@backstage/plugin-permission-common 0.5.2 → 0.6.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @backstage/plugin-permission-common
 
+## 0.6.0-next.1
+
+### Patch Changes
+
+- 2b07063d77: Added `PermissionEvaluator`, which will replace the existing `PermissionAuthorizer` interface. This new interface provides stronger type safety and validation by splitting `PermissionAuthorizer.authorize()` into two methods:
+
+  - `authorize()`: Used when the caller requires a definitive decision.
+  - `authorizeConditional()`: Used when the caller can optimize the evaluation of any conditional decisions. For example, a plugin backend may want to use conditions in a database query instead of evaluating each resource in memory.
+
+## 0.6.0-next.0
+
+### Minor Changes
+
+- 8012ac46a0: Add `resourceType` property to `PermissionCondition` type to allow matching them with `ResourcePermission` instances.
+- c98d271466: Refactor api types into more specific, decoupled names.
+
+  - **BREAKING:**
+    - Renamed `AuthorizeDecision` to `EvaluatePermissionResponse`
+    - Renamed `AuthorizeQuery` to `EvaluatePermissionRequest`
+    - Renamed `AuthorizeRequest` to `EvaluatePermissionRequestBatch`
+    - Renamed `AuthorizeResponse` to `EvaluatePermissionResponseBatch`
+    - Renamed `Identified` to `IdentifiedPermissionMessage`
+  - Add `PermissionMessageBatch` helper type
+  - Add `ConditionalPolicyDecision`, `DefinitivePolicyDecision`, and `PolicyDecision` types from `@backstage/plugin-permission-node`
+
+### Patch Changes
+
+- 8012ac46a0: Add `isPermission` helper method.
+- 95284162d6: - Add more specific `Permission` types.
+  - Add `createPermission` helper to infer the appropriate type for some permission input.
+  - Add `isResourcePermission` helper to refine Permissions to ResourcePermissions.
+
+## 0.5.3
+
+### Patch Changes
+
+- f24ef7864e: Minor typo fixes
+- Updated dependencies
+  - @backstage/config@1.0.0
+  - @backstage/errors@1.0.0
+
 ## 0.5.2
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -37,6 +37,15 @@ var AuthorizeResult = /* @__PURE__ */ ((AuthorizeResult2) => {
   return AuthorizeResult2;
 })(AuthorizeResult || {});
 
+function isPermission(permission, comparedPermission) {
+  return permission.name === comparedPermission.name;
+}
+function isResourcePermission(permission, resourceType) {
+  if (!("resourceType" in permission)) {
+    return false;
+  }
+  return !resourceType || permission.resourceType === resourceType;
+}
 function isCreatePermission(permission) {
   return permission.attributes.action === "create";
 }
@@ -49,20 +58,64 @@ function isUpdatePermission(permission) {
 function isDeletePermission(permission) {
   return permission.attributes.action === "delete";
 }
+function toPermissionEvaluator(permissionAuthorizer) {
+  return {
+    authorize: async (requests, options) => {
+      const response = await permissionAuthorizer.authorize(requests, options);
+      return response;
+    },
+    authorizeConditional(requests, options) {
+      const parsedRequests = requests;
+      return permissionAuthorizer.authorize(parsedRequests, options);
+    }
+  };
+}
+
+function createPermission({
+  name,
+  attributes,
+  resourceType
+}) {
+  if (resourceType) {
+    return {
+      type: "resource",
+      name,
+      attributes,
+      resourceType
+    };
+  }
+  return {
+    type: "basic",
+    name,
+    attributes
+  };
+}
 
 const permissionCriteriaSchema = zod.z.lazy(() => zod.z.object({
   rule: zod.z.string(),
+  resourceType: zod.z.string(),
   params: zod.z.array(zod.z.unknown())
 }).strict().or(zod.z.object({ anyOf: zod.z.array(permissionCriteriaSchema).nonempty() }).strict()).or(zod.z.object({ allOf: zod.z.array(permissionCriteriaSchema).nonempty() }).strict()).or(zod.z.object({ not: permissionCriteriaSchema }).strict()));
-const responseSchema = zod.z.object({
-  items: zod.z.array(zod.z.object({
-    id: zod.z.string(),
+const authorizePermissionResponseSchema = zod.z.object({
+  result: zod.z.literal(AuthorizeResult.ALLOW).or(zod.z.literal(AuthorizeResult.DENY))
+});
+const queryPermissionResponseSchema = zod.z.union([
+  zod.z.object({
     result: zod.z.literal(AuthorizeResult.ALLOW).or(zod.z.literal(AuthorizeResult.DENY))
-  }).or(zod.z.object({
-    id: zod.z.string(),
+  }),
+  zod.z.object({
     result: zod.z.literal(AuthorizeResult.CONDITIONAL),
+    pluginId: zod.z.string(),
+    resourceType: zod.z.string(),
     conditions: permissionCriteriaSchema
-  })))
+  })
+]);
+const responseSchema = (itemSchema, ids) => zod.z.object({
+  items: zod.z.array(zod.z.intersection(zod.z.object({
+    id: zod.z.string()
+  }), itemSchema)).refine((items) => items.length === ids.size && items.every(({ id }) => ids.has(id)), {
+    message: "Items in response do not match request"
+  })
 });
 class PermissionClient {
   constructor(options) {
@@ -70,7 +123,13 @@ class PermissionClient {
     this.discovery = options.discovery;
     this.enabled = (_a = options.config.getOptionalBoolean("permission.enabled")) != null ? _a : false;
   }
-  async authorize(queries, options) {
+  async authorize(requests, options) {
+    return this.makeRequest(requests, authorizePermissionResponseSchema, options);
+  }
+  async authorizeConditional(queries, options) {
+    return this.makeRequest(queries, queryPermissionResponseSchema, options);
+  }
+  async makeRequest(queries, itemSchema, options) {
     if (!this.enabled) {
       return queries.map((_) => ({ result: AuthorizeResult.ALLOW }));
     }
@@ -93,8 +152,8 @@ class PermissionClient {
       throw await errors.ResponseError.fromResponse(response);
     }
     const responseBody = await response.json();
-    this.assertValidResponse(request, responseBody);
-    const responsesById = responseBody.items.reduce((acc, r) => {
+    const parsedResponse = responseSchema(itemSchema, new Set(request.items.map(({ id }) => id))).parse(responseBody);
+    const responsesById = parsedResponse.items.reduce((acc, r) => {
       acc[r.id] = r;
       return acc;
     }, {});
@@ -103,20 +162,16 @@ class PermissionClient {
   getAuthorizationHeader(token) {
     return token ? { Authorization: `Bearer ${token}` } : {};
   }
-  assertValidResponse(request, json) {
-    const authorizedResponses = responseSchema.parse(json);
-    const responseIds = authorizedResponses.items.map((r) => r.id);
-    const hasAllRequestIds = request.items.every((r) => responseIds.includes(r.id));
-    if (!hasAllRequestIds) {
-      throw new Error("Unexpected authorization response from permission-backend");
-    }
-  }
 }
 
 exports.AuthorizeResult = AuthorizeResult;
 exports.PermissionClient = PermissionClient;
+exports.createPermission = createPermission;
 exports.isCreatePermission = isCreatePermission;
 exports.isDeletePermission = isDeletePermission;
+exports.isPermission = isPermission;
 exports.isReadPermission = isReadPermission;
+exports.isResourcePermission = isResourcePermission;
 exports.isUpdatePermission = isUpdatePermission;
+exports.toPermissionEvaluator = toPermissionEvaluator;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type Identified<T> = T & { id: string };\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * An individual authorization request for {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeQuery = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of authorization requests from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeRequest = {\n  items: Identified<AuthorizeQuery>[];\n};\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<TParams extends unknown[] = unknown[]> = {\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represnts a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represnts a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual authorization response from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeDecision =\n  | { result: AuthorizeResult.ALLOW | AuthorizeResult.DENY }\n  | {\n      result: AuthorizeResult.CONDITIONAL;\n      conditions: PermissionCriteria<PermissionCondition>;\n    };\n\n/**\n * A batch of authorization responses from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeResponse = {\n  items: Identified<AuthorizeDecision>[];\n};\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from '../types';\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  AuthorizeQuery,\n  AuthorizeDecision,\n  Identified,\n  PermissionCriteria,\n  PermissionCondition,\n  AuthorizeResponse,\n  AuthorizeRequest,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport {\n  PermissionAuthorizer,\n  AuthorizeRequestOptions,\n} from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst responseSchema = z.object({\n  items: z.array(\n    z\n      .object({\n        id: z.string(),\n        result: z\n          .literal(AuthorizeResult.ALLOW)\n          .or(z.literal(AuthorizeResult.DENY)),\n      })\n      .or(\n        z.object({\n          id: z.string(),\n          result: z.literal(AuthorizeResult.CONDITIONAL),\n          conditions: permissionCriteriaSchema,\n        }),\n      ),\n  ),\n});\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionAuthorizer {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * Request authorization from the permission-backend for the given set of permissions.\n   *\n   * Authorization requests check that a given Backstage user can perform a protected operation,\n   * potentially for a specific resource (such as a catalog entity). The Backstage identity token\n   * should be included in the `options` if available.\n   *\n   * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.\n   *\n   * The response will be either ALLOW or DENY when either the permission has no resourceType, or a\n   * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be\n   * returned if no resourceRef is provided in the request. Conditional responses are intended only\n   * for backends which have access to the data source for permissioned resources, so that filters\n   * can be applied when loading collections of resources.\n   * @public\n   */\n  async authorize(\n    queries: AuthorizeQuery[],\n    options?: AuthorizeRequestOptions,\n  ): Promise<AuthorizeDecision[]> {\n    // TODO(permissions): it would be great to provide some kind of typing guarantee that\n    // conditional responses will only ever be returned for requests containing a resourceType\n    // but no resourceRef. That way clients who aren't prepared to handle filtering according\n    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.\n\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n    }\n\n    const request: AuthorizeRequest = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n    this.assertValidResponse(request, responseBody);\n\n    const responsesById = responseBody.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, Identified<AuthorizeDecision>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n\n  private assertValidResponse(\n    request: AuthorizeRequest,\n    json: any,\n  ): asserts json is AuthorizeResponse {\n    const authorizedResponses = responseSchema.parse(json);\n    const responseIds = authorizedResponses.items.map(r => r.id);\n    const hasAllRequestIds = request.items.every(r =>\n      responseIds.includes(r.id),\n    );\n    if (!hasAllRequestIds) {\n      throw new Error(\n        'Unexpected authorization response from permission-backend',\n      );\n    }\n  }\n}\n"],"names":["z","uuid","fetch","ResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BY,oCAAA,qBAAL;AAIL,6BAAO;AAIP,8BAAQ;AAIR,oCAAc;AAZJ;AAAA;;4BCPuB,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;0BAOT,YAAwB;AACvD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;;ACV1C,MAAM,2BAEFA,MAAE,KAAK,MACTA,MACG,OAAO;AAAA,EACN,MAAMA,MAAE;AAAA,EACR,QAAQA,MAAE,MAAMA,MAAE;AAAA,GAEnB,SACA,GACCA,MACG,OAAO,EAAE,OAAOA,MAAE,MAAM,0BAA0B,cAClD,UAEJ,GACCA,MACG,OAAO,EAAE,OAAOA,MAAE,MAAM,0BAA0B,cAClD,UAEJ,GAAGA,MAAE,OAAO,EAAE,KAAK,4BAA4B;AAGpD,MAAM,iBAAiBA,MAAE,OAAO;AAAA,EAC9B,OAAOA,MAAE,MACPA,MACG,OAAO;AAAA,IACN,IAAIA,MAAE;AAAA,IACN,QAAQA,MACL,QAAQ,gBAAgB,OACxB,GAAGA,MAAE,QAAQ,gBAAgB;AAAA,KAEjC,GACCA,MAAE,OAAO;AAAA,IACP,IAAIA,MAAE;AAAA,IACN,QAAQA,MAAE,QAAQ,gBAAgB;AAAA,IAClC,YAAY;AAAA;AAAA;uBAUwC;AAAA,EAI5D,YAAY,SAAsD;AAtFpE;AAuFI,SAAK,YAAY,QAAQ;AACzB,SAAK,UACH,cAAQ,OAAO,mBAAmB,0BAAlC,YAA2D;AAAA;AAAA,QAmBzD,UACJ,SACA,SAC8B;AAM9B,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,QAAQ,IAAI,UAAQ,QAAQ,gBAAgB;AAAA;AAGrD,UAAM,UAA4B;AAAA,MAChC,OAAO,QAAQ,IAAI;AAAU,QAC3B,IAAIC,gBAAK;AAAA,WACN;AAAA;AAAA;AAIP,UAAM,gBAAgB,MAAM,KAAK,UAAU,WAAW;AACtD,UAAM,WAAW,MAAMC,0BAAM,GAAG,2BAA2B;AAAA,MACzD,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,WACJ,KAAK,uBAAuB,mCAAS;AAAA,QACxC,gBAAgB;AAAA;AAAA;AAGpB,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAMC,qBAAc,aAAa;AAAA;AAGzC,UAAM,eAAe,MAAM,SAAS;AACpC,SAAK,oBAAoB,SAAS;AAElC,UAAM,gBAAgB,aAAa,MAAM,OAAO,CAAC,KAAK,MAAM;AAC1D,UAAI,EAAE,MAAM;AACZ,aAAO;AAAA,OACN;AAEH,WAAO,QAAQ,MAAM,IAAI,WAAS,cAAc,MAAM;AAAA;AAAA,EAGhD,uBAAuB,OAAwC;AACrE,WAAO,QAAQ,EAAE,eAAe,UAAU,YAAY;AAAA;AAAA,EAGhD,oBACN,SACA,MACmC;AACnC,UAAM,sBAAsB,eAAe,MAAM;AACjD,UAAM,cAAc,oBAAoB,MAAM,IAAI,OAAK,EAAE;AACzD,UAAM,mBAAmB,QAAQ,MAAM,MAAM,OAC3C,YAAY,SAAS,EAAE;AAEzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MACR;AAAA;AAAA;AAAA;;;;;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/permissions/createPermission.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ResourcePermission } from '.';\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type IdentifiedPermissionMessage<T> = T & { id: string };\n\n/**\n * A batch of request or response items.\n * @public\n */\nexport type PermissionMessageBatch<T> = {\n  items: IdentifiedPermissionMessage<T>[];\n};\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * A definitive decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy unconditionally allows (or denies) the request.\n *\n * @public\n */\nexport type DefinitivePolicyDecision = {\n  result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;\n};\n\n/**\n * A conditional decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy allows authorization for the request, given that the returned\n * conditions hold when evaluated. The conditions will be evaluated by the corresponding plugin\n * which knows about the referenced permission rules.\n *\n * @public\n */\nexport type ConditionalPolicyDecision = {\n  result: AuthorizeResult.CONDITIONAL;\n  pluginId: string;\n  resourceType: string;\n  conditions: PermissionCriteria<PermissionCondition>;\n};\n\n/**\n * A decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @public\n */\nexport type PolicyDecision =\n  | DefinitivePolicyDecision\n  | ConditionalPolicyDecision;\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<\n  TResourceType extends string = string,\n  TParams extends unknown[] = unknown[],\n> = {\n  resourceType: TResourceType;\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represents a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual request sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequest = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of requests sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequestBatch =\n  PermissionMessageBatch<EvaluatePermissionRequest>;\n\n/**\n * An individual response from the permission backend.\n *\n * @remarks\n *\n * This response type is an alias of {@link PolicyDecision} to maintain separation between the\n * {@link @backstage/plugin-permission-node#PermissionPolicy} interface and the permission backend\n * api. They may diverge at some point in the future. The response\n *\n * @public\n */\nexport type EvaluatePermissionResponse = PolicyDecision;\n\n/**\n * A batch of responses from the permission backend.\n * @public\n */\nexport type EvaluatePermissionResponseBatch =\n  PermissionMessageBatch<EvaluatePermissionResponse>;\n\n/**\n * Request object for {@link PermissionEvaluator.authorize}. If a {@link ResourcePermission}\n * is provided, it must include a corresponding `resourceRef`.\n * @public\n */\nexport type AuthorizePermissionRequest =\n  | {\n      permission: Exclude<Permission, ResourcePermission>;\n      resourceRef?: never;\n    }\n  | { permission: ResourcePermission; resourceRef: string };\n\n/**\n * Response object for {@link PermissionEvaluator.authorize}.\n * @public\n */\nexport type AuthorizePermissionResponse = DefinitivePolicyDecision;\n\n/**\n * Request object for {@link PermissionEvaluator.authorizeConditional}.\n * @public\n */\nexport type QueryPermissionRequest = {\n  permission: ResourcePermission;\n  resourceRef?: never;\n};\n\n/**\n * Response object for {@link PermissionEvaluator.authorizeConditional}.\n * @public\n */\nexport type QueryPermissionResponse = PolicyDecision;\n\n/**\n * A client interacting with the permission backend can implement this evaluator interface.\n *\n * @public\n */\nexport interface PermissionEvaluator {\n  /**\n   * Evaluates {@link Permission | Permissions} and returns a definitive decision.\n   */\n  authorize(\n    requests: AuthorizePermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<AuthorizePermissionResponse[]>;\n\n  /**\n   * Evaluates {@link ResourcePermission | ResourcePermissions} and returns both definitive and\n   * conditional decisions, depending on the configured\n   * {@link @backstage/plugin-permission-node#PermissionPolicy}. This method is useful when the\n   * caller needs more control over the processing of conditional decisions. For example, a plugin\n   * backend may want to use {@link PermissionCriteria | conditions} in a database query instead of\n   * evaluating each resource in memory.\n   */\n  authorizeConditional(\n    requests: QueryPermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<QueryPermissionResponse[]>;\n}\n\n/**\n * Options for {@link PermissionEvaluator} requests.\n * The Backstage identity token should be defined if available.\n * @public\n */\nexport type EvaluatorRequestOptions = {\n  token?: string;\n};\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthorizePermissionRequest,\n  AuthorizePermissionResponse,\n  DefinitivePolicyDecision,\n  EvaluatorRequestOptions,\n  Permission,\n  PermissionAuthorizer,\n  PermissionEvaluator,\n  QueryPermissionRequest,\n  QueryPermissionResponse,\n  ResourcePermission,\n} from '../types';\n\n/**\n * Check if the two parameters are equivalent permissions.\n * @public\n */\nexport function isPermission<T extends Permission>(\n  permission: Permission,\n  comparedPermission: T,\n): permission is T {\n  return permission.name === comparedPermission.name;\n}\n\n/**\n * Check if a given permission is a {@link ResourcePermission}. When\n * `resourceType` is supplied as the second parameter, also checks if\n * the permission has the specified resource type.\n * @public\n */\nexport function isResourcePermission<T extends string = string>(\n  permission: Permission,\n  resourceType?: T,\n): permission is ResourcePermission<T> {\n  if (!('resourceType' in permission)) {\n    return false;\n  }\n\n  return !resourceType || permission.resourceType === resourceType;\n}\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n\n/**\n * Convert {@link PermissionAuthorizer} to {@link PermissionEvaluator}.\n *\n * @public\n */\nexport function toPermissionEvaluator(\n  permissionAuthorizer: PermissionAuthorizer,\n): PermissionEvaluator {\n  return {\n    authorize: async (\n      requests: AuthorizePermissionRequest[],\n      options?: EvaluatorRequestOptions,\n    ): Promise<AuthorizePermissionResponse[]> => {\n      const response = await permissionAuthorizer.authorize(requests, options);\n\n      return response as DefinitivePolicyDecision[];\n    },\n    authorizeConditional(\n      requests: QueryPermissionRequest[],\n      options?: EvaluatorRequestOptions,\n    ): Promise<QueryPermissionResponse[]> {\n      const parsedRequests =\n        requests as unknown as AuthorizePermissionRequest[];\n      return permissionAuthorizer.authorize(parsedRequests, options);\n    },\n  };\n}\n","/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BasicPermission,\n  Permission,\n  PermissionAttributes,\n  ResourcePermission,\n} from '../types';\n\n/**\n * Utility function for creating a valid {@link ResourcePermission}, inferring\n * the appropriate type and resource type parameter.\n *\n * @public\n */\nexport function createPermission<TResourceType extends string>(input: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType: TResourceType;\n}): ResourcePermission<TResourceType>;\n/**\n * Utility function for creating a valid {@link BasicPermission}.\n *\n * @public\n */\nexport function createPermission(input: {\n  name: string;\n  attributes: PermissionAttributes;\n}): BasicPermission;\nexport function createPermission({\n  name,\n  attributes,\n  resourceType,\n}: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType?: string;\n}): Permission {\n  if (resourceType) {\n    return {\n      type: 'resource',\n      name,\n      attributes,\n      resourceType,\n    };\n  }\n\n  return {\n    type: 'basic',\n    name,\n    attributes,\n  };\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  PermissionMessageBatch,\n  PermissionCriteria,\n  PermissionCondition,\n  PermissionEvaluator,\n  QueryPermissionRequest,\n  AuthorizePermissionRequest,\n  EvaluatorRequestOptions,\n  AuthorizePermissionResponse,\n  QueryPermissionResponse,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport { AuthorizeRequestOptions } from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      resourceType: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst authorizePermissionResponseSchema: z.ZodSchema<AuthorizePermissionResponse> =\n  z.object({\n    result: z\n      .literal(AuthorizeResult.ALLOW)\n      .or(z.literal(AuthorizeResult.DENY)),\n  });\n\nconst queryPermissionResponseSchema: z.ZodSchema<QueryPermissionResponse> =\n  z.union([\n    z.object({\n      result: z\n        .literal(AuthorizeResult.ALLOW)\n        .or(z.literal(AuthorizeResult.DENY)),\n    }),\n    z.object({\n      result: z.literal(AuthorizeResult.CONDITIONAL),\n      pluginId: z.string(),\n      resourceType: z.string(),\n      conditions: permissionCriteriaSchema,\n    }),\n  ]);\n\nconst responseSchema = <T>(\n  itemSchema: z.ZodSchema<T>,\n  ids: Set<string>,\n): z.ZodSchema<PermissionMessageBatch<T>> =>\n  z.object({\n    items: z\n      .array(\n        z.intersection(\n          z.object({\n            id: z.string(),\n          }),\n          itemSchema,\n        ),\n      )\n      .refine(\n        items =>\n          items.length === ids.size && items.every(({ id }) => ids.has(id)),\n        {\n          message: 'Items in response do not match request',\n        },\n      ),\n  });\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionEvaluator {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * {@inheritdoc PermissionEvaluator.authorize}\n   */\n  async authorize(\n    requests: AuthorizePermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<AuthorizePermissionResponse[]> {\n    return this.makeRequest(\n      requests,\n      authorizePermissionResponseSchema,\n      options,\n    );\n  }\n\n  /**\n   * {@inheritdoc PermissionEvaluator.authorizeConditional}\n   */\n  async authorizeConditional(\n    queries: QueryPermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<QueryPermissionResponse[]> {\n    return this.makeRequest(queries, queryPermissionResponseSchema, options);\n  }\n\n  private async makeRequest<TQuery, TResult>(\n    queries: TQuery[],\n    itemSchema: z.ZodSchema<TResult>,\n    options?: AuthorizeRequestOptions,\n  ) {\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW as const }));\n    }\n\n    const request: PermissionMessageBatch<TQuery> = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n\n    const parsedResponse = responseSchema(\n      itemSchema,\n      new Set(request.items.map(({ id }) => id)),\n    ).parse(responseBody);\n\n    const responsesById = parsedResponse.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, z.infer<typeof itemSchema>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n}\n"],"names":["z","uuid","fetch","ResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAU,IAAC,eAAe,mBAAmB,CAAC,CAAC,gBAAgB,KAAK;AACpE,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AACpC,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AACtC,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;AAClD,EAAE,OAAO,gBAAgB,CAAC;AAC1B,CAAC,EAAE,eAAe,IAAI,EAAE;;ACLjB,SAAS,YAAY,CAAC,UAAU,EAAE,kBAAkB,EAAE;AAC7D,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,CAAC;AACrD,CAAC;AACM,SAAS,oBAAoB,CAAC,UAAU,EAAE,YAAY,EAAE;AAC/D,EAAE,IAAI,EAAE,cAAc,IAAI,UAAU,CAAC,EAAE;AACvC,IAAI,OAAO,KAAK,CAAC;AACjB,GAAG;AACH,EAAE,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,KAAK,YAAY,CAAC;AACnE,CAAC;AACM,SAAS,kBAAkB,CAAC,UAAU,EAAE;AAC/C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AACM,SAAS,gBAAgB,CAAC,UAAU,EAAE;AAC7C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;AACjD,CAAC;AACM,SAAS,kBAAkB,CAAC,UAAU,EAAE;AAC/C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AACM,SAAS,kBAAkB,CAAC,UAAU,EAAE;AAC/C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AACM,SAAS,qBAAqB,CAAC,oBAAoB,EAAE;AAC5D,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AAC5C,MAAM,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/E,MAAM,OAAO,QAAQ,CAAC;AACtB,KAAK;AACL,IAAI,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE;AAC5C,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;AACtC,MAAM,OAAO,oBAAoB,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AACrE,KAAK;AACL,GAAG,CAAC;AACJ;;AChCO,SAAS,gBAAgB,CAAC;AACjC,EAAE,IAAI;AACN,EAAE,UAAU;AACZ,EAAE,YAAY;AACd,CAAC,EAAE;AACH,EAAE,IAAI,YAAY,EAAE;AACpB,IAAI,OAAO;AACX,MAAM,IAAI,EAAE,UAAU;AACtB,MAAM,IAAI;AACV,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,KAAK,CAAC;AACN,GAAG;AACH,EAAE,OAAO;AACT,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,IAAI;AACR,IAAI,UAAU;AACd,GAAG,CAAC;AACJ;;ACXA,MAAM,wBAAwB,GAAGA,KAAC,CAAC,IAAI,CAAC,MAAMA,KAAC,CAAC,MAAM,CAAC;AACvD,EAAE,IAAI,EAAEA,KAAC,CAAC,MAAM,EAAE;AAClB,EAAE,YAAY,EAAEA,KAAC,CAAC,MAAM,EAAE;AAC1B,EAAE,MAAM,EAAEA,KAAC,CAAC,KAAK,CAACA,KAAC,CAAC,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAACA,KAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAEA,KAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAACA,KAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAEA,KAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAACA,KAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACpO,MAAM,iCAAiC,GAAGA,KAAC,CAAC,MAAM,CAAC;AACnD,EAAE,MAAM,EAAEA,KAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAACA,KAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AACH,MAAM,6BAA6B,GAAGA,KAAC,CAAC,KAAK,CAAC;AAC9C,EAAEA,KAAC,CAAC,MAAM,CAAC;AACX,IAAI,MAAM,EAAEA,KAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAACA,KAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAChF,GAAG,CAAC;AACJ,EAAEA,KAAC,CAAC,MAAM,CAAC;AACX,IAAI,MAAM,EAAEA,KAAC,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;AAClD,IAAI,QAAQ,EAAEA,KAAC,CAAC,MAAM,EAAE;AACxB,IAAI,YAAY,EAAEA,KAAC,CAAC,MAAM,EAAE;AAC5B,IAAI,UAAU,EAAE,wBAAwB;AACxC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,GAAG,KAAKA,KAAC,CAAC,MAAM,CAAC;AACrD,EAAE,KAAK,EAAEA,KAAC,CAAC,KAAK,CAACA,KAAC,CAAC,YAAY,CAACA,KAAC,CAAC,MAAM,CAAC;AACzC,IAAI,EAAE,EAAEA,KAAC,CAAC,MAAM,EAAE;AAClB,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE;AACxG,IAAI,OAAO,EAAE,wCAAwC;AACrD,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACI,MAAM,gBAAgB,CAAC;AAC9B,EAAE,WAAW,CAAC,OAAO,EAAE;AACvB,IAAI,IAAI,EAAE,CAAC;AACX,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AACvC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC;AACvG,GAAG;AACH,EAAE,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE;AACrC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,iCAAiC,EAAE,OAAO,CAAC,CAAC;AAClF,GAAG;AACH,EAAE,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE;AAC/C,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,6BAA6B,EAAE,OAAO,CAAC,CAAC;AAC7E,GAAG;AACH,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;AAClD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;AACvB,MAAM,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrE,KAAK;AACL,IAAI,MAAM,OAAO,GAAG;AACpB,MAAM,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM;AACrC,QAAQ,EAAE,EAAEC,eAAI,CAAC,EAAE,EAAE;AACrB,QAAQ,GAAG,KAAK;AAChB,OAAO,CAAC,CAAC;AACT,KAAK,CAAC;AACN,IAAI,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACxE,IAAI,MAAM,QAAQ,GAAG,MAAMC,yBAAK,CAAC,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE;AAC/D,MAAM,MAAM,EAAE,MAAM;AACpB,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;AACnC,MAAM,OAAO,EAAE;AACf,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;AAChF,QAAQ,cAAc,EAAE,kBAAkB;AAC1C,OAAO;AACP,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AACtB,MAAM,MAAM,MAAMC,oBAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;AACvD,KAAK;AACL,IAAI,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/C,IAAI,MAAM,cAAc,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACtH,IAAI,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK;AAClE,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;AACpB,MAAM,OAAO,GAAG,CAAC;AACjB,KAAK,EAAE,EAAE,CAAC,CAAC;AACX,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,GAAG;AACH,EAAE,sBAAsB,CAAC,KAAK,EAAE;AAChC,IAAI,OAAO,KAAK,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;AAC7D,GAAG;AACH;;;;;;;;;;;;;"}

package/dist/index.d.ts

@@ -9,17 +9,10 @@ declare type PermissionAttributes = {
     action?: 'create' | 'read' | 'update' | 'delete';
 };
 /**
- * A permission that can be checked through authorization.
- *
- * Permissions are the "what" part of authorization, the action to be performed. This may be reading
- * an entity from the catalog, executing a software template, or any other action a plugin author
- * may wish to protect.
- *
- * To evaluate authorization, a permission is paired with a Backstage identity (the "who") and
- * evaluated using an authorization policy.
+ * Generic type for building {@link Permission} types.
  * @public
  */
-declare type Permission = {
+declare type PermissionBase<TType extends string, TFields extends object> = {
     /**
      * The name of the permission.
      */
@@ -30,20 +23,53 @@ declare type Permission = {
      * all by name.
      */
     attributes: PermissionAttributes;
+} & {
     /**
-     * Some permissions can be authorized based on characteristics of a resource
-     * such a catalog entity. For these permissions, the resourceType field
-     * denotes the type of the resource whose resourceRef should be passed when
+     * String value indicating the type of the permission (e.g. 'basic',
+     * 'resource'). The allowed authorization flows in the permission system
+     * depend on the type. For example, a `resourceRef` should only be provided
+     * when authorizing permissions of type 'resource'.
+     */
+    type: TType;
+} & TFields;
+/**
+ * A permission that can be checked through authorization.
+ *
+ * @remarks
+ *
+ * Permissions are the "what" part of authorization, the action to be performed. This may be reading
+ * an entity from the catalog, executing a software template, or any other action a plugin author
+ * may wish to protect.
+ *
+ * To evaluate authorization, a permission is paired with a Backstage identity (the "who") and
+ * evaluated using an authorization policy.
+ * @public
+ */
+declare type Permission = BasicPermission | ResourcePermission;
+/**
+ * A standard {@link Permission} with no additional capabilities or restrictions.
+ * @public
+ */
+declare type BasicPermission = PermissionBase<'basic', {}>;
+/**
+ * ResourcePermissions are {@link Permission}s that can be authorized based on
+ * characteristics of a resource such a catalog entity.
+ * @public
+ */
+declare type ResourcePermission<TResourceType extends string = string> = PermissionBase<'resource', {
+    /**
+     * Denotes the type of the resource whose resourceRef should be passed when
      * authorizing.
      */
-    resourceType?: string;
-};
+    resourceType: TResourceType;
+}>;
 /**
  * A client interacting with the permission backend can implement this authorizer interface.
  * @public
+ * @deprecated Use {@link @backstage/plugin-permission-common#PermissionEvaluator} instead
  */
 interface PermissionAuthorizer {
-    authorize(queries: AuthorizeQuery[], options?: AuthorizeRequestOptions): Promise<AuthorizeDecision[]>;
+    authorize(requests: EvaluatePermissionRequest[], options?: AuthorizeRequestOptions): Promise<EvaluatePermissionResponse[]>;
 }
 /**
  * Options for authorization requests.
@@ -58,9 +84,16 @@ declare type AuthorizeRequestOptions = {
  * requests.
  * @public
  */
-declare type Identified<T> = T & {
+declare type IdentifiedPermissionMessage<T> = T & {
     id: string;
 };
+/**
+ * A batch of request or response items.
+ * @public
+ */
+declare type PermissionMessageBatch<T> = {
+    items: IdentifiedPermissionMessage<T>[];
+};
 /**
  * The result of an authorization request.
  * @public
@@ -80,20 +113,40 @@ declare enum AuthorizeResult {
     CONDITIONAL = "CONDITIONAL"
 }
 /**
- * An individual authorization request for {@link PermissionClient#authorize}.
+ * A definitive decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.
+ *
+ * @remarks
+ *
+ * This indicates that the policy unconditionally allows (or denies) the request.
+ *
  * @public
  */
-declare type AuthorizeQuery = {
-    permission: Permission;
-    resourceRef?: string;
+declare type DefinitivePolicyDecision = {
+    result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
 };
 /**
- * A batch of authorization requests from {@link PermissionClient#authorize}.
+ * A conditional decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.
+ *
+ * @remarks
+ *
+ * This indicates that the policy allows authorization for the request, given that the returned
+ * conditions hold when evaluated. The conditions will be evaluated by the corresponding plugin
+ * which knows about the referenced permission rules.
+ *
  * @public
  */
-declare type AuthorizeRequest = {
-    items: Identified<AuthorizeQuery>[];
+declare type ConditionalPolicyDecision = {
+    result: AuthorizeResult.CONDITIONAL;
+    pluginId: string;
+    resourceType: string;
+    conditions: PermissionCriteria<PermissionCondition>;
 };
+/**
+ * A decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.
+ *
+ * @public
+ */
+declare type PolicyDecision = DefinitivePolicyDecision | ConditionalPolicyDecision;
 /**
  * A condition returned with a CONDITIONAL authorization response.
  *
@@ -102,7 +155,8 @@ declare type AuthorizeRequest = {
  * claims from a identity token.
  * @public
  */
-declare type PermissionCondition<TParams extends unknown[] = unknown[]> = {
+declare type PermissionCondition<TResourceType extends string = string, TParams extends unknown[] = unknown[]> = {
+    resourceType: TResourceType;
     rule: string;
     params: TParams;
 };
@@ -112,14 +166,14 @@ declare type PermissionCondition<TParams extends unknown[] = unknown[]> = {
  */
 declare type NonEmptyArray<T> = [T, ...T[]];
 /**
- * Represnts a logical AND for the provided criteria.
+ * Represents a logical AND for the provided criteria.
  * @public
  */
 declare type AllOfCriteria<TQuery> = {
     allOf: NonEmptyArray<PermissionCriteria<TQuery>>;
 };
 /**
- * Represnts a logical OR for the provided criteria.
+ * Represents a logical OR for the provided criteria.
  * @public
  */
 declare type AnyOfCriteria<TQuery> = {
@@ -138,21 +192,92 @@ declare type NotCriteria<TQuery> = {
  */
 declare type PermissionCriteria<TQuery> = AllOfCriteria<TQuery> | AnyOfCriteria<TQuery> | NotCriteria<TQuery> | TQuery;
 /**
- * An individual authorization response from {@link PermissionClient#authorize}.
+ * An individual request sent to the permission backend.
  * @public
  */
-declare type AuthorizeDecision = {
-    result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
+declare type EvaluatePermissionRequest = {
+    permission: Permission;
+    resourceRef?: string;
+};
+/**
+ * A batch of requests sent to the permission backend.
+ * @public
+ */
+declare type EvaluatePermissionRequestBatch = PermissionMessageBatch<EvaluatePermissionRequest>;
+/**
+ * An individual response from the permission backend.
+ *
+ * @remarks
+ *
+ * This response type is an alias of {@link PolicyDecision} to maintain separation between the
+ * {@link @backstage/plugin-permission-node#PermissionPolicy} interface and the permission backend
+ * api. They may diverge at some point in the future. The response
+ *
+ * @public
+ */
+declare type EvaluatePermissionResponse = PolicyDecision;
+/**
+ * A batch of responses from the permission backend.
+ * @public
+ */
+declare type EvaluatePermissionResponseBatch = PermissionMessageBatch<EvaluatePermissionResponse>;
+/**
+ * Request object for {@link PermissionEvaluator.authorize}. If a {@link ResourcePermission}
+ * is provided, it must include a corresponding `resourceRef`.
+ * @public
+ */
+declare type AuthorizePermissionRequest = {
+    permission: Exclude<Permission, ResourcePermission>;
+    resourceRef?: never;
 } | {
-    result: AuthorizeResult.CONDITIONAL;
-    conditions: PermissionCriteria<PermissionCondition>;
+    permission: ResourcePermission;
+    resourceRef: string;
 };
 /**
- * A batch of authorization responses from {@link PermissionClient#authorize}.
+ * Response object for {@link PermissionEvaluator.authorize}.
+ * @public
+ */
+declare type AuthorizePermissionResponse = DefinitivePolicyDecision;
+/**
+ * Request object for {@link PermissionEvaluator.authorizeConditional}.
  * @public
  */
-declare type AuthorizeResponse = {
-    items: Identified<AuthorizeDecision>[];
+declare type QueryPermissionRequest = {
+    permission: ResourcePermission;
+    resourceRef?: never;
+};
+/**
+ * Response object for {@link PermissionEvaluator.authorizeConditional}.
+ * @public
+ */
+declare type QueryPermissionResponse = PolicyDecision;
+/**
+ * A client interacting with the permission backend can implement this evaluator interface.
+ *
+ * @public
+ */
+interface PermissionEvaluator {
+    /**
+     * Evaluates {@link Permission | Permissions} and returns a definitive decision.
+     */
+    authorize(requests: AuthorizePermissionRequest[], options?: EvaluatorRequestOptions): Promise<AuthorizePermissionResponse[]>;
+    /**
+     * Evaluates {@link ResourcePermission | ResourcePermissions} and returns both definitive and
+     * conditional decisions, depending on the configured
+     * {@link @backstage/plugin-permission-node#PermissionPolicy}. This method is useful when the
+     * caller needs more control over the processing of conditional decisions. For example, a plugin
+     * backend may want to use {@link PermissionCriteria | conditions} in a database query instead of
+     * evaluating each resource in memory.
+     */
+    authorizeConditional(requests: QueryPermissionRequest[], options?: EvaluatorRequestOptions): Promise<QueryPermissionResponse[]>;
+}
+/**
+ * Options for {@link PermissionEvaluator} requests.
+ * The Backstage identity token should be defined if available.
+ * @public
+ */
+declare type EvaluatorRequestOptions = {
+    token?: string;
 };
 
 /**
@@ -164,6 +289,18 @@ declare type DiscoveryApi = {
     getBaseUrl(pluginId: string): Promise<string>;
 };
 
+/**
+ * Check if the two parameters are equivalent permissions.
+ * @public
+ */
+declare function isPermission<T extends Permission>(permission: Permission, comparedPermission: T): permission is T;
+/**
+ * Check if a given permission is a {@link ResourcePermission}. When
+ * `resourceType` is supplied as the second parameter, also checks if
+ * the permission has the specified resource type.
+ * @public
+ */
+declare function isResourcePermission<T extends string = string>(permission: Permission, resourceType?: T): permission is ResourcePermission<T>;
 /**
  * Check if a given permission is related to a create action.
  * @public
@@ -184,12 +321,39 @@ declare function isUpdatePermission(permission: Permission): boolean;
  * @public
  */
 declare function isDeletePermission(permission: Permission): boolean;
+/**
+ * Convert {@link PermissionAuthorizer} to {@link PermissionEvaluator}.
+ *
+ * @public
+ */
+declare function toPermissionEvaluator(permissionAuthorizer: PermissionAuthorizer): PermissionEvaluator;
+
+/**
+ * Utility function for creating a valid {@link ResourcePermission}, inferring
+ * the appropriate type and resource type parameter.
+ *
+ * @public
+ */
+declare function createPermission<TResourceType extends string>(input: {
+    name: string;
+    attributes: PermissionAttributes;
+    resourceType: TResourceType;
+}): ResourcePermission<TResourceType>;
+/**
+ * Utility function for creating a valid {@link BasicPermission}.
+ *
+ * @public
+ */
+declare function createPermission(input: {
+    name: string;
+    attributes: PermissionAttributes;
+}): BasicPermission;
 
 /**
  * An isomorphic client for requesting authorization for Backstage permissions.
  * @public
  */
-declare class PermissionClient implements PermissionAuthorizer {
+declare class PermissionClient implements PermissionEvaluator {
     private readonly enabled;
     private readonly discovery;
     constructor(options: {
@@ -197,24 +361,15 @@ declare class PermissionClient implements PermissionAuthorizer {
         config: Config;
     });
     /**
-     * Request authorization from the permission-backend for the given set of permissions.
-     *
-     * Authorization requests check that a given Backstage user can perform a protected operation,
-     * potentially for a specific resource (such as a catalog entity). The Backstage identity token
-     * should be included in the `options` if available.
-     *
-     * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.
-     *
-     * The response will be either ALLOW or DENY when either the permission has no resourceType, or a
-     * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be
-     * returned if no resourceRef is provided in the request. Conditional responses are intended only
-     * for backends which have access to the data source for permissioned resources, so that filters
-     * can be applied when loading collections of resources.
-     * @public
+     * {@inheritdoc PermissionEvaluator.authorize}
+     */
+    authorize(requests: AuthorizePermissionRequest[], options?: EvaluatorRequestOptions): Promise<AuthorizePermissionResponse[]>;
+    /**
+     * {@inheritdoc PermissionEvaluator.authorizeConditional}
      */
-    authorize(queries: AuthorizeQuery[], options?: AuthorizeRequestOptions): Promise<AuthorizeDecision[]>;
+    authorizeConditional(queries: QueryPermissionRequest[], options?: EvaluatorRequestOptions): Promise<QueryPermissionResponse[]>;
+    private makeRequest;
     private getAuthorizationHeader;
-    private assertValidResponse;
 }
 
-export { AllOfCriteria, AnyOfCriteria, AuthorizeDecision, AuthorizeQuery, AuthorizeRequest, AuthorizeRequestOptions, AuthorizeResponse, AuthorizeResult, DiscoveryApi, Identified, NotCriteria, Permission, PermissionAttributes, PermissionAuthorizer, PermissionClient, PermissionCondition, PermissionCriteria, isCreatePermission, isDeletePermission, isReadPermission, isUpdatePermission };
+export { AllOfCriteria, AnyOfCriteria, AuthorizePermissionRequest, AuthorizePermissionResponse, AuthorizeRequestOptions, AuthorizeResult, BasicPermission, ConditionalPolicyDecision, DefinitivePolicyDecision, DiscoveryApi, EvaluatePermissionRequest, EvaluatePermissionRequestBatch, EvaluatePermissionResponse, EvaluatePermissionResponseBatch, EvaluatorRequestOptions, IdentifiedPermissionMessage, NotCriteria, Permission, PermissionAttributes, PermissionAuthorizer, PermissionBase, PermissionClient, PermissionCondition, PermissionCriteria, PermissionEvaluator, PermissionMessageBatch, PolicyDecision, QueryPermissionRequest, QueryPermissionResponse, ResourcePermission, createPermission, isCreatePermission, isDeletePermission, isPermission, isReadPermission, isResourcePermission, isUpdatePermission, toPermissionEvaluator };

package/dist/index.esm.js

@@ -10,6 +10,15 @@ var AuthorizeResult = /* @__PURE__ */ ((AuthorizeResult2) => {
   return AuthorizeResult2;
 })(AuthorizeResult || {});
 
+function isPermission(permission, comparedPermission) {
+  return permission.name === comparedPermission.name;
+}
+function isResourcePermission(permission, resourceType) {
+  if (!("resourceType" in permission)) {
+    return false;
+  }
+  return !resourceType || permission.resourceType === resourceType;
+}
 function isCreatePermission(permission) {
   return permission.attributes.action === "create";
 }
@@ -22,20 +31,64 @@ function isUpdatePermission(permission) {
 function isDeletePermission(permission) {
   return permission.attributes.action === "delete";
 }
+function toPermissionEvaluator(permissionAuthorizer) {
+  return {
+    authorize: async (requests, options) => {
+      const response = await permissionAuthorizer.authorize(requests, options);
+      return response;
+    },
+    authorizeConditional(requests, options) {
+      const parsedRequests = requests;
+      return permissionAuthorizer.authorize(parsedRequests, options);
+    }
+  };
+}
+
+function createPermission({
+  name,
+  attributes,
+  resourceType
+}) {
+  if (resourceType) {
+    return {
+      type: "resource",
+      name,
+      attributes,
+      resourceType
+    };
+  }
+  return {
+    type: "basic",
+    name,
+    attributes
+  };
+}
 
 const permissionCriteriaSchema = z.lazy(() => z.object({
   rule: z.string(),
+  resourceType: z.string(),
   params: z.array(z.unknown())
 }).strict().or(z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }).strict()).or(z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }).strict()).or(z.object({ not: permissionCriteriaSchema }).strict()));
-const responseSchema = z.object({
-  items: z.array(z.object({
-    id: z.string(),
+const authorizePermissionResponseSchema = z.object({
+  result: z.literal(AuthorizeResult.ALLOW).or(z.literal(AuthorizeResult.DENY))
+});
+const queryPermissionResponseSchema = z.union([
+  z.object({
     result: z.literal(AuthorizeResult.ALLOW).or(z.literal(AuthorizeResult.DENY))
-  }).or(z.object({
-    id: z.string(),
+  }),
+  z.object({
     result: z.literal(AuthorizeResult.CONDITIONAL),
+    pluginId: z.string(),
+    resourceType: z.string(),
     conditions: permissionCriteriaSchema
-  })))
+  })
+]);
+const responseSchema = (itemSchema, ids) => z.object({
+  items: z.array(z.intersection(z.object({
+    id: z.string()
+  }), itemSchema)).refine((items) => items.length === ids.size && items.every(({ id }) => ids.has(id)), {
+    message: "Items in response do not match request"
+  })
 });
 class PermissionClient {
   constructor(options) {
@@ -43,7 +96,13 @@ class PermissionClient {
     this.discovery = options.discovery;
     this.enabled = (_a = options.config.getOptionalBoolean("permission.enabled")) != null ? _a : false;
   }
-  async authorize(queries, options) {
+  async authorize(requests, options) {
+    return this.makeRequest(requests, authorizePermissionResponseSchema, options);
+  }
+  async authorizeConditional(queries, options) {
+    return this.makeRequest(queries, queryPermissionResponseSchema, options);
+  }
+  async makeRequest(queries, itemSchema, options) {
     if (!this.enabled) {
       return queries.map((_) => ({ result: AuthorizeResult.ALLOW }));
     }
@@ -66,8 +125,8 @@ class PermissionClient {
       throw await ResponseError.fromResponse(response);
     }
     const responseBody = await response.json();
-    this.assertValidResponse(request, responseBody);
-    const responsesById = responseBody.items.reduce((acc, r) => {
+    const parsedResponse = responseSchema(itemSchema, new Set(request.items.map(({ id }) => id))).parse(responseBody);
+    const responsesById = parsedResponse.items.reduce((acc, r) => {
       acc[r.id] = r;
       return acc;
     }, {});
@@ -76,15 +135,7 @@ class PermissionClient {
   getAuthorizationHeader(token) {
     return token ? { Authorization: `Bearer ${token}` } : {};
   }
-  assertValidResponse(request, json) {
-    const authorizedResponses = responseSchema.parse(json);
-    const responseIds = authorizedResponses.items.map((r) => r.id);
-    const hasAllRequestIds = request.items.every((r) => responseIds.includes(r.id));
-    if (!hasAllRequestIds) {
-      throw new Error("Unexpected authorization response from permission-backend");
-    }
-  }
 }
 
-export { AuthorizeResult, PermissionClient, isCreatePermission, isDeletePermission, isReadPermission, isUpdatePermission };
+export { AuthorizeResult, PermissionClient, createPermission, isCreatePermission, isDeletePermission, isPermission, isReadPermission, isResourcePermission, isUpdatePermission, toPermissionEvaluator };
 //# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type Identified<T> = T & { id: string };\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * An individual authorization request for {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeQuery = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of authorization requests from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeRequest = {\n  items: Identified<AuthorizeQuery>[];\n};\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<TParams extends unknown[] = unknown[]> = {\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represnts a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represnts a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual authorization response from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeDecision =\n  | { result: AuthorizeResult.ALLOW | AuthorizeResult.DENY }\n  | {\n      result: AuthorizeResult.CONDITIONAL;\n      conditions: PermissionCriteria<PermissionCondition>;\n    };\n\n/**\n * A batch of authorization responses from {@link PermissionClient#authorize}.\n * @public\n */\nexport type AuthorizeResponse = {\n  items: Identified<AuthorizeDecision>[];\n};\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Permission } from '../types';\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  AuthorizeQuery,\n  AuthorizeDecision,\n  Identified,\n  PermissionCriteria,\n  PermissionCondition,\n  AuthorizeResponse,\n  AuthorizeRequest,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport {\n  PermissionAuthorizer,\n  AuthorizeRequestOptions,\n} from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst responseSchema = z.object({\n  items: z.array(\n    z\n      .object({\n        id: z.string(),\n        result: z\n          .literal(AuthorizeResult.ALLOW)\n          .or(z.literal(AuthorizeResult.DENY)),\n      })\n      .or(\n        z.object({\n          id: z.string(),\n          result: z.literal(AuthorizeResult.CONDITIONAL),\n          conditions: permissionCriteriaSchema,\n        }),\n      ),\n  ),\n});\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionAuthorizer {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * Request authorization from the permission-backend for the given set of permissions.\n   *\n   * Authorization requests check that a given Backstage user can perform a protected operation,\n   * potentially for a specific resource (such as a catalog entity). The Backstage identity token\n   * should be included in the `options` if available.\n   *\n   * Permissions can be imported from plugins exposing them, such as `catalogEntityReadPermission`.\n   *\n   * The response will be either ALLOW or DENY when either the permission has no resourceType, or a\n   * resourceRef is provided in the request. For permissions with a resourceType, CONDITIONAL may be\n   * returned if no resourceRef is provided in the request. Conditional responses are intended only\n   * for backends which have access to the data source for permissioned resources, so that filters\n   * can be applied when loading collections of resources.\n   * @public\n   */\n  async authorize(\n    queries: AuthorizeQuery[],\n    options?: AuthorizeRequestOptions,\n  ): Promise<AuthorizeDecision[]> {\n    // TODO(permissions): it would be great to provide some kind of typing guarantee that\n    // conditional responses will only ever be returned for requests containing a resourceType\n    // but no resourceRef. That way clients who aren't prepared to handle filtering according\n    // to conditions can be guaranteed that they won't unexpectedly get a CONDITIONAL response.\n\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n    }\n\n    const request: AuthorizeRequest = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n    this.assertValidResponse(request, responseBody);\n\n    const responsesById = responseBody.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, Identified<AuthorizeDecision>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n\n  private assertValidResponse(\n    request: AuthorizeRequest,\n    json: any,\n  ): asserts json is AuthorizeResponse {\n    const authorizedResponses = responseSchema.parse(json);\n    const responseIds = authorizedResponses.items.map(r => r.id);\n    const hasAllRequestIds = request.items.every(r =>\n      responseIds.includes(r.id),\n    );\n    if (!hasAllRequestIds) {\n      throw new Error(\n        'Unexpected authorization response from permission-backend',\n      );\n    }\n  }\n}\n"],"names":[],"mappings":";;;;;IA6BY,oCAAA,qBAAL;AAIL,6BAAO;AAIP,8BAAQ;AAIR,oCAAc;AAZJ;AAAA;;4BCPuB,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;0BAOT,YAAwB;AACvD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;4BAOP,YAAwB;AACzD,SAAO,WAAW,WAAW,WAAW;AAAA;;ACV1C,MAAM,2BAEF,EAAE,KAAK,MACT,EACG,OAAO;AAAA,EACN,MAAM,EAAE;AAAA,EACR,QAAQ,EAAE,MAAM,EAAE;AAAA,GAEnB,SACA,GACC,EACG,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,cAClD,UAEJ,GACC,EACG,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,cAClD,UAEJ,GAAG,EAAE,OAAO,EAAE,KAAK,4BAA4B;AAGpD,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MACP,EACG,OAAO;AAAA,IACN,IAAI,EAAE;AAAA,IACN,QAAQ,EACL,QAAQ,gBAAgB,OACxB,GAAG,EAAE,QAAQ,gBAAgB;AAAA,KAEjC,GACC,EAAE,OAAO;AAAA,IACP,IAAI,EAAE;AAAA,IACN,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,IAClC,YAAY;AAAA;AAAA;uBAUwC;AAAA,EAI5D,YAAY,SAAsD;AAtFpE;AAuFI,SAAK,YAAY,QAAQ;AACzB,SAAK,UACH,cAAQ,OAAO,mBAAmB,0BAAlC,YAA2D;AAAA;AAAA,QAmBzD,UACJ,SACA,SAC8B;AAM9B,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,QAAQ,IAAI,UAAQ,QAAQ,gBAAgB;AAAA;AAGrD,UAAM,UAA4B;AAAA,MAChC,OAAO,QAAQ,IAAI;AAAU,QAC3B,IAAI,KAAK;AAAA,WACN;AAAA;AAAA;AAIP,UAAM,gBAAgB,MAAM,KAAK,UAAU,WAAW;AACtD,UAAM,WAAW,MAAM,MAAM,GAAG,2BAA2B;AAAA,MACzD,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,WACJ,KAAK,uBAAuB,mCAAS;AAAA,QACxC,gBAAgB;AAAA;AAAA;AAGpB,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAM,cAAc,aAAa;AAAA;AAGzC,UAAM,eAAe,MAAM,SAAS;AACpC,SAAK,oBAAoB,SAAS;AAElC,UAAM,gBAAgB,aAAa,MAAM,OAAO,CAAC,KAAK,MAAM;AAC1D,UAAI,EAAE,MAAM;AACZ,aAAO;AAAA,OACN;AAEH,WAAO,QAAQ,MAAM,IAAI,WAAS,cAAc,MAAM;AAAA;AAAA,EAGhD,uBAAuB,OAAwC;AACrE,WAAO,QAAQ,EAAE,eAAe,UAAU,YAAY;AAAA;AAAA,EAGhD,oBACN,SACA,MACmC;AACnC,UAAM,sBAAsB,eAAe,MAAM;AACjD,UAAM,cAAc,oBAAoB,MAAM,IAAI,OAAK,EAAE;AACzD,UAAM,mBAAmB,QAAQ,MAAM,MAAM,OAC3C,YAAY,SAAS,EAAE;AAEzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MACR;AAAA;AAAA;AAAA;;;;"}
+{"version":3,"file":"index.esm.js","sources":["../src/types/api.ts","../src/permissions/util.ts","../src/permissions/createPermission.ts","../src/PermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ResourcePermission } from '.';\nimport { Permission } from './permission';\n\n/**\n * A request with a UUID identifier, so that batched responses can be matched up with the original\n * requests.\n * @public\n */\nexport type IdentifiedPermissionMessage<T> = T & { id: string };\n\n/**\n * A batch of request or response items.\n * @public\n */\nexport type PermissionMessageBatch<T> = {\n  items: IdentifiedPermissionMessage<T>[];\n};\n\n/**\n * The result of an authorization request.\n * @public\n */\nexport enum AuthorizeResult {\n  /**\n   * The authorization request is denied.\n   */\n  DENY = 'DENY',\n  /**\n   * The authorization request is allowed.\n   */\n  ALLOW = 'ALLOW',\n  /**\n   * The authorization request is allowed if the provided conditions are met.\n   */\n  CONDITIONAL = 'CONDITIONAL',\n}\n\n/**\n * A definitive decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy unconditionally allows (or denies) the request.\n *\n * @public\n */\nexport type DefinitivePolicyDecision = {\n  result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;\n};\n\n/**\n * A conditional decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @remarks\n *\n * This indicates that the policy allows authorization for the request, given that the returned\n * conditions hold when evaluated. The conditions will be evaluated by the corresponding plugin\n * which knows about the referenced permission rules.\n *\n * @public\n */\nexport type ConditionalPolicyDecision = {\n  result: AuthorizeResult.CONDITIONAL;\n  pluginId: string;\n  resourceType: string;\n  conditions: PermissionCriteria<PermissionCondition>;\n};\n\n/**\n * A decision returned by the {@link @backstage/plugin-permission-node#PermissionPolicy}.\n *\n * @public\n */\nexport type PolicyDecision =\n  | DefinitivePolicyDecision\n  | ConditionalPolicyDecision;\n\n/**\n * A condition returned with a CONDITIONAL authorization response.\n *\n * Conditions are a reference to a rule defined by a plugin, and parameters to apply the rule. For\n * example, a rule might be `isOwner` from the catalog-backend, and params may be a list of entity\n * claims from a identity token.\n * @public\n */\nexport type PermissionCondition<\n  TResourceType extends string = string,\n  TParams extends unknown[] = unknown[],\n> = {\n  resourceType: TResourceType;\n  rule: string;\n  params: TParams;\n};\n\n/**\n * Utility type to represent an array with 1 or more elements.\n * @ignore\n */\ntype NonEmptyArray<T> = [T, ...T[]];\n\n/**\n * Represents a logical AND for the provided criteria.\n * @public\n */\nexport type AllOfCriteria<TQuery> = {\n  allOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a logical OR for the provided criteria.\n * @public\n */\nexport type AnyOfCriteria<TQuery> = {\n  anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;\n};\n\n/**\n * Represents a negation of the provided criteria.\n * @public\n */\nexport type NotCriteria<TQuery> = {\n  not: PermissionCriteria<TQuery>;\n};\n\n/**\n * Composes several {@link PermissionCondition}s as criteria with a nested AND/OR structure.\n * @public\n */\nexport type PermissionCriteria<TQuery> =\n  | AllOfCriteria<TQuery>\n  | AnyOfCriteria<TQuery>\n  | NotCriteria<TQuery>\n  | TQuery;\n\n/**\n * An individual request sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequest = {\n  permission: Permission;\n  resourceRef?: string;\n};\n\n/**\n * A batch of requests sent to the permission backend.\n * @public\n */\nexport type EvaluatePermissionRequestBatch =\n  PermissionMessageBatch<EvaluatePermissionRequest>;\n\n/**\n * An individual response from the permission backend.\n *\n * @remarks\n *\n * This response type is an alias of {@link PolicyDecision} to maintain separation between the\n * {@link @backstage/plugin-permission-node#PermissionPolicy} interface and the permission backend\n * api. They may diverge at some point in the future. The response\n *\n * @public\n */\nexport type EvaluatePermissionResponse = PolicyDecision;\n\n/**\n * A batch of responses from the permission backend.\n * @public\n */\nexport type EvaluatePermissionResponseBatch =\n  PermissionMessageBatch<EvaluatePermissionResponse>;\n\n/**\n * Request object for {@link PermissionEvaluator.authorize}. If a {@link ResourcePermission}\n * is provided, it must include a corresponding `resourceRef`.\n * @public\n */\nexport type AuthorizePermissionRequest =\n  | {\n      permission: Exclude<Permission, ResourcePermission>;\n      resourceRef?: never;\n    }\n  | { permission: ResourcePermission; resourceRef: string };\n\n/**\n * Response object for {@link PermissionEvaluator.authorize}.\n * @public\n */\nexport type AuthorizePermissionResponse = DefinitivePolicyDecision;\n\n/**\n * Request object for {@link PermissionEvaluator.authorizeConditional}.\n * @public\n */\nexport type QueryPermissionRequest = {\n  permission: ResourcePermission;\n  resourceRef?: never;\n};\n\n/**\n * Response object for {@link PermissionEvaluator.authorizeConditional}.\n * @public\n */\nexport type QueryPermissionResponse = PolicyDecision;\n\n/**\n * A client interacting with the permission backend can implement this evaluator interface.\n *\n * @public\n */\nexport interface PermissionEvaluator {\n  /**\n   * Evaluates {@link Permission | Permissions} and returns a definitive decision.\n   */\n  authorize(\n    requests: AuthorizePermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<AuthorizePermissionResponse[]>;\n\n  /**\n   * Evaluates {@link ResourcePermission | ResourcePermissions} and returns both definitive and\n   * conditional decisions, depending on the configured\n   * {@link @backstage/plugin-permission-node#PermissionPolicy}. This method is useful when the\n   * caller needs more control over the processing of conditional decisions. For example, a plugin\n   * backend may want to use {@link PermissionCriteria | conditions} in a database query instead of\n   * evaluating each resource in memory.\n   */\n  authorizeConditional(\n    requests: QueryPermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<QueryPermissionResponse[]>;\n}\n\n/**\n * Options for {@link PermissionEvaluator} requests.\n * The Backstage identity token should be defined if available.\n * @public\n */\nexport type EvaluatorRequestOptions = {\n  token?: string;\n};\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthorizePermissionRequest,\n  AuthorizePermissionResponse,\n  DefinitivePolicyDecision,\n  EvaluatorRequestOptions,\n  Permission,\n  PermissionAuthorizer,\n  PermissionEvaluator,\n  QueryPermissionRequest,\n  QueryPermissionResponse,\n  ResourcePermission,\n} from '../types';\n\n/**\n * Check if the two parameters are equivalent permissions.\n * @public\n */\nexport function isPermission<T extends Permission>(\n  permission: Permission,\n  comparedPermission: T,\n): permission is T {\n  return permission.name === comparedPermission.name;\n}\n\n/**\n * Check if a given permission is a {@link ResourcePermission}. When\n * `resourceType` is supplied as the second parameter, also checks if\n * the permission has the specified resource type.\n * @public\n */\nexport function isResourcePermission<T extends string = string>(\n  permission: Permission,\n  resourceType?: T,\n): permission is ResourcePermission<T> {\n  if (!('resourceType' in permission)) {\n    return false;\n  }\n\n  return !resourceType || permission.resourceType === resourceType;\n}\n\n/**\n * Check if a given permission is related to a create action.\n * @public\n */\nexport function isCreatePermission(permission: Permission) {\n  return permission.attributes.action === 'create';\n}\n\n/**\n * Check if a given permission is related to a read action.\n * @public\n */\nexport function isReadPermission(permission: Permission) {\n  return permission.attributes.action === 'read';\n}\n\n/**\n * Check if a given permission is related to an update action.\n * @public\n */\nexport function isUpdatePermission(permission: Permission) {\n  return permission.attributes.action === 'update';\n}\n\n/**\n * Check if a given permission is related to a delete action.\n * @public\n */\nexport function isDeletePermission(permission: Permission) {\n  return permission.attributes.action === 'delete';\n}\n\n/**\n * Convert {@link PermissionAuthorizer} to {@link PermissionEvaluator}.\n *\n * @public\n */\nexport function toPermissionEvaluator(\n  permissionAuthorizer: PermissionAuthorizer,\n): PermissionEvaluator {\n  return {\n    authorize: async (\n      requests: AuthorizePermissionRequest[],\n      options?: EvaluatorRequestOptions,\n    ): Promise<AuthorizePermissionResponse[]> => {\n      const response = await permissionAuthorizer.authorize(requests, options);\n\n      return response as DefinitivePolicyDecision[];\n    },\n    authorizeConditional(\n      requests: QueryPermissionRequest[],\n      options?: EvaluatorRequestOptions,\n    ): Promise<QueryPermissionResponse[]> {\n      const parsedRequests =\n        requests as unknown as AuthorizePermissionRequest[];\n      return permissionAuthorizer.authorize(parsedRequests, options);\n    },\n  };\n}\n","/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BasicPermission,\n  Permission,\n  PermissionAttributes,\n  ResourcePermission,\n} from '../types';\n\n/**\n * Utility function for creating a valid {@link ResourcePermission}, inferring\n * the appropriate type and resource type parameter.\n *\n * @public\n */\nexport function createPermission<TResourceType extends string>(input: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType: TResourceType;\n}): ResourcePermission<TResourceType>;\n/**\n * Utility function for creating a valid {@link BasicPermission}.\n *\n * @public\n */\nexport function createPermission(input: {\n  name: string;\n  attributes: PermissionAttributes;\n}): BasicPermission;\nexport function createPermission({\n  name,\n  attributes,\n  resourceType,\n}: {\n  name: string;\n  attributes: PermissionAttributes;\n  resourceType?: string;\n}): Permission {\n  if (resourceType) {\n    return {\n      type: 'resource',\n      name,\n      attributes,\n      resourceType,\n    };\n  }\n\n  return {\n    type: 'basic',\n    name,\n    attributes,\n  };\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { ResponseError } from '@backstage/errors';\nimport fetch from 'cross-fetch';\nimport * as uuid from 'uuid';\nimport { z } from 'zod';\nimport {\n  AuthorizeResult,\n  PermissionMessageBatch,\n  PermissionCriteria,\n  PermissionCondition,\n  PermissionEvaluator,\n  QueryPermissionRequest,\n  AuthorizePermissionRequest,\n  EvaluatorRequestOptions,\n  AuthorizePermissionResponse,\n  QueryPermissionResponse,\n} from './types/api';\nimport { DiscoveryApi } from './types/discovery';\nimport { AuthorizeRequestOptions } from './types/permission';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z\n    .object({\n      rule: z.string(),\n      resourceType: z.string(),\n      params: z.array(z.unknown()),\n    })\n    .strict()\n    .or(\n      z\n        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(\n      z\n        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })\n        .strict(),\n    )\n    .or(z.object({ not: permissionCriteriaSchema }).strict()),\n);\n\nconst authorizePermissionResponseSchema: z.ZodSchema<AuthorizePermissionResponse> =\n  z.object({\n    result: z\n      .literal(AuthorizeResult.ALLOW)\n      .or(z.literal(AuthorizeResult.DENY)),\n  });\n\nconst queryPermissionResponseSchema: z.ZodSchema<QueryPermissionResponse> =\n  z.union([\n    z.object({\n      result: z\n        .literal(AuthorizeResult.ALLOW)\n        .or(z.literal(AuthorizeResult.DENY)),\n    }),\n    z.object({\n      result: z.literal(AuthorizeResult.CONDITIONAL),\n      pluginId: z.string(),\n      resourceType: z.string(),\n      conditions: permissionCriteriaSchema,\n    }),\n  ]);\n\nconst responseSchema = <T>(\n  itemSchema: z.ZodSchema<T>,\n  ids: Set<string>,\n): z.ZodSchema<PermissionMessageBatch<T>> =>\n  z.object({\n    items: z\n      .array(\n        z.intersection(\n          z.object({\n            id: z.string(),\n          }),\n          itemSchema,\n        ),\n      )\n      .refine(\n        items =>\n          items.length === ids.size && items.every(({ id }) => ids.has(id)),\n        {\n          message: 'Items in response do not match request',\n        },\n      ),\n  });\n\n/**\n * An isomorphic client for requesting authorization for Backstage permissions.\n * @public\n */\nexport class PermissionClient implements PermissionEvaluator {\n  private readonly enabled: boolean;\n  private readonly discovery: DiscoveryApi;\n\n  constructor(options: { discovery: DiscoveryApi; config: Config }) {\n    this.discovery = options.discovery;\n    this.enabled =\n      options.config.getOptionalBoolean('permission.enabled') ?? false;\n  }\n\n  /**\n   * {@inheritdoc PermissionEvaluator.authorize}\n   */\n  async authorize(\n    requests: AuthorizePermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<AuthorizePermissionResponse[]> {\n    return this.makeRequest(\n      requests,\n      authorizePermissionResponseSchema,\n      options,\n    );\n  }\n\n  /**\n   * {@inheritdoc PermissionEvaluator.authorizeConditional}\n   */\n  async authorizeConditional(\n    queries: QueryPermissionRequest[],\n    options?: EvaluatorRequestOptions,\n  ): Promise<QueryPermissionResponse[]> {\n    return this.makeRequest(queries, queryPermissionResponseSchema, options);\n  }\n\n  private async makeRequest<TQuery, TResult>(\n    queries: TQuery[],\n    itemSchema: z.ZodSchema<TResult>,\n    options?: AuthorizeRequestOptions,\n  ) {\n    if (!this.enabled) {\n      return queries.map(_ => ({ result: AuthorizeResult.ALLOW as const }));\n    }\n\n    const request: PermissionMessageBatch<TQuery> = {\n      items: queries.map(query => ({\n        id: uuid.v4(),\n        ...query,\n      })),\n    };\n\n    const permissionApi = await this.discovery.getBaseUrl('permission');\n    const response = await fetch(`${permissionApi}/authorize`, {\n      method: 'POST',\n      body: JSON.stringify(request),\n      headers: {\n        ...this.getAuthorizationHeader(options?.token),\n        'content-type': 'application/json',\n      },\n    });\n    if (!response.ok) {\n      throw await ResponseError.fromResponse(response);\n    }\n\n    const responseBody = await response.json();\n\n    const parsedResponse = responseSchema(\n      itemSchema,\n      new Set(request.items.map(({ id }) => id)),\n    ).parse(responseBody);\n\n    const responsesById = parsedResponse.items.reduce((acc, r) => {\n      acc[r.id] = r;\n      return acc;\n    }, {} as Record<string, z.infer<typeof itemSchema>>);\n\n    return request.items.map(query => responsesById[query.id]);\n  }\n\n  private getAuthorizationHeader(token?: string): Record<string, string> {\n    return token ? { Authorization: `Bearer ${token}` } : {};\n  }\n}\n"],"names":[],"mappings":";;;;;AAAU,IAAC,eAAe,mBAAmB,CAAC,CAAC,gBAAgB,KAAK;AACpE,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AACpC,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AACtC,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;AAClD,EAAE,OAAO,gBAAgB,CAAC;AAC1B,CAAC,EAAE,eAAe,IAAI,EAAE;;ACLjB,SAAS,YAAY,CAAC,UAAU,EAAE,kBAAkB,EAAE;AAC7D,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,CAAC;AACrD,CAAC;AACM,SAAS,oBAAoB,CAAC,UAAU,EAAE,YAAY,EAAE;AAC/D,EAAE,IAAI,EAAE,cAAc,IAAI,UAAU,CAAC,EAAE;AACvC,IAAI,OAAO,KAAK,CAAC;AACjB,GAAG;AACH,EAAE,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,KAAK,YAAY,CAAC;AACnE,CAAC;AACM,SAAS,kBAAkB,CAAC,UAAU,EAAE;AAC/C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AACM,SAAS,gBAAgB,CAAC,UAAU,EAAE;AAC7C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;AACjD,CAAC;AACM,SAAS,kBAAkB,CAAC,UAAU,EAAE;AAC/C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AACM,SAAS,kBAAkB,CAAC,UAAU,EAAE;AAC/C,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AACM,SAAS,qBAAqB,CAAC,oBAAoB,EAAE;AAC5D,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AAC5C,MAAM,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/E,MAAM,OAAO,QAAQ,CAAC;AACtB,KAAK;AACL,IAAI,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE;AAC5C,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;AACtC,MAAM,OAAO,oBAAoB,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AACrE,KAAK;AACL,GAAG,CAAC;AACJ;;AChCO,SAAS,gBAAgB,CAAC;AACjC,EAAE,IAAI;AACN,EAAE,UAAU;AACZ,EAAE,YAAY;AACd,CAAC,EAAE;AACH,EAAE,IAAI,YAAY,EAAE;AACpB,IAAI,OAAO;AACX,MAAM,IAAI,EAAE,UAAU;AACtB,MAAM,IAAI;AACV,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,KAAK,CAAC;AACN,GAAG;AACH,EAAE,OAAO;AACT,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,IAAI;AACR,IAAI,UAAU;AACd,GAAG,CAAC;AACJ;;ACXA,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AACvD,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACpO,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;AACnD,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AACH,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;AAC9C,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAChF,GAAG,CAAC;AACJ,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,IAAI,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;AAClD,IAAI,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;AACxB,IAAI,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AAC5B,IAAI,UAAU,EAAE,wBAAwB;AACxC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;AACrD,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AACzC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE;AACxG,IAAI,OAAO,EAAE,wCAAwC;AACrD,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACI,MAAM,gBAAgB,CAAC;AAC9B,EAAE,WAAW,CAAC,OAAO,EAAE;AACvB,IAAI,IAAI,EAAE,CAAC;AACX,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AACvC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC;AACvG,GAAG;AACH,EAAE,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE;AACrC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,iCAAiC,EAAE,OAAO,CAAC,CAAC;AAClF,GAAG;AACH,EAAE,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE;AAC/C,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,6BAA6B,EAAE,OAAO,CAAC,CAAC;AAC7E,GAAG;AACH,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;AAClD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;AACvB,MAAM,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrE,KAAK;AACL,IAAI,MAAM,OAAO,GAAG;AACpB,MAAM,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM;AACrC,QAAQ,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;AACrB,QAAQ,GAAG,KAAK;AAChB,OAAO,CAAC,CAAC;AACT,KAAK,CAAC;AACN,IAAI,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACxE,IAAI,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE;AAC/D,MAAM,MAAM,EAAE,MAAM;AACpB,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;AACnC,MAAM,OAAO,EAAE;AACf,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;AAChF,QAAQ,cAAc,EAAE,kBAAkB;AAC1C,OAAO;AACP,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AACtB,MAAM,MAAM,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;AACvD,KAAK;AACL,IAAI,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/C,IAAI,MAAM,cAAc,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACtH,IAAI,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK;AAClE,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;AACpB,MAAM,OAAO,GAAG,CAAC;AACjB,KAAK,EAAE,EAAE,CAAC,CAAC;AACX,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,GAAG;AACH,EAAE,sBAAsB,CAAC,KAAK,EAAE;AAChC,IAAI,OAAO,KAAK,GAAG,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;AAC7D,GAAG;AACH;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-permission-common",
   "description": "Isomorphic types and client for Backstage permissions and authorization",
-  "version": "0.5.2",
+  "version": "0.6.0-next.1",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "publishConfig": {
@@ -41,17 +41,17 @@
     "url": "https://github.com/backstage/backstage/issues"
   },
   "dependencies": {
-    "@backstage/config": "^0.1.15",
-    "@backstage/errors": "^0.2.2",
+    "@backstage/config": "^1.0.0",
+    "@backstage/errors": "^1.0.0",
     "cross-fetch": "^3.1.5",
     "uuid": "^8.0.0",
     "zod": "^3.11.6"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.15.0",
+    "@backstage/cli": "^0.17.0-next.3",
     "@types/jest": "^26.0.7",
     "msw": "^0.35.0"
   },
-  "gitHead": "04bb0dd824b78f6b57dac62c3015e681f094045c",
+  "gitHead": "2eca57d93ef1081f4a76a19fc994a8e9e1a19e00",
   "module": "dist/index.esm.js"
 }