@backstage/plugin-search-backend 1.0.2 → 1.1.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # @backstage/plugin-search-backend
 
+## 1.1.0-next.1
+
+### Minor Changes
+
+- 16c853a6ed: Be less restrictive with unknown keys on query endpoint
+- a799972bb1: The query received by search engines now contains a property called `pageLimit`, it specifies how many results to return per page when sending a query request to the search backend.
+
+  Example:
+  _Returns up to 30 results per page_
+
+  ```
+  GET /query?pageLimit=30
+  ```
+
+  The search backend validates the page limit and this value must not exceed 100, but it doesn't set a default value for the page limit parameter, it leaves it up to each search engine to set this, so Lunr, Postgres and Elastic Search set 25 results per page as a default value.
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.15.2-next.1
+  - @backstage/plugin-search-common@1.1.0-next.1
+  - @backstage/plugin-search-backend-node@1.0.3-next.1
+  - @backstage/config@1.0.3-next.1
+  - @backstage/errors@1.1.2-next.1
+  - @backstage/types@1.0.0
+  - @backstage/plugin-auth-node@0.2.6-next.1
+  - @backstage/plugin-permission-common@0.6.5-next.1
+  - @backstage/plugin-permission-node@0.6.6-next.1
+
+## 1.0.3-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.15.2-next.0
+  - @backstage/plugin-auth-node@0.2.6-next.0
+  - @backstage/plugin-permission-node@0.6.6-next.0
+  - @backstage/config@1.0.3-next.0
+  - @backstage/errors@1.1.2-next.0
+  - @backstage/types@1.0.0
+  - @backstage/plugin-permission-common@0.6.5-next.0
+  - @backstage/plugin-search-backend-node@1.0.3-next.0
+  - @backstage/plugin-search-common@1.0.2-next.0
+
 ## 1.0.2
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -167,6 +167,7 @@ const jsonObjectSchema = zod.z.lazy(() => {
   );
   return zod.z.record(jsonValueSchema);
 });
+const maxPageLimit = 100;
 const allowedLocationProtocols = ["http:", "https:"];
 async function createRouter(options) {
   const { engine: inputEngine, types, permissions, config, logger } = options;
@@ -174,7 +175,18 @@ async function createRouter(options) {
     term: zod.z.string().default(""),
     filters: jsonObjectSchema.optional(),
     types: zod.z.array(zod.z.string().refine((type) => Object.keys(types).includes(type))).optional(),
-    pageCursor: zod.z.string().optional()
+    pageCursor: zod.z.string().optional(),
+    pageLimit: zod.z.string().transform((pageLimit) => parseInt(pageLimit, 10)).refine(
+      (pageLimit) => !isNaN(pageLimit),
+      (pageLimit) => ({
+        message: `The page limit "${pageLimit}" is not a number`
+      })
+    ).refine(
+      (pageLimit) => pageLimit <= maxPageLimit,
+      (pageLimit) => ({
+        message: `The page limit "${pageLimit}" is greater than "${maxPageLimit}"`
+      })
+    ).optional()
   });
   let permissionEvaluator;
   if ("authorizeConditional" in permissions) {
@@ -219,7 +231,7 @@ async function createRouter(options) {
     "/query",
     async (req, res) => {
       var _a;
-      const parseResult = requestSchema.safeParse(req.query);
+      const parseResult = requestSchema.passthrough().safeParse(req.query);
       if (!parseResult.success) {
         throw new errors.InputError(`Invalid query string: ${parseResult.error}`);
       }

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/service/AuthorizedSearchEngine.ts","../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { compact, zipObject } from 'lodash';\nimport qs from 'qs';\nimport DataLoader from 'dataloader';\nimport {\n  EvaluatePermissionResponse,\n  EvaluatePermissionRequest,\n  AuthorizeResult,\n  isResourcePermission,\n  PermissionEvaluator,\n  AuthorizePermissionRequest,\n  QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResult,\n  IndexableResultSet,\n  QueryRequestOptions,\n  QueryTranslator,\n  SearchEngine,\n  SearchQuery,\n} from '@backstage/plugin-search-common';\nimport { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { Writable } from 'stream';\n\nexport function decodePageCursor(pageCursor?: string): { page: number } {\n  if (!pageCursor) {\n    return { page: 0 };\n  }\n\n  const page = Number(Buffer.from(pageCursor, 'base64').toString('utf-8'));\n  if (isNaN(page)) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  if (page < 0) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  return {\n    page,\n  };\n}\n\nexport function encodePageCursor({ page }: { page: number }): string {\n  return Buffer.from(`${page}`, 'utf-8').toString('base64');\n}\n\nexport class AuthorizedSearchEngine implements SearchEngine {\n  private readonly pageSize = 25;\n  private readonly queryLatencyBudgetMs: number;\n\n  constructor(\n    private readonly searchEngine: SearchEngine,\n    private readonly types: Record<string, DocumentTypeInfo>,\n    private readonly permissions: PermissionEvaluator,\n    config: Config,\n  ) {\n    this.queryLatencyBudgetMs =\n      config.getOptionalNumber('search.permissions.queryLatencyBudgetMs') ??\n      1000;\n  }\n\n  setTranslator(translator: QueryTranslator): void {\n    this.searchEngine.setTranslator(translator);\n  }\n\n  async getIndexer(type: string): Promise<Writable> {\n    return this.searchEngine.getIndexer(type);\n  }\n\n  async query(\n    query: SearchQuery,\n    options: QueryRequestOptions,\n  ): Promise<IndexableResultSet> {\n    const queryStartTime = Date.now();\n\n    const conditionFetcher = new DataLoader(\n      (requests: readonly QueryPermissionRequest[]) =>\n        this.permissions.authorizeConditional(requests.slice(), options),\n      {\n        cacheKeyFn: ({ permission: { name } }) => name,\n      },\n    );\n\n    const authorizer = new DataLoader(\n      (requests: readonly AuthorizePermissionRequest[]) =>\n        this.permissions.authorize(requests.slice(), options),\n      {\n        // Serialize the permission name and resourceRef as\n        // a query string to avoid collisions from overlapping\n        // permission names and resourceRefs.\n        cacheKeyFn: ({ permission: { name }, resourceRef }) =>\n          qs.stringify({ name, resourceRef }),\n      },\n    );\n\n    const requestedTypes = query.types || Object.keys(this.types);\n\n    const typeDecisions = zipObject(\n      requestedTypes,\n      await Promise.all(\n        requestedTypes.map(type => {\n          const permission = this.types[type]?.visibilityPermission;\n\n          // No permission configured for this document type - always allow.\n          if (!permission) {\n            return { result: AuthorizeResult.ALLOW as const };\n          }\n\n          // Resource permission supplied, so we need to check for conditional decisions.\n          if (isResourcePermission(permission)) {\n            return conditionFetcher.load({ permission });\n          }\n\n          // Non-resource permission supplied - we can perform a standard authorization.\n          return authorizer.load({ permission });\n        }),\n      ),\n    );\n\n    const authorizedTypes = requestedTypes.filter(\n      type => typeDecisions[type]?.result !== AuthorizeResult.DENY,\n    );\n\n    const resultByResultFilteringRequired = authorizedTypes.some(\n      type => typeDecisions[type]?.result === AuthorizeResult.CONDITIONAL,\n    );\n\n    // When there are no CONDITIONAL decisions for any of the requested\n    // result types, we can skip filtering result by result by simply\n    // skipping the types the user is not permitted to see, which will\n    // be much more efficient.\n    //\n    // Since it's not currently possible to configure the page size used\n    // by search engines, this detail means that a single user might see\n    // a different page size depending on whether their search required\n    // result-by-result filtering or not. We can fix this minor\n    // inconsistency by introducing a configurable page size.\n    //\n    // cf. https://github.com/backstage/backstage/issues/9162\n    if (!resultByResultFilteringRequired) {\n      return this.searchEngine.query(\n        { ...query, types: authorizedTypes },\n        options,\n      );\n    }\n\n    const { page } = decodePageCursor(query.pageCursor);\n    const targetResults = (page + 1) * this.pageSize;\n\n    let filteredResults: IndexableResult[] = [];\n    let nextPageCursor: string | undefined;\n    let latencyBudgetExhausted = false;\n\n    do {\n      const nextPage = await this.searchEngine.query(\n        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },\n        options,\n      );\n\n      filteredResults = filteredResults.concat(\n        await this.filterResults(nextPage.results, typeDecisions, authorizer),\n      );\n\n      nextPageCursor = nextPage.nextPageCursor;\n      latencyBudgetExhausted =\n        Date.now() - queryStartTime > this.queryLatencyBudgetMs;\n    } while (\n      nextPageCursor &&\n      filteredResults.length < targetResults &&\n      !latencyBudgetExhausted\n    );\n\n    return {\n      results: filteredResults\n        .slice(page * this.pageSize, (page + 1) * this.pageSize)\n        .map((result, index) => {\n          // Overwrite any/all rank entries to avoid leaking knowledge of filtered results.\n          return {\n            ...result,\n            rank: page * this.pageSize + index + 1,\n          };\n        }),\n      previousPageCursor:\n        page === 0 ? undefined : encodePageCursor({ page: page - 1 }),\n      nextPageCursor:\n        !latencyBudgetExhausted &&\n        (nextPageCursor || filteredResults.length > targetResults)\n          ? encodePageCursor({ page: page + 1 })\n          : undefined,\n    };\n  }\n\n  private async filterResults(\n    results: IndexableResult[],\n    typeDecisions: Record<string, EvaluatePermissionResponse>,\n    authorizer: DataLoader<\n      EvaluatePermissionRequest,\n      EvaluatePermissionResponse\n    >,\n  ) {\n    return compact(\n      await Promise.all(\n        results.map(result => {\n          if (typeDecisions[result.type]?.result === AuthorizeResult.ALLOW) {\n            return result;\n          }\n\n          const permission = this.types[result.type]?.visibilityPermission;\n          const resourceRef = result.document.authorization?.resourceRef;\n\n          if (!permission || !resourceRef) {\n            return result;\n          }\n\n          // We only reach this point in the code for types where the initial\n          // authorization returned CONDITIONAL -- ALLOWs return early\n          // immediately above, and types where the decision was DENY get\n          // filtered out entirely when querying.\n          //\n          // This means the call to isResourcePermission here is mostly about\n          // narrowing the type of permission - the only way to get here with a\n          // non-resource permission is if the PermissionPolicy returns a\n          // CONDITIONAL decision for a non-resource permission, which can't\n          // happen - it would throw an error during validation in the\n          // permission-backend.\n          if (!isResourcePermission(permission)) {\n            throw new Error(\n              `Unexpected conditional decision returned for non-resource permission \"${permission.name}\"`,\n            );\n          }\n\n          return authorizer\n            .load({ permission, resourceRef })\n            .then(decision =>\n              decision.result === AuthorizeResult.ALLOW ? result : undefined,\n            );\n        }),\n      ),\n    );\n  }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { z } from 'zod';\nimport { errorHandler } from '@backstage/backend-common';\nimport { ErrorResponseBody, InputError } from '@backstage/errors';\nimport { Config } from '@backstage/config';\nimport { JsonObject, JsonValue } from '@backstage/types';\nimport { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';\nimport {\n  PermissionAuthorizer,\n  PermissionEvaluator,\n  toPermissionEvaluator,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResultSet,\n  SearchResultSet,\n} from '@backstage/plugin-search-common';\nimport { SearchEngine } from '@backstage/plugin-search-common';\nimport { AuthorizedSearchEngine } from './AuthorizedSearchEngine';\n\nconst jsonObjectSchema: z.ZodSchema<JsonObject> = z.lazy(() => {\n  const jsonValueSchema: z.ZodSchema<JsonValue> = z.lazy(() =>\n    z.union([\n      z.string(),\n      z.number(),\n      z.boolean(),\n      z.null(),\n      z.array(jsonValueSchema),\n      jsonObjectSchema,\n    ]),\n  );\n\n  return z.record(jsonValueSchema);\n});\n\n/**\n * @public\n */\nexport type RouterOptions = {\n  engine: SearchEngine;\n  types: Record<string, DocumentTypeInfo>;\n  permissions: PermissionEvaluator | PermissionAuthorizer;\n  config: Config;\n  logger: Logger;\n};\n\nconst allowedLocationProtocols = ['http:', 'https:'];\n\n/**\n * @public\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine: inputEngine, types, permissions, config, logger } = options;\n\n  const requestSchema = z.object({\n    term: z.string().default(''),\n    filters: jsonObjectSchema.optional(),\n    types: z\n      .array(z.string().refine(type => Object.keys(types).includes(type)))\n      .optional(),\n    pageCursor: z.string().optional(),\n  });\n\n  let permissionEvaluator: PermissionEvaluator;\n  if ('authorizeConditional' in permissions) {\n    permissionEvaluator = permissions as PermissionEvaluator;\n  } else {\n    logger.warn(\n      'PermissionAuthorizer is deprecated. Please use an instance of PermissionEvaluator instead of PermissionAuthorizer in PluginEnvironment#permissions',\n    );\n    permissionEvaluator = toPermissionEvaluator(permissions);\n  }\n\n  const engine = config.getOptionalBoolean('permission.enabled')\n    ? new AuthorizedSearchEngine(\n        inputEngine,\n        types,\n        permissionEvaluator,\n        config,\n      )\n    : inputEngine;\n\n  const filterResultSet = ({ results, ...resultSet }: SearchResultSet) => ({\n    ...resultSet,\n    results: results.filter(result => {\n      const protocol = new URL(result.document.location, 'https://example.com')\n        .protocol;\n      const isAllowed = allowedLocationProtocols.includes(protocol);\n      if (!isAllowed) {\n        logger.info(\n          `Rejected search result for \"${result.document.title}\" as location protocol \"${protocol}\" is unsafe`,\n        );\n      }\n      return isAllowed;\n    }),\n  });\n\n  const toSearchResults = (resultSet: IndexableResultSet): SearchResultSet => ({\n    ...resultSet,\n    results: resultSet.results.map(result => ({\n      ...result,\n      document: {\n        ...result.document,\n        authorization: undefined,\n      },\n    })),\n  });\n\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request,\n      res: express.Response<SearchResultSet | ErrorResponseBody>,\n    ) => {\n      const parseResult = requestSchema.safeParse(req.query);\n\n      if (!parseResult.success) {\n        throw new InputError(`Invalid query string: ${parseResult.error}`);\n      }\n\n      const query = parseResult.data;\n\n      logger.info(\n        `Search request received: term=\"${\n          query.term\n        }\", filters=${JSON.stringify(query.filters)}, types=${\n          query.types ? query.types.join(',') : ''\n        }, pageCursor=${query.pageCursor ?? ''}`,\n      );\n\n      const token = getBearerTokenFromAuthorizationHeader(\n        req.header('authorization'),\n      );\n\n      try {\n        const resultSet = await engine?.query(query, { token });\n\n        res.send(filterResultSet(toSearchResults(resultSet)));\n      } catch (error) {\n        if (error.name === 'MissingIndexError') {\n          // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form\n          throw error;\n        }\n\n        throw new Error(\n          `There was a problem performing the search query. ${error}`,\n        );\n      }\n    },\n  );\n\n  router.use(errorHandler());\n\n  return router;\n}\n"],"names":["InputError","DataLoader","qs","zipObject","AuthorizeResult","isResourcePermission","compact","z","toPermissionEvaluator","Router","getBearerTokenFromAuthorizationHeader","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyCO,SAAS,iBAAiB,UAAuC,EAAA;AACtE,EAAA,IAAI,CAAC,UAAY,EAAA;AACf,IAAO,OAAA,EAAE,MAAM,CAAE,EAAA,CAAA;AAAA,GACnB;AAEA,EAAM,MAAA,IAAA,GAAO,OAAO,MAAO,CAAA,IAAA,CAAK,YAAY,QAAQ,CAAA,CAAE,QAAS,CAAA,OAAO,CAAC,CAAA,CAAA;AACvE,EAAI,IAAA,KAAA,CAAM,IAAI,CAAG,EAAA;AACf,IAAM,MAAA,IAAIA,kBAAW,qBAAqB,CAAA,CAAA;AAAA,GAC5C;AAEA,EAAA,IAAI,OAAO,CAAG,EAAA;AACZ,IAAM,MAAA,IAAIA,kBAAW,qBAAqB,CAAA,CAAA;AAAA,GAC5C;AAEA,EAAO,OAAA;AAAA,IACL,IAAA;AAAA,GACF,CAAA;AACF,CAAA;AAEgB,SAAA,gBAAA,CAAiB,EAAE,IAAA,EAAkC,EAAA;AACnE,EAAA,OAAO,OAAO,IAAK,CAAA,CAAA,EAAG,QAAQ,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA,CAAA;AAC1D,CAAA;AAEO,MAAM,sBAA+C,CAAA;AAAA,EAI1D,WACmB,CAAA,YAAA,EACA,KACA,EAAA,WAAA,EACjB,MACA,EAAA;AAJiB,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA,CAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA,CAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA,CAAA;AANnB,IAAA,IAAA,CAAiB,QAAW,GAAA,EAAA,CAAA;AAjE9B,IAAA,IAAA,EAAA,CAAA;AA0EI,IAAA,IAAA,CAAK,oBACH,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,iBAAkB,CAAA,yCAAyC,MAAlE,IACA,GAAA,EAAA,GAAA,GAAA,CAAA;AAAA,GACJ;AAAA,EAEA,cAAc,UAAmC,EAAA;AAC/C,IAAK,IAAA,CAAA,YAAA,CAAa,cAAc,UAAU,CAAA,CAAA;AAAA,GAC5C;AAAA,EAEA,MAAM,WAAW,IAAiC,EAAA;AAChD,IAAO,OAAA,IAAA,CAAK,YAAa,CAAA,UAAA,CAAW,IAAI,CAAA,CAAA;AAAA,GAC1C;AAAA,EAEA,MAAM,KACJ,CAAA,KAAA,EACA,OAC6B,EAAA;AAC7B,IAAM,MAAA,cAAA,GAAiB,KAAK,GAAI,EAAA,CAAA;AAEhC,IAAA,MAAM,mBAAmB,IAAIC,8BAAA;AAAA,MAC3B,CAAC,aACC,IAAK,CAAA,WAAA,CAAY,qBAAqB,QAAS,CAAA,KAAA,IAAS,OAAO,CAAA;AAAA,MACjE;AAAA,QACE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAA,IAAa,KAAA,IAAA;AAAA,OAC5C;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,aAAa,IAAIA,8BAAA;AAAA,MACrB,CAAC,aACC,IAAK,CAAA,WAAA,CAAY,UAAU,QAAS,CAAA,KAAA,IAAS,OAAO,CAAA;AAAA,MACtD;AAAA,QAIE,UAAY,EAAA,CAAC,EAAE,UAAA,EAAY,EAAE,IAAK,EAAA,EAAG,WAAY,EAAA,KAC/CC,sBAAG,CAAA,SAAA,CAAU,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,OACtC;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,iBAAiB,KAAM,CAAA,KAAA,IAAS,MAAO,CAAA,IAAA,CAAK,KAAK,KAAK,CAAA,CAAA;AAE5D,IAAA,MAAM,aAAgB,GAAAC,gBAAA;AAAA,MACpB,cAAA;AAAA,MACA,MAAM,OAAQ,CAAA,GAAA;AAAA,QACZ,cAAA,CAAe,IAAI,CAAQ,IAAA,KAAA;AAtHnC,UAAA,IAAA,EAAA,CAAA;AAuHU,UAAA,MAAM,UAAa,GAAA,CAAA,EAAA,GAAA,IAAA,CAAK,KAAM,CAAA,IAAA,CAAA,KAAX,IAAkB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,oBAAA,CAAA;AAGrC,UAAA,IAAI,CAAC,UAAY,EAAA;AACf,YAAO,OAAA,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,KAAe,EAAA,CAAA;AAAA,WAClD;AAGA,UAAI,IAAAC,2CAAA,CAAqB,UAAU,CAAG,EAAA;AACpC,YAAA,OAAO,gBAAiB,CAAA,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA,CAAA;AAAA,WAC7C;AAGA,UAAA,OAAO,UAAW,CAAA,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA,CAAA;AAAA,SACtC,CAAA;AAAA,OACH;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,kBAAkB,cAAe,CAAA,MAAA;AAAA,MACrC,CAAK,IAAA,KAAA;AA1IX,QAAA,IAAA,EAAA,CAAA;AA0Ic,QAAc,OAAA,CAAA,CAAA,EAAA,GAAA,aAAA,CAAA,IAAA,CAAA,KAAd,IAAqB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,MAAA,MAAWD,sCAAgB,CAAA,IAAA,CAAA;AAAA,OAAA;AAAA,KAC1D,CAAA;AAEA,IAAA,MAAM,kCAAkC,eAAgB,CAAA,IAAA;AAAA,MACtD,CAAK,IAAA,KAAA;AA9IX,QAAA,IAAA,EAAA,CAAA;AA8Ic,QAAc,OAAA,CAAA,CAAA,EAAA,GAAA,aAAA,CAAA,IAAA,CAAA,KAAd,IAAqB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,MAAA,MAAWA,sCAAgB,CAAA,WAAA,CAAA;AAAA,OAAA;AAAA,KAC1D,CAAA;AAcA,IAAA,IAAI,CAAC,+BAAiC,EAAA;AACpC,MAAA,OAAO,KAAK,YAAa,CAAA,KAAA;AAAA,QACvB,EAAE,GAAG,KAAO,EAAA,KAAA,EAAO,eAAgB,EAAA;AAAA,QACnC,OAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,EAAE,IAAA,EAAS,GAAA,gBAAA,CAAiB,MAAM,UAAU,CAAA,CAAA;AAClD,IAAM,MAAA,aAAA,GAAA,CAAiB,IAAO,GAAA,CAAA,IAAK,IAAK,CAAA,QAAA,CAAA;AAExC,IAAA,IAAI,kBAAqC,EAAC,CAAA;AAC1C,IAAI,IAAA,cAAA,CAAA;AACJ,IAAA,IAAI,sBAAyB,GAAA,KAAA,CAAA;AAE7B,IAAG,GAAA;AACD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAa,CAAA,KAAA;AAAA,QACvC,EAAE,GAAG,KAAA,EAAO,KAAO,EAAA,eAAA,EAAiB,YAAY,cAAe,EAAA;AAAA,QAC/D,OAAA;AAAA,OACF,CAAA;AAEA,MAAA,eAAA,GAAkB,eAAgB,CAAA,MAAA;AAAA,QAChC,MAAM,IAAK,CAAA,aAAA,CAAc,QAAS,CAAA,OAAA,EAAS,eAAe,UAAU,CAAA;AAAA,OACtE,CAAA;AAEA,MAAA,cAAA,GAAiB,QAAS,CAAA,cAAA,CAAA;AAC1B,MAAA,sBAAA,GACE,IAAK,CAAA,GAAA,EAAQ,GAAA,cAAA,GAAiB,IAAK,CAAA,oBAAA,CAAA;AAAA,KAErC,QAAA,cAAA,IACA,eAAgB,CAAA,MAAA,GAAS,iBACzB,CAAC,sBAAA,EAAA;AAGH,IAAO,OAAA;AAAA,MACL,OAAS,EAAA,eAAA,CACN,KAAM,CAAA,IAAA,GAAO,KAAK,QAAW,EAAA,CAAA,IAAA,GAAO,CAAK,IAAA,IAAA,CAAK,QAAQ,CAAA,CACtD,GAAI,CAAA,CAAC,QAAQ,KAAU,KAAA;AAEtB,QAAO,OAAA;AAAA,UACL,GAAG,MAAA;AAAA,UACH,IAAM,EAAA,IAAA,GAAO,IAAK,CAAA,QAAA,GAAW,KAAQ,GAAA,CAAA;AAAA,SACvC,CAAA;AAAA,OACD,CAAA;AAAA,MACH,kBAAA,EACE,SAAS,CAAI,GAAA,KAAA,CAAA,GAAY,iBAAiB,EAAE,IAAA,EAAM,IAAO,GAAA,CAAA,EAAG,CAAA;AAAA,MAC9D,cACE,EAAA,CAAC,sBACA,KAAA,cAAA,IAAkB,eAAgB,CAAA,MAAA,GAAS,aACxC,CAAA,GAAA,gBAAA,CAAiB,EAAE,IAAA,EAAM,IAAO,GAAA,CAAA,EAAG,CACnC,GAAA,KAAA,CAAA;AAAA,KACR,CAAA;AAAA,GACF;AAAA,EAEA,MAAc,aAAA,CACZ,OACA,EAAA,aAAA,EACA,UAIA,EAAA;AACA,IAAO,OAAAE,cAAA;AAAA,MACL,MAAM,OAAQ,CAAA,GAAA;AAAA,QACZ,OAAA,CAAQ,IAAI,CAAU,MAAA,KAAA;AA5N9B,UAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,CAAA;AA6NU,UAAA,IAAA,CAAA,CAAI,mBAAc,MAAO,CAAA,IAAA,CAAA,KAArB,IAA4B,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,MAAA,MAAWF,uCAAgB,KAAO,EAAA;AAChE,YAAO,OAAA,MAAA,CAAA;AAAA,WACT;AAEA,UAAA,MAAM,UAAa,GAAA,CAAA,EAAA,GAAA,IAAA,CAAK,KAAM,CAAA,MAAA,CAAO,UAAlB,IAAyB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,oBAAA,CAAA;AAC5C,UAAA,MAAM,WAAc,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,QAAS,CAAA,aAAA,KAAhB,IAA+B,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,WAAA,CAAA;AAEnD,UAAI,IAAA,CAAC,UAAc,IAAA,CAAC,WAAa,EAAA;AAC/B,YAAO,OAAA,MAAA,CAAA;AAAA,WACT;AAaA,UAAI,IAAA,CAACC,2CAAqB,CAAA,UAAU,CAAG,EAAA;AACrC,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,yEAAyE,UAAW,CAAA,IAAA,CAAA,CAAA,CAAA;AAAA,aACtF,CAAA;AAAA,WACF;AAEA,UAAA,OAAO,WACJ,IAAK,CAAA,EAAE,UAAY,EAAA,WAAA,EAAa,CAChC,CAAA,IAAA;AAAA,YAAK,CACJ,QAAA,KAAA,QAAA,CAAS,MAAW,KAAAD,sCAAA,CAAgB,QAAQ,MAAS,GAAA,KAAA,CAAA;AAAA,WACvD,CAAA;AAAA,SACH,CAAA;AAAA,OACH;AAAA,KACF,CAAA;AAAA,GACF;AACF;;AC5NA,MAAM,gBAAA,GAA4CG,KAAE,CAAA,IAAA,CAAK,MAAM;AAC7D,EAAA,MAAM,kBAA0CA,KAAE,CAAA,IAAA;AAAA,IAAK,MACrDA,MAAE,KAAM,CAAA;AAAA,MACNA,MAAE,MAAO,EAAA;AAAA,MACTA,MAAE,MAAO,EAAA;AAAA,MACTA,MAAE,OAAQ,EAAA;AAAA,MACVA,MAAE,IAAK,EAAA;AAAA,MACPA,KAAA,CAAE,MAAM,eAAe,CAAA;AAAA,MACvB,gBAAA;AAAA,KACD,CAAA;AAAA,GACH,CAAA;AAEA,EAAO,OAAAA,KAAA,CAAE,OAAO,eAAe,CAAA,CAAA;AACjC,CAAC,CAAA,CAAA;AAaD,MAAM,wBAAA,GAA2B,CAAC,OAAA,EAAS,QAAQ,CAAA,CAAA;AAKnD,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAA,MAAM,EAAE,MAAQ,EAAA,WAAA,EAAa,OAAO,WAAa,EAAA,MAAA,EAAQ,QAAW,GAAA,OAAA,CAAA;AAEpE,EAAM,MAAA,aAAA,GAAgBA,MAAE,MAAO,CAAA;AAAA,IAC7B,IAAM,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,IAC3B,OAAA,EAAS,iBAAiB,QAAS,EAAA;AAAA,IACnC,OAAOA,KACJ,CAAA,KAAA,CAAMA,KAAE,CAAA,MAAA,GAAS,MAAO,CAAA,CAAA,IAAA,KAAQ,MAAO,CAAA,IAAA,CAAK,KAAK,CAAE,CAAA,QAAA,CAAS,IAAI,CAAC,CAAC,EAClE,QAAS,EAAA;AAAA,IACZ,UAAY,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,GACjC,CAAA,CAAA;AAED,EAAI,IAAA,mBAAA,CAAA;AACJ,EAAA,IAAI,0BAA0B,WAAa,EAAA;AACzC,IAAsB,mBAAA,GAAA,WAAA,CAAA;AAAA,GACjB,MAAA;AACL,IAAO,MAAA,CAAA,IAAA;AAAA,MACL,oJAAA;AAAA,KACF,CAAA;AACA,IAAA,mBAAA,GAAsBC,6CAAsB,WAAW,CAAA,CAAA;AAAA,GACzD;AAEA,EAAA,MAAM,MAAS,GAAA,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,IACzD,IAAI,sBAAA;AAAA,IACF,WAAA;AAAA,IACA,KAAA;AAAA,IACA,mBAAA;AAAA,IACA,MAAA;AAAA,GAEF,GAAA,WAAA,CAAA;AAEJ,EAAA,MAAM,eAAkB,GAAA,CAAC,EAAE,OAAA,EAAA,GAAY,WAAkC,MAAA;AAAA,IACvE,GAAG,SAAA;AAAA,IACH,OAAA,EAAS,OAAQ,CAAA,MAAA,CAAO,CAAU,MAAA,KAAA;AAChC,MAAA,MAAM,WAAW,IAAI,GAAA,CAAI,OAAO,QAAS,CAAA,QAAA,EAAU,qBAAqB,CACrE,CAAA,QAAA,CAAA;AACH,MAAM,MAAA,SAAA,GAAY,wBAAyB,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAA;AAC5D,MAAA,IAAI,CAAC,SAAW,EAAA;AACd,QAAO,MAAA,CAAA,IAAA;AAAA,UACL,CAAA,4BAAA,EAA+B,MAAO,CAAA,QAAA,CAAS,KAAgC,CAAA,wBAAA,EAAA,QAAA,CAAA,WAAA,CAAA;AAAA,SACjF,CAAA;AAAA,OACF;AACA,MAAO,OAAA,SAAA,CAAA;AAAA,KACR,CAAA;AAAA,GACH,CAAA,CAAA;AAEA,EAAM,MAAA,eAAA,GAAkB,CAAC,SAAoD,MAAA;AAAA,IAC3E,GAAG,SAAA;AAAA,IACH,OAAS,EAAA,SAAA,CAAU,OAAQ,CAAA,GAAA,CAAI,CAAW,MAAA,MAAA;AAAA,MACxC,GAAG,MAAA;AAAA,MACH,QAAU,EAAA;AAAA,QACR,GAAG,MAAO,CAAA,QAAA;AAAA,QACV,aAAe,EAAA,KAAA,CAAA;AAAA,OACjB;AAAA,KACA,CAAA,CAAA;AAAA,GACJ,CAAA,CAAA;AAEA,EAAA,MAAM,SAASC,0BAAO,EAAA,CAAA;AACtB,EAAO,MAAA,CAAA,GAAA;AAAA,IACL,QAAA;AAAA,IACA,OACE,KACA,GACG,KAAA;AAtIT,MAAA,IAAA,EAAA,CAAA;AAuIM,MAAA,MAAM,WAAc,GAAA,aAAA,CAAc,SAAU,CAAA,GAAA,CAAI,KAAK,CAAA,CAAA;AAErD,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIT,iBAAA,CAAW,CAAyB,sBAAA,EAAA,WAAA,CAAY,KAAO,CAAA,CAAA,CAAA,CAAA;AAAA,OACnE;AAEA,MAAA,MAAM,QAAQ,WAAY,CAAA,IAAA,CAAA;AAE1B,MAAO,MAAA,CAAA,IAAA;AAAA,QACL,kCACE,KAAM,CAAA,IAAA,CAAA,WAAA,EACM,KAAK,SAAU,CAAA,KAAA,CAAM,OAAO,CACxC,CAAA,QAAA,EAAA,KAAA,CAAM,KAAQ,GAAA,KAAA,CAAM,MAAM,IAAK,CAAA,GAAG,IAAI,EACxB,CAAA,aAAA,EAAA,CAAA,EAAA,GAAA,KAAA,CAAM,eAAN,IAAoB,GAAA,EAAA,GAAA,EAAA,CAAA,CAAA;AAAA,OACtC,CAAA;AAEA,MAAA,MAAM,KAAQ,GAAAU,oDAAA;AAAA,QACZ,GAAA,CAAI,OAAO,eAAe,CAAA;AAAA,OAC5B,CAAA;AAEA,MAAI,IAAA;AACF,QAAA,MAAM,YAAY,OAAM,MAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,MAAA,CAAQ,KAAM,CAAA,KAAA,EAAO,EAAE,KAAM,EAAA,CAAA,CAAA,CAAA;AAErD,QAAA,GAAA,CAAI,IAAK,CAAA,eAAA,CAAgB,eAAgB,CAAA,SAAS,CAAC,CAAC,CAAA,CAAA;AAAA,eAC7C,KAAP,EAAA;AACA,QAAI,IAAA,KAAA,CAAM,SAAS,mBAAqB,EAAA;AAEtC,UAAM,MAAA,KAAA,CAAA;AAAA,SACR;AAEA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAoD,iDAAA,EAAA,KAAA,CAAA,CAAA;AAAA,SACtD,CAAA;AAAA,OACF;AAAA,KACF;AAAA,GACF,CAAA;AAEA,EAAO,MAAA,CAAA,GAAA,CAAIC,4BAAc,CAAA,CAAA;AAEzB,EAAO,OAAA,MAAA,CAAA;AACT;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/service/AuthorizedSearchEngine.ts","../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { compact, zipObject } from 'lodash';\nimport qs from 'qs';\nimport DataLoader from 'dataloader';\nimport {\n  EvaluatePermissionResponse,\n  EvaluatePermissionRequest,\n  AuthorizeResult,\n  isResourcePermission,\n  PermissionEvaluator,\n  AuthorizePermissionRequest,\n  QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResult,\n  IndexableResultSet,\n  QueryRequestOptions,\n  QueryTranslator,\n  SearchEngine,\n  SearchQuery,\n} from '@backstage/plugin-search-common';\nimport { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { Writable } from 'stream';\n\nexport function decodePageCursor(pageCursor?: string): { page: number } {\n  if (!pageCursor) {\n    return { page: 0 };\n  }\n\n  const page = Number(Buffer.from(pageCursor, 'base64').toString('utf-8'));\n  if (isNaN(page)) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  if (page < 0) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  return {\n    page,\n  };\n}\n\nexport function encodePageCursor({ page }: { page: number }): string {\n  return Buffer.from(`${page}`, 'utf-8').toString('base64');\n}\n\nexport class AuthorizedSearchEngine implements SearchEngine {\n  private readonly pageSize = 25;\n  private readonly queryLatencyBudgetMs: number;\n\n  constructor(\n    private readonly searchEngine: SearchEngine,\n    private readonly types: Record<string, DocumentTypeInfo>,\n    private readonly permissions: PermissionEvaluator,\n    config: Config,\n  ) {\n    this.queryLatencyBudgetMs =\n      config.getOptionalNumber('search.permissions.queryLatencyBudgetMs') ??\n      1000;\n  }\n\n  setTranslator(translator: QueryTranslator): void {\n    this.searchEngine.setTranslator(translator);\n  }\n\n  async getIndexer(type: string): Promise<Writable> {\n    return this.searchEngine.getIndexer(type);\n  }\n\n  async query(\n    query: SearchQuery,\n    options: QueryRequestOptions,\n  ): Promise<IndexableResultSet> {\n    const queryStartTime = Date.now();\n\n    const conditionFetcher = new DataLoader(\n      (requests: readonly QueryPermissionRequest[]) =>\n        this.permissions.authorizeConditional(requests.slice(), options),\n      {\n        cacheKeyFn: ({ permission: { name } }) => name,\n      },\n    );\n\n    const authorizer = new DataLoader(\n      (requests: readonly AuthorizePermissionRequest[]) =>\n        this.permissions.authorize(requests.slice(), options),\n      {\n        // Serialize the permission name and resourceRef as\n        // a query string to avoid collisions from overlapping\n        // permission names and resourceRefs.\n        cacheKeyFn: ({ permission: { name }, resourceRef }) =>\n          qs.stringify({ name, resourceRef }),\n      },\n    );\n\n    const requestedTypes = query.types || Object.keys(this.types);\n\n    const typeDecisions = zipObject(\n      requestedTypes,\n      await Promise.all(\n        requestedTypes.map(type => {\n          const permission = this.types[type]?.visibilityPermission;\n\n          // No permission configured for this document type - always allow.\n          if (!permission) {\n            return { result: AuthorizeResult.ALLOW as const };\n          }\n\n          // Resource permission supplied, so we need to check for conditional decisions.\n          if (isResourcePermission(permission)) {\n            return conditionFetcher.load({ permission });\n          }\n\n          // Non-resource permission supplied - we can perform a standard authorization.\n          return authorizer.load({ permission });\n        }),\n      ),\n    );\n\n    const authorizedTypes = requestedTypes.filter(\n      type => typeDecisions[type]?.result !== AuthorizeResult.DENY,\n    );\n\n    const resultByResultFilteringRequired = authorizedTypes.some(\n      type => typeDecisions[type]?.result === AuthorizeResult.CONDITIONAL,\n    );\n\n    // When there are no CONDITIONAL decisions for any of the requested\n    // result types, we can skip filtering result by result by simply\n    // skipping the types the user is not permitted to see, which will\n    // be much more efficient.\n    //\n    // Since it's not currently possible to configure the page size used\n    // by search engines, this detail means that a single user might see\n    // a different page size depending on whether their search required\n    // result-by-result filtering or not. We can fix this minor\n    // inconsistency by introducing a configurable page size.\n    //\n    // cf. https://github.com/backstage/backstage/issues/9162\n    if (!resultByResultFilteringRequired) {\n      return this.searchEngine.query(\n        { ...query, types: authorizedTypes },\n        options,\n      );\n    }\n\n    const { page } = decodePageCursor(query.pageCursor);\n    const targetResults = (page + 1) * this.pageSize;\n\n    let filteredResults: IndexableResult[] = [];\n    let nextPageCursor: string | undefined;\n    let latencyBudgetExhausted = false;\n\n    do {\n      const nextPage = await this.searchEngine.query(\n        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },\n        options,\n      );\n\n      filteredResults = filteredResults.concat(\n        await this.filterResults(nextPage.results, typeDecisions, authorizer),\n      );\n\n      nextPageCursor = nextPage.nextPageCursor;\n      latencyBudgetExhausted =\n        Date.now() - queryStartTime > this.queryLatencyBudgetMs;\n    } while (\n      nextPageCursor &&\n      filteredResults.length < targetResults &&\n      !latencyBudgetExhausted\n    );\n\n    return {\n      results: filteredResults\n        .slice(page * this.pageSize, (page + 1) * this.pageSize)\n        .map((result, index) => {\n          // Overwrite any/all rank entries to avoid leaking knowledge of filtered results.\n          return {\n            ...result,\n            rank: page * this.pageSize + index + 1,\n          };\n        }),\n      previousPageCursor:\n        page === 0 ? undefined : encodePageCursor({ page: page - 1 }),\n      nextPageCursor:\n        !latencyBudgetExhausted &&\n        (nextPageCursor || filteredResults.length > targetResults)\n          ? encodePageCursor({ page: page + 1 })\n          : undefined,\n    };\n  }\n\n  private async filterResults(\n    results: IndexableResult[],\n    typeDecisions: Record<string, EvaluatePermissionResponse>,\n    authorizer: DataLoader<\n      EvaluatePermissionRequest,\n      EvaluatePermissionResponse\n    >,\n  ) {\n    return compact(\n      await Promise.all(\n        results.map(result => {\n          if (typeDecisions[result.type]?.result === AuthorizeResult.ALLOW) {\n            return result;\n          }\n\n          const permission = this.types[result.type]?.visibilityPermission;\n          const resourceRef = result.document.authorization?.resourceRef;\n\n          if (!permission || !resourceRef) {\n            return result;\n          }\n\n          // We only reach this point in the code for types where the initial\n          // authorization returned CONDITIONAL -- ALLOWs return early\n          // immediately above, and types where the decision was DENY get\n          // filtered out entirely when querying.\n          //\n          // This means the call to isResourcePermission here is mostly about\n          // narrowing the type of permission - the only way to get here with a\n          // non-resource permission is if the PermissionPolicy returns a\n          // CONDITIONAL decision for a non-resource permission, which can't\n          // happen - it would throw an error during validation in the\n          // permission-backend.\n          if (!isResourcePermission(permission)) {\n            throw new Error(\n              `Unexpected conditional decision returned for non-resource permission \"${permission.name}\"`,\n            );\n          }\n\n          return authorizer\n            .load({ permission, resourceRef })\n            .then(decision =>\n              decision.result === AuthorizeResult.ALLOW ? result : undefined,\n            );\n        }),\n      ),\n    );\n  }\n}\n","/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { z } from 'zod';\nimport { errorHandler } from '@backstage/backend-common';\nimport { ErrorResponseBody, InputError } from '@backstage/errors';\nimport { Config } from '@backstage/config';\nimport { JsonObject, JsonValue } from '@backstage/types';\nimport { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';\nimport {\n  PermissionAuthorizer,\n  PermissionEvaluator,\n  toPermissionEvaluator,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResultSet,\n  SearchResultSet,\n} from '@backstage/plugin-search-common';\nimport { SearchEngine } from '@backstage/plugin-search-common';\nimport { AuthorizedSearchEngine } from './AuthorizedSearchEngine';\n\nconst jsonObjectSchema: z.ZodSchema<JsonObject> = z.lazy(() => {\n  const jsonValueSchema: z.ZodSchema<JsonValue> = z.lazy(() =>\n    z.union([\n      z.string(),\n      z.number(),\n      z.boolean(),\n      z.null(),\n      z.array(jsonValueSchema),\n      jsonObjectSchema,\n    ]),\n  );\n\n  return z.record(jsonValueSchema);\n});\n\n/**\n * @public\n */\nexport type RouterOptions = {\n  engine: SearchEngine;\n  types: Record<string, DocumentTypeInfo>;\n  permissions: PermissionEvaluator | PermissionAuthorizer;\n  config: Config;\n  logger: Logger;\n};\n\nconst maxPageLimit = 100;\nconst allowedLocationProtocols = ['http:', 'https:'];\n\n/**\n * @public\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine: inputEngine, types, permissions, config, logger } = options;\n\n  const requestSchema = z.object({\n    term: z.string().default(''),\n    filters: jsonObjectSchema.optional(),\n    types: z\n      .array(z.string().refine(type => Object.keys(types).includes(type)))\n      .optional(),\n    pageCursor: z.string().optional(),\n    pageLimit: z\n      .string()\n      .transform(pageLimit => parseInt(pageLimit, 10))\n      .refine(\n        pageLimit => !isNaN(pageLimit),\n        pageLimit => ({\n          message: `The page limit \"${pageLimit}\" is not a number`,\n        }),\n      )\n      .refine(\n        pageLimit => pageLimit <= maxPageLimit,\n        pageLimit => ({\n          message: `The page limit \"${pageLimit}\" is greater than \"${maxPageLimit}\"`,\n        }),\n      )\n      .optional(),\n  });\n\n  let permissionEvaluator: PermissionEvaluator;\n  if ('authorizeConditional' in permissions) {\n    permissionEvaluator = permissions as PermissionEvaluator;\n  } else {\n    logger.warn(\n      'PermissionAuthorizer is deprecated. Please use an instance of PermissionEvaluator instead of PermissionAuthorizer in PluginEnvironment#permissions',\n    );\n    permissionEvaluator = toPermissionEvaluator(permissions);\n  }\n\n  const engine = config.getOptionalBoolean('permission.enabled')\n    ? new AuthorizedSearchEngine(\n        inputEngine,\n        types,\n        permissionEvaluator,\n        config,\n      )\n    : inputEngine;\n\n  const filterResultSet = ({ results, ...resultSet }: SearchResultSet) => ({\n    ...resultSet,\n    results: results.filter(result => {\n      const protocol = new URL(result.document.location, 'https://example.com')\n        .protocol;\n      const isAllowed = allowedLocationProtocols.includes(protocol);\n      if (!isAllowed) {\n        logger.info(\n          `Rejected search result for \"${result.document.title}\" as location protocol \"${protocol}\" is unsafe`,\n        );\n      }\n      return isAllowed;\n    }),\n  });\n\n  const toSearchResults = (resultSet: IndexableResultSet): SearchResultSet => ({\n    ...resultSet,\n    results: resultSet.results.map(result => ({\n      ...result,\n      document: {\n        ...result.document,\n        authorization: undefined,\n      },\n    })),\n  });\n\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request,\n      res: express.Response<SearchResultSet | ErrorResponseBody>,\n    ) => {\n      const parseResult = requestSchema.passthrough().safeParse(req.query);\n\n      if (!parseResult.success) {\n        throw new InputError(`Invalid query string: ${parseResult.error}`);\n      }\n\n      const query = parseResult.data;\n\n      logger.info(\n        `Search request received: term=\"${\n          query.term\n        }\", filters=${JSON.stringify(query.filters)}, types=${\n          query.types ? query.types.join(',') : ''\n        }, pageCursor=${query.pageCursor ?? ''}`,\n      );\n\n      const token = getBearerTokenFromAuthorizationHeader(\n        req.header('authorization'),\n      );\n\n      try {\n        const resultSet = await engine?.query(query, { token });\n\n        res.send(filterResultSet(toSearchResults(resultSet)));\n      } catch (error) {\n        if (error.name === 'MissingIndexError') {\n          // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form\n          throw error;\n        }\n\n        throw new Error(\n          `There was a problem performing the search query. ${error}`,\n        );\n      }\n    },\n  );\n\n  router.use(errorHandler());\n\n  return router;\n}\n"],"names":["InputError","DataLoader","qs","zipObject","AuthorizeResult","isResourcePermission","compact","z","toPermissionEvaluator","Router","getBearerTokenFromAuthorizationHeader","errorHandler"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyCO,SAAS,iBAAiB,UAAuC,EAAA;AACtE,EAAA,IAAI,CAAC,UAAY,EAAA;AACf,IAAO,OAAA,EAAE,MAAM,CAAE,EAAA,CAAA;AAAA,GACnB;AAEA,EAAM,MAAA,IAAA,GAAO,OAAO,MAAO,CAAA,IAAA,CAAK,YAAY,QAAQ,CAAA,CAAE,QAAS,CAAA,OAAO,CAAC,CAAA,CAAA;AACvE,EAAI,IAAA,KAAA,CAAM,IAAI,CAAG,EAAA;AACf,IAAM,MAAA,IAAIA,kBAAW,qBAAqB,CAAA,CAAA;AAAA,GAC5C;AAEA,EAAA,IAAI,OAAO,CAAG,EAAA;AACZ,IAAM,MAAA,IAAIA,kBAAW,qBAAqB,CAAA,CAAA;AAAA,GAC5C;AAEA,EAAO,OAAA;AAAA,IACL,IAAA;AAAA,GACF,CAAA;AACF,CAAA;AAEgB,SAAA,gBAAA,CAAiB,EAAE,IAAA,EAAkC,EAAA;AACnE,EAAA,OAAO,OAAO,IAAK,CAAA,CAAA,EAAG,QAAQ,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA,CAAA;AAC1D,CAAA;AAEO,MAAM,sBAA+C,CAAA;AAAA,EAI1D,WACmB,CAAA,YAAA,EACA,KACA,EAAA,WAAA,EACjB,MACA,EAAA;AAJiB,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA,CAAA;AACA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA,CAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA,CAAA;AANnB,IAAA,IAAA,CAAiB,QAAW,GAAA,EAAA,CAAA;AAjE9B,IAAA,IAAA,EAAA,CAAA;AA0EI,IAAA,IAAA,CAAK,oBACH,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,iBAAkB,CAAA,yCAAyC,MAAlE,IACA,GAAA,EAAA,GAAA,GAAA,CAAA;AAAA,GACJ;AAAA,EAEA,cAAc,UAAmC,EAAA;AAC/C,IAAK,IAAA,CAAA,YAAA,CAAa,cAAc,UAAU,CAAA,CAAA;AAAA,GAC5C;AAAA,EAEA,MAAM,WAAW,IAAiC,EAAA;AAChD,IAAO,OAAA,IAAA,CAAK,YAAa,CAAA,UAAA,CAAW,IAAI,CAAA,CAAA;AAAA,GAC1C;AAAA,EAEA,MAAM,KACJ,CAAA,KAAA,EACA,OAC6B,EAAA;AAC7B,IAAM,MAAA,cAAA,GAAiB,KAAK,GAAI,EAAA,CAAA;AAEhC,IAAA,MAAM,mBAAmB,IAAIC,8BAAA;AAAA,MAC3B,CAAC,aACC,IAAK,CAAA,WAAA,CAAY,qBAAqB,QAAS,CAAA,KAAA,IAAS,OAAO,CAAA;AAAA,MACjE;AAAA,QACE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAA,IAAa,KAAA,IAAA;AAAA,OAC5C;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,aAAa,IAAIA,8BAAA;AAAA,MACrB,CAAC,aACC,IAAK,CAAA,WAAA,CAAY,UAAU,QAAS,CAAA,KAAA,IAAS,OAAO,CAAA;AAAA,MACtD;AAAA,QAIE,UAAY,EAAA,CAAC,EAAE,UAAA,EAAY,EAAE,IAAK,EAAA,EAAG,WAAY,EAAA,KAC/CC,sBAAG,CAAA,SAAA,CAAU,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,OACtC;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,iBAAiB,KAAM,CAAA,KAAA,IAAS,MAAO,CAAA,IAAA,CAAK,KAAK,KAAK,CAAA,CAAA;AAE5D,IAAA,MAAM,aAAgB,GAAAC,gBAAA;AAAA,MACpB,cAAA;AAAA,MACA,MAAM,OAAQ,CAAA,GAAA;AAAA,QACZ,cAAA,CAAe,IAAI,CAAQ,IAAA,KAAA;AAtHnC,UAAA,IAAA,EAAA,CAAA;AAuHU,UAAA,MAAM,UAAa,GAAA,CAAA,EAAA,GAAA,IAAA,CAAK,KAAM,CAAA,IAAA,CAAA,KAAX,IAAkB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,oBAAA,CAAA;AAGrC,UAAA,IAAI,CAAC,UAAY,EAAA;AACf,YAAO,OAAA,EAAE,MAAQ,EAAAC,sCAAA,CAAgB,KAAe,EAAA,CAAA;AAAA,WAClD;AAGA,UAAI,IAAAC,2CAAA,CAAqB,UAAU,CAAG,EAAA;AACpC,YAAA,OAAO,gBAAiB,CAAA,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA,CAAA;AAAA,WAC7C;AAGA,UAAA,OAAO,UAAW,CAAA,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA,CAAA;AAAA,SACtC,CAAA;AAAA,OACH;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,kBAAkB,cAAe,CAAA,MAAA;AAAA,MACrC,CAAK,IAAA,KAAA;AA1IX,QAAA,IAAA,EAAA,CAAA;AA0Ic,QAAc,OAAA,CAAA,CAAA,EAAA,GAAA,aAAA,CAAA,IAAA,CAAA,KAAd,IAAqB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,MAAA,MAAWD,sCAAgB,CAAA,IAAA,CAAA;AAAA,OAAA;AAAA,KAC1D,CAAA;AAEA,IAAA,MAAM,kCAAkC,eAAgB,CAAA,IAAA;AAAA,MACtD,CAAK,IAAA,KAAA;AA9IX,QAAA,IAAA,EAAA,CAAA;AA8Ic,QAAc,OAAA,CAAA,CAAA,EAAA,GAAA,aAAA,CAAA,IAAA,CAAA,KAAd,IAAqB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,MAAA,MAAWA,sCAAgB,CAAA,WAAA,CAAA;AAAA,OAAA;AAAA,KAC1D,CAAA;AAcA,IAAA,IAAI,CAAC,+BAAiC,EAAA;AACpC,MAAA,OAAO,KAAK,YAAa,CAAA,KAAA;AAAA,QACvB,EAAE,GAAG,KAAO,EAAA,KAAA,EAAO,eAAgB,EAAA;AAAA,QACnC,OAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,EAAE,IAAA,EAAS,GAAA,gBAAA,CAAiB,MAAM,UAAU,CAAA,CAAA;AAClD,IAAM,MAAA,aAAA,GAAA,CAAiB,IAAO,GAAA,CAAA,IAAK,IAAK,CAAA,QAAA,CAAA;AAExC,IAAA,IAAI,kBAAqC,EAAC,CAAA;AAC1C,IAAI,IAAA,cAAA,CAAA;AACJ,IAAA,IAAI,sBAAyB,GAAA,KAAA,CAAA;AAE7B,IAAG,GAAA;AACD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAa,CAAA,KAAA;AAAA,QACvC,EAAE,GAAG,KAAA,EAAO,KAAO,EAAA,eAAA,EAAiB,YAAY,cAAe,EAAA;AAAA,QAC/D,OAAA;AAAA,OACF,CAAA;AAEA,MAAA,eAAA,GAAkB,eAAgB,CAAA,MAAA;AAAA,QAChC,MAAM,IAAK,CAAA,aAAA,CAAc,QAAS,CAAA,OAAA,EAAS,eAAe,UAAU,CAAA;AAAA,OACtE,CAAA;AAEA,MAAA,cAAA,GAAiB,QAAS,CAAA,cAAA,CAAA;AAC1B,MAAA,sBAAA,GACE,IAAK,CAAA,GAAA,EAAQ,GAAA,cAAA,GAAiB,IAAK,CAAA,oBAAA,CAAA;AAAA,KAErC,QAAA,cAAA,IACA,eAAgB,CAAA,MAAA,GAAS,iBACzB,CAAC,sBAAA,EAAA;AAGH,IAAO,OAAA;AAAA,MACL,OAAS,EAAA,eAAA,CACN,KAAM,CAAA,IAAA,GAAO,KAAK,QAAW,EAAA,CAAA,IAAA,GAAO,CAAK,IAAA,IAAA,CAAK,QAAQ,CAAA,CACtD,GAAI,CAAA,CAAC,QAAQ,KAAU,KAAA;AAEtB,QAAO,OAAA;AAAA,UACL,GAAG,MAAA;AAAA,UACH,IAAM,EAAA,IAAA,GAAO,IAAK,CAAA,QAAA,GAAW,KAAQ,GAAA,CAAA;AAAA,SACvC,CAAA;AAAA,OACD,CAAA;AAAA,MACH,kBAAA,EACE,SAAS,CAAI,GAAA,KAAA,CAAA,GAAY,iBAAiB,EAAE,IAAA,EAAM,IAAO,GAAA,CAAA,EAAG,CAAA;AAAA,MAC9D,cACE,EAAA,CAAC,sBACA,KAAA,cAAA,IAAkB,eAAgB,CAAA,MAAA,GAAS,aACxC,CAAA,GAAA,gBAAA,CAAiB,EAAE,IAAA,EAAM,IAAO,GAAA,CAAA,EAAG,CACnC,GAAA,KAAA,CAAA;AAAA,KACR,CAAA;AAAA,GACF;AAAA,EAEA,MAAc,aAAA,CACZ,OACA,EAAA,aAAA,EACA,UAIA,EAAA;AACA,IAAO,OAAAE,cAAA;AAAA,MACL,MAAM,OAAQ,CAAA,GAAA;AAAA,QACZ,OAAA,CAAQ,IAAI,CAAU,MAAA,KAAA;AA5N9B,UAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,CAAA;AA6NU,UAAA,IAAA,CAAA,CAAI,mBAAc,MAAO,CAAA,IAAA,CAAA,KAArB,IAA4B,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,MAAA,MAAWF,uCAAgB,KAAO,EAAA;AAChE,YAAO,OAAA,MAAA,CAAA;AAAA,WACT;AAEA,UAAA,MAAM,UAAa,GAAA,CAAA,EAAA,GAAA,IAAA,CAAK,KAAM,CAAA,MAAA,CAAO,UAAlB,IAAyB,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,oBAAA,CAAA;AAC5C,UAAA,MAAM,WAAc,GAAA,CAAA,EAAA,GAAA,MAAA,CAAO,QAAS,CAAA,aAAA,KAAhB,IAA+B,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,WAAA,CAAA;AAEnD,UAAI,IAAA,CAAC,UAAc,IAAA,CAAC,WAAa,EAAA;AAC/B,YAAO,OAAA,MAAA,CAAA;AAAA,WACT;AAaA,UAAI,IAAA,CAACC,2CAAqB,CAAA,UAAU,CAAG,EAAA;AACrC,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,yEAAyE,UAAW,CAAA,IAAA,CAAA,CAAA,CAAA;AAAA,aACtF,CAAA;AAAA,WACF;AAEA,UAAA,OAAO,WACJ,IAAK,CAAA,EAAE,UAAY,EAAA,WAAA,EAAa,CAChC,CAAA,IAAA;AAAA,YAAK,CACJ,QAAA,KAAA,QAAA,CAAS,MAAW,KAAAD,sCAAA,CAAgB,QAAQ,MAAS,GAAA,KAAA,CAAA;AAAA,WACvD,CAAA;AAAA,SACH,CAAA;AAAA,OACH;AAAA,KACF,CAAA;AAAA,GACF;AACF;;AC5NA,MAAM,gBAAA,GAA4CG,KAAE,CAAA,IAAA,CAAK,MAAM;AAC7D,EAAA,MAAM,kBAA0CA,KAAE,CAAA,IAAA;AAAA,IAAK,MACrDA,MAAE,KAAM,CAAA;AAAA,MACNA,MAAE,MAAO,EAAA;AAAA,MACTA,MAAE,MAAO,EAAA;AAAA,MACTA,MAAE,OAAQ,EAAA;AAAA,MACVA,MAAE,IAAK,EAAA;AAAA,MACPA,KAAA,CAAE,MAAM,eAAe,CAAA;AAAA,MACvB,gBAAA;AAAA,KACD,CAAA;AAAA,GACH,CAAA;AAEA,EAAO,OAAAA,KAAA,CAAE,OAAO,eAAe,CAAA,CAAA;AACjC,CAAC,CAAA,CAAA;AAaD,MAAM,YAAe,GAAA,GAAA,CAAA;AACrB,MAAM,wBAAA,GAA2B,CAAC,OAAA,EAAS,QAAQ,CAAA,CAAA;AAKnD,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAA,MAAM,EAAE,MAAQ,EAAA,WAAA,EAAa,OAAO,WAAa,EAAA,MAAA,EAAQ,QAAW,GAAA,OAAA,CAAA;AAEpE,EAAM,MAAA,aAAA,GAAgBA,MAAE,MAAO,CAAA;AAAA,IAC7B,IAAM,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,IAC3B,OAAA,EAAS,iBAAiB,QAAS,EAAA;AAAA,IACnC,OAAOA,KACJ,CAAA,KAAA,CAAMA,KAAE,CAAA,MAAA,GAAS,MAAO,CAAA,CAAA,IAAA,KAAQ,MAAO,CAAA,IAAA,CAAK,KAAK,CAAE,CAAA,QAAA,CAAS,IAAI,CAAC,CAAC,EAClE,QAAS,EAAA;AAAA,IACZ,UAAY,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,IAChC,SAAA,EAAWA,KACR,CAAA,MAAA,EACA,CAAA,SAAA,CAAU,eAAa,QAAS,CAAA,SAAA,EAAW,EAAE,CAAC,CAC9C,CAAA,MAAA;AAAA,MACC,CAAA,SAAA,KAAa,CAAC,KAAA,CAAM,SAAS,CAAA;AAAA,MAC7B,CAAc,SAAA,MAAA;AAAA,QACZ,SAAS,CAAmB,gBAAA,EAAA,SAAA,CAAA,iBAAA,CAAA;AAAA,OAC9B,CAAA;AAAA,KAED,CAAA,MAAA;AAAA,MACC,eAAa,SAAa,IAAA,YAAA;AAAA,MAC1B,CAAc,SAAA,MAAA;AAAA,QACZ,OAAA,EAAS,mBAAmB,SAA+B,CAAA,mBAAA,EAAA,YAAA,CAAA,CAAA,CAAA;AAAA,OAC7D,CAAA;AAAA,MAED,QAAS,EAAA;AAAA,GACb,CAAA,CAAA;AAED,EAAI,IAAA,mBAAA,CAAA;AACJ,EAAA,IAAI,0BAA0B,WAAa,EAAA;AACzC,IAAsB,mBAAA,GAAA,WAAA,CAAA;AAAA,GACjB,MAAA;AACL,IAAO,MAAA,CAAA,IAAA;AAAA,MACL,oJAAA;AAAA,KACF,CAAA;AACA,IAAA,mBAAA,GAAsBC,6CAAsB,WAAW,CAAA,CAAA;AAAA,GACzD;AAEA,EAAA,MAAM,MAAS,GAAA,MAAA,CAAO,kBAAmB,CAAA,oBAAoB,IACzD,IAAI,sBAAA;AAAA,IACF,WAAA;AAAA,IACA,KAAA;AAAA,IACA,mBAAA;AAAA,IACA,MAAA;AAAA,GAEF,GAAA,WAAA,CAAA;AAEJ,EAAA,MAAM,eAAkB,GAAA,CAAC,EAAE,OAAA,EAAA,GAAY,WAAkC,MAAA;AAAA,IACvE,GAAG,SAAA;AAAA,IACH,OAAA,EAAS,OAAQ,CAAA,MAAA,CAAO,CAAU,MAAA,KAAA;AAChC,MAAA,MAAM,WAAW,IAAI,GAAA,CAAI,OAAO,QAAS,CAAA,QAAA,EAAU,qBAAqB,CACrE,CAAA,QAAA,CAAA;AACH,MAAM,MAAA,SAAA,GAAY,wBAAyB,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAA;AAC5D,MAAA,IAAI,CAAC,SAAW,EAAA;AACd,QAAO,MAAA,CAAA,IAAA;AAAA,UACL,CAAA,4BAAA,EAA+B,MAAO,CAAA,QAAA,CAAS,KAAgC,CAAA,wBAAA,EAAA,QAAA,CAAA,WAAA,CAAA;AAAA,SACjF,CAAA;AAAA,OACF;AACA,MAAO,OAAA,SAAA,CAAA;AAAA,KACR,CAAA;AAAA,GACH,CAAA,CAAA;AAEA,EAAM,MAAA,eAAA,GAAkB,CAAC,SAAoD,MAAA;AAAA,IAC3E,GAAG,SAAA;AAAA,IACH,OAAS,EAAA,SAAA,CAAU,OAAQ,CAAA,GAAA,CAAI,CAAW,MAAA,MAAA;AAAA,MACxC,GAAG,MAAA;AAAA,MACH,QAAU,EAAA;AAAA,QACR,GAAG,MAAO,CAAA,QAAA;AAAA,QACV,aAAe,EAAA,KAAA,CAAA;AAAA,OACjB;AAAA,KACA,CAAA,CAAA;AAAA,GACJ,CAAA,CAAA;AAEA,EAAA,MAAM,SAASC,0BAAO,EAAA,CAAA;AACtB,EAAO,MAAA,CAAA,GAAA;AAAA,IACL,QAAA;AAAA,IACA,OACE,KACA,GACG,KAAA;AAvJT,MAAA,IAAA,EAAA,CAAA;AAwJM,MAAA,MAAM,cAAc,aAAc,CAAA,WAAA,EAAc,CAAA,SAAA,CAAU,IAAI,KAAK,CAAA,CAAA;AAEnE,MAAI,IAAA,CAAC,YAAY,OAAS,EAAA;AACxB,QAAA,MAAM,IAAIT,iBAAA,CAAW,CAAyB,sBAAA,EAAA,WAAA,CAAY,KAAO,CAAA,CAAA,CAAA,CAAA;AAAA,OACnE;AAEA,MAAA,MAAM,QAAQ,WAAY,CAAA,IAAA,CAAA;AAE1B,MAAO,MAAA,CAAA,IAAA;AAAA,QACL,kCACE,KAAM,CAAA,IAAA,CAAA,WAAA,EACM,KAAK,SAAU,CAAA,KAAA,CAAM,OAAO,CACxC,CAAA,QAAA,EAAA,KAAA,CAAM,KAAQ,GAAA,KAAA,CAAM,MAAM,IAAK,CAAA,GAAG,IAAI,EACxB,CAAA,aAAA,EAAA,CAAA,EAAA,GAAA,KAAA,CAAM,eAAN,IAAoB,GAAA,EAAA,GAAA,EAAA,CAAA,CAAA;AAAA,OACtC,CAAA;AAEA,MAAA,MAAM,KAAQ,GAAAU,oDAAA;AAAA,QACZ,GAAA,CAAI,OAAO,eAAe,CAAA;AAAA,OAC5B,CAAA;AAEA,MAAI,IAAA;AACF,QAAA,MAAM,YAAY,OAAM,MAAA,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,MAAA,CAAQ,KAAM,CAAA,KAAA,EAAO,EAAE,KAAM,EAAA,CAAA,CAAA,CAAA;AAErD,QAAA,GAAA,CAAI,IAAK,CAAA,eAAA,CAAgB,eAAgB,CAAA,SAAS,CAAC,CAAC,CAAA,CAAA;AAAA,eAC7C,KAAP,EAAA;AACA,QAAI,IAAA,KAAA,CAAM,SAAS,mBAAqB,EAAA;AAEtC,UAAM,MAAA,KAAA,CAAA;AAAA,SACR;AAEA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAoD,iDAAA,EAAA,KAAA,CAAA,CAAA;AAAA,SACtD,CAAA;AAAA,OACF;AAAA,KACF;AAAA,GACF,CAAA;AAEA,EAAO,MAAA,CAAA,GAAA,CAAIC,4BAAc,CAAA,CAAA;AAEzB,EAAO,OAAA,MAAA,CAAA;AACT;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-search-backend",
   "description": "The Backstage backend plugin that provides your backstage app with search",
-  "version": "1.0.2",
+  "version": "1.1.0-next.1",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",
@@ -23,14 +23,14 @@
     "clean": "backstage-cli package clean"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.15.1",
-    "@backstage/config": "^1.0.2",
-    "@backstage/errors": "^1.1.1",
-    "@backstage/plugin-auth-node": "^0.2.5",
-    "@backstage/plugin-permission-common": "^0.6.4",
-    "@backstage/plugin-permission-node": "^0.6.5",
-    "@backstage/plugin-search-backend-node": "^1.0.2",
-    "@backstage/plugin-search-common": "^1.0.1",
+    "@backstage/backend-common": "^0.15.2-next.1",
+    "@backstage/config": "^1.0.3-next.1",
+    "@backstage/errors": "^1.1.2-next.1",
+    "@backstage/plugin-auth-node": "^0.2.6-next.1",
+    "@backstage/plugin-permission-common": "^0.6.5-next.1",
+    "@backstage/plugin-permission-node": "^0.6.6-next.1",
+    "@backstage/plugin-search-backend-node": "^1.0.3-next.1",
+    "@backstage/plugin-search-common": "^1.1.0-next.1",
     "@backstage/types": "^1.0.0",
     "@types/express": "^4.17.6",
     "dataloader": "^2.0.0",
@@ -43,12 +43,11 @@
     "zod": "^3.11.6"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.19.0",
+    "@backstage/cli": "^0.20.0-next.1",
     "@types/supertest": "^2.0.8",
     "supertest": "^6.1.3"
   },
   "files": [
     "dist"
-  ],
-  "gitHead": "25b94e63455f1fb170506f9e84e3f430f4b79406"
-}
+  ]
+}

package/LICENSE

@@ -1,201 +0,0 @@
-                              Apache License
-                        Version 2.0, January 2004
-                     http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-   "License" shall mean the terms and conditions for use, reproduction,
-   and distribution as defined by Sections 1 through 9 of this document.
-
-   "Licensor" shall mean the copyright owner or entity authorized by
-   the copyright owner that is granting the License.
-
-   "Legal Entity" shall mean the union of the acting entity and all
-   other entities that control, are controlled by, or are under common
-   control with that entity. For the purposes of this definition,
-   "control" means (i) the power, direct or indirect, to cause the
-   direction or management of such entity, whether by contract or
-   otherwise, or (ii) ownership of fifty percent (50%) or more of the
-   outstanding shares, or (iii) beneficial ownership of such entity.
-
-   "You" (or "Your") shall mean an individual or Legal Entity
-   exercising permissions granted by this License.
-
-   "Source" form shall mean the preferred form for making modifications,
-   including but not limited to software source code, documentation
-   source, and configuration files.
-
-   "Object" form shall mean any form resulting from mechanical
-   transformation or translation of a Source form, including but
-   not limited to compiled object code, generated documentation,
-   and conversions to other media types.
-
-   "Work" shall mean the work of authorship, whether in Source or
-   Object form, made available under the License, as indicated by a
-   copyright notice that is included in or attached to the work
-   (an example is provided in the Appendix below).
-
-   "Derivative Works" shall mean any work, whether in Source or Object
-   form, that is based on (or derived from) the Work and for which the
-   editorial revisions, annotations, elaborations, or other modifications
-   represent, as a whole, an original work of authorship. For the purposes
-   of this License, Derivative Works shall not include works that remain
-   separable from, or merely link (or bind by name) to the interfaces of,
-   the Work and Derivative Works thereof.
-
-   "Contribution" shall mean any work of authorship, including
-   the original version of the Work and any modifications or additions
-   to that Work or Derivative Works thereof, that is intentionally
-   submitted to Licensor for inclusion in the Work by the copyright owner
-   or by an individual or Legal Entity authorized to submit on behalf of
-   the copyright owner. For the purposes of this definition, "submitted"
-   means any form of electronic, verbal, or written communication sent
-   to the Licensor or its representatives, including but not limited to
-   communication on electronic mailing lists, source code control systems,
-   and issue tracking systems that are managed by, or on behalf of, the
-   Licensor for the purpose of discussing and improving the Work, but
-   excluding communication that is conspicuously marked or otherwise
-   designated in writing by the copyright owner as "Not a Contribution."
-
-   "Contributor" shall mean Licensor and any individual or Legal Entity
-   on behalf of whom a Contribution has been received by Licensor and
-   subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-   this License, each Contributor hereby grants to You a perpetual,
-   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-   copyright license to reproduce, prepare Derivative Works of,
-   publicly display, publicly perform, sublicense, and distribute the
-   Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-   this License, each Contributor hereby grants to You a perpetual,
-   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-   (except as stated in this section) patent license to make, have made,
-   use, offer to sell, sell, import, and otherwise transfer the Work,
-   where such license applies only to those patent claims licensable
-   by such Contributor that are necessarily infringed by their
-   Contribution(s) alone or by combination of their Contribution(s)
-   with the Work to which such Contribution(s) was submitted. If You
-   institute patent litigation against any entity (including a
-   cross-claim or counterclaim in a lawsuit) alleging that the Work
-   or a Contribution incorporated within the Work constitutes direct
-   or contributory patent infringement, then any patent licenses
-   granted to You under this License for that Work shall terminate
-   as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-   Work or Derivative Works thereof in any medium, with or without
-   modifications, and in Source or Object form, provided that You
-   meet the following conditions:
-
-   (a) You must give any other recipients of the Work or
-       Derivative Works a copy of this License; and
-
-   (b) You must cause any modified files to carry prominent notices
-       stating that You changed the files; and
-
-   (c) You must retain, in the Source form of any Derivative Works
-       that You distribute, all copyright, patent, trademark, and
-       attribution notices from the Source form of the Work,
-       excluding those notices that do not pertain to any part of
-       the Derivative Works; and
-
-   (d) If the Work includes a "NOTICE" text file as part of its
-       distribution, then any Derivative Works that You distribute must
-       include a readable copy of the attribution notices contained
-       within such NOTICE file, excluding those notices that do not
-       pertain to any part of the Derivative Works, in at least one
-       of the following places: within a NOTICE text file distributed
-       as part of the Derivative Works; within the Source form or
-       documentation, if provided along with the Derivative Works; or,
-       within a display generated by the Derivative Works, if and
-       wherever such third-party notices normally appear. The contents
-       of the NOTICE file are for informational purposes only and
-       do not modify the License. You may add Your own attribution
-       notices within Derivative Works that You distribute, alongside
-       or as an addendum to the NOTICE text from the Work, provided
-       that such additional attribution notices cannot be construed
-       as modifying the License.
-
-   You may add Your own copyright statement to Your modifications and
-   may provide additional or different license terms and conditions
-   for use, reproduction, or distribution of Your modifications, or
-   for any such Derivative Works as a whole, provided Your use,
-   reproduction, and distribution of the Work otherwise complies with
-   the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-   any Contribution intentionally submitted for inclusion in the Work
-   by You to the Licensor shall be under the terms and conditions of
-   this License, without any additional terms or conditions.
-   Notwithstanding the above, nothing herein shall supersede or modify
-   the terms of any separate license agreement you may have executed
-   with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-   names, trademarks, service marks, or product names of the Licensor,
-   except as required for reasonable and customary use in describing the
-   origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-   agreed to in writing, Licensor provides the Work (and each
-   Contributor provides its Contributions) on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-   implied, including, without limitation, any warranties or conditions
-   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-   PARTICULAR PURPOSE. You are solely responsible for determining the
-   appropriateness of using or redistributing the Work and assume any
-   risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-   whether in tort (including negligence), contract, or otherwise,
-   unless required by applicable law (such as deliberate and grossly
-   negligent acts) or agreed to in writing, shall any Contributor be
-   liable to You for damages, including any direct, indirect, special,
-   incidental, or consequential damages of any character arising as a
-   result of this License or out of the use or inability to use the
-   Work (including but not limited to damages for loss of goodwill,
-   work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses), even if such Contributor
-   has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-   the Work or Derivative Works thereof, You may choose to offer,
-   and charge a fee for, acceptance of support, warranty, indemnity,
-   or other liability obligations and/or rights consistent with this
-   License. However, in accepting such obligations, You may act only
-   on Your own behalf and on Your sole responsibility, not on behalf
-   of any other Contributor, and only if You agree to indemnify,
-   defend, and hold each Contributor harmless for any liability
-   incurred by, or claims asserted against, such Contributor by reason
-   of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-   To apply the Apache License to your work, attach the following
-   boilerplate notice, with the fields enclosed by brackets "[]"
-   replaced with your own identifying information. (Don't include
-   the brackets!)  The text should be enclosed in the appropriate
-   comment syntax for the file format. We also recommend that a
-   file or class name and description of purpose be included on the
-   same "printed page" as the copyright notice for easier
-   identification within third-party archives.
-
-Copyright 2020 The Backstage Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.