@backstage/plugin-search-backend 1.0.0 → 1.0.1-next.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @backstage/plugin-search-backend
 
+## 1.0.1-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.15.0-next.0
+  - @backstage/plugin-auth-node@0.2.4-next.0
+  - @backstage/plugin-permission-node@0.6.4-next.0
+  - @backstage/plugin-search-backend-node@1.0.1-next.0
+
 ## 1.0.0
 
 ### Major Changes

package/dist/index.cjs.js

@@ -53,34 +53,52 @@ class AuthorizedSearchEngine {
   }
   async query(query, options) {
     const queryStartTime = Date.now();
-    const conditionFetcher = new DataLoader__default["default"]((requests) => this.permissions.authorizeConditional(requests.slice(), options), {
-      cacheKeyFn: ({ permission: { name } }) => name
-    });
-    const authorizer = new DataLoader__default["default"]((requests) => this.permissions.authorize(requests.slice(), options), {
-      cacheKeyFn: ({ permission: { name }, resourceRef }) => qs__default["default"].stringify({ name, resourceRef })
-    });
+    const conditionFetcher = new DataLoader__default["default"](
+      (requests) => this.permissions.authorizeConditional(requests.slice(), options),
+      {
+        cacheKeyFn: ({ permission: { name } }) => name
+      }
+    );
+    const authorizer = new DataLoader__default["default"](
+      (requests) => this.permissions.authorize(requests.slice(), options),
+      {
+        cacheKeyFn: ({ permission: { name }, resourceRef }) => qs__default["default"].stringify({ name, resourceRef })
+      }
+    );
     const requestedTypes = query.types || Object.keys(this.types);
-    const typeDecisions = lodash.zipObject(requestedTypes, await Promise.all(requestedTypes.map((type) => {
-      var _a;
-      const permission = (_a = this.types[type]) == null ? void 0 : _a.visibilityPermission;
-      if (!permission) {
-        return { result: pluginPermissionCommon.AuthorizeResult.ALLOW };
+    const typeDecisions = lodash.zipObject(
+      requestedTypes,
+      await Promise.all(
+        requestedTypes.map((type) => {
+          var _a;
+          const permission = (_a = this.types[type]) == null ? void 0 : _a.visibilityPermission;
+          if (!permission) {
+            return { result: pluginPermissionCommon.AuthorizeResult.ALLOW };
+          }
+          if (pluginPermissionCommon.isResourcePermission(permission)) {
+            return conditionFetcher.load({ permission });
+          }
+          return authorizer.load({ permission });
+        })
+      )
+    );
+    const authorizedTypes = requestedTypes.filter(
+      (type) => {
+        var _a;
+        return ((_a = typeDecisions[type]) == null ? void 0 : _a.result) !== pluginPermissionCommon.AuthorizeResult.DENY;
       }
-      if (pluginPermissionCommon.isResourcePermission(permission)) {
-        return conditionFetcher.load({ permission });
+    );
+    const resultByResultFilteringRequired = authorizedTypes.some(
+      (type) => {
+        var _a;
+        return ((_a = typeDecisions[type]) == null ? void 0 : _a.result) === pluginPermissionCommon.AuthorizeResult.CONDITIONAL;
       }
-      return authorizer.load({ permission });
-    })));
-    const authorizedTypes = requestedTypes.filter((type) => {
-      var _a;
-      return ((_a = typeDecisions[type]) == null ? void 0 : _a.result) !== pluginPermissionCommon.AuthorizeResult.DENY;
-    });
-    const resultByResultFilteringRequired = authorizedTypes.some((type) => {
-      var _a;
-      return ((_a = typeDecisions[type]) == null ? void 0 : _a.result) === pluginPermissionCommon.AuthorizeResult.CONDITIONAL;
-    });
+    );
     if (!resultByResultFilteringRequired) {
-      return this.searchEngine.query({ ...query, types: authorizedTypes }, options);
+      return this.searchEngine.query(
+        { ...query, types: authorizedTypes },
+        options
+      );
     }
     const { page } = decodePageCursor(query.pageCursor);
     const targetResults = (page + 1) * this.pageSize;
@@ -88,8 +106,13 @@ class AuthorizedSearchEngine {
     let nextPageCursor;
     let latencyBudgetExhausted = false;
     do {
-      const nextPage = await this.searchEngine.query({ ...query, types: authorizedTypes, pageCursor: nextPageCursor }, options);
-      filteredResults = filteredResults.concat(await this.filterResults(nextPage.results, typeDecisions, authorizer));
+      const nextPage = await this.searchEngine.query(
+        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },
+        options
+      );
+      filteredResults = filteredResults.concat(
+        await this.filterResults(nextPage.results, typeDecisions, authorizer)
+      );
       nextPageCursor = nextPage.nextPageCursor;
       latencyBudgetExhausted = Date.now() - queryStartTime > this.queryLatencyBudgetMs;
     } while (nextPageCursor && filteredResults.length < targetResults && !latencyBudgetExhausted);
@@ -105,33 +128,43 @@ class AuthorizedSearchEngine {
     };
   }
   async filterResults(results, typeDecisions, authorizer) {
-    return lodash.compact(await Promise.all(results.map((result) => {
-      var _a, _b, _c;
-      if (((_a = typeDecisions[result.type]) == null ? void 0 : _a.result) === pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        return result;
-      }
-      const permission = (_b = this.types[result.type]) == null ? void 0 : _b.visibilityPermission;
-      const resourceRef = (_c = result.document.authorization) == null ? void 0 : _c.resourceRef;
-      if (!permission || !resourceRef) {
-        return result;
-      }
-      if (!pluginPermissionCommon.isResourcePermission(permission)) {
-        throw new Error(`Unexpected conditional decision returned for non-resource permission "${permission.name}"`);
-      }
-      return authorizer.load({ permission, resourceRef }).then((decision) => decision.result === pluginPermissionCommon.AuthorizeResult.ALLOW ? result : void 0);
-    })));
+    return lodash.compact(
+      await Promise.all(
+        results.map((result) => {
+          var _a, _b, _c;
+          if (((_a = typeDecisions[result.type]) == null ? void 0 : _a.result) === pluginPermissionCommon.AuthorizeResult.ALLOW) {
+            return result;
+          }
+          const permission = (_b = this.types[result.type]) == null ? void 0 : _b.visibilityPermission;
+          const resourceRef = (_c = result.document.authorization) == null ? void 0 : _c.resourceRef;
+          if (!permission || !resourceRef) {
+            return result;
+          }
+          if (!pluginPermissionCommon.isResourcePermission(permission)) {
+            throw new Error(
+              `Unexpected conditional decision returned for non-resource permission "${permission.name}"`
+            );
+          }
+          return authorizer.load({ permission, resourceRef }).then(
+            (decision) => decision.result === pluginPermissionCommon.AuthorizeResult.ALLOW ? result : void 0
+          );
+        })
+      )
+    );
   }
 }
 
 const jsonObjectSchema = zod.z.lazy(() => {
-  const jsonValueSchema = zod.z.lazy(() => zod.z.union([
-    zod.z.string(),
-    zod.z.number(),
-    zod.z.boolean(),
-    zod.z.null(),
-    zod.z.array(jsonValueSchema),
-    jsonObjectSchema
-  ]));
+  const jsonValueSchema = zod.z.lazy(
+    () => zod.z.union([
+      zod.z.string(),
+      zod.z.number(),
+      zod.z.boolean(),
+      zod.z.null(),
+      zod.z.array(jsonValueSchema),
+      jsonObjectSchema
+    ])
+  );
   return zod.z.record(jsonValueSchema);
 });
 const allowedLocationProtocols = ["http:", "https:"];
@@ -147,17 +180,26 @@ async function createRouter(options) {
   if ("authorizeConditional" in permissions) {
     permissionEvaluator = permissions;
   } else {
-    logger.warn("PermissionAuthorizer is deprecated. Please use an instance of PermissionEvaluator instead of PermissionAuthorizer in PluginEnvironment#permissions");
+    logger.warn(
+      "PermissionAuthorizer is deprecated. Please use an instance of PermissionEvaluator instead of PermissionAuthorizer in PluginEnvironment#permissions"
+    );
     permissionEvaluator = pluginPermissionCommon.toPermissionEvaluator(permissions);
   }
-  const engine = config.getOptionalBoolean("permission.enabled") ? new AuthorizedSearchEngine(inputEngine, types, permissionEvaluator, config) : inputEngine;
+  const engine = config.getOptionalBoolean("permission.enabled") ? new AuthorizedSearchEngine(
+    inputEngine,
+    types,
+    permissionEvaluator,
+    config
+  ) : inputEngine;
   const filterResultSet = ({ results, ...resultSet }) => ({
     ...resultSet,
     results: results.filter((result) => {
       const protocol = new URL(result.document.location, "https://example.com").protocol;
       const isAllowed = allowedLocationProtocols.includes(protocol);
       if (!isAllowed) {
-        logger.info(`Rejected search result for "${result.document.title}" as location protocol "${protocol}" is unsafe`);
+        logger.info(
+          `Rejected search result for "${result.document.title}" as location protocol "${protocol}" is unsafe`
+        );
       }
       return isAllowed;
     })
@@ -173,25 +215,34 @@ async function createRouter(options) {
     }))
   });
   const router = Router__default["default"]();
-  router.get("/query", async (req, res) => {
-    var _a;
-    const parseResult = requestSchema.safeParse(req.query);
-    if (!parseResult.success) {
-      throw new errors.InputError(`Invalid query string: ${parseResult.error}`);
-    }
-    const query = parseResult.data;
-    logger.info(`Search request received: term="${query.term}", filters=${JSON.stringify(query.filters)}, types=${query.types ? query.types.join(",") : ""}, pageCursor=${(_a = query.pageCursor) != null ? _a : ""}`);
-    const token = pluginAuthNode.getBearerTokenFromAuthorizationHeader(req.header("authorization"));
-    try {
-      const resultSet = await (engine == null ? void 0 : engine.query(query, { token }));
-      res.send(filterResultSet(toSearchResults(resultSet)));
-    } catch (error) {
-      if (error.name === "MissingIndexError") {
-        throw error;
+  router.get(
+    "/query",
+    async (req, res) => {
+      var _a;
+      const parseResult = requestSchema.safeParse(req.query);
+      if (!parseResult.success) {
+        throw new errors.InputError(`Invalid query string: ${parseResult.error}`);
+      }
+      const query = parseResult.data;
+      logger.info(
+        `Search request received: term="${query.term}", filters=${JSON.stringify(query.filters)}, types=${query.types ? query.types.join(",") : ""}, pageCursor=${(_a = query.pageCursor) != null ? _a : ""}`
+      );
+      const token = pluginAuthNode.getBearerTokenFromAuthorizationHeader(
+        req.header("authorization")
+      );
+      try {
+        const resultSet = await (engine == null ? void 0 : engine.query(query, { token }));
+        res.send(filterResultSet(toSearchResults(resultSet)));
+      } catch (error) {
+        if (error.name === "MissingIndexError") {
+          throw error;
+        }
+        throw new Error(
+          `There was a problem performing the search query. ${error}`
+        );
       }
-      throw new Error(`There was a problem performing the search query. ${error}`);
     }
-  });
+  );
   router.use(backendCommon.errorHandler());
   return router;
 }

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/service/AuthorizedSearchEngine.ts","../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { compact, zipObject } from 'lodash';\nimport qs from 'qs';\nimport DataLoader from 'dataloader';\nimport {\n  EvaluatePermissionResponse,\n  EvaluatePermissionRequest,\n  AuthorizeResult,\n  isResourcePermission,\n  PermissionEvaluator,\n  AuthorizePermissionRequest,\n  QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResult,\n  IndexableResultSet,\n  QueryRequestOptions,\n  QueryTranslator,\n  SearchEngine,\n  SearchQuery,\n} from '@backstage/plugin-search-common';\nimport { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { Writable } from 'stream';\n\nexport function decodePageCursor(pageCursor?: string): { page: number } {\n  if (!pageCursor) {\n    return { page: 0 };\n  }\n\n  const page = Number(Buffer.from(pageCursor, 'base64').toString('utf-8'));\n  if (isNaN(page)) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  if (page < 0) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  return {\n    page,\n  };\n}\n\nexport function encodePageCursor({ page }: { page: number }): string {\n  return Buffer.from(`${page}`, 'utf-8').toString('base64');\n}\n\nexport class AuthorizedSearchEngine implements SearchEngine {\n  private readonly pageSize = 25;\n  private readonly queryLatencyBudgetMs: number;\n\n  constructor(\n    private readonly searchEngine: SearchEngine,\n    private readonly types: Record<string, DocumentTypeInfo>,\n    private readonly permissions: PermissionEvaluator,\n    config: Config,\n  ) {\n    this.queryLatencyBudgetMs =\n      config.getOptionalNumber('search.permissions.queryLatencyBudgetMs') ??\n      1000;\n  }\n\n  setTranslator(translator: QueryTranslator): void {\n    this.searchEngine.setTranslator(translator);\n  }\n\n  async getIndexer(type: string): Promise<Writable> {\n    return this.searchEngine.getIndexer(type);\n  }\n\n  async query(\n    query: SearchQuery,\n    options: QueryRequestOptions,\n  ): Promise<IndexableResultSet> {\n    const queryStartTime = Date.now();\n\n    const conditionFetcher = new DataLoader(\n      (requests: readonly QueryPermissionRequest[]) =>\n        this.permissions.authorizeConditional(requests.slice(), options),\n      {\n        cacheKeyFn: ({ permission: { name } }) => name,\n      },\n    );\n\n    const authorizer = new DataLoader(\n      (requests: readonly AuthorizePermissionRequest[]) =>\n        this.permissions.authorize(requests.slice(), options),\n      {\n        // Serialize the permission name and resourceRef as\n        // a query string to avoid collisions from overlapping\n        // permission names and resourceRefs.\n        cacheKeyFn: ({ permission: { name }, resourceRef }) =>\n          qs.stringify({ name, resourceRef }),\n      },\n    );\n\n    const requestedTypes = query.types || Object.keys(this.types);\n\n    const typeDecisions = zipObject(\n      requestedTypes,\n      await Promise.all(\n        requestedTypes.map(type => {\n          const permission = this.types[type]?.visibilityPermission;\n\n          // No permission configured for this document type - always allow.\n          if (!permission) {\n            return { result: AuthorizeResult.ALLOW as const };\n          }\n\n          // Resource permission supplied, so we need to check for conditional decisions.\n          if (isResourcePermission(permission)) {\n            return conditionFetcher.load({ permission });\n          }\n\n          // Non-resource permission supplied - we can perform a standard authorization.\n          return authorizer.load({ permission });\n        }),\n      ),\n    );\n\n    const authorizedTypes = requestedTypes.filter(\n      type => typeDecisions[type]?.result !== AuthorizeResult.DENY,\n    );\n\n    const resultByResultFilteringRequired = authorizedTypes.some(\n      type => typeDecisions[type]?.result === AuthorizeResult.CONDITIONAL,\n    );\n\n    // When there are no CONDITIONAL decisions for any of the requested\n    // result types, we can skip filtering result by result by simply\n    // skipping the types the user is not permitted to see, which will\n    // be much more efficient.\n    //\n    // Since it's not currently possible to configure the page size used\n    // by search engines, this detail means that a single user might see\n    // a different page size depending on whether their search required\n    // result-by-result filtering or not. We can fix this minor\n    // inconsistency by introducing a configurable page size.\n    //\n    // cf. https://github.com/backstage/backstage/issues/9162\n    if (!resultByResultFilteringRequired) {\n      return this.searchEngine.query(\n        { ...query, types: authorizedTypes },\n        options,\n      );\n    }\n\n    const { page } = decodePageCursor(query.pageCursor);\n    const targetResults = (page + 1) * this.pageSize;\n\n    let filteredResults: IndexableResult[] = [];\n    let nextPageCursor: string | undefined;\n    let latencyBudgetExhausted = false;\n\n    do {\n      const nextPage = await this.searchEngine.query(\n        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },\n        options,\n      );\n\n      filteredResults = filteredResults.concat(\n        await this.filterResults(nextPage.results, typeDecisions, authorizer),\n      );\n\n      nextPageCursor = nextPage.nextPageCursor;\n      latencyBudgetExhausted =\n        Date.now() - queryStartTime > this.queryLatencyBudgetMs;\n    } while (\n      nextPageCursor &&\n      filteredResults.length < targetResults &&\n      !latencyBudgetExhausted\n    );\n\n    return {\n      results: filteredResults\n        .slice(page * this.pageSize, (page + 1) * this.pageSize)\n        .map((result, index) => {\n          // Overwrite any/all rank entries to avoid leaking knowledge of filtered results.\n          return {\n            ...result,\n            rank: page * this.pageSize + index + 1,\n          };\n        }),\n      previousPageCursor:\n        page === 0 ? undefined : encodePageCursor({ page: page - 1 }),\n      nextPageCursor:\n        !latencyBudgetExhausted &&\n        (nextPageCursor || filteredResults.length > targetResults)\n          ? encodePageCursor({ page: page + 1 })\n          : undefined,\n    };\n  }\n\n  private async filterResults(\n    results: IndexableResult[],\n    typeDecisions: Record<string, EvaluatePermissionResponse>,\n    authorizer: DataLoader<\n      EvaluatePermissionRequest,\n      EvaluatePermissionResponse\n    >,\n  ) {\n    return compact(\n      await Promise.all(\n        results.map(result => {\n          if (typeDecisions[result.type]?.result === AuthorizeResult.ALLOW) {\n            return result;\n          }\n\n          const permission = this.types[result.type]?.visibilityPermission;\n          const resourceRef = result.document.authorization?.resourceRef;\n\n          if (!permission || !resourceRef) {\n            return result;\n          }\n\n          // We only reach this point in the code for types where the initial\n          // authorization returned CONDITIONAL -- ALLOWs return early\n          // immediately above, and types where the decision was DENY get\n          // filtered out entirely when querying.\n          //\n          // This means the call to isResourcePermission here is mostly about\n          // narrowing the type of permission - the only way to get here with a\n          // non-resource permission is if the PermissionPolicy returns a\n          // CONDITIONAL decision for a non-resource permission, which can't\n          // happen - it would throw an error during validation in the\n          // permission-backend.\n          if (!isResourcePermission(permission)) {\n            throw new Error(\n              `Unexpected conditional decision returned for non-resource permission \"${permission.name}\"`,\n            );\n          }\n\n          return authorizer\n            .load({ permission, resourceRef })\n            .then(decision =>\n              decision.result === AuthorizeResult.ALLOW ? result : undefined,\n            );\n        }),\n      ),\n    );\n  }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { z } from 'zod';\nimport { errorHandler } from '@backstage/backend-common';\nimport { ErrorResponseBody, InputError } from '@backstage/errors';\nimport { Config } from '@backstage/config';\nimport { JsonObject, JsonValue } from '@backstage/types';\nimport { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';\nimport {\n  PermissionAuthorizer,\n  PermissionEvaluator,\n  toPermissionEvaluator,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResultSet,\n  SearchResultSet,\n} from '@backstage/plugin-search-common';\nimport { SearchEngine } from '@backstage/plugin-search-common';\nimport { AuthorizedSearchEngine } from './AuthorizedSearchEngine';\n\nconst jsonObjectSchema: z.ZodSchema<JsonObject> = z.lazy(() => {\n  const jsonValueSchema: z.ZodSchema<JsonValue> = z.lazy(() =>\n    z.union([\n      z.string(),\n      z.number(),\n      z.boolean(),\n      z.null(),\n      z.array(jsonValueSchema),\n      jsonObjectSchema,\n    ]),\n  );\n\n  return z.record(jsonValueSchema);\n});\n\n/**\n * @public\n */\nexport type RouterOptions = {\n  engine: SearchEngine;\n  types: Record<string, DocumentTypeInfo>;\n  permissions: PermissionEvaluator | PermissionAuthorizer;\n  config: Config;\n  logger: Logger;\n};\n\nconst allowedLocationProtocols = ['http:', 'https:'];\n\n/**\n * @public\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine: inputEngine, types, permissions, config, logger } = options;\n\n  const requestSchema = z.object({\n    term: z.string().default(''),\n    filters: jsonObjectSchema.optional(),\n    types: z\n      .array(z.string().refine(type => Object.keys(types).includes(type)))\n      .optional(),\n    pageCursor: z.string().optional(),\n  });\n\n  let permissionEvaluator: PermissionEvaluator;\n  if ('authorizeConditional' in permissions) {\n    permissionEvaluator = permissions as PermissionEvaluator;\n  } else {\n    logger.warn(\n      'PermissionAuthorizer is deprecated. Please use an instance of PermissionEvaluator instead of PermissionAuthorizer in PluginEnvironment#permissions',\n    );\n    permissionEvaluator = toPermissionEvaluator(permissions);\n  }\n\n  const engine = config.getOptionalBoolean('permission.enabled')\n    ? new AuthorizedSearchEngine(\n        inputEngine,\n        types,\n        permissionEvaluator,\n        config,\n      )\n    : inputEngine;\n\n  const filterResultSet = ({ results, ...resultSet }: SearchResultSet) => ({\n    ...resultSet,\n    results: results.filter(result => {\n      const protocol = new URL(result.document.location, 'https://example.com')\n        .protocol;\n      const isAllowed = allowedLocationProtocols.includes(protocol);\n      if (!isAllowed) {\n        logger.info(\n          `Rejected search result for \"${result.document.title}\" as location protocol \"${protocol}\" is unsafe`,\n        );\n      }\n      return isAllowed;\n    }),\n  });\n\n  const toSearchResults = (resultSet: IndexableResultSet): SearchResultSet => ({\n    ...resultSet,\n    results: resultSet.results.map(result => ({\n      ...result,\n      document: {\n        ...result.document,\n        authorization: undefined,\n      },\n    })),\n  });\n\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request,\n      res: express.Response<SearchResultSet | ErrorResponseBody>,\n    ) => {\n      const parseResult = requestSchema.safeParse(req.query);\n\n      if (!parseResult.success) {\n        throw new InputError(`Invalid query string: ${parseResult.error}`);\n      }\n\n      const query = parseResult.data;\n\n      logger.info(\n        `Search request received: term=\"${\n          query.term\n        }\", filters=${JSON.stringify(query.filters)}, types=${\n          query.types ? query.types.join(',') : ''\n        }, pageCursor=${query.pageCursor ?? ''}`,\n      );\n\n      const token = getBearerTokenFromAuthorizationHeader(\n        req.header('authorization'),\n      );\n\n      try {\n        const resultSet = await engine?.query(query, { token });\n\n        res.send(filterResultSet(toSearchResults(resultSet)));\n      } catch (error) {\n        if (error.name === 'MissingIndexError') {\n          // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form\n          throw error;\n        }\n\n        throw new Error(\n          `There was a problem performing the search query. ${error}`,\n        );\n      }\n    },\n  );\n\n  router.use(errorHandler());\n\n  return router;\n}\n"],"names":["InputError","DataLoader","qs","zipObject","AuthorizeResult","isResourcePermission","compact","z","toPermissionEvaluator","Router","getBearerTokenFromAuthorizationHeader","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQO,SAAS,gBAAgB,CAAC,UAAU,EAAE;AAC7C,EAAE,IAAI,CAAC,UAAU,EAAE;AACnB,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACvB,GAAG;AACH,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3E,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE;AACnB,IAAI,MAAM,IAAIA,iBAAU,CAAC,qBAAqB,CAAC,CAAC;AAChD,GAAG;AACH,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE;AAChB,IAAI,MAAM,IAAIA,iBAAU,CAAC,qBAAqB,CAAC,CAAC;AAChD,GAAG;AACH,EAAE,OAAO;AACT,IAAI,IAAI;AACR,GAAG,CAAC;AACJ,CAAC;AACM,SAAS,gBAAgB,CAAC,EAAE,IAAI,EAAE,EAAE;AAC3C,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AACM,MAAM,sBAAsB,CAAC;AACpC,EAAE,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE;AACxD,IAAI,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;AACrC,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;AACvB,IAAI,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AACnC,IAAI,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;AACvB,IAAI,IAAI,EAAE,CAAC;AACX,IAAI,IAAI,CAAC,oBAAoB,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,yCAAyC,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC;AAC9H,GAAG;AACH,EAAE,aAAa,CAAC,UAAU,EAAE;AAC5B,IAAI,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;AAChD,GAAG;AACH,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE;AACzB,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9C,GAAG;AACH,EAAE,MAAM,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;AAC9B,IAAI,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACtC,IAAI,MAAM,gBAAgB,GAAG,IAAIC,8BAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,EAAE;AAC5H,MAAM,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI;AACpD,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,UAAU,GAAG,IAAIA,8BAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,EAAE;AAC3G,MAAM,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAKC,sBAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAChG,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,IAAI,MAAM,aAAa,GAAGC,gBAAS,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK;AACnG,MAAM,IAAI,EAAE,CAAC;AACb,MAAM,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;AAC5F,MAAM,IAAI,CAAC,UAAU,EAAE;AACvB,QAAQ,OAAO,EAAE,MAAM,EAAEC,sCAAe,CAAC,KAAK,EAAE,CAAC;AACjD,OAAO;AACP,MAAM,IAAIC,2CAAoB,CAAC,UAAU,CAAC,EAAE;AAC5C,QAAQ,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACrD,OAAO;AACP,MAAM,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7C,KAAK,CAAC,CAAC,CAAC,CAAC;AACT,IAAI,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK;AAC5D,MAAM,IAAI,EAAE,CAAC;AACb,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,MAAMD,sCAAe,CAAC,IAAI,CAAC;AAChG,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,+BAA+B,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK;AAC3E,MAAM,IAAI,EAAE,CAAC;AACb,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,MAAMA,sCAAe,CAAC,WAAW,CAAC;AACvG,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,CAAC,+BAA+B,EAAE;AAC1C,MAAM,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC;AACpF,KAAK;AACL,IAAI,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACxD,IAAI,MAAM,aAAa,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;AACrD,IAAI,IAAI,eAAe,GAAG,EAAE,CAAC;AAC7B,IAAI,IAAI,cAAc,CAAC;AACvB,IAAI,IAAI,sBAAsB,GAAG,KAAK,CAAC;AACvC,IAAI,GAAG;AACP,MAAM,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;AAChI,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AACtH,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AAC/C,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC;AACvF,KAAK,QAAQ,cAAc,IAAI,eAAe,CAAC,MAAM,GAAG,aAAa,IAAI,CAAC,sBAAsB,EAAE;AAClG,IAAI,OAAO;AACX,MAAM,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK;AAC9G,QAAQ,OAAO;AACf,UAAU,GAAG,MAAM;AACnB,UAAU,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,KAAK,GAAG,CAAC;AAChD,SAAS,CAAC;AACV,OAAO,CAAC;AACR,MAAM,kBAAkB,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC;AACpF,MAAM,cAAc,EAAE,CAAC,sBAAsB,KAAK,cAAc,IAAI,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;AAC3J,KAAK,CAAC;AACN,GAAG;AACH,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE;AAC1D,IAAI,OAAOE,cAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK;AAC7D,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACrB,MAAM,IAAI,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,MAAMF,sCAAe,CAAC,KAAK,EAAE;AACtG,QAAQ,OAAO,MAAM,CAAC;AACtB,OAAO;AACP,MAAM,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;AACnG,MAAM,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;AACjG,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE;AACvC,QAAQ,OAAO,MAAM,CAAC;AACtB,OAAO;AACP,MAAM,IAAI,CAACC,2CAAoB,CAAC,UAAU,CAAC,EAAE;AAC7C,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,sEAAsE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,OAAO;AACP,MAAM,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,KAAKD,sCAAe,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC;AAC1I,KAAK,CAAC,CAAC,CAAC,CAAC;AACT,GAAG;AACH;;ACtGA,MAAM,gBAAgB,GAAGG,KAAC,CAAC,IAAI,CAAC,MAAM;AACtC,EAAE,MAAM,eAAe,GAAGA,KAAC,CAAC,IAAI,CAAC,MAAMA,KAAC,CAAC,KAAK,CAAC;AAC/C,IAAIA,KAAC,CAAC,MAAM,EAAE;AACd,IAAIA,KAAC,CAAC,MAAM,EAAE;AACd,IAAIA,KAAC,CAAC,OAAO,EAAE;AACf,IAAIA,KAAC,CAAC,IAAI,EAAE;AACZ,IAAIA,KAAC,CAAC,KAAK,CAAC,eAAe,CAAC;AAC5B,IAAI,gBAAgB;AACpB,GAAG,CAAC,CAAC,CAAC;AACN,EAAE,OAAOA,KAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC9C,eAAe,YAAY,CAAC,OAAO,EAAE;AAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;AAC9E,EAAE,MAAM,aAAa,GAAGA,KAAC,CAAC,MAAM,CAAC;AACjC,IAAI,IAAI,EAAEA,KAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAChC,IAAI,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;AACxC,IAAI,KAAK,EAAEA,KAAC,CAAC,KAAK,CAACA,KAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;AAC7F,IAAI,UAAU,EAAEA,KAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACrC,GAAG,CAAC,CAAC;AACL,EAAE,IAAI,mBAAmB,CAAC;AAC1B,EAAE,IAAI,sBAAsB,IAAI,WAAW,EAAE;AAC7C,IAAI,mBAAmB,GAAG,WAAW,CAAC;AACtC,GAAG,MAAM;AACT,IAAI,MAAM,CAAC,IAAI,CAAC,oJAAoJ,CAAC,CAAC;AACtK,IAAI,mBAAmB,GAAGC,4CAAqB,CAAC,WAAW,CAAC,CAAC;AAC7D,GAAG;AACH,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,GAAG,IAAI,sBAAsB,CAAC,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC;AAC7J,EAAE,MAAM,eAAe,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM;AAC1D,IAAI,GAAG,SAAS;AAChB,IAAI,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK;AACxC,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpE,MAAM,IAAI,CAAC,SAAS,EAAE;AACtB,QAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,4BAA4B,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1H,OAAO;AACP,MAAM,OAAO,SAAS,CAAC;AACvB,KAAK,CAAC;AACN,GAAG,CAAC,CAAC;AACL,EAAE,MAAM,eAAe,GAAG,CAAC,SAAS,MAAM;AAC1C,IAAI,GAAG,SAAS;AAChB,IAAI,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM;AAChD,MAAM,GAAG,MAAM;AACf,MAAM,QAAQ,EAAE;AAChB,QAAQ,GAAG,MAAM,CAAC,QAAQ;AAC1B,QAAQ,aAAa,EAAE,KAAK,CAAC;AAC7B,OAAO;AACP,KAAK,CAAC,CAAC;AACP,GAAG,CAAC,CAAC;AACL,EAAE,MAAM,MAAM,GAAGC,0BAAM,EAAE,CAAC;AAC1B,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE,GAAG,KAAK;AAC3C,IAAI,IAAI,EAAE,CAAC;AACX,IAAI,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3D,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;AAC9B,MAAM,MAAM,IAAIT,iBAAU,CAAC,CAAC,sBAAsB,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,KAAK;AACL,IAAI,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;AACnC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,+BAA+B,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACvN,IAAI,MAAM,KAAK,GAAGU,oDAAqC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;AACrF,IAAI,IAAI;AACR,MAAM,MAAM,SAAS,GAAG,OAAO,MAAM,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACzF,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC5D,KAAK,CAAC,OAAO,KAAK,EAAE;AACpB,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE;AAC9C,QAAQ,MAAM,KAAK,CAAC;AACpB,OAAO;AACP,MAAM,MAAM,IAAI,KAAK,CAAC,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACnF,KAAK;AACL,GAAG,CAAC,CAAC;AACL,EAAE,MAAM,CAAC,GAAG,CAACC,0BAAY,EAAE,CAAC,CAAC;AAC7B,EAAE,OAAO,MAAM,CAAC;AAChB;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/service/AuthorizedSearchEngine.ts","../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { compact, zipObject } from 'lodash';\nimport qs from 'qs';\nimport DataLoader from 'dataloader';\nimport {\n  EvaluatePermissionResponse,\n  EvaluatePermissionRequest,\n  AuthorizeResult,\n  isResourcePermission,\n  PermissionEvaluator,\n  AuthorizePermissionRequest,\n  QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResult,\n  IndexableResultSet,\n  QueryRequestOptions,\n  QueryTranslator,\n  SearchEngine,\n  SearchQuery,\n} from '@backstage/plugin-search-common';\nimport { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { Writable } from 'stream';\n\nexport function decodePageCursor(pageCursor?: string): { page: number } {\n  if (!pageCursor) {\n    return { page: 0 };\n  }\n\n  const page = Number(Buffer.from(pageCursor, 'base64').toString('utf-8'));\n  if (isNaN(page)) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  if (page < 0) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  return {\n    page,\n  };\n}\n\nexport function encodePageCursor({ page }: { page: number }): string {\n  return Buffer.from(`${page}`, 'utf-8').toString('base64');\n}\n\nexport class AuthorizedSearchEngine implements SearchEngine {\n  private readonly pageSize = 25;\n  private readonly queryLatencyBudgetMs: number;\n\n  constructor(\n    private readonly searchEngine: SearchEngine,\n    private readonly types: Record<string, DocumentTypeInfo>,\n    private readonly permissions: PermissionEvaluator,\n    config: Config,\n  ) {\n    this.queryLatencyBudgetMs =\n      config.getOptionalNumber('search.permissions.queryLatencyBudgetMs') ??\n      1000;\n  }\n\n  setTranslator(translator: QueryTranslator): void {\n    this.searchEngine.setTranslator(translator);\n  }\n\n  async getIndexer(type: string): Promise<Writable> {\n    return this.searchEngine.getIndexer(type);\n  }\n\n  async query(\n    query: SearchQuery,\n    options: QueryRequestOptions,\n  ): Promise<IndexableResultSet> {\n    const queryStartTime = Date.now();\n\n    const conditionFetcher = new DataLoader(\n      (requests: readonly QueryPermissionRequest[]) =>\n        this.permissions.authorizeConditional(requests.slice(), options),\n      {\n        cacheKeyFn: ({ permission: { name } }) => name,\n      },\n    );\n\n    const authorizer = new DataLoader(\n      (requests: readonly AuthorizePermissionRequest[]) =>\n        this.permissions.authorize(requests.slice(), options),\n      {\n        // Serialize the permission name and resourceRef as\n        // a query string to avoid collisions from overlapping\n        // permission names and resourceRefs.\n        cacheKeyFn: ({ permission: { name }, resourceRef }) =>\n          qs.stringify({ name, resourceRef }),\n      },\n    );\n\n    const requestedTypes = query.types || Object.keys(this.types);\n\n    const typeDecisions = zipObject(\n      requestedTypes,\n      await Promise.all(\n        requestedTypes.map(type => {\n          const permission = this.types[type]?.visibilityPermission;\n\n          // No permission configured for this document type - always allow.\n          if (!permission) {\n            return { result: AuthorizeResult.ALLOW as const };\n          }\n\n          // Resource permission supplied, so we need to check for conditional decisions.\n          if (isResourcePermission(permission)) {\n            return conditionFetcher.load({ permission });\n          }\n\n          // Non-resource permission supplied - we can perform a standard authorization.\n          return authorizer.load({ permission });\n        }),\n      ),\n    );\n\n    const authorizedTypes = requestedTypes.filter(\n      type => typeDecisions[type]?.result !== AuthorizeResult.DENY,\n    );\n\n    const resultByResultFilteringRequired = authorizedTypes.some(\n      type => typeDecisions[type]?.result === AuthorizeResult.CONDITIONAL,\n    );\n\n    // When there are no CONDITIONAL decisions for any of the requested\n    // result types, we can skip filtering result by result by simply\n    // skipping the types the user is not permitted to see, which will\n    // be much more efficient.\n    //\n    // Since it's not currently possible to configure the page size used\n    // by search engines, this detail means that a single user might see\n    // a different page size depending on whether their search required\n    // result-by-result filtering or not. We can fix this minor\n    // inconsistency by introducing a configurable page size.\n    //\n    // cf. https://github.com/backstage/backstage/issues/9162\n    if (!resultByResultFilteringRequired) {\n      return this.searchEngine.query(\n        { ...query, types: authorizedTypes },\n        options,\n      );\n    }\n\n    const { page } = decodePageCursor(query.pageCursor);\n    const targetResults = (page + 1) * this.pageSize;\n\n    let filteredResults: IndexableResult[] = [];\n    let nextPageCursor: string | undefined;\n    let latencyBudgetExhausted = false;\n\n    do {\n      const nextPage = await this.searchEngine.query(\n        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },\n        options,\n      );\n\n      filteredResults = filteredResults.concat(\n        await this.filterResults(nextPage.results, typeDecisions, authorizer),\n      );\n\n      nextPageCursor = nextPage.nextPageCursor;\n      latencyBudgetExhausted =\n        Date.now() - queryStartTime > this.queryLatencyBudgetMs;\n    } while (\n      nextPageCursor &&\n      filteredResults.length < targetResults &&\n      !latencyBudgetExhausted\n    );\n\n    return {\n      results: filteredResults\n        .slice(page * this.pageSize, (page + 1) * this.pageSize)\n        .map((result, index) => {\n          // Overwrite any/all rank entries to avoid leaking knowledge of filtered results.\n          return {\n            ...result,\n            rank: page * this.pageSize + index + 1,\n          };\n        }),\n      previousPageCursor:\n        page === 0 ? undefined : encodePageCursor({ page: page - 1 }),\n      nextPageCursor:\n        !latencyBudgetExhausted &&\n        (nextPageCursor || filteredResults.length > targetResults)\n          ? encodePageCursor({ page: page + 1 })\n          : undefined,\n    };\n  }\n\n  private async filterResults(\n    results: IndexableResult[],\n    typeDecisions: Record<string, EvaluatePermissionResponse>,\n    authorizer: DataLoader<\n      EvaluatePermissionRequest,\n      EvaluatePermissionResponse\n    >,\n  ) {\n    return compact(\n      await Promise.all(\n        results.map(result => {\n          if (typeDecisions[result.type]?.result === AuthorizeResult.ALLOW) {\n            return result;\n          }\n\n          const permission = this.types[result.type]?.visibilityPermission;\n          const resourceRef = result.document.authorization?.resourceRef;\n\n          if (!permission || !resourceRef) {\n            return result;\n          }\n\n          // We only reach this point in the code for types where the initial\n          // authorization returned CONDITIONAL -- ALLOWs return early\n          // immediately above, and types where the decision was DENY get\n          // filtered out entirely when querying.\n          //\n          // This means the call to isResourcePermission here is mostly about\n          // narrowing the type of permission - the only way to get here with a\n          // non-resource permission is if the PermissionPolicy returns a\n          // CONDITIONAL decision for a non-resource permission, which can't\n          // happen - it would throw an error during validation in the\n          // permission-backend.\n          if (!isResourcePermission(permission)) {\n            throw new Error(\n              `Unexpected conditional decision returned for non-resource permission \"${permission.name}\"`,\n            );\n          }\n\n          return authorizer\n            .load({ permission, resourceRef })\n            .then(decision =>\n              decision.result === AuthorizeResult.ALLOW ? result : undefined,\n            );\n        }),\n      ),\n    );\n  }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { z } from 'zod';\nimport { errorHandler } from '@backstage/backend-common';\nimport { ErrorResponseBody, InputError } from '@backstage/errors';\nimport { Config } from '@backstage/config';\nimport { JsonObject, JsonValue } from '@backstage/types';\nimport { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';\nimport {\n  PermissionAuthorizer,\n  PermissionEvaluator,\n  toPermissionEvaluator,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResultSet,\n  SearchResultSet,\n} from '@backstage/plugin-search-common';\nimport { SearchEngine } from '@backstage/plugin-search-common';\nimport { AuthorizedSearchEngine } from './AuthorizedSearchEngine';\n\nconst jsonObjectSchema: z.ZodSchema<JsonObject> = z.lazy(() => {\n  const jsonValueSchema: z.ZodSchema<JsonValue> = z.lazy(() =>\n    z.union([\n      z.string(),\n      z.number(),\n      z.boolean(),\n      z.null(),\n      z.array(jsonValueSchema),\n      jsonObjectSchema,\n    ]),\n  );\n\n  return z.record(jsonValueSchema);\n});\n\n/**\n * @public\n */\nexport type RouterOptions = {\n  engine: SearchEngine;\n  types: Record<string, DocumentTypeInfo>;\n  permissions: PermissionEvaluator | PermissionAuthorizer;\n  config: Config;\n  logger: Logger;\n};\n\nconst allowedLocationProtocols = ['http:', 'https:'];\n\n/**\n * @public\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine: inputEngine, types, permissions, config, logger } = options;\n\n  const requestSchema = z.object({\n    term: z.string().default(''),\n    filters: jsonObjectSchema.optional(),\n    types: z\n      .array(z.string().refine(type => Object.keys(types).includes(type)))\n      .optional(),\n    pageCursor: z.string().optional(),\n  });\n\n  let permissionEvaluator: PermissionEvaluator;\n  if ('authorizeConditional' in permissions) {\n    permissionEvaluator = permissions as PermissionEvaluator;\n  } else {\n    logger.warn(\n      'PermissionAuthorizer is deprecated. Please use an instance of PermissionEvaluator instead of PermissionAuthorizer in PluginEnvironment#permissions',\n    );\n    permissionEvaluator = toPermissionEvaluator(permissions);\n  }\n\n  const engine = config.getOptionalBoolean('permission.enabled')\n    ? new AuthorizedSearchEngine(\n        inputEngine,\n        types,\n        permissionEvaluator,\n        config,\n      )\n    : inputEngine;\n\n  const filterResultSet = ({ results, ...resultSet }: SearchResultSet) => ({\n    ...resultSet,\n    results: results.filter(result => {\n      const protocol = new URL(result.document.location, 'https://example.com')\n        .protocol;\n      const isAllowed = allowedLocationProtocols.includes(protocol);\n      if (!isAllowed) {\n        logger.info(\n          `Rejected search result for \"${result.document.title}\" as location protocol \"${protocol}\" is unsafe`,\n        );\n      }\n      return isAllowed;\n    }),\n  });\n\n  const toSearchResults = (resultSet: IndexableResultSet): SearchResultSet => ({\n    ...resultSet,\n    results: resultSet.results.map(result => ({\n      ...result,\n      document: {\n        ...result.document,\n        authorization: undefined,\n      },\n    })),\n  });\n\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request,\n      res: express.Response<SearchResultSet | ErrorResponseBody>,\n    ) => {\n      const parseResult = requestSchema.safeParse(req.query);\n\n      if (!parseResult.success) {\n        throw new InputError(`Invalid query string: ${parseResult.error}`);\n      }\n\n      const query = parseResult.data;\n\n      logger.info(\n        `Search request received: term=\"${\n          query.term\n        }\", filters=${JSON.stringify(query.filters)}, types=${\n          query.types ? query.types.join(',') : ''\n        }, pageCursor=${query.pageCursor ?? ''}`,\n      );\n\n      const token = getBearerTokenFromAuthorizationHeader(\n        req.header('authorization'),\n      );\n\n      try {\n        const resultSet = await engine?.query(query, { token });\n\n        res.send(filterResultSet(toSearchResults(resultSet)));\n      } catch (error) {\n        if (error.name === 'MissingIndexError') {\n          // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form\n          throw error;\n        }\n\n        throw new Error(\n          `There was a problem performing the search query. ${error}`,\n        );\n      }\n    },\n  );\n\n  router.use(errorHandler());\n\n  return router;\n}\n"],"names":["InputError","DataLoader","qs","zipObject","AuthorizeResult","isResourcePermission","compact","z","toPermissionEvaluator","Router","getBearerTokenFromAuthorizationHeader","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQO,SAAS,gBAAgB,CAAC,UAAU,EAAE;AAC7C,EAAE,IAAI,CAAC,UAAU,EAAE;AACnB,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACvB,GAAG;AACH,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3E,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE;AACnB,IAAI,MAAM,IAAIA,iBAAU,CAAC,qBAAqB,CAAC,CAAC;AAChD,GAAG;AACH,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE;AAChB,IAAI,MAAM,IAAIA,iBAAU,CAAC,qBAAqB,CAAC,CAAC;AAChD,GAAG;AACH,EAAE,OAAO;AACT,IAAI,IAAI;AACR,GAAG,CAAC;AACJ,CAAC;AACM,SAAS,gBAAgB,CAAC,EAAE,IAAI,EAAE,EAAE;AAC3C,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AACM,MAAM,sBAAsB,CAAC;AACpC,EAAE,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE;AACxD,IAAI,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;AACrC,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;AACvB,IAAI,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AACnC,IAAI,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;AACvB,IAAI,IAAI,EAAE,CAAC;AACX,IAAI,IAAI,CAAC,oBAAoB,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,yCAAyC,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC;AAC9H,GAAG;AACH,EAAE,aAAa,CAAC,UAAU,EAAE;AAC5B,IAAI,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;AAChD,GAAG;AACH,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE;AACzB,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9C,GAAG;AACH,EAAE,MAAM,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;AAC9B,IAAI,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACtC,IAAI,MAAM,gBAAgB,GAAG,IAAIC,8BAAU;AAC3C,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC;AACpF,MAAM;AACN,QAAQ,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI;AACtD,OAAO;AACP,KAAK,CAAC;AACN,IAAI,MAAM,UAAU,GAAG,IAAIA,8BAAU;AACrC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC;AACzE,MAAM;AACN,QAAQ,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAKC,sBAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAClG,OAAO;AACP,KAAK,CAAC;AACN,IAAI,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,IAAI,MAAM,aAAa,GAAGC,gBAAS;AACnC,MAAM,cAAc;AACpB,MAAM,MAAM,OAAO,CAAC,GAAG;AACvB,QAAQ,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK;AACrC,UAAU,IAAI,EAAE,CAAC;AACjB,UAAU,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;AAChG,UAAU,IAAI,CAAC,UAAU,EAAE;AAC3B,YAAY,OAAO,EAAE,MAAM,EAAEC,sCAAe,CAAC,KAAK,EAAE,CAAC;AACrD,WAAW;AACX,UAAU,IAAIC,2CAAoB,CAAC,UAAU,CAAC,EAAE;AAChD,YAAY,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACzD,WAAW;AACX,UAAU,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACjD,SAAS,CAAC;AACV,OAAO;AACP,KAAK,CAAC;AACN,IAAI,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM;AACjD,MAAM,CAAC,IAAI,KAAK;AAChB,QAAQ,IAAI,EAAE,CAAC;AACf,QAAQ,OAAO,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,MAAMD,sCAAe,CAAC,IAAI,CAAC;AAClG,OAAO;AACP,KAAK,CAAC;AACN,IAAI,MAAM,+BAA+B,GAAG,eAAe,CAAC,IAAI;AAChE,MAAM,CAAC,IAAI,KAAK;AAChB,QAAQ,IAAI,EAAE,CAAC;AACf,QAAQ,OAAO,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,MAAMA,sCAAe,CAAC,WAAW,CAAC;AACzG,OAAO;AACP,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,+BAA+B,EAAE;AAC1C,MAAM,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK;AACpC,QAAQ,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE;AAC5C,QAAQ,OAAO;AACf,OAAO,CAAC;AACR,KAAK;AACL,IAAI,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACxD,IAAI,MAAM,aAAa,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;AACrD,IAAI,IAAI,eAAe,GAAG,EAAE,CAAC;AAC7B,IAAI,IAAI,cAAc,CAAC;AACvB,IAAI,IAAI,sBAAsB,GAAG,KAAK,CAAC;AACvC,IAAI,GAAG;AACP,MAAM,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK;AACpD,QAAQ,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE;AACxE,QAAQ,OAAO;AACf,OAAO,CAAC;AACR,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM;AAC9C,QAAQ,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC;AAC7E,OAAO,CAAC;AACR,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AAC/C,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC;AACvF,KAAK,QAAQ,cAAc,IAAI,eAAe,CAAC,MAAM,GAAG,aAAa,IAAI,CAAC,sBAAsB,EAAE;AAClG,IAAI,OAAO;AACX,MAAM,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK;AAC9G,QAAQ,OAAO;AACf,UAAU,GAAG,MAAM;AACnB,UAAU,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,KAAK,GAAG,CAAC;AAChD,SAAS,CAAC;AACV,OAAO,CAAC;AACR,MAAM,kBAAkB,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC;AACpF,MAAM,cAAc,EAAE,CAAC,sBAAsB,KAAK,cAAc,IAAI,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;AAC3J,KAAK,CAAC;AACN,GAAG;AACH,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE;AAC1D,IAAI,OAAOE,cAAO;AAClB,MAAM,MAAM,OAAO,CAAC,GAAG;AACvB,QAAQ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK;AAChC,UAAU,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACzB,UAAU,IAAI,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,MAAMF,sCAAe,CAAC,KAAK,EAAE;AAC1G,YAAY,OAAO,MAAM,CAAC;AAC1B,WAAW;AACX,UAAU,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;AACvG,UAAU,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC;AACrG,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE;AAC3C,YAAY,OAAO,MAAM,CAAC;AAC1B,WAAW;AACX,UAAU,IAAI,CAACC,2CAAoB,CAAC,UAAU,CAAC,EAAE;AACjD,YAAY,MAAM,IAAI,KAAK;AAC3B,cAAc,CAAC,sEAAsE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACzG,aAAa,CAAC;AACd,WAAW;AACX,UAAU,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI;AAClE,YAAY,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,KAAKD,sCAAe,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AACrF,WAAW,CAAC;AACZ,SAAS,CAAC;AACV,OAAO;AACP,KAAK,CAAC;AACN,GAAG;AACH;;ACrIA,MAAM,gBAAgB,GAAGG,KAAC,CAAC,IAAI,CAAC,MAAM;AACtC,EAAE,MAAM,eAAe,GAAGA,KAAC,CAAC,IAAI;AAChC,IAAI,MAAMA,KAAC,CAAC,KAAK,CAAC;AAClB,MAAMA,KAAC,CAAC,MAAM,EAAE;AAChB,MAAMA,KAAC,CAAC,MAAM,EAAE;AAChB,MAAMA,KAAC,CAAC,OAAO,EAAE;AACjB,MAAMA,KAAC,CAAC,IAAI,EAAE;AACd,MAAMA,KAAC,CAAC,KAAK,CAAC,eAAe,CAAC;AAC9B,MAAM,gBAAgB;AACtB,KAAK,CAAC;AACN,GAAG,CAAC;AACJ,EAAE,OAAOA,KAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC9C,eAAe,YAAY,CAAC,OAAO,EAAE;AAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;AAC9E,EAAE,MAAM,aAAa,GAAGA,KAAC,CAAC,MAAM,CAAC;AACjC,IAAI,IAAI,EAAEA,KAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAChC,IAAI,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;AACxC,IAAI,KAAK,EAAEA,KAAC,CAAC,KAAK,CAACA,KAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;AAC7F,IAAI,UAAU,EAAEA,KAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACrC,GAAG,CAAC,CAAC;AACL,EAAE,IAAI,mBAAmB,CAAC;AAC1B,EAAE,IAAI,sBAAsB,IAAI,WAAW,EAAE;AAC7C,IAAI,mBAAmB,GAAG,WAAW,CAAC;AACtC,GAAG,MAAM;AACT,IAAI,MAAM,CAAC,IAAI;AACf,MAAM,oJAAoJ;AAC1J,KAAK,CAAC;AACN,IAAI,mBAAmB,GAAGC,4CAAqB,CAAC,WAAW,CAAC,CAAC;AAC7D,GAAG;AACH,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,GAAG,IAAI,sBAAsB;AAC7F,IAAI,WAAW;AACf,IAAI,KAAK;AACT,IAAI,mBAAmB;AACvB,IAAI,MAAM;AACV,GAAG,GAAG,WAAW,CAAC;AAClB,EAAE,MAAM,eAAe,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM;AAC1D,IAAI,GAAG,SAAS;AAChB,IAAI,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK;AACxC,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpE,MAAM,IAAI,CAAC,SAAS,EAAE;AACtB,QAAQ,MAAM,CAAC,IAAI;AACnB,UAAU,CAAC,4BAA4B,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,EAAE,QAAQ,CAAC,WAAW,CAAC;AAC9G,SAAS,CAAC;AACV,OAAO;AACP,MAAM,OAAO,SAAS,CAAC;AACvB,KAAK,CAAC;AACN,GAAG,CAAC,CAAC;AACL,EAAE,MAAM,eAAe,GAAG,CAAC,SAAS,MAAM;AAC1C,IAAI,GAAG,SAAS;AAChB,IAAI,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM;AAChD,MAAM,GAAG,MAAM;AACf,MAAM,QAAQ,EAAE;AAChB,QAAQ,GAAG,MAAM,CAAC,QAAQ;AAC1B,QAAQ,aAAa,EAAE,KAAK,CAAC;AAC7B,OAAO;AACP,KAAK,CAAC,CAAC;AACP,GAAG,CAAC,CAAC;AACL,EAAE,MAAM,MAAM,GAAGC,0BAAM,EAAE,CAAC;AAC1B,EAAE,MAAM,CAAC,GAAG;AACZ,IAAI,QAAQ;AACZ,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK;AACxB,MAAM,IAAI,EAAE,CAAC;AACb,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7D,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;AAChC,QAAQ,MAAM,IAAIT,iBAAU,CAAC,CAAC,sBAAsB,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3E,OAAO;AACP,MAAM,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;AACrC,MAAM,MAAM,CAAC,IAAI;AACjB,QAAQ,CAAC,+BAA+B,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7M,OAAO,CAAC;AACR,MAAM,MAAM,KAAK,GAAGU,oDAAqC;AACzD,QAAQ,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;AACnC,OAAO,CAAC;AACR,MAAM,IAAI;AACV,QAAQ,MAAM,SAAS,GAAG,OAAO,MAAM,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC3F,QAAQ,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC9D,OAAO,CAAC,OAAO,KAAK,EAAE;AACtB,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE;AAChD,UAAU,MAAM,KAAK,CAAC;AACtB,SAAS;AACT,QAAQ,MAAM,IAAI,KAAK;AACvB,UAAU,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;AACrE,SAAS,CAAC;AACV,OAAO;AACP,KAAK;AACL,GAAG,CAAC;AACJ,EAAE,MAAM,CAAC,GAAG,CAACC,0BAAY,EAAE,CAAC,CAAC;AAC7B,EAAE,OAAO,MAAM,CAAC;AAChB;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-search-backend",
   "description": "The Backstage backend plugin that provides your backstage app with search",
-  "version": "1.0.0",
+  "version": "1.0.1-next.0",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",
@@ -23,13 +23,13 @@
     "clean": "backstage-cli package clean"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.14.1",
+    "@backstage/backend-common": "^0.15.0-next.0",
     "@backstage/config": "^1.0.1",
     "@backstage/errors": "^1.1.0",
-    "@backstage/plugin-auth-node": "^0.2.3",
+    "@backstage/plugin-auth-node": "^0.2.4-next.0",
     "@backstage/plugin-permission-common": "^0.6.3",
-    "@backstage/plugin-permission-node": "^0.6.3",
-    "@backstage/plugin-search-backend-node": "^1.0.0",
+    "@backstage/plugin-permission-node": "^0.6.4-next.0",
+    "@backstage/plugin-search-backend-node": "^1.0.1-next.0",
     "@backstage/plugin-search-common": "^1.0.0",
     "@backstage/types": "^1.0.0",
     "@types/express": "^4.17.6",
@@ -43,12 +43,12 @@
     "zod": "^3.11.6"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.18.0",
+    "@backstage/cli": "^0.18.1-next.0",
     "@types/supertest": "^2.0.8",
     "supertest": "^6.1.3"
   },
   "files": [
     "dist"
   ],
-  "gitHead": "999878d8f1ae30f6a15925816af2016cb9d717a1"
+  "gitHead": "fc3229c49caf6eced02ed9516199015bf4682664"
 }