@backstage/plugin-permission-backend 0.1.0 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +46 -0
- package/dist/index.cjs.js +14 -12
- package/dist/index.cjs.js.map +1 -1
- package/package.json +8 -8
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,51 @@
|
|
|
1
1
|
# @backstage/plugin-permission-backend
|
|
2
2
|
|
|
3
|
+
## 0.2.3
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies
|
|
8
|
+
- @backstage/plugin-auth-backend@0.6.0
|
|
9
|
+
- @backstage/backend-common@0.10.1
|
|
10
|
+
- @backstage/plugin-permission-node@0.2.3
|
|
11
|
+
|
|
12
|
+
## 0.2.2
|
|
13
|
+
|
|
14
|
+
### Patch Changes
|
|
15
|
+
|
|
16
|
+
- Updated dependencies
|
|
17
|
+
- @backstage/backend-common@0.10.0
|
|
18
|
+
- @backstage/plugin-auth-backend@0.5.2
|
|
19
|
+
- @backstage/plugin-permission-common@0.3.0
|
|
20
|
+
- @backstage/plugin-permission-node@0.2.2
|
|
21
|
+
|
|
22
|
+
## 0.2.1
|
|
23
|
+
|
|
24
|
+
### Patch Changes
|
|
25
|
+
|
|
26
|
+
- a036b65c2f: Updated to use the new `BackstageIdentityResponse` type from `@backstage/plugin-auth-backend`.
|
|
27
|
+
|
|
28
|
+
The `BackstageIdentityResponse` type is backwards compatible with the `BackstageIdentity`, and provides an additional `identity` field with the claims of the user.
|
|
29
|
+
|
|
30
|
+
- Updated dependencies
|
|
31
|
+
- @backstage/plugin-auth-backend@0.5.0
|
|
32
|
+
- @backstage/backend-common@0.9.13
|
|
33
|
+
- @backstage/plugin-permission-node@0.2.1
|
|
34
|
+
|
|
35
|
+
## 0.2.0
|
|
36
|
+
|
|
37
|
+
### Minor Changes
|
|
38
|
+
|
|
39
|
+
- 450ca92330: Change route used for integration between the authorization framework and other plugin backends to use the /.well-known prefix.
|
|
40
|
+
|
|
41
|
+
### Patch Changes
|
|
42
|
+
|
|
43
|
+
- e7851efa9e: Rename and adjust permission policy return type to reduce nesting
|
|
44
|
+
- Updated dependencies
|
|
45
|
+
- @backstage/plugin-auth-backend@0.4.10
|
|
46
|
+
- @backstage/plugin-permission-node@0.2.0
|
|
47
|
+
- @backstage/backend-common@0.9.12
|
|
48
|
+
|
|
3
49
|
## 0.1.0
|
|
4
50
|
|
|
5
51
|
### Minor Changes
|
package/dist/index.cjs.js
CHANGED
|
@@ -29,17 +29,17 @@ class PermissionIntegrationClient {
|
|
|
29
29
|
resourceType,
|
|
30
30
|
conditions
|
|
31
31
|
}, authHeader) {
|
|
32
|
-
const endpoint = `${await this.discovery.getBaseUrl(pluginId)}/permissions/apply-conditions`;
|
|
32
|
+
const endpoint = `${await this.discovery.getBaseUrl(pluginId)}/.well-known/backstage/permissions/apply-conditions`;
|
|
33
33
|
const request = {
|
|
34
34
|
resourceRef,
|
|
35
35
|
resourceType,
|
|
36
36
|
conditions
|
|
37
37
|
};
|
|
38
|
-
const response = await fetch__default[
|
|
38
|
+
const response = await fetch__default["default"](endpoint, {
|
|
39
39
|
method: "POST",
|
|
40
40
|
body: JSON.stringify(request),
|
|
41
41
|
headers: {
|
|
42
|
-
...authHeader ? {authorization: authHeader} : {},
|
|
42
|
+
...authHeader ? { authorization: authHeader } : {},
|
|
43
43
|
"content-type": "application/json"
|
|
44
44
|
}
|
|
45
45
|
});
|
|
@@ -66,10 +66,10 @@ const requestSchema = zod.z.array(zod.z.object({
|
|
|
66
66
|
})
|
|
67
67
|
})
|
|
68
68
|
}));
|
|
69
|
-
const handleRequest = async ({id, resourceRef, ...request}, user, policy, permissionIntegrationClient, authHeader) => {
|
|
69
|
+
const handleRequest = async ({ id, resourceRef, ...request }, user, policy, permissionIntegrationClient, authHeader) => {
|
|
70
70
|
const response = await policy.handle(request, user);
|
|
71
71
|
if (response.result === pluginPermissionCommon.AuthorizeResult.CONDITIONAL) {
|
|
72
|
-
if (request.permission.resourceType !== response.
|
|
72
|
+
if (request.permission.resourceType !== response.resourceType) {
|
|
73
73
|
throw new Error(`Invalid resource conditions returned from permission policy for permission ${request.permission.name}`);
|
|
74
74
|
}
|
|
75
75
|
if (resourceRef) {
|
|
@@ -77,27 +77,29 @@ const handleRequest = async ({id, resourceRef, ...request}, user, policy, permis
|
|
|
77
77
|
id,
|
|
78
78
|
...await permissionIntegrationClient.applyConditions({
|
|
79
79
|
resourceRef,
|
|
80
|
-
|
|
80
|
+
pluginId: response.pluginId,
|
|
81
|
+
resourceType: response.resourceType,
|
|
82
|
+
conditions: response.conditions
|
|
81
83
|
}, authHeader)
|
|
82
84
|
};
|
|
83
85
|
}
|
|
84
86
|
return {
|
|
85
87
|
id,
|
|
86
88
|
result: pluginPermissionCommon.AuthorizeResult.CONDITIONAL,
|
|
87
|
-
conditions: response.conditions
|
|
89
|
+
conditions: response.conditions
|
|
88
90
|
};
|
|
89
91
|
}
|
|
90
|
-
return {id, ...response};
|
|
92
|
+
return { id, ...response };
|
|
91
93
|
};
|
|
92
94
|
async function createRouter(options) {
|
|
93
|
-
const {policy, discovery, identity} = options;
|
|
95
|
+
const { policy, discovery, identity } = options;
|
|
94
96
|
const permissionIntegrationClient = new PermissionIntegrationClient({
|
|
95
97
|
discovery
|
|
96
98
|
});
|
|
97
|
-
const router = Router__default[
|
|
98
|
-
router.use(express__default[
|
|
99
|
+
const router = Router__default["default"]();
|
|
100
|
+
router.use(express__default["default"].json());
|
|
99
101
|
router.get("/health", (_, response) => {
|
|
100
|
-
response.send({status: "ok"});
|
|
102
|
+
response.send({ status: "ok" });
|
|
101
103
|
});
|
|
102
104
|
router.post("/authorize", async (req, res) => {
|
|
103
105
|
const token = pluginAuthBackend.IdentityClient.getBearerToken(req.header("authorization"));
|
package/dist/index.cjs.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.cjs.js","sources":["../src/service/PermissionIntegrationClient.ts","../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'node-fetch';\nimport { z } from 'zod';\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport {\n AuthorizeResult,\n PermissionCondition,\n PermissionCriteria,\n} from '@backstage/plugin-permission-common';\nimport {\n ApplyConditionsRequest,\n ApplyConditionsResponse,\n} from '@backstage/plugin-permission-node';\n\nconst responseSchema = z.object({\n result: z.literal(AuthorizeResult.ALLOW).or(z.literal(AuthorizeResult.DENY)),\n});\n\nexport class PermissionIntegrationClient {\n private readonly discovery: PluginEndpointDiscovery;\n\n constructor(options: { discovery: PluginEndpointDiscovery }) {\n this.discovery = options.discovery;\n }\n\n async applyConditions(\n {\n pluginId,\n resourceRef,\n resourceType,\n conditions,\n }: {\n resourceRef: string;\n pluginId: string;\n resourceType: string;\n conditions: PermissionCriteria<PermissionCondition>;\n },\n authHeader?: string,\n ): Promise<ApplyConditionsResponse> {\n const endpoint = `${await this.discovery.getBaseUrl(\n pluginId,\n )}/permissions/apply-conditions`;\n\n const request: ApplyConditionsRequest = {\n resourceRef,\n resourceType,\n conditions,\n };\n\n const response = await fetch(endpoint, {\n method: 'POST',\n body: JSON.stringify(request),\n headers: {\n ...(authHeader ? { authorization: authHeader } : {}),\n 'content-type': 'application/json',\n },\n });\n\n if (!response.ok) {\n throw new Error(\n `Unexpected response from plugin upstream when applying conditions. Expected 200 but got ${response.status} - ${response.statusText}`,\n );\n }\n\n return responseSchema.parse(await response.json());\n }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { z } from 'zod';\nimport express, { Request, Response } from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport {\n errorHandler,\n PluginEndpointDiscovery,\n} from '@backstage/backend-common';\nimport {\n
|
|
1
|
+
{"version":3,"file":"index.cjs.js","sources":["../src/service/PermissionIntegrationClient.ts","../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'node-fetch';\nimport { z } from 'zod';\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport {\n AuthorizeResult,\n PermissionCondition,\n PermissionCriteria,\n} from '@backstage/plugin-permission-common';\nimport {\n ApplyConditionsRequest,\n ApplyConditionsResponse,\n} from '@backstage/plugin-permission-node';\n\nconst responseSchema = z.object({\n result: z.literal(AuthorizeResult.ALLOW).or(z.literal(AuthorizeResult.DENY)),\n});\n\nexport class PermissionIntegrationClient {\n private readonly discovery: PluginEndpointDiscovery;\n\n constructor(options: { discovery: PluginEndpointDiscovery }) {\n this.discovery = options.discovery;\n }\n\n async applyConditions(\n {\n pluginId,\n resourceRef,\n resourceType,\n conditions,\n }: {\n resourceRef: string;\n pluginId: string;\n resourceType: string;\n conditions: PermissionCriteria<PermissionCondition>;\n },\n authHeader?: string,\n ): Promise<ApplyConditionsResponse> {\n const endpoint = `${await this.discovery.getBaseUrl(\n pluginId,\n )}/.well-known/backstage/permissions/apply-conditions`;\n\n const request: ApplyConditionsRequest = {\n resourceRef,\n resourceType,\n conditions,\n };\n\n const response = await fetch(endpoint, {\n method: 'POST',\n body: JSON.stringify(request),\n headers: {\n ...(authHeader ? { authorization: authHeader } : {}),\n 'content-type': 'application/json',\n },\n });\n\n if (!response.ok) {\n throw new Error(\n `Unexpected response from plugin upstream when applying conditions. Expected 200 but got ${response.status} - ${response.statusText}`,\n );\n }\n\n return responseSchema.parse(await response.json());\n }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { z } from 'zod';\nimport express, { Request, Response } from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport {\n errorHandler,\n PluginEndpointDiscovery,\n} from '@backstage/backend-common';\nimport {\n BackstageIdentityResponse,\n IdentityClient,\n} from '@backstage/plugin-auth-backend';\nimport {\n AuthorizeResult,\n AuthorizeResponse,\n AuthorizeRequest,\n Identified,\n} from '@backstage/plugin-permission-common';\nimport { PermissionPolicy } from '@backstage/plugin-permission-node';\nimport { PermissionIntegrationClient } from './PermissionIntegrationClient';\n\nconst requestSchema: z.ZodSchema<Identified<AuthorizeRequest>[]> = z.array(\n z.object({\n id: z.string(),\n resourceRef: z.string().optional(),\n permission: z.object({\n name: z.string(),\n resourceType: z.string().optional(),\n attributes: z.object({\n action: z\n .union([\n z.literal('create'),\n z.literal('read'),\n z.literal('update'),\n z.literal('delete'),\n ])\n .optional(),\n }),\n }),\n }),\n);\n\n/**\n * Options required when constructing a new {@link express#Router} using\n * {@link createRouter}.\n *\n * @public\n */\nexport interface RouterOptions {\n logger: Logger;\n discovery: PluginEndpointDiscovery;\n policy: PermissionPolicy;\n identity: IdentityClient;\n}\n\nconst handleRequest = async (\n { id, resourceRef, ...request }: Identified<AuthorizeRequest>,\n user: BackstageIdentityResponse | undefined,\n policy: PermissionPolicy,\n permissionIntegrationClient: PermissionIntegrationClient,\n authHeader?: string,\n): Promise<Identified<AuthorizeResponse>> => {\n const response = await policy.handle(request, user);\n\n if (response.result === AuthorizeResult.CONDITIONAL) {\n // Sanity check that any resource provided matches the one expected by the permission\n if (request.permission.resourceType !== response.resourceType) {\n throw new Error(\n `Invalid resource conditions returned from permission policy for permission ${request.permission.name}`,\n );\n }\n\n if (resourceRef) {\n return {\n id,\n ...(await permissionIntegrationClient.applyConditions(\n {\n resourceRef,\n pluginId: response.pluginId,\n resourceType: response.resourceType,\n conditions: response.conditions,\n },\n authHeader,\n )),\n };\n }\n\n return {\n id,\n result: AuthorizeResult.CONDITIONAL,\n conditions: response.conditions,\n };\n }\n\n return { id, ...response };\n};\n\n/**\n * Creates a new {@link express#Router} which provides the backend API\n * for the permission system.\n *\n * @public\n */\nexport async function createRouter(\n options: RouterOptions,\n): Promise<express.Router> {\n const { policy, discovery, identity } = options;\n\n const permissionIntegrationClient = new PermissionIntegrationClient({\n discovery,\n });\n\n const router = Router();\n router.use(express.json());\n\n router.get('/health', (_, response) => {\n response.send({ status: 'ok' });\n });\n\n router.post(\n '/authorize',\n async (\n req: Request<Identified<AuthorizeRequest>[]>,\n res: Response<Identified<AuthorizeResponse>[]>,\n ) => {\n const token = IdentityClient.getBearerToken(req.header('authorization'));\n const user = token ? await identity.authenticate(token) : undefined;\n\n const body = requestSchema.parse(req.body);\n\n res.json(\n await Promise.all(\n body.map(request =>\n handleRequest(\n request,\n user,\n policy,\n permissionIntegrationClient,\n req.header('authorization'),\n ),\n ),\n ),\n );\n },\n );\n\n router.use(errorHandler());\n return router;\n}\n"],"names":["z","AuthorizeResult","fetch","Router","express","IdentityClient","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,MAAM,iBAAiBA,MAAE,OAAO;AAAA,EAC9B,QAAQA,MAAE,QAAQC,uCAAgB,OAAO,GAAGD,MAAE,QAAQC,uCAAgB;AAAA;kCAG/B;AAAA,EAGvC,YAAY,SAAiD;AAC3D,SAAK,YAAY,QAAQ;AAAA;AAAA,QAGrB,gBACJ;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,KAOF,YACkC;AAClC,UAAM,WAAW,GAAG,MAAM,KAAK,UAAU,WACvC;AAGF,UAAM,UAAkC;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA;AAGF,UAAM,WAAW,MAAMC,0BAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,WACH,aAAa,EAAE,eAAe,eAAe;AAAA,QACjD,gBAAgB;AAAA;AAAA;AAIpB,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MACR,2FAA2F,SAAS,YAAY,SAAS;AAAA;AAI7H,WAAO,eAAe,MAAM,MAAM,SAAS;AAAA;AAAA;;AC1C/C,MAAM,gBAA6DF,MAAE,MACnEA,MAAE,OAAO;AAAA,EACP,IAAIA,MAAE;AAAA,EACN,aAAaA,MAAE,SAAS;AAAA,EACxB,YAAYA,MAAE,OAAO;AAAA,IACnB,MAAMA,MAAE;AAAA,IACR,cAAcA,MAAE,SAAS;AAAA,IACzB,YAAYA,MAAE,OAAO;AAAA,MACnB,QAAQA,MACL,MAAM;AAAA,QACLA,MAAE,QAAQ;AAAA,QACVA,MAAE,QAAQ;AAAA,QACVA,MAAE,QAAQ;AAAA,QACVA,MAAE,QAAQ;AAAA,SAEX;AAAA;AAAA;AAAA;AAmBX,MAAM,gBAAgB,OACpB,EAAE,IAAI,gBAAgB,WACtB,MACA,QACA,6BACA,eAC2C;AAC3C,QAAM,WAAW,MAAM,OAAO,OAAO,SAAS;AAE9C,MAAI,SAAS,WAAWC,uCAAgB,aAAa;AAEnD,QAAI,QAAQ,WAAW,iBAAiB,SAAS,cAAc;AAC7D,YAAM,IAAI,MACR,8EAA8E,QAAQ,WAAW;AAAA;AAIrG,QAAI,aAAa;AACf,aAAO;AAAA,QACL;AAAA,WACI,MAAM,4BAA4B,gBACpC;AAAA,UACE;AAAA,UACA,UAAU,SAAS;AAAA,UACnB,cAAc,SAAS;AAAA,UACvB,YAAY,SAAS;AAAA,WAEvB;AAAA;AAAA;AAKN,WAAO;AAAA,MACL;AAAA,MACA,QAAQA,uCAAgB;AAAA,MACxB,YAAY,SAAS;AAAA;AAAA;AAIzB,SAAO,EAAE,OAAO;AAAA;4BAUhB,SACyB;AACzB,QAAM,EAAE,QAAQ,WAAW,aAAa;AAExC,QAAM,8BAA8B,IAAI,4BAA4B;AAAA,IAClE;AAAA;AAGF,QAAM,SAASE;AACf,SAAO,IAAIC,4BAAQ;AAEnB,SAAO,IAAI,WAAW,CAAC,GAAG,aAAa;AACrC,aAAS,KAAK,EAAE,QAAQ;AAAA;AAG1B,SAAO,KACL,cACA,OACE,KACA,QACG;AACH,UAAM,QAAQC,iCAAe,eAAe,IAAI,OAAO;AACvD,UAAM,OAAO,QAAQ,MAAM,SAAS,aAAa,SAAS;AAE1D,UAAM,OAAO,cAAc,MAAM,IAAI;AAErC,QAAI,KACF,MAAM,QAAQ,IACZ,KAAK,IAAI,aACP,cACE,SACA,MACA,QACA,6BACA,IAAI,OAAO;AAAA;AAQvB,SAAO,IAAIC;AACX,SAAO;AAAA;;;;"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@backstage/plugin-permission-backend",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.3",
|
|
4
4
|
"main": "dist/index.cjs.js",
|
|
5
5
|
"types": "dist/index.d.ts",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -19,11 +19,11 @@
|
|
|
19
19
|
"clean": "backstage-cli clean"
|
|
20
20
|
},
|
|
21
21
|
"dependencies": {
|
|
22
|
-
"@backstage/backend-common": "^0.
|
|
22
|
+
"@backstage/backend-common": "^0.10.1",
|
|
23
23
|
"@backstage/config": "^0.1.11",
|
|
24
|
-
"@backstage/plugin-auth-backend": "^0.
|
|
25
|
-
"@backstage/plugin-permission-common": "^0.
|
|
26
|
-
"@backstage/plugin-permission-node": "^0.
|
|
24
|
+
"@backstage/plugin-auth-backend": "^0.6.0",
|
|
25
|
+
"@backstage/plugin-permission-common": "^0.3.0",
|
|
26
|
+
"@backstage/plugin-permission-node": "^0.2.3",
|
|
27
27
|
"@types/express": "*",
|
|
28
28
|
"express": "^4.17.1",
|
|
29
29
|
"express-promise-router": "^4.1.0",
|
|
@@ -33,13 +33,13 @@
|
|
|
33
33
|
"zod": "^3.11.6"
|
|
34
34
|
},
|
|
35
35
|
"devDependencies": {
|
|
36
|
-
"@backstage/cli": "^0.
|
|
36
|
+
"@backstage/cli": "^0.10.4",
|
|
37
37
|
"@types/supertest": "^2.0.8",
|
|
38
38
|
"msw": "^0.35.0",
|
|
39
|
-
"supertest": "^
|
|
39
|
+
"supertest": "^6.1.6"
|
|
40
40
|
},
|
|
41
41
|
"files": [
|
|
42
42
|
"dist"
|
|
43
43
|
],
|
|
44
|
-
"gitHead": "
|
|
44
|
+
"gitHead": "4b2a8ed96ff427735c872a72c1864321ef698436"
|
|
45
45
|
}
|