@backstage/plugin-scaffolder-backend 1.22.8 → 1.22.9

package/dist/cjs/{router-Bj9ovbjU.cjs.js → router-BtUx0eIt.cjs.js}

@@ -164,7 +164,6 @@ function createCatalogRegisterAction(options) {
       }
     },
     async handler(ctx) {
-      var _a, _b;
       const { input } = ctx;
       let catalogInfoUrl;
       if ("catalogInfoUrl" in input) {
@@ -183,10 +182,10 @@ function createCatalogRegisterAction(options) {
         });
       }
       ctx.logger.info(`Registering ${catalogInfoUrl} in the catalog`);
-      const { token } = (_b = await (auth == null ? void 0 : auth.getPluginRequestToken({
+      const { token } = await auth?.getPluginRequestToken({
         onBehalfOf: await ctx.getInitiatorCredentials(),
         targetPluginId: "catalog"
-      }))) != null ? _b : { token: (_a = ctx.secrets) == null ? void 0 : _a.backstageToken };
+      }) ?? { token: ctx.secrets?.backstageToken };
       try {
         await catalogClient.addLocation(
           {
@@ -282,11 +281,10 @@ function createCatalogWriteAction() {
     examples: examples$8,
     supportsDryRun: true,
     async handler(ctx) {
-      var _a;
       ctx.logger.info(`Writing catalog-info.yaml`);
       const { filePath, entity } = ctx.input;
-      const entityRef = (_a = ctx.templateInfo) == null ? void 0 : _a.entityRef;
-      const path = filePath != null ? filePath : "catalog-info.yaml";
+      const entityRef = ctx.templateInfo?.entityRef;
+      const path = filePath ?? "catalog-info.yaml";
       await fs__default.default.writeFile(
         backendPluginApi.resolveSafeChildPath(ctx.workspacePath, path),
         yaml__namespace.stringify({
@@ -373,7 +371,6 @@ function createFetchCatalogEntityAction(options) {
       })
     },
     async handler(ctx) {
-      var _a, _b;
       const { entityRef, entityRefs, optional, defaultKind, defaultNamespace } = ctx.input;
       if (!entityRef && !entityRefs) {
         if (optional) {
@@ -381,10 +378,10 @@ function createFetchCatalogEntityAction(options) {
         }
         throw new Error("Missing entity reference or references");
       }
-      const { token } = (_b = await (auth == null ? void 0 : auth.getPluginRequestToken({
+      const { token } = await auth?.getPluginRequestToken({
         onBehalfOf: await ctx.getInitiatorCredentials(),
         targetPluginId: "catalog"
-      }))) != null ? _b : { token: (_a = ctx.secrets) == null ? void 0 : _a.backstageToken };
+      }) ?? { token: ctx.secrets?.backstageToken };
       if (entityRef) {
         const entity = await catalogClient.getEntityByRef(
           catalogModel.stringifyEntityRef(
@@ -397,7 +394,7 @@ function createFetchCatalogEntityAction(options) {
         if (!entity && !optional) {
           throw new Error(`Entity ${entityRef} not found`);
         }
-        ctx.output("entity", entity != null ? entity : null);
+        ctx.output("entity", entity ?? null);
       }
       if (entityRefs) {
         const entities = await catalogClient.getEntitiesByRefs(
@@ -416,7 +413,7 @@ function createFetchCatalogEntityAction(options) {
           if (!e && !optional) {
             throw new Error(`Entity ${entityRefs[i]} not found`);
           }
-          return e != null ? e : null;
+          return e ?? null;
         });
         ctx.output("entities", finalEntities);
       }
@@ -483,12 +480,11 @@ function createDebugLogAction() {
     },
     supportsDryRun: true,
     async handler(ctx) {
-      var _a, _b;
       ctx.logger.info(JSON.stringify(ctx.input, null, 2));
-      if ((_a = ctx.input) == null ? void 0 : _a.message) {
+      if (ctx.input?.message) {
         ctx.logger.info(ctx.input.message);
       }
-      if ((_b = ctx.input) == null ? void 0 : _b.listWorkspace) {
+      if (ctx.input?.listWorkspace) {
         const files = await recursiveReadDir(ctx.workspacePath);
         ctx.logger.info(
           `Workspace:
@@ -558,7 +554,7 @@ const examples$5 = [
 ];
 
 const id = "debug:wait";
-const MAX_WAIT_TIME_IN_ISO = "T00:00:30";
+const MAX_WAIT_TIME_IN_ISO = "T00:10:00";
 function createWaitAction(options) {
   const toDuration = (maxWaitTime) => {
     if (maxWaitTime) {
@@ -594,20 +590,18 @@ function createWaitAction(options) {
     },
     async handler(ctx) {
       const delayTime = luxon.Duration.fromObject(ctx.input);
-      const maxWait = toDuration(options == null ? void 0 : options.maxWaitTime);
+      const maxWait = toDuration(options?.maxWaitTime);
       if (delayTime.minus(maxWait).toMillis() > 0) {
         throw new Error(
           `Waiting duration is longer than the maximum threshold of ${maxWait.toHuman()}`
         );
       }
       await new Promise((resolve) => {
-        var _a;
         const controller = new AbortController();
         const timeoutHandle = setTimeout(abort, delayTime.toMillis());
-        (_a = ctx.signal) == null ? void 0 : _a.addEventListener("abort", abort);
+        ctx.signal?.addEventListener("abort", abort);
         function abort() {
-          var _a2;
-          (_a2 = ctx.signal) == null ? void 0 : _a2.removeEventListener("abort", abort);
+          ctx.signal?.removeEventListener("abort", abort);
           clearTimeout(timeoutHandle);
           controller.abort();
           resolve("finished");
@@ -683,14 +677,13 @@ function createFetchPlainAction(options) {
     },
     supportsDryRun: true,
     async handler(ctx) {
-      var _a, _b;
       ctx.logger.info("Fetching plain content from remote URL");
-      const targetPath = (_a = ctx.input.targetPath) != null ? _a : "./";
+      const targetPath = ctx.input.targetPath ?? "./";
       const outputPath = backendPluginApi.resolveSafeChildPath(ctx.workspacePath, targetPath);
       await pluginScaffolderNode.fetchContents({
         reader,
         integrations,
-        baseUrl: (_b = ctx.templateInfo) == null ? void 0 : _b.baseUrl,
+        baseUrl: ctx.templateInfo?.baseUrl,
         fetchUrl: ctx.input.url,
         outputPath,
         token: ctx.input.token
@@ -749,7 +742,6 @@ function createFetchPlainFileAction(options) {
     },
     supportsDryRun: true,
     async handler(ctx) {
-      var _a;
       ctx.logger.info("Fetching plain content from remote URL");
       const outputPath = backendPluginApi.resolveSafeChildPath(
         ctx.workspacePath,
@@ -758,7 +750,7 @@ function createFetchPlainFileAction(options) {
       await pluginScaffolderNode.fetchFile({
         reader,
         integrations,
-        baseUrl: (_a = ctx.templateInfo) == null ? void 0 : _a.baseUrl,
+        baseUrl: ctx.templateInfo?.baseUrl,
         fetchUrl: ctx.input.url,
         outputPath,
         token: ctx.input.token
@@ -768,8 +760,7 @@ function createFetchPlainFileAction(options) {
 }
 
 function isNoNodeSnapshotOptionProvided() {
-  var _a;
-  return ((_a = process.env.NODE_OPTIONS) == null ? void 0 : _a.includes("--no-node-snapshot")) || process.argv.includes("--no-node-snapshot");
+  return process.env.NODE_OPTIONS?.includes("--no-node-snapshot") || process.argv.includes("--no-node-snapshot");
 }
 function getMajorNodeVersion() {
   const version = process.versions.node;
@@ -1044,11 +1035,10 @@ function createFetchTemplateAction(options) {
     },
     supportsDryRun: true,
     async handler(ctx) {
-      var _a, _b;
       ctx.logger.info("Fetching template content from remote URL");
       const workDir = await ctx.createTemporaryDirectory();
       const templateDir = backendPluginApi.resolveSafeChildPath(workDir, "template");
-      const targetPath = (_a = ctx.input.targetPath) != null ? _a : "./";
+      const targetPath = ctx.input.targetPath ?? "./";
       const outputDir = backendPluginApi.resolveSafeChildPath(ctx.workspacePath, targetPath);
       if (ctx.input.copyWithoutRender && ctx.input.copyWithoutTemplating) {
         throw new errors.InputError(
@@ -1087,7 +1077,7 @@ function createFetchTemplateAction(options) {
       await pluginScaffolderNode.fetchContents({
         reader,
         integrations,
-        baseUrl: (_b = ctx.templateInfo) == null ? void 0 : _b.baseUrl,
+        baseUrl: ctx.templateInfo?.baseUrl,
         fetchUrl: ctx.input.url,
         outputPath: templateDir,
         token: ctx.input.token
@@ -1234,8 +1224,7 @@ const createFilesystemDeleteAction = () => {
     },
     supportsDryRun: true,
     async handler(ctx) {
-      var _a;
-      if (!Array.isArray((_a = ctx.input) == null ? void 0 : _a.files)) {
+      if (!Array.isArray(ctx.input?.files)) {
         throw new errors.InputError("files must be an Array");
       }
       for (const file of ctx.input.files) {
@@ -1312,8 +1301,7 @@ const createFilesystemRenameAction = () => {
     },
     supportsDryRun: true,
     async handler(ctx) {
-      var _a, _b;
-      if (!Array.isArray((_a = ctx.input) == null ? void 0 : _a.files)) {
+      if (!Array.isArray(ctx.input?.files)) {
         throw new errors.InputError("files must be an Array");
       }
       for (const file of ctx.input.files) {
@@ -1327,7 +1315,7 @@ const createFilesystemRenameAction = () => {
         const destFilepath = backendPluginApi.resolveSafeChildPath(ctx.workspacePath, file.to);
         try {
           await fs__default.default.move(sourceFilepath, destFilepath, {
-            overwrite: (_b = file.overwrite) != null ? _b : false
+            overwrite: file.overwrite ?? false
           });
           ctx.logger.info(
             `File ${sourceFilepath} renamed to ${destFilepath} successfully`
@@ -1467,16 +1455,8 @@ const createBuiltinActions = (options) => {
   return actions;
 };
 
-var __defProp$4 = Object.defineProperty;
-var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$4 = (obj, key, value) => {
-  __defNormalProp$4(obj, key + "" , value);
-  return value;
-};
 class TemplateActionRegistry {
-  constructor() {
-    __publicField$4(this, "actions", /* @__PURE__ */ new Map());
-  }
+  actions = /* @__PURE__ */ new Map();
   register(action) {
     if (this.actions.has(action.id)) {
       throw new errors.ConflictError(
@@ -1546,12 +1526,6 @@ const restoreWorkspace = async (path, buffer) => {
   }
 };
 
-var __defProp$3 = Object.defineProperty;
-var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$3 = (obj, key, value) => {
-  __defNormalProp$3(obj, key + "" , value);
-  return value;
-};
 const migrationsDir = backendPluginApi.resolvePackagePath(
   "@backstage/plugin-scaffolder-backend",
   "migrations"
@@ -1572,10 +1546,7 @@ const parseSqlDateToIsoString = (input) => {
   return input;
 };
 class DatabaseTaskStore {
-  constructor(client) {
-    __publicField$3(this, "db");
-    this.db = client;
-  }
+  db;
   static async create(options) {
     const { database } = options;
     const client = await this.getClient(database);
@@ -1583,9 +1554,8 @@ class DatabaseTaskStore {
     return new DatabaseTaskStore(client);
   }
   isRecoverableTask(spec) {
-    var _a, _b;
     return ["startOver"].includes(
-      (_b = (_a = spec.EXPERIMENTAL_recovery) == null ? void 0 : _a.EXPERIMENTAL_strategy) != null ? _b : "none"
+      spec.EXPERIMENTAL_recovery?.EXPERIMENTAL_strategy ?? "none"
     );
   }
   parseSpec({ spec, id }) {
@@ -1611,19 +1581,21 @@ class DatabaseTaskStore {
     return database;
   }
   static async runMigrations(database, client) {
-    var _a;
     if (!isPluginDatabaseManager(database)) {
       await client.migrate.latest({
         directory: migrationsDir
       });
       return;
     }
-    if (!((_a = database.migrations) == null ? void 0 : _a.skip)) {
+    if (!database.migrations?.skip) {
       await client.migrate.latest({
         directory: migrationsDir
       });
     }
   }
+  constructor(client) {
+    this.db = client;
+  }
   async list(options) {
     const queryBuilder = this.db("tasks");
     if (options.createdBy) {
@@ -1632,21 +1604,17 @@ class DatabaseTaskStore {
       });
     }
     const results = await queryBuilder.orderBy("created_at", "desc").select();
-    const tasks = results.map((result) => {
-      var _a;
-      return {
-        id: result.id,
-        spec: JSON.parse(result.spec),
-        status: result.status,
-        createdBy: (_a = result.created_by) != null ? _a : void 0,
-        lastHeartbeatAt: parseSqlDateToIsoString(result.last_heartbeat_at),
-        createdAt: parseSqlDateToIsoString(result.created_at)
-      };
-    });
+    const tasks = results.map((result) => ({
+      id: result.id,
+      spec: JSON.parse(result.spec),
+      status: result.status,
+      createdBy: result.created_by ?? void 0,
+      lastHeartbeatAt: parseSqlDateToIsoString(result.last_heartbeat_at),
+      createdAt: parseSqlDateToIsoString(result.created_at)
+    }));
     return { tasks };
   }
   async getTask(taskId) {
-    var _a;
     const [result] = await this.db("tasks").where({ id: taskId }).select();
     if (!result) {
       throw new errors.NotFoundError(`No task with id '${taskId}' found`);
@@ -1661,7 +1629,7 @@ class DatabaseTaskStore {
         status: result.status,
         lastHeartbeatAt: parseSqlDateToIsoString(result.last_heartbeat_at),
         createdAt: parseSqlDateToIsoString(result.created_at),
-        createdBy: (_a = result.created_by) != null ? _a : void 0,
+        createdBy: result.created_by ?? void 0,
         secrets,
         state
       };
@@ -1670,20 +1638,18 @@ class DatabaseTaskStore {
     }
   }
   async createTask(options) {
-    var _a;
     const taskId = uuid.v4();
     await this.db("tasks").insert({
       id: taskId,
       spec: JSON.stringify(options.spec),
       secrets: options.secrets ? JSON.stringify(options.secrets) : void 0,
-      created_by: (_a = options.createdBy) != null ? _a : null,
+      created_by: options.createdBy ?? null,
       status: "open"
     });
     return { taskId };
   }
   async claimTask() {
     return this.db.transaction(async (tx) => {
-      var _a;
       const [task] = await tx("tasks").where({
         status: "open"
       }).limit(1).select();
@@ -1716,7 +1682,7 @@ class DatabaseTaskStore {
         status: "processing",
         lastHeartbeatAt: task.last_heartbeat_at,
         createdAt: task.created_at,
-        createdBy: (_a = task.created_by) != null ? _a : void 0,
+        createdBy: task.created_by ?? void 0,
         secrets,
         state: getState()
       };
@@ -1845,7 +1811,7 @@ class DatabaseTaskStore {
     const { taskId } = options;
     const message = `This task was marked as stale as it exceeded its timeout`;
     const statusStepEvents = (await this.listEvents({ taskId })).events.filter(
-      ({ body }) => body == null ? void 0 : body.stepId
+      ({ body }) => body?.stepId
     );
     const completedSteps = statusStepEvents.filter(
       ({ body: { status } }) => status === "failed" || status === "completed"
@@ -1898,7 +1864,6 @@ class DatabaseTaskStore {
     const taskIdsToRecover = [];
     const timeoutS = luxon.Duration.fromObject(options.timeout).as("seconds");
     await this.db.transaction(async (tx) => {
-      var _a, _b;
       const heartbeatInterval = intervalFromNowTill(timeoutS, this.db);
       const result = await tx("tasks").where("status", "processing").andWhere("last_heartbeat_at", "<=", heartbeatInterval).update(
         {
@@ -1914,7 +1879,7 @@ class DatabaseTaskStore {
           task_id: id,
           event_type: "recovered",
           body: JSON.stringify({
-            recoverStrategy: (_b = (_a = taskSpec.EXPERIMENTAL_recovery) == null ? void 0 : _a.EXPERIMENTAL_strategy) != null ? _b : "none"
+            recoverStrategy: taskSpec.EXPERIMENTAL_recovery?.EXPERIMENTAL_strategy ?? "none"
           })
         });
       }
@@ -1927,20 +1892,19 @@ function isTruthy(value) {
   return lodash.isArray(value) ? value.length > 0 : !!value;
 }
 function generateExampleOutput(schema) {
-  var _a, _b;
   const { examples } = schema;
   if (examples && Array.isArray(examples)) {
     return examples[0];
   }
   if (schema.type === "object") {
     return Object.fromEntries(
-      Object.entries((_a = schema.properties) != null ? _a : {}).map(([key, value]) => [
+      Object.entries(schema.properties ?? {}).map(([key, value]) => [
         key,
         generateExampleOutput(value)
       ])
     );
   } else if (schema.type === "array") {
-    const [firstSchema] = (_b = [schema.items]) == null ? void 0 : _b.flat();
+    const [firstSchema] = [schema.items]?.flat();
     if (firstSchema) {
       return [generateExampleOutput(firstSchema)];
     }
@@ -1955,18 +1919,12 @@ function generateExampleOutput(schema) {
   return "<unknown>";
 }
 const readDuration$1 = (config$1, key, defaultValue) => {
-  if (config$1 == null ? void 0 : config$1.has(key)) {
+  if (config$1?.has(key)) {
     return config.readDurationFromConfig(config$1, { key });
   }
   return defaultValue;
 };
 
-var __defProp$2 = Object.defineProperty;
-var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$2 = (obj, key, value) => {
-  __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class TaskManager {
   // Runs heartbeat internally
   constructor(task, storage, signal, logger, auth, config) {
@@ -1976,9 +1934,9 @@ class TaskManager {
     this.logger = logger;
     this.auth = auth;
     this.config = config;
-    __publicField$2(this, "isDone", false);
-    __publicField$2(this, "heartbeatTimeoutId");
   }
+  isDone = false;
+  heartbeatTimeoutId;
   static create(task, storage, abortSignal, logger, auth, config) {
     const agent = new TaskManager(
       task,
@@ -2007,9 +1965,8 @@ class TaskManager {
     return this.task.taskId;
   }
   async rehydrateWorkspace(options) {
-    var _a, _b;
     if (this.isWorkspaceSerializationEnabled()) {
-      (_b = (_a = this.storage).rehydrateWorkspace) == null ? void 0 : _b.call(_a, options);
+      this.storage.rehydrateWorkspace?.(options);
     }
   }
   get done() {
@@ -2022,35 +1979,31 @@ class TaskManager {
     });
   }
   async getTaskState() {
-    var _a, _b;
-    return (_b = (_a = this.storage).getTaskState) == null ? void 0 : _b.call(_a, { taskId: this.task.taskId });
+    return this.storage.getTaskState?.({ taskId: this.task.taskId });
   }
   async updateCheckpoint(options) {
-    var _a, _b;
     const { key, ...value } = options;
     if (this.task.state) {
       this.task.state.checkpoints[key] = value;
     } else {
       this.task.state = { checkpoints: { [key]: value } };
     }
-    await ((_b = (_a = this.storage).saveTaskState) == null ? void 0 : _b.call(_a, {
+    await this.storage.saveTaskState?.({
       taskId: this.task.taskId,
       state: this.task.state
-    }));
+    });
   }
   async serializeWorkspace(options) {
-    var _a, _b;
     if (this.isWorkspaceSerializationEnabled()) {
-      await ((_b = (_a = this.storage).serializeWorkspace) == null ? void 0 : _b.call(_a, {
+      await this.storage.serializeWorkspace?.({
         path: options.path,
         taskId: this.task.taskId
-      }));
+      });
     }
   }
   async cleanWorkspace() {
-    var _a, _b;
     if (this.isWorkspaceSerializationEnabled()) {
-      await ((_b = (_a = this.storage).cleanWorkspace) == null ? void 0 : _b.call(_a, { taskId: this.task.taskId }));
+      await this.storage.cleanWorkspace?.({ taskId: this.task.taskId });
     }
   }
   async complete(result, metadata) {
@@ -2082,10 +2035,9 @@ class TaskManager {
     }, 1e3);
   }
   isWorkspaceSerializationEnabled() {
-    var _a, _b;
-    return (_b = (_a = this.config) == null ? void 0 : _a.getOptionalBoolean(
+    return this.config?.getOptionalBoolean(
       "scaffolder.EXPERIMENTAL_workspaceSerialization"
-    )) != null ? _b : false;
+    ) ?? false;
   }
   async getInitiatorCredentials() {
     const secrets = this.task.secrets;
@@ -2114,7 +2066,6 @@ class StorageTaskBroker {
     this.logger = logger;
     this.config = config;
     this.auth = auth;
-    __publicField$2(this, "deferredDispatch", defer());
   }
   async list(options) {
     if (!this.storage.list) {
@@ -2122,8 +2073,9 @@ class StorageTaskBroker {
         "TaskStore does not implement the list method. Please implement the list method to be able to list tasks"
       );
     }
-    return await this.storage.list({ createdBy: options == null ? void 0 : options.createdBy });
+    return await this.storage.list({ createdBy: options?.createdBy });
   }
+  deferredDispatch = defer();
   async registerCancellable(taskId, abortController) {
     let shouldUnsubscribe = false;
     const subscription = this.event$({ taskId, after: void 0 }).subscribe({
@@ -2147,10 +2099,9 @@ class StorageTaskBroker {
     });
   }
   async recoverTasks() {
-    var _a, _b, _c, _d;
-    const enabled = (_a = this.config && this.config.getOptionalBoolean(
+    const enabled = (this.config && this.config.getOptionalBoolean(
       "scaffolder.EXPERIMENTAL_recoverTasks"
-    )) != null ? _a : false;
+    )) ?? false;
     if (enabled) {
       const defaultTimeout = { seconds: 30 };
       const timeout = readDuration$1(
@@ -2158,9 +2109,9 @@ class StorageTaskBroker {
         "scaffolder.EXPERIMENTAL_recoverTasksTimeout",
         defaultTimeout
       );
-      const { ids: recoveredTaskIds } = (_d = await ((_c = (_b = this.storage).recoverTasks) == null ? void 0 : _c.call(_b, {
+      const { ids: recoveredTaskIds } = await this.storage.recoverTasks?.({
         timeout
-      }))) != null ? _d : { ids: [] };
+      }) ?? { ids: [] };
       if (recoveredTaskIds.length > 0) {
         this.signalDispatch();
       }
@@ -2262,17 +2213,16 @@ class StorageTaskBroker {
     this.deferredDispatch = defer();
   }
   async cancel(taskId) {
-    var _a, _b;
     const { events } = await this.storage.listEvents({ taskId });
-    const currentStepId = events.length > 0 ? events.filter(({ body }) => body == null ? void 0 : body.stepId).reduce((prev, curr) => prev.id > curr.id ? prev : curr).body.stepId : 0;
-    await ((_b = (_a = this.storage).cancelTask) == null ? void 0 : _b.call(_a, {
+    const currentStepId = events.length > 0 ? events.filter(({ body }) => body?.stepId).reduce((prev, curr) => prev.id > curr.id ? prev : curr).body.stepId : 0;
+    await this.storage.cancelTask?.({
       taskId,
       body: {
         message: `Step ${currentStepId} has been cancelled.`,
         stepId: currentStepId,
         status: "cancelled"
       }
-    }));
+    });
   }
 }
 
@@ -2302,8 +2252,7 @@ const hasTag = createTemplatePermissionRule({
     tag: zod.z.string().describe("Name of the tag to match on")
   }),
   apply: (resource, { tag }) => {
-    var _a, _b, _c;
-    return (_c = (_b = (_a = resource["backstage:permissions"]) == null ? void 0 : _a.tags) == null ? void 0 : _b.includes(tag)) != null ? _c : false;
+    return resource["backstage:permissions"]?.tags?.includes(tag) ?? false;
   },
   toQuery: () => ({})
 });
@@ -2374,25 +2323,6 @@ const scaffolderActionRules = {
   hasStringProperty
 };
 
-var __accessCheck = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet = (obj, member, getter) => {
-  __accessCheck(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet = (obj, member, value, setter) => {
-  __accessCheck(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _winston, _addRedactions;
 const escapeRegExp = (text) => {
   return text.replace(/[.*+?^${}(\)|[\]\\]/g, "\\$&");
 };
@@ -2431,28 +2361,23 @@ class BackstageLoggerTransport extends Transport__default.default {
     callback();
   }
 }
-const _WinstonLogger = class _WinstonLogger {
-  constructor(winston, addRedactions) {
-    __privateAdd(this, _winston, void 0);
-    __privateAdd(this, _addRedactions, void 0);
-    __privateSet(this, _winston, winston);
-    __privateSet(this, _addRedactions, addRedactions);
-  }
+class WinstonLogger {
+  #winston;
+  #addRedactions;
   /**
    * Creates a {@link WinstonLogger} instance.
    */
   static create(options) {
-    var _a;
-    const redacter = _WinstonLogger.redacter();
+    const redacter = WinstonLogger.redacter();
     let logger = winston.createLogger({
       level: options.level,
       format: winston.format.combine(options.format, redacter.format),
-      transports: (_a = options.transports) != null ? _a : new winston.transports.Console()
+      transports: options.transports ?? new winston.transports.Console()
     });
     if (options.meta) {
       logger = logger.child(options.meta);
     }
-    return new _WinstonLogger(logger, redacter.add);
+    return new WinstonLogger(logger, redacter.add);
   }
   /**
    * Creates a winston log formatter for redacting secrets.
@@ -2462,11 +2387,10 @@ const _WinstonLogger = class _WinstonLogger {
     let redactionPattern = void 0;
     return {
       format: winston.format((obj) => {
-        var _a, _b;
         if (!redactionPattern || !obj) {
           return obj;
         }
-        obj[tripleBeam.MESSAGE] = (_b = (_a = obj[tripleBeam.MESSAGE]) == null ? void 0 : _a.replace) == null ? void 0 : _b.call(_a, redactionPattern, "[REDACTED]");
+        obj[tripleBeam.MESSAGE] = obj[tripleBeam.MESSAGE]?.replace?.(redactionPattern, "***");
         return obj;
       })(),
       add(newRedactions) {
@@ -2518,36 +2442,30 @@ const _WinstonLogger = class _WinstonLogger {
       })
     );
   }
+  constructor(winston, addRedactions) {
+    this.#winston = winston;
+    this.#addRedactions = addRedactions;
+  }
   error(message, meta) {
-    __privateGet(this, _winston).error(message, meta);
+    this.#winston.error(message, meta);
   }
   warn(message, meta) {
-    __privateGet(this, _winston).warn(message, meta);
+    this.#winston.warn(message, meta);
   }
   info(message, meta) {
-    __privateGet(this, _winston).info(message, meta);
+    this.#winston.info(message, meta);
   }
   debug(message, meta) {
-    __privateGet(this, _winston).debug(message, meta);
+    this.#winston.debug(message, meta);
   }
   child(meta) {
-    return new _WinstonLogger(__privateGet(this, _winston).child(meta));
+    return new WinstonLogger(this.#winston.child(meta));
   }
   addRedactions(redactions) {
-    var _a;
-    (_a = __privateGet(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
+    this.#addRedactions?.(redactions);
   }
-};
-_winston = new WeakMap();
-_addRedactions = new WeakMap();
-let WinstonLogger = _WinstonLogger;
+}
 
-var __defProp$1 = Object.defineProperty;
-var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$1 = (obj, key, value) => {
-  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 const isValidTaskSpec = (taskSpec) => {
   return taskSpec.apiVersion === "scaffolder.backstage.io/v1beta3";
 };
@@ -2556,7 +2474,6 @@ const createStepLogger = ({
   step,
   rootLogger
 }) => {
-  var _a;
   const taskLogger = WinstonLogger.create({
     level: process.env.LOG_LEVEL || "info",
     format: winston__namespace.format.combine(
@@ -2565,11 +2482,11 @@ const createStepLogger = ({
     ),
     transports: [new BackstageLoggerTransport(rootLogger, task, step.id)]
   });
-  taskLogger.addRedactions(Object.values((_a = task.secrets) != null ? _a : {}));
+  taskLogger.addRedactions(Object.values(task.secrets ?? {}));
   const streamLogger = new stream.PassThrough();
   streamLogger.on("data", async (data) => {
     const message = data.toString().trim();
-    if ((message == null ? void 0 : message.length) > 1) {
+    if (message?.length > 1) {
       taskLogger.info(message);
     }
   });
@@ -2581,14 +2498,13 @@ const isActionAuthorized = pluginPermissionNode.createConditionAuthorizer(
 class NunjucksWorkflowRunner {
   constructor(options) {
     this.options = options;
-    __publicField$1(this, "defaultTemplateFilters");
-    __publicField$1(this, "tracker", scaffoldingTracker());
     this.defaultTemplateFilters = createDefaultFilters({
       integrations: this.options.integrations
     });
   }
+  defaultTemplateFilters;
+  tracker = scaffoldingTracker();
   isSingleTemplateString(input) {
-    var _a, _b;
     const { parser, nodes } = nunjucks__default.default;
     const parsed = parser.parse(
       input,
@@ -2601,7 +2517,7 @@ class NunjucksWorkflowRunner {
         }
       }
     );
-    return parsed.children.length === 1 && !(((_b = (_a = parsed.children[0]) == null ? void 0 : _a.children) == null ? void 0 : _b[0]) instanceof nodes.TemplateData);
+    return parsed.children.length === 1 && !(parsed.children[0]?.children?.[0] instanceof nodes.TemplateData);
   }
   render(input, context, renderTemplate) {
     return JSON.parse(JSON.stringify(input), (_key, value) => {
@@ -2637,7 +2553,6 @@ class NunjucksWorkflowRunner {
     });
   }
   async executeStep(task, step, context, renderTemplate, taskTrack, workspacePath, decision) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
     const stepTrack = await this.tracker.stepStart(task, step);
     if (task.cancelSignal.aborted) {
       throw new Error(`Step ${step.name} has been cancelled.`);
@@ -2658,19 +2573,16 @@ class NunjucksWorkflowRunner {
       });
       if (task.isDryRun) {
         const redactedSecrets = Object.fromEntries(
-          Object.entries((_a = task.secrets) != null ? _a : {}).map((secret) => [
-            secret[0],
-            "[REDACTED]"
-          ])
+          Object.entries(task.secrets ?? {}).map((secret) => [secret[0], "***"])
         );
-        const debugInput = (_b = step.input && this.render(
+        const debugInput = (step.input && this.render(
           step.input,
           {
             ...context,
             secrets: redactedSecrets
           },
           renderTemplate
-        )) != null ? _b : {};
+        )) ?? {};
         taskLogger.info(
           `Running ${action.id} in dry-run mode with inputs (secrets redacted): ${JSON.stringify(
             debugInput,
@@ -2680,7 +2592,7 @@ class NunjucksWorkflowRunner {
         );
         if (!action.supportsDryRun) {
           await taskTrack.skipDryRun(step, action);
-          const outputSchema = (_c = action.schema) == null ? void 0 : _c.output;
+          const outputSchema = action.schema?.output;
           if (outputSchema) {
             context.steps[step.id] = {
               output: generateExampleOutput(outputSchema)
@@ -2695,21 +2607,18 @@ class NunjucksWorkflowRunner {
         ([key, value]) => ({
           each: { key, value }
         })
-      ) : [{}]).map((i) => {
-        var _a2;
-        return {
-          ...i,
-          // Secrets are only passed when templating the input to actions for security reasons
-          input: step.input ? this.render(
-            step.input,
-            { ...context, secrets: (_a2 = task.secrets) != null ? _a2 : {}, ...i },
-            renderTemplate
-          ) : {}
-        };
-      });
+      ) : [{}]).map((i) => ({
+        ...i,
+        // Secrets are only passed when templating the input to actions for security reasons
+        input: step.input ? this.render(
+          step.input,
+          { ...context, secrets: task.secrets ?? {}, ...i },
+          renderTemplate
+        ) : {}
+      }));
       for (const iteration of iterations) {
         const actionId = `${action.id}${iteration.each ? `[${iteration.each.key}]` : ""}`;
-        if ((_d = action.schema) == null ? void 0 : _d.input) {
+        if (action.schema?.input) {
           const validateResult = jsonschema.validate(
             iteration.input,
             action.schema.input
@@ -2736,7 +2645,7 @@ class NunjucksWorkflowRunner {
       }
       const tmpDirs = new Array();
       const stepOutput = {};
-      const prevTaskState = await ((_e = task.getTaskState) == null ? void 0 : _e.call(task));
+      const prevTaskState = await task.getTaskState?.();
       for (const iteration of iterations) {
         if (iteration.each) {
           taskLogger.info(
@@ -2749,25 +2658,24 @@ class NunjucksWorkflowRunner {
         }
         await action.handler({
           input: iteration.input,
-          secrets: (_f = task.secrets) != null ? _f : {},
+          secrets: task.secrets ?? {},
           // TODO(blam): move to LoggerService and away from Winston
           logger: backendCommon.loggerToWinstonLogger(taskLogger),
           logStream: streamLogger,
           workspacePath,
           async checkpoint(keySuffix, fn) {
-            var _a2, _b2, _c2, _d2, _e2;
             const key = `v1.task.checkpoint.${keySuffix}`;
             try {
               let prevValue;
               if (prevTaskState) {
-                const prevState = (_b2 = (_a2 = prevTaskState.state) == null ? void 0 : _a2.checkpoints) == null ? void 0 : _b2[key];
+                const prevState = prevTaskState.state?.checkpoints?.[key];
                 if (prevState && prevState.status === "success") {
                   prevValue = prevState.value;
                 }
               }
               const value = prevValue ? prevValue : await fn();
               if (!prevValue) {
-                (_c2 = task.updateCheckpoint) == null ? void 0 : _c2.call(task, {
+                task.updateCheckpoint?.({
                   key,
                   status: "success",
                   value
@@ -2775,14 +2683,14 @@ class NunjucksWorkflowRunner {
               }
               return value;
             } catch (err) {
-              (_d2 = task.updateCheckpoint) == null ? void 0 : _d2.call(task, {
+              task.updateCheckpoint?.({
                 key,
                 status: "failed",
                 reason: errors.stringifyError(err)
               });
               throw err;
             } finally {
-              await ((_e2 = task.serializeWorkspace) == null ? void 0 : _e2.call(task, { path: workspacePath }));
+              await task.serializeWorkspace?.({ path: workspacePath });
             }
           },
           createTemporaryDirectory: async () => {
@@ -2814,18 +2722,17 @@ class NunjucksWorkflowRunner {
       if (task.cancelSignal.aborted) {
         throw new Error(`Step ${step.name} has been cancelled.`);
       }
-      await ((_g = task.cleanWorkspace) == null ? void 0 : _g.call(task));
+      await task.cleanWorkspace?.();
       await stepTrack.markSuccessful();
     } catch (err) {
       await taskTrack.markFailed(step, err);
       await stepTrack.markFailed();
       throw err;
     } finally {
-      await ((_h = task.serializeWorkspace) == null ? void 0 : _h.call(task, { path: workspacePath }));
+      await task.serializeWorkspace?.({ path: workspacePath });
     }
   }
   async execute(task) {
-    var _a;
     if (!isValidTaskSpec(task.spec)) {
       throw new errors.InputError(
         "Wrong template version executed with the workflow engine"
@@ -2842,7 +2749,7 @@ class NunjucksWorkflowRunner {
       templateGlobals: additionalTemplateGlobals
     });
     try {
-      await ((_a = task.rehydrateWorkspace) == null ? void 0 : _a.call(task, { taskId, targetPath: workspacePath }));
+      await task.rehydrateWorkspace?.({ taskId, targetPath: workspacePath });
       const taskTrack = await this.tracker.taskStart(task);
       await fs__default.default.ensureDir(workspacePath);
       const context = {
@@ -2897,10 +2804,9 @@ function scaffoldingTracker() {
     labelNames: ["template", "step", "result"]
   });
   async function taskStart(task) {
-    var _a, _b;
     await task.emitLog(`Starting up task with ${task.spec.steps.length} steps`);
-    const template = ((_a = task.spec.templateInfo) == null ? void 0 : _a.entityRef) || "";
-    const user = ((_b = task.spec.user) == null ? void 0 : _b.ref) || "";
+    const template = task.spec.templateInfo?.entityRef || "";
+    const user = task.spec.user?.ref || "";
     const taskTimer = taskDuration.startTimer({
       template
     });
@@ -2950,12 +2856,11 @@ function scaffoldingTracker() {
     };
   }
   async function stepStart(task, step) {
-    var _a;
     await task.emitLog(`Beginning step ${step.name}`, {
       stepId: step.id,
       status: "processing"
     });
-    const template = ((_a = task.spec.templateInfo) == null ? void 0 : _a.entityRef) || "";
+    const template = task.spec.templateInfo?.entityRef || "";
     const stepTimer = stepDuration.startTimer({
       template,
       step: step.name
@@ -3008,24 +2913,18 @@ function scaffoldingTracker() {
   };
 }
 
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => {
-  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class TaskWorker {
   constructor(options) {
     this.options = options;
-    __publicField(this, "taskQueue");
-    __publicField(this, "logger");
-    __publicField(this, "stopWorkers");
     this.stopWorkers = false;
     this.logger = options.logger;
     this.taskQueue = new PQueue__default.default({
       concurrency: options.concurrentTasksLimit
     });
   }
+  taskQueue;
+  logger;
+  stopWorkers;
   static async create(options) {
     const {
       taskBroker,
@@ -3056,11 +2955,10 @@ class TaskWorker {
     });
   }
   async recoverTasks() {
-    var _a, _b, _c;
     try {
-      await ((_b = (_a = this.options.taskBroker).recoverTasks) == null ? void 0 : _b.call(_a));
+      await this.options.taskBroker.recoverTasks?.();
     } catch (err) {
-      (_c = this.logger) == null ? void 0 : _c.error(errors.stringifyError(err));
+      this.logger?.error(errors.stringifyError(err));
     }
   }
   start() {
@@ -3182,7 +3080,7 @@ function createDryRunner(options) {
         getWorkspaceName: async () => `dry-run-${dryRunId}`,
         cancelSignal: abortSignal,
         async emitLog(message, logMetadata) {
-          if ((logMetadata == null ? void 0 : logMetadata.stepId) === dryRunId) {
+          if (logMetadata?.stepId === dryRunId) {
             return;
           }
           log.push({
@@ -3229,10 +3127,9 @@ async function getWorkingDirectory(config, logger) {
   return workingDirectory;
 }
 function getEntityBaseUrl(entity) {
-  var _a, _b;
-  let location = (_a = entity.metadata.annotations) == null ? void 0 : _a[catalogModel.ANNOTATION_SOURCE_LOCATION];
+  let location = entity.metadata.annotations?.[catalogModel.ANNOTATION_SOURCE_LOCATION];
   if (!location) {
-    location = (_b = entity.metadata.annotations) == null ? void 0 : _b[catalogModel.ANNOTATION_LOCATION];
+    location = entity.metadata.annotations?.[catalogModel.ANNOTATION_LOCATION];
   }
   if (!location) {
     return void 0;
@@ -3259,6 +3156,24 @@ async function findTemplate(options) {
   return template;
 }
 
+async function checkPermission(options) {
+  const { permissions, permissionService, credentials } = options;
+  if (permissionService) {
+    const permissionRequest = permissions.map((permission) => ({
+      permission
+    }));
+    const authorizationResponses = await permissionService.authorize(
+      permissionRequest,
+      { credentials }
+    );
+    for (const response of authorizationResponses) {
+      if (response.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+        throw new errors.NotAllowedError();
+      }
+    }
+  }
+}
+
 function isTemplatePermissionRuleInput(permissionRule) {
   return permissionRule.resourceType === alpha.RESOURCE_TYPE_SCAFFOLDER_TEMPLATE;
 }
@@ -3271,14 +3186,13 @@ function isSupportedTemplate(entity) {
 function buildDefaultIdentityClient(options) {
   return {
     getIdentity: async ({ request }) => {
-      var _a;
       const header = request.headers.authorization;
       const { logger } = options;
       if (!header) {
         return void 0;
       }
       try {
-        const token = (_a = header.match(/^Bearer\s(\S+\.\S+\.\S+)$/i)) == null ? void 0 : _a[1];
+        const token = header.match(/^Bearer\s(\S+\.\S+\.\S+)$/i)?.[1];
         if (!token) {
           throw new TypeError("Expected Bearer with JWT");
         }
@@ -3319,7 +3233,6 @@ const readDuration = (config$1, key, defaultValue) => {
   return defaultValue;
 };
 async function createRouter(options) {
-  var _a;
   const router = Router__default.default();
   router.use(express__default.default.json({ limit: "10MB" }));
   const {
@@ -3343,7 +3256,7 @@ async function createRouter(options) {
     identity,
     discovery
   });
-  const concurrentTasksLimit = (_a = options.concurrentTasksLimit) != null ? _a : options.config.getOptionalNumber("scaffolder.concurrentTasksLimit");
+  const concurrentTasksLimit = options.concurrentTasksLimit ?? options.config.getOptionalNumber("scaffolder.concurrentTasksLimit");
   const logger = parentLogger.child({ plugin: "scaffolder" });
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = integration.ScmIntegrations.fromConfig(config);
@@ -3452,13 +3365,13 @@ async function createRouter(options) {
         permissions: alpha.scaffolderActionPermissions,
         rules: actionRules
       }
-    ]
+    ],
+    permissions: alpha.scaffolderTaskPermissions
   });
   router.use(permissionIntegrationRouter);
   router.get(
     "/v2/templates/:namespace/:kind/:name/parameter-schema",
     async (req, res) => {
-      var _a2, _b;
       const credentials = await httpAuth.credentials(req);
       const { token } = await auth.getPluginRequestToken({
         onBehalfOf: credentials,
@@ -3469,21 +3382,18 @@ async function createRouter(options) {
         token,
         credentials
       );
-      const parameters = [(_a2 = template.spec.parameters) != null ? _a2 : []].flat();
+      const parameters = [template.spec.parameters ?? []].flat();
       const presentation = template.spec.presentation;
       res.json({
-        title: (_b = template.metadata.title) != null ? _b : template.metadata.name,
+        title: template.metadata.title ?? template.metadata.name,
         ...presentation ? { presentation } : {},
         description: template.metadata.description,
         "ui:options": template.metadata["ui:options"],
-        steps: parameters.map((schema) => {
-          var _a3;
-          return {
-            title: (_a3 = schema.title) != null ? _a3 : "Please enter the following information",
-            description: schema.description,
-            schema
-          };
-        })
+        steps: parameters.map((schema) => ({
+          title: schema.title ?? "Please enter the following information",
+          description: schema.description,
+          schema
+        }))
       });
     }
   ).get("/v2/actions", async (_req, res) => {
@@ -3497,12 +3407,16 @@ async function createRouter(options) {
     });
     res.json(actionsList);
   }).post("/v2/tasks", async (req, res) => {
-    var _a2, _b;
     const templateRef = req.body.templateRef;
     const { kind, namespace, name } = catalogModel.parseEntityRef(templateRef, {
       defaultKind: "template"
     });
     const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskCreatePermission],
+      permissionService: permissions
+    });
     const { token } = await auth.getPluginRequestToken({
       onBehalfOf: credentials,
       targetPluginId: "catalog"
@@ -3520,7 +3434,7 @@ async function createRouter(options) {
       token,
       credentials
     );
-    for (const parameters of [(_a2 = template.spec.parameters) != null ? _a2 : []].flat()) {
+    for (const parameters of [template.spec.parameters ?? []].flat()) {
       const result2 = jsonschema.validate(values, parameters);
       if (!result2.valid) {
         res.status(400).json({ errors: result2.errors });
@@ -3530,16 +3444,13 @@ async function createRouter(options) {
     const baseUrl = getEntityBaseUrl(template);
     const taskSpec = {
       apiVersion: template.apiVersion,
-      steps: template.spec.steps.map((step, index) => {
-        var _a3, _b2;
-        return {
-          ...step,
-          id: (_a3 = step.id) != null ? _a3 : `step-${index + 1}`,
-          name: (_b2 = step.name) != null ? _b2 : step.action
-        };
-      }),
+      steps: template.spec.steps.map((step, index) => ({
+        ...step,
+        id: step.id ?? `step-${index + 1}`,
+        name: step.name ?? step.action
+      })),
       EXPERIMENTAL_recovery: template.spec.EXPERIMENTAL_recovery,
-      output: (_b = template.spec.output) != null ? _b : {},
+      output: template.spec.output ?? {},
       parameters: values,
       user: {
         entity: userEntity,
@@ -3565,6 +3476,12 @@ async function createRouter(options) {
     });
     res.status(201).json({ id: result.taskId });
   }).get("/v2/tasks", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const [userEntityRef] = [req.query.createdBy].flat();
     if (typeof userEntityRef !== "string" && typeof userEntityRef !== "undefined") {
       throw new errors.InputError("createdBy query parameter must be a string");
@@ -3579,6 +3496,12 @@ async function createRouter(options) {
     });
     res.status(200).json(tasks);
   }).get("/v2/tasks/:taskId", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     const task = await taskBroker.get(taskId);
     if (!task) {
@@ -3587,11 +3510,22 @@ async function createRouter(options) {
     delete task.secrets;
     res.status(200).json(task);
   }).post("/v2/tasks/:taskId/cancel", async (req, res) => {
-    var _a2;
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskCancelPermission, alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
-    await ((_a2 = taskBroker.cancel) == null ? void 0 : _a2.call(taskBroker, taskId));
+    await taskBroker.cancel?.(taskId);
     res.status(200).json({ status: "cancelled" });
   }).get("/v2/tasks/:taskId/eventstream", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     const after = req.query.after !== void 0 ? Number(req.query.after) : void 0;
     logger.debug(`Event stream observing taskId '${taskId}' opened`);
@@ -3608,7 +3542,6 @@ async function createRouter(options) {
         res.end();
       },
       next: ({ events }) => {
-        var _a2;
         let shouldUnsubscribe = false;
         for (const event of events) {
           res.write(
@@ -3621,7 +3554,7 @@ data: ${JSON.stringify(event)}
             shouldUnsubscribe = true;
           }
         }
-        (_a2 = res.flush) == null ? void 0 : _a2.call(res);
+        res.flush?.();
         if (shouldUnsubscribe) {
           subscription.unsubscribe();
           res.end();
@@ -3633,6 +3566,12 @@ data: ${JSON.stringify(event)}
       logger.debug(`Event stream observing taskId '${taskId}' closed`);
     });
   }).get("/v2/tasks/:taskId/events", async (req, res) => {
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskReadPermission],
+      permissionService: permissions
+    });
     const { taskId } = req.params;
     const after = Number(req.query.after) || void 0;
     const timeout = setTimeout(() => {
@@ -3655,7 +3594,12 @@ data: ${JSON.stringify(event)}
       clearTimeout(timeout);
     });
   }).post("/v2/dry-run", async (req, res) => {
-    var _a2, _b, _c;
+    const credentials = await httpAuth.credentials(req);
+    await checkPermission({
+      credentials,
+      permissions: [alpha.taskCreatePermission],
+      permissionService: permissions
+    });
     const bodySchema = zod.z.object({
       template: zod.z.unknown(),
       values: zod.z.record(zod.z.unknown()),
@@ -3671,34 +3615,30 @@ data: ${JSON.stringify(event)}
     if (!await pluginScaffolderCommon.templateEntityV1beta3Validator.check(template)) {
       throw new errors.InputError("Input template is not a template");
     }
-    const credentials = await httpAuth.credentials(req);
     const { token } = await auth.getPluginRequestToken({
       onBehalfOf: credentials,
       targetPluginId: "catalog"
     });
-    for (const parameters of [(_a2 = template.spec.parameters) != null ? _a2 : []].flat()) {
+    for (const parameters of [template.spec.parameters ?? []].flat()) {
       const result2 = jsonschema.validate(body.values, parameters);
       if (!result2.valid) {
         res.status(400).json({ errors: result2.errors });
         return;
       }
     }
-    const steps = template.spec.steps.map((step, index) => {
-      var _a3, _b2;
-      return {
-        ...step,
-        id: (_a3 = step.id) != null ? _a3 : `step-${index + 1}`,
-        name: (_b2 = step.name) != null ? _b2 : step.action
-      };
-    });
+    const steps = template.spec.steps.map((step, index) => ({
+      ...step,
+      id: step.id ?? `step-${index + 1}`,
+      name: step.name ?? step.action
+    }));
     const result = await dryRunner({
       spec: {
         apiVersion: template.apiVersion,
         steps,
-        output: (_b = template.spec.output) != null ? _b : {},
+        output: template.spec.output ?? {},
         parameters: body.values
       },
-      directoryContents: ((_c = body.directoryContents) != null ? _c : []).map((file) => ({
+      directoryContents: (body.directoryContents ?? []).map((file) => ({
         path: file.path,
         content: Buffer.from(file.base64Content, "base64")
       })),
@@ -3775,4 +3715,4 @@ exports.createRouter = createRouter;
 exports.createWaitAction = createWaitAction;
 exports.scaffolderActionRules = scaffolderActionRules;
 exports.scaffolderTemplateRules = scaffolderTemplateRules;
-//# sourceMappingURL=router-Bj9ovbjU.cjs.js.map
+//# sourceMappingURL=router-BtUx0eIt.cjs.js.map