@backstage/plugin-search-backend 2.0.8-next.0 → 2.0.8-next.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @backstage/plugin-search-backend
 
+## 2.0.8-next.1
+
+### Patch Changes
+
+- b2bef92: Convert all enums to erasable-syntax compliant patterns
+- Updated dependencies
+  - @backstage/backend-defaults@0.13.1-next.1
+  - @backstage/backend-plugin-api@1.5.0-next.1
+  - @backstage/plugin-permission-common@0.9.3-next.1
+  - @backstage/backend-openapi-utils@0.6.3-next.1
+  - @backstage/plugin-permission-node@0.10.6-next.1
+  - @backstage/plugin-search-backend-node@1.3.17-next.1
+
 ## 2.0.8-next.0
 
 ### Patch Changes

package/dist/service/AuthorizedSearchEngine.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizedSearchEngine.cjs.js","sources":["../../src/service/AuthorizedSearchEngine.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { compact, zipObject } from 'lodash';\nimport qs from 'qs';\nimport DataLoader from 'dataloader';\nimport {\n  AuthorizePermissionRequest,\n  AuthorizeResult,\n  EvaluatePermissionRequest,\n  EvaluatePermissionResponse,\n  isResourcePermission,\n  QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResult,\n  IndexableResultSet,\n  SearchQuery,\n} from '@backstage/plugin-search-common';\nimport {\n  QueryRequestOptions,\n  QueryTranslator,\n  SearchEngine,\n} from '@backstage/plugin-search-backend-node';\nimport { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { Writable } from 'stream';\nimport { AuthService, PermissionsService } from '@backstage/backend-plugin-api';\n\nexport function decodePageCursor(pageCursor?: string): { page: number } {\n  if (!pageCursor) {\n    return { page: 0 };\n  }\n\n  const page = Number(Buffer.from(pageCursor, 'base64').toString('utf-8'));\n  if (isNaN(page)) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  if (page < 0) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  return {\n    page,\n  };\n}\n\nexport function encodePageCursor({ page }: { page: number }): string {\n  return Buffer.from(`${page}`, 'utf-8').toString('base64');\n}\n\nexport class AuthorizedSearchEngine implements SearchEngine {\n  private readonly queryLatencyBudgetMs: number;\n  private readonly searchEngine: SearchEngine;\n  private readonly types: Record<string, DocumentTypeInfo>;\n  private readonly permissions: PermissionsService;\n  private readonly auth: AuthService;\n\n  constructor(\n    searchEngine: SearchEngine,\n    types: Record<string, DocumentTypeInfo>,\n    permissions: PermissionsService,\n    auth: AuthService,\n    config: Config,\n  ) {\n    this.searchEngine = searchEngine;\n    this.types = types;\n    this.permissions = permissions;\n    this.auth = auth;\n    this.queryLatencyBudgetMs =\n      config.getOptionalNumber('search.permissions.queryLatencyBudgetMs') ??\n      1000;\n  }\n\n  setTranslator(translator: QueryTranslator): void {\n    this.searchEngine.setTranslator(translator);\n  }\n\n  async getIndexer(type: string): Promise<Writable> {\n    return this.searchEngine.getIndexer(type);\n  }\n\n  async query(\n    query: SearchQuery,\n    options: QueryRequestOptions,\n  ): Promise<IndexableResultSet> {\n    const queryStartTime = Date.now();\n\n    const compatOptions =\n      'credentials' in options\n        ? options\n        : { credentials: await this.auth.getNoneCredentials() };\n\n    const conditionFetcher = new DataLoader(\n      (requests: readonly QueryPermissionRequest[]) =>\n        this.permissions.authorizeConditional(requests.slice(), compatOptions),\n      {\n        cacheKeyFn: ({ permission: { name } }) => name,\n      },\n    );\n\n    const authorizer = new DataLoader(\n      (requests: readonly AuthorizePermissionRequest[]) =>\n        this.permissions.authorize(requests.slice(), compatOptions),\n      {\n        // Serialize the permission name and resourceRef as\n        // a query string to avoid collisions from overlapping\n        // permission names and resourceRefs.\n        cacheKeyFn: ({ permission: { name }, resourceRef }) =>\n          qs.stringify({ name, resourceRef }),\n      },\n    );\n\n    const requestedTypes = query.types || Object.keys(this.types);\n\n    const typeDecisions = zipObject(\n      requestedTypes,\n      await Promise.all(\n        requestedTypes.map(type => {\n          const permission = this.types[type]?.visibilityPermission;\n\n          // No permission configured for this document type - always allow.\n          if (!permission) {\n            return { result: AuthorizeResult.ALLOW as const };\n          }\n\n          // Resource permission supplied, so we need to check for conditional decisions.\n          if (isResourcePermission(permission)) {\n            return conditionFetcher.load({ permission });\n          }\n\n          // Non-resource permission supplied - we can perform a standard authorization.\n          return authorizer.load({ permission });\n        }),\n      ),\n    );\n\n    const authorizedTypes = requestedTypes.filter(\n      type => typeDecisions[type]?.result !== AuthorizeResult.DENY,\n    );\n\n    const resultByResultFilteringRequired = authorizedTypes.some(\n      type => typeDecisions[type]?.result === AuthorizeResult.CONDITIONAL,\n    );\n\n    // When there are no CONDITIONAL decisions for any of the requested\n    // result types, we can skip filtering result by result by simply\n    // skipping the types the user is not permitted to see, which will\n    // be much more efficient.\n    //\n    // Since it's not currently possible to configure the page size used\n    // by search engines, this detail means that a single user might see\n    // a different page size depending on whether their search required\n    // result-by-result filtering or not. We can fix this minor\n    // inconsistency by introducing a configurable page size.\n    //\n    // cf. https://github.com/backstage/backstage/issues/9162\n    if (!resultByResultFilteringRequired) {\n      return this.searchEngine.query(\n        { ...query, types: authorizedTypes },\n        compatOptions,\n      );\n    }\n\n    const pageSize = query.pageLimit || 25;\n    const { page } = decodePageCursor(query.pageCursor);\n    const targetResults = (page + 1) * pageSize;\n\n    let filteredResults: IndexableResult[] = [];\n    let nextPageCursor: string | undefined;\n    let latencyBudgetExhausted = false;\n\n    do {\n      const nextPage = await this.searchEngine.query(\n        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },\n        compatOptions,\n      );\n\n      filteredResults = filteredResults.concat(\n        await this.filterResults(nextPage.results, typeDecisions, authorizer),\n      );\n\n      nextPageCursor = nextPage.nextPageCursor;\n      latencyBudgetExhausted =\n        Date.now() - queryStartTime > this.queryLatencyBudgetMs;\n    } while (\n      nextPageCursor &&\n      filteredResults.length < targetResults &&\n      !latencyBudgetExhausted\n    );\n\n    return {\n      results: filteredResults\n        .slice(page * pageSize, (page + 1) * pageSize)\n        .map((result, index) => {\n          // Overwrite any/all rank entries to avoid leaking knowledge of filtered results.\n          return {\n            ...result,\n            rank: page * pageSize + index + 1,\n          };\n        }),\n      previousPageCursor:\n        page === 0 ? undefined : encodePageCursor({ page: page - 1 }),\n      nextPageCursor:\n        !latencyBudgetExhausted &&\n        (nextPageCursor || filteredResults.length > targetResults)\n          ? encodePageCursor({ page: page + 1 })\n          : undefined,\n      numberOfResults: undefined,\n    };\n  }\n\n  private async filterResults(\n    results: IndexableResult[],\n    typeDecisions: Record<string, EvaluatePermissionResponse>,\n    authorizer: DataLoader<\n      EvaluatePermissionRequest,\n      EvaluatePermissionResponse\n    >,\n  ) {\n    return compact(\n      await Promise.all(\n        results.map(result => {\n          if (typeDecisions[result.type]?.result === AuthorizeResult.ALLOW) {\n            return result;\n          }\n\n          const permission = this.types[result.type]?.visibilityPermission;\n          const resourceRef = result.document.authorization?.resourceRef;\n\n          if (!permission || !resourceRef) {\n            return result;\n          }\n\n          // We only reach this point in the code for types where the initial\n          // authorization returned CONDITIONAL -- ALLOWs return early\n          // immediately above, and types where the decision was DENY get\n          // filtered out entirely when querying.\n          //\n          // This means the call to isResourcePermission here is mostly about\n          // narrowing the type of permission - the only way to get here with a\n          // non-resource permission is if the PermissionPolicy returns a\n          // CONDITIONAL decision for a non-resource permission, which can't\n          // happen - it would throw an error during validation in the\n          // permission-backend.\n          if (!isResourcePermission(permission)) {\n            throw new Error(\n              `Unexpected conditional decision returned for non-resource permission \"${permission.name}\"`,\n            );\n          }\n\n          return authorizer\n            .load({ permission, resourceRef })\n            .then(decision =>\n              decision.result === AuthorizeResult.ALLOW ? result : undefined,\n            );\n        }),\n      ),\n    );\n  }\n}\n"],"names":["InputError","DataLoader","qs","zipObject","AuthorizeResult","isResourcePermission","compact"],"mappings":";;;;;;;;;;;;;AA2CO,SAAS,iBAAiB,UAAA,EAAuC;AACtE,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAE,MAAM,CAAA,EAAE;AAAA,EACnB;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,IAAA,CAAK,YAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AACvE,EAAA,IAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AACf,IAAA,MAAM,IAAIA,kBAAW,qBAAqB,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAI,OAAO,CAAA,EAAG;AACZ,IAAA,MAAM,IAAIA,kBAAW,qBAAqB,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF;AAEO,SAAS,gBAAA,CAAiB,EAAE,IAAA,EAAK,EAA6B;AACnE,EAAA,OAAO,MAAA,CAAO,KAAK,CAAA,EAAG,IAAI,IAAI,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1D;AAEO,MAAM,sBAAA,CAA+C;AAAA,EACzC,oBAAA;AAAA,EACA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EAEjB,WAAA,CACE,YAAA,EACA,KAAA,EACA,WAAA,EACA,MACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,oBAAA,GACH,MAAA,CAAO,iBAAA,CAAkB,yCAAyC,CAAA,IAClE,GAAA;AAAA,EACJ;AAAA,EAEA,cAAc,UAAA,EAAmC;AAC/C,IAAA,IAAA,CAAK,YAAA,CAAa,cAAc,UAAU,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,IAAA,EAAiC;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW,IAAI,CAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,KAAA,CACJ,KAAA,EACA,OAAA,EAC6B;AAC7B,IAAA,MAAM,cAAA,GAAiB,KAAK,GAAA,EAAI;AAEhC,IAAA,MAAM,aAAA,GACJ,aAAA,IAAiB,OAAA,GACb,OAAA,GACA,EAAE,aAAa,MAAM,IAAA,CAAK,IAAA,CAAK,kBAAA,EAAmB,EAAE;AAE1D,IAAA,MAAM,mBAAmB,IAAIC,2BAAA;AAAA,MAC3B,CAAC,aACC,IAAA,CAAK,WAAA,CAAY,qBAAqB,QAAA,CAAS,KAAA,IAAS,aAAa,CAAA;AAAA,MACvE;AAAA,QACE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAA,IAAO,KAAM;AAAA;AAC5C,KACF;AAEA,IAAA,MAAM,aAAa,IAAIA,2BAAA;AAAA,MACrB,CAAC,aACC,IAAA,CAAK,WAAA,CAAY,UAAU,QAAA,CAAS,KAAA,IAAS,aAAa,CAAA;AAAA,MAC5D;AAAA;AAAA;AAAA;AAAA,QAIE,UAAA,EAAY,CAAC,EAAE,UAAA,EAAY,EAAE,IAAA,EAAK,EAAG,WAAA,EAAY,KAC/CC,mBAAA,CAAG,SAAA,CAAU,EAAE,IAAA,EAAM,aAAa;AAAA;AACtC,KACF;AAEA,IAAA,MAAM,iBAAiB,KAAA,CAAM,KAAA,IAAS,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAE5D,IAAA,MAAM,aAAA,GAAgBC,gBAAA;AAAA,MACpB,cAAA;AAAA,MACA,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,cAAA,CAAe,IAAI,CAAA,IAAA,KAAQ;AACzB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG,oBAAA;AAGrC,UAAA,IAAI,CAAC,UAAA,EAAY;AACf,YAAA,OAAO,EAAE,MAAA,EAAQC,sCAAA,CAAgB,KAAA,EAAe;AAAA,UAClD;AAGA,UAAA,IAAIC,2CAAA,CAAqB,UAAU,CAAA,EAAG;AACpC,YAAA,OAAO,gBAAA,CAAiB,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA;AAAA,UAC7C;AAGA,UAAA,OAAO,UAAA,CAAW,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA;AAAA,QACvC,CAAC;AAAA;AACH,KACF;AAEA,IAAA,MAAM,kBAAkB,cAAA,CAAe,MAAA;AAAA,MACrC,CAAA,IAAA,KAAQ,aAAA,CAAc,IAAI,CAAA,EAAG,WAAWD,sCAAA,CAAgB;AAAA,KAC1D;AAEA,IAAA,MAAM,kCAAkC,eAAA,CAAgB,IAAA;AAAA,MACtD,CAAA,IAAA,KAAQ,aAAA,CAAc,IAAI,CAAA,EAAG,WAAWA,sCAAA,CAAgB;AAAA,KAC1D;AAcA,IAAA,IAAI,CAAC,+BAAA,EAAiC;AACpC,MAAA,OAAO,KAAK,YAAA,CAAa,KAAA;AAAA,QACvB,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,QACnC;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,IAAa,EAAA;AACpC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,gBAAA,CAAiB,MAAM,UAAU,CAAA;AAClD,IAAA,MAAM,aAAA,GAAA,CAAiB,OAAO,CAAA,IAAK,QAAA;AAEnC,IAAA,IAAI,kBAAqC,EAAC;AAC1C,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI,sBAAA,GAAyB,KAAA;AAE7B,IAAA,GAAG;AACD,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,KAAA;AAAA,QACvC,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,YAAY,cAAA,EAAe;AAAA,QAC/D;AAAA,OACF;AAEA,MAAA,eAAA,GAAkB,eAAA,CAAgB,MAAA;AAAA,QAChC,MAAM,IAAA,CAAK,aAAA,CAAc,QAAA,CAAS,OAAA,EAAS,eAAe,UAAU;AAAA,OACtE;AAEA,MAAA,cAAA,GAAiB,QAAA,CAAS,cAAA;AAC1B,MAAA,sBAAA,GACE,IAAA,CAAK,GAAA,EAAI,GAAI,cAAA,GAAiB,IAAA,CAAK,oBAAA;AAAA,IACvC,CAAA,QACE,cAAA,IACA,eAAA,CAAgB,MAAA,GAAS,iBACzB,CAAC,sBAAA;AAGH,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,eAAA,CACN,KAAA,CAAM,IAAA,GAAO,QAAA,EAAA,CAAW,IAAA,GAAO,CAAA,IAAK,QAAQ,CAAA,CAC5C,GAAA,CAAI,CAAC,MAAA,EAAQ,KAAA,KAAU;AAEtB,QAAA,OAAO;AAAA,UACL,GAAG,MAAA;AAAA,UACH,IAAA,EAAM,IAAA,GAAO,QAAA,GAAW,KAAA,GAAQ;AAAA,SAClC;AAAA,MACF,CAAC,CAAA;AAAA,MACH,kBAAA,EACE,SAAS,CAAA,GAAI,MAAA,GAAY,iBAAiB,EAAE,IAAA,EAAM,IAAA,GAAO,CAAA,EAAG,CAAA;AAAA,MAC9D,cAAA,EACE,CAAC,sBAAA,KACA,cAAA,IAAkB,eAAA,CAAgB,MAAA,GAAS,aAAA,CAAA,GACxC,gBAAA,CAAiB,EAAE,IAAA,EAAM,IAAA,GAAO,CAAA,EAAG,CAAA,GACnC,MAAA;AAAA,MACN,eAAA,EAAiB;AAAA,KACnB;AAAA,EACF;AAAA,EAEA,MAAc,aAAA,CACZ,OAAA,EACA,aAAA,EACA,UAAA,EAIA;AACA,IAAA,OAAOE,cAAA;AAAA,MACL,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,OAAA,CAAQ,IAAI,CAAA,MAAA,KAAU;AACpB,UAAA,IAAI,cAAc,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,KAAWF,uCAAgB,KAAA,EAAO;AAChE,YAAA,OAAO,MAAA;AAAA,UACT;AAEA,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA,EAAG,oBAAA;AAC5C,UAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe,WAAA;AAEnD,UAAA,IAAI,CAAC,UAAA,IAAc,CAAC,WAAA,EAAa;AAC/B,YAAA,OAAO,MAAA;AAAA,UACT;AAaA,UAAA,IAAI,CAACC,2CAAA,CAAqB,UAAU,CAAA,EAAG;AACrC,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,CAAA,sEAAA,EAAyE,WAAW,IAAI,CAAA,CAAA;AAAA,aAC1F;AAAA,UACF;AAEA,UAAA,OAAO,WACJ,IAAA,CAAK,EAAE,UAAA,EAAY,WAAA,EAAa,CAAA,CAChC,IAAA;AAAA,YAAK,CAAA,QAAA,KACJ,QAAA,CAAS,MAAA,KAAWD,sCAAA,CAAgB,QAAQ,MAAA,GAAS;AAAA,WACvD;AAAA,QACJ,CAAC;AAAA;AACH,KACF;AAAA,EACF;AACF;;;;;;"}
+{"version":3,"file":"AuthorizedSearchEngine.cjs.js","sources":["../../src/service/AuthorizedSearchEngine.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { compact, zipObject } from 'lodash';\nimport qs from 'qs';\nimport DataLoader from 'dataloader';\nimport {\n  AuthorizePermissionRequest,\n  AuthorizeResult,\n  EvaluatePermissionRequest,\n  EvaluatePermissionResponse,\n  isResourcePermission,\n  QueryPermissionRequest,\n} from '@backstage/plugin-permission-common';\nimport {\n  DocumentTypeInfo,\n  IndexableResult,\n  IndexableResultSet,\n  SearchQuery,\n} from '@backstage/plugin-search-common';\nimport {\n  QueryRequestOptions,\n  QueryTranslator,\n  SearchEngine,\n} from '@backstage/plugin-search-backend-node';\nimport { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { Writable } from 'stream';\nimport { AuthService, PermissionsService } from '@backstage/backend-plugin-api';\n\nexport function decodePageCursor(pageCursor?: string): { page: number } {\n  if (!pageCursor) {\n    return { page: 0 };\n  }\n\n  const page = Number(Buffer.from(pageCursor, 'base64').toString('utf-8'));\n  if (isNaN(page)) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  if (page < 0) {\n    throw new InputError('Invalid page cursor');\n  }\n\n  return {\n    page,\n  };\n}\n\nexport function encodePageCursor({ page }: { page: number }): string {\n  return Buffer.from(`${page}`, 'utf-8').toString('base64');\n}\n\nexport class AuthorizedSearchEngine implements SearchEngine {\n  private readonly queryLatencyBudgetMs: number;\n  private readonly searchEngine: SearchEngine;\n  private readonly types: Record<string, DocumentTypeInfo>;\n  private readonly permissions: PermissionsService;\n  private readonly auth: AuthService;\n\n  constructor(\n    searchEngine: SearchEngine,\n    types: Record<string, DocumentTypeInfo>,\n    permissions: PermissionsService,\n    auth: AuthService,\n    config: Config,\n  ) {\n    this.searchEngine = searchEngine;\n    this.types = types;\n    this.permissions = permissions;\n    this.auth = auth;\n    this.queryLatencyBudgetMs =\n      config.getOptionalNumber('search.permissions.queryLatencyBudgetMs') ??\n      1000;\n  }\n\n  setTranslator(translator: QueryTranslator): void {\n    this.searchEngine.setTranslator(translator);\n  }\n\n  async getIndexer(type: string): Promise<Writable> {\n    return this.searchEngine.getIndexer(type);\n  }\n\n  async query(\n    query: SearchQuery,\n    options: QueryRequestOptions,\n  ): Promise<IndexableResultSet> {\n    const queryStartTime = Date.now();\n\n    const compatOptions =\n      'credentials' in options\n        ? options\n        : { credentials: await this.auth.getNoneCredentials() };\n\n    const conditionFetcher = new DataLoader(\n      (requests: readonly QueryPermissionRequest[]) =>\n        this.permissions.authorizeConditional(requests.slice(), compatOptions),\n      {\n        cacheKeyFn: ({ permission: { name } }) => name,\n      },\n    );\n\n    const authorizer = new DataLoader(\n      (requests: readonly AuthorizePermissionRequest[]) =>\n        this.permissions.authorize(requests.slice(), compatOptions),\n      {\n        // Serialize the permission name and resourceRef as\n        // a query string to avoid collisions from overlapping\n        // permission names and resourceRefs.\n        cacheKeyFn: ({ permission: { name }, resourceRef }) =>\n          qs.stringify({ name, resourceRef }),\n      },\n    );\n\n    const requestedTypes = query.types || Object.keys(this.types);\n\n    const typeDecisions = zipObject(\n      requestedTypes,\n      await Promise.all(\n        requestedTypes.map(type => {\n          const permission = this.types[type]?.visibilityPermission;\n\n          // No permission configured for this document type - always allow.\n          if (!permission) {\n            return { result: AuthorizeResult.ALLOW };\n          }\n\n          // Resource permission supplied, so we need to check for conditional decisions.\n          if (isResourcePermission(permission)) {\n            return conditionFetcher.load({ permission });\n          }\n\n          // Non-resource permission supplied - we can perform a standard authorization.\n          return authorizer.load({ permission });\n        }),\n      ),\n    );\n\n    const authorizedTypes = requestedTypes.filter(\n      type => typeDecisions[type]?.result !== AuthorizeResult.DENY,\n    );\n\n    const resultByResultFilteringRequired = authorizedTypes.some(\n      type => typeDecisions[type]?.result === AuthorizeResult.CONDITIONAL,\n    );\n\n    // When there are no CONDITIONAL decisions for any of the requested\n    // result types, we can skip filtering result by result by simply\n    // skipping the types the user is not permitted to see, which will\n    // be much more efficient.\n    //\n    // Since it's not currently possible to configure the page size used\n    // by search engines, this detail means that a single user might see\n    // a different page size depending on whether their search required\n    // result-by-result filtering or not. We can fix this minor\n    // inconsistency by introducing a configurable page size.\n    //\n    // cf. https://github.com/backstage/backstage/issues/9162\n    if (!resultByResultFilteringRequired) {\n      return this.searchEngine.query(\n        { ...query, types: authorizedTypes },\n        compatOptions,\n      );\n    }\n\n    const pageSize = query.pageLimit || 25;\n    const { page } = decodePageCursor(query.pageCursor);\n    const targetResults = (page + 1) * pageSize;\n\n    let filteredResults: IndexableResult[] = [];\n    let nextPageCursor: string | undefined;\n    let latencyBudgetExhausted = false;\n\n    do {\n      const nextPage = await this.searchEngine.query(\n        { ...query, types: authorizedTypes, pageCursor: nextPageCursor },\n        compatOptions,\n      );\n\n      filteredResults = filteredResults.concat(\n        await this.filterResults(nextPage.results, typeDecisions, authorizer),\n      );\n\n      nextPageCursor = nextPage.nextPageCursor;\n      latencyBudgetExhausted =\n        Date.now() - queryStartTime > this.queryLatencyBudgetMs;\n    } while (\n      nextPageCursor &&\n      filteredResults.length < targetResults &&\n      !latencyBudgetExhausted\n    );\n\n    return {\n      results: filteredResults\n        .slice(page * pageSize, (page + 1) * pageSize)\n        .map((result, index) => {\n          // Overwrite any/all rank entries to avoid leaking knowledge of filtered results.\n          return {\n            ...result,\n            rank: page * pageSize + index + 1,\n          };\n        }),\n      previousPageCursor:\n        page === 0 ? undefined : encodePageCursor({ page: page - 1 }),\n      nextPageCursor:\n        !latencyBudgetExhausted &&\n        (nextPageCursor || filteredResults.length > targetResults)\n          ? encodePageCursor({ page: page + 1 })\n          : undefined,\n      numberOfResults: undefined,\n    };\n  }\n\n  private async filterResults(\n    results: IndexableResult[],\n    typeDecisions: Record<string, EvaluatePermissionResponse>,\n    authorizer: DataLoader<\n      EvaluatePermissionRequest,\n      EvaluatePermissionResponse\n    >,\n  ) {\n    return compact(\n      await Promise.all(\n        results.map(result => {\n          if (typeDecisions[result.type]?.result === AuthorizeResult.ALLOW) {\n            return result;\n          }\n\n          const permission = this.types[result.type]?.visibilityPermission;\n          const resourceRef = result.document.authorization?.resourceRef;\n\n          if (!permission || !resourceRef) {\n            return result;\n          }\n\n          // We only reach this point in the code for types where the initial\n          // authorization returned CONDITIONAL -- ALLOWs return early\n          // immediately above, and types where the decision was DENY get\n          // filtered out entirely when querying.\n          //\n          // This means the call to isResourcePermission here is mostly about\n          // narrowing the type of permission - the only way to get here with a\n          // non-resource permission is if the PermissionPolicy returns a\n          // CONDITIONAL decision for a non-resource permission, which can't\n          // happen - it would throw an error during validation in the\n          // permission-backend.\n          if (!isResourcePermission(permission)) {\n            throw new Error(\n              `Unexpected conditional decision returned for non-resource permission \"${permission.name}\"`,\n            );\n          }\n\n          return authorizer\n            .load({ permission, resourceRef })\n            .then(decision =>\n              decision.result === AuthorizeResult.ALLOW ? result : undefined,\n            );\n        }),\n      ),\n    );\n  }\n}\n"],"names":["InputError","DataLoader","qs","zipObject","AuthorizeResult","isResourcePermission","compact"],"mappings":";;;;;;;;;;;;;AA2CO,SAAS,iBAAiB,UAAA,EAAuC;AACtE,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,EAAE,MAAM,CAAA,EAAE;AAAA,EACnB;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,IAAA,CAAK,YAAY,QAAQ,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,CAAA;AACvE,EAAA,IAAI,KAAA,CAAM,IAAI,CAAA,EAAG;AACf,IAAA,MAAM,IAAIA,kBAAW,qBAAqB,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAI,OAAO,CAAA,EAAG;AACZ,IAAA,MAAM,IAAIA,kBAAW,qBAAqB,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF;AAEO,SAAS,gBAAA,CAAiB,EAAE,IAAA,EAAK,EAA6B;AACnE,EAAA,OAAO,MAAA,CAAO,KAAK,CAAA,EAAG,IAAI,IAAI,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1D;AAEO,MAAM,sBAAA,CAA+C;AAAA,EACzC,oBAAA;AAAA,EACA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EAEjB,WAAA,CACE,YAAA,EACA,KAAA,EACA,WAAA,EACA,MACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,oBAAA,GACH,MAAA,CAAO,iBAAA,CAAkB,yCAAyC,CAAA,IAClE,GAAA;AAAA,EACJ;AAAA,EAEA,cAAc,UAAA,EAAmC;AAC/C,IAAA,IAAA,CAAK,YAAA,CAAa,cAAc,UAAU,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,IAAA,EAAiC;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW,IAAI,CAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,KAAA,CACJ,KAAA,EACA,OAAA,EAC6B;AAC7B,IAAA,MAAM,cAAA,GAAiB,KAAK,GAAA,EAAI;AAEhC,IAAA,MAAM,aAAA,GACJ,aAAA,IAAiB,OAAA,GACb,OAAA,GACA,EAAE,aAAa,MAAM,IAAA,CAAK,IAAA,CAAK,kBAAA,EAAmB,EAAE;AAE1D,IAAA,MAAM,mBAAmB,IAAIC,2BAAA;AAAA,MAC3B,CAAC,aACC,IAAA,CAAK,WAAA,CAAY,qBAAqB,QAAA,CAAS,KAAA,IAAS,aAAa,CAAA;AAAA,MACvE;AAAA,QACE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAA,IAAO,KAAM;AAAA;AAC5C,KACF;AAEA,IAAA,MAAM,aAAa,IAAIA,2BAAA;AAAA,MACrB,CAAC,aACC,IAAA,CAAK,WAAA,CAAY,UAAU,QAAA,CAAS,KAAA,IAAS,aAAa,CAAA;AAAA,MAC5D;AAAA;AAAA;AAAA;AAAA,QAIE,UAAA,EAAY,CAAC,EAAE,UAAA,EAAY,EAAE,IAAA,EAAK,EAAG,WAAA,EAAY,KAC/CC,mBAAA,CAAG,SAAA,CAAU,EAAE,IAAA,EAAM,aAAa;AAAA;AACtC,KACF;AAEA,IAAA,MAAM,iBAAiB,KAAA,CAAM,KAAA,IAAS,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAE5D,IAAA,MAAM,aAAA,GAAgBC,gBAAA;AAAA,MACpB,cAAA;AAAA,MACA,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,cAAA,CAAe,IAAI,CAAA,IAAA,KAAQ;AACzB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG,oBAAA;AAGrC,UAAA,IAAI,CAAC,UAAA,EAAY;AACf,YAAA,OAAO,EAAE,MAAA,EAAQC,sCAAA,CAAgB,KAAA,EAAM;AAAA,UACzC;AAGA,UAAA,IAAIC,2CAAA,CAAqB,UAAU,CAAA,EAAG;AACpC,YAAA,OAAO,gBAAA,CAAiB,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA;AAAA,UAC7C;AAGA,UAAA,OAAO,UAAA,CAAW,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA;AAAA,QACvC,CAAC;AAAA;AACH,KACF;AAEA,IAAA,MAAM,kBAAkB,cAAA,CAAe,MAAA;AAAA,MACrC,CAAA,IAAA,KAAQ,aAAA,CAAc,IAAI,CAAA,EAAG,WAAWD,sCAAA,CAAgB;AAAA,KAC1D;AAEA,IAAA,MAAM,kCAAkC,eAAA,CAAgB,IAAA;AAAA,MACtD,CAAA,IAAA,KAAQ,aAAA,CAAc,IAAI,CAAA,EAAG,WAAWA,sCAAA,CAAgB;AAAA,KAC1D;AAcA,IAAA,IAAI,CAAC,+BAAA,EAAiC;AACpC,MAAA,OAAO,KAAK,YAAA,CAAa,KAAA;AAAA,QACvB,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,QACnC;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,IAAa,EAAA;AACpC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,gBAAA,CAAiB,MAAM,UAAU,CAAA;AAClD,IAAA,MAAM,aAAA,GAAA,CAAiB,OAAO,CAAA,IAAK,QAAA;AAEnC,IAAA,IAAI,kBAAqC,EAAC;AAC1C,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI,sBAAA,GAAyB,KAAA;AAE7B,IAAA,GAAG;AACD,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,KAAA;AAAA,QACvC,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,YAAY,cAAA,EAAe;AAAA,QAC/D;AAAA,OACF;AAEA,MAAA,eAAA,GAAkB,eAAA,CAAgB,MAAA;AAAA,QAChC,MAAM,IAAA,CAAK,aAAA,CAAc,QAAA,CAAS,OAAA,EAAS,eAAe,UAAU;AAAA,OACtE;AAEA,MAAA,cAAA,GAAiB,QAAA,CAAS,cAAA;AAC1B,MAAA,sBAAA,GACE,IAAA,CAAK,GAAA,EAAI,GAAI,cAAA,GAAiB,IAAA,CAAK,oBAAA;AAAA,IACvC,CAAA,QACE,cAAA,IACA,eAAA,CAAgB,MAAA,GAAS,iBACzB,CAAC,sBAAA;AAGH,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,eAAA,CACN,KAAA,CAAM,IAAA,GAAO,QAAA,EAAA,CAAW,IAAA,GAAO,CAAA,IAAK,QAAQ,CAAA,CAC5C,GAAA,CAAI,CAAC,MAAA,EAAQ,KAAA,KAAU;AAEtB,QAAA,OAAO;AAAA,UACL,GAAG,MAAA;AAAA,UACH,IAAA,EAAM,IAAA,GAAO,QAAA,GAAW,KAAA,GAAQ;AAAA,SAClC;AAAA,MACF,CAAC,CAAA;AAAA,MACH,kBAAA,EACE,SAAS,CAAA,GAAI,MAAA,GAAY,iBAAiB,EAAE,IAAA,EAAM,IAAA,GAAO,CAAA,EAAG,CAAA;AAAA,MAC9D,cAAA,EACE,CAAC,sBAAA,KACA,cAAA,IAAkB,eAAA,CAAgB,MAAA,GAAS,aAAA,CAAA,GACxC,gBAAA,CAAiB,EAAE,IAAA,EAAM,IAAA,GAAO,CAAA,EAAG,CAAA,GACnC,MAAA;AAAA,MACN,eAAA,EAAiB;AAAA,KACnB;AAAA,EACF;AAAA,EAEA,MAAc,aAAA,CACZ,OAAA,EACA,aAAA,EACA,UAAA,EAIA;AACA,IAAA,OAAOE,cAAA;AAAA,MACL,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,OAAA,CAAQ,IAAI,CAAA,MAAA,KAAU;AACpB,UAAA,IAAI,cAAc,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,KAAWF,uCAAgB,KAAA,EAAO;AAChE,YAAA,OAAO,MAAA;AAAA,UACT;AAEA,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA,EAAG,oBAAA;AAC5C,UAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe,WAAA;AAEnD,UAAA,IAAI,CAAC,UAAA,IAAc,CAAC,WAAA,EAAa;AAC/B,YAAA,OAAO,MAAA;AAAA,UACT;AAaA,UAAA,IAAI,CAACC,2CAAA,CAAqB,UAAU,CAAA,EAAG;AACrC,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,CAAA,sEAAA,EAAyE,WAAW,IAAI,CAAA,CAAA;AAAA,aAC1F;AAAA,UACF;AAEA,UAAA,OAAO,WACJ,IAAA,CAAK,EAAE,UAAA,EAAY,WAAA,EAAa,CAAA,CAChC,IAAA;AAAA,YAAK,CAAA,QAAA,KACJ,QAAA,CAAS,MAAA,KAAWD,sCAAA,CAAgB,QAAQ,MAAA,GAAS;AAAA,WACvD;AAAA,QACJ,CAAC;AAAA;AACH,KACF;AAAA,EACF;AACF;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-search-backend",
-  "version": "2.0.8-next.0",
+  "version": "2.0.8-next.1",
   "description": "The Backstage backend plugin that provides your backstage app with search",
   "backstage": {
     "role": "backend-plugin",
@@ -70,14 +70,14 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-defaults": "0.13.1-next.0",
-    "@backstage/backend-openapi-utils": "0.6.3-next.0",
-    "@backstage/backend-plugin-api": "1.4.5-next.0",
+    "@backstage/backend-defaults": "0.13.1-next.1",
+    "@backstage/backend-openapi-utils": "0.6.3-next.1",
+    "@backstage/backend-plugin-api": "1.5.0-next.1",
     "@backstage/config": "1.3.6-next.0",
     "@backstage/errors": "1.2.7",
-    "@backstage/plugin-permission-common": "0.9.3-next.0",
-    "@backstage/plugin-permission-node": "0.10.6-next.0",
-    "@backstage/plugin-search-backend-node": "1.3.17-next.0",
+    "@backstage/plugin-permission-common": "0.9.3-next.1",
+    "@backstage/plugin-permission-node": "0.10.6-next.1",
+    "@backstage/plugin-search-backend-node": "1.3.17-next.1",
     "@backstage/plugin-search-common": "1.2.21-next.0",
     "@backstage/types": "1.2.2",
     "dataloader": "^2.0.0",
@@ -88,9 +88,9 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "1.10.0-next.0",
-    "@backstage/cli": "0.34.5-next.0",
-    "@backstage/repo-tools": "0.15.4-next.0",
+    "@backstage/backend-test-utils": "1.10.0-next.1",
+    "@backstage/cli": "0.34.5-next.1",
+    "@backstage/repo-tools": "0.15.4-next.1",
     "@types/express": "^4.17.6",
     "@types/supertest": "^2.0.8",
     "supertest": "^7.0.0"