,MAAM,gBAAsC,GAAA;AAC1C,IAAA,MAAM,EAAE,KAAM,EAAA,GAAI,MAAM,IAAA,CAAK,KAAK,qBAAsB,CAAA;AAAA,MACtD,UAAY,EAAA,MAAM,IAAK,CAAA,IAAA,CAAK,wBAAyB,EAAA;AAAA,MACrD,cAAgB,EAAA;AAAA,KACjB,CAAA;AACD,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,UAAW,CAAA,WAAA;AAAA,MACtC;AAAA,QACE,QAAQ,EAAE,IAAA,EAAM,OAAS,EAAA,qBAAA,EAAuB,KAAK,aAAc,EAAA;AAAA,QACnE,MAAQ,EAAA,CAAC,eAAiB,EAAA,oBAAA,EAAsB,aAAa;AAAA,OAC/D;AAAA,MACA,EAAE,KAAM;AAAA,KACV;AACA,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,QAAA,CAAS,KAAe,EAAA,SAAA,EAAqB,aAAuB,EAAA;AAClE,IAAA,MAAM,SAAY,GAAA,CAAA,MAAA,EAAS,KAAM,CAAA,QAAA,CAAS,SAAW,EAAA,iBAAA;AAAA,MACnD;AAAA,KACD,CAAI,CAAA,EAAA,KAAA,CAAM,SAAS,IAAK,CAAA,iBAAA,CAAkB,OAAO,CAAC,CAAA,CAAA;AACnD,IAAA,IAAI,CAAC,KAAA,CAAM,YAAa,CAAA,SAAS,CAAG,EAAA;AAClC,MAAA,KAAA,CAAM,QAAQ,SAAS,CAAA;AAAA;AAGzB,IAAA,IAAI,IAAK,CAAA,QAAA,KAAa,SAAa,IAAA,aAAA,IAAiB,KAAK,QAAU,EAAA;AACjE,MAAA;AAAA;AAEF,IAAA,MAAM,QAAQ,aAAgB,GAAA,CAAA;AAE9B,IAAM,MAAA,MAAA,GAAS,MAAM,IAAM,EAAA,MAAA;AAC3B,IAAA,MAAM,cAAc,SAAU,CAAA,IAAA,CAAK,OAAK,CAAE,CAAA,QAAA,CAAS,SAAS,MAAM,CAAA;AAElE,IAAA,IAAI,WAAa,EAAA;AACf,MAAA,MAAM,UAAa,GAAA,CAAA,MAAA,EAAS,KAAM,CAAA,QAAA,CAAS,SAAW,EAAA,iBAAA;AAAA,QACpD;AAAA,OACD,CAAI,CAAA,EAAA,WAAA,CAAY,SAAS,IAAK,CAAA,iBAAA,CAAkB,OAAO,CAAC,CAAA,CAAA;AACzD,MAAM,KAAA,CAAA,OAAA,CAAQ,YAAY,SAAS,CAAA;AAEnC,MAAI,IAAA,KAAA,CAAM,WAAa,EAAA;AACrB,QAAK,IAAA,CAAA,QAAA,CAAS,WAAa,EAAA,SAAA,EAAW,KAAK,CAAA;AAAA;AAC7C;AACF;AACF,EAEA,MAAM,cAAiB,GAAA;AACrB,IAAM,MAAA,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAiB,EAAA;AAC/C,IAAM,MAAA,SAAA,GAAY,MAAM,IAAA,CAAK,eAAgB,EAAA;AAC7C,IAAW,UAAA,CAAA,OAAA;AAAA,MAAQ,CACjB,KAAA,KAAA,IAAA,CAAK,QAAS,CAAA,KAAA,EAAiB,WAAuB,CAAC;AAAA,KACzD;AAAA;AAEJ;;;;"}
+{"version":3,"file":"ancestor-search-memo-sqlite.cjs.js","sources":["../../src/role-manager/ancestor-search-memo-sqlite.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { AuthService } from '@backstage/backend-plugin-api';\nimport type { CatalogApi } from '@backstage/catalog-client';\nimport type { Entity } from '@backstage/catalog-model';\nimport { parseEntityRef, stringifyEntityRef } from '@backstage/catalog-model';\n\nimport { AncestorSearchMemo } from './ancestor-search-memo';\n\nexport class AncestorSearchMemoSQLite extends AncestorSearchMemo<Entity> {\n  constructor(\n    private readonly userEntityRef: string,\n    private readonly catalogApi: CatalogApi,\n    private readonly auth: AuthService,\n    private readonly maxDepth?: number,\n  ) {\n    super();\n  }\n\n  async getAllASMGroups(): Promise<Entity[]> {\n    const { token } = await this.auth.getPluginRequestToken({\n      onBehalfOf: await this.auth.getOwnServiceCredentials(),\n      targetPluginId: 'catalog',\n    });\n\n    const { items } = await this.catalogApi.getEntities(\n      {\n        filter: { kind: 'Group' },\n        fields: ['kind', 'metadata.name', 'metadata.namespace', 'spec.parent'],\n      },\n      { token },\n    );\n    return items;\n  }\n\n  async getUserASMGroups(): Promise<Entity[]> {\n    const { token } = await this.auth.getPluginRequestToken({\n      onBehalfOf: await this.auth.getOwnServiceCredentials(),\n      targetPluginId: 'catalog',\n    });\n    const { items } = await this.catalogApi.getEntities(\n      {\n        filter: { kind: 'Group', 'relations.hasMember': this.userEntityRef },\n        fields: ['kind', 'metadata.name', 'metadata.namespace', 'spec.parent'],\n      },\n      { token },\n    );\n    return items;\n  }\n\n  traverse(group: Entity, allGroups: Entity[], current_depth: number) {\n    const groupRef = stringifyEntityRef(group);\n\n    if (!super.hasEntityRef(groupRef)) {\n      super.setNode(groupRef);\n    }\n\n    if (this.maxDepth !== undefined && current_depth >= this.maxDepth) {\n      return;\n    }\n    const depth = current_depth + 1;\n\n    const parent = group.spec?.parent as string;\n    if (!parent) {\n      return;\n    }\n\n    const parentRef = stringifyEntityRef(\n      parseEntityRef(parent, {\n        defaultKind: 'group',\n        defaultNamespace: group.metadata.namespace,\n      }),\n    );\n\n    const parentGroup = allGroups.find(\n      g => stringifyEntityRef(g) === parentRef,\n    );\n\n    if (parentGroup) {\n      super.setEdge(parentRef, groupRef);\n\n      if (super.isAcyclic()) {\n        this.traverse(parentGroup, allGroups, depth);\n      }\n    }\n  }\n\n  async buildUserGraph() {\n    const userGroups = await this.getUserASMGroups();\n    const allGroups = await this.getAllASMGroups();\n    userGroups.forEach(group =>\n      this.traverse(group as Entity, allGroups as Entity[], 0),\n    );\n  }\n}\n"],"names":["AncestorSearchMemo","stringifyEntityRef","parseEntityRef"],"mappings":";;;;;AAsBO,MAAM,iCAAiCA,qCAA2B,CAAA;AAAA,EACvE,WACmB,CAAA,aAAA,EACA,UACA,EAAA,IAAA,EACA,QACjB,EAAA;AACA,IAAM,KAAA,EAAA;AALW,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA;AAGnB,EAEA,MAAM,eAAqC,GAAA;AACzC,IAAA,MAAM,EAAE,KAAM,EAAA,GAAI,MAAM,IAAA,CAAK,KAAK,qBAAsB,CAAA;AAAA,MACtD,UAAY,EAAA,MAAM,IAAK,CAAA,IAAA,CAAK,wBAAyB,EAAA;AAAA,MACrD,cAAgB,EAAA;AAAA,KACjB,CAAA;AAED,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,UAAW,CAAA,WAAA;AAAA,MACtC;AAAA,QACE,MAAA,EAAQ,EAAE,IAAA,EAAM,OAAQ,EAAA;AAAA,QACxB,MAAQ,EAAA,CAAC,MAAQ,EAAA,eAAA,EAAiB,sBAAsB,aAAa;AAAA,OACvE;AAAA,MACA,EAAE,KAAM;AAAA,KACV;AACA,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,MAAM,gBAAsC,GAAA;AAC1C,IAAA,MAAM,EAAE,KAAM,EAAA,GAAI,MAAM,IAAA,CAAK,KAAK,qBAAsB,CAAA;AAAA,MACtD,UAAY,EAAA,MAAM,IAAK,CAAA,IAAA,CAAK,wBAAyB,EAAA;AAAA,MACrD,cAAgB,EAAA;AAAA,KACjB,CAAA;AACD,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,UAAW,CAAA,WAAA;AAAA,MACtC;AAAA,QACE,QAAQ,EAAE,IAAA,EAAM,OAAS,EAAA,qBAAA,EAAuB,KAAK,aAAc,EAAA;AAAA,QACnE,MAAQ,EAAA,CAAC,MAAQ,EAAA,eAAA,EAAiB,sBAAsB,aAAa;AAAA,OACvE;AAAA,MACA,EAAE,KAAM;AAAA,KACV;AACA,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,QAAA,CAAS,KAAe,EAAA,SAAA,EAAqB,aAAuB,EAAA;AAClE,IAAM,MAAA,QAAA,GAAWC,gCAAmB,KAAK,CAAA;AAEzC,IAAA,IAAI,CAAC,KAAA,CAAM,YAAa,CAAA,QAAQ,CAAG,EAAA;AACjC,MAAA,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAAA;AAGxB,IAAA,IAAI,IAAK,CAAA,QAAA,KAAa,SAAa,IAAA,aAAA,IAAiB,KAAK,QAAU,EAAA;AACjE,MAAA;AAAA;AAEF,IAAA,MAAM,QAAQ,aAAgB,GAAA,CAAA;AAE9B,IAAM,MAAA,MAAA,GAAS,MAAM,IAAM,EAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,MAAQ,EAAA;AACX,MAAA;AAAA;AAGF,IAAA,MAAM,SAAY,GAAAA,+BAAA;AAAA,MAChBC,4BAAe,MAAQ,EAAA;AAAA,QACrB,WAAa,EAAA,OAAA;AAAA,QACb,gBAAA,EAAkB,MAAM,QAAS,CAAA;AAAA,OAClC;AAAA,KACH;AAEA,IAAA,MAAM,cAAc,SAAU,CAAA,IAAA;AAAA,MAC5B,CAAA,CAAA,KAAKD,+BAAmB,CAAA,CAAC,CAAM,KAAA;AAAA,KACjC;AAEA,IAAA,IAAI,WAAa,EAAA;AACf,MAAM,KAAA,CAAA,OAAA,CAAQ,WAAW,QAAQ,CAAA;AAEjC,MAAI,IAAA,KAAA,CAAM,WAAa,EAAA;AACrB,QAAK,IAAA,CAAA,QAAA,CAAS,WAAa,EAAA,SAAA,EAAW,KAAK,CAAA;AAAA;AAC7C;AACF;AACF,EAEA,MAAM,cAAiB,GAAA;AACrB,IAAM,MAAA,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAiB,EAAA;AAC/C,IAAM,MAAA,SAAA,GAAY,MAAM,IAAA,CAAK,eAAgB,EAAA;AAC7C,IAAW,UAAA,CAAA,OAAA;AAAA,MAAQ,CACjB,KAAA,KAAA,IAAA,CAAK,QAAS,CAAA,KAAA,EAAiB,WAAuB,CAAC;AAAA,KACzD;AAAA;AAEJ;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage-community/plugin-rbac-backend",
-  "version": "7.4.0",
+  "version": "7.4.2",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",
@@ -73,7 +73,7 @@
     "@types/lodash": "^4.14.151",
     "@types/node": "22.15.29",
     "@types/supertest": "2.0.16",
-    "knex-mock-client": "2.0.1",
+    "knex-mock-client": "3.0.2",
     "msw": "1.3.5",
     "qs": "6.14.0",
     "supertest": "6.3.4"