@backstage/plugin-permission-node 0.10.3-next.0 → 0.10.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/dist/ServerPermissionClient.cjs.js.map +1 -1
  3. package/dist/integration/createConditionExports.cjs.js.map +1 -1
  4. package/dist/integration/createConditionFactory.cjs.js.map +1 -1
  5. package/dist/integration/createConditionTransformer.cjs.js.map +1 -1
  6. package/dist/integration/createPermissionIntegrationRouter.cjs.js.map +1 -1
  7. package/dist/integration/createPermissionResourceRef.cjs.js.map +1 -1
  8. package/dist/integration/createPermissionRule.cjs.js.map +1 -1
  9. package/dist/integration/util.cjs.js.map +1 -1
  10. package/dist/plugin.cjs.js.map +1 -1
  11. package/package.json +9 -9
package/CHANGELOG.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # @backstage/plugin-permission-node
2
2
 
3
+ ## 0.10.3
4
+
5
+ ### Patch Changes
6
+
7
+ - Updated dependencies
8
+ - @backstage/plugin-auth-node@0.6.6
9
+ - @backstage/backend-plugin-api@1.4.2
10
+
3
11
  ## 0.10.3-next.0
4
12
 
5
13
  ### Patch Changes
package/dist/ServerPermissionClient.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"ServerPermissionClient.cjs.js","sources":["../src/ServerPermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n AuthService,\n BackstageCredentials,\n BackstageServicePrincipal,\n DiscoveryService,\n PermissionsService,\n PermissionsServiceRequestOptions,\n} from '@backstage/backend-plugin-api';\nimport { Config } from '@backstage/config';\nimport {\n AuthorizePermissionRequest,\n AuthorizePermissionResponse,\n AuthorizeResult,\n DefinitivePolicyDecision,\n Permission,\n PermissionClient,\n PolicyDecision,\n QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\n\n/**\n * A thin wrapper around\n * {@link @backstage/plugin-permission-common#PermissionClient} that allows all\n * service-to-service requests.\n * @public\n */\nexport class ServerPermissionClient implements PermissionsService {\n readonly #auth: AuthService;\n readonly #permissionClient: PermissionClient;\n readonly #permissionEnabled: boolean;\n\n static fromConfig(\n config: Config,\n options: {\n discovery: DiscoveryService;\n auth: AuthService;\n },\n ) {\n const { auth, discovery } = options;\n const permissionClient = new PermissionClient({ discovery, config });\n const permissionEnabled =\n config.getOptionalBoolean('permission.enabled') ?? false;\n\n return new ServerPermissionClient({\n auth,\n permissionClient,\n permissionEnabled,\n });\n }\n\n private constructor(options: {\n auth: AuthService;\n permissionClient: PermissionClient;\n permissionEnabled: boolean;\n }) {\n this.#auth = options.auth;\n this.#permissionClient = options.permissionClient;\n this.#permissionEnabled = options.permissionEnabled;\n }\n\n async authorizeConditional(\n queries: QueryPermissionRequest[],\n options?: PermissionsServiceRequestOptions,\n ): Promise<PolicyDecision[]> {\n const credentials = await this.#getIncomingCredentials(options);\n if (credentials && this.#auth.isPrincipal(credentials, 'service')) {\n return this.#servicePrincipalDecision(queries, credentials);\n } else if (!this.#permissionEnabled) {\n return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n }\n\n return this.#permissionClient.authorizeConditional(\n queries,\n await this.#getRequestOptions(options),\n );\n }\n\n async authorize(\n requests: AuthorizePermissionRequest[],\n options?: PermissionsServiceRequestOptions,\n ): Promise<AuthorizePermissionResponse[]> {\n const credentials = await this.#getIncomingCredentials(options);\n if (credentials && this.#auth.isPrincipal(credentials, 'service')) {\n return this.#servicePrincipalDecision(requests, credentials);\n } else if (!this.#permissionEnabled) {\n return requests.map(_ => ({ result: AuthorizeResult.ALLOW }));\n }\n\n return this.#permissionClient.authorize(\n requests,\n await this.#getRequestOptions(options),\n );\n }\n\n async #getRequestOptions(\n options?: PermissionsServiceRequestOptions,\n ): Promise<{ token?: string } | undefined> {\n if (options && 'credentials' in options) {\n if (this.#auth.isPrincipal(options.credentials, 'none')) {\n return {};\n }\n\n return this.#auth.getPluginRequestToken({\n onBehalfOf: options.credentials,\n targetPluginId: 'permission',\n });\n }\n\n return options;\n }\n\n async #getIncomingCredentials(\n options?: PermissionsServiceRequestOptions,\n ): Promise<BackstageCredentials | undefined> {\n if (options && 'credentials' in options) {\n return options.credentials;\n }\n\n return undefined;\n }\n\n /**\n * For service principals, we can always make an immediate definitive decision\n * based on their associated access restrictions (if any).\n */\n #servicePrincipalDecision(\n input: { permission: Permission }[],\n credentials: BackstageCredentials<BackstageServicePrincipal>,\n ): DefinitivePolicyDecision[] {\n const { permissionNames, permissionAttributes } =\n credentials.principal.accessRestrictions ?? {};\n\n return input.map(item => {\n if (permissionNames && !permissionNames.includes(item.permission.name)) {\n return { result: AuthorizeResult.DENY };\n }\n\n if (permissionAttributes?.action) {\n const action = item.permission.attributes?.action;\n if (!action || !permissionAttributes.action.includes(action)) {\n return { result: AuthorizeResult.DENY };\n }\n }\n\n return { result: AuthorizeResult.ALLOW };\n });\n }\n}\n"],"names":["PermissionClient","AuthorizeResult"],"mappings":";;;;AA0CO,MAAM,sBAAqD,CAAA;AAAA,EACvD,KAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EAET,OAAO,UACL,CAAA,MAAA,EACA,OAIA,EAAA;AACA,IAAM,MAAA,EAAE,IAAM,EAAA,SAAA,EAAc,GAAA,OAAA;AAC5B,IAAA,MAAM,mBAAmB,IAAIA,uCAAA,CAAiB,EAAE,SAAA,EAAW,QAAQ,CAAA;AACnE,IAAA,MAAM,iBACJ,GAAA,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,CAAK,IAAA,KAAA;AAErD,IAAA,OAAO,IAAI,sBAAuB,CAAA;AAAA,MAChC,IAAA;AAAA,MACA,gBAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA;AACH,EAEQ,YAAY,OAIjB,EAAA;AACD,IAAA,IAAA,CAAK,QAAQ,OAAQ,CAAA,IAAA;AACrB,IAAA,IAAA,CAAK,oBAAoB,OAAQ,CAAA,gBAAA;AACjC,IAAA,IAAA,CAAK,qBAAqB,OAAQ,CAAA,iBAAA;AAAA;AACpC,EAEA,MAAM,oBACJ,CAAA,OAAA,EACA,OAC2B,EAAA;AAC3B,IAAA,MAAM,WAAc,GAAA,MAAM,IAAK,CAAA,uBAAA,CAAwB,OAAO,CAAA;AAC9D,IAAA,IAAI,eAAe,IAAK,CAAA,KAAA,CAAM,WAAY,CAAA,WAAA,EAAa,SAAS,CAAG,EAAA;AACjE,MAAO,OAAA,IAAA,CAAK,yBAA0B,CAAA,OAAA,EAAS,WAAW,CAAA;AAAA,KAC5D,MAAA,IAAW,CAAC,IAAA,CAAK,kBAAoB,EAAA;AACnC,MAAA,OAAO,QAAQ,GAAI,CAAA,CAAA,CAAA,MAAM,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,OAAQ,CAAA,CAAA;AAAA;AAG7D,IAAA,OAAO,KAAK,iBAAkB,CAAA,oBAAA;AAAA,MAC5B,OAAA;AAAA,MACA,MAAM,IAAK,CAAA,kBAAA,CAAmB,OAAO;AAAA,KACvC;AAAA;AACF,EAEA,MAAM,SACJ,CAAA,QAAA,EACA,OACwC,EAAA;AACxC,IAAA,MAAM,WAAc,GAAA,MAAM,IAAK,CAAA,uBAAA,CAAwB,OAAO,CAAA;AAC9D,IAAA,IAAI,eAAe,IAAK,CAAA,KAAA,CAAM,WAAY,CAAA,WAAA,EAAa,SAAS,CAAG,EAAA;AACjE,MAAO,OAAA,IAAA,CAAK,yBAA0B,CAAA,QAAA,EAAU,WAAW,CAAA;AAAA,KAC7D,MAAA,IAAW,CAAC,IAAA,CAAK,kBAAoB,EAAA;AACnC,MAAA,OAAO,SAAS,GAAI,CAAA,CAAA,CAAA,MAAM,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,OAAQ,CAAA,CAAA;AAAA;AAG9D,IAAA,OAAO,KAAK,iBAAkB,CAAA,SAAA;AAAA,MAC5B,QAAA;AAAA,MACA,MAAM,IAAK,CAAA,kBAAA,CAAmB,OAAO;AAAA,KACvC;AAAA;AACF,EAEA,MAAM,mBACJ,OACyC,EAAA;AACzC,IAAI,IAAA,OAAA,IAAW,iBAAiB,OAAS,EAAA;AACvC,MAAA,IAAI,KAAK,KAAM,CAAA,WAAA,CAAY,OAAQ,CAAA,WAAA,EAAa,MAAM,CAAG,EAAA;AACvD,QAAA,OAAO,EAAC;AAAA;AAGV,MAAO,OAAA,IAAA,CAAK,MAAM,qBAAsB,CAAA;AAAA,QACtC,YAAY,OAAQ,CAAA,WAAA;AAAA,QACpB,cAAgB,EAAA;AAAA,OACjB,CAAA;AAAA;AAGH,IAAO,OAAA,OAAA;AAAA;AACT,EAEA,MAAM,wBACJ,OAC2C,EAAA;AAC3C,IAAI,IAAA,OAAA,IAAW,iBAAiB,OAAS,EAAA;AACvC,MAAA,OAAO,OAAQ,CAAA,WAAA;AAAA;AAGjB,IAAO,OAAA,KAAA,CAAA;AAAA;AACT;AAAA;AAAA;AAAA;AAAA,EAMA,yBAAA,CACE,OACA,WAC4B,EAAA;AAC5B,IAAA,MAAM,EAAE,eAAiB,EAAA,oBAAA,KACvB,WAAY,CAAA,SAAA,CAAU,sBAAsB,EAAC;AAE/C,IAAO,OAAA,KAAA,CAAM,IAAI,CAAQ,IAAA,KAAA;AACvB,MAAA,IAAI,mBAAmB,CAAC,eAAA,CAAgB,SAAS,IAAK,CAAA,UAAA,CAAW,IAAI,CAAG,EAAA;AACtE,QAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,IAAK,EAAA;AAAA;AAGxC,MAAA,IAAI,sBAAsB,MAAQ,EAAA;AAChC,QAAM,MAAA,MAAA,GAAS,IAAK,CAAA,UAAA,CAAW,UAAY,EAAA,MAAA;AAC3C,QAAA,IAAI,CAAC,MAAU,IAAA,CAAC,qBAAqB,MAAO,CAAA,QAAA,CAAS,MAAM,CAAG,EAAA;AAC5D,UAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,IAAK,EAAA;AAAA;AACxC;AAGF,MAAO,OAAA,EAAE,MAAQ,EAAAA,sCAAA,CAAgB,KAAM,EAAA;AAAA,KACxC,CAAA;AAAA;AAEL;;;;"}
1
+ {"version":3,"file":"ServerPermissionClient.cjs.js","sources":["../src/ServerPermissionClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n AuthService,\n BackstageCredentials,\n BackstageServicePrincipal,\n DiscoveryService,\n PermissionsService,\n PermissionsServiceRequestOptions,\n} from '@backstage/backend-plugin-api';\nimport { Config } from '@backstage/config';\nimport {\n AuthorizePermissionRequest,\n AuthorizePermissionResponse,\n AuthorizeResult,\n DefinitivePolicyDecision,\n Permission,\n PermissionClient,\n PolicyDecision,\n QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\n\n/**\n * A thin wrapper around\n * {@link @backstage/plugin-permission-common#PermissionClient} that allows all\n * service-to-service requests.\n * @public\n */\nexport class ServerPermissionClient implements PermissionsService {\n readonly #auth: AuthService;\n readonly #permissionClient: PermissionClient;\n readonly #permissionEnabled: boolean;\n\n static fromConfig(\n config: Config,\n options: {\n discovery: DiscoveryService;\n auth: AuthService;\n },\n ) {\n const { auth, discovery } = options;\n const permissionClient = new PermissionClient({ discovery, config });\n const permissionEnabled =\n config.getOptionalBoolean('permission.enabled') ?? false;\n\n return new ServerPermissionClient({\n auth,\n permissionClient,\n permissionEnabled,\n });\n }\n\n private constructor(options: {\n auth: AuthService;\n permissionClient: PermissionClient;\n permissionEnabled: boolean;\n }) {\n this.#auth = options.auth;\n this.#permissionClient = options.permissionClient;\n this.#permissionEnabled = options.permissionEnabled;\n }\n\n async authorizeConditional(\n queries: QueryPermissionRequest[],\n options?: PermissionsServiceRequestOptions,\n ): Promise<PolicyDecision[]> {\n const credentials = await this.#getIncomingCredentials(options);\n if (credentials && this.#auth.isPrincipal(credentials, 'service')) {\n return this.#servicePrincipalDecision(queries, credentials);\n } else if (!this.#permissionEnabled) {\n return queries.map(_ => ({ result: AuthorizeResult.ALLOW }));\n }\n\n return this.#permissionClient.authorizeConditional(\n queries,\n await this.#getRequestOptions(options),\n );\n }\n\n async authorize(\n requests: AuthorizePermissionRequest[],\n options?: PermissionsServiceRequestOptions,\n ): Promise<AuthorizePermissionResponse[]> {\n const credentials = await this.#getIncomingCredentials(options);\n if (credentials && this.#auth.isPrincipal(credentials, 'service')) {\n return this.#servicePrincipalDecision(requests, credentials);\n } else if (!this.#permissionEnabled) {\n return requests.map(_ => ({ result: AuthorizeResult.ALLOW }));\n }\n\n return this.#permissionClient.authorize(\n requests,\n await this.#getRequestOptions(options),\n );\n }\n\n async #getRequestOptions(\n options?: PermissionsServiceRequestOptions,\n ): Promise<{ token?: string } | undefined> {\n if (options && 'credentials' in options) {\n if (this.#auth.isPrincipal(options.credentials, 'none')) {\n return {};\n }\n\n return this.#auth.getPluginRequestToken({\n onBehalfOf: options.credentials,\n targetPluginId: 'permission',\n });\n }\n\n return options;\n }\n\n async #getIncomingCredentials(\n options?: PermissionsServiceRequestOptions,\n ): Promise<BackstageCredentials | undefined> {\n if (options && 'credentials' in options) {\n return options.credentials;\n }\n\n return undefined;\n }\n\n /**\n * For service principals, we can always make an immediate definitive decision\n * based on their associated access restrictions (if any).\n */\n #servicePrincipalDecision(\n input: { permission: Permission }[],\n credentials: BackstageCredentials<BackstageServicePrincipal>,\n ): DefinitivePolicyDecision[] {\n const { permissionNames, permissionAttributes } =\n credentials.principal.accessRestrictions ?? {};\n\n return input.map(item => {\n if (permissionNames && !permissionNames.includes(item.permission.name)) {\n return { result: AuthorizeResult.DENY };\n }\n\n if (permissionAttributes?.action) {\n const action = item.permission.attributes?.action;\n if (!action || !permissionAttributes.action.includes(action)) {\n return { result: AuthorizeResult.DENY };\n }\n }\n\n return { result: AuthorizeResult.ALLOW };\n });\n }\n}\n"],"names":["PermissionClient","AuthorizeResult"],"mappings":";;;;AA0CO,MAAM,sBAAA,CAAqD;AAAA,EACvD,KAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EAET,OAAO,UAAA,CACL,MAAA,EACA,OAAA,EAIA;AACA,IAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,OAAA;AAC5B,IAAA,MAAM,mBAAmB,IAAIA,uCAAA,CAAiB,EAAE,SAAA,EAAW,QAAQ,CAAA;AACnE,IAAA,MAAM,iBAAA,GACJ,MAAA,CAAO,kBAAA,CAAmB,oBAAoB,CAAA,IAAK,KAAA;AAErD,IAAA,OAAO,IAAI,sBAAA,CAAuB;AAAA,MAChC,IAAA;AAAA,MACA,gBAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEQ,YAAY,OAAA,EAIjB;AACD,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,IAAA;AACrB,IAAA,IAAA,CAAK,oBAAoB,OAAA,CAAQ,gBAAA;AACjC,IAAA,IAAA,CAAK,qBAAqB,OAAA,CAAQ,iBAAA;AAAA,EACpC;AAAA,EAEA,MAAM,oBAAA,CACJ,OAAA,EACA,OAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,uBAAA,CAAwB,OAAO,CAAA;AAC9D,IAAA,IAAI,eAAe,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,WAAA,EAAa,SAAS,CAAA,EAAG;AACjE,MAAA,OAAO,IAAA,CAAK,yBAAA,CAA0B,OAAA,EAAS,WAAW,CAAA;AAAA,IAC5D,CAAA,MAAA,IAAW,CAAC,IAAA,CAAK,kBAAA,EAAoB;AACnC,MAAA,OAAO,QAAQ,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,MAAA,EAAQC,sCAAA,CAAgB,OAAM,CAAE,CAAA;AAAA,IAC7D;AAEA,IAAA,OAAO,KAAK,iBAAA,CAAkB,oBAAA;AAAA,MAC5B,OAAA;AAAA,MACA,MAAM,IAAA,CAAK,kBAAA,CAAmB,OAAO;AAAA,KACvC;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,CACJ,QAAA,EACA,OAAA,EACwC;AACxC,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,uBAAA,CAAwB,OAAO,CAAA;AAC9D,IAAA,IAAI,eAAe,IAAA,CAAK,KAAA,CAAM,WAAA,CAAY,WAAA,EAAa,SAAS,CAAA,EAAG;AACjE,MAAA,OAAO,IAAA,CAAK,yBAAA,CAA0B,QAAA,EAAU,WAAW,CAAA;AAAA,IAC7D,CAAA,MAAA,IAAW,CAAC,IAAA,CAAK,kBAAA,EAAoB;AACnC,MAAA,OAAO,SAAS,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,MAAA,EAAQA,sCAAA,CAAgB,OAAM,CAAE,CAAA;AAAA,IAC9D;AAEA,IAAA,OAAO,KAAK,iBAAA,CAAkB,SAAA;AAAA,MAC5B,QAAA;AAAA,MACA,MAAM,IAAA,CAAK,kBAAA,CAAmB,OAAO;AAAA,KACvC;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,OAAA,EACyC;AACzC,IAAA,IAAI,OAAA,IAAW,iBAAiB,OAAA,EAAS;AACvC,MAAA,IAAI,KAAK,KAAA,CAAM,WAAA,CAAY,OAAA,CAAQ,WAAA,EAAa,MAAM,CAAA,EAAG;AACvD,QAAA,OAAO,EAAC;AAAA,MACV;AAEA,MAAA,OAAO,IAAA,CAAK,MAAM,qBAAA,CAAsB;AAAA,QACtC,YAAY,OAAA,CAAQ,WAAA;AAAA,QACpB,cAAA,EAAgB;AAAA,OACjB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,wBACJ,OAAA,EAC2C;AAC3C,IAAA,IAAI,OAAA,IAAW,iBAAiB,OAAA,EAAS;AACvC,MAAA,OAAO,OAAA,CAAQ,WAAA;AAAA,IACjB;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,yBAAA,CACE,OACA,WAAA,EAC4B;AAC5B,IAAA,MAAM,EAAE,eAAA,EAAiB,oBAAA,KACvB,WAAA,CAAY,SAAA,CAAU,sBAAsB,EAAC;AAE/C,IAAA,OAAO,KAAA,CAAM,IAAI,CAAA,IAAA,KAAQ;AACvB,MAAA,IAAI,mBAAmB,CAAC,eAAA,CAAgB,SAAS,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,EAAG;AACtE,QAAA,OAAO,EAAE,MAAA,EAAQA,sCAAA,CAAgB,IAAA,EAAK;AAAA,MACxC;AAEA,MAAA,IAAI,sBAAsB,MAAA,EAAQ;AAChC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,UAAA,EAAY,MAAA;AAC3C,QAAA,IAAI,CAAC,MAAA,IAAU,CAAC,qBAAqB,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAC5D,UAAA,OAAO,EAAE,MAAA,EAAQA,sCAAA,CAAgB,IAAA,EAAK;AAAA,QACxC;AAAA,MACF;AAEA,MAAA,OAAO,EAAE,MAAA,EAAQA,sCAAA,CAAgB,KAAA,EAAM;AAAA,IACzC,CAAC,CAAA;AAAA,EACH;AACF;;;;"}
package/dist/integration/createConditionExports.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"createConditionExports.cjs.js","sources":["../../src/integration/createConditionExports.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n AuthorizeResult,\n ConditionalPolicyDecision,\n PermissionCondition,\n PermissionCriteria,\n ResourcePermission,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\nimport { createConditionFactory } from './createConditionFactory';\nimport { PermissionResourceRef } from './createPermissionResourceRef';\n\n/**\n * A utility type for mapping a single {@link PermissionRule} to its\n * corresponding {@link @backstage/plugin-permission-common#PermissionCondition}.\n *\n * @public\n */\nexport type Condition<TRule> = TRule extends PermissionRule<\n any,\n any,\n infer TResourceType,\n infer TParams\n>\n ? undefined extends TParams\n ? () => PermissionCondition<TResourceType, TParams>\n : (params: TParams) => PermissionCondition<TResourceType, TParams>\n : never;\n\n/**\n * A utility type for mapping {@link PermissionRule}s to their corresponding\n * {@link @backstage/plugin-permission-common#PermissionCondition}s.\n *\n * @public\n */\nexport type Conditions<\n TRules extends Record<string, PermissionRule<any, any, any>>,\n> = {\n [Name in keyof TRules]: Condition<TRules[Name]>;\n};\n\n/**\n * Creates the recommended condition-related exports for a given plugin based on\n * the built-in {@link PermissionRule}s it supports.\n *\n * @remarks\n *\n * The function returns a `conditions` object containing a\n * {@link @backstage/plugin-permission-common#PermissionCondition} factory for\n * each of the supplied {@link PermissionRule}s, along with a\n * `createConditionalDecision` function which builds the wrapper object needed\n * to enclose conditions when authoring {@link PermissionPolicy}\n * implementations.\n *\n * Plugin authors should generally call this method with all the built-in\n * {@link PermissionRule}s the plugin supports, and export the resulting\n * `conditions` object and `createConditionalDecision` function so that they can\n * be used by {@link PermissionPolicy} authors.\n *\n * @public\n */\nexport function createConditionExports<\n TResourceType extends string,\n TResource,\n TRules extends Record<string, PermissionRule<TResource, any, TResourceType>>,\n>(options: {\n resourceRef: PermissionResourceRef<TResource, any, TResourceType>;\n rules: TRules;\n}): {\n conditions: Conditions<TRules>;\n createConditionalDecision: (\n permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition<TResourceType>>,\n ) => ConditionalPolicyDecision;\n};\n/**\n * @public\n * @deprecated Use the version of `createConditionExports` that accepts a `resourceRef` option instead.\n */\nexport function createConditionExports<\n TResourceType extends string,\n TResource,\n TRules extends Record<string, PermissionRule<TResource, any, TResourceType>>,\n>(options: {\n pluginId: string;\n resourceType: TResourceType;\n rules: TRules;\n}): {\n conditions: Conditions<TRules>;\n createConditionalDecision: (\n permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition<TResourceType>>,\n ) => ConditionalPolicyDecision;\n};\nexport function createConditionExports<\n TResourceType extends string,\n TResource,\n TRules extends Record<string, PermissionRule<TResource, any, TResourceType>>,\n>(\n options:\n | {\n resourceRef: PermissionResourceRef<TResource, any, TResourceType>;\n rules: TRules;\n }\n | {\n pluginId: string;\n resourceType: TResourceType;\n rules: TRules;\n },\n): {\n conditions: Conditions<TRules>;\n createConditionalDecision: (\n permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition<TResourceType>>,\n ) => ConditionalPolicyDecision;\n} {\n const { rules } = options;\n const { pluginId, resourceType } =\n 'resourceRef' in options ? options.resourceRef : options;\n\n return {\n conditions: Object.entries(rules).reduce(\n (acc, [key, rule]) => ({\n ...acc,\n [key]: createConditionFactory(rule),\n }),\n {} as Conditions<TRules>,\n ),\n createConditionalDecision: (\n _permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition>,\n ) => ({\n result: AuthorizeResult.CONDITIONAL,\n pluginId,\n resourceType,\n conditions,\n }),\n };\n}\n"],"names":["createConditionFactory","AuthorizeResult"],"mappings":";;;;;AA6GO,SAAS,uBAKd,OAgBA,EAAA;AACA,EAAM,MAAA,EAAE,OAAU,GAAA,OAAA;AAClB,EAAA,MAAM,EAAE,QAAU,EAAA,YAAA,KAChB,aAAiB,IAAA,OAAA,GAAU,QAAQ,WAAc,GAAA,OAAA;AAEnD,EAAO,OAAA;AAAA,IACL,UAAY,EAAA,MAAA,CAAO,OAAQ,CAAA,KAAK,CAAE,CAAA,MAAA;AAAA,MAChC,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,IAAI,CAAO,MAAA;AAAA,QACrB,GAAG,GAAA;AAAA,QACH,CAAC,GAAG,GAAGA,6CAAA,CAAuB,IAAI;AAAA,OACpC,CAAA;AAAA,MACA;AAAC,KACH;AAAA,IACA,yBAAA,EAA2B,CACzB,WAAA,EACA,UACI,MAAA;AAAA,MACJ,QAAQC,sCAAgB,CAAA,WAAA;AAAA,MACxB,QAAA;AAAA,MACA,YAAA;AAAA,MACA;AAAA,KACF;AAAA,GACF;AACF;;;;"}
1
+ {"version":3,"file":"createConditionExports.cjs.js","sources":["../../src/integration/createConditionExports.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n AuthorizeResult,\n ConditionalPolicyDecision,\n PermissionCondition,\n PermissionCriteria,\n ResourcePermission,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\nimport { createConditionFactory } from './createConditionFactory';\nimport { PermissionResourceRef } from './createPermissionResourceRef';\n\n/**\n * A utility type for mapping a single {@link PermissionRule} to its\n * corresponding {@link @backstage/plugin-permission-common#PermissionCondition}.\n *\n * @public\n */\nexport type Condition<TRule> = TRule extends PermissionRule<\n any,\n any,\n infer TResourceType,\n infer TParams\n>\n ? undefined extends TParams\n ? () => PermissionCondition<TResourceType, TParams>\n : (params: TParams) => PermissionCondition<TResourceType, TParams>\n : never;\n\n/**\n * A utility type for mapping {@link PermissionRule}s to their corresponding\n * {@link @backstage/plugin-permission-common#PermissionCondition}s.\n *\n * @public\n */\nexport type Conditions<\n TRules extends Record<string, PermissionRule<any, any, any>>,\n> = {\n [Name in keyof TRules]: Condition<TRules[Name]>;\n};\n\n/**\n * Creates the recommended condition-related exports for a given plugin based on\n * the built-in {@link PermissionRule}s it supports.\n *\n * @remarks\n *\n * The function returns a `conditions` object containing a\n * {@link @backstage/plugin-permission-common#PermissionCondition} factory for\n * each of the supplied {@link PermissionRule}s, along with a\n * `createConditionalDecision` function which builds the wrapper object needed\n * to enclose conditions when authoring {@link PermissionPolicy}\n * implementations.\n *\n * Plugin authors should generally call this method with all the built-in\n * {@link PermissionRule}s the plugin supports, and export the resulting\n * `conditions` object and `createConditionalDecision` function so that they can\n * be used by {@link PermissionPolicy} authors.\n *\n * @public\n */\nexport function createConditionExports<\n TResourceType extends string,\n TResource,\n TRules extends Record<string, PermissionRule<TResource, any, TResourceType>>,\n>(options: {\n resourceRef: PermissionResourceRef<TResource, any, TResourceType>;\n rules: TRules;\n}): {\n conditions: Conditions<TRules>;\n createConditionalDecision: (\n permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition<TResourceType>>,\n ) => ConditionalPolicyDecision;\n};\n/**\n * @public\n * @deprecated Use the version of `createConditionExports` that accepts a `resourceRef` option instead.\n */\nexport function createConditionExports<\n TResourceType extends string,\n TResource,\n TRules extends Record<string, PermissionRule<TResource, any, TResourceType>>,\n>(options: {\n pluginId: string;\n resourceType: TResourceType;\n rules: TRules;\n}): {\n conditions: Conditions<TRules>;\n createConditionalDecision: (\n permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition<TResourceType>>,\n ) => ConditionalPolicyDecision;\n};\nexport function createConditionExports<\n TResourceType extends string,\n TResource,\n TRules extends Record<string, PermissionRule<TResource, any, TResourceType>>,\n>(\n options:\n | {\n resourceRef: PermissionResourceRef<TResource, any, TResourceType>;\n rules: TRules;\n }\n | {\n pluginId: string;\n resourceType: TResourceType;\n rules: TRules;\n },\n): {\n conditions: Conditions<TRules>;\n createConditionalDecision: (\n permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition<TResourceType>>,\n ) => ConditionalPolicyDecision;\n} {\n const { rules } = options;\n const { pluginId, resourceType } =\n 'resourceRef' in options ? options.resourceRef : options;\n\n return {\n conditions: Object.entries(rules).reduce(\n (acc, [key, rule]) => ({\n ...acc,\n [key]: createConditionFactory(rule),\n }),\n {} as Conditions<TRules>,\n ),\n createConditionalDecision: (\n _permission: ResourcePermission<TResourceType>,\n conditions: PermissionCriteria<PermissionCondition>,\n ) => ({\n result: AuthorizeResult.CONDITIONAL,\n pluginId,\n resourceType,\n conditions,\n }),\n };\n}\n"],"names":["createConditionFactory","AuthorizeResult"],"mappings":";;;;;AA6GO,SAAS,uBAKd,OAAA,EAgBA;AACA,EAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAClB,EAAA,MAAM,EAAE,QAAA,EAAU,YAAA,KAChB,aAAA,IAAiB,OAAA,GAAU,QAAQ,WAAA,GAAc,OAAA;AAEnD,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,CAAE,MAAA;AAAA,MAChC,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,IAAI,CAAA,MAAO;AAAA,QACrB,GAAG,GAAA;AAAA,QACH,CAAC,GAAG,GAAGA,6CAAA,CAAuB,IAAI;AAAA,OACpC,CAAA;AAAA,MACA;AAAC,KACH;AAAA,IACA,yBAAA,EAA2B,CACzB,WAAA,EACA,UAAA,MACI;AAAA,MACJ,QAAQC,sCAAA,CAAgB,WAAA;AAAA,MACxB,QAAA;AAAA,MACA,YAAA;AAAA,MACA;AAAA,KACF;AAAA,GACF;AACF;;;;"}
package/dist/integration/createConditionFactory.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"createConditionFactory.cjs.js","sources":["../../src/integration/createConditionFactory.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n PermissionCondition,\n PermissionRuleParams,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\n\n/**\n * Creates a condition factory function for a given authorization rule and parameter types.\n *\n * @remarks\n *\n * For example, an isEntityOwner rule for catalog entities might take an array of entityRef strings.\n * The rule itself defines _how_ to check a given resource, whereas a condition also includes _what_\n * to verify.\n *\n * Plugin authors should generally use the {@link (createConditionExports:1)} in order to efficiently\n * create multiple condition factories. This helper should generally only be used to construct\n * condition factories for third-party rules that aren't part of the backend plugin with which\n * they're intended to integrate.\n *\n * @public\n */\nexport const createConditionFactory = <\n TResourceType extends string,\n TParams extends PermissionRuleParams = PermissionRuleParams,\n>(\n rule: PermissionRule<unknown, unknown, TResourceType, TParams>,\n) => {\n return (params: TParams): PermissionCondition<TResourceType, TParams> => {\n return {\n rule: rule.name,\n resourceType: rule.resourceType,\n params,\n };\n };\n};\n"],"names":[],"mappings":";;AAsCa,MAAA,sBAAA,GAAyB,CAIpC,IACG,KAAA;AACH,EAAA,OAAO,CAAC,MAAiE,KAAA;AACvE,IAAO,OAAA;AAAA,MACL,MAAM,IAAK,CAAA,IAAA;AAAA,MACX,cAAc,IAAK,CAAA,YAAA;AAAA,MACnB;AAAA,KACF;AAAA,GACF;AACF;;;;"}
1
+ {"version":3,"file":"createConditionFactory.cjs.js","sources":["../../src/integration/createConditionFactory.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n PermissionCondition,\n PermissionRuleParams,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\n\n/**\n * Creates a condition factory function for a given authorization rule and parameter types.\n *\n * @remarks\n *\n * For example, an isEntityOwner rule for catalog entities might take an array of entityRef strings.\n * The rule itself defines _how_ to check a given resource, whereas a condition also includes _what_\n * to verify.\n *\n * Plugin authors should generally use the {@link (createConditionExports:1)} in order to efficiently\n * create multiple condition factories. This helper should generally only be used to construct\n * condition factories for third-party rules that aren't part of the backend plugin with which\n * they're intended to integrate.\n *\n * @public\n */\nexport const createConditionFactory = <\n TResourceType extends string,\n TParams extends PermissionRuleParams = PermissionRuleParams,\n>(\n rule: PermissionRule<unknown, unknown, TResourceType, TParams>,\n) => {\n return (params: TParams): PermissionCondition<TResourceType, TParams> => {\n return {\n rule: rule.name,\n resourceType: rule.resourceType,\n params,\n };\n };\n};\n"],"names":[],"mappings":";;AAsCO,MAAM,sBAAA,GAAyB,CAIpC,IAAA,KACG;AACH,EAAA,OAAO,CAAC,MAAA,KAAiE;AACvE,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB;AAAA,KACF;AAAA,EACF,CAAA;AACF;;;;"}
package/dist/integration/createConditionTransformer.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"createConditionTransformer.cjs.js","sources":["../../src/integration/createConditionTransformer.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { InputError } from '@backstage/errors';\nimport {\n AllOfCriteria,\n AnyOfCriteria,\n PermissionCondition,\n PermissionCriteria,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule, PermissionRuleset } from '../types';\nimport {\n createGetRule,\n isAndCriteria,\n isNotCriteria,\n isOrCriteria,\n} from './util';\n\nconst mapConditions = <TQuery>(\n criteria: PermissionCriteria<PermissionCondition>,\n getRule: (name: string) => PermissionRule<unknown, TQuery, string>,\n): PermissionCriteria<TQuery> => {\n if (isAndCriteria(criteria)) {\n return {\n allOf: criteria.allOf.map(child => mapConditions(child, getRule)),\n } as AllOfCriteria<TQuery>;\n } else if (isOrCriteria(criteria)) {\n return {\n anyOf: criteria.anyOf.map(child => mapConditions(child, getRule)),\n } as AnyOfCriteria<TQuery>;\n } else if (isNotCriteria(criteria)) {\n return {\n not: mapConditions(criteria.not, getRule),\n };\n }\n\n const rule = getRule(criteria.rule);\n const result = rule.paramsSchema?.safeParse(criteria.params);\n\n if (result && !result.success) {\n throw new InputError(`Parameters to rule are invalid`, result.error);\n }\n\n return rule.toQuery(criteria.params ?? {});\n};\n\n/**\n * A function which accepts {@link @backstage/plugin-permission-common#PermissionCondition}s\n * logically grouped in a {@link @backstage/plugin-permission-common#PermissionCriteria}\n * object, and transforms the {@link @backstage/plugin-permission-common#PermissionCondition}s\n * into plugin specific query fragments while retaining the enclosing criteria shape.\n *\n * @public\n */\nexport type ConditionTransformer<TQuery> = (\n conditions: PermissionCriteria<PermissionCondition>,\n) => PermissionCriteria<TQuery>;\n\n/**\n * A higher-order helper function which accepts an array of\n * {@link PermissionRule}s, and returns a {@link ConditionTransformer}\n * which transforms input conditions into equivalent plugin-specific\n * query fragments using the supplied rules.\n *\n * @public\n */\nexport function createConditionTransformer<TQuery>(\n permissionRuleset: PermissionRuleset<any, TQuery>,\n): ConditionTransformer<TQuery>;\n/**\n * @public\n * @deprecated Use the version of `createConditionTransformer` that accepts a `PermissionRuleset` instead.\n */\nexport function createConditionTransformer<\n TQuery,\n TRules extends PermissionRule<any, TQuery, string>[],\n>(permissionRules: [...TRules]): ConditionTransformer<TQuery>;\nexport function createConditionTransformer<TQuery>(\n permissionRules:\n | PermissionRule<any, TQuery, string>[]\n | PermissionRuleset<any, TQuery>,\n): ConditionTransformer<TQuery> {\n const getRule =\n 'getRuleByName' in permissionRules\n ? (n: string) => permissionRules.getRuleByName(n)\n : createGetRule(permissionRules);\n\n return conditions => mapConditions(conditions, getRule);\n}\n"],"names":["isAndCriteria","isOrCriteria","isNotCriteria","InputError","createGetRule"],"mappings":";;;;;AA8BA,MAAM,aAAA,GAAgB,CACpB,QAAA,EACA,OAC+B,KAAA;AAC/B,EAAI,IAAAA,kBAAA,CAAc,QAAQ,CAAG,EAAA;AAC3B,IAAO,OAAA;AAAA,MACL,KAAA,EAAO,SAAS,KAAM,CAAA,GAAA,CAAI,WAAS,aAAc,CAAA,KAAA,EAAO,OAAO,CAAC;AAAA,KAClE;AAAA,GACF,MAAA,IAAWC,iBAAa,CAAA,QAAQ,CAAG,EAAA;AACjC,IAAO,OAAA;AAAA,MACL,KAAA,EAAO,SAAS,KAAM,CAAA,GAAA,CAAI,WAAS,aAAc,CAAA,KAAA,EAAO,OAAO,CAAC;AAAA,KAClE;AAAA,GACF,MAAA,IAAWC,kBAAc,CAAA,QAAQ,CAAG,EAAA;AAClC,IAAO,OAAA;AAAA,MACL,GAAK,EAAA,aAAA,CAAc,QAAS,CAAA,GAAA,EAAK,OAAO;AAAA,KAC1C;AAAA;AAGF,EAAM,MAAA,IAAA,GAAO,OAAQ,CAAA,QAAA,CAAS,IAAI,CAAA;AAClC,EAAA,MAAM,MAAS,GAAA,IAAA,CAAK,YAAc,EAAA,SAAA,CAAU,SAAS,MAAM,CAAA;AAE3D,EAAI,IAAA,MAAA,IAAU,CAAC,MAAA,CAAO,OAAS,EAAA;AAC7B,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAkC,8BAAA,CAAA,EAAA,MAAA,CAAO,KAAK,CAAA;AAAA;AAGrE,EAAA,OAAO,IAAK,CAAA,OAAA,CAAQ,QAAS,CAAA,MAAA,IAAU,EAAE,CAAA;AAC3C,CAAA;AAiCO,SAAS,2BACd,eAG8B,EAAA;AAC9B,EAAM,MAAA,OAAA,GACJ,eAAmB,IAAA,eAAA,GACf,CAAC,CAAA,KAAc,gBAAgB,aAAc,CAAA,CAAC,CAC9C,GAAAC,kBAAA,CAAc,eAAe,CAAA;AAEnC,EAAO,OAAA,CAAA,UAAA,KAAc,aAAc,CAAA,UAAA,EAAY,OAAO,CAAA;AACxD;;;;"}
1
+ {"version":3,"file":"createConditionTransformer.cjs.js","sources":["../../src/integration/createConditionTransformer.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { InputError } from '@backstage/errors';\nimport {\n AllOfCriteria,\n AnyOfCriteria,\n PermissionCondition,\n PermissionCriteria,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule, PermissionRuleset } from '../types';\nimport {\n createGetRule,\n isAndCriteria,\n isNotCriteria,\n isOrCriteria,\n} from './util';\n\nconst mapConditions = <TQuery>(\n criteria: PermissionCriteria<PermissionCondition>,\n getRule: (name: string) => PermissionRule<unknown, TQuery, string>,\n): PermissionCriteria<TQuery> => {\n if (isAndCriteria(criteria)) {\n return {\n allOf: criteria.allOf.map(child => mapConditions(child, getRule)),\n } as AllOfCriteria<TQuery>;\n } else if (isOrCriteria(criteria)) {\n return {\n anyOf: criteria.anyOf.map(child => mapConditions(child, getRule)),\n } as AnyOfCriteria<TQuery>;\n } else if (isNotCriteria(criteria)) {\n return {\n not: mapConditions(criteria.not, getRule),\n };\n }\n\n const rule = getRule(criteria.rule);\n const result = rule.paramsSchema?.safeParse(criteria.params);\n\n if (result && !result.success) {\n throw new InputError(`Parameters to rule are invalid`, result.error);\n }\n\n return rule.toQuery(criteria.params ?? {});\n};\n\n/**\n * A function which accepts {@link @backstage/plugin-permission-common#PermissionCondition}s\n * logically grouped in a {@link @backstage/plugin-permission-common#PermissionCriteria}\n * object, and transforms the {@link @backstage/plugin-permission-common#PermissionCondition}s\n * into plugin specific query fragments while retaining the enclosing criteria shape.\n *\n * @public\n */\nexport type ConditionTransformer<TQuery> = (\n conditions: PermissionCriteria<PermissionCondition>,\n) => PermissionCriteria<TQuery>;\n\n/**\n * A higher-order helper function which accepts an array of\n * {@link PermissionRule}s, and returns a {@link ConditionTransformer}\n * which transforms input conditions into equivalent plugin-specific\n * query fragments using the supplied rules.\n *\n * @public\n */\nexport function createConditionTransformer<TQuery>(\n permissionRuleset: PermissionRuleset<any, TQuery>,\n): ConditionTransformer<TQuery>;\n/**\n * @public\n * @deprecated Use the version of `createConditionTransformer` that accepts a `PermissionRuleset` instead.\n */\nexport function createConditionTransformer<\n TQuery,\n TRules extends PermissionRule<any, TQuery, string>[],\n>(permissionRules: [...TRules]): ConditionTransformer<TQuery>;\nexport function createConditionTransformer<TQuery>(\n permissionRules:\n | PermissionRule<any, TQuery, string>[]\n | PermissionRuleset<any, TQuery>,\n): ConditionTransformer<TQuery> {\n const getRule =\n 'getRuleByName' in permissionRules\n ? (n: string) => permissionRules.getRuleByName(n)\n : createGetRule(permissionRules);\n\n return conditions => mapConditions(conditions, getRule);\n}\n"],"names":["isAndCriteria","isOrCriteria","isNotCriteria","InputError","createGetRule"],"mappings":";;;;;AA8BA,MAAM,aAAA,GAAgB,CACpB,QAAA,EACA,OAAA,KAC+B;AAC/B,EAAA,IAAIA,kBAAA,CAAc,QAAQ,CAAA,EAAG;AAC3B,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,SAAS,KAAA,CAAM,GAAA,CAAI,WAAS,aAAA,CAAc,KAAA,EAAO,OAAO,CAAC;AAAA,KAClE;AAAA,EACF,CAAA,MAAA,IAAWC,iBAAA,CAAa,QAAQ,CAAA,EAAG;AACjC,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,SAAS,KAAA,CAAM,GAAA,CAAI,WAAS,aAAA,CAAc,KAAA,EAAO,OAAO,CAAC;AAAA,KAClE;AAAA,EACF,CAAA,MAAA,IAAWC,kBAAA,CAAc,QAAQ,CAAA,EAAG;AAClC,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,aAAA,CAAc,QAAA,CAAS,GAAA,EAAK,OAAO;AAAA,KAC1C;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA;AAClC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,CAAU,SAAS,MAAM,CAAA;AAE3D,EAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAA,8BAAA,CAAA,EAAkC,MAAA,CAAO,KAAK,CAAA;AAAA,EACrE;AAEA,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,CAAS,MAAA,IAAU,EAAE,CAAA;AAC3C,CAAA;AAiCO,SAAS,2BACd,eAAA,EAG8B;AAC9B,EAAA,MAAM,OAAA,GACJ,eAAA,IAAmB,eAAA,GACf,CAAC,CAAA,KAAc,gBAAgB,aAAA,CAAc,CAAC,CAAA,GAC9CC,kBAAA,CAAc,eAAe,CAAA;AAEnC,EAAA,OAAO,CAAA,UAAA,KAAc,aAAA,CAAc,UAAA,EAAY,OAAO,CAAA;AACxD;;;;"}
package/dist/integration/createPermissionIntegrationRouter.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"createPermissionIntegrationRouter.cjs.js","sources":["../../src/integration/createPermissionIntegrationRouter.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express, { Response } from 'express';\nimport Router from 'express-promise-router';\nimport { z } from 'zod';\nimport zodToJsonSchema from 'zod-to-json-schema';\nimport { InputError } from '@backstage/errors';\nimport {\n AuthorizeResult,\n DefinitivePolicyDecision,\n IdentifiedPermissionMessage,\n MetadataResponse as CommonMetadataResponse,\n MetadataResponseSerializedRule as CommonMetadataResponseSerializedRule,\n Permission,\n PermissionCondition,\n PermissionCriteria,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport { NoInfer, PermissionRule, PermissionRuleset } from '../types';\nimport {\n createGetRule,\n isAndCriteria,\n isNotCriteria,\n isOrCriteria,\n} from './util';\nimport { NotImplementedError } from '@backstage/errors';\nimport { PermissionResourceRef } from './createPermissionResourceRef';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n z.union([\n z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }),\n z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }),\n z.object({ not: permissionCriteriaSchema }),\n z.object({\n rule: z.string(),\n resourceType: z.string(),\n params: z.record(z.any()).optional(),\n }),\n ]),\n);\n\nconst applyConditionsRequestSchema = z.object({\n items: z.array(\n z.object({\n id: z.string(),\n resourceRef: z.union([z.string(), z.array(z.string()).nonempty()]),\n resourceType: z.string(),\n conditions: permissionCriteriaSchema,\n }),\n ),\n});\n\n/**\n * A request to load the referenced resource and apply conditions in order to\n * finalize a conditional authorization response.\n *\n * @public\n */\nexport type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{\n resourceRef: string | string[];\n resourceType: string;\n conditions: PermissionCriteria<PermissionCondition>;\n}>;\n\n/**\n * A batch of {@link ApplyConditionsRequestEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsRequest = {\n items: ApplyConditionsRequestEntry[];\n};\n\n/**\n * The result of applying the conditions, expressed as a definitive authorize\n * result of ALLOW or DENY.\n *\n * @public\n */\nexport type ApplyConditionsResponseEntry = IdentifiedPermissionMessage<\n | DefinitivePolicyDecision\n | {\n result: Array<AuthorizeResult.ALLOW | AuthorizeResult.DENY>;\n }\n>;\n\n/**\n * A batch of {@link ApplyConditionsResponseEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsResponse = {\n items: ApplyConditionsResponseEntry[];\n};\n\n/**\n * Serialized permission rules, with the paramsSchema\n * converted from a ZodSchema to a JsonSchema.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponseSerializedRule =\n CommonMetadataResponseSerializedRule;\n\n/**\n * Response type for the .metadata endpoint.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponse = CommonMetadataResponse;\n\nconst applyConditions = <TResourceType extends string, TResource>(\n criteria: PermissionCriteria<PermissionCondition<TResourceType>>,\n resource: TResource | undefined,\n getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,\n): boolean => {\n // If resource was not found, deny. This avoids leaking information from the\n // apply-conditions API which would allow a user to differentiate between\n // non-existent resources and resources to which they do not have access.\n if (resource === undefined) {\n return false;\n }\n\n if (isAndCriteria(criteria)) {\n return criteria.allOf.every(child =>\n applyConditions(child, resource, getRule),\n );\n } else if (isOrCriteria(criteria)) {\n return criteria.anyOf.some(child =>\n applyConditions(child, resource, getRule),\n );\n } else if (isNotCriteria(criteria)) {\n return !applyConditions(criteria.not, resource, getRule);\n }\n\n const rule = getRule(criteria.rule);\n const result = rule.paramsSchema?.safeParse(criteria.params);\n\n if (result && !result.success) {\n throw new InputError(`Parameters to rule are invalid`, result.error);\n }\n\n return rule.apply(resource, criteria.params ?? {});\n};\n\nfunction authorizeResult<TResourceType extends string, TResource>(\n criteria: PermissionCriteria<PermissionCondition<TResourceType>>,\n resource: TResource | undefined,\n getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,\n) {\n return applyConditions(criteria, resource, getRule)\n ? AuthorizeResult.ALLOW\n : AuthorizeResult.DENY;\n}\n\n/**\n * Takes some permission conditions and returns a definitive authorization result\n * on the resource to which they apply.\n *\n * @public\n */\nexport function createConditionAuthorizer<TResource>(\n permissionRuleset: PermissionRuleset<TResource>,\n): (decision: PolicyDecision, resource: TResource | undefined) => boolean;\n/**\n * @public\n * @deprecated Use the version of `createConditionAuthorizer` that accepts a `PermissionRuleset` instead.\n */\nexport function createConditionAuthorizer<TResource, TQuery>(\n rules: PermissionRule<TResource, TQuery, string>[],\n): (decision: PolicyDecision, resource: TResource | undefined) => boolean;\nexport function createConditionAuthorizer<TResource, TQuery>(\n rules:\n | PermissionRule<TResource, TQuery, string>[]\n | PermissionRuleset<TResource>,\n): (decision: PolicyDecision, resource: TResource | undefined) => boolean {\n const getRule =\n 'getRuleByName' in rules\n ? (n: string) => rules.getRuleByName(n)\n : createGetRule(rules);\n\n return (\n decision: PolicyDecision,\n resource: TResource | undefined,\n ): boolean => {\n if (decision.result === AuthorizeResult.CONDITIONAL) {\n return applyConditions(decision.conditions, resource, getRule);\n }\n\n return decision.result === AuthorizeResult.ALLOW;\n };\n}\n\n/**\n * Options for creating a permission integration router specific\n * for a particular resource type.\n *\n * @public\n * @deprecated {@link createPermissionIntegrationRouter} is deprecated\n */\nexport type CreatePermissionIntegrationRouterResourceOptions<\n TResourceType extends string,\n TResource,\n> = {\n resourceType: TResourceType;\n permissions?: Array<Permission>;\n // Do not infer value of TResourceType from supplied rules.\n // instead only consider the resourceType parameter, and\n // consider any rules whose resource type does not match\n // to be an error.\n rules: PermissionRule<TResource, any, NoInfer<TResourceType>>[];\n getResources?: (\n resourceRefs: string[],\n ) => Promise<Array<TResource | undefined>>;\n};\n\n/**\n * Options for creating a permission integration router exposing\n * permissions and rules from multiple resource types.\n *\n * @public\n * @deprecated {@link createPermissionIntegrationRouter} is deprecated\n */\nexport type PermissionIntegrationRouterOptions<\n TResourceType1 extends string = string,\n TResource1 = any,\n TResourceType2 extends string = string,\n TResource2 = any,\n TResourceType3 extends string = string,\n TResource3 = any,\n> = {\n resources: Readonly<\n | [\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >,\n ]\n | [\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >,\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType2,\n TResource2\n >,\n ]\n | [\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >,\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType2,\n TResource2\n >,\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType3,\n TResource3\n >,\n ]\n >;\n};\n\nclass PermissionIntegrationMetadataStore {\n readonly #rulesByTypeByName = new Map<\n string,\n Map<string, PermissionRule<unknown, unknown, string>>\n >();\n readonly #permissionsByName = new Map<string, Permission>();\n readonly #resourcesByType = new Map<\n string,\n CreatePermissionIntegrationRouterResourceOptions<string, unknown>\n >();\n readonly #serializedRules = new Array<MetadataResponseSerializedRule>();\n\n getSerializedMetadata(): MetadataResponse {\n return {\n permissions: Array.from(this.#permissionsByName.values()),\n rules: this.#serializedRules,\n };\n }\n\n hasResourceType(type: string): boolean {\n return this.#resourcesByType.has(type);\n }\n\n async getResources(\n resourceType: string,\n refs: string[],\n ): Promise<Record<string, unknown>> {\n const resource = this.#resourcesByType.get(resourceType);\n if (!resource?.getResources) {\n throw new NotImplementedError(\n `This plugin does not expose any permission rule or can't evaluate the conditions request for ${resourceType}`,\n );\n }\n\n const uniqueRefs = Array.from(new Set(refs));\n const resources = await resource.getResources(uniqueRefs);\n return Object.fromEntries(\n uniqueRefs.map((ref, index) => [ref, resources[index]]),\n );\n }\n\n getRuleMapper(resourceType: string) {\n return (name: string): PermissionRule<unknown, unknown, string> => {\n const rule = this.#rulesByTypeByName.get(resourceType)?.get(name);\n if (!rule) {\n throw new Error(\n `Permission rule '${name}' does not exist for resource type '${resourceType}'`,\n );\n }\n return rule;\n };\n }\n\n addPermissions(permissions: Permission[]) {\n for (const permission of permissions) {\n // Permission naming conflicts are silently ignored\n this.#permissionsByName.set(permission.name, permission);\n }\n }\n\n addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]) {\n for (const rule of rules) {\n const rulesByName =\n this.#rulesByTypeByName.get(rule.resourceType) ?? new Map();\n this.#rulesByTypeByName.set(rule.resourceType, rulesByName);\n\n if (rulesByName.has(rule.name)) {\n throw new Error(\n `Refused to add permission rule for type '${rule.resourceType}' with name '${rule.name}' because it already exists`,\n );\n }\n rulesByName.set(rule.name, rule);\n\n this.#serializedRules.push({\n name: rule.name,\n description: rule.description,\n resourceType: rule.resourceType,\n paramsSchema: zodToJsonSchema(rule.paramsSchema ?? z.object({})),\n });\n }\n }\n\n addResourceType(\n resource: CreatePermissionIntegrationRouterResourceOptions<string, unknown>,\n ) {\n const { resourceType } = resource;\n\n if (this.#resourcesByType.has(resourceType)) {\n throw new Error(\n `Refused to add permission resource with type '${resourceType}' because it already exists`,\n );\n }\n this.#resourcesByType.set(resourceType, resource);\n\n if (resource.rules) {\n this.addPermissionRules(resource.rules);\n }\n\n if (resource.permissions) {\n this.addPermissions(resource.permissions);\n }\n }\n}\n\n/**\n * Create an express Router which provides an authorization route to allow\n * integration between the permission backend and other Backstage backend\n * plugins. Plugin owners that wish to support conditional authorization for\n * their resources should add the router created by this function to their\n * express app inside their `createRouter` implementation.\n *\n * In case the `permissions` option is provided, the router also\n * provides a route that exposes permissions and routes of a plugin.\n *\n * In case resources is provided, the routes can handle permissions\n * for multiple resource types.\n *\n * @remarks\n *\n * To make this concrete, we can use the Backstage software catalog as an\n * example. The catalog has conditional rules around access to specific\n * _entities_ in the catalog. The _type_ of resource is captured here as\n * `resourceType`, a string identifier (`catalog-entity` in this example) that\n * can be provided with permission definitions. This is merely a _type_ to\n * verify that conditions in an authorization policy are constructed correctly,\n * not a reference to a specific resource.\n *\n * The `rules` parameter is an array of {@link PermissionRule}s that introduce\n * conditional filtering logic for resources; for the catalog, these are things\n * like `isEntityOwner` or `hasAnnotation`. Rules describe how to filter a list\n * of resources, and the `conditions` returned allow these rules to be applied\n * with specific parameters (such as 'group:default/team-a', or\n * 'backstage.io/edit-url').\n *\n * The `getResources` argument should load resources based on a reference\n * identifier. For the catalog, this is an\n * {@link @backstage/catalog-model#EntityRef}. For other plugins, this can be\n * any serialized format. This is used to construct the\n * `createPermissionIntegrationRouter`, a function to add an authorization route\n * to your backend plugin. This function will be called by the\n * `permission-backend` when authorization conditions relating to this plugin\n * need to be evaluated.\n *\n * @public\n * @deprecated use `PermissionRegistryService` instead, see {@link https://backstage.io/docs/backend-system/core-services/permissions-registry#migrating-from-createpermissionintegrationrouter | the migration section in the service docs} for more details.\n */\nexport function createPermissionIntegrationRouter<\n TResourceType1 extends string,\n TResource1,\n TResourceType2 extends string,\n TResource2,\n TResourceType3 extends string,\n TResource3,\n>(\n options?:\n | { permissions: Array<Permission> }\n | CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >\n | PermissionIntegrationRouterOptions<\n TResourceType1,\n TResource1,\n TResourceType2,\n TResource2,\n TResourceType3,\n TResource3\n >,\n): express.Router & {\n addPermissions(permissions: Permission[]): void;\n addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]): void;\n addResourceType<const TResourceType extends string, TResource>(\n resource: CreatePermissionIntegrationRouterResourceOptions<\n TResourceType,\n TResource\n >,\n ): void;\n getPermissionRuleset<TResource, TQuery, TResourceType extends string>(\n resourceRef: PermissionResourceRef<TResource, TQuery, TResourceType>,\n ): PermissionRuleset<TResource, TQuery, TResourceType>;\n} {\n const store = new PermissionIntegrationMetadataStore();\n\n if (options) {\n if ('resources' in options) {\n // Not technically allowed by types, but it's historically been covered by tests\n if ('permissions' in options) {\n store.addPermissions(options.permissions as Permission[]);\n }\n\n for (const resource of options.resources) {\n store.addResourceType(resource);\n }\n } else if ('resourceType' in options) {\n store.addResourceType(options);\n } else {\n store.addPermissions(options.permissions);\n }\n }\n\n const router = Router();\n\n router.use('/.well-known/backstage/permissions/', express.json());\n\n router.get('/.well-known/backstage/permissions/metadata', (_, res) => {\n res.json(store.getSerializedMetadata());\n });\n\n router.post(\n '/.well-known/backstage/permissions/apply-conditions',\n async (req, res: Response<ApplyConditionsResponse>) => {\n const parseResult = applyConditionsRequestSchema.safeParse(req.body);\n if (!parseResult.success) {\n throw new InputError(parseResult.error.toString());\n }\n\n const { items: requests } = parseResult.data;\n\n const invalidResourceTypes = requests.filter(\n i => !store.hasResourceType(i.resourceType),\n );\n if (invalidResourceTypes.length) {\n throw new InputError(\n `Unexpected resource types: ${invalidResourceTypes\n .map(i => i.resourceType)\n .join(', ')}.`,\n );\n }\n\n const resourcesByType: Record<string, Record<string, any>> = {};\n for (const requestedType of new Set(requests.map(i => i.resourceType))) {\n resourcesByType[requestedType] = await store.getResources(\n requestedType,\n requests\n .filter(r => r.resourceType === requestedType)\n .map(i => i.resourceRef)\n .flat(),\n );\n }\n\n res.json({\n items: requests.map(request => ({\n id: request.id,\n result: Array.isArray(request.resourceRef)\n ? request.resourceRef.map(resourceRef =>\n authorizeResult(\n request.conditions,\n resourcesByType[request.resourceType][resourceRef],\n store.getRuleMapper(request.resourceType),\n ),\n )\n : authorizeResult(\n request.conditions,\n resourcesByType[request.resourceType][request.resourceRef],\n store.getRuleMapper(request.resourceType),\n ),\n })),\n });\n },\n );\n\n return Object.assign(router, {\n addPermissions(permissions: Permission[]) {\n store.addPermissions(permissions);\n },\n addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]) {\n store.addPermissionRules(rules);\n },\n addResourceType<const TResourceType extends string, TResource>(\n resource: CreatePermissionIntegrationRouterResourceOptions<\n TResourceType,\n TResource\n >,\n ) {\n store.addResourceType(resource);\n },\n getPermissionRuleset<TResource, TQuery, TResourceType extends string>(\n resourceRef: PermissionResourceRef<TResource, TQuery, TResourceType>,\n ): PermissionRuleset<TResource, TQuery, TResourceType> {\n return {\n getRuleByName: store.getRuleMapper(resourceRef.resourceType),\n } as PermissionRuleset<TResource, TQuery, TResourceType>;\n },\n });\n}\n"],"names":["z","isAndCriteria","isOrCriteria","isNotCriteria","InputError","AuthorizeResult","createGetRule","NotImplementedError","zodToJsonSchema","Router","express"],"mappings":";;;;;;;;;;;;;;;;AA0CA,MAAM,2BAEFA,KAAE,CAAA,IAAA;AAAA,EAAK,MACTA,MAAE,KAAM,CAAA;AAAA,IACNA,KAAA,CAAE,MAAO,CAAA,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAS,EAAA,EAAG,CAAA;AAAA,IAChEA,KAAA,CAAE,MAAO,CAAA,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAS,EAAA,EAAG,CAAA;AAAA,IAChEA,KAAE,CAAA,MAAA,CAAO,EAAE,GAAA,EAAK,0BAA0B,CAAA;AAAA,IAC1CA,MAAE,MAAO,CAAA;AAAA,MACP,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,MACf,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,MACvB,QAAQA,KAAE,CAAA,MAAA,CAAOA,MAAE,GAAI,EAAC,EAAE,QAAS;AAAA,KACpC;AAAA,GACF;AACH,CAAA;AAEA,MAAM,4BAAA,GAA+BA,MAAE,MAAO,CAAA;AAAA,EAC5C,OAAOA,KAAE,CAAA,KAAA;AAAA,IACPA,MAAE,MAAO,CAAA;AAAA,MACP,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,MACb,WAAa,EAAAA,KAAA,CAAE,KAAM,CAAA,CAACA,MAAE,MAAO,EAAA,EAAGA,KAAE,CAAA,KAAA,CAAMA,MAAE,MAAO,EAAC,CAAE,CAAA,QAAA,EAAU,CAAC,CAAA;AAAA,MACjE,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,MACvB,UAAY,EAAA;AAAA,KACb;AAAA;AAEL,CAAC,CAAA;AA+DD,MAAM,eAAkB,GAAA,CACtB,QACA,EAAA,QAAA,EACA,OACY,KAAA;AAIZ,EAAA,IAAI,aAAa,KAAW,CAAA,EAAA;AAC1B,IAAO,OAAA,KAAA;AAAA;AAGT,EAAI,IAAAC,kBAAA,CAAc,QAAQ,CAAG,EAAA;AAC3B,IAAA,OAAO,SAAS,KAAM,CAAA,KAAA;AAAA,MAAM,CAC1B,KAAA,KAAA,eAAA,CAAgB,KAAO,EAAA,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,GACF,MAAA,IAAWC,iBAAa,CAAA,QAAQ,CAAG,EAAA;AACjC,IAAA,OAAO,SAAS,KAAM,CAAA,IAAA;AAAA,MAAK,CACzB,KAAA,KAAA,eAAA,CAAgB,KAAO,EAAA,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,GACF,MAAA,IAAWC,kBAAc,CAAA,QAAQ,CAAG,EAAA;AAClC,IAAA,OAAO,CAAC,eAAA,CAAgB,QAAS,CAAA,GAAA,EAAK,UAAU,OAAO,CAAA;AAAA;AAGzD,EAAM,MAAA,IAAA,GAAO,OAAQ,CAAA,QAAA,CAAS,IAAI,CAAA;AAClC,EAAA,MAAM,MAAS,GAAA,IAAA,CAAK,YAAc,EAAA,SAAA,CAAU,SAAS,MAAM,CAAA;AAE3D,EAAI,IAAA,MAAA,IAAU,CAAC,MAAA,CAAO,OAAS,EAAA;AAC7B,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAkC,8BAAA,CAAA,EAAA,MAAA,CAAO,KAAK,CAAA;AAAA;AAGrE,EAAA,OAAO,KAAK,KAAM,CAAA,QAAA,EAAU,QAAS,CAAA,MAAA,IAAU,EAAE,CAAA;AACnD,CAAA;AAEA,SAAS,eAAA,CACP,QACA,EAAA,QAAA,EACA,OACA,EAAA;AACA,EAAA,OAAO,gBAAgB,QAAU,EAAA,QAAA,EAAU,OAAO,CAC9C,GAAAC,sCAAA,CAAgB,QAChBA,sCAAgB,CAAA,IAAA;AACtB;AAkBO,SAAS,0BACd,KAGwE,EAAA;AACxE,EAAM,MAAA,OAAA,GACJ,eAAmB,IAAA,KAAA,GACf,CAAC,CAAA,KAAc,MAAM,aAAc,CAAA,CAAC,CACpC,GAAAC,kBAAA,CAAc,KAAK,CAAA;AAEzB,EAAO,OAAA,CACL,UACA,QACY,KAAA;AACZ,IAAI,IAAA,QAAA,CAAS,MAAW,KAAAD,sCAAA,CAAgB,WAAa,EAAA;AACnD,MAAA,OAAO,eAAgB,CAAA,QAAA,CAAS,UAAY,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA;AAG/D,IAAO,OAAA,QAAA,CAAS,WAAWA,sCAAgB,CAAA,KAAA;AAAA,GAC7C;AACF;AA0EA,MAAM,kCAAmC,CAAA;AAAA,EAC9B,kBAAA,uBAAyB,GAGhC,EAAA;AAAA,EACO,kBAAA,uBAAyB,GAAwB,EAAA;AAAA,EACjD,gBAAA,uBAAuB,GAG9B,EAAA;AAAA,EACO,gBAAA,GAAmB,IAAI,KAAsC,EAAA;AAAA,EAEtE,qBAA0C,GAAA;AACxC,IAAO,OAAA;AAAA,MACL,aAAa,KAAM,CAAA,IAAA,CAAK,IAAK,CAAA,kBAAA,CAAmB,QAAQ,CAAA;AAAA,MACxD,OAAO,IAAK,CAAA;AAAA,KACd;AAAA;AACF,EAEA,gBAAgB,IAAuB,EAAA;AACrC,IAAO,OAAA,IAAA,CAAK,gBAAiB,CAAA,GAAA,CAAI,IAAI,CAAA;AAAA;AACvC,EAEA,MAAM,YACJ,CAAA,YAAA,EACA,IACkC,EAAA;AAClC,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,gBAAiB,CAAA,GAAA,CAAI,YAAY,CAAA;AACvD,IAAI,IAAA,CAAC,UAAU,YAAc,EAAA;AAC3B,MAAA,MAAM,IAAIE,0BAAA;AAAA,QACR,gGAAgG,YAAY,CAAA;AAAA,OAC9G;AAAA;AAGF,IAAA,MAAM,aAAa,KAAM,CAAA,IAAA,CAAK,IAAI,GAAA,CAAI,IAAI,CAAC,CAAA;AAC3C,IAAA,MAAM,SAAY,GAAA,MAAM,QAAS,CAAA,YAAA,CAAa,UAAU,CAAA;AACxD,IAAA,OAAO,MAAO,CAAA,WAAA;AAAA,MACZ,UAAA,CAAW,GAAI,CAAA,CAAC,GAAK,EAAA,KAAA,KAAU,CAAC,GAAK,EAAA,SAAA,CAAU,KAAK,CAAC,CAAC;AAAA,KACxD;AAAA;AACF,EAEA,cAAc,YAAsB,EAAA;AAClC,IAAA,OAAO,CAAC,IAA2D,KAAA;AACjE,MAAA,MAAM,OAAO,IAAK,CAAA,kBAAA,CAAmB,IAAI,YAAY,CAAA,EAAG,IAAI,IAAI,CAAA;AAChE,MAAA,IAAI,CAAC,IAAM,EAAA;AACT,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,iBAAA,EAAoB,IAAI,CAAA,oCAAA,EAAuC,YAAY,CAAA,CAAA;AAAA,SAC7E;AAAA;AAEF,MAAO,OAAA,IAAA;AAAA,KACT;AAAA;AACF,EAEA,eAAe,WAA2B,EAAA;AACxC,IAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AAEpC,MAAA,IAAA,CAAK,kBAAmB,CAAA,GAAA,CAAI,UAAW,CAAA,IAAA,EAAM,UAAU,CAAA;AAAA;AACzD;AACF,EAEA,mBAAmB,KAAmD,EAAA;AACpE,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAM,MAAA,WAAA,GACJ,KAAK,kBAAmB,CAAA,GAAA,CAAI,KAAK,YAAY,CAAA,wBAAS,GAAI,EAAA;AAC5D,MAAA,IAAA,CAAK,kBAAmB,CAAA,GAAA,CAAI,IAAK,CAAA,YAAA,EAAc,WAAW,CAAA;AAE1D,MAAA,IAAI,WAAY,CAAA,GAAA,CAAI,IAAK,CAAA,IAAI,CAAG,EAAA;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAA4C,yCAAA,EAAA,IAAA,CAAK,YAAY,CAAA,aAAA,EAAgB,KAAK,IAAI,CAAA,2BAAA;AAAA,SACxF;AAAA;AAEF,MAAY,WAAA,CAAA,GAAA,CAAI,IAAK,CAAA,IAAA,EAAM,IAAI,CAAA;AAE/B,MAAA,IAAA,CAAK,iBAAiB,IAAK,CAAA;AAAA,QACzB,MAAM,IAAK,CAAA,IAAA;AAAA,QACX,aAAa,IAAK,CAAA,WAAA;AAAA,QAClB,cAAc,IAAK,CAAA,YAAA;AAAA,QACnB,YAAA,EAAcC,iCAAgB,IAAK,CAAA,YAAA,IAAgBR,MAAE,MAAO,CAAA,EAAE,CAAC;AAAA,OAChE,CAAA;AAAA;AACH;AACF,EAEA,gBACE,QACA,EAAA;AACA,IAAM,MAAA,EAAE,cAAiB,GAAA,QAAA;AAEzB,IAAA,IAAI,IAAK,CAAA,gBAAA,CAAiB,GAAI,CAAA,YAAY,CAAG,EAAA;AAC3C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iDAAiD,YAAY,CAAA,2BAAA;AAAA,OAC/D;AAAA;AAEF,IAAK,IAAA,CAAA,gBAAA,CAAiB,GAAI,CAAA,YAAA,EAAc,QAAQ,CAAA;AAEhD,IAAA,IAAI,SAAS,KAAO,EAAA;AAClB,MAAK,IAAA,CAAA,kBAAA,CAAmB,SAAS,KAAK,CAAA;AAAA;AAGxC,IAAA,IAAI,SAAS,WAAa,EAAA;AACxB,MAAK,IAAA,CAAA,cAAA,CAAe,SAAS,WAAW,CAAA;AAAA;AAC1C;AAEJ;AA4CO,SAAS,kCAQd,OA0BA,EAAA;AACA,EAAM,MAAA,KAAA,GAAQ,IAAI,kCAAmC,EAAA;AAErD,EAAA,IAAI,OAAS,EAAA;AACX,IAAA,IAAI,eAAe,OAAS,EAAA;AAE1B,MAAA,IAAI,iBAAiB,OAAS,EAAA;AAC5B,QAAM,KAAA,CAAA,cAAA,CAAe,QAAQ,WAA2B,CAAA;AAAA;AAG1D,MAAW,KAAA,MAAA,QAAA,IAAY,QAAQ,SAAW,EAAA;AACxC,QAAA,KAAA,CAAM,gBAAgB,QAAQ,CAAA;AAAA;AAChC,KACF,MAAA,IAAW,kBAAkB,OAAS,EAAA;AACpC,MAAA,KAAA,CAAM,gBAAgB,OAAO,CAAA;AAAA,KACxB,MAAA;AACL,MAAM,KAAA,CAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAAA;AAC1C;AAGF,EAAA,MAAM,SAASS,uBAAO,EAAA;AAEtB,EAAA,MAAA,CAAO,GAAI,CAAA,qCAAA,EAAuCC,wBAAQ,CAAA,IAAA,EAAM,CAAA;AAEhE,EAAA,MAAA,CAAO,GAAI,CAAA,6CAAA,EAA+C,CAAC,CAAA,EAAG,GAAQ,KAAA;AACpE,IAAI,GAAA,CAAA,IAAA,CAAK,KAAM,CAAA,qBAAA,EAAuB,CAAA;AAAA,GACvC,CAAA;AAED,EAAO,MAAA,CAAA,IAAA;AAAA,IACL,qDAAA;AAAA,IACA,OAAO,KAAK,GAA2C,KAAA;AACrD,MAAA,MAAM,WAAc,GAAA,4BAAA,CAA6B,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACnE,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIN,iBAAA,CAAW,WAAY,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAGnD,MAAA,MAAM,EAAE,KAAA,EAAO,QAAS,EAAA,GAAI,WAAY,CAAA,IAAA;AAExC,MAAA,MAAM,uBAAuB,QAAS,CAAA,MAAA;AAAA,QACpC,CAAK,CAAA,KAAA,CAAC,KAAM,CAAA,eAAA,CAAgB,EAAE,YAAY;AAAA,OAC5C;AACA,MAAA,IAAI,qBAAqB,MAAQ,EAAA;AAC/B,QAAA,MAAM,IAAIA,iBAAA;AAAA,UACR,CAAA,2BAAA,EAA8B,qBAC3B,GAAI,CAAA,CAAA,CAAA,KAAK,EAAE,YAAY,CAAA,CACvB,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,SACf;AAAA;AAGF,MAAA,MAAM,kBAAuD,EAAC;AAC9D,MAAW,KAAA,MAAA,aAAA,IAAiB,IAAI,GAAI,CAAA,QAAA,CAAS,IAAI,CAAK,CAAA,KAAA,CAAA,CAAE,YAAY,CAAC,CAAG,EAAA;AACtE,QAAgB,eAAA,CAAA,aAAa,CAAI,GAAA,MAAM,KAAM,CAAA,YAAA;AAAA,UAC3C,aAAA;AAAA,UACA,QACG,CAAA,MAAA,CAAO,CAAK,CAAA,KAAA,CAAA,CAAE,YAAiB,KAAA,aAAa,CAC5C,CAAA,GAAA,CAAI,CAAK,CAAA,KAAA,CAAA,CAAE,WAAW,CAAA,CACtB,IAAK;AAAA,SACV;AAAA;AAGF,MAAA,GAAA,CAAI,IAAK,CAAA;AAAA,QACP,KAAA,EAAO,QAAS,CAAA,GAAA,CAAI,CAAY,OAAA,MAAA;AAAA,UAC9B,IAAI,OAAQ,CAAA,EAAA;AAAA,UACZ,QAAQ,KAAM,CAAA,OAAA,CAAQ,QAAQ,WAAW,CAAA,GACrC,QAAQ,WAAY,CAAA,GAAA;AAAA,YAAI,CACtB,WAAA,KAAA,eAAA;AAAA,cACE,OAAQ,CAAA,UAAA;AAAA,cACR,eAAgB,CAAA,OAAA,CAAQ,YAAY,CAAA,CAAE,WAAW,CAAA;AAAA,cACjD,KAAA,CAAM,aAAc,CAAA,OAAA,CAAQ,YAAY;AAAA;AAC1C,WAEF,GAAA,eAAA;AAAA,YACE,OAAQ,CAAA,UAAA;AAAA,YACR,eAAgB,CAAA,OAAA,CAAQ,YAAY,CAAA,CAAE,QAAQ,WAAW,CAAA;AAAA,YACzD,KAAA,CAAM,aAAc,CAAA,OAAA,CAAQ,YAAY;AAAA;AAC1C,SACJ,CAAA;AAAA,OACH,CAAA;AAAA;AACH,GACF;AAEA,EAAO,OAAA,MAAA,CAAO,OAAO,MAAQ,EAAA;AAAA,IAC3B,eAAe,WAA2B,EAAA;AACxC,MAAA,KAAA,CAAM,eAAe,WAAW,CAAA;AAAA,KAClC;AAAA,IACA,mBAAmB,KAAmD,EAAA;AACpE,MAAA,KAAA,CAAM,mBAAmB,KAAK,CAAA;AAAA,KAChC;AAAA,IACA,gBACE,QAIA,EAAA;AACA,MAAA,KAAA,CAAM,gBAAgB,QAAQ,CAAA;AAAA,KAChC;AAAA,IACA,qBACE,WACqD,EAAA;AACrD,MAAO,OAAA;AAAA,QACL,aAAe,EAAA,KAAA,CAAM,aAAc,CAAA,WAAA,CAAY,YAAY;AAAA,OAC7D;AAAA;AACF,GACD,CAAA;AACH;;;;;"}
1
+ {"version":3,"file":"createPermissionIntegrationRouter.cjs.js","sources":["../../src/integration/createPermissionIntegrationRouter.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express, { Response } from 'express';\nimport Router from 'express-promise-router';\nimport { z } from 'zod';\nimport zodToJsonSchema from 'zod-to-json-schema';\nimport { InputError } from '@backstage/errors';\nimport {\n AuthorizeResult,\n DefinitivePolicyDecision,\n IdentifiedPermissionMessage,\n MetadataResponse as CommonMetadataResponse,\n MetadataResponseSerializedRule as CommonMetadataResponseSerializedRule,\n Permission,\n PermissionCondition,\n PermissionCriteria,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport { NoInfer, PermissionRule, PermissionRuleset } from '../types';\nimport {\n createGetRule,\n isAndCriteria,\n isNotCriteria,\n isOrCriteria,\n} from './util';\nimport { NotImplementedError } from '@backstage/errors';\nimport { PermissionResourceRef } from './createPermissionResourceRef';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n z.union([\n z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }),\n z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }),\n z.object({ not: permissionCriteriaSchema }),\n z.object({\n rule: z.string(),\n resourceType: z.string(),\n params: z.record(z.any()).optional(),\n }),\n ]),\n);\n\nconst applyConditionsRequestSchema = z.object({\n items: z.array(\n z.object({\n id: z.string(),\n resourceRef: z.union([z.string(), z.array(z.string()).nonempty()]),\n resourceType: z.string(),\n conditions: permissionCriteriaSchema,\n }),\n ),\n});\n\n/**\n * A request to load the referenced resource and apply conditions in order to\n * finalize a conditional authorization response.\n *\n * @public\n */\nexport type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{\n resourceRef: string | string[];\n resourceType: string;\n conditions: PermissionCriteria<PermissionCondition>;\n}>;\n\n/**\n * A batch of {@link ApplyConditionsRequestEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsRequest = {\n items: ApplyConditionsRequestEntry[];\n};\n\n/**\n * The result of applying the conditions, expressed as a definitive authorize\n * result of ALLOW or DENY.\n *\n * @public\n */\nexport type ApplyConditionsResponseEntry = IdentifiedPermissionMessage<\n | DefinitivePolicyDecision\n | {\n result: Array<AuthorizeResult.ALLOW | AuthorizeResult.DENY>;\n }\n>;\n\n/**\n * A batch of {@link ApplyConditionsResponseEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsResponse = {\n items: ApplyConditionsResponseEntry[];\n};\n\n/**\n * Serialized permission rules, with the paramsSchema\n * converted from a ZodSchema to a JsonSchema.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponseSerializedRule =\n CommonMetadataResponseSerializedRule;\n\n/**\n * Response type for the .metadata endpoint.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponse = CommonMetadataResponse;\n\nconst applyConditions = <TResourceType extends string, TResource>(\n criteria: PermissionCriteria<PermissionCondition<TResourceType>>,\n resource: TResource | undefined,\n getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,\n): boolean => {\n // If resource was not found, deny. This avoids leaking information from the\n // apply-conditions API which would allow a user to differentiate between\n // non-existent resources and resources to which they do not have access.\n if (resource === undefined) {\n return false;\n }\n\n if (isAndCriteria(criteria)) {\n return criteria.allOf.every(child =>\n applyConditions(child, resource, getRule),\n );\n } else if (isOrCriteria(criteria)) {\n return criteria.anyOf.some(child =>\n applyConditions(child, resource, getRule),\n );\n } else if (isNotCriteria(criteria)) {\n return !applyConditions(criteria.not, resource, getRule);\n }\n\n const rule = getRule(criteria.rule);\n const result = rule.paramsSchema?.safeParse(criteria.params);\n\n if (result && !result.success) {\n throw new InputError(`Parameters to rule are invalid`, result.error);\n }\n\n return rule.apply(resource, criteria.params ?? {});\n};\n\nfunction authorizeResult<TResourceType extends string, TResource>(\n criteria: PermissionCriteria<PermissionCondition<TResourceType>>,\n resource: TResource | undefined,\n getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,\n) {\n return applyConditions(criteria, resource, getRule)\n ? AuthorizeResult.ALLOW\n : AuthorizeResult.DENY;\n}\n\n/**\n * Takes some permission conditions and returns a definitive authorization result\n * on the resource to which they apply.\n *\n * @public\n */\nexport function createConditionAuthorizer<TResource>(\n permissionRuleset: PermissionRuleset<TResource>,\n): (decision: PolicyDecision, resource: TResource | undefined) => boolean;\n/**\n * @public\n * @deprecated Use the version of `createConditionAuthorizer` that accepts a `PermissionRuleset` instead.\n */\nexport function createConditionAuthorizer<TResource, TQuery>(\n rules: PermissionRule<TResource, TQuery, string>[],\n): (decision: PolicyDecision, resource: TResource | undefined) => boolean;\nexport function createConditionAuthorizer<TResource, TQuery>(\n rules:\n | PermissionRule<TResource, TQuery, string>[]\n | PermissionRuleset<TResource>,\n): (decision: PolicyDecision, resource: TResource | undefined) => boolean {\n const getRule =\n 'getRuleByName' in rules\n ? (n: string) => rules.getRuleByName(n)\n : createGetRule(rules);\n\n return (\n decision: PolicyDecision,\n resource: TResource | undefined,\n ): boolean => {\n if (decision.result === AuthorizeResult.CONDITIONAL) {\n return applyConditions(decision.conditions, resource, getRule);\n }\n\n return decision.result === AuthorizeResult.ALLOW;\n };\n}\n\n/**\n * Options for creating a permission integration router specific\n * for a particular resource type.\n *\n * @public\n * @deprecated {@link createPermissionIntegrationRouter} is deprecated\n */\nexport type CreatePermissionIntegrationRouterResourceOptions<\n TResourceType extends string,\n TResource,\n> = {\n resourceType: TResourceType;\n permissions?: Array<Permission>;\n // Do not infer value of TResourceType from supplied rules.\n // instead only consider the resourceType parameter, and\n // consider any rules whose resource type does not match\n // to be an error.\n rules: PermissionRule<TResource, any, NoInfer<TResourceType>>[];\n getResources?: (\n resourceRefs: string[],\n ) => Promise<Array<TResource | undefined>>;\n};\n\n/**\n * Options for creating a permission integration router exposing\n * permissions and rules from multiple resource types.\n *\n * @public\n * @deprecated {@link createPermissionIntegrationRouter} is deprecated\n */\nexport type PermissionIntegrationRouterOptions<\n TResourceType1 extends string = string,\n TResource1 = any,\n TResourceType2 extends string = string,\n TResource2 = any,\n TResourceType3 extends string = string,\n TResource3 = any,\n> = {\n resources: Readonly<\n | [\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >,\n ]\n | [\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >,\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType2,\n TResource2\n >,\n ]\n | [\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >,\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType2,\n TResource2\n >,\n CreatePermissionIntegrationRouterResourceOptions<\n TResourceType3,\n TResource3\n >,\n ]\n >;\n};\n\nclass PermissionIntegrationMetadataStore {\n readonly #rulesByTypeByName = new Map<\n string,\n Map<string, PermissionRule<unknown, unknown, string>>\n >();\n readonly #permissionsByName = new Map<string, Permission>();\n readonly #resourcesByType = new Map<\n string,\n CreatePermissionIntegrationRouterResourceOptions<string, unknown>\n >();\n readonly #serializedRules = new Array<MetadataResponseSerializedRule>();\n\n getSerializedMetadata(): MetadataResponse {\n return {\n permissions: Array.from(this.#permissionsByName.values()),\n rules: this.#serializedRules,\n };\n }\n\n hasResourceType(type: string): boolean {\n return this.#resourcesByType.has(type);\n }\n\n async getResources(\n resourceType: string,\n refs: string[],\n ): Promise<Record<string, unknown>> {\n const resource = this.#resourcesByType.get(resourceType);\n if (!resource?.getResources) {\n throw new NotImplementedError(\n `This plugin does not expose any permission rule or can't evaluate the conditions request for ${resourceType}`,\n );\n }\n\n const uniqueRefs = Array.from(new Set(refs));\n const resources = await resource.getResources(uniqueRefs);\n return Object.fromEntries(\n uniqueRefs.map((ref, index) => [ref, resources[index]]),\n );\n }\n\n getRuleMapper(resourceType: string) {\n return (name: string): PermissionRule<unknown, unknown, string> => {\n const rule = this.#rulesByTypeByName.get(resourceType)?.get(name);\n if (!rule) {\n throw new Error(\n `Permission rule '${name}' does not exist for resource type '${resourceType}'`,\n );\n }\n return rule;\n };\n }\n\n addPermissions(permissions: Permission[]) {\n for (const permission of permissions) {\n // Permission naming conflicts are silently ignored\n this.#permissionsByName.set(permission.name, permission);\n }\n }\n\n addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]) {\n for (const rule of rules) {\n const rulesByName =\n this.#rulesByTypeByName.get(rule.resourceType) ?? new Map();\n this.#rulesByTypeByName.set(rule.resourceType, rulesByName);\n\n if (rulesByName.has(rule.name)) {\n throw new Error(\n `Refused to add permission rule for type '${rule.resourceType}' with name '${rule.name}' because it already exists`,\n );\n }\n rulesByName.set(rule.name, rule);\n\n this.#serializedRules.push({\n name: rule.name,\n description: rule.description,\n resourceType: rule.resourceType,\n paramsSchema: zodToJsonSchema(rule.paramsSchema ?? z.object({})),\n });\n }\n }\n\n addResourceType(\n resource: CreatePermissionIntegrationRouterResourceOptions<string, unknown>,\n ) {\n const { resourceType } = resource;\n\n if (this.#resourcesByType.has(resourceType)) {\n throw new Error(\n `Refused to add permission resource with type '${resourceType}' because it already exists`,\n );\n }\n this.#resourcesByType.set(resourceType, resource);\n\n if (resource.rules) {\n this.addPermissionRules(resource.rules);\n }\n\n if (resource.permissions) {\n this.addPermissions(resource.permissions);\n }\n }\n}\n\n/**\n * Create an express Router which provides an authorization route to allow\n * integration between the permission backend and other Backstage backend\n * plugins. Plugin owners that wish to support conditional authorization for\n * their resources should add the router created by this function to their\n * express app inside their `createRouter` implementation.\n *\n * In case the `permissions` option is provided, the router also\n * provides a route that exposes permissions and routes of a plugin.\n *\n * In case resources is provided, the routes can handle permissions\n * for multiple resource types.\n *\n * @remarks\n *\n * To make this concrete, we can use the Backstage software catalog as an\n * example. The catalog has conditional rules around access to specific\n * _entities_ in the catalog. The _type_ of resource is captured here as\n * `resourceType`, a string identifier (`catalog-entity` in this example) that\n * can be provided with permission definitions. This is merely a _type_ to\n * verify that conditions in an authorization policy are constructed correctly,\n * not a reference to a specific resource.\n *\n * The `rules` parameter is an array of {@link PermissionRule}s that introduce\n * conditional filtering logic for resources; for the catalog, these are things\n * like `isEntityOwner` or `hasAnnotation`. Rules describe how to filter a list\n * of resources, and the `conditions` returned allow these rules to be applied\n * with specific parameters (such as 'group:default/team-a', or\n * 'backstage.io/edit-url').\n *\n * The `getResources` argument should load resources based on a reference\n * identifier. For the catalog, this is an\n * {@link @backstage/catalog-model#EntityRef}. For other plugins, this can be\n * any serialized format. This is used to construct the\n * `createPermissionIntegrationRouter`, a function to add an authorization route\n * to your backend plugin. This function will be called by the\n * `permission-backend` when authorization conditions relating to this plugin\n * need to be evaluated.\n *\n * @public\n * @deprecated use `PermissionRegistryService` instead, see {@link https://backstage.io/docs/backend-system/core-services/permissions-registry#migrating-from-createpermissionintegrationrouter | the migration section in the service docs} for more details.\n */\nexport function createPermissionIntegrationRouter<\n TResourceType1 extends string,\n TResource1,\n TResourceType2 extends string,\n TResource2,\n TResourceType3 extends string,\n TResource3,\n>(\n options?:\n | { permissions: Array<Permission> }\n | CreatePermissionIntegrationRouterResourceOptions<\n TResourceType1,\n TResource1\n >\n | PermissionIntegrationRouterOptions<\n TResourceType1,\n TResource1,\n TResourceType2,\n TResource2,\n TResourceType3,\n TResource3\n >,\n): express.Router & {\n addPermissions(permissions: Permission[]): void;\n addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]): void;\n addResourceType<const TResourceType extends string, TResource>(\n resource: CreatePermissionIntegrationRouterResourceOptions<\n TResourceType,\n TResource\n >,\n ): void;\n getPermissionRuleset<TResource, TQuery, TResourceType extends string>(\n resourceRef: PermissionResourceRef<TResource, TQuery, TResourceType>,\n ): PermissionRuleset<TResource, TQuery, TResourceType>;\n} {\n const store = new PermissionIntegrationMetadataStore();\n\n if (options) {\n if ('resources' in options) {\n // Not technically allowed by types, but it's historically been covered by tests\n if ('permissions' in options) {\n store.addPermissions(options.permissions as Permission[]);\n }\n\n for (const resource of options.resources) {\n store.addResourceType(resource);\n }\n } else if ('resourceType' in options) {\n store.addResourceType(options);\n } else {\n store.addPermissions(options.permissions);\n }\n }\n\n const router = Router();\n\n router.use('/.well-known/backstage/permissions/', express.json());\n\n router.get('/.well-known/backstage/permissions/metadata', (_, res) => {\n res.json(store.getSerializedMetadata());\n });\n\n router.post(\n '/.well-known/backstage/permissions/apply-conditions',\n async (req, res: Response<ApplyConditionsResponse>) => {\n const parseResult = applyConditionsRequestSchema.safeParse(req.body);\n if (!parseResult.success) {\n throw new InputError(parseResult.error.toString());\n }\n\n const { items: requests } = parseResult.data;\n\n const invalidResourceTypes = requests.filter(\n i => !store.hasResourceType(i.resourceType),\n );\n if (invalidResourceTypes.length) {\n throw new InputError(\n `Unexpected resource types: ${invalidResourceTypes\n .map(i => i.resourceType)\n .join(', ')}.`,\n );\n }\n\n const resourcesByType: Record<string, Record<string, any>> = {};\n for (const requestedType of new Set(requests.map(i => i.resourceType))) {\n resourcesByType[requestedType] = await store.getResources(\n requestedType,\n requests\n .filter(r => r.resourceType === requestedType)\n .map(i => i.resourceRef)\n .flat(),\n );\n }\n\n res.json({\n items: requests.map(request => ({\n id: request.id,\n result: Array.isArray(request.resourceRef)\n ? request.resourceRef.map(resourceRef =>\n authorizeResult(\n request.conditions,\n resourcesByType[request.resourceType][resourceRef],\n store.getRuleMapper(request.resourceType),\n ),\n )\n : authorizeResult(\n request.conditions,\n resourcesByType[request.resourceType][request.resourceRef],\n store.getRuleMapper(request.resourceType),\n ),\n })),\n });\n },\n );\n\n return Object.assign(router, {\n addPermissions(permissions: Permission[]) {\n store.addPermissions(permissions);\n },\n addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]) {\n store.addPermissionRules(rules);\n },\n addResourceType<const TResourceType extends string, TResource>(\n resource: CreatePermissionIntegrationRouterResourceOptions<\n TResourceType,\n TResource\n >,\n ) {\n store.addResourceType(resource);\n },\n getPermissionRuleset<TResource, TQuery, TResourceType extends string>(\n resourceRef: PermissionResourceRef<TResource, TQuery, TResourceType>,\n ): PermissionRuleset<TResource, TQuery, TResourceType> {\n return {\n getRuleByName: store.getRuleMapper(resourceRef.resourceType),\n } as PermissionRuleset<TResource, TQuery, TResourceType>;\n },\n });\n}\n"],"names":["z","isAndCriteria","isOrCriteria","isNotCriteria","InputError","AuthorizeResult","createGetRule","NotImplementedError","zodToJsonSchema","Router","express"],"mappings":";;;;;;;;;;;;;;;;AA0CA,MAAM,2BAEFA,KAAA,CAAE,IAAA;AAAA,EAAK,MACTA,MAAE,KAAA,CAAM;AAAA,IACNA,KAAA,CAAE,MAAA,CAAO,EAAE,KAAA,EAAOA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAA,EAAS,EAAG,CAAA;AAAA,IAChEA,KAAA,CAAE,MAAA,CAAO,EAAE,KAAA,EAAOA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAA,EAAS,EAAG,CAAA;AAAA,IAChEA,KAAA,CAAE,MAAA,CAAO,EAAE,GAAA,EAAK,0BAA0B,CAAA;AAAA,IAC1CA,MAAE,MAAA,CAAO;AAAA,MACP,IAAA,EAAMA,MAAE,MAAA,EAAO;AAAA,MACf,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,MACvB,QAAQA,KAAA,CAAE,MAAA,CAAOA,MAAE,GAAA,EAAK,EAAE,QAAA;AAAS,KACpC;AAAA,GACF;AACH,CAAA;AAEA,MAAM,4BAAA,GAA+BA,MAAE,MAAA,CAAO;AAAA,EAC5C,OAAOA,KAAA,CAAE,KAAA;AAAA,IACPA,MAAE,MAAA,CAAO;AAAA,MACP,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,MACb,WAAA,EAAaA,KAAA,CAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,EAAGA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAU,CAAC,CAAA;AAAA,MACjE,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,MACvB,UAAA,EAAY;AAAA,KACb;AAAA;AAEL,CAAC,CAAA;AA+DD,MAAM,eAAA,GAAkB,CACtB,QAAA,EACA,QAAA,EACA,OAAA,KACY;AAIZ,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAIC,kBAAA,CAAc,QAAQ,CAAA,EAAG;AAC3B,IAAA,OAAO,SAAS,KAAA,CAAM,KAAA;AAAA,MAAM,CAAA,KAAA,KAC1B,eAAA,CAAgB,KAAA,EAAO,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,EACF,CAAA,MAAA,IAAWC,iBAAA,CAAa,QAAQ,CAAA,EAAG;AACjC,IAAA,OAAO,SAAS,KAAA,CAAM,IAAA;AAAA,MAAK,CAAA,KAAA,KACzB,eAAA,CAAgB,KAAA,EAAO,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,EACF,CAAA,MAAA,IAAWC,kBAAA,CAAc,QAAQ,CAAA,EAAG;AAClC,IAAA,OAAO,CAAC,eAAA,CAAgB,QAAA,CAAS,GAAA,EAAK,UAAU,OAAO,CAAA;AAAA,EACzD;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,QAAA,CAAS,IAAI,CAAA;AAClC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,CAAU,SAAS,MAAM,CAAA;AAE3D,EAAA,IAAI,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAA,8BAAA,CAAA,EAAkC,MAAA,CAAO,KAAK,CAAA;AAAA,EACrE;AAEA,EAAA,OAAO,KAAK,KAAA,CAAM,QAAA,EAAU,QAAA,CAAS,MAAA,IAAU,EAAE,CAAA;AACnD,CAAA;AAEA,SAAS,eAAA,CACP,QAAA,EACA,QAAA,EACA,OAAA,EACA;AACA,EAAA,OAAO,gBAAgB,QAAA,EAAU,QAAA,EAAU,OAAO,CAAA,GAC9CC,sCAAA,CAAgB,QAChBA,sCAAA,CAAgB,IAAA;AACtB;AAkBO,SAAS,0BACd,KAAA,EAGwE;AACxE,EAAA,MAAM,OAAA,GACJ,eAAA,IAAmB,KAAA,GACf,CAAC,CAAA,KAAc,MAAM,aAAA,CAAc,CAAC,CAAA,GACpCC,kBAAA,CAAc,KAAK,CAAA;AAEzB,EAAA,OAAO,CACL,UACA,QAAA,KACY;AACZ,IAAA,IAAI,QAAA,CAAS,MAAA,KAAWD,sCAAA,CAAgB,WAAA,EAAa;AACnD,MAAA,OAAO,eAAA,CAAgB,QAAA,CAAS,UAAA,EAAY,QAAA,EAAU,OAAO,CAAA;AAAA,IAC/D;AAEA,IAAA,OAAO,QAAA,CAAS,WAAWA,sCAAA,CAAgB,KAAA;AAAA,EAC7C,CAAA;AACF;AA0EA,MAAM,kCAAA,CAAmC;AAAA,EAC9B,kBAAA,uBAAyB,GAAA,EAGhC;AAAA,EACO,kBAAA,uBAAyB,GAAA,EAAwB;AAAA,EACjD,gBAAA,uBAAuB,GAAA,EAG9B;AAAA,EACO,gBAAA,GAAmB,IAAI,KAAA,EAAsC;AAAA,EAEtE,qBAAA,GAA0C;AACxC,IAAA,OAAO;AAAA,MACL,aAAa,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,kBAAA,CAAmB,QAAQ,CAAA;AAAA,MACxD,OAAO,IAAA,CAAK;AAAA,KACd;AAAA,EACF;AAAA,EAEA,gBAAgB,IAAA,EAAuB;AACrC,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,GAAA,CAAI,IAAI,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,YAAA,CACJ,YAAA,EACA,IAAA,EACkC;AAClC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,gBAAA,CAAiB,GAAA,CAAI,YAAY,CAAA;AACvD,IAAA,IAAI,CAAC,UAAU,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAIE,0BAAA;AAAA,QACR,gGAAgG,YAAY,CAAA;AAAA,OAC9G;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,IAAI,CAAC,CAAA;AAC3C,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,YAAA,CAAa,UAAU,CAAA;AACxD,IAAA,OAAO,MAAA,CAAO,WAAA;AAAA,MACZ,UAAA,CAAW,GAAA,CAAI,CAAC,GAAA,EAAK,KAAA,KAAU,CAAC,GAAA,EAAK,SAAA,CAAU,KAAK,CAAC,CAAC;AAAA,KACxD;AAAA,EACF;AAAA,EAEA,cAAc,YAAA,EAAsB;AAClC,IAAA,OAAO,CAAC,IAAA,KAA2D;AACjE,MAAA,MAAM,OAAO,IAAA,CAAK,kBAAA,CAAmB,IAAI,YAAY,CAAA,EAAG,IAAI,IAAI,CAAA;AAChE,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,iBAAA,EAAoB,IAAI,CAAA,oCAAA,EAAuC,YAAY,CAAA,CAAA;AAAA,SAC7E;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,EACF;AAAA,EAEA,eAAe,WAAA,EAA2B;AACxC,IAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AAEpC,MAAA,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,UAAA,CAAW,IAAA,EAAM,UAAU,CAAA;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,mBAAmB,KAAA,EAAmD;AACpE,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,WAAA,GACJ,KAAK,kBAAA,CAAmB,GAAA,CAAI,KAAK,YAAY,CAAA,wBAAS,GAAA,EAAI;AAC5D,MAAA,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,IAAA,CAAK,YAAA,EAAc,WAAW,CAAA;AAE1D,MAAA,IAAI,WAAA,CAAY,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,yCAAA,EAA4C,IAAA,CAAK,YAAY,CAAA,aAAA,EAAgB,KAAK,IAAI,CAAA,2BAAA;AAAA,SACxF;AAAA,MACF;AACA,MAAA,WAAA,CAAY,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAE/B,MAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK;AAAA,QACzB,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,YAAA,EAAcC,iCAAgB,IAAA,CAAK,YAAA,IAAgBR,MAAE,MAAA,CAAO,EAAE,CAAC;AAAA,OAChE,CAAA;AAAA,IACH;AAAA,EACF;AAAA,EAEA,gBACE,QAAA,EACA;AACA,IAAA,MAAM,EAAE,cAAa,GAAI,QAAA;AAEzB,IAAA,IAAI,IAAA,CAAK,gBAAA,CAAiB,GAAA,CAAI,YAAY,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iDAAiD,YAAY,CAAA,2BAAA;AAAA,OAC/D;AAAA,IACF;AACA,IAAA,IAAA,CAAK,gBAAA,CAAiB,GAAA,CAAI,YAAA,EAAc,QAAQ,CAAA;AAEhD,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,IAAA,CAAK,kBAAA,CAAmB,SAAS,KAAK,CAAA;AAAA,IACxC;AAEA,IAAA,IAAI,SAAS,WAAA,EAAa;AACxB,MAAA,IAAA,CAAK,cAAA,CAAe,SAAS,WAAW,CAAA;AAAA,IAC1C;AAAA,EACF;AACF;AA4CO,SAAS,kCAQd,OAAA,EA0BA;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,kCAAA,EAAmC;AAErD,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,IAAI,eAAe,OAAA,EAAS;AAE1B,MAAA,IAAI,iBAAiB,OAAA,EAAS;AAC5B,QAAA,KAAA,CAAM,cAAA,CAAe,QAAQ,WAA2B,CAAA;AAAA,MAC1D;AAEA,MAAA,KAAA,MAAW,QAAA,IAAY,QAAQ,SAAA,EAAW;AACxC,QAAA,KAAA,CAAM,gBAAgB,QAAQ,CAAA;AAAA,MAChC;AAAA,IACF,CAAA,MAAA,IAAW,kBAAkB,OAAA,EAAS;AACpC,MAAA,KAAA,CAAM,gBAAgB,OAAO,CAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,cAAA,CAAe,QAAQ,WAAW,CAAA;AAAA,IAC1C;AAAA,EACF;AAEA,EAAA,MAAM,SAASS,uBAAA,EAAO;AAEtB,EAAA,MAAA,CAAO,GAAA,CAAI,qCAAA,EAAuCC,wBAAA,CAAQ,IAAA,EAAM,CAAA;AAEhE,EAAA,MAAA,CAAO,GAAA,CAAI,6CAAA,EAA+C,CAAC,CAAA,EAAG,GAAA,KAAQ;AACpE,IAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,qBAAA,EAAuB,CAAA;AAAA,EACxC,CAAC,CAAA;AAED,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,qDAAA;AAAA,IACA,OAAO,KAAK,GAAA,KAA2C;AACrD,MAAA,MAAM,WAAA,GAAc,4BAAA,CAA6B,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA;AACnE,MAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,QAAA,MAAM,IAAIN,iBAAA,CAAW,WAAA,CAAY,KAAA,CAAM,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAS,GAAI,WAAA,CAAY,IAAA;AAExC,MAAA,MAAM,uBAAuB,QAAA,CAAS,MAAA;AAAA,QACpC,CAAA,CAAA,KAAK,CAAC,KAAA,CAAM,eAAA,CAAgB,EAAE,YAAY;AAAA,OAC5C;AACA,MAAA,IAAI,qBAAqB,MAAA,EAAQ;AAC/B,QAAA,MAAM,IAAIA,iBAAA;AAAA,UACR,CAAA,2BAAA,EAA8B,qBAC3B,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,YAAY,CAAA,CACvB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,SACf;AAAA,MACF;AAEA,MAAA,MAAM,kBAAuD,EAAC;AAC9D,MAAA,KAAA,MAAW,aAAA,IAAiB,IAAI,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,YAAY,CAAC,CAAA,EAAG;AACtE,QAAA,eAAA,CAAgB,aAAa,CAAA,GAAI,MAAM,KAAA,CAAM,YAAA;AAAA,UAC3C,aAAA;AAAA,UACA,QAAA,CACG,MAAA,CAAO,CAAA,CAAA,KAAK,CAAA,CAAE,YAAA,KAAiB,aAAa,CAAA,CAC5C,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,WAAW,CAAA,CACtB,IAAA;AAAK,SACV;AAAA,MACF;AAEA,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,KAAA,EAAO,QAAA,CAAS,GAAA,CAAI,CAAA,OAAA,MAAY;AAAA,UAC9B,IAAI,OAAA,CAAQ,EAAA;AAAA,UACZ,QAAQ,KAAA,CAAM,OAAA,CAAQ,QAAQ,WAAW,CAAA,GACrC,QAAQ,WAAA,CAAY,GAAA;AAAA,YAAI,CAAA,WAAA,KACtB,eAAA;AAAA,cACE,OAAA,CAAQ,UAAA;AAAA,cACR,eAAA,CAAgB,OAAA,CAAQ,YAAY,CAAA,CAAE,WAAW,CAAA;AAAA,cACjD,KAAA,CAAM,aAAA,CAAc,OAAA,CAAQ,YAAY;AAAA;AAC1C,WACF,GACA,eAAA;AAAA,YACE,OAAA,CAAQ,UAAA;AAAA,YACR,eAAA,CAAgB,OAAA,CAAQ,YAAY,CAAA,CAAE,QAAQ,WAAW,CAAA;AAAA,YACzD,KAAA,CAAM,aAAA,CAAc,OAAA,CAAQ,YAAY;AAAA;AAC1C,SACN,CAAE;AAAA,OACH,CAAA;AAAA,IACH;AAAA,GACF;AAEA,EAAA,OAAO,MAAA,CAAO,OAAO,MAAA,EAAQ;AAAA,IAC3B,eAAe,WAAA,EAA2B;AACxC,MAAA,KAAA,CAAM,eAAe,WAAW,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,mBAAmB,KAAA,EAAmD;AACpE,MAAA,KAAA,CAAM,mBAAmB,KAAK,CAAA;AAAA,IAChC,CAAA;AAAA,IACA,gBACE,QAAA,EAIA;AACA,MAAA,KAAA,CAAM,gBAAgB,QAAQ,CAAA;AAAA,IAChC,CAAA;AAAA,IACA,qBACE,WAAA,EACqD;AACrD,MAAA,OAAO;AAAA,QACL,aAAA,EAAe,KAAA,CAAM,aAAA,CAAc,WAAA,CAAY,YAAY;AAAA,OAC7D;AAAA,IACF;AAAA,GACD,CAAA;AACH;;;;;"}
package/dist/integration/createPermissionResourceRef.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"createPermissionResourceRef.cjs.js","sources":["../../src/integration/createPermissionResourceRef.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * @public\n */\nexport type PermissionResourceRef<\n TResource = unknown,\n TQuery = unknown,\n TResourceType extends string = string,\n TPluginId extends string = string,\n> = {\n readonly $$type: '@backstage/PermissionResourceRef';\n readonly pluginId: TPluginId;\n readonly resourceType: TResourceType;\n readonly TQuery: TQuery;\n readonly TResource: TResource;\n};\n\n/**\n * @public\n */\nexport function createPermissionResourceRef<TResource, TQuery>(): {\n with<TPluginId extends string, TResourceType extends string>(options: {\n pluginId: TPluginId;\n resourceType: TResourceType;\n }): PermissionResourceRef<TResource, TQuery, TResourceType, TPluginId>;\n} {\n return {\n with<TPluginId extends string, TResourceType extends string>(options: {\n pluginId: TPluginId;\n resourceType: TResourceType;\n }): PermissionResourceRef<TResource, TQuery, TResourceType, TPluginId> {\n return {\n $$type: '@backstage/PermissionResourceRef',\n pluginId: options.pluginId,\n resourceType: options.resourceType,\n TQuery: null as TQuery,\n TResource: null as TResource,\n };\n },\n };\n}\n"],"names":[],"mappings":";;AAmCO,SAAS,2BAKd,GAAA;AACA,EAAO,OAAA;AAAA,IACL,KAA6D,OAGU,EAAA;AACrE,MAAO,OAAA;AAAA,QACL,MAAQ,EAAA,kCAAA;AAAA,QACR,UAAU,OAAQ,CAAA,QAAA;AAAA,QAClB,cAAc,OAAQ,CAAA,YAAA;AAAA,QACtB,MAAQ,EAAA,IAAA;AAAA,QACR,SAAW,EAAA;AAAA,OACb;AAAA;AACF,GACF;AACF;;;;"}
1
+ {"version":3,"file":"createPermissionResourceRef.cjs.js","sources":["../../src/integration/createPermissionResourceRef.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * @public\n */\nexport type PermissionResourceRef<\n TResource = unknown,\n TQuery = unknown,\n TResourceType extends string = string,\n TPluginId extends string = string,\n> = {\n readonly $$type: '@backstage/PermissionResourceRef';\n readonly pluginId: TPluginId;\n readonly resourceType: TResourceType;\n readonly TQuery: TQuery;\n readonly TResource: TResource;\n};\n\n/**\n * @public\n */\nexport function createPermissionResourceRef<TResource, TQuery>(): {\n with<TPluginId extends string, TResourceType extends string>(options: {\n pluginId: TPluginId;\n resourceType: TResourceType;\n }): PermissionResourceRef<TResource, TQuery, TResourceType, TPluginId>;\n} {\n return {\n with<TPluginId extends string, TResourceType extends string>(options: {\n pluginId: TPluginId;\n resourceType: TResourceType;\n }): PermissionResourceRef<TResource, TQuery, TResourceType, TPluginId> {\n return {\n $$type: '@backstage/PermissionResourceRef',\n pluginId: options.pluginId,\n resourceType: options.resourceType,\n TQuery: null as TQuery,\n TResource: null as TResource,\n };\n },\n };\n}\n"],"names":[],"mappings":";;AAmCO,SAAS,2BAAA,GAKd;AACA,EAAA,OAAO;AAAA,IACL,KAA6D,OAAA,EAGU;AACrE,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,kCAAA;AAAA,QACR,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,cAAc,OAAA,CAAQ,YAAA;AAAA,QACtB,MAAA,EAAQ,IAAA;AAAA,QACR,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAAA,GACF;AACF;;;;"}
package/dist/integration/createPermissionRule.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"createPermissionRule.cjs.js","sources":["../../src/integration/createPermissionRule.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n PermissionCriteria,\n PermissionRuleParams,\n} from '@backstage/plugin-permission-common';\nimport { NoInfer, PermissionRule } from '../types';\nimport { z } from 'zod';\nimport { PermissionResourceRef } from './createPermissionResourceRef';\n\n/**\n * @public\n */\nexport type CreatePermissionRuleOptions<\n TRef extends PermissionResourceRef,\n TParams extends PermissionRuleParams,\n> = TRef extends PermissionResourceRef<infer IResource, infer IQuery, any>\n ? {\n name: string;\n description: string;\n\n resourceRef: TRef;\n\n /**\n * A ZodSchema that reflects the structure of the parameters that are passed to\n */\n paramsSchema?: z.ZodSchema<TParams>;\n\n /**\n * Apply this rule to a resource already loaded from a backing data source. The params are\n * arguments supplied for the rule; for example, a rule could be `isOwner` with entityRefs as the\n * params.\n */\n apply(resource: IResource, params: NoInfer<TParams>): boolean;\n\n /**\n * Translate this rule to criteria suitable for use in querying a backing data store. The criteria\n * can be used for loading a collection of resources efficiently with conditional criteria already\n * applied.\n */\n toQuery(params: NoInfer<TParams>): PermissionCriteria<IQuery>;\n }\n : never;\n\n/**\n * Helper function to create a {@link PermissionRule} for a specific resource type using a {@link PermissionResourceRef}.\n *\n * @public\n */\nexport function createPermissionRule<\n TRef extends PermissionResourceRef,\n TParams extends PermissionRuleParams = undefined,\n>(\n rule: CreatePermissionRuleOptions<TRef, TParams>,\n): PermissionRule<\n TRef['TResource'],\n TRef['TQuery'],\n TRef['resourceType'],\n TParams\n>;\n/**\n * Helper function to ensure that {@link PermissionRule} definitions are typed correctly.\n *\n * @deprecated Use the version of `createPermissionRule` that accepts a `resourceRef` option instead.\n * @public\n */\nexport function createPermissionRule<\n TResource,\n TQuery,\n TResourceType extends string,\n TParams extends PermissionRuleParams = undefined,\n>(\n rule: PermissionRule<TResource, TQuery, TResourceType, TParams>,\n): PermissionRule<TResource, TQuery, TResourceType, TParams>;\nexport function createPermissionRule<\n TResource,\n TQuery,\n TResourceType extends string,\n TRef extends PermissionResourceRef,\n TParams extends PermissionRuleParams = undefined,\n>(\n rule:\n | PermissionRule<TResource, TQuery, TResourceType, TParams>\n | CreatePermissionRuleOptions<TRef, TParams>,\n): PermissionRule<TResource, TQuery, TResourceType, TParams> {\n if ('resourceRef' in rule) {\n return {\n ...rule,\n resourceType: rule.resourceRef.resourceType as TResourceType,\n } as PermissionRule<TResource, TQuery, TResourceType, TParams>;\n }\n return rule;\n}\n\n/**\n * Helper for making plugin-specific createPermissionRule functions, that have\n * the TResource and TQuery type parameters populated but infer the params from\n * the supplied rule. This helps ensure that rules created for this plugin use\n * consistent types for the resource and query.\n *\n * @public\n * @deprecated Use {@link (createPermissionRule:1)} directly instead with the resourceRef option.\n */\nexport const makeCreatePermissionRule =\n <TResource, TQuery, TResourceType extends string>() =>\n <TParams extends PermissionRuleParams = undefined>(\n rule: PermissionRule<TResource, TQuery, TResourceType, TParams>,\n ) =>\n createPermissionRule(rule);\n"],"names":[],"mappings":";;AAwFO,SAAS,qBAOd,IAG2D,EAAA;AAC3D,EAAA,IAAI,iBAAiB,IAAM,EAAA;AACzB,IAAO,OAAA;AAAA,MACL,GAAG,IAAA;AAAA,MACH,YAAA,EAAc,KAAK,WAAY,CAAA;AAAA,KACjC;AAAA;AAEF,EAAO,OAAA,IAAA;AACT;AAWO,MAAM,wBACX,GAAA,MACA,CACE,IAAA,KAEA,qBAAqB,IAAI;;;;;"}
1
+ {"version":3,"file":"createPermissionRule.cjs.js","sources":["../../src/integration/createPermissionRule.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n PermissionCriteria,\n PermissionRuleParams,\n} from '@backstage/plugin-permission-common';\nimport { NoInfer, PermissionRule } from '../types';\nimport { z } from 'zod';\nimport { PermissionResourceRef } from './createPermissionResourceRef';\n\n/**\n * @public\n */\nexport type CreatePermissionRuleOptions<\n TRef extends PermissionResourceRef,\n TParams extends PermissionRuleParams,\n> = TRef extends PermissionResourceRef<infer IResource, infer IQuery, any>\n ? {\n name: string;\n description: string;\n\n resourceRef: TRef;\n\n /**\n * A ZodSchema that reflects the structure of the parameters that are passed to\n */\n paramsSchema?: z.ZodSchema<TParams>;\n\n /**\n * Apply this rule to a resource already loaded from a backing data source. The params are\n * arguments supplied for the rule; for example, a rule could be `isOwner` with entityRefs as the\n * params.\n */\n apply(resource: IResource, params: NoInfer<TParams>): boolean;\n\n /**\n * Translate this rule to criteria suitable for use in querying a backing data store. The criteria\n * can be used for loading a collection of resources efficiently with conditional criteria already\n * applied.\n */\n toQuery(params: NoInfer<TParams>): PermissionCriteria<IQuery>;\n }\n : never;\n\n/**\n * Helper function to create a {@link PermissionRule} for a specific resource type using a {@link PermissionResourceRef}.\n *\n * @public\n */\nexport function createPermissionRule<\n TRef extends PermissionResourceRef,\n TParams extends PermissionRuleParams = undefined,\n>(\n rule: CreatePermissionRuleOptions<TRef, TParams>,\n): PermissionRule<\n TRef['TResource'],\n TRef['TQuery'],\n TRef['resourceType'],\n TParams\n>;\n/**\n * Helper function to ensure that {@link PermissionRule} definitions are typed correctly.\n *\n * @deprecated Use the version of `createPermissionRule` that accepts a `resourceRef` option instead.\n * @public\n */\nexport function createPermissionRule<\n TResource,\n TQuery,\n TResourceType extends string,\n TParams extends PermissionRuleParams = undefined,\n>(\n rule: PermissionRule<TResource, TQuery, TResourceType, TParams>,\n): PermissionRule<TResource, TQuery, TResourceType, TParams>;\nexport function createPermissionRule<\n TResource,\n TQuery,\n TResourceType extends string,\n TRef extends PermissionResourceRef,\n TParams extends PermissionRuleParams = undefined,\n>(\n rule:\n | PermissionRule<TResource, TQuery, TResourceType, TParams>\n | CreatePermissionRuleOptions<TRef, TParams>,\n): PermissionRule<TResource, TQuery, TResourceType, TParams> {\n if ('resourceRef' in rule) {\n return {\n ...rule,\n resourceType: rule.resourceRef.resourceType as TResourceType,\n } as PermissionRule<TResource, TQuery, TResourceType, TParams>;\n }\n return rule;\n}\n\n/**\n * Helper for making plugin-specific createPermissionRule functions, that have\n * the TResource and TQuery type parameters populated but infer the params from\n * the supplied rule. This helps ensure that rules created for this plugin use\n * consistent types for the resource and query.\n *\n * @public\n * @deprecated Use {@link (createPermissionRule:1)} directly instead with the resourceRef option.\n */\nexport const makeCreatePermissionRule =\n <TResource, TQuery, TResourceType extends string>() =>\n <TParams extends PermissionRuleParams = undefined>(\n rule: PermissionRule<TResource, TQuery, TResourceType, TParams>,\n ) =>\n createPermissionRule(rule);\n"],"names":[],"mappings":";;AAwFO,SAAS,qBAOd,IAAA,EAG2D;AAC3D,EAAA,IAAI,iBAAiB,IAAA,EAAM;AACzB,IAAA,OAAO;AAAA,MACL,GAAG,IAAA;AAAA,MACH,YAAA,EAAc,KAAK,WAAA,CAAY;AAAA,KACjC;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAWO,MAAM,wBAAA,GACX,MACA,CACE,IAAA,KAEA,qBAAqB,IAAI;;;;;"}
package/dist/integration/util.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"util.cjs.js","sources":["../../src/integration/util.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n AllOfCriteria,\n AnyOfCriteria,\n NotCriteria,\n PermissionCriteria,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\n\n/**\n * Utility function used to parse a PermissionCriteria\n * @param criteria - a PermissionCriteria\n * @public\n *\n * @returns `true` if the permission criteria is of type allOf,\n * narrowing down `criteria` to the specific type.\n */\nexport const isAndCriteria = <T>(\n criteria: PermissionCriteria<T>,\n): criteria is AllOfCriteria<T> =>\n Object.prototype.hasOwnProperty.call(criteria, 'allOf');\n\n/**\n * Utility function used to parse a PermissionCriteria of type\n * @param criteria - a PermissionCriteria\n * @public\n *\n * @returns `true` if the permission criteria is of type anyOf,\n * narrowing down `criteria` to the specific type.\n */\nexport const isOrCriteria = <T>(\n criteria: PermissionCriteria<T>,\n): criteria is AnyOfCriteria<T> =>\n Object.prototype.hasOwnProperty.call(criteria, 'anyOf');\n\n/**\n * Utility function used to parse a PermissionCriteria\n * @param criteria - a PermissionCriteria\n * @public\n *\n * @returns `true` if the permission criteria is of type not,\n * narrowing down `criteria` to the specific type.\n */\nexport const isNotCriteria = <T>(\n criteria: PermissionCriteria<T>,\n): criteria is NotCriteria<T> =>\n Object.prototype.hasOwnProperty.call(criteria, 'not');\n\nexport const createGetRule = <TResource, TQuery>(\n rules: PermissionRule<TResource, TQuery, string>[],\n) => {\n const rulesMap = new Map(Object.values(rules).map(rule => [rule.name, rule]));\n\n return (name: string): PermissionRule<TResource, TQuery, string> => {\n const rule = rulesMap.get(name);\n\n if (!rule) {\n throw new Error(`Unexpected permission rule: ${name}`);\n }\n\n return rule;\n };\n};\n"],"names":[],"mappings":";;AAgCa,MAAA,aAAA,GAAgB,CAC3B,QAEA,KAAA,MAAA,CAAO,UAAU,cAAe,CAAA,IAAA,CAAK,UAAU,OAAO;AAU3C,MAAA,YAAA,GAAe,CAC1B,QAEA,KAAA,MAAA,CAAO,UAAU,cAAe,CAAA,IAAA,CAAK,UAAU,OAAO;AAU3C,MAAA,aAAA,GAAgB,CAC3B,QAEA,KAAA,MAAA,CAAO,UAAU,cAAe,CAAA,IAAA,CAAK,UAAU,KAAK;AAEzC,MAAA,aAAA,GAAgB,CAC3B,KACG,KAAA;AACH,EAAA,MAAM,QAAW,GAAA,IAAI,GAAI,CAAA,MAAA,CAAO,OAAO,KAAK,CAAA,CAAE,GAAI,CAAA,CAAA,IAAA,KAAQ,CAAC,IAAA,CAAK,IAAM,EAAA,IAAI,CAAC,CAAC,CAAA;AAE5E,EAAA,OAAO,CAAC,IAA4D,KAAA;AAClE,IAAM,MAAA,IAAA,GAAO,QAAS,CAAA,GAAA,CAAI,IAAI,CAAA;AAE9B,IAAA,IAAI,CAAC,IAAM,EAAA;AACT,MAAA,MAAM,IAAI,KAAA,CAAM,CAA+B,4BAAA,EAAA,IAAI,CAAE,CAAA,CAAA;AAAA;AAGvD,IAAO,OAAA,IAAA;AAAA,GACT;AACF;;;;;;;"}
1
+ {"version":3,"file":"util.cjs.js","sources":["../../src/integration/util.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n AllOfCriteria,\n AnyOfCriteria,\n NotCriteria,\n PermissionCriteria,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\n\n/**\n * Utility function used to parse a PermissionCriteria\n * @param criteria - a PermissionCriteria\n * @public\n *\n * @returns `true` if the permission criteria is of type allOf,\n * narrowing down `criteria` to the specific type.\n */\nexport const isAndCriteria = <T>(\n criteria: PermissionCriteria<T>,\n): criteria is AllOfCriteria<T> =>\n Object.prototype.hasOwnProperty.call(criteria, 'allOf');\n\n/**\n * Utility function used to parse a PermissionCriteria of type\n * @param criteria - a PermissionCriteria\n * @public\n *\n * @returns `true` if the permission criteria is of type anyOf,\n * narrowing down `criteria` to the specific type.\n */\nexport const isOrCriteria = <T>(\n criteria: PermissionCriteria<T>,\n): criteria is AnyOfCriteria<T> =>\n Object.prototype.hasOwnProperty.call(criteria, 'anyOf');\n\n/**\n * Utility function used to parse a PermissionCriteria\n * @param criteria - a PermissionCriteria\n * @public\n *\n * @returns `true` if the permission criteria is of type not,\n * narrowing down `criteria` to the specific type.\n */\nexport const isNotCriteria = <T>(\n criteria: PermissionCriteria<T>,\n): criteria is NotCriteria<T> =>\n Object.prototype.hasOwnProperty.call(criteria, 'not');\n\nexport const createGetRule = <TResource, TQuery>(\n rules: PermissionRule<TResource, TQuery, string>[],\n) => {\n const rulesMap = new Map(Object.values(rules).map(rule => [rule.name, rule]));\n\n return (name: string): PermissionRule<TResource, TQuery, string> => {\n const rule = rulesMap.get(name);\n\n if (!rule) {\n throw new Error(`Unexpected permission rule: ${name}`);\n }\n\n return rule;\n };\n};\n"],"names":[],"mappings":";;AAgCO,MAAM,aAAA,GAAgB,CAC3B,QAAA,KAEA,MAAA,CAAO,UAAU,cAAA,CAAe,IAAA,CAAK,UAAU,OAAO;AAUjD,MAAM,YAAA,GAAe,CAC1B,QAAA,KAEA,MAAA,CAAO,UAAU,cAAA,CAAe,IAAA,CAAK,UAAU,OAAO;AAUjD,MAAM,aAAA,GAAgB,CAC3B,QAAA,KAEA,MAAA,CAAO,UAAU,cAAA,CAAe,IAAA,CAAK,UAAU,KAAK;AAE/C,MAAM,aAAA,GAAgB,CAC3B,KAAA,KACG;AACH,EAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,MAAA,CAAO,OAAO,KAAK,CAAA,CAAE,GAAA,CAAI,CAAA,IAAA,KAAQ,CAAC,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAE5E,EAAA,OAAO,CAAC,IAAA,KAA4D;AAClE,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAE9B,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAI,CAAA,CAAE,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;;;;;;;"}
package/dist/plugin.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createExtensionPoint } from '@backstage/backend-plugin-api';\nimport { PermissionPolicy } from '@backstage/plugin-permission-node';\n\n/**\n * Allows supplying policies to the permissions backend\n *\n * @alpha\n */\nexport type PolicyExtensionPoint = {\n setPolicy(policy: PermissionPolicy): void;\n};\n\n/**\n * Allows supplying policies to the permissions backend\n *\n * @alpha\n */\nexport const policyExtensionPoint = createExtensionPoint<PolicyExtensionPoint>({\n id: 'permission.policy',\n});\n"],"names":["createExtensionPoint"],"mappings":";;;;AAiCO,MAAM,uBAAuBA,qCAA2C,CAAA;AAAA,EAC7E,EAAI,EAAA;AACN,CAAC;;;;"}
1
+ {"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createExtensionPoint } from '@backstage/backend-plugin-api';\nimport { PermissionPolicy } from '@backstage/plugin-permission-node';\n\n/**\n * Allows supplying policies to the permissions backend\n *\n * @alpha\n */\nexport type PolicyExtensionPoint = {\n setPolicy(policy: PermissionPolicy): void;\n};\n\n/**\n * Allows supplying policies to the permissions backend\n *\n * @alpha\n */\nexport const policyExtensionPoint = createExtensionPoint<PolicyExtensionPoint>({\n id: 'permission.policy',\n});\n"],"names":["createExtensionPoint"],"mappings":";;;;AAiCO,MAAM,uBAAuBA,qCAAA,CAA2C;AAAA,EAC7E,EAAA,EAAI;AACN,CAAC;;;;"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@backstage/plugin-permission-node",
3
- "version": "0.10.3-next.0",
3
+ "version": "0.10.3",
4
4
  "description": "Common permission and authorization utilities for backend plugins",
5
5
  "backstage": {
6
6
  "role": "node-library",
@@ -64,11 +64,11 @@
64
64
  "test": "backstage-cli package test"
65
65
  },
66
66
  "dependencies": {
67
- "@backstage/backend-plugin-api": "1.4.2-next.0",
68
- "@backstage/config": "1.3.3",
69
- "@backstage/errors": "1.2.7",
70
- "@backstage/plugin-auth-node": "0.6.6-next.0",
71
- "@backstage/plugin-permission-common": "0.9.1",
67
+ "@backstage/backend-plugin-api": "^1.4.2",
68
+ "@backstage/config": "^1.3.3",
69
+ "@backstage/errors": "^1.2.7",
70
+ "@backstage/plugin-auth-node": "^0.6.6",
71
+ "@backstage/plugin-permission-common": "^0.9.1",
72
72
  "@types/express": "^4.17.6",
73
73
  "express": "^4.17.1",
74
74
  "express-promise-router": "^4.1.0",
@@ -76,9 +76,9 @@
76
76
  "zod-to-json-schema": "^3.20.4"
77
77
  },
78
78
  "devDependencies": {
79
- "@backstage/backend-defaults": "0.11.2-next.0",
80
- "@backstage/backend-test-utils": "1.7.1-next.0",
81
- "@backstage/cli": "0.33.2-next.0",
79
+ "@backstage/backend-defaults": "^0.12.0",
80
+ "@backstage/backend-test-utils": "^1.8.0",
81
+ "@backstage/cli": "^0.34.0",
82
82
  "@types/supertest": "^2.0.8",
83
83
  "msw": "^1.0.0",
84
84
  "supertest": "^7.0.0"