@backstage/plugin-permission-common 0.5.1 → 0.6.0-next.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @backstage/plugin-permission-common
 
+## 0.6.0-next.0
+
+### Minor Changes
+
+- 8012ac46a0: Add `resourceType` property to `PermissionCondition` type to allow matching them with `ResourcePermission` instances.
+- c98d271466: Refactor api types into more specific, decoupled names.
+
+  - **BREAKING:**
+    - Renamed `AuthorizeDecision` to `EvaluatePermissionResponse`
+    - Renamed `AuthorizeQuery` to `EvaluatePermissionRequest`
+    - Renamed `AuthorizeRequest` to `EvaluatePermissionRequestBatch`
+    - Renamed `AuthorizeResponse` to `EvaluatePermissionResponseBatch`
+    - Renamed `Identified` to `IdentifiedPermissionMessage`
+  - Add `PermissionMessageBatch` helper type
+  - Add `ConditionalPolicyDecision`, `DefinitivePolicyDecision`, and `PolicyDecision` types from `@backstage/plugin-permission-node`
+
+### Patch Changes
+
+- 8012ac46a0: Add `isPermission` helper method.
+- 95284162d6: - Add more specific `Permission` types.
+  - Add `createPermission` helper to infer the appropriate type for some permission input.
+  - Add `isResourcePermission` helper to refine Permissions to ResourcePermissions.
+
+## 0.5.3
+
+### Patch Changes
+
+- f24ef7864e: Minor typo fixes
+- Updated dependencies
+  - @backstage/config@1.0.0
+  - @backstage/errors@1.0.0
+
+## 0.5.2
+
+### Patch Changes
+
+- 79b9d8a861: Add api doc comments to `Permission` type properties.
+
 ## 0.5.1
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -37,6 +37,15 @@ var AuthorizeResult = /* @__PURE__ */ ((AuthorizeResult2) => {
   return AuthorizeResult2;
 })(AuthorizeResult || {});
 
+function isPermission(permission, comparedPermission) {
+  return permission.name === comparedPermission.name;
+}
+function isResourcePermission(permission, resourceType) {
+  if (!("resourceType" in permission)) {
+    return false;
+  }
+  return !resourceType || permission.resourceType === resourceType;
+}
 function isCreatePermission(permission) {
   return permission.attributes.action === "create";
 }
@@ -50,8 +59,29 @@ function isDeletePermission(permission) {
   return permission.attributes.action === "delete";
 }
 
+function createPermission({
+  name,
+  attributes,
+  resourceType
+}) {
+  if (resourceType) {
+    return {
+      type: "resource",
+      name,
+      attributes,
+      resourceType
+    };
+  }
+  return {
+    type: "basic",
+    name,
+    attributes
+  };
+}
+
 const permissionCriteriaSchema = zod.z.lazy(() => zod.z.object({
   rule: zod.z.string(),
+  resourceType: zod.z.string(),
   params: zod.z.array(zod.z.unknown())
 }).strict().or(zod.z.object({ anyOf: zod.z.array(permissionCriteriaSchema).nonempty() }).strict()).or(zod.z.object({ allOf: zod.z.array(permissionCriteriaSchema).nonempty() }).strict()).or(zod.z.object({ not: permissionCriteriaSchema }).strict()));
 const responseSchema = zod.z.object({
@@ -115,8 +145,11 @@ class PermissionClient {
 
 exports.AuthorizeResult = AuthorizeResult;
 exports.PermissionClient = PermissionClient;
+exports.createPermission = createPermission;
 exports.isCreatePermission = isCreatePermission;
 exports.isDeletePermission = isDeletePermission;
+exports.isPermission = isPermission;
 exports.isReadPermission = isReadPermission;
+exports.isResourcePermission = isResourcePermission;
 exports.isUpdatePermission = isUpdatePermission;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type Identified<T> = T & { id: string };\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * An individual authorization request for {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeQuery = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of authorization requests from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeRequest = {\n  items: Identified<AuthorizeQuery>[];\n};\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<TParams extends unknown[] = unknown[]> = {\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represnts a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represnts a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual authorization response from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeDecision =\n  | { result: AuthorizeResult.ALLOW | AuthorizeResult.DENY }\n  | {\n      result: AuthorizeResult.CONDITIONAL;\n      conditions: PermissionCriteria<PermissionCondition>;\n    };\n\n/**\n * A batch of authorization responses from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeResponse = {\n  items: Identified<AuthorizeDecision>[];\n};\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from '../types';\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  AuthorizeQuery,\n  AuthorizeDecision,\n  Identified,\n  PermissionCriteria,\n  PermissionCondition,\n  AuthorizeResponse,\n  AuthorizeRequest,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport {\n  PermissionAuthorizer,\n  AuthorizeRequestOptions,\n} from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst responseSchema = z.object({\n  items: z.array(\n    z\n      .object({\n        id: z.string(),\n        result: z\n          .literal(AuthorizeResult.ALLOW)\n          .or(z.literal(AuthorizeResult.DENY)),\n      })\n      .or(\n        z.object({\n          id: z.string(),\n          result: z.literal(AuthorizeResult.CONDITIONAL),\n          conditions: permissionCriteriaSchema,\n        }),\n      ),\n  ),\n});\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionAuthorizer {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * Request authorization from the permission-backend for the given set of permissions.\n   *\n   * Authorization requests check that a given Backstage user can perform a protected operation,\n   * potentially for a specific resource (such as a catalog entity). The Backstage identity token\n   * should be included in the `options` if available.\n   *\n   * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.\n   *\n   * The response will be either ALLOW or DENY when either the permission has no resourceType, or a\n   * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be\n   * returned if no resourceRef is provided in the request. Conditional responses are intended only\n   * for backends which have access to the data source for permissioned resources, so that filters\n   * can be applied when loading collections of resources.\n   * @public\n   */\n  async authorize(\n    queries: AuthorizeQuery[],\n    options?: AuthorizeRequestOptions,\n  ): Promise<AuthorizeDecision[]> {\n    // TODO(permissions): it would be great to provide some kind of typing guarantee that\n    // conditional responses will only ever be returned for requests containing a resourceType\n    // but no resourceRef. That way clients who aren't prepared to handle filtering according\n    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.\n\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n    }\n\n    const request: AuthorizeRequest = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n    this.assertValidResponse(request, responseBody);\n\n    const responsesById = responseBody.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, Identified<AuthorizeDecision>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n\n  private assertValidResponse(\n    request: AuthorizeRequest,\n    json: any,\n  ): asserts json is AuthorizeResponse {\n    const authorizedResponses = responseSchema.parse(json);\n    const responseIds = authorizedResponses.items.map(r => r.id);\n    const hasAllRequestIds = request.items.every(r =>\n      responseIds.includes(r.id),\n    );\n    if (!hasAllRequestIds) {\n      throw new Error(\n        'Unexpected authorization response from permission-backend',\n      );\n    }\n  }\n}\n"],"names":["z","uuid","fetch","ResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BY,oCAAA,qBAAL;AAIL,6BAAO;AAIP,8BAAQ;AAIR,oCAAc;AAZJ;AAAA;;4BCPuB,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;0BAOT,YAAwB;AACvD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;;ACV1C,MAAM,2BAEFA,MAAE,KAAK,MACTA,MACG,OAAO;AAAA,EACN,MAAMA,MAAE;AAAA,EACR,QAAQA,MAAE,MAAMA,MAAE;AAAA,GAEnB,SACA,GACCA,MACG,OAAO,EAAE,OAAOA,MAAE,MAAM,0BAA0B,cAClD,UAEJ,GACCA,MACG,OAAO,EAAE,OAAOA,MAAE,MAAM,0BAA0B,cAClD,UAEJ,GAAGA,MAAE,OAAO,EAAE,KAAK,4BAA4B;AAGpD,MAAM,iBAAiBA,MAAE,OAAO;AAAA,EAC9B,OAAOA,MAAE,MACPA,MACG,OAAO;AAAA,IACN,IAAIA,MAAE;AAAA,IACN,QAAQA,MACL,QAAQ,gBAAgB,OACxB,GAAGA,MAAE,QAAQ,gBAAgB;AAAA,KAEjC,GACCA,MAAE,OAAO;AAAA,IACP,IAAIA,MAAE;AAAA,IACN,QAAQA,MAAE,QAAQ,gBAAgB;AAAA,IAClC,YAAY;AAAA;AAAA;uBAUwC;AAAA,EAI5D,YAAY,SAAsD;AAtFpE;AAuFI,SAAK,YAAY,QAAQ;AACzB,SAAK,UACH,cAAQ,OAAO,mBAAmB,0BAAlC,YAA2D;AAAA;AAAA,QAmBzD,UACJ,SACA,SAC8B;AAM9B,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,QAAQ,IAAI,UAAQ,QAAQ,gBAAgB;AAAA;AAGrD,UAAM,UAA4B;AAAA,MAChC,OAAO,QAAQ,IAAI;AAAU,QAC3B,IAAIC,gBAAK;AAAA,WACN;AAAA;AAAA;AAIP,UAAM,gBAAgB,MAAM,KAAK,UAAU,WAAW;AACtD,UAAM,WAAW,MAAMC,0BAAM,GAAG,2BAA2B;AAAA,MACzD,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,WACJ,KAAK,uBAAuB,mCAAS;AAAA,QACxC,gBAAgB;AAAA;AAAA;AAGpB,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAMC,qBAAc,aAAa;AAAA;AAGzC,UAAM,eAAe,MAAM,SAAS;AACpC,SAAK,oBAAoB,SAAS;AAElC,UAAM,gBAAgB,aAAa,MAAM,OAAO,CAAC,KAAK,MAAM;AAC1D,UAAI,EAAE,MAAM;AACZ,aAAO;AAAA,OACN;AAEH,WAAO,QAAQ,MAAM,IAAI,WAAS,cAAc,MAAM;AAAA;AAAA,EAGhD,uBAAuB,OAAwC;AACrE,WAAO,QAAQ,EAAE,eAAe,UAAU,YAAY;AAAA;AAAA,EAGhD,oBACN,SACA,MACmC;AACnC,UAAM,sBAAsB,eAAe,MAAM;AACjD,UAAM,cAAc,oBAAoB,MAAM,IAAI,OAAK,EAAE;AACzD,UAAM,mBAAmB,QAAQ,MAAM,MAAM,OAC3C,YAAY,SAAS,EAAE;AAEzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MACR;AAAA;AAAA;AAAA;;;;;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/permissions/createPermission.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type IdentifiedPermissionMessage<T> = T & { id: string };\n\n/**\n * A batch of request or response items.\n * @public\n */\nexport type PermissionMessageBatch<T> = {\n  items: IdentifiedPermissionMessage<T>[];\n};\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * A definitive decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy unconditionally allows (or denies) the request.\n *\n * @public\n */\nexport type DefinitivePolicyDecision = {\n  result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;\n};\n\n/**\n * A conditional decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy allows authorization for the request, given that the returned\n * conditions hold when evaluated. The conditions will be evaluated by the corresponding plugin\n * which knows about the referenced permission rules.\n *\n * @public\n */\nexport type ConditionalPolicyDecision = {\n  result: AuthorizeResult.CONDITIONAL;\n  pluginId: string;\n  resourceType: string;\n  conditions: PermissionCriteria<PermissionCondition>;\n};\n\n/**\n * A decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @public\n */\nexport type PolicyDecision =\n  | DefinitivePolicyDecision\n  | ConditionalPolicyDecision;\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<\n  TResourceType extends string = string,\n  TParams extends unknown[] = unknown[],\n> = {\n  resourceType: TResourceType;\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represents a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual request sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequest = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of requests sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequestBatch =\n  PermissionMessageBatch<EvaluatePermissionRequest>;\n\n/**\n * An individual response from the permission backend.\n *\n * @remarks\n *\n * This response type is an alias of {@link PolicyDecision} to maintain separation between the\n * {@link @backstage/plugin-permission-node#PermissionPolicy} interface and the permission backend\n * api. They may diverge at some point in the future. The response\n *\n * @public\n */\nexport type EvaluatePermissionResponse = PolicyDecision;\n\n/**\n * A batch of responses from the permission backend.\n * @public\n */\nexport type EvaluatePermissionResponseBatch =\n  PermissionMessageBatch<EvaluatePermissionResponse>;\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission, ResourcePermission } from '../types';\n\n/**\n * Check if the two parameters are equivalent permissions.\n * @public\n */\nexport function isPermission<T extends Permission>(\n  permission: Permission,\n  comparedPermission: T,\n): permission is T {\n  return permission.name === comparedPermission.name;\n}\n\n/**\n * Check if a given permission is a {@link ResourcePermission}. When\n * `resourceType` is supplied as the second parameter, also checks if\n * the permission has the specified resource type.\n * @public\n */\nexport function isResourcePermission<T extends string = string>(\n  permission: Permission,\n  resourceType?: T,\n): permission is ResourcePermission<T> {\n  if (!('resourceType' in permission)) {\n    return false;\n  }\n\n  return !resourceType || permission.resourceType === resourceType;\n}\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n","/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BasicPermission,\n  Permission,\n  PermissionAttributes,\n  ResourcePermission,\n} from '../types';\n\n/**\n * Utility function for creating a valid {@link ResourcePermission}, inferring\n * the appropriate type and resource type parameter.\n *\n * @public\n */\nexport function createPermission<TResourceType extends string>(input: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType: TResourceType;\n}): ResourcePermission<TResourceType>;\n/**\n * Utility function for creating a valid {@link BasicPermission}.\n *\n * @public\n */\nexport function createPermission(input: {\n  name: string;\n  attributes: PermissionAttributes;\n}): BasicPermission;\nexport function createPermission({\n  name,\n  attributes,\n  resourceType,\n}: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType?: string;\n}): Permission {\n  if (resourceType) {\n    return {\n      type: 'resource',\n      name,\n      attributes,\n      resourceType,\n    };\n  }\n\n  return {\n    type: 'basic',\n    name,\n    attributes,\n  };\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  EvaluatePermissionRequest,\n  EvaluatePermissionResponse,\n  IdentifiedPermissionMessage,\n  PermissionCriteria,\n  PermissionCondition,\n  EvaluatePermissionResponseBatch,\n  EvaluatePermissionRequestBatch,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport {\n  PermissionAuthorizer,\n  AuthorizeRequestOptions,\n} from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      resourceType: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst responseSchema = z.object({\n  items: z.array(\n    z\n      .object({\n        id: z.string(),\n        result: z\n          .literal(AuthorizeResult.ALLOW)\n          .or(z.literal(AuthorizeResult.DENY)),\n      })\n      .or(\n        z.object({\n          id: z.string(),\n          result: z.literal(AuthorizeResult.CONDITIONAL),\n          conditions: permissionCriteriaSchema,\n        }),\n      ),\n  ),\n});\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionAuthorizer {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * Request authorization from the permission-backend for the given set of permissions.\n   *\n   * Authorization requests check that a given Backstage user can perform a protected operation,\n   * potentially for a specific resource (such as a catalog entity). The Backstage identity token\n   * should be included in the `options` if available.\n   *\n   * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.\n   *\n   * The response will be either ALLOW or DENY when either the permission has no resourceType, or a\n   * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be\n   * returned if no resourceRef is provided in the request. Conditional responses are intended only\n   * for backends which have access to the data source for permissioned resources, so that filters\n   * can be applied when loading collections of resources.\n   * @public\n   */\n  async authorize(\n    queries: EvaluatePermissionRequest[],\n    options?: AuthorizeRequestOptions,\n  ): Promise<EvaluatePermissionResponse[]> {\n    // TODO(permissions): it would be great to provide some kind of typing guarantee that\n    // conditional responses will only ever be returned for requests containing a resourceType\n    // but no resourceRef. That way clients who aren't prepared to handle filtering according\n    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.\n\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n    }\n\n    const request: EvaluatePermissionRequestBatch = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n    this.assertValidResponse(request, responseBody);\n\n    const responsesById = responseBody.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, IdentifiedPermissionMessage<EvaluatePermissionResponse>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n\n  private assertValidResponse(\n    request: EvaluatePermissionRequestBatch,\n    json: any,\n  ): asserts json is EvaluatePermissionResponseBatch {\n    const authorizedResponses = responseSchema.parse(json);\n    const responseIds = authorizedResponses.items.map(r => r.id);\n    const hasAllRequestIds = request.items.every(r =>\n      responseIds.includes(r.id),\n    );\n    if (!hasAllRequestIds) {\n      throw new Error(\n        'Unexpected authorization response from permission-backend',\n      );\n    }\n  }\n}\n"],"names":["z","uuid","fetch","ResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCY,IAAA,eAAA,qBAAA,gBAAL,KAAA;AAIL,EAAO,gBAAA,CAAA,MAAA,CAAA,GAAA,MAAA,CAAA;AAIP,EAAQ,gBAAA,CAAA,OAAA,CAAA,GAAA,OAAA,CAAA;AAIR,EAAc,gBAAA,CAAA,aAAA,CAAA,GAAA,aAAA,CAAA;AAZJ,EAAA,OAAA,gBAAA,CAAA;AAAA,CAAA,EAAA,eAAA,IAAA,EAAA;;ACfL,SAAA,YAAA,CACL,YACA,kBACiB,EAAA;AACjB,EAAO,OAAA,UAAA,CAAW,SAAS,kBAAmB,CAAA,IAAA,CAAA;AAChD,CAAA;AAQO,SAAA,oBAAA,CACL,YACA,YACqC,EAAA;AACrC,EAAI,IAAA,oBAAoB,UAAa,CAAA,EAAA;AACnC,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AAEA,EAAO,OAAA,CAAC,YAAgB,IAAA,UAAA,CAAW,YAAiB,KAAA,YAAA,CAAA;AACtD,CAAA;AAMO,SAAA,kBAAA,CAA4B,UAAwB,EAAA;AACzD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,QAAA,CAAA;AAC1C,CAAA;AAMO,SAAA,gBAAA,CAA0B,UAAwB,EAAA;AACvD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,MAAA,CAAA;AAC1C,CAAA;AAMO,SAAA,kBAAA,CAA4B,UAAwB,EAAA;AACzD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,QAAA,CAAA;AAC1C,CAAA;AAMO,SAAA,kBAAA,CAA4B,UAAwB,EAAA;AACzD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,QAAA,CAAA;AAC1C;;ACjCiC,SAAA,gBAAA,CAAA;AAAA,EAC/B,IAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,CAKa,EAAA;AACb,EAAA,IAAI,YAAc,EAAA;AAChB,IAAO,OAAA;AAAA,MACL,IAAM,EAAA,UAAA;AAAA,MACN,IAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAO,OAAA;AAAA,IACL,IAAM,EAAA,OAAA;AAAA,IACN,IAAA;AAAA,IACA,UAAA;AAAA,GACF,CAAA;AACF;;AC7BA,MAAM,wBAEF,GAAAA,KAAA,CAAE,IAAK,CAAA,MACTA,MACG,MAAO,CAAA;AAAA,EACN,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,EACf,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,EACvB,MAAQ,EAAAA,KAAA,CAAE,KAAM,CAAAA,KAAA,CAAE,SAAS,CAAA;AAC7B,CAAC,CAAA,CACA,QACA,CAAA,EAAA,CACCA,MACG,MAAO,CAAA,EAAE,OAAOA,KAAE,CAAA,KAAA,CAAM,wBAAwB,CAAE,CAAA,QAAA,IAAY,CAAA,CAC9D,QACL,CAAA,CACC,GACCA,KACG,CAAA,MAAA,CAAO,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,UAAW,EAAC,EAC9D,MAAO,EACZ,EACC,EAAG,CAAAA,KAAA,CAAE,OAAO,EAAE,GAAA,EAAK,0BAA0B,CAAA,CAAE,MAAO,EAAC,CAC5D,CAAA,CAAA;AAEA,MAAM,cAAA,GAAiBA,MAAE,MAAO,CAAA;AAAA,EAC9B,KAAO,EAAAA,KAAA,CAAE,KACP,CAAAA,KAAA,CACG,MAAO,CAAA;AAAA,IACN,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,IACb,MAAA,EAAQA,KACL,CAAA,OAAA,CAAQ,eAAgB,CAAA,KAAK,CAC7B,CAAA,EAAA,CAAGA,KAAE,CAAA,OAAA,CAAQ,eAAgB,CAAA,IAAI,CAAC,CAAA;AAAA,GACtC,CAAA,CACA,EACC,CAAAA,KAAA,CAAE,MAAO,CAAA;AAAA,IACP,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,IACb,MAAQ,EAAAA,KAAA,CAAE,OAAQ,CAAA,eAAA,CAAgB,WAAW,CAAA;AAAA,IAC7C,UAAY,EAAA,wBAAA;AAAA,GACb,CACH,CACJ,CAAA;AACF,CAAC,CAAA,CAAA;AAMM,MAAM,gBAAiD,CAAA;AAAA,EAI5D,YAAY,OAAsD,EAAA;AAvFpE,IAAA,IAAA,EAAA,CAAA;AAwFI,IAAA,IAAA,CAAK,YAAY,OAAQ,CAAA,SAAA,CAAA;AACzB,IAAA,IAAA,CAAK,UACH,CAAQ,EAAA,GAAA,OAAA,CAAA,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,MAAtD,IAA2D,GAAA,EAAA,GAAA,KAAA,CAAA;AAAA,GAC/D;AAAA,EAkBM,MAAA,SAAA,CACJ,SACA,OACuC,EAAA;AAMvC,IAAI,IAAA,CAAC,KAAK,OAAS,EAAA;AACjB,MAAA,OAAO,QAAQ,GAAI,CAAA,CAAA,CAAA,QAAQ,MAAQ,EAAA,eAAA,CAAgB,OAAQ,CAAA,CAAA,CAAA;AAAA,KAC7D;AAEA,IAAA,MAAM,OAA0C,GAAA;AAAA,MAC9C,KAAA,EAAO,OAAQ,CAAA,GAAA,CAAI,CAAU,KAAA,MAAA;AAAA,QAC3B,EAAA,EAAIC,gBAAK,EAAG,EAAA;AAAA,QACT,GAAA,KAAA;AAAA,OACH,CAAA,CAAA;AAAA,KACJ,CAAA;AAEA,IAAA,MAAM,aAAgB,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,YAAY,CAAA,CAAA;AAClE,IAAA,MAAM,QAAW,GAAA,MAAMC,yBAAM,CAAA,CAAA,EAAG,aAA2B,CAAA,UAAA,CAAA,EAAA;AAAA,MACzD,MAAQ,EAAA,MAAA;AAAA,MACR,IAAA,EAAM,IAAK,CAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MAC5B,OAAS,EAAA;AAAA,QACJ,GAAA,IAAA,CAAK,sBAAuB,CAAA,OAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,OAAA,CAAS,KAAK,CAAA;AAAA,QAC7C,cAAgB,EAAA,kBAAA;AAAA,OAClB;AAAA,KACD,CAAA,CAAA;AACD,IAAI,IAAA,CAAC,SAAS,EAAI,EAAA;AAChB,MAAM,MAAA,MAAMC,oBAAc,CAAA,YAAA,CAAa,QAAQ,CAAA,CAAA;AAAA,KACjD;AAEA,IAAM,MAAA,YAAA,GAAe,MAAM,QAAA,CAAS,IAAK,EAAA,CAAA;AACzC,IAAK,IAAA,CAAA,mBAAA,CAAoB,SAAS,YAAY,CAAA,CAAA;AAE9C,IAAA,MAAM,gBAAgB,YAAa,CAAA,KAAA,CAAM,MAAO,CAAA,CAAC,KAAK,CAAM,KAAA;AAC1D,MAAA,GAAA,CAAI,EAAE,EAAM,CAAA,GAAA,CAAA,CAAA;AACZ,MAAO,OAAA,GAAA,CAAA;AAAA,KACT,EAAG,EAA6E,CAAA,CAAA;AAEhF,IAAA,OAAO,QAAQ,KAAM,CAAA,GAAA,CAAI,CAAS,KAAA,KAAA,aAAA,CAAc,MAAM,EAAG,CAAA,CAAA,CAAA;AAAA,GAC3D;AAAA,EAEQ,uBAAuB,KAAwC,EAAA;AACrE,IAAA,OAAO,QAAQ,EAAE,aAAA,EAAe,CAAU,OAAA,EAAA,KAAA,CAAA,CAAA,KAAY,EAAC,CAAA;AAAA,GACzD;AAAA,EAEQ,mBAAA,CACN,SACA,IACiD,EAAA;AACjD,IAAM,MAAA,mBAAA,GAAsB,cAAe,CAAA,KAAA,CAAM,IAAI,CAAA,CAAA;AACrD,IAAA,MAAM,cAAc,mBAAoB,CAAA,KAAA,CAAM,GAAI,CAAA,CAAA,CAAA,KAAK,EAAE,EAAE,CAAA,CAAA;AAC3D,IAAM,MAAA,gBAAA,GAAmB,QAAQ,KAAM,CAAA,KAAA,CAAM,OAC3C,WAAY,CAAA,QAAA,CAAS,CAAE,CAAA,EAAE,CAC3B,CAAA,CAAA;AACA,IAAA,IAAI,CAAC,gBAAkB,EAAA;AACrB,MAAM,MAAA,IAAI,MACR,2DACF,CAAA,CAAA;AAAA,KACF;AAAA,GACF;AACF;;;;;;;;;;;;"}

package/dist/index.d.ts

@@ -8,9 +8,35 @@ import { Config } from '@backstage/config';
 declare type PermissionAttributes = {
     action?: 'create' | 'read' | 'update' | 'delete';
 };
+/**
+ * Generic type for building {@link Permission} types.
+ * @public
+ */
+declare type PermissionBase<TType extends string, TFields extends object> = {
+    /**
+     * The name of the permission.
+     */
+    name: string;
+    /**
+     * {@link PermissionAttributes} which describe characteristics of the permission, to help
+     * policy authors make consistent decisions for similar permissions without referring to them
+     * all by name.
+     */
+    attributes: PermissionAttributes;
+} & {
+    /**
+     * String value indicating the type of the permission (e.g. 'basic',
+     * 'resource'). The allowed authorization flows in the permission system
+     * depend on the type. For example, a `resourceRef` should only be provided
+     * when authorizing permissions of type 'resource'.
+     */
+    type: TType;
+} & TFields;
 /**
  * A permission that can be checked through authorization.
  *
+ * @remarks
+ *
  * Permissions are the "what" part of authorization, the action to be performed. This may be reading
  * an entity from the catalog, executing a software template, or any other action a plugin author
  * may wish to protect.
@@ -19,17 +45,30 @@ declare type PermissionAttributes = {
  * evaluated using an authorization policy.
  * @public
  */
-declare type Permission = {
-    name: string;
-    attributes: PermissionAttributes;
-    resourceType?: string;
-};
+declare type Permission = BasicPermission | ResourcePermission;
+/**
+ * A standard {@link Permission} with no additional capabilities or restrictions.
+ * @public
+ */
+declare type BasicPermission = PermissionBase<'basic', {}>;
+/**
+ * ResourcePermissions are {@link Permission}s that can be authorized based on
+ * characteristics of a resource such a catalog entity.
+ * @public
+ */
+declare type ResourcePermission<TResourceType extends string = string> = PermissionBase<'resource', {
+    /**
+     * Denotes the type of the resource whose resourceRef should be passed when
+     * authorizing.
+     */
+    resourceType: TResourceType;
+}>;
 /**
  * A client interacting with the permission backend can implement this authorizer interface.
  * @public
  */
 interface PermissionAuthorizer {
-    authorize(queries: AuthorizeQuery[], options?: AuthorizeRequestOptions): Promise<AuthorizeDecision[]>;
+    authorize(requests: EvaluatePermissionRequest[], options?: AuthorizeRequestOptions): Promise<EvaluatePermissionResponse[]>;
 }
 /**
  * Options for authorization requests.
@@ -44,9 +83,16 @@ declare type AuthorizeRequestOptions = {
  * requests.
  * @public
  */
-declare type Identified<T> = T & {
+declare type IdentifiedPermissionMessage<T> = T & {
     id: string;
 };
+/**
+ * A batch of request or response items.
+ * @public
+ */
+declare type PermissionMessageBatch<T> = {
+    items: IdentifiedPermissionMessage<T>[];
+};
 /**
  * The result of an authorization request.
  * @public
@@ -66,20 +112,40 @@ declare enum AuthorizeResult {
     CONDITIONAL = "CONDITIONAL"
 }
 /**
- * An individual authorization request for {@link PermissionClient#authorize}.
+ * A definitive decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.
+ *
+ * @remarks
+ *
+ * This indicates that the policy unconditionally allows (or denies) the request.
+ *
  * @public
  */
-declare type AuthorizeQuery = {
-    permission: Permission;
-    resourceRef?: string;
+declare type DefinitivePolicyDecision = {
+    result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
 };
 /**
- * A batch of authorization requests from {@link PermissionClient#authorize}.
+ * A conditional decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.
+ *
+ * @remarks
+ *
+ * This indicates that the policy allows authorization for the request, given that the returned
+ * conditions hold when evaluated. The conditions will be evaluated by the corresponding plugin
+ * which knows about the referenced permission rules.
+ *
  * @public
  */
-declare type AuthorizeRequest = {
-    items: Identified<AuthorizeQuery>[];
+declare type ConditionalPolicyDecision = {
+    result: AuthorizeResult.CONDITIONAL;
+    pluginId: string;
+    resourceType: string;
+    conditions: PermissionCriteria<PermissionCondition>;
 };
+/**
+ * A decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.
+ *
+ * @public
+ */
+declare type PolicyDecision = DefinitivePolicyDecision | ConditionalPolicyDecision;
 /**
  * A condition returned with a CONDITIONAL authorization response.
  *
@@ -88,7 +154,8 @@ declare type AuthorizeRequest = {
  * claims from a identity token.
  * @public
  */
-declare type PermissionCondition<TParams extends unknown[] = unknown[]> = {
+declare type PermissionCondition<TResourceType extends string = string, TParams extends unknown[] = unknown[]> = {
+    resourceType: TResourceType;
     rule: string;
     params: TParams;
 };
@@ -98,14 +165,14 @@ declare type PermissionCondition<TParams extends unknown[] = unknown[]> = {
  */
 declare type NonEmptyArray<T> = [T, ...T[]];
 /**
- * Represnts a logical AND for the provided criteria.
+ * Represents a logical AND for the provided criteria.
  * @public
  */
 declare type AllOfCriteria<TQuery> = {
     allOf: NonEmptyArray<PermissionCriteria<TQuery>>;
 };
 /**
- * Represnts a logical OR for the provided criteria.
+ * Represents a logical OR for the provided criteria.
  * @public
  */
 declare type AnyOfCriteria<TQuery> = {
@@ -124,22 +191,35 @@ declare type NotCriteria<TQuery> = {
  */
 declare type PermissionCriteria<TQuery> = AllOfCriteria<TQuery> | AnyOfCriteria<TQuery> | NotCriteria<TQuery> | TQuery;
 /**
- * An individual authorization response from {@link PermissionClient#authorize}.
+ * An individual request sent to the permission backend.
  * @public
  */
-declare type AuthorizeDecision = {
-    result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
-} | {
-    result: AuthorizeResult.CONDITIONAL;
-    conditions: PermissionCriteria<PermissionCondition>;
+declare type EvaluatePermissionRequest = {
+    permission: Permission;
+    resourceRef?: string;
 };
 /**
- * A batch of authorization responses from {@link PermissionClient#authorize}.
+ * A batch of requests sent to the permission backend.
  * @public
  */
-declare type AuthorizeResponse = {
-    items: Identified<AuthorizeDecision>[];
-};
+declare type EvaluatePermissionRequestBatch = PermissionMessageBatch<EvaluatePermissionRequest>;
+/**
+ * An individual response from the permission backend.
+ *
+ * @remarks
+ *
+ * This response type is an alias of {@link PolicyDecision} to maintain separation between the
+ * {@link @backstage/plugin-permission-node#PermissionPolicy} interface and the permission backend
+ * api. They may diverge at some point in the future. The response
+ *
+ * @public
+ */
+declare type EvaluatePermissionResponse = PolicyDecision;
+/**
+ * A batch of responses from the permission backend.
+ * @public
+ */
+declare type EvaluatePermissionResponseBatch = PermissionMessageBatch<EvaluatePermissionResponse>;
 
 /**
  * This is a copy of the core DiscoveryApi, to avoid importing core.
@@ -150,6 +230,18 @@ declare type DiscoveryApi = {
     getBaseUrl(pluginId: string): Promise<string>;
 };
 
+/**
+ * Check if the two parameters are equivalent permissions.
+ * @public
+ */
+declare function isPermission<T extends Permission>(permission: Permission, comparedPermission: T): permission is T;
+/**
+ * Check if a given permission is a {@link ResourcePermission}. When
+ * `resourceType` is supplied as the second parameter, also checks if
+ * the permission has the specified resource type.
+ * @public
+ */
+declare function isResourcePermission<T extends string = string>(permission: Permission, resourceType?: T): permission is ResourcePermission<T>;
 /**
  * Check if a given permission is related to a create action.
  * @public
@@ -171,6 +263,27 @@ declare function isUpdatePermission(permission: Permission): boolean;
  */
 declare function isDeletePermission(permission: Permission): boolean;
 
+/**
+ * Utility function for creating a valid {@link ResourcePermission}, inferring
+ * the appropriate type and resource type parameter.
+ *
+ * @public
+ */
+declare function createPermission<TResourceType extends string>(input: {
+    name: string;
+    attributes: PermissionAttributes;
+    resourceType: TResourceType;
+}): ResourcePermission<TResourceType>;
+/**
+ * Utility function for creating a valid {@link BasicPermission}.
+ *
+ * @public
+ */
+declare function createPermission(input: {
+    name: string;
+    attributes: PermissionAttributes;
+}): BasicPermission;
+
 /**
  * An isomorphic client for requesting authorization for Backstage permissions.
  * @public
@@ -198,9 +311,9 @@ declare class PermissionClient implements PermissionAuthorizer {
      * can be applied when loading collections of resources.
      * @public
      */
-    authorize(queries: AuthorizeQuery[], options?: AuthorizeRequestOptions): Promise<AuthorizeDecision[]>;
+    authorize(queries: EvaluatePermissionRequest[], options?: AuthorizeRequestOptions): Promise<EvaluatePermissionResponse[]>;
     private getAuthorizationHeader;
     private assertValidResponse;
 }
 
-export { AllOfCriteria, AnyOfCriteria, AuthorizeDecision, AuthorizeQuery, AuthorizeRequest, AuthorizeRequestOptions, AuthorizeResponse, AuthorizeResult, DiscoveryApi, Identified, NotCriteria, Permission, PermissionAttributes, PermissionAuthorizer, PermissionClient, PermissionCondition, PermissionCriteria, isCreatePermission, isDeletePermission, isReadPermission, isUpdatePermission };
+export { AllOfCriteria, AnyOfCriteria, AuthorizeRequestOptions, AuthorizeResult, BasicPermission, ConditionalPolicyDecision, DefinitivePolicyDecision, DiscoveryApi, EvaluatePermissionRequest, EvaluatePermissionRequestBatch, EvaluatePermissionResponse, EvaluatePermissionResponseBatch, IdentifiedPermissionMessage, NotCriteria, Permission, PermissionAttributes, PermissionAuthorizer, PermissionBase, PermissionClient, PermissionCondition, PermissionCriteria, PermissionMessageBatch, PolicyDecision, ResourcePermission, createPermission, isCreatePermission, isDeletePermission, isPermission, isReadPermission, isResourcePermission, isUpdatePermission };

package/dist/index.esm.js

@@ -10,6 +10,15 @@ var AuthorizeResult = /* @__PURE__ */ ((AuthorizeResult2) => {
   return AuthorizeResult2;
 })(AuthorizeResult || {});
 
+function isPermission(permission, comparedPermission) {
+  return permission.name === comparedPermission.name;
+}
+function isResourcePermission(permission, resourceType) {
+  if (!("resourceType" in permission)) {
+    return false;
+  }
+  return !resourceType || permission.resourceType === resourceType;
+}
 function isCreatePermission(permission) {
   return permission.attributes.action === "create";
 }
@@ -23,8 +32,29 @@ function isDeletePermission(permission) {
   return permission.attributes.action === "delete";
 }
 
+function createPermission({
+  name,
+  attributes,
+  resourceType
+}) {
+  if (resourceType) {
+    return {
+      type: "resource",
+      name,
+      attributes,
+      resourceType
+    };
+  }
+  return {
+    type: "basic",
+    name,
+    attributes
+  };
+}
+
 const permissionCriteriaSchema = z.lazy(() => z.object({
   rule: z.string(),
+  resourceType: z.string(),
   params: z.array(z.unknown())
 }).strict().or(z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }).strict()).or(z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }).strict()).or(z.object({ not: permissionCriteriaSchema }).strict()));
 const responseSchema = z.object({
@@ -86,5 +116,5 @@ class PermissionClient {
   }
 }
 
-export { AuthorizeResult, PermissionClient, isCreatePermission, isDeletePermission, isReadPermission, isUpdatePermission };
+export { AuthorizeResult, PermissionClient, createPermission, isCreatePermission, isDeletePermission, isPermission, isReadPermission, isResourcePermission, isUpdatePermission };
 //# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type Identified<T> = T & { id: string };\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * An individual authorization request for {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeQuery = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of authorization requests from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeRequest = {\n  items: Identified<AuthorizeQuery>[];\n};\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<TParams extends unknown[] = unknown[]> = {\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represnts a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represnts a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual authorization response from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeDecision =\n  | { result: AuthorizeResult.ALLOW | AuthorizeResult.DENY }\n  | {\n      result: AuthorizeResult.CONDITIONAL;\n      conditions: PermissionCriteria<PermissionCondition>;\n    };\n\n/**\n * A batch of authorization responses from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeResponse = {\n  items: Identified<AuthorizeDecision>[];\n};\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from '../types';\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  AuthorizeQuery,\n  AuthorizeDecision,\n  Identified,\n  PermissionCriteria,\n  PermissionCondition,\n  AuthorizeResponse,\n  AuthorizeRequest,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport {\n  PermissionAuthorizer,\n  AuthorizeRequestOptions,\n} from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst responseSchema = z.object({\n  items: z.array(\n    z\n      .object({\n        id: z.string(),\n        result: z\n          .literal(AuthorizeResult.ALLOW)\n          .or(z.literal(AuthorizeResult.DENY)),\n      })\n      .or(\n        z.object({\n          id: z.string(),\n          result: z.literal(AuthorizeResult.CONDITIONAL),\n          conditions: permissionCriteriaSchema,\n        }),\n      ),\n  ),\n});\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionAuthorizer {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * Request authorization from the permission-backend for the given set of permissions.\n   *\n   * Authorization requests check that a given Backstage user can perform a protected operation,\n   * potentially for a specific resource (such as a catalog entity). The Backstage identity token\n   * should be included in the `options` if available.\n   *\n   * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.\n   *\n   * The response will be either ALLOW or DENY when either the permission has no resourceType, or a\n   * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be\n   * returned if no resourceRef is provided in the request. Conditional responses are intended only\n   * for backends which have access to the data source for permissioned resources, so that filters\n   * can be applied when loading collections of resources.\n   * @public\n   */\n  async authorize(\n    queries: AuthorizeQuery[],\n    options?: AuthorizeRequestOptions,\n  ): Promise<AuthorizeDecision[]> {\n    // TODO(permissions): it would be great to provide some kind of typing guarantee that\n    // conditional responses will only ever be returned for requests containing a resourceType\n    // but no resourceRef. That way clients who aren't prepared to handle filtering according\n    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.\n\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n    }\n\n    const request: AuthorizeRequest = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n    this.assertValidResponse(request, responseBody);\n\n    const responsesById = responseBody.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, Identified<AuthorizeDecision>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n\n  private assertValidResponse(\n    request: AuthorizeRequest,\n    json: any,\n  ): asserts json is AuthorizeResponse {\n    const authorizedResponses = responseSchema.parse(json);\n    const responseIds = authorizedResponses.items.map(r => r.id);\n    const hasAllRequestIds = request.items.every(r =>\n      responseIds.includes(r.id),\n    );\n    if (!hasAllRequestIds) {\n      throw new Error(\n        'Unexpected authorization response from permission-backend',\n      );\n    }\n  }\n}\n"],"names":[],"mappings":";;;;;IA6BY,oCAAA,qBAAL;AAIL,6BAAO;AAIP,8BAAQ;AAIR,oCAAc;AAZJ;AAAA;;4BCPuB,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;0BAOT,YAAwB;AACvD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;;ACV1C,MAAM,2BAEF,EAAE,KAAK,MACT,EACG,OAAO;AAAA,EACN,MAAM,EAAE;AAAA,EACR,QAAQ,EAAE,MAAM,EAAE;AAAA,GAEnB,SACA,GACC,EACG,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,cAClD,UAEJ,GACC,EACG,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,cAClD,UAEJ,GAAG,EAAE,OAAO,EAAE,KAAK,4BAA4B;AAGpD,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MACP,EACG,OAAO;AAAA,IACN,IAAI,EAAE;AAAA,IACN,QAAQ,EACL,QAAQ,gBAAgB,OACxB,GAAG,EAAE,QAAQ,gBAAgB;AAAA,KAEjC,GACC,EAAE,OAAO;AAAA,IACP,IAAI,EAAE;AAAA,IACN,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,IAClC,YAAY;AAAA;AAAA;uBAUwC;AAAA,EAI5D,YAAY,SAAsD;AAtFpE;AAuFI,SAAK,YAAY,QAAQ;AACzB,SAAK,UACH,cAAQ,OAAO,mBAAmB,0BAAlC,YAA2D;AAAA;AAAA,QAmBzD,UACJ,SACA,SAC8B;AAM9B,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,QAAQ,IAAI,UAAQ,QAAQ,gBAAgB;AAAA;AAGrD,UAAM,UAA4B;AAAA,MAChC,OAAO,QAAQ,IAAI;AAAU,QAC3B,IAAI,KAAK;AAAA,WACN;AAAA;AAAA;AAIP,UAAM,gBAAgB,MAAM,KAAK,UAAU,WAAW;AACtD,UAAM,WAAW,MAAM,MAAM,GAAG,2BAA2B;AAAA,MACzD,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,WACJ,KAAK,uBAAuB,mCAAS;AAAA,QACxC,gBAAgB;AAAA;AAAA;AAGpB,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAM,cAAc,aAAa;AAAA;AAGzC,UAAM,eAAe,MAAM,SAAS;AACpC,SAAK,oBAAoB,SAAS;AAElC,UAAM,gBAAgB,aAAa,MAAM,OAAO,CAAC,KAAK,MAAM;AAC1D,UAAI,EAAE,MAAM;AACZ,aAAO;AAAA,OACN;AAEH,WAAO,QAAQ,MAAM,IAAI,WAAS,cAAc,MAAM;AAAA;AAAA,EAGhD,uBAAuB,OAAwC;AACrE,WAAO,QAAQ,EAAE,eAAe,UAAU,YAAY;AAAA;AAAA,EAGhD,oBACN,SACA,MACmC;AACnC,UAAM,sBAAsB,eAAe,MAAM;AACjD,UAAM,cAAc,oBAAoB,MAAM,IAAI,OAAK,EAAE;AACzD,UAAM,mBAAmB,QAAQ,MAAM,MAAM,OAC3C,YAAY,SAAS,EAAE;AAEzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MACR;AAAA;AAAA;AAAA;;;;"}
+{"version":3,"file":"index.esm.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/permissions/createPermission.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type IdentifiedPermissionMessage<T> = T & { id: string };\n\n/**\n * A batch of request or response items.\n * @public\n */\nexport type PermissionMessageBatch<T> = {\n  items: IdentifiedPermissionMessage<T>[];\n};\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * A definitive decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy unconditionally allows (or denies) the request.\n *\n * @public\n */\nexport type DefinitivePolicyDecision = {\n  result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;\n};\n\n/**\n * A conditional decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy allows authorization for the request, given that the returned\n * conditions hold when evaluated. The conditions will be evaluated by the corresponding plugin\n * which knows about the referenced permission rules.\n *\n * @public\n */\nexport type ConditionalPolicyDecision = {\n  result: AuthorizeResult.CONDITIONAL;\n  pluginId: string;\n  resourceType: string;\n  conditions: PermissionCriteria<PermissionCondition>;\n};\n\n/**\n * A decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @public\n */\nexport type PolicyDecision =\n  | DefinitivePolicyDecision\n  | ConditionalPolicyDecision;\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<\n  TResourceType extends string = string,\n  TParams extends unknown[] = unknown[],\n> = {\n  resourceType: TResourceType;\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represents a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual request sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequest = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of requests sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequestBatch =\n  PermissionMessageBatch<EvaluatePermissionRequest>;\n\n/**\n * An individual response from the permission backend.\n *\n * @remarks\n *\n * This response type is an alias of {@link PolicyDecision} to maintain separation between the\n * {@link @backstage/plugin-permission-node#PermissionPolicy} interface and the permission backend\n * api. They may diverge at some point in the future. The response\n *\n * @public\n */\nexport type EvaluatePermissionResponse = PolicyDecision;\n\n/**\n * A batch of responses from the permission backend.\n * @public\n */\nexport type EvaluatePermissionResponseBatch =\n  PermissionMessageBatch<EvaluatePermissionResponse>;\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission, ResourcePermission } from '../types';\n\n/**\n * Check if the two parameters are equivalent permissions.\n * @public\n */\nexport function isPermission<T extends Permission>(\n  permission: Permission,\n  comparedPermission: T,\n): permission is T {\n  return permission.name === comparedPermission.name;\n}\n\n/**\n * Check if a given permission is a {@link ResourcePermission}. When\n * `resourceType` is supplied as the second parameter, also checks if\n * the permission has the specified resource type.\n * @public\n */\nexport function isResourcePermission<T extends string = string>(\n  permission: Permission,\n  resourceType?: T,\n): permission is ResourcePermission<T> {\n  if (!('resourceType' in permission)) {\n    return false;\n  }\n\n  return !resourceType || permission.resourceType === resourceType;\n}\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n","/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BasicPermission,\n  Permission,\n  PermissionAttributes,\n  ResourcePermission,\n} from '../types';\n\n/**\n * Utility function for creating a valid {@link ResourcePermission}, inferring\n * the appropriate type and resource type parameter.\n *\n * @public\n */\nexport function createPermission<TResourceType extends string>(input: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType: TResourceType;\n}): ResourcePermission<TResourceType>;\n/**\n * Utility function for creating a valid {@link BasicPermission}.\n *\n * @public\n */\nexport function createPermission(input: {\n  name: string;\n  attributes: PermissionAttributes;\n}): BasicPermission;\nexport function createPermission({\n  name,\n  attributes,\n  resourceType,\n}: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType?: string;\n}): Permission {\n  if (resourceType) {\n    return {\n      type: 'resource',\n      name,\n      attributes,\n      resourceType,\n    };\n  }\n\n  return {\n    type: 'basic',\n    name,\n    attributes,\n  };\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  EvaluatePermissionRequest,\n  EvaluatePermissionResponse,\n  IdentifiedPermissionMessage,\n  PermissionCriteria,\n  PermissionCondition,\n  EvaluatePermissionResponseBatch,\n  EvaluatePermissionRequestBatch,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport {\n  PermissionAuthorizer,\n  AuthorizeRequestOptions,\n} from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      resourceType: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst responseSchema = z.object({\n  items: z.array(\n    z\n      .object({\n        id: z.string(),\n        result: z\n          .literal(AuthorizeResult.ALLOW)\n          .or(z.literal(AuthorizeResult.DENY)),\n      })\n      .or(\n        z.object({\n          id: z.string(),\n          result: z.literal(AuthorizeResult.CONDITIONAL),\n          conditions: permissionCriteriaSchema,\n        }),\n      ),\n  ),\n});\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionAuthorizer {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * Request authorization from the permission-backend for the given set of permissions.\n   *\n   * Authorization requests check that a given Backstage user can perform a protected operation,\n   * potentially for a specific resource (such as a catalog entity). The Backstage identity token\n   * should be included in the `options` if available.\n   *\n   * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.\n   *\n   * The response will be either ALLOW or DENY when either the permission has no resourceType, or a\n   * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be\n   * returned if no resourceRef is provided in the request. Conditional responses are intended only\n   * for backends which have access to the data source for permissioned resources, so that filters\n   * can be applied when loading collections of resources.\n   * @public\n   */\n  async authorize(\n    queries: EvaluatePermissionRequest[],\n    options?: AuthorizeRequestOptions,\n  ): Promise<EvaluatePermissionResponse[]> {\n    // TODO(permissions): it would be great to provide some kind of typing guarantee that\n    // conditional responses will only ever be returned for requests containing a resourceType\n    // but no resourceRef. That way clients who aren't prepared to handle filtering according\n    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.\n\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n    }\n\n    const request: EvaluatePermissionRequestBatch = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n    this.assertValidResponse(request, responseBody);\n\n    const responsesById = responseBody.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, IdentifiedPermissionMessage<EvaluatePermissionResponse>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n\n  private assertValidResponse(\n    request: EvaluatePermissionRequestBatch,\n    json: any,\n  ): asserts json is EvaluatePermissionResponseBatch {\n    const authorizedResponses = responseSchema.parse(json);\n    const responseIds = authorizedResponses.items.map(r => r.id);\n    const hasAllRequestIds = request.items.every(r =>\n      responseIds.includes(r.id),\n    );\n    if (!hasAllRequestIds) {\n      throw new Error(\n        'Unexpected authorization response from permission-backend',\n      );\n    }\n  }\n}\n"],"names":[],"mappings":";;;;;AAqCY,IAAA,eAAA,qBAAA,gBAAL,KAAA;AAIL,EAAO,gBAAA,CAAA,MAAA,CAAA,GAAA,MAAA,CAAA;AAIP,EAAQ,gBAAA,CAAA,OAAA,CAAA,GAAA,OAAA,CAAA;AAIR,EAAc,gBAAA,CAAA,aAAA,CAAA,GAAA,aAAA,CAAA;AAZJ,EAAA,OAAA,gBAAA,CAAA;AAAA,CAAA,EAAA,eAAA,IAAA,EAAA;;ACfL,SAAA,YAAA,CACL,YACA,kBACiB,EAAA;AACjB,EAAO,OAAA,UAAA,CAAW,SAAS,kBAAmB,CAAA,IAAA,CAAA;AAChD,CAAA;AAQO,SAAA,oBAAA,CACL,YACA,YACqC,EAAA;AACrC,EAAI,IAAA,oBAAoB,UAAa,CAAA,EAAA;AACnC,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AAEA,EAAO,OAAA,CAAC,YAAgB,IAAA,UAAA,CAAW,YAAiB,KAAA,YAAA,CAAA;AACtD,CAAA;AAMO,SAAA,kBAAA,CAA4B,UAAwB,EAAA;AACzD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,QAAA,CAAA;AAC1C,CAAA;AAMO,SAAA,gBAAA,CAA0B,UAAwB,EAAA;AACvD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,MAAA,CAAA;AAC1C,CAAA;AAMO,SAAA,kBAAA,CAA4B,UAAwB,EAAA;AACzD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,QAAA,CAAA;AAC1C,CAAA;AAMO,SAAA,kBAAA,CAA4B,UAAwB,EAAA;AACzD,EAAO,OAAA,UAAA,CAAW,WAAW,MAAW,KAAA,QAAA,CAAA;AAC1C;;ACjCiC,SAAA,gBAAA,CAAA;AAAA,EAC/B,IAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,CAKa,EAAA;AACb,EAAA,IAAI,YAAc,EAAA;AAChB,IAAO,OAAA;AAAA,MACL,IAAM,EAAA,UAAA;AAAA,MACN,IAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAO,OAAA;AAAA,IACL,IAAM,EAAA,OAAA;AAAA,IACN,IAAA;AAAA,IACA,UAAA;AAAA,GACF,CAAA;AACF;;AC7BA,MAAM,wBAEF,GAAA,CAAA,CAAE,IAAK,CAAA,MACT,EACG,MAAO,CAAA;AAAA,EACN,IAAA,EAAM,EAAE,MAAO,EAAA;AAAA,EACf,YAAA,EAAc,EAAE,MAAO,EAAA;AAAA,EACvB,MAAQ,EAAA,CAAA,CAAE,KAAM,CAAA,CAAA,CAAE,SAAS,CAAA;AAC7B,CAAC,CAAA,CACA,QACA,CAAA,EAAA,CACC,EACG,MAAO,CAAA,EAAE,OAAO,CAAE,CAAA,KAAA,CAAM,wBAAwB,CAAE,CAAA,QAAA,IAAY,CAAA,CAC9D,QACL,CAAA,CACC,GACC,CACG,CAAA,MAAA,CAAO,EAAE,KAAO,EAAA,CAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,UAAW,EAAC,EAC9D,MAAO,EACZ,EACC,EAAG,CAAA,CAAA,CAAE,OAAO,EAAE,GAAA,EAAK,0BAA0B,CAAA,CAAE,MAAO,EAAC,CAC5D,CAAA,CAAA;AAEA,MAAM,cAAA,GAAiB,EAAE,MAAO,CAAA;AAAA,EAC9B,KAAO,EAAA,CAAA,CAAE,KACP,CAAA,CAAA,CACG,MAAO,CAAA;AAAA,IACN,EAAA,EAAI,EAAE,MAAO,EAAA;AAAA,IACb,MAAA,EAAQ,CACL,CAAA,OAAA,CAAQ,eAAgB,CAAA,KAAK,CAC7B,CAAA,EAAA,CAAG,CAAE,CAAA,OAAA,CAAQ,eAAgB,CAAA,IAAI,CAAC,CAAA;AAAA,GACtC,CAAA,CACA,EACC,CAAA,CAAA,CAAE,MAAO,CAAA;AAAA,IACP,EAAA,EAAI,EAAE,MAAO,EAAA;AAAA,IACb,MAAQ,EAAA,CAAA,CAAE,OAAQ,CAAA,eAAA,CAAgB,WAAW,CAAA;AAAA,IAC7C,UAAY,EAAA,wBAAA;AAAA,GACb,CACH,CACJ,CAAA;AACF,CAAC,CAAA,CAAA;AAMM,MAAM,gBAAiD,CAAA;AAAA,EAI5D,YAAY,OAAsD,EAAA;AAvFpE,IAAA,IAAA,EAAA,CAAA;AAwFI,IAAA,IAAA,CAAK,YAAY,OAAQ,CAAA,SAAA,CAAA;AACzB,IAAA,IAAA,CAAK,UACH,CAAQ,EAAA,GAAA,OAAA,CAAA,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,MAAtD,IAA2D,GAAA,EAAA,GAAA,KAAA,CAAA;AAAA,GAC/D;AAAA,EAkBM,MAAA,SAAA,CACJ,SACA,OACuC,EAAA;AAMvC,IAAI,IAAA,CAAC,KAAK,OAAS,EAAA;AACjB,MAAA,OAAO,QAAQ,GAAI,CAAA,CAAA,CAAA,QAAQ,MAAQ,EAAA,eAAA,CAAgB,OAAQ,CAAA,CAAA,CAAA;AAAA,KAC7D;AAEA,IAAA,MAAM,OAA0C,GAAA;AAAA,MAC9C,KAAA,EAAO,OAAQ,CAAA,GAAA,CAAI,CAAU,KAAA,MAAA;AAAA,QAC3B,EAAA,EAAI,KAAK,EAAG,EAAA;AAAA,QACT,GAAA,KAAA;AAAA,OACH,CAAA,CAAA;AAAA,KACJ,CAAA;AAEA,IAAA,MAAM,aAAgB,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,YAAY,CAAA,CAAA;AAClE,IAAA,MAAM,QAAW,GAAA,MAAM,KAAM,CAAA,CAAA,EAAG,aAA2B,CAAA,UAAA,CAAA,EAAA;AAAA,MACzD,MAAQ,EAAA,MAAA;AAAA,MACR,IAAA,EAAM,IAAK,CAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MAC5B,OAAS,EAAA;AAAA,QACJ,GAAA,IAAA,CAAK,sBAAuB,CAAA,OAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,OAAA,CAAS,KAAK,CAAA;AAAA,QAC7C,cAAgB,EAAA,kBAAA;AAAA,OAClB;AAAA,KACD,CAAA,CAAA;AACD,IAAI,IAAA,CAAC,SAAS,EAAI,EAAA;AAChB,MAAM,MAAA,MAAM,aAAc,CAAA,YAAA,CAAa,QAAQ,CAAA,CAAA;AAAA,KACjD;AAEA,IAAM,MAAA,YAAA,GAAe,MAAM,QAAA,CAAS,IAAK,EAAA,CAAA;AACzC,IAAK,IAAA,CAAA,mBAAA,CAAoB,SAAS,YAAY,CAAA,CAAA;AAE9C,IAAA,MAAM,gBAAgB,YAAa,CAAA,KAAA,CAAM,MAAO,CAAA,CAAC,KAAK,CAAM,KAAA;AAC1D,MAAA,GAAA,CAAI,EAAE,EAAM,CAAA,GAAA,CAAA,CAAA;AACZ,MAAO,OAAA,GAAA,CAAA;AAAA,KACT,EAAG,EAA6E,CAAA,CAAA;AAEhF,IAAA,OAAO,QAAQ,KAAM,CAAA,GAAA,CAAI,CAAS,KAAA,KAAA,aAAA,CAAc,MAAM,EAAG,CAAA,CAAA,CAAA;AAAA,GAC3D;AAAA,EAEQ,uBAAuB,KAAwC,EAAA;AACrE,IAAA,OAAO,QAAQ,EAAE,aAAA,EAAe,CAAU,OAAA,EAAA,KAAA,CAAA,CAAA,KAAY,EAAC,CAAA;AAAA,GACzD;AAAA,EAEQ,mBAAA,CACN,SACA,IACiD,EAAA;AACjD,IAAM,MAAA,mBAAA,GAAsB,cAAe,CAAA,KAAA,CAAM,IAAI,CAAA,CAAA;AACrD,IAAA,MAAM,cAAc,mBAAoB,CAAA,KAAA,CAAM,GAAI,CAAA,CAAA,CAAA,KAAK,EAAE,EAAE,CAAA,CAAA;AAC3D,IAAM,MAAA,gBAAA,GAAmB,QAAQ,KAAM,CAAA,KAAA,CAAM,OAC3C,WAAY,CAAA,QAAA,CAAS,CAAE,CAAA,EAAE,CAC3B,CAAA,CAAA;AACA,IAAA,IAAI,CAAC,gBAAkB,EAAA;AACrB,MAAM,MAAA,IAAI,MACR,2DACF,CAAA,CAAA;AAAA,KACF;AAAA,GACF;AACF;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-permission-common",
   "description": "Isomorphic types and client for Backstage permissions and authorization",
-  "version": "0.5.1",
+  "version": "0.6.0-next.0",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "publishConfig": {
@@ -41,17 +41,17 @@
     "url": "https://github.com/backstage/backstage/issues"
   },
   "dependencies": {
-    "@backstage/config": "^0.1.15",
-    "@backstage/errors": "^0.2.2",
+    "@backstage/config": "^1.0.0",
+    "@backstage/errors": "^1.0.0",
     "cross-fetch": "^3.1.5",
     "uuid": "^8.0.0",
     "zod": "^3.11.6"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.14.0",
+    "@backstage/cli": "^0.17.0-next.1",
     "@types/jest": "^26.0.7",
     "msw": "^0.35.0"
   },
-  "gitHead": "e244b348c473700e7d5e5fbcef38bd9f9fd1d0ba",
+  "gitHead": "57d12dcc35aeb6c33b09e51d1efc3408c574f109",
   "module": "dist/index.esm.js"
 }