@backstage/plugin-permission-node 0.8.6 → 0.8.7-next.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @backstage/plugin-permission-node
 
+## 0.8.7-next.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.1.1-next.1
+  - @backstage/config@1.3.2-next.0
+  - @backstage/errors@1.2.7-next.0
+  - @backstage/plugin-auth-node@0.5.6-next.1
+  - @backstage/plugin-permission-common@0.8.4-next.0
+
+## 0.8.7-next.0
+
+### Patch Changes
+
+- d9d62ef: Remove some internal usages of the backend-common package
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.6-next.0
+  - @backstage/backend-plugin-api@1.1.1-next.0
+  - @backstage/config@1.3.1
+  - @backstage/errors@1.2.6
+  - @backstage/plugin-permission-common@0.8.3
+
 ## 0.8.6
 
 ### Patch Changes

package/dist/integration/createPermissionIntegrationRouter.cjs.js

@@ -5,7 +5,6 @@ var Router = require('express-promise-router');
 var zod = require('zod');
 var zodToJsonSchema = require('zod-to-json-schema');
 var errors = require('@backstage/errors');
-var backendCommon = require('@backstage/backend-common');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var util = require('./util.cjs.js');
 
@@ -177,7 +176,6 @@ function createPermissionIntegrationRouter(options) {
       });
     }
   );
-  router.use(backendCommon.errorHandler());
   return router;
 }
 function isCreatePermissionIntegrationRouterResourceOptions(options) {

package/dist/integration/createPermissionIntegrationRouter.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"createPermissionIntegrationRouter.cjs.js","sources":["../../src/integration/createPermissionIntegrationRouter.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express, { Response } from 'express';\nimport Router from 'express-promise-router';\nimport { z } from 'zod';\nimport zodToJsonSchema from 'zod-to-json-schema';\nimport { InputError } from '@backstage/errors';\nimport { errorHandler } from '@backstage/backend-common';\nimport {\n  AuthorizeResult,\n  DefinitivePolicyDecision,\n  IdentifiedPermissionMessage,\n  MetadataResponse as CommonMetadataResponse,\n  MetadataResponseSerializedRule as CommonMetadataResponseSerializedRule,\n  Permission,\n  PermissionCondition,\n  PermissionCriteria,\n  PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\nimport {\n  NoInfer,\n  createGetRule,\n  isAndCriteria,\n  isNotCriteria,\n  isOrCriteria,\n} from './util';\nimport { NotImplementedError } from '@backstage/errors';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z.union([\n    z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }),\n    z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }),\n    z.object({ not: permissionCriteriaSchema }),\n    z.object({\n      rule: z.string(),\n      resourceType: z.string(),\n      params: z.record(z.any()).optional(),\n    }),\n  ]),\n);\n\nconst applyConditionsRequestSchema = z.object({\n  items: z.array(\n    z.object({\n      id: z.string(),\n      resourceRef: z.string(),\n      resourceType: z.string(),\n      conditions: permissionCriteriaSchema,\n    }),\n  ),\n});\n\n/**\n * A request to load the referenced resource and apply conditions in order to\n * finalize a conditional authorization response.\n *\n * @public\n */\nexport type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{\n  resourceRef: string;\n  resourceType: string;\n  conditions: PermissionCriteria<PermissionCondition>;\n}>;\n\n/**\n * A batch of {@link ApplyConditionsRequestEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsRequest = {\n  items: ApplyConditionsRequestEntry[];\n};\n\n/**\n * The result of applying the conditions, expressed as a definitive authorize\n * result of ALLOW or DENY.\n *\n * @public\n */\nexport type ApplyConditionsResponseEntry =\n  IdentifiedPermissionMessage<DefinitivePolicyDecision>;\n\n/**\n * A batch of {@link ApplyConditionsResponseEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsResponse = {\n  items: ApplyConditionsResponseEntry[];\n};\n\n/**\n * Serialized permission rules, with the paramsSchema\n * converted from a ZodSchema to a JsonSchema.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponseSerializedRule =\n  CommonMetadataResponseSerializedRule;\n\n/**\n * Response type for the .metadata endpoint.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponse = CommonMetadataResponse;\n\nconst applyConditions = <TResourceType extends string, TResource>(\n  criteria: PermissionCriteria<PermissionCondition<TResourceType>>,\n  resource: TResource | undefined,\n  getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,\n): boolean => {\n  // If resource was not found, deny. This avoids leaking information from the\n  // apply-conditions API which would allow a user to differentiate between\n  // non-existent resources and resources to which they do not have access.\n  if (resource === undefined) {\n    return false;\n  }\n\n  if (isAndCriteria(criteria)) {\n    return criteria.allOf.every(child =>\n      applyConditions(child, resource, getRule),\n    );\n  } else if (isOrCriteria(criteria)) {\n    return criteria.anyOf.some(child =>\n      applyConditions(child, resource, getRule),\n    );\n  } else if (isNotCriteria(criteria)) {\n    return !applyConditions(criteria.not, resource, getRule);\n  }\n\n  const rule = getRule(criteria.rule);\n  const result = rule.paramsSchema?.safeParse(criteria.params);\n\n  if (result && !result.success) {\n    throw new InputError(`Parameters to rule are invalid`, result.error);\n  }\n\n  return rule.apply(resource, criteria.params ?? {});\n};\n\n/**\n * Takes some permission conditions and returns a definitive authorization result\n * on the resource to which they apply.\n *\n * @public\n */\nexport const createConditionAuthorizer = <TResource, TQuery>(\n  rules: PermissionRule<TResource, TQuery, string>[],\n) => {\n  const getRule = createGetRule(rules);\n\n  return (\n    decision: PolicyDecision,\n    resource: TResource | undefined,\n  ): boolean => {\n    if (decision.result === AuthorizeResult.CONDITIONAL) {\n      return applyConditions(decision.conditions, resource, getRule);\n    }\n\n    return decision.result === AuthorizeResult.ALLOW;\n  };\n};\n\n/**\n * Options for creating a permission integration router specific\n * for a particular resource type.\n *\n * @public\n */\nexport type CreatePermissionIntegrationRouterResourceOptions<\n  TResourceType extends string,\n  TResource,\n> = {\n  resourceType: TResourceType;\n  permissions?: Array<Permission>;\n  // Do not infer value of TResourceType from supplied rules.\n  // instead only consider the resourceType parameter, and\n  // consider any rules whose resource type does not match\n  // to be an error.\n  rules: PermissionRule<TResource, any, NoInfer<TResourceType>>[];\n  getResources?: (\n    resourceRefs: string[],\n  ) => Promise<Array<TResource | undefined>>;\n};\n\n/**\n * Options for creating a permission integration router exposing\n * permissions and rules from multiple resource types.\n *\n * @public\n */\nexport type PermissionIntegrationRouterOptions<\n  TResourceType1 extends string = string,\n  TResource1 = any,\n  TResourceType2 extends string = string,\n  TResource2 = any,\n  TResourceType3 extends string = string,\n  TResource3 = any,\n> = {\n  resources: Readonly<\n    | [\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >,\n      ]\n    | [\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType2,\n          TResource2\n        >,\n      ]\n    | [\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType2,\n          TResource2\n        >,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType3,\n          TResource3\n        >,\n      ]\n  >;\n};\n\n/**\n * Create an express Router which provides an authorization route to allow\n * integration between the permission backend and other Backstage backend\n * plugins. Plugin owners that wish to support conditional authorization for\n * their resources should add the router created by this function to their\n * express app inside their `createRouter` implementation.\n *\n * In case the `permissions` option is provided, the router also\n * provides a route that exposes permissions and routes of a plugin.\n *\n * In case resources is provided, the routes can handle permissions\n * for multiple resource types.\n *\n * @remarks\n *\n * To make this concrete, we can use the Backstage software catalog as an\n * example. The catalog has conditional rules around access to specific\n * _entities_ in the catalog. The _type_ of resource is captured here as\n * `resourceType`, a string identifier (`catalog-entity` in this example) that\n * can be provided with permission definitions. This is merely a _type_ to\n * verify that conditions in an authorization policy are constructed correctly,\n * not a reference to a specific resource.\n *\n * The `rules` parameter is an array of {@link PermissionRule}s that introduce\n * conditional filtering logic for resources; for the catalog, these are things\n * like `isEntityOwner` or `hasAnnotation`. Rules describe how to filter a list\n * of resources, and the `conditions` returned allow these rules to be applied\n * with specific parameters (such as 'group:default/team-a', or\n * 'backstage.io/edit-url').\n *\n * The `getResources` argument should load resources based on a reference\n * identifier. For the catalog, this is an\n * {@link @backstage/catalog-model#EntityRef}. For other plugins, this can be\n * any serialized format. This is used to construct the\n * `createPermissionIntegrationRouter`, a function to add an authorization route\n * to your backend plugin. This function will be called by the\n * `permission-backend` when authorization conditions relating to this plugin\n * need to be evaluated.\n *\n * @public\n */\nexport function createPermissionIntegrationRouter<\n  TResourceType1 extends string,\n  TResource1,\n  TResourceType2 extends string,\n  TResource2,\n  TResourceType3 extends string,\n  TResource3,\n>(\n  options:\n    | { permissions: Array<Permission> }\n    | CreatePermissionIntegrationRouterResourceOptions<\n        TResourceType1,\n        TResource1\n      >\n    | PermissionIntegrationRouterOptions<\n        TResourceType1,\n        TResource1,\n        TResourceType2,\n        TResource2,\n        TResourceType3,\n        TResource3\n      >,\n): express.Router {\n  const optionsWithResources = options as PermissionIntegrationRouterOptions;\n  const allOptions = [\n    optionsWithResources.resources ? optionsWithResources.resources : options,\n  ].flat();\n  const allRules = allOptions.flatMap(\n    option =>\n      (\n        option as CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >\n      ).rules || [],\n  );\n\n  const allPermissions = Array.from(\n    new Map(\n      [\n        ...((options as { permissions: Permission[] }).permissions || []),\n        ...(optionsWithResources.resources?.flatMap(o => o.permissions || []) ||\n          []),\n      ].map(i => [i.name, i]),\n    ).values(),\n  );\n\n  const allResourceTypes = allOptions.reduce((acc, option) => {\n    if (\n      isCreatePermissionIntegrationRouterResourceOptions(\n        option as\n          | { permissions: Array<Permission> }\n          | CreatePermissionIntegrationRouterResourceOptions<\n              TResourceType1,\n              TResource1\n            >,\n      )\n    ) {\n      acc.push(\n        (\n          option as CreatePermissionIntegrationRouterResourceOptions<\n            TResourceType1,\n            TResource1\n          >\n        ).resourceType,\n      );\n    }\n    return acc;\n  }, [] as string[]);\n\n  const router = Router();\n  router.use(express.json());\n\n  router.get('/.well-known/backstage/permissions/metadata', (_, res) => {\n    const serializedRules: MetadataResponseSerializedRule[] = allRules.map(\n      rule => ({\n        name: rule.name,\n        description: rule.description,\n        resourceType: rule.resourceType,\n        paramsSchema: zodToJsonSchema(rule.paramsSchema ?? z.object({})),\n      }),\n    );\n\n    const responseJson: MetadataResponse = {\n      permissions: allPermissions,\n      rules: serializedRules,\n    };\n\n    return res.json(responseJson);\n  });\n\n  router.post(\n    '/.well-known/backstage/permissions/apply-conditions',\n    async (req, res: Response<ApplyConditionsResponse | string>) => {\n      const ruleMapByResourceType: Record<\n        string,\n        ReturnType<typeof createGetRule>\n      > = {};\n      const getResourcesByResourceType: Record<\n        string,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >['getResources']\n      > = {};\n\n      for (let option of allOptions) {\n        option = option as\n          | { permissions: Array<Permission> }\n          | CreatePermissionIntegrationRouterResourceOptions<\n              TResourceType1,\n              TResource1\n            >;\n        if (isCreatePermissionIntegrationRouterResourceOptions(option)) {\n          ruleMapByResourceType[option.resourceType] = createGetRule(\n            option.rules,\n          );\n\n          getResourcesByResourceType[option.resourceType] = option.getResources;\n        }\n      }\n\n      const assertValidResourceTypes = (\n        requests: ApplyConditionsRequestEntry[],\n      ) => {\n        const invalidResourceTypes = requests\n          .filter(request => !allResourceTypes.includes(request.resourceType))\n          .map(request => request.resourceType);\n\n        if (invalidResourceTypes.length) {\n          throw new InputError(\n            `Unexpected resource types: ${invalidResourceTypes.join(', ')}.`,\n          );\n        }\n      };\n\n      const parseResult = applyConditionsRequestSchema.safeParse(req.body);\n\n      if (!parseResult.success) {\n        throw new InputError(parseResult.error.toString());\n      }\n\n      const body = parseResult.data;\n\n      assertValidResourceTypes(body.items);\n\n      const resourceRefsByResourceType = body.items.reduce<\n        Record<string, Set<string>>\n      >((acc, item) => {\n        if (!acc[item.resourceType]) {\n          acc[item.resourceType] = new Set();\n        }\n        acc[item.resourceType].add(item.resourceRef);\n        return acc;\n      }, {});\n\n      const resourcesByResourceType: Record<string, Record<string, any>> = {};\n      for (const resourceType of Object.keys(resourceRefsByResourceType)) {\n        const getResources = getResourcesByResourceType[resourceType];\n        if (!getResources) {\n          throw new NotImplementedError(\n            `This plugin does not expose any permission rule or can't evaluate the conditions request for ${resourceType}`,\n          );\n        }\n        const resourceRefs = Array.from(\n          resourceRefsByResourceType[resourceType],\n        );\n        const resources = await getResources(resourceRefs);\n        resourceRefs.forEach((resourceRef, index) => {\n          if (!resourcesByResourceType[resourceType]) {\n            resourcesByResourceType[resourceType] = {};\n          }\n          resourcesByResourceType[resourceType][resourceRef] = resources[index];\n        });\n      }\n\n      return res.json({\n        items: body.items.map(request => ({\n          id: request.id,\n          result: applyConditions(\n            request.conditions,\n            resourcesByResourceType[request.resourceType][request.resourceRef],\n            ruleMapByResourceType[request.resourceType],\n          )\n            ? AuthorizeResult.ALLOW\n            : AuthorizeResult.DENY,\n        })),\n      });\n    },\n  );\n\n  // TODO(belugas): Remove this when dropping support to the legacy backend system because setting the error handler manually is no logger required in the new system.\n  router.use(errorHandler());\n\n  return router;\n}\n\nfunction isCreatePermissionIntegrationRouterResourceOptions<\n  TResourceType extends string,\n  TResource,\n>(\n  options:\n    | { permissions: Array<Permission> }\n    | CreatePermissionIntegrationRouterResourceOptions<\n        TResourceType,\n        TResource\n      >,\n): options is CreatePermissionIntegrationRouterResourceOptions<\n  TResourceType,\n  TResource\n> {\n  return (\n    (\n      options as CreatePermissionIntegrationRouterResourceOptions<\n        TResourceType,\n        TResource\n      >\n    ).resourceType !== undefined\n  );\n}\n"],"names":["z","isAndCriteria","isOrCriteria","isNotCriteria","InputError","createGetRule","AuthorizeResult","Router","express","zodToJsonSchema","NotImplementedError","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;AA2CA,MAAM,2BAEFA,KAAE,CAAA,IAAA;AAAA,EAAK,MACTA,MAAE,KAAM,CAAA;AAAA,IACNA,KAAA,CAAE,MAAO,CAAA,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAS,EAAA,EAAG,CAAA;AAAA,IAChEA,KAAA,CAAE,MAAO,CAAA,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAS,EAAA,EAAG,CAAA;AAAA,IAChEA,KAAE,CAAA,MAAA,CAAO,EAAE,GAAA,EAAK,0BAA0B,CAAA;AAAA,IAC1CA,MAAE,MAAO,CAAA;AAAA,MACP,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,MACf,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,MACvB,QAAQA,KAAE,CAAA,MAAA,CAAOA,MAAE,GAAI,EAAC,EAAE,QAAS;AAAA,KACpC;AAAA,GACF;AACH,CAAA;AAEA,MAAM,4BAAA,GAA+BA,MAAE,MAAO,CAAA;AAAA,EAC5C,OAAOA,KAAE,CAAA,KAAA;AAAA,IACPA,MAAE,MAAO,CAAA;AAAA,MACP,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,MACb,WAAA,EAAaA,MAAE,MAAO,EAAA;AAAA,MACtB,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,MACvB,UAAY,EAAA;AAAA,KACb;AAAA;AAEL,CAAC,CAAA;AA2DD,MAAM,eAAkB,GAAA,CACtB,QACA,EAAA,QAAA,EACA,OACY,KAAA;AAIZ,EAAA,IAAI,aAAa,KAAW,CAAA,EAAA;AAC1B,IAAO,OAAA,KAAA;AAAA;AAGT,EAAI,IAAAC,kBAAA,CAAc,QAAQ,CAAG,EAAA;AAC3B,IAAA,OAAO,SAAS,KAAM,CAAA,KAAA;AAAA,MAAM,CAC1B,KAAA,KAAA,eAAA,CAAgB,KAAO,EAAA,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,GACF,MAAA,IAAWC,iBAAa,CAAA,QAAQ,CAAG,EAAA;AACjC,IAAA,OAAO,SAAS,KAAM,CAAA,IAAA;AAAA,MAAK,CACzB,KAAA,KAAA,eAAA,CAAgB,KAAO,EAAA,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,GACF,MAAA,IAAWC,kBAAc,CAAA,QAAQ,CAAG,EAAA;AAClC,IAAA,OAAO,CAAC,eAAA,CAAgB,QAAS,CAAA,GAAA,EAAK,UAAU,OAAO,CAAA;AAAA;AAGzD,EAAM,MAAA,IAAA,GAAO,OAAQ,CAAA,QAAA,CAAS,IAAI,CAAA;AAClC,EAAA,MAAM,MAAS,GAAA,IAAA,CAAK,YAAc,EAAA,SAAA,CAAU,SAAS,MAAM,CAAA;AAE3D,EAAI,IAAA,MAAA,IAAU,CAAC,MAAA,CAAO,OAAS,EAAA;AAC7B,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAkC,8BAAA,CAAA,EAAA,MAAA,CAAO,KAAK,CAAA;AAAA;AAGrE,EAAA,OAAO,KAAK,KAAM,CAAA,QAAA,EAAU,QAAS,CAAA,MAAA,IAAU,EAAE,CAAA;AACnD,CAAA;AAQa,MAAA,yBAAA,GAA4B,CACvC,KACG,KAAA;AACH,EAAM,MAAA,OAAA,GAAUC,mBAAc,KAAK,CAAA;AAEnC,EAAO,OAAA,CACL,UACA,QACY,KAAA;AACZ,IAAI,IAAA,QAAA,CAAS,MAAW,KAAAC,sCAAA,CAAgB,WAAa,EAAA;AACnD,MAAA,OAAO,eAAgB,CAAA,QAAA,CAAS,UAAY,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA;AAG/D,IAAO,OAAA,QAAA,CAAS,WAAWA,sCAAgB,CAAA,KAAA;AAAA,GAC7C;AACF;AAiHO,SAAS,kCAQd,OAcgB,EAAA;AAChB,EAAA,MAAM,oBAAuB,GAAA,OAAA;AAC7B,EAAA,MAAM,UAAa,GAAA;AAAA,IACjB,oBAAA,CAAqB,SAAY,GAAA,oBAAA,CAAqB,SAAY,GAAA;AAAA,IAClE,IAAK,EAAA;AACP,EAAA,MAAM,WAAW,UAAW,CAAA,OAAA;AAAA,IAC1B,CAAA,MAAA,KAEI,MAIA,CAAA,KAAA,IAAS;AAAC,GAChB;AAEA,EAAA,MAAM,iBAAiB,KAAM,CAAA,IAAA;AAAA,IAC3B,IAAI,GAAA;AAAA,MACF;AAAA,QACE,GAAK,OAA0C,CAAA,WAAA,IAAe,EAAC;AAAA,QAC/D,GAAI,oBAAqB,CAAA,SAAA,EAAW,OAAQ,CAAA,CAAA,CAAA,KAAK,EAAE,WAAe,IAAA,EAAE,CAAA,IAClE;AAAC,QACH,GAAI,CAAA,CAAA,CAAA,KAAK,CAAC,CAAE,CAAA,IAAA,EAAM,CAAC,CAAC;AAAA,MACtB,MAAO;AAAA,GACX;AAEA,EAAA,MAAM,gBAAmB,GAAA,UAAA,CAAW,MAAO,CAAA,CAAC,KAAK,MAAW,KAAA;AAC1D,IACE,IAAA,kDAAA;AAAA,MACE;AAAA,KAOF,EAAA;AACA,MAAI,GAAA,CAAA,IAAA;AAAA,QAEA,MAIA,CAAA;AAAA,OACJ;AAAA;AAEF,IAAO,OAAA,GAAA;AAAA,GACT,EAAG,EAAc,CAAA;AAEjB,EAAA,MAAM,SAASC,uBAAO,EAAA;AACtB,EAAO,MAAA,CAAA,GAAA,CAAIC,wBAAQ,CAAA,IAAA,EAAM,CAAA;AAEzB,EAAA,MAAA,CAAO,GAAI,CAAA,6CAAA,EAA+C,CAAC,CAAA,EAAG,GAAQ,KAAA;AACpE,IAAA,MAAM,kBAAoD,QAAS,CAAA,GAAA;AAAA,MACjE,CAAS,IAAA,MAAA;AAAA,QACP,MAAM,IAAK,CAAA,IAAA;AAAA,QACX,aAAa,IAAK,CAAA,WAAA;AAAA,QAClB,cAAc,IAAK,CAAA,YAAA;AAAA,QACnB,YAAA,EAAcC,iCAAgB,IAAK,CAAA,YAAA,IAAgBT,MAAE,MAAO,CAAA,EAAE,CAAC;AAAA,OACjE;AAAA,KACF;AAEA,IAAA,MAAM,YAAiC,GAAA;AAAA,MACrC,WAAa,EAAA,cAAA;AAAA,MACb,KAAO,EAAA;AAAA,KACT;AAEA,IAAO,OAAA,GAAA,CAAI,KAAK,YAAY,CAAA;AAAA,GAC7B,CAAA;AAED,EAAO,MAAA,CAAA,IAAA;AAAA,IACL,qDAAA;AAAA,IACA,OAAO,KAAK,GAAoD,KAAA;AAC9D,MAAA,MAAM,wBAGF,EAAC;AACL,MAAA,MAAM,6BAMF,EAAC;AAEL,MAAA,KAAA,IAAS,UAAU,UAAY,EAAA;AAC7B,QAAS,MAAA,GAAA,MAAA;AAMT,QAAI,IAAA,kDAAA,CAAmD,MAAM,CAAG,EAAA;AAC9D,UAAsB,qBAAA,CAAA,MAAA,CAAO,YAAY,CAAI,GAAAK,kBAAA;AAAA,YAC3C,MAAO,CAAA;AAAA,WACT;AAEA,UAA2B,0BAAA,CAAA,MAAA,CAAO,YAAY,CAAA,GAAI,MAAO,CAAA,YAAA;AAAA;AAC3D;AAGF,MAAM,MAAA,wBAAA,GAA2B,CAC/B,QACG,KAAA;AACH,QAAA,MAAM,oBAAuB,GAAA,QAAA,CAC1B,MAAO,CAAA,CAAA,OAAA,KAAW,CAAC,gBAAiB,CAAA,QAAA,CAAS,OAAQ,CAAA,YAAY,CAAC,CAAA,CAClE,GAAI,CAAA,CAAA,OAAA,KAAW,QAAQ,YAAY,CAAA;AAEtC,QAAA,IAAI,qBAAqB,MAAQ,EAAA;AAC/B,UAAA,MAAM,IAAID,iBAAA;AAAA,YACR,CAA8B,2BAAA,EAAA,oBAAA,CAAqB,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,WAC/D;AAAA;AACF,OACF;AAEA,MAAA,MAAM,WAAc,GAAA,4BAAA,CAA6B,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAEnE,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIA,iBAAA,CAAW,WAAY,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAGnD,MAAA,MAAM,OAAO,WAAY,CAAA,IAAA;AAEzB,MAAA,wBAAA,CAAyB,KAAK,KAAK,CAAA;AAEnC,MAAA,MAAM,6BAA6B,IAAK,CAAA,KAAA,CAAM,MAE5C,CAAA,CAAC,KAAK,IAAS,KAAA;AACf,QAAA,IAAI,CAAC,GAAA,CAAI,IAAK,CAAA,YAAY,CAAG,EAAA;AAC3B,UAAA,GAAA,CAAI,IAAK,CAAA,YAAY,CAAI,mBAAA,IAAI,GAAI,EAAA;AAAA;AAEnC,QAAA,GAAA,CAAI,IAAK,CAAA,YAAY,CAAE,CAAA,GAAA,CAAI,KAAK,WAAW,CAAA;AAC3C,QAAO,OAAA,GAAA;AAAA,OACT,EAAG,EAAE,CAAA;AAEL,MAAA,MAAM,0BAA+D,EAAC;AACtE,MAAA,KAAA,MAAW,YAAgB,IAAA,MAAA,CAAO,IAAK,CAAA,0BAA0B,CAAG,EAAA;AAClE,QAAM,MAAA,YAAA,GAAe,2BAA2B,YAAY,CAAA;AAC5D,QAAA,IAAI,CAAC,YAAc,EAAA;AACjB,UAAA,MAAM,IAAIM,0BAAA;AAAA,YACR,gGAAgG,YAAY,CAAA;AAAA,WAC9G;AAAA;AAEF,QAAA,MAAM,eAAe,KAAM,CAAA,IAAA;AAAA,UACzB,2BAA2B,YAAY;AAAA,SACzC;AACA,QAAM,MAAA,SAAA,GAAY,MAAM,YAAA,CAAa,YAAY,CAAA;AACjD,QAAa,YAAA,CAAA,OAAA,CAAQ,CAAC,WAAA,EAAa,KAAU,KAAA;AAC3C,UAAI,IAAA,CAAC,uBAAwB,CAAA,YAAY,CAAG,EAAA;AAC1C,YAAwB,uBAAA,CAAA,YAAY,IAAI,EAAC;AAAA;AAE3C,UAAA,uBAAA,CAAwB,YAAY,CAAA,CAAE,WAAW,CAAA,GAAI,UAAU,KAAK,CAAA;AAAA,SACrE,CAAA;AAAA;AAGH,MAAA,OAAO,IAAI,IAAK,CAAA;AAAA,QACd,KAAO,EAAA,IAAA,CAAK,KAAM,CAAA,GAAA,CAAI,CAAY,OAAA,MAAA;AAAA,UAChC,IAAI,OAAQ,CAAA,EAAA;AAAA,UACZ,MAAQ,EAAA,eAAA;AAAA,YACN,OAAQ,CAAA,UAAA;AAAA,YACR,uBAAwB,CAAA,OAAA,CAAQ,YAAY,CAAA,CAAE,QAAQ,WAAW,CAAA;AAAA,YACjE,qBAAA,CAAsB,QAAQ,YAAY;AAAA,WAC5C,GACIJ,sCAAgB,CAAA,KAAA,GAChBA,sCAAgB,CAAA;AAAA,SACpB,CAAA;AAAA,OACH,CAAA;AAAA;AACH,GACF;AAGA,EAAO,MAAA,CAAA,GAAA,CAAIK,4BAAc,CAAA;AAEzB,EAAO,OAAA,MAAA;AACT;AAEA,SAAS,mDAIP,OASA,EAAA;AACA,EAAA,OAEI,QAIA,YAAiB,KAAA,KAAA,CAAA;AAEvB;;;;;"}
+{"version":3,"file":"createPermissionIntegrationRouter.cjs.js","sources":["../../src/integration/createPermissionIntegrationRouter.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express, { Response } from 'express';\nimport Router from 'express-promise-router';\nimport { z } from 'zod';\nimport zodToJsonSchema from 'zod-to-json-schema';\nimport { InputError } from '@backstage/errors';\nimport {\n  AuthorizeResult,\n  DefinitivePolicyDecision,\n  IdentifiedPermissionMessage,\n  MetadataResponse as CommonMetadataResponse,\n  MetadataResponseSerializedRule as CommonMetadataResponseSerializedRule,\n  Permission,\n  PermissionCondition,\n  PermissionCriteria,\n  PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport { PermissionRule } from '../types';\nimport {\n  NoInfer,\n  createGetRule,\n  isAndCriteria,\n  isNotCriteria,\n  isOrCriteria,\n} from './util';\nimport { NotImplementedError } from '@backstage/errors';\n\nconst permissionCriteriaSchema: z.ZodSchema<\n  PermissionCriteria<PermissionCondition>\n> = z.lazy(() =>\n  z.union([\n    z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }),\n    z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }),\n    z.object({ not: permissionCriteriaSchema }),\n    z.object({\n      rule: z.string(),\n      resourceType: z.string(),\n      params: z.record(z.any()).optional(),\n    }),\n  ]),\n);\n\nconst applyConditionsRequestSchema = z.object({\n  items: z.array(\n    z.object({\n      id: z.string(),\n      resourceRef: z.string(),\n      resourceType: z.string(),\n      conditions: permissionCriteriaSchema,\n    }),\n  ),\n});\n\n/**\n * A request to load the referenced resource and apply conditions in order to\n * finalize a conditional authorization response.\n *\n * @public\n */\nexport type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{\n  resourceRef: string;\n  resourceType: string;\n  conditions: PermissionCriteria<PermissionCondition>;\n}>;\n\n/**\n * A batch of {@link ApplyConditionsRequestEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsRequest = {\n  items: ApplyConditionsRequestEntry[];\n};\n\n/**\n * The result of applying the conditions, expressed as a definitive authorize\n * result of ALLOW or DENY.\n *\n * @public\n */\nexport type ApplyConditionsResponseEntry =\n  IdentifiedPermissionMessage<DefinitivePolicyDecision>;\n\n/**\n * A batch of {@link ApplyConditionsResponseEntry} objects.\n *\n * @public\n */\nexport type ApplyConditionsResponse = {\n  items: ApplyConditionsResponseEntry[];\n};\n\n/**\n * Serialized permission rules, with the paramsSchema\n * converted from a ZodSchema to a JsonSchema.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponseSerializedRule =\n  CommonMetadataResponseSerializedRule;\n\n/**\n * Response type for the .metadata endpoint.\n *\n * @public\n * @deprecated Please import from `@backstage/plugin-permission-common` instead.\n */\nexport type MetadataResponse = CommonMetadataResponse;\n\nconst applyConditions = <TResourceType extends string, TResource>(\n  criteria: PermissionCriteria<PermissionCondition<TResourceType>>,\n  resource: TResource | undefined,\n  getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,\n): boolean => {\n  // If resource was not found, deny. This avoids leaking information from the\n  // apply-conditions API which would allow a user to differentiate between\n  // non-existent resources and resources to which they do not have access.\n  if (resource === undefined) {\n    return false;\n  }\n\n  if (isAndCriteria(criteria)) {\n    return criteria.allOf.every(child =>\n      applyConditions(child, resource, getRule),\n    );\n  } else if (isOrCriteria(criteria)) {\n    return criteria.anyOf.some(child =>\n      applyConditions(child, resource, getRule),\n    );\n  } else if (isNotCriteria(criteria)) {\n    return !applyConditions(criteria.not, resource, getRule);\n  }\n\n  const rule = getRule(criteria.rule);\n  const result = rule.paramsSchema?.safeParse(criteria.params);\n\n  if (result && !result.success) {\n    throw new InputError(`Parameters to rule are invalid`, result.error);\n  }\n\n  return rule.apply(resource, criteria.params ?? {});\n};\n\n/**\n * Takes some permission conditions and returns a definitive authorization result\n * on the resource to which they apply.\n *\n * @public\n */\nexport const createConditionAuthorizer = <TResource, TQuery>(\n  rules: PermissionRule<TResource, TQuery, string>[],\n) => {\n  const getRule = createGetRule(rules);\n\n  return (\n    decision: PolicyDecision,\n    resource: TResource | undefined,\n  ): boolean => {\n    if (decision.result === AuthorizeResult.CONDITIONAL) {\n      return applyConditions(decision.conditions, resource, getRule);\n    }\n\n    return decision.result === AuthorizeResult.ALLOW;\n  };\n};\n\n/**\n * Options for creating a permission integration router specific\n * for a particular resource type.\n *\n * @public\n */\nexport type CreatePermissionIntegrationRouterResourceOptions<\n  TResourceType extends string,\n  TResource,\n> = {\n  resourceType: TResourceType;\n  permissions?: Array<Permission>;\n  // Do not infer value of TResourceType from supplied rules.\n  // instead only consider the resourceType parameter, and\n  // consider any rules whose resource type does not match\n  // to be an error.\n  rules: PermissionRule<TResource, any, NoInfer<TResourceType>>[];\n  getResources?: (\n    resourceRefs: string[],\n  ) => Promise<Array<TResource | undefined>>;\n};\n\n/**\n * Options for creating a permission integration router exposing\n * permissions and rules from multiple resource types.\n *\n * @public\n */\nexport type PermissionIntegrationRouterOptions<\n  TResourceType1 extends string = string,\n  TResource1 = any,\n  TResourceType2 extends string = string,\n  TResource2 = any,\n  TResourceType3 extends string = string,\n  TResource3 = any,\n> = {\n  resources: Readonly<\n    | [\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >,\n      ]\n    | [\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType2,\n          TResource2\n        >,\n      ]\n    | [\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType2,\n          TResource2\n        >,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType3,\n          TResource3\n        >,\n      ]\n  >;\n};\n\n/**\n * Create an express Router which provides an authorization route to allow\n * integration between the permission backend and other Backstage backend\n * plugins. Plugin owners that wish to support conditional authorization for\n * their resources should add the router created by this function to their\n * express app inside their `createRouter` implementation.\n *\n * In case the `permissions` option is provided, the router also\n * provides a route that exposes permissions and routes of a plugin.\n *\n * In case resources is provided, the routes can handle permissions\n * for multiple resource types.\n *\n * @remarks\n *\n * To make this concrete, we can use the Backstage software catalog as an\n * example. The catalog has conditional rules around access to specific\n * _entities_ in the catalog. The _type_ of resource is captured here as\n * `resourceType`, a string identifier (`catalog-entity` in this example) that\n * can be provided with permission definitions. This is merely a _type_ to\n * verify that conditions in an authorization policy are constructed correctly,\n * not a reference to a specific resource.\n *\n * The `rules` parameter is an array of {@link PermissionRule}s that introduce\n * conditional filtering logic for resources; for the catalog, these are things\n * like `isEntityOwner` or `hasAnnotation`. Rules describe how to filter a list\n * of resources, and the `conditions` returned allow these rules to be applied\n * with specific parameters (such as 'group:default/team-a', or\n * 'backstage.io/edit-url').\n *\n * The `getResources` argument should load resources based on a reference\n * identifier. For the catalog, this is an\n * {@link @backstage/catalog-model#EntityRef}. For other plugins, this can be\n * any serialized format. This is used to construct the\n * `createPermissionIntegrationRouter`, a function to add an authorization route\n * to your backend plugin. This function will be called by the\n * `permission-backend` when authorization conditions relating to this plugin\n * need to be evaluated.\n *\n * @public\n */\nexport function createPermissionIntegrationRouter<\n  TResourceType1 extends string,\n  TResource1,\n  TResourceType2 extends string,\n  TResource2,\n  TResourceType3 extends string,\n  TResource3,\n>(\n  options:\n    | { permissions: Array<Permission> }\n    | CreatePermissionIntegrationRouterResourceOptions<\n        TResourceType1,\n        TResource1\n      >\n    | PermissionIntegrationRouterOptions<\n        TResourceType1,\n        TResource1,\n        TResourceType2,\n        TResource2,\n        TResourceType3,\n        TResource3\n      >,\n): express.Router {\n  const optionsWithResources = options as PermissionIntegrationRouterOptions;\n  const allOptions = [\n    optionsWithResources.resources ? optionsWithResources.resources : options,\n  ].flat();\n  const allRules = allOptions.flatMap(\n    option =>\n      (\n        option as CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >\n      ).rules || [],\n  );\n\n  const allPermissions = Array.from(\n    new Map(\n      [\n        ...((options as { permissions: Permission[] }).permissions || []),\n        ...(optionsWithResources.resources?.flatMap(o => o.permissions || []) ||\n          []),\n      ].map(i => [i.name, i]),\n    ).values(),\n  );\n\n  const allResourceTypes = allOptions.reduce((acc, option) => {\n    if (\n      isCreatePermissionIntegrationRouterResourceOptions(\n        option as\n          | { permissions: Array<Permission> }\n          | CreatePermissionIntegrationRouterResourceOptions<\n              TResourceType1,\n              TResource1\n            >,\n      )\n    ) {\n      acc.push(\n        (\n          option as CreatePermissionIntegrationRouterResourceOptions<\n            TResourceType1,\n            TResource1\n          >\n        ).resourceType,\n      );\n    }\n    return acc;\n  }, [] as string[]);\n\n  const router = Router();\n  router.use(express.json());\n\n  router.get('/.well-known/backstage/permissions/metadata', (_, res) => {\n    const serializedRules: MetadataResponseSerializedRule[] = allRules.map(\n      rule => ({\n        name: rule.name,\n        description: rule.description,\n        resourceType: rule.resourceType,\n        paramsSchema: zodToJsonSchema(rule.paramsSchema ?? z.object({})),\n      }),\n    );\n\n    const responseJson: MetadataResponse = {\n      permissions: allPermissions,\n      rules: serializedRules,\n    };\n\n    return res.json(responseJson);\n  });\n\n  router.post(\n    '/.well-known/backstage/permissions/apply-conditions',\n    async (req, res: Response<ApplyConditionsResponse | string>) => {\n      const ruleMapByResourceType: Record<\n        string,\n        ReturnType<typeof createGetRule>\n      > = {};\n      const getResourcesByResourceType: Record<\n        string,\n        CreatePermissionIntegrationRouterResourceOptions<\n          TResourceType1,\n          TResource1\n        >['getResources']\n      > = {};\n\n      for (let option of allOptions) {\n        option = option as\n          | { permissions: Array<Permission> }\n          | CreatePermissionIntegrationRouterResourceOptions<\n              TResourceType1,\n              TResource1\n            >;\n        if (isCreatePermissionIntegrationRouterResourceOptions(option)) {\n          ruleMapByResourceType[option.resourceType] = createGetRule(\n            option.rules,\n          );\n\n          getResourcesByResourceType[option.resourceType] = option.getResources;\n        }\n      }\n\n      const assertValidResourceTypes = (\n        requests: ApplyConditionsRequestEntry[],\n      ) => {\n        const invalidResourceTypes = requests\n          .filter(request => !allResourceTypes.includes(request.resourceType))\n          .map(request => request.resourceType);\n\n        if (invalidResourceTypes.length) {\n          throw new InputError(\n            `Unexpected resource types: ${invalidResourceTypes.join(', ')}.`,\n          );\n        }\n      };\n\n      const parseResult = applyConditionsRequestSchema.safeParse(req.body);\n\n      if (!parseResult.success) {\n        throw new InputError(parseResult.error.toString());\n      }\n\n      const body = parseResult.data;\n\n      assertValidResourceTypes(body.items);\n\n      const resourceRefsByResourceType = body.items.reduce<\n        Record<string, Set<string>>\n      >((acc, item) => {\n        if (!acc[item.resourceType]) {\n          acc[item.resourceType] = new Set();\n        }\n        acc[item.resourceType].add(item.resourceRef);\n        return acc;\n      }, {});\n\n      const resourcesByResourceType: Record<string, Record<string, any>> = {};\n      for (const resourceType of Object.keys(resourceRefsByResourceType)) {\n        const getResources = getResourcesByResourceType[resourceType];\n        if (!getResources) {\n          throw new NotImplementedError(\n            `This plugin does not expose any permission rule or can't evaluate the conditions request for ${resourceType}`,\n          );\n        }\n        const resourceRefs = Array.from(\n          resourceRefsByResourceType[resourceType],\n        );\n        const resources = await getResources(resourceRefs);\n        resourceRefs.forEach((resourceRef, index) => {\n          if (!resourcesByResourceType[resourceType]) {\n            resourcesByResourceType[resourceType] = {};\n          }\n          resourcesByResourceType[resourceType][resourceRef] = resources[index];\n        });\n      }\n\n      return res.json({\n        items: body.items.map(request => ({\n          id: request.id,\n          result: applyConditions(\n            request.conditions,\n            resourcesByResourceType[request.resourceType][request.resourceRef],\n            ruleMapByResourceType[request.resourceType],\n          )\n            ? AuthorizeResult.ALLOW\n            : AuthorizeResult.DENY,\n        })),\n      });\n    },\n  );\n\n  return router;\n}\n\nfunction isCreatePermissionIntegrationRouterResourceOptions<\n  TResourceType extends string,\n  TResource,\n>(\n  options:\n    | { permissions: Array<Permission> }\n    | CreatePermissionIntegrationRouterResourceOptions<\n        TResourceType,\n        TResource\n      >,\n): options is CreatePermissionIntegrationRouterResourceOptions<\n  TResourceType,\n  TResource\n> {\n  return (\n    (\n      options as CreatePermissionIntegrationRouterResourceOptions<\n        TResourceType,\n        TResource\n      >\n    ).resourceType !== undefined\n  );\n}\n"],"names":["z","isAndCriteria","isOrCriteria","isNotCriteria","InputError","createGetRule","AuthorizeResult","Router","express","zodToJsonSchema","NotImplementedError"],"mappings":";;;;;;;;;;;;;;;;AA0CA,MAAM,2BAEFA,KAAE,CAAA,IAAA;AAAA,EAAK,MACTA,MAAE,KAAM,CAAA;AAAA,IACNA,KAAA,CAAE,MAAO,CAAA,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAS,EAAA,EAAG,CAAA;AAAA,IAChEA,KAAA,CAAE,MAAO,CAAA,EAAE,KAAO,EAAAA,KAAA,CAAE,MAAM,wBAAwB,CAAA,CAAE,QAAS,EAAA,EAAG,CAAA;AAAA,IAChEA,KAAE,CAAA,MAAA,CAAO,EAAE,GAAA,EAAK,0BAA0B,CAAA;AAAA,IAC1CA,MAAE,MAAO,CAAA;AAAA,MACP,IAAA,EAAMA,MAAE,MAAO,EAAA;AAAA,MACf,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,MACvB,QAAQA,KAAE,CAAA,MAAA,CAAOA,MAAE,GAAI,EAAC,EAAE,QAAS;AAAA,KACpC;AAAA,GACF;AACH,CAAA;AAEA,MAAM,4BAAA,GAA+BA,MAAE,MAAO,CAAA;AAAA,EAC5C,OAAOA,KAAE,CAAA,KAAA;AAAA,IACPA,MAAE,MAAO,CAAA;AAAA,MACP,EAAA,EAAIA,MAAE,MAAO,EAAA;AAAA,MACb,WAAA,EAAaA,MAAE,MAAO,EAAA;AAAA,MACtB,YAAA,EAAcA,MAAE,MAAO,EAAA;AAAA,MACvB,UAAY,EAAA;AAAA,KACb;AAAA;AAEL,CAAC,CAAA;AA2DD,MAAM,eAAkB,GAAA,CACtB,QACA,EAAA,QAAA,EACA,OACY,KAAA;AAIZ,EAAA,IAAI,aAAa,KAAW,CAAA,EAAA;AAC1B,IAAO,OAAA,KAAA;AAAA;AAGT,EAAI,IAAAC,kBAAA,CAAc,QAAQ,CAAG,EAAA;AAC3B,IAAA,OAAO,SAAS,KAAM,CAAA,KAAA;AAAA,MAAM,CAC1B,KAAA,KAAA,eAAA,CAAgB,KAAO,EAAA,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,GACF,MAAA,IAAWC,iBAAa,CAAA,QAAQ,CAAG,EAAA;AACjC,IAAA,OAAO,SAAS,KAAM,CAAA,IAAA;AAAA,MAAK,CACzB,KAAA,KAAA,eAAA,CAAgB,KAAO,EAAA,QAAA,EAAU,OAAO;AAAA,KAC1C;AAAA,GACF,MAAA,IAAWC,kBAAc,CAAA,QAAQ,CAAG,EAAA;AAClC,IAAA,OAAO,CAAC,eAAA,CAAgB,QAAS,CAAA,GAAA,EAAK,UAAU,OAAO,CAAA;AAAA;AAGzD,EAAM,MAAA,IAAA,GAAO,OAAQ,CAAA,QAAA,CAAS,IAAI,CAAA;AAClC,EAAA,MAAM,MAAS,GAAA,IAAA,CAAK,YAAc,EAAA,SAAA,CAAU,SAAS,MAAM,CAAA;AAE3D,EAAI,IAAA,MAAA,IAAU,CAAC,MAAA,CAAO,OAAS,EAAA;AAC7B,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAkC,8BAAA,CAAA,EAAA,MAAA,CAAO,KAAK,CAAA;AAAA;AAGrE,EAAA,OAAO,KAAK,KAAM,CAAA,QAAA,EAAU,QAAS,CAAA,MAAA,IAAU,EAAE,CAAA;AACnD,CAAA;AAQa,MAAA,yBAAA,GAA4B,CACvC,KACG,KAAA;AACH,EAAM,MAAA,OAAA,GAAUC,mBAAc,KAAK,CAAA;AAEnC,EAAO,OAAA,CACL,UACA,QACY,KAAA;AACZ,IAAI,IAAA,QAAA,CAAS,MAAW,KAAAC,sCAAA,CAAgB,WAAa,EAAA;AACnD,MAAA,OAAO,eAAgB,CAAA,QAAA,CAAS,UAAY,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA;AAG/D,IAAO,OAAA,QAAA,CAAS,WAAWA,sCAAgB,CAAA,KAAA;AAAA,GAC7C;AACF;AAiHO,SAAS,kCAQd,OAcgB,EAAA;AAChB,EAAA,MAAM,oBAAuB,GAAA,OAAA;AAC7B,EAAA,MAAM,UAAa,GAAA;AAAA,IACjB,oBAAA,CAAqB,SAAY,GAAA,oBAAA,CAAqB,SAAY,GAAA;AAAA,IAClE,IAAK,EAAA;AACP,EAAA,MAAM,WAAW,UAAW,CAAA,OAAA;AAAA,IAC1B,CAAA,MAAA,KAEI,MAIA,CAAA,KAAA,IAAS;AAAC,GAChB;AAEA,EAAA,MAAM,iBAAiB,KAAM,CAAA,IAAA;AAAA,IAC3B,IAAI,GAAA;AAAA,MACF;AAAA,QACE,GAAK,OAA0C,CAAA,WAAA,IAAe,EAAC;AAAA,QAC/D,GAAI,oBAAqB,CAAA,SAAA,EAAW,OAAQ,CAAA,CAAA,CAAA,KAAK,EAAE,WAAe,IAAA,EAAE,CAAA,IAClE;AAAC,QACH,GAAI,CAAA,CAAA,CAAA,KAAK,CAAC,CAAE,CAAA,IAAA,EAAM,CAAC,CAAC;AAAA,MACtB,MAAO;AAAA,GACX;AAEA,EAAA,MAAM,gBAAmB,GAAA,UAAA,CAAW,MAAO,CAAA,CAAC,KAAK,MAAW,KAAA;AAC1D,IACE,IAAA,kDAAA;AAAA,MACE;AAAA,KAOF,EAAA;AACA,MAAI,GAAA,CAAA,IAAA;AAAA,QAEA,MAIA,CAAA;AAAA,OACJ;AAAA;AAEF,IAAO,OAAA,GAAA;AAAA,GACT,EAAG,EAAc,CAAA;AAEjB,EAAA,MAAM,SAASC,uBAAO,EAAA;AACtB,EAAO,MAAA,CAAA,GAAA,CAAIC,wBAAQ,CAAA,IAAA,EAAM,CAAA;AAEzB,EAAA,MAAA,CAAO,GAAI,CAAA,6CAAA,EAA+C,CAAC,CAAA,EAAG,GAAQ,KAAA;AACpE,IAAA,MAAM,kBAAoD,QAAS,CAAA,GAAA;AAAA,MACjE,CAAS,IAAA,MAAA;AAAA,QACP,MAAM,IAAK,CAAA,IAAA;AAAA,QACX,aAAa,IAAK,CAAA,WAAA;AAAA,QAClB,cAAc,IAAK,CAAA,YAAA;AAAA,QACnB,YAAA,EAAcC,iCAAgB,IAAK,CAAA,YAAA,IAAgBT,MAAE,MAAO,CAAA,EAAE,CAAC;AAAA,OACjE;AAAA,KACF;AAEA,IAAA,MAAM,YAAiC,GAAA;AAAA,MACrC,WAAa,EAAA,cAAA;AAAA,MACb,KAAO,EAAA;AAAA,KACT;AAEA,IAAO,OAAA,GAAA,CAAI,KAAK,YAAY,CAAA;AAAA,GAC7B,CAAA;AAED,EAAO,MAAA,CAAA,IAAA;AAAA,IACL,qDAAA;AAAA,IACA,OAAO,KAAK,GAAoD,KAAA;AAC9D,MAAA,MAAM,wBAGF,EAAC;AACL,MAAA,MAAM,6BAMF,EAAC;AAEL,MAAA,KAAA,IAAS,UAAU,UAAY,EAAA;AAC7B,QAAS,MAAA,GAAA,MAAA;AAMT,QAAI,IAAA,kDAAA,CAAmD,MAAM,CAAG,EAAA;AAC9D,UAAsB,qBAAA,CAAA,MAAA,CAAO,YAAY,CAAI,GAAAK,kBAAA;AAAA,YAC3C,MAAO,CAAA;AAAA,WACT;AAEA,UAA2B,0BAAA,CAAA,MAAA,CAAO,YAAY,CAAA,GAAI,MAAO,CAAA,YAAA;AAAA;AAC3D;AAGF,MAAM,MAAA,wBAAA,GAA2B,CAC/B,QACG,KAAA;AACH,QAAA,MAAM,oBAAuB,GAAA,QAAA,CAC1B,MAAO,CAAA,CAAA,OAAA,KAAW,CAAC,gBAAiB,CAAA,QAAA,CAAS,OAAQ,CAAA,YAAY,CAAC,CAAA,CAClE,GAAI,CAAA,CAAA,OAAA,KAAW,QAAQ,YAAY,CAAA;AAEtC,QAAA,IAAI,qBAAqB,MAAQ,EAAA;AAC/B,UAAA,MAAM,IAAID,iBAAA;AAAA,YACR,CAA8B,2BAAA,EAAA,oBAAA,CAAqB,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,WAC/D;AAAA;AACF,OACF;AAEA,MAAA,MAAM,WAAc,GAAA,4BAAA,CAA6B,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAEnE,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIA,iBAAA,CAAW,WAAY,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAGnD,MAAA,MAAM,OAAO,WAAY,CAAA,IAAA;AAEzB,MAAA,wBAAA,CAAyB,KAAK,KAAK,CAAA;AAEnC,MAAA,MAAM,6BAA6B,IAAK,CAAA,KAAA,CAAM,MAE5C,CAAA,CAAC,KAAK,IAAS,KAAA;AACf,QAAA,IAAI,CAAC,GAAA,CAAI,IAAK,CAAA,YAAY,CAAG,EAAA;AAC3B,UAAA,GAAA,CAAI,IAAK,CAAA,YAAY,CAAI,mBAAA,IAAI,GAAI,EAAA;AAAA;AAEnC,QAAA,GAAA,CAAI,IAAK,CAAA,YAAY,CAAE,CAAA,GAAA,CAAI,KAAK,WAAW,CAAA;AAC3C,QAAO,OAAA,GAAA;AAAA,OACT,EAAG,EAAE,CAAA;AAEL,MAAA,MAAM,0BAA+D,EAAC;AACtE,MAAA,KAAA,MAAW,YAAgB,IAAA,MAAA,CAAO,IAAK,CAAA,0BAA0B,CAAG,EAAA;AAClE,QAAM,MAAA,YAAA,GAAe,2BAA2B,YAAY,CAAA;AAC5D,QAAA,IAAI,CAAC,YAAc,EAAA;AACjB,UAAA,MAAM,IAAIM,0BAAA;AAAA,YACR,gGAAgG,YAAY,CAAA;AAAA,WAC9G;AAAA;AAEF,QAAA,MAAM,eAAe,KAAM,CAAA,IAAA;AAAA,UACzB,2BAA2B,YAAY;AAAA,SACzC;AACA,QAAM,MAAA,SAAA,GAAY,MAAM,YAAA,CAAa,YAAY,CAAA;AACjD,QAAa,YAAA,CAAA,OAAA,CAAQ,CAAC,WAAA,EAAa,KAAU,KAAA;AAC3C,UAAI,IAAA,CAAC,uBAAwB,CAAA,YAAY,CAAG,EAAA;AAC1C,YAAwB,uBAAA,CAAA,YAAY,IAAI,EAAC;AAAA;AAE3C,UAAA,uBAAA,CAAwB,YAAY,CAAA,CAAE,WAAW,CAAA,GAAI,UAAU,KAAK,CAAA;AAAA,SACrE,CAAA;AAAA;AAGH,MAAA,OAAO,IAAI,IAAK,CAAA;AAAA,QACd,KAAO,EAAA,IAAA,CAAK,KAAM,CAAA,GAAA,CAAI,CAAY,OAAA,MAAA;AAAA,UAChC,IAAI,OAAQ,CAAA,EAAA;AAAA,UACZ,MAAQ,EAAA,eAAA;AAAA,YACN,OAAQ,CAAA,UAAA;AAAA,YACR,uBAAwB,CAAA,OAAA,CAAQ,YAAY,CAAA,CAAE,QAAQ,WAAW,CAAA;AAAA,YACjE,qBAAA,CAAsB,QAAQ,YAAY;AAAA,WAC5C,GACIJ,sCAAgB,CAAA,KAAA,GAChBA,sCAAgB,CAAA;AAAA,SACpB,CAAA;AAAA,OACH,CAAA;AAAA;AACH,GACF;AAEA,EAAO,OAAA,MAAA;AACT;AAEA,SAAS,mDAIP,OASA,EAAA;AACA,EAAA,OAEI,QAIA,YAAiB,KAAA,KAAA,CAAA;AAEvB;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-permission-node",
-  "version": "0.8.6",
+  "version": "0.8.7-next.1",
   "description": "Common permission and authorization utilities for backend plugins",
   "backstage": {
     "role": "node-library",
@@ -65,11 +65,11 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.25.0",
-    "@backstage/backend-plugin-api": "^1.1.0",
-    "@backstage/config": "^1.3.1",
-    "@backstage/errors": "^1.2.6",
-    "@backstage/plugin-auth-node": "^0.5.5",
-    "@backstage/plugin-permission-common": "^0.8.3",
+    "@backstage/backend-plugin-api": "1.1.1-next.1",
+    "@backstage/config": "1.3.2-next.0",
+    "@backstage/errors": "1.2.7-next.0",
+    "@backstage/plugin-auth-node": "0.5.6-next.1",
+    "@backstage/plugin-permission-common": "0.8.4-next.0",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
@@ -77,8 +77,9 @@
     "zod-to-json-schema": "^3.20.4"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "^1.2.0",
-    "@backstage/cli": "^0.29.4",
+    "@backstage/backend-defaults": "0.7.0-next.1",
+    "@backstage/backend-test-utils": "1.2.1-next.1",
+    "@backstage/cli": "0.29.5-next.1",
     "@types/supertest": "^2.0.8",
     "msw": "^1.0.0",
     "supertest": "^7.0.0"