@backstage/plugin-permission-backend 0.5.50-next.0 → 0.5.50

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @backstage/plugin-permission-backend
 
+## 0.5.50
+
+### Patch Changes
+
+- 094eaa3: Remove references to in-repo backend-common
+- 3109c24: The export for the new backend system at the `/alpha` export is now also available via the main entry point, which means that you can remove the `/alpha` suffix from the import.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3
+  - @backstage/plugin-permission-node@0.8.4
+  - @backstage/backend-plugin-api@1.0.1
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/plugin-permission-common@0.8.1
+
+## 0.5.50-next.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3-next.1
+  - @backstage/backend-plugin-api@1.0.1-next.1
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/plugin-permission-common@0.8.1
+  - @backstage/plugin-permission-node@0.8.4-next.1
+
 ## 0.5.50-next.0
 
 ### Patch Changes

package/alpha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-permission-backend__alpha",
-  "version": "0.5.50-next.0",
+  "version": "0.5.50",
   "main": "../dist/alpha.cjs.js",
   "types": "../dist/alpha.d.ts"
 }

package/dist/alpha.cjs.js

@@ -2,76 +2,9 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var backendPluginApi = require('@backstage/backend-plugin-api');
-var alpha = require('@backstage/plugin-permission-node/alpha');
-var router = require('./cjs/router-CQi5gJv2.cjs.js');
-require('zod');
-require('express');
-require('express-promise-router');
-require('@backstage/backend-common');
-require('@backstage/errors');
-require('@backstage/plugin-permission-common');
-require('node-fetch');
-require('lodash');
-require('dataloader');
+var plugin = require('./plugin.cjs.js');
 
-class PolicyExtensionPointImpl {
-  policy;
-  setPolicy(policy) {
-    if (this.policy) {
-      throw new Error("Policy already set");
-    }
-    this.policy = policy;
-  }
-}
-const permissionPlugin = backendPluginApi.createBackendPlugin({
-  pluginId: "permission",
-  register(env) {
-    const policies = new PolicyExtensionPointImpl();
-    env.registerExtensionPoint(alpha.policyExtensionPoint, policies);
-    env.registerInit({
-      deps: {
-        http: backendPluginApi.coreServices.httpRouter,
-        config: backendPluginApi.coreServices.rootConfig,
-        logger: backendPluginApi.coreServices.logger,
-        discovery: backendPluginApi.coreServices.discovery,
-        auth: backendPluginApi.coreServices.auth,
-        httpAuth: backendPluginApi.coreServices.httpAuth,
-        userInfo: backendPluginApi.coreServices.userInfo
-      },
-      async init({
-        http,
-        config,
-        logger,
-        discovery,
-        auth,
-        httpAuth,
-        userInfo
-      }) {
-        if (!policies.policy) {
-          throw new Error(
-            "No policy module installed! Please install a policy module. If you want to allow all requests, use @backstage/plugin-permission-backend-module-allow-all-policy permissionModuleAllowAllPolicy"
-          );
-        }
-        http.use(
-          await router.createRouter({
-            config,
-            discovery,
-            logger,
-            policy: policies.policy,
-            auth,
-            httpAuth,
-            userInfo
-          })
-        );
-        http.addAuthPolicy({
-          path: "/health",
-          allow: "unauthenticated"
-        });
-      }
-    });
-  }
-});
+const _feature = plugin.permissionPlugin;
 
-exports.default = permissionPlugin;
+exports.default = _feature;
 //# sourceMappingURL=alpha.cjs.js.map

package/dist/alpha.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"alpha.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { PermissionPolicy } from '@backstage/plugin-permission-node';\nimport {\n  policyExtensionPoint,\n  PolicyExtensionPoint,\n} from '@backstage/plugin-permission-node/alpha';\nimport { createRouter } from './service';\n\nclass PolicyExtensionPointImpl implements PolicyExtensionPoint {\n  public policy: PermissionPolicy | undefined;\n\n  setPolicy(policy: PermissionPolicy): void {\n    if (this.policy) {\n      throw new Error('Policy already set');\n    }\n    this.policy = policy;\n  }\n}\n\n/**\n * Permission plugin\n *\n * @alpha\n */\nexport const permissionPlugin = createBackendPlugin({\n  pluginId: 'permission',\n  register(env) {\n    const policies = new PolicyExtensionPointImpl();\n\n    env.registerExtensionPoint(policyExtensionPoint, policies);\n\n    env.registerInit({\n      deps: {\n        http: coreServices.httpRouter,\n        config: coreServices.rootConfig,\n        logger: coreServices.logger,\n        discovery: coreServices.discovery,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        userInfo: coreServices.userInfo,\n      },\n      async init({\n        http,\n        config,\n        logger,\n        discovery,\n        auth,\n        httpAuth,\n        userInfo,\n      }) {\n        if (!policies.policy) {\n          throw new Error(\n            'No policy module installed! Please install a policy module. If you want to allow all requests, use @backstage/plugin-permission-backend-module-allow-all-policy permissionModuleAllowAllPolicy',\n          );\n        }\n\n        http.use(\n          await createRouter({\n            config,\n            discovery,\n            logger,\n            policy: policies.policy,\n            auth,\n            httpAuth,\n            userInfo,\n          }),\n        );\n        http.addAuthPolicy({\n          path: '/health',\n          allow: 'unauthenticated',\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","policyExtensionPoint","coreServices","createRouter"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,MAAM,wBAAyD,CAAA;AAAA,EACtD,MAAA,CAAA;AAAA,EAEP,UAAU,MAAgC,EAAA;AACxC,IAAA,IAAI,KAAK,MAAQ,EAAA;AACf,MAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,KACtC;AACA,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA,CAAA;AAAA,GAChB;AACF,CAAA;AAOO,MAAM,mBAAmBA,oCAAoB,CAAA;AAAA,EAClD,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAM,MAAA,QAAA,GAAW,IAAI,wBAAyB,EAAA,CAAA;AAE9C,IAAI,GAAA,CAAA,sBAAA,CAAuBC,4BAAsB,QAAQ,CAAA,CAAA;AAEzD,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,MAAMC,6BAAa,CAAA,UAAA;AAAA,QACnB,QAAQA,6BAAa,CAAA,UAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA,MAAA;AAAA,QACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,QACxB,MAAMA,6BAAa,CAAA,IAAA;AAAA,QACnB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,UAAUA,6BAAa,CAAA,QAAA;AAAA,OACzB;AAAA,MACA,MAAM,IAAK,CAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA,QACA,QAAA;AAAA,OACC,EAAA;AACD,QAAI,IAAA,CAAC,SAAS,MAAQ,EAAA;AACpB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,gMAAA;AAAA,WACF,CAAA;AAAA,SACF;AAEA,QAAK,IAAA,CAAA,GAAA;AAAA,UACH,MAAMC,mBAAa,CAAA;AAAA,YACjB,MAAA;AAAA,YACA,SAAA;AAAA,YACA,MAAA;AAAA,YACA,QAAQ,QAAS,CAAA,MAAA;AAAA,YACjB,IAAA;AAAA,YACA,QAAA;AAAA,YACA,QAAA;AAAA,WACD,CAAA;AAAA,SACH,CAAA;AACA,QAAA,IAAA,CAAK,aAAc,CAAA;AAAA,UACjB,IAAM,EAAA,SAAA;AAAA,UACN,KAAO,EAAA,iBAAA;AAAA,SACR,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}
+{"version":3,"file":"alpha.cjs.js","sources":["../src/alpha.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { permissionPlugin as feature } from './plugin';\n\n/** @alpha */\nconst _feature = feature;\nexport default _feature;\n"],"names":["feature"],"mappings":";;;;;;AAmBA,MAAM,QAAW,GAAAA;;;;"}

package/dist/alpha.d.ts

@@ -1,10 +1,6 @@
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
 
-/**
- * Permission plugin
- *
- * @alpha
- */
-declare const permissionPlugin: _backstage_backend_plugin_api.BackendFeature;
+/** @alpha */
+declare const _feature: _backstage_backend_plugin_api.BackendFeature;
 
-export { permissionPlugin as default };
+export { _feature as default };

package/dist/index.cjs.js

@@ -1,17 +1,12 @@
 'use strict';
 
-var router = require('./cjs/router-CQi5gJv2.cjs.js');
-require('zod');
-require('express');
-require('express-promise-router');
-require('@backstage/backend-common');
-require('@backstage/errors');
-require('@backstage/plugin-permission-common');
-require('node-fetch');
-require('lodash');
-require('dataloader');
+Object.defineProperty(exports, '__esModule', { value: true });
 
+var plugin = require('./plugin.cjs.js');
+var router = require('./service/router.cjs.js');
 
 
+
+exports.default = plugin.permissionPlugin;
 exports.createRouter = router.createRouter;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;"}

package/dist/index.d.ts

@@ -1,7 +1,15 @@
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+import { LoggerService, DiscoveryService, RootConfigService, AuthService, HttpAuthService, UserInfoService } from '@backstage/backend-plugin-api';
 import express from 'express';
 import { IdentityApi } from '@backstage/plugin-auth-node';
 import { PermissionPolicy } from '@backstage/plugin-permission-node';
-import { LoggerService, DiscoveryService, RootConfigService, AuthService, HttpAuthService, UserInfoService } from '@backstage/backend-plugin-api';
+
+/**
+ * Permission plugin
+ *
+ * @public
+ */
+declare const permissionPlugin: _backstage_backend_plugin_api.BackendFeature;
 
 /**
  * Options required when constructing a new {@link express#Router} using
@@ -29,4 +37,4 @@ interface RouterOptions {
  */
 declare function createRouter(options: RouterOptions): Promise<express.Router>;
 
-export { type RouterOptions, createRouter };
+export { type RouterOptions, createRouter, permissionPlugin as default };

package/dist/plugin.cjs.js

@@ -0,0 +1,66 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var alpha = require('@backstage/plugin-permission-node/alpha');
+var router = require('./service/router.cjs.js');
+
+class PolicyExtensionPointImpl {
+  policy;
+  setPolicy(policy) {
+    if (this.policy) {
+      throw new Error("Policy already set");
+    }
+    this.policy = policy;
+  }
+}
+const permissionPlugin = backendPluginApi.createBackendPlugin({
+  pluginId: "permission",
+  register(env) {
+    const policies = new PolicyExtensionPointImpl();
+    env.registerExtensionPoint(alpha.policyExtensionPoint, policies);
+    env.registerInit({
+      deps: {
+        http: backendPluginApi.coreServices.httpRouter,
+        config: backendPluginApi.coreServices.rootConfig,
+        logger: backendPluginApi.coreServices.logger,
+        discovery: backendPluginApi.coreServices.discovery,
+        auth: backendPluginApi.coreServices.auth,
+        httpAuth: backendPluginApi.coreServices.httpAuth,
+        userInfo: backendPluginApi.coreServices.userInfo
+      },
+      async init({
+        http,
+        config,
+        logger,
+        discovery,
+        auth,
+        httpAuth,
+        userInfo
+      }) {
+        if (!policies.policy) {
+          throw new Error(
+            "No policy module installed! Please install a policy module. If you want to allow all requests, use @backstage/plugin-permission-backend-module-allow-all-policy permissionModuleAllowAllPolicy"
+          );
+        }
+        http.use(
+          await router.createRouter({
+            config,
+            discovery,
+            logger,
+            policy: policies.policy,
+            auth,
+            httpAuth,
+            userInfo
+          })
+        );
+        http.addAuthPolicy({
+          path: "/health",
+          allow: "unauthenticated"
+        });
+      }
+    });
+  }
+});
+
+exports.permissionPlugin = permissionPlugin;
+//# sourceMappingURL=plugin.cjs.js.map

package/dist/plugin.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { PermissionPolicy } from '@backstage/plugin-permission-node';\nimport {\n  policyExtensionPoint,\n  PolicyExtensionPoint,\n} from '@backstage/plugin-permission-node/alpha';\nimport { createRouter } from './service';\n\nclass PolicyExtensionPointImpl implements PolicyExtensionPoint {\n  public policy: PermissionPolicy | undefined;\n\n  setPolicy(policy: PermissionPolicy): void {\n    if (this.policy) {\n      throw new Error('Policy already set');\n    }\n    this.policy = policy;\n  }\n}\n\n/**\n * Permission plugin\n *\n * @public\n */\nexport const permissionPlugin = createBackendPlugin({\n  pluginId: 'permission',\n  register(env) {\n    const policies = new PolicyExtensionPointImpl();\n\n    env.registerExtensionPoint(policyExtensionPoint, policies);\n\n    env.registerInit({\n      deps: {\n        http: coreServices.httpRouter,\n        config: coreServices.rootConfig,\n        logger: coreServices.logger,\n        discovery: coreServices.discovery,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        userInfo: coreServices.userInfo,\n      },\n      async init({\n        http,\n        config,\n        logger,\n        discovery,\n        auth,\n        httpAuth,\n        userInfo,\n      }) {\n        if (!policies.policy) {\n          throw new Error(\n            'No policy module installed! Please install a policy module. If you want to allow all requests, use @backstage/plugin-permission-backend-module-allow-all-policy permissionModuleAllowAllPolicy',\n          );\n        }\n\n        http.use(\n          await createRouter({\n            config,\n            discovery,\n            logger,\n            policy: policies.policy,\n            auth,\n            httpAuth,\n            userInfo,\n          }),\n        );\n        http.addAuthPolicy({\n          path: '/health',\n          allow: 'unauthenticated',\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","policyExtensionPoint","coreServices","createRouter"],"mappings":";;;;;;AA2BA,MAAM,wBAAyD,CAAA;AAAA,EACtD,MAAA,CAAA;AAAA,EAEP,UAAU,MAAgC,EAAA;AACxC,IAAA,IAAI,KAAK,MAAQ,EAAA;AACf,MAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,KACtC;AACA,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA,CAAA;AAAA,GAChB;AACF,CAAA;AAOO,MAAM,mBAAmBA,oCAAoB,CAAA;AAAA,EAClD,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAM,MAAA,QAAA,GAAW,IAAI,wBAAyB,EAAA,CAAA;AAE9C,IAAI,GAAA,CAAA,sBAAA,CAAuBC,4BAAsB,QAAQ,CAAA,CAAA;AAEzD,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,MAAMC,6BAAa,CAAA,UAAA;AAAA,QACnB,QAAQA,6BAAa,CAAA,UAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA,MAAA;AAAA,QACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,QACxB,MAAMA,6BAAa,CAAA,IAAA;AAAA,QACnB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,UAAUA,6BAAa,CAAA,QAAA;AAAA,OACzB;AAAA,MACA,MAAM,IAAK,CAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA,QACA,QAAA;AAAA,OACC,EAAA;AACD,QAAI,IAAA,CAAC,SAAS,MAAQ,EAAA;AACpB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,gMAAA;AAAA,WACF,CAAA;AAAA,SACF;AAEA,QAAK,IAAA,CAAA,GAAA;AAAA,UACH,MAAMC,mBAAa,CAAA;AAAA,YACjB,MAAA;AAAA,YACA,SAAA;AAAA,YACA,MAAA;AAAA,YACA,QAAQ,QAAS,CAAA,MAAA;AAAA,YACjB,IAAA;AAAA,YACA,QAAA;AAAA,YACA,QAAA;AAAA,WACD,CAAA;AAAA,SACH,CAAA;AACA,QAAA,IAAA,CAAK,aAAc,CAAA;AAAA,UACjB,IAAM,EAAA,SAAA;AAAA,UACN,KAAO,EAAA,iBAAA;AAAA,SACR,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}

package/dist/service/PermissionIntegrationClient.cjs.js

@@ -0,0 +1,60 @@
+'use strict';
+
+var fetch = require('node-fetch');
+var zod = require('zod');
+var pluginPermissionCommon = require('@backstage/plugin-permission-common');
+var errors = require('@backstage/errors');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var fetch__default = /*#__PURE__*/_interopDefaultCompat(fetch);
+
+const responseSchema = zod.z.object({
+  items: zod.z.array(
+    zod.z.object({
+      id: zod.z.string(),
+      result: zod.z.literal(pluginPermissionCommon.AuthorizeResult.ALLOW).or(zod.z.literal(pluginPermissionCommon.AuthorizeResult.DENY))
+    })
+  )
+});
+class PermissionIntegrationClient {
+  discovery;
+  auth;
+  constructor(options) {
+    this.discovery = options.discovery;
+    this.auth = options.auth;
+  }
+  async applyConditions(pluginId, credentials, decisions) {
+    const baseUrl = await this.discovery.getBaseUrl(pluginId);
+    const endpoint = `${baseUrl}/.well-known/backstage/permissions/apply-conditions`;
+    const token = this.auth.isPrincipal(credentials, "none") ? void 0 : await this.auth.getPluginRequestToken({
+      onBehalfOf: credentials,
+      targetPluginId: pluginId
+    }).then((t) => t.token);
+    const response = await fetch__default.default(endpoint, {
+      method: "POST",
+      body: JSON.stringify({
+        items: decisions.map(
+          ({ id, resourceRef, resourceType, conditions }) => ({
+            id,
+            resourceRef,
+            resourceType,
+            conditions
+          })
+        )
+      }),
+      headers: {
+        ...token ? { authorization: `Bearer ${token}` } : {},
+        "content-type": "application/json"
+      }
+    });
+    if (!response.ok) {
+      throw await errors.ResponseError.fromResponse(response);
+    }
+    const result = responseSchema.parse(await response.json());
+    return result.items;
+  }
+}
+
+exports.PermissionIntegrationClient = PermissionIntegrationClient;
+//# sourceMappingURL=PermissionIntegrationClient.cjs.js.map

package/dist/service/PermissionIntegrationClient.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionIntegrationClient.cjs.js","sources":["../../src/service/PermissionIntegrationClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'node-fetch';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  ConditionalPolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n  ApplyConditionsRequestEntry,\n  ApplyConditionsResponseEntry,\n} from '@backstage/plugin-permission-node';\nimport {\n  AuthService,\n  BackstageCredentials,\n  DiscoveryService,\n} from '@backstage/backend-plugin-api';\nimport { ResponseError } from '@backstage/errors';\n\nconst responseSchema = z.object({\n  items: z.array(\n    z.object({\n      id: z.string(),\n      result: z\n        .literal(AuthorizeResult.ALLOW)\n        .or(z.literal(AuthorizeResult.DENY)),\n    }),\n  ),\n});\n\nexport type ResourcePolicyDecision = ConditionalPolicyDecision & {\n  resourceRef: string;\n};\n\nexport class PermissionIntegrationClient {\n  private readonly discovery: DiscoveryService;\n  private readonly auth: AuthService;\n\n  constructor(options: { discovery: DiscoveryService; auth: AuthService }) {\n    this.discovery = options.discovery;\n    this.auth = options.auth;\n  }\n\n  async applyConditions(\n    pluginId: string,\n    credentials: BackstageCredentials,\n    decisions: readonly ApplyConditionsRequestEntry[],\n  ): Promise<ApplyConditionsResponseEntry[]> {\n    const baseUrl = await this.discovery.getBaseUrl(pluginId);\n    const endpoint = `${baseUrl}/.well-known/backstage/permissions/apply-conditions`;\n\n    const token = this.auth.isPrincipal(credentials, 'none')\n      ? undefined\n      : await this.auth\n          .getPluginRequestToken({\n            onBehalfOf: credentials,\n            targetPluginId: pluginId,\n          })\n          .then(t => t.token);\n\n    const response = await fetch(endpoint, {\n      method: 'POST',\n      body: JSON.stringify({\n        items: decisions.map(\n          ({ id, resourceRef, resourceType, conditions }) => ({\n            id,\n            resourceRef,\n            resourceType,\n            conditions,\n          }),\n        ),\n      }),\n      headers: {\n        ...(token ? { authorization: `Bearer ${token}` } : {}),\n        'content-type': 'application/json',\n      },\n    });\n\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const result = responseSchema.parse(await response.json());\n\n    return result.items;\n  }\n}\n"],"names":["z","AuthorizeResult","fetch","ResponseError"],"mappings":";;;;;;;;;;;AAiCA,MAAM,cAAA,GAAiBA,MAAE,MAAO,CAAA;AAAA,EAC9B,OAAOA,KAAE,CAAA,KAAA;AAAA,IACPA,MAAE,MAAO,CAAA;AAAA,MACP,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,MACb,MAAA,EAAQA,KACL,CAAA,OAAA,CAAQC,sCAAgB,CAAA,KAAK,CAC7B,CAAA,EAAA,CAAGD,KAAE,CAAA,OAAA,CAAQC,sCAAgB,CAAA,IAAI,CAAC,CAAA;AAAA,KACtC,CAAA;AAAA,GACH;AACF,CAAC,CAAA,CAAA;AAMM,MAAM,2BAA4B,CAAA;AAAA,EACtB,SAAA,CAAA;AAAA,EACA,IAAA,CAAA;AAAA,EAEjB,YAAY,OAA6D,EAAA;AACvE,IAAA,IAAA,CAAK,YAAY,OAAQ,CAAA,SAAA,CAAA;AACzB,IAAA,IAAA,CAAK,OAAO,OAAQ,CAAA,IAAA,CAAA;AAAA,GACtB;AAAA,EAEA,MAAM,eAAA,CACJ,QACA,EAAA,WAAA,EACA,SACyC,EAAA;AACzC,IAAA,MAAM,OAAU,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,QAAQ,CAAA,CAAA;AACxD,IAAM,MAAA,QAAA,GAAW,GAAG,OAAO,CAAA,mDAAA,CAAA,CAAA;AAE3B,IAAM,MAAA,KAAA,GAAQ,IAAK,CAAA,IAAA,CAAK,WAAY,CAAA,WAAA,EAAa,MAAM,CAAA,GACnD,KACA,CAAA,GAAA,MAAM,IAAK,CAAA,IAAA,CACR,qBAAsB,CAAA;AAAA,MACrB,UAAY,EAAA,WAAA;AAAA,MACZ,cAAgB,EAAA,QAAA;AAAA,KACjB,CAAA,CACA,IAAK,CAAA,CAAA,CAAA,KAAK,EAAE,KAAK,CAAA,CAAA;AAExB,IAAM,MAAA,QAAA,GAAW,MAAMC,sBAAA,CAAM,QAAU,EAAA;AAAA,MACrC,MAAQ,EAAA,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,SAAU,CAAA;AAAA,QACnB,OAAO,SAAU,CAAA,GAAA;AAAA,UACf,CAAC,EAAE,EAAA,EAAI,WAAa,EAAA,YAAA,EAAc,YAAkB,MAAA;AAAA,YAClD,EAAA;AAAA,YACA,WAAA;AAAA,YACA,YAAA;AAAA,YACA,UAAA;AAAA,WACF,CAAA;AAAA,SACF;AAAA,OACD,CAAA;AAAA,MACD,OAAS,EAAA;AAAA,QACP,GAAI,QAAQ,EAAE,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA,KAAO,EAAC;AAAA,QACpD,cAAgB,EAAA,kBAAA;AAAA,OAClB;AAAA,KACD,CAAA,CAAA;AAED,IAAI,IAAA,CAAC,SAAS,EAAI,EAAA;AAChB,MAAM,MAAA,MAAMC,oBAAc,CAAA,YAAA,CAAa,QAAQ,CAAA,CAAA;AAAA,KACjD;AAEA,IAAA,MAAM,SAAS,cAAe,CAAA,KAAA,CAAM,MAAM,QAAA,CAAS,MAAM,CAAA,CAAA;AAEzD,IAAA,OAAO,MAAO,CAAA,KAAA,CAAA;AAAA,GAChB;AACF;;;;"}

package/dist/{cjs/router-CQi5gJv2.cjs.js → service/router.cjs.js}

@@ -6,7 +6,7 @@ var Router = require('express-promise-router');
 var backendCommon = require('@backstage/backend-common');
 var errors = require('@backstage/errors');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
-var fetch = require('node-fetch');
+var PermissionIntegrationClient = require('./PermissionIntegrationClient.cjs.js');
 var lodash = require('lodash');
 var DataLoader = require('dataloader');
 
@@ -14,56 +14,8 @@ function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'defau
 
 var express__default = /*#__PURE__*/_interopDefaultCompat(express);
 var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
-var fetch__default = /*#__PURE__*/_interopDefaultCompat(fetch);
 var DataLoader__default = /*#__PURE__*/_interopDefaultCompat(DataLoader);
 
-const responseSchema = zod.z.object({
-  items: zod.z.array(
-    zod.z.object({
-      id: zod.z.string(),
-      result: zod.z.literal(pluginPermissionCommon.AuthorizeResult.ALLOW).or(zod.z.literal(pluginPermissionCommon.AuthorizeResult.DENY))
-    })
-  )
-});
-class PermissionIntegrationClient {
-  discovery;
-  auth;
-  constructor(options) {
-    this.discovery = options.discovery;
-    this.auth = options.auth;
-  }
-  async applyConditions(pluginId, credentials, decisions) {
-    const baseUrl = await this.discovery.getBaseUrl(pluginId);
-    const endpoint = `${baseUrl}/.well-known/backstage/permissions/apply-conditions`;
-    const token = this.auth.isPrincipal(credentials, "none") ? void 0 : await this.auth.getPluginRequestToken({
-      onBehalfOf: credentials,
-      targetPluginId: pluginId
-    }).then((t) => t.token);
-    const response = await fetch__default.default(endpoint, {
-      method: "POST",
-      body: JSON.stringify({
-        items: decisions.map(
-          ({ id, resourceRef, resourceType, conditions }) => ({
-            id,
-            resourceRef,
-            resourceType,
-            conditions
-          })
-        )
-      }),
-      headers: {
-        ...token ? { authorization: `Bearer ${token}` } : {},
-        "content-type": "application/json"
-      }
-    });
-    if (!response.ok) {
-      throw await errors.ResponseError.fromResponse(response);
-    }
-    const result = responseSchema.parse(await response.json());
-    return result.items;
-  }
-}
-
 const attributesSchema = zod.z.object({
   action: zod.z.union([
     zod.z.literal("create"),
@@ -160,7 +112,7 @@ async function createRouter(options) {
       "Permission backend started with permissions disabled. Enable permissions by setting permission.enabled=true."
     );
   }
-  const permissionIntegrationClient = new PermissionIntegrationClient({
+  const permissionIntegrationClient = new PermissionIntegrationClient.PermissionIntegrationClient({
     discovery,
     auth
   });
@@ -199,4 +151,4 @@ async function createRouter(options) {
 }
 
 exports.createRouter = createRouter;
-//# sourceMappingURL=router-CQi5gJv2.cjs.js.map
+//# sourceMappingURL=router.cjs.js.map

package/dist/service/router.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { z } from 'zod';\nimport express, { Request, Response } from 'express';\nimport Router from 'express-promise-router';\nimport {\n  createLegacyAuthAdapters,\n  errorHandler,\n} from '@backstage/backend-common';\nimport { InputError } from '@backstage/errors';\nimport { IdentityApi } from '@backstage/plugin-auth-node';\nimport {\n  AuthorizeResult,\n  EvaluatePermissionRequest,\n  EvaluatePermissionRequestBatch,\n  EvaluatePermissionResponse,\n  EvaluatePermissionResponseBatch,\n  IdentifiedPermissionMessage,\n  isResourcePermission,\n  PermissionAttributes,\n} from '@backstage/plugin-permission-common';\nimport {\n  ApplyConditionsRequestEntry,\n  ApplyConditionsResponseEntry,\n  PermissionPolicy,\n  PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\nimport { PermissionIntegrationClient } from './PermissionIntegrationClient';\nimport { memoize } from 'lodash';\nimport DataLoader from 'dataloader';\nimport {\n  AuthService,\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstageUserPrincipal,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n  UserInfoService,\n} from '@backstage/backend-plugin-api';\n\nconst attributesSchema: z.ZodSchema<PermissionAttributes> = z.object({\n  action: z\n    .union([\n      z.literal('create'),\n      z.literal('read'),\n      z.literal('update'),\n      z.literal('delete'),\n    ])\n    .optional(),\n});\n\nconst permissionSchema = z.union([\n  z.object({\n    type: z.literal('basic'),\n    name: z.string(),\n    attributes: attributesSchema,\n  }),\n  z.object({\n    type: z.literal('resource'),\n    name: z.string(),\n    attributes: attributesSchema,\n    resourceType: z.string(),\n  }),\n]);\n\nconst evaluatePermissionRequestSchema: z.ZodSchema<\n  IdentifiedPermissionMessage<EvaluatePermissionRequest>\n> = z.object({\n  id: z.string(),\n  resourceRef: z.string().optional(),\n  permission: permissionSchema,\n});\n\nconst evaluatePermissionRequestBatchSchema: z.ZodSchema<EvaluatePermissionRequestBatch> =\n  z.object({\n    items: z.array(evaluatePermissionRequestSchema),\n  });\n\n/**\n * Options required when constructing a new {@link express#Router} using\n * {@link createRouter}.\n *\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  discovery: DiscoveryService;\n  policy: PermissionPolicy;\n  identity?: IdentityApi;\n  config: RootConfigService;\n  auth?: AuthService;\n  httpAuth?: HttpAuthService;\n  userInfo?: UserInfoService;\n}\n\nconst handleRequest = async (\n  requests: IdentifiedPermissionMessage<EvaluatePermissionRequest>[],\n  policy: PermissionPolicy,\n  permissionIntegrationClient: PermissionIntegrationClient,\n  credentials: BackstageCredentials<\n    BackstageNonePrincipal | BackstageUserPrincipal\n  >,\n  auth: AuthService,\n  userInfo: UserInfoService,\n): Promise<IdentifiedPermissionMessage<EvaluatePermissionResponse>[]> => {\n  const applyConditionsLoaderFor = memoize((pluginId: string) => {\n    return new DataLoader<\n      ApplyConditionsRequestEntry,\n      ApplyConditionsResponseEntry\n    >(batch =>\n      permissionIntegrationClient.applyConditions(pluginId, credentials, batch),\n    );\n  });\n\n  let user: PolicyQueryUser | undefined;\n  if (auth.isPrincipal(credentials, 'user')) {\n    const info = await userInfo.getUserInfo(credentials);\n    const { token } = await auth.getPluginRequestToken({\n      onBehalfOf: credentials,\n      targetPluginId: 'catalog', // TODO: unknown at this point\n    });\n    user = {\n      identity: {\n        type: 'user',\n        userEntityRef: credentials.principal.userEntityRef,\n        ownershipEntityRefs: info.ownershipEntityRefs,\n      },\n      token,\n      credentials,\n      info,\n    };\n  }\n\n  return Promise.all(\n    requests.map(({ id, resourceRef, ...request }) =>\n      policy.handle(request, user).then(decision => {\n        if (decision.result !== AuthorizeResult.CONDITIONAL) {\n          return {\n            id,\n            ...decision,\n          };\n        }\n\n        if (!isResourcePermission(request.permission)) {\n          throw new Error(\n            `Conditional decision returned from permission policy for non-resource permission ${request.permission.name}`,\n          );\n        }\n\n        if (decision.resourceType !== request.permission.resourceType) {\n          throw new Error(\n            `Invalid resource conditions returned from permission policy for permission ${request.permission.name}`,\n          );\n        }\n\n        if (!resourceRef) {\n          return {\n            id,\n            ...decision,\n          };\n        }\n\n        return applyConditionsLoaderFor(decision.pluginId).load({\n          id,\n          resourceRef,\n          ...decision,\n        });\n      }),\n    ),\n  );\n};\n\n/**\n * Creates a new {@link express#Router} which provides the backend API\n * for the permission system.\n *\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n * @public\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { policy, discovery, config, logger } = options;\n  const { auth, httpAuth, userInfo } = createLegacyAuthAdapters(options);\n\n  if (!config.getOptionalBoolean('permission.enabled')) {\n    logger.warn(\n      'Permission backend started with permissions disabled. Enable permissions by setting permission.enabled=true.',\n    );\n  }\n\n  const permissionIntegrationClient = new PermissionIntegrationClient({\n    discovery,\n    auth,\n  });\n\n  const router = Router();\n  router.use(express.json());\n\n  router.get('/health', (_, response) => {\n    response.json({ status: 'ok' });\n  });\n\n  router.post(\n    '/authorize',\n    async (\n      req: Request<EvaluatePermissionRequestBatch>,\n      res: Response<EvaluatePermissionResponseBatch>,\n    ) => {\n      const credentials = await httpAuth.credentials(req, {\n        allow: ['user', 'none'],\n      });\n\n      const parseResult = evaluatePermissionRequestBatchSchema.safeParse(\n        req.body,\n      );\n\n      if (!parseResult.success) {\n        throw new InputError(parseResult.error.toString());\n      }\n\n      const body = parseResult.data;\n\n      res.json({\n        items: await handleRequest(\n          body.items,\n          policy,\n          permissionIntegrationClient,\n          credentials,\n          auth,\n          userInfo,\n        ),\n      });\n    },\n  );\n\n  router.use(errorHandler());\n\n  return router;\n}\n"],"names":["z","memoize","DataLoader","AuthorizeResult","isResourcePermission","createLegacyAuthAdapters","PermissionIntegrationClient","Router","express","InputError","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;AAwDA,MAAM,gBAAA,GAAsDA,MAAE,MAAO,CAAA;AAAA,EACnE,MAAA,EAAQA,MACL,KAAM,CAAA;AAAA,IACLA,KAAA,CAAE,QAAQ,QAAQ,CAAA;AAAA,IAClBA,KAAA,CAAE,QAAQ,MAAM,CAAA;AAAA,IAChBA,KAAA,CAAE,QAAQ,QAAQ,CAAA;AAAA,IAClBA,KAAA,CAAE,QAAQ,QAAQ,CAAA;AAAA,GACnB,EACA,QAAS,EAAA;AACd,CAAC,CAAA,CAAA;AAED,MAAM,gBAAA,GAAmBA,MAAE,KAAM,CAAA;AAAA,EAC/BA,MAAE,MAAO,CAAA;AAAA,IACP,IAAA,EAAMA,KAAE,CAAA,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,IACf,UAAY,EAAA,gBAAA;AAAA,GACb,CAAA;AAAA,EACDA,MAAE,MAAO,CAAA;AAAA,IACP,IAAA,EAAMA,KAAE,CAAA,OAAA,CAAQ,UAAU,CAAA;AAAA,IAC1B,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,IACf,UAAY,EAAA,gBAAA;AAAA,IACZ,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,GACxB,CAAA;AACH,CAAC,CAAA,CAAA;AAED,MAAM,+BAAA,GAEFA,MAAE,MAAO,CAAA;AAAA,EACX,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,EACb,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,EACjC,UAAY,EAAA,gBAAA;AACd,CAAC,CAAA,CAAA;AAED,MAAM,oCAAA,GACJA,MAAE,MAAO,CAAA;AAAA,EACP,KAAA,EAAOA,KAAE,CAAA,KAAA,CAAM,+BAA+B,CAAA;AAChD,CAAC,CAAA,CAAA;AAoBH,MAAM,gBAAgB,OACpB,QAAA,EACA,QACA,2BACA,EAAA,WAAA,EAGA,MACA,QACuE,KAAA;AACvE,EAAM,MAAA,wBAAA,GAA2BC,cAAQ,CAAA,CAAC,QAAqB,KAAA;AAC7D,IAAA,OAAO,IAAIC,2BAAA;AAAA,MAGT,CACA,KAAA,KAAA,2BAAA,CAA4B,eAAgB,CAAA,QAAA,EAAU,aAAa,KAAK,CAAA;AAAA,KAC1E,CAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAI,IAAA,IAAA,CAAA;AACJ,EAAA,IAAI,IAAK,CAAA,WAAA,CAAY,WAAa,EAAA,MAAM,CAAG,EAAA;AACzC,IAAA,MAAM,IAAO,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,WAAW,CAAA,CAAA;AACnD,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,MACjD,UAAY,EAAA,WAAA;AAAA,MACZ,cAAgB,EAAA,SAAA;AAAA;AAAA,KACjB,CAAA,CAAA;AACD,IAAO,IAAA,GAAA;AAAA,MACL,QAAU,EAAA;AAAA,QACR,IAAM,EAAA,MAAA;AAAA,QACN,aAAA,EAAe,YAAY,SAAU,CAAA,aAAA;AAAA,QACrC,qBAAqB,IAAK,CAAA,mBAAA;AAAA,OAC5B;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAA,OAAO,OAAQ,CAAA,GAAA;AAAA,IACb,QAAS,CAAA,GAAA;AAAA,MAAI,CAAC,EAAE,EAAI,EAAA,WAAA,EAAa,GAAG,OAAA,EAClC,KAAA,MAAA,CAAO,MAAO,CAAA,OAAA,EAAS,IAAI,CAAA,CAAE,KAAK,CAAY,QAAA,KAAA;AAC5C,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAC,sCAAA,CAAgB,WAAa,EAAA;AACnD,UAAO,OAAA;AAAA,YACL,EAAA;AAAA,YACA,GAAG,QAAA;AAAA,WACL,CAAA;AAAA,SACF;AAEA,QAAA,IAAI,CAACC,2CAAA,CAAqB,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC7C,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,iFAAA,EAAoF,OAAQ,CAAA,UAAA,CAAW,IAAI,CAAA,CAAA;AAAA,WAC7G,CAAA;AAAA,SACF;AAEA,QAAA,IAAI,QAAS,CAAA,YAAA,KAAiB,OAAQ,CAAA,UAAA,CAAW,YAAc,EAAA;AAC7D,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,2EAAA,EAA8E,OAAQ,CAAA,UAAA,CAAW,IAAI,CAAA,CAAA;AAAA,WACvG,CAAA;AAAA,SACF;AAEA,QAAA,IAAI,CAAC,WAAa,EAAA;AAChB,UAAO,OAAA;AAAA,YACL,EAAA;AAAA,YACA,GAAG,QAAA;AAAA,WACL,CAAA;AAAA,SACF;AAEA,QAAA,OAAO,wBAAyB,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAE,IAAK,CAAA;AAAA,UACtD,EAAA;AAAA,UACA,WAAA;AAAA,UACA,GAAG,QAAA;AAAA,SACJ,CAAA,CAAA;AAAA,OACF,CAAA;AAAA,KACH;AAAA,GACF,CAAA;AACF,CAAA,CAAA;AASA,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAW,EAAA,MAAA,EAAQ,QAAW,GAAA,OAAA,CAAA;AAC9C,EAAA,MAAM,EAAE,IAAM,EAAA,QAAA,EAAU,QAAS,EAAA,GAAIC,uCAAyB,OAAO,CAAA,CAAA;AAErE,EAAA,IAAI,CAAC,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,CAAG,EAAA;AACpD,IAAO,MAAA,CAAA,IAAA;AAAA,MACL,8GAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAM,MAAA,2BAAA,GAA8B,IAAIC,uDAA4B,CAAA;AAAA,IAClE,SAAA;AAAA,IACA,IAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAA,MAAM,SAASC,uBAAO,EAAA,CAAA;AACtB,EAAO,MAAA,CAAA,GAAA,CAAIC,wBAAQ,CAAA,IAAA,EAAM,CAAA,CAAA;AAEzB,EAAA,MAAA,CAAO,GAAI,CAAA,SAAA,EAAW,CAAC,CAAA,EAAG,QAAa,KAAA;AACrC,IAAA,QAAA,CAAS,IAAK,CAAA,EAAE,MAAQ,EAAA,IAAA,EAAM,CAAA,CAAA;AAAA,GAC/B,CAAA,CAAA;AAED,EAAO,MAAA,CAAA,IAAA;AAAA,IACL,YAAA;AAAA,IACA,OACE,KACA,GACG,KAAA;AACH,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAK,EAAA;AAAA,QAClD,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAM,CAAA;AAAA,OACvB,CAAA,CAAA;AAED,MAAA,MAAM,cAAc,oCAAqC,CAAA,SAAA;AAAA,QACvD,GAAI,CAAA,IAAA;AAAA,OACN,CAAA;AAEA,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIC,iBAAA,CAAW,WAAY,CAAA,KAAA,CAAM,UAAU,CAAA,CAAA;AAAA,OACnD;AAEA,MAAA,MAAM,OAAO,WAAY,CAAA,IAAA,CAAA;AAEzB,MAAA,GAAA,CAAI,IAAK,CAAA;AAAA,QACP,OAAO,MAAM,aAAA;AAAA,UACX,IAAK,CAAA,KAAA;AAAA,UACL,MAAA;AAAA,UACA,2BAAA;AAAA,UACA,WAAA;AAAA,UACA,IAAA;AAAA,UACA,QAAA;AAAA,SACF;AAAA,OACD,CAAA,CAAA;AAAA,KACH;AAAA,GACF,CAAA;AAEA,EAAO,MAAA,CAAA,GAAA,CAAIC,4BAAc,CAAA,CAAA;AAEzB,EAAO,OAAA,MAAA,CAAA;AACT;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-permission-backend",
-  "version": "0.5.50-next.0",
+  "version": "0.5.50",
   "backstage": {
     "role": "backend-plugin",
     "pluginId": "permission",
@@ -23,6 +23,7 @@
   "license": "Apache-2.0",
   "exports": {
     ".": {
+      "backstage": "@backstage/BackendFeature",
       "require": "./dist/index.cjs.js",
       "types": "./dist/index.d.ts",
       "default": "./dist/index.cjs.js"
@@ -52,12 +53,12 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.25.0",
-    "@backstage/backend-plugin-api": "^1.0.1-next.0",
+    "@backstage/backend-plugin-api": "^1.0.1",
     "@backstage/config": "^1.2.0",
     "@backstage/errors": "^1.2.4",
-    "@backstage/plugin-auth-node": "^0.5.3-next.0",
+    "@backstage/plugin-auth-node": "^0.5.3",
     "@backstage/plugin-permission-common": "^0.8.1",
-    "@backstage/plugin-permission-node": "^0.8.4-next.0",
+    "@backstage/plugin-permission-node": "^0.8.4",
     "@types/express": "*",
     "dataloader": "^2.0.0",
     "express": "^4.17.1",
@@ -68,8 +69,8 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "^1.0.1-next.0",
-    "@backstage/cli": "^0.28.0-next.0",
+    "@backstage/backend-test-utils": "^1.0.1",
+    "@backstage/cli": "^0.28.0",
     "@types/lodash": "^4.14.151",
     "@types/supertest": "^2.0.8",
     "msw": "^1.0.0",

package/dist/cjs/router-CQi5gJv2.cjs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"router-CQi5gJv2.cjs.js","sources":["../../src/service/PermissionIntegrationClient.ts","../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fetch from 'node-fetch';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  ConditionalPolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n  ApplyConditionsRequestEntry,\n  ApplyConditionsResponseEntry,\n} from '@backstage/plugin-permission-node';\nimport {\n  AuthService,\n  BackstageCredentials,\n  DiscoveryService,\n} from '@backstage/backend-plugin-api';\nimport { ResponseError } from '@backstage/errors';\n\nconst responseSchema = z.object({\n  items: z.array(\n    z.object({\n      id: z.string(),\n      result: z\n        .literal(AuthorizeResult.ALLOW)\n        .or(z.literal(AuthorizeResult.DENY)),\n    }),\n  ),\n});\n\nexport type ResourcePolicyDecision = ConditionalPolicyDecision & {\n  resourceRef: string;\n};\n\nexport class PermissionIntegrationClient {\n  private readonly discovery: DiscoveryService;\n  private readonly auth: AuthService;\n\n  constructor(options: { discovery: DiscoveryService; auth: AuthService }) {\n    this.discovery = options.discovery;\n    this.auth = options.auth;\n  }\n\n  async applyConditions(\n    pluginId: string,\n    credentials: BackstageCredentials,\n    decisions: readonly ApplyConditionsRequestEntry[],\n  ): Promise<ApplyConditionsResponseEntry[]> {\n    const baseUrl = await this.discovery.getBaseUrl(pluginId);\n    const endpoint = `${baseUrl}/.well-known/backstage/permissions/apply-conditions`;\n\n    const token = this.auth.isPrincipal(credentials, 'none')\n      ? undefined\n      : await this.auth\n          .getPluginRequestToken({\n            onBehalfOf: credentials,\n            targetPluginId: pluginId,\n          })\n          .then(t => t.token);\n\n    const response = await fetch(endpoint, {\n      method: 'POST',\n      body: JSON.stringify({\n        items: decisions.map(\n          ({ id, resourceRef, resourceType, conditions }) => ({\n            id,\n            resourceRef,\n            resourceType,\n            conditions,\n          }),\n        ),\n      }),\n      headers: {\n        ...(token ? { authorization: `Bearer ${token}` } : {}),\n        'content-type': 'application/json',\n      },\n    });\n\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const result = responseSchema.parse(await response.json());\n\n    return result.items;\n  }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { z } from 'zod';\nimport express, { Request, Response } from 'express';\nimport Router from 'express-promise-router';\nimport {\n  createLegacyAuthAdapters,\n  errorHandler,\n} from '@backstage/backend-common';\nimport { InputError } from '@backstage/errors';\nimport { IdentityApi } from '@backstage/plugin-auth-node';\nimport {\n  AuthorizeResult,\n  EvaluatePermissionRequest,\n  EvaluatePermissionRequestBatch,\n  EvaluatePermissionResponse,\n  EvaluatePermissionResponseBatch,\n  IdentifiedPermissionMessage,\n  isResourcePermission,\n  PermissionAttributes,\n} from '@backstage/plugin-permission-common';\nimport {\n  ApplyConditionsRequestEntry,\n  ApplyConditionsResponseEntry,\n  PermissionPolicy,\n  PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\nimport { PermissionIntegrationClient } from './PermissionIntegrationClient';\nimport { memoize } from 'lodash';\nimport DataLoader from 'dataloader';\nimport {\n  AuthService,\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstageUserPrincipal,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n  UserInfoService,\n} from '@backstage/backend-plugin-api';\n\nconst attributesSchema: z.ZodSchema<PermissionAttributes> = z.object({\n  action: z\n    .union([\n      z.literal('create'),\n      z.literal('read'),\n      z.literal('update'),\n      z.literal('delete'),\n    ])\n    .optional(),\n});\n\nconst permissionSchema = z.union([\n  z.object({\n    type: z.literal('basic'),\n    name: z.string(),\n    attributes: attributesSchema,\n  }),\n  z.object({\n    type: z.literal('resource'),\n    name: z.string(),\n    attributes: attributesSchema,\n    resourceType: z.string(),\n  }),\n]);\n\nconst evaluatePermissionRequestSchema: z.ZodSchema<\n  IdentifiedPermissionMessage<EvaluatePermissionRequest>\n> = z.object({\n  id: z.string(),\n  resourceRef: z.string().optional(),\n  permission: permissionSchema,\n});\n\nconst evaluatePermissionRequestBatchSchema: z.ZodSchema<EvaluatePermissionRequestBatch> =\n  z.object({\n    items: z.array(evaluatePermissionRequestSchema),\n  });\n\n/**\n * Options required when constructing a new {@link express#Router} using\n * {@link createRouter}.\n *\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  discovery: DiscoveryService;\n  policy: PermissionPolicy;\n  identity?: IdentityApi;\n  config: RootConfigService;\n  auth?: AuthService;\n  httpAuth?: HttpAuthService;\n  userInfo?: UserInfoService;\n}\n\nconst handleRequest = async (\n  requests: IdentifiedPermissionMessage<EvaluatePermissionRequest>[],\n  policy: PermissionPolicy,\n  permissionIntegrationClient: PermissionIntegrationClient,\n  credentials: BackstageCredentials<\n    BackstageNonePrincipal | BackstageUserPrincipal\n  >,\n  auth: AuthService,\n  userInfo: UserInfoService,\n): Promise<IdentifiedPermissionMessage<EvaluatePermissionResponse>[]> => {\n  const applyConditionsLoaderFor = memoize((pluginId: string) => {\n    return new DataLoader<\n      ApplyConditionsRequestEntry,\n      ApplyConditionsResponseEntry\n    >(batch =>\n      permissionIntegrationClient.applyConditions(pluginId, credentials, batch),\n    );\n  });\n\n  let user: PolicyQueryUser | undefined;\n  if (auth.isPrincipal(credentials, 'user')) {\n    const info = await userInfo.getUserInfo(credentials);\n    const { token } = await auth.getPluginRequestToken({\n      onBehalfOf: credentials,\n      targetPluginId: 'catalog', // TODO: unknown at this point\n    });\n    user = {\n      identity: {\n        type: 'user',\n        userEntityRef: credentials.principal.userEntityRef,\n        ownershipEntityRefs: info.ownershipEntityRefs,\n      },\n      token,\n      credentials,\n      info,\n    };\n  }\n\n  return Promise.all(\n    requests.map(({ id, resourceRef, ...request }) =>\n      policy.handle(request, user).then(decision => {\n        if (decision.result !== AuthorizeResult.CONDITIONAL) {\n          return {\n            id,\n            ...decision,\n          };\n        }\n\n        if (!isResourcePermission(request.permission)) {\n          throw new Error(\n            `Conditional decision returned from permission policy for non-resource permission ${request.permission.name}`,\n          );\n        }\n\n        if (decision.resourceType !== request.permission.resourceType) {\n          throw new Error(\n            `Invalid resource conditions returned from permission policy for permission ${request.permission.name}`,\n          );\n        }\n\n        if (!resourceRef) {\n          return {\n            id,\n            ...decision,\n          };\n        }\n\n        return applyConditionsLoaderFor(decision.pluginId).load({\n          id,\n          resourceRef,\n          ...decision,\n        });\n      }),\n    ),\n  );\n};\n\n/**\n * Creates a new {@link express#Router} which provides the backend API\n * for the permission system.\n *\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n * @public\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { policy, discovery, config, logger } = options;\n  const { auth, httpAuth, userInfo } = createLegacyAuthAdapters(options);\n\n  if (!config.getOptionalBoolean('permission.enabled')) {\n    logger.warn(\n      'Permission backend started with permissions disabled. Enable permissions by setting permission.enabled=true.',\n    );\n  }\n\n  const permissionIntegrationClient = new PermissionIntegrationClient({\n    discovery,\n    auth,\n  });\n\n  const router = Router();\n  router.use(express.json());\n\n  router.get('/health', (_, response) => {\n    response.json({ status: 'ok' });\n  });\n\n  router.post(\n    '/authorize',\n    async (\n      req: Request<EvaluatePermissionRequestBatch>,\n      res: Response<EvaluatePermissionResponseBatch>,\n    ) => {\n      const credentials = await httpAuth.credentials(req, {\n        allow: ['user', 'none'],\n      });\n\n      const parseResult = evaluatePermissionRequestBatchSchema.safeParse(\n        req.body,\n      );\n\n      if (!parseResult.success) {\n        throw new InputError(parseResult.error.toString());\n      }\n\n      const body = parseResult.data;\n\n      res.json({\n        items: await handleRequest(\n          body.items,\n          policy,\n          permissionIntegrationClient,\n          credentials,\n          auth,\n          userInfo,\n        ),\n      });\n    },\n  );\n\n  router.use(errorHandler());\n\n  return router;\n}\n"],"names":["z","AuthorizeResult","fetch","ResponseError","memoize","DataLoader","isResourcePermission","createLegacyAuthAdapters","Router","express","InputError","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,MAAM,cAAA,GAAiBA,MAAE,MAAO,CAAA;AAAA,EAC9B,OAAOA,KAAE,CAAA,KAAA;AAAA,IACPA,MAAE,MAAO,CAAA;AAAA,MACP,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,MACb,MAAA,EAAQA,KACL,CAAA,OAAA,CAAQC,sCAAgB,CAAA,KAAK,CAC7B,CAAA,EAAA,CAAGD,KAAE,CAAA,OAAA,CAAQC,sCAAgB,CAAA,IAAI,CAAC,CAAA;AAAA,KACtC,CAAA;AAAA,GACH;AACF,CAAC,CAAA,CAAA;AAMM,MAAM,2BAA4B,CAAA;AAAA,EACtB,SAAA,CAAA;AAAA,EACA,IAAA,CAAA;AAAA,EAEjB,YAAY,OAA6D,EAAA;AACvE,IAAA,IAAA,CAAK,YAAY,OAAQ,CAAA,SAAA,CAAA;AACzB,IAAA,IAAA,CAAK,OAAO,OAAQ,CAAA,IAAA,CAAA;AAAA,GACtB;AAAA,EAEA,MAAM,eAAA,CACJ,QACA,EAAA,WAAA,EACA,SACyC,EAAA;AACzC,IAAA,MAAM,OAAU,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,QAAQ,CAAA,CAAA;AACxD,IAAM,MAAA,QAAA,GAAW,GAAG,OAAO,CAAA,mDAAA,CAAA,CAAA;AAE3B,IAAM,MAAA,KAAA,GAAQ,IAAK,CAAA,IAAA,CAAK,WAAY,CAAA,WAAA,EAAa,MAAM,CAAA,GACnD,KACA,CAAA,GAAA,MAAM,IAAK,CAAA,IAAA,CACR,qBAAsB,CAAA;AAAA,MACrB,UAAY,EAAA,WAAA;AAAA,MACZ,cAAgB,EAAA,QAAA;AAAA,KACjB,CAAA,CACA,IAAK,CAAA,CAAA,CAAA,KAAK,EAAE,KAAK,CAAA,CAAA;AAExB,IAAM,MAAA,QAAA,GAAW,MAAMC,sBAAA,CAAM,QAAU,EAAA;AAAA,MACrC,MAAQ,EAAA,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,SAAU,CAAA;AAAA,QACnB,OAAO,SAAU,CAAA,GAAA;AAAA,UACf,CAAC,EAAE,EAAA,EAAI,WAAa,EAAA,YAAA,EAAc,YAAkB,MAAA;AAAA,YAClD,EAAA;AAAA,YACA,WAAA;AAAA,YACA,YAAA;AAAA,YACA,UAAA;AAAA,WACF,CAAA;AAAA,SACF;AAAA,OACD,CAAA;AAAA,MACD,OAAS,EAAA;AAAA,QACP,GAAI,QAAQ,EAAE,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA,KAAO,EAAC;AAAA,QACpD,cAAgB,EAAA,kBAAA;AAAA,OAClB;AAAA,KACD,CAAA,CAAA;AAED,IAAI,IAAA,CAAC,SAAS,EAAI,EAAA;AAChB,MAAM,MAAA,MAAMC,oBAAc,CAAA,YAAA,CAAa,QAAQ,CAAA,CAAA;AAAA,KACjD;AAEA,IAAA,MAAM,SAAS,cAAe,CAAA,KAAA,CAAM,MAAM,QAAA,CAAS,MAAM,CAAA,CAAA;AAEzD,IAAA,OAAO,MAAO,CAAA,KAAA,CAAA;AAAA,GAChB;AACF;;AC5CA,MAAM,gBAAA,GAAsDH,MAAE,MAAO,CAAA;AAAA,EACnE,MAAA,EAAQA,MACL,KAAM,CAAA;AAAA,IACLA,KAAA,CAAE,QAAQ,QAAQ,CAAA;AAAA,IAClBA,KAAA,CAAE,QAAQ,MAAM,CAAA;AAAA,IAChBA,KAAA,CAAE,QAAQ,QAAQ,CAAA;AAAA,IAClBA,KAAA,CAAE,QAAQ,QAAQ,CAAA;AAAA,GACnB,EACA,QAAS,EAAA;AACd,CAAC,CAAA,CAAA;AAED,MAAM,gBAAA,GAAmBA,MAAE,KAAM,CAAA;AAAA,EAC/BA,MAAE,MAAO,CAAA;AAAA,IACP,IAAA,EAAMA,KAAE,CAAA,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,IACf,UAAY,EAAA,gBAAA;AAAA,GACb,CAAA;AAAA,EACDA,MAAE,MAAO,CAAA;AAAA,IACP,IAAA,EAAMA,KAAE,CAAA,OAAA,CAAQ,UAAU,CAAA;AAAA,IAC1B,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,IACf,UAAY,EAAA,gBAAA;AAAA,IACZ,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,GACxB,CAAA;AACH,CAAC,CAAA,CAAA;AAED,MAAM,+BAAA,GAEFA,MAAE,MAAO,CAAA;AAAA,EACX,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,EACb,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,EACjC,UAAY,EAAA,gBAAA;AACd,CAAC,CAAA,CAAA;AAED,MAAM,oCAAA,GACJA,MAAE,MAAO,CAAA;AAAA,EACP,KAAA,EAAOA,KAAE,CAAA,KAAA,CAAM,+BAA+B,CAAA;AAChD,CAAC,CAAA,CAAA;AAoBH,MAAM,gBAAgB,OACpB,QAAA,EACA,QACA,2BACA,EAAA,WAAA,EAGA,MACA,QACuE,KAAA;AACvE,EAAM,MAAA,wBAAA,GAA2BI,cAAQ,CAAA,CAAC,QAAqB,KAAA;AAC7D,IAAA,OAAO,IAAIC,2BAAA;AAAA,MAGT,CACA,KAAA,KAAA,2BAAA,CAA4B,eAAgB,CAAA,QAAA,EAAU,aAAa,KAAK,CAAA;AAAA,KAC1E,CAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAI,IAAA,IAAA,CAAA;AACJ,EAAA,IAAI,IAAK,CAAA,WAAA,CAAY,WAAa,EAAA,MAAM,CAAG,EAAA;AACzC,IAAA,MAAM,IAAO,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,WAAW,CAAA,CAAA;AACnD,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,MACjD,UAAY,EAAA,WAAA;AAAA,MACZ,cAAgB,EAAA,SAAA;AAAA;AAAA,KACjB,CAAA,CAAA;AACD,IAAO,IAAA,GAAA;AAAA,MACL,QAAU,EAAA;AAAA,QACR,IAAM,EAAA,MAAA;AAAA,QACN,aAAA,EAAe,YAAY,SAAU,CAAA,aAAA;AAAA,QACrC,qBAAqB,IAAK,CAAA,mBAAA;AAAA,OAC5B;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAA,OAAO,OAAQ,CAAA,GAAA;AAAA,IACb,QAAS,CAAA,GAAA;AAAA,MAAI,CAAC,EAAE,EAAI,EAAA,WAAA,EAAa,GAAG,OAAA,EAClC,KAAA,MAAA,CAAO,MAAO,CAAA,OAAA,EAAS,IAAI,CAAA,CAAE,KAAK,CAAY,QAAA,KAAA;AAC5C,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,WAAa,EAAA;AACnD,UAAO,OAAA;AAAA,YACL,EAAA;AAAA,YACA,GAAG,QAAA;AAAA,WACL,CAAA;AAAA,SACF;AAEA,QAAA,IAAI,CAACK,2CAAA,CAAqB,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC7C,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,iFAAA,EAAoF,OAAQ,CAAA,UAAA,CAAW,IAAI,CAAA,CAAA;AAAA,WAC7G,CAAA;AAAA,SACF;AAEA,QAAA,IAAI,QAAS,CAAA,YAAA,KAAiB,OAAQ,CAAA,UAAA,CAAW,YAAc,EAAA;AAC7D,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,2EAAA,EAA8E,OAAQ,CAAA,UAAA,CAAW,IAAI,CAAA,CAAA;AAAA,WACvG,CAAA;AAAA,SACF;AAEA,QAAA,IAAI,CAAC,WAAa,EAAA;AAChB,UAAO,OAAA;AAAA,YACL,EAAA;AAAA,YACA,GAAG,QAAA;AAAA,WACL,CAAA;AAAA,SACF;AAEA,QAAA,OAAO,wBAAyB,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAE,IAAK,CAAA;AAAA,UACtD,EAAA;AAAA,UACA,WAAA;AAAA,UACA,GAAG,QAAA;AAAA,SACJ,CAAA,CAAA;AAAA,OACF,CAAA;AAAA,KACH;AAAA,GACF,CAAA;AACF,CAAA,CAAA;AASA,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAW,EAAA,MAAA,EAAQ,QAAW,GAAA,OAAA,CAAA;AAC9C,EAAA,MAAM,EAAE,IAAM,EAAA,QAAA,EAAU,QAAS,EAAA,GAAIC,uCAAyB,OAAO,CAAA,CAAA;AAErE,EAAA,IAAI,CAAC,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,CAAG,EAAA;AACpD,IAAO,MAAA,CAAA,IAAA;AAAA,MACL,8GAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAM,MAAA,2BAAA,GAA8B,IAAI,2BAA4B,CAAA;AAAA,IAClE,SAAA;AAAA,IACA,IAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAA,MAAM,SAASC,uBAAO,EAAA,CAAA;AACtB,EAAO,MAAA,CAAA,GAAA,CAAIC,wBAAQ,CAAA,IAAA,EAAM,CAAA,CAAA;AAEzB,EAAA,MAAA,CAAO,GAAI,CAAA,SAAA,EAAW,CAAC,CAAA,EAAG,QAAa,KAAA;AACrC,IAAA,QAAA,CAAS,IAAK,CAAA,EAAE,MAAQ,EAAA,IAAA,EAAM,CAAA,CAAA;AAAA,GAC/B,CAAA,CAAA;AAED,EAAO,MAAA,CAAA,IAAA;AAAA,IACL,YAAA;AAAA,IACA,OACE,KACA,GACG,KAAA;AACH,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAK,EAAA;AAAA,QAClD,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAM,CAAA;AAAA,OACvB,CAAA,CAAA;AAED,MAAA,MAAM,cAAc,oCAAqC,CAAA,SAAA;AAAA,QACvD,GAAI,CAAA,IAAA;AAAA,OACN,CAAA;AAEA,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIC,iBAAA,CAAW,WAAY,CAAA,KAAA,CAAM,UAAU,CAAA,CAAA;AAAA,OACnD;AAEA,MAAA,MAAM,OAAO,WAAY,CAAA,IAAA,CAAA;AAEzB,MAAA,GAAA,CAAI,IAAK,CAAA;AAAA,QACP,OAAO,MAAM,aAAA;AAAA,UACX,IAAK,CAAA,KAAA;AAAA,UACL,MAAA;AAAA,UACA,2BAAA;AAAA,UACA,WAAA;AAAA,UACA,IAAA;AAAA,UACA,QAAA;AAAA,SACF;AAAA,OACD,CAAA,CAAA;AAAA,KACH;AAAA,GACF,CAAA;AAEA,EAAO,MAAA,CAAA,GAAA,CAAIC,4BAAc,CAAA,CAAA;AAEzB,EAAO,OAAA,MAAA,CAAA;AACT;;;;"}