@cloudbase/manager-node 5.5.4 → 5.5.5

package/lib/permission/index.js

@@ -18,7 +18,11 @@ class PermissionService {
     constructor(environment) {
         this.environment = environment;
         this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
+        this.lowcodeService = new utils_1.CloudService(environment.cloudBaseContext, 'lowcode', '2021-01-08');
     }
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 modifyEnvAuthzConfig 替代
+     */
     async modifyResourcePermission(options) {
         const { EnvId } = this.environment.lazyEnvironmentConfig;
         const { resourceType, resource, permission, securityRule } = options;
@@ -51,6 +55,9 @@ class PermissionService {
         }
         return this.tcbService.request('ModifyResourcePermission', reqData);
     }
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 describeResourcePolicyList 或 describeEnvAuthzConfig 替代
+     */
     async describeResourcePermission(options) {
         const { EnvId } = this.environment.lazyEnvironmentConfig;
         const { resourceType, resources } = options;
@@ -288,6 +295,104 @@ class PermissionService {
             RoleIds: roleIds
         });
     }
+    /**
+     * 拉取环境下的所有用户自定义的网关鉴权策略列表
+     * 注意：PG 环境无需调用，直接按照无存量策略处理；
+     * 若环境 meta 中 authz_engine 值为 opa，则网关策略不生效，无需调用
+     */
+    async describeResourcePolicyList(options = {}) {
+        const { resourceType } = options;
+        if (resourceType !== undefined && (typeof resourceType !== 'string' || resourceType.trim().length === 0)) {
+            throw new Error('Invalid resourceType');
+        }
+        // PG 环境无需调用，直接返回空策略列表
+        if (await this.isPostgresqlEnv()) {
+            const emptyData = { PolicyList: [], Total: '0' };
+            return {
+                Data: emptyData,
+                RequestId: ''
+            };
+        }
+        // authz_engine 为 opa 时网关策略不生效，无需调用，直接返回空策略列表
+        if (await this.isOpaAuthzEngine()) {
+            const emptyData = { PolicyList: [], Total: '0' };
+            return {
+                Data: emptyData,
+                RequestId: ''
+            };
+        }
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const reqData = {
+            EnvId,
+            ResourceType: resourceType || 'policy'
+        };
+        return this.lowcodeService.request('DescribeResourcePolicyList', reqData);
+    }
+    /**
+     * 拉取环境下的鉴权策略配置
+     * key: authz.platform.extension.rego - 单独为该环境配置的策略
+     * key: authz.user.rego - 用户配置的策略
+     */
+    async describeEnvAuthzConfig(options) {
+        const { key } = options;
+        if (!key || (key !== 'authz.platform.extension.rego' && key !== 'authz.user.rego')) {
+            throw new Error('key must be "authz.platform.extension.rego" or "authz.user.rego"');
+        }
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        return this.tcbService.request('DescribeEnvConfig', {
+            EnvId,
+            Key: key
+        });
+    }
+    /**
+     * 保存用户编写的 rego 策略，保存后旧网关鉴权将直接失效
+     */
+    async modifyEnvAuthzConfig(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { key, value } = options;
+        if (key !== 'authz.user.rego') {
+            throw new Error('key must be "authz.user.rego"');
+        }
+        if (typeof value !== 'string' || value.trim().length === 0) {
+            throw new Error('value is required and must be a non-empty string');
+        }
+        return this.tcbService.request('ModifyEnvConfig', {
+            EnvId,
+            Key: key,
+            Value: value
+        });
+    }
+    /**
+     * 获取完整的环境基础信息（含 PostgreSQL、Meta 等字段）
+     */
+    async getEnvBaseInfo() {
+        var _a;
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const params = { EnvId };
+        const res = await this.environment.getEnvService().describeEnvInfo(params);
+        return ((_a = res === null || res === void 0 ? void 0 : res.EnvInfo) === null || _a === void 0 ? void 0 : _a.EnvBaseInfo) || {};
+    }
+    /**
+     * 判断当前环境是否为 PostgreSQL 环境
+     * PostgreSQL 是数组且长度 > 0 时为 PG 环境
+     */
+    async isPostgresqlEnv() {
+        const envBaseInfo = await this.getEnvBaseInfo();
+        return Array.isArray(envBaseInfo.PostgreSQL) && envBaseInfo.PostgreSQL.length > 0;
+    }
+    /**
+     * 判断当前环境的 authz_engine 是否为 opa
+     * 从环境 Meta 中查找 Key 为 authz_engine 的标签，Value 为 opa 表示已切到 OPA
+     */
+    async isOpaAuthzEngine() {
+        const envBaseInfo = await this.getEnvBaseInfo();
+        const meta = envBaseInfo === null || envBaseInfo === void 0 ? void 0 : envBaseInfo.Meta;
+        if (!Array.isArray(meta)) {
+            return false;
+        }
+        const authzEngineTag = meta.find(tag => tag.Key === 'authz_engine');
+        return (authzEngineTag === null || authzEngineTag === void 0 ? void 0 : authzEngineTag.Value) === 'opa';
+    }
 }
 exports.PermissionService = PermissionService;
 __decorate([
@@ -308,3 +413,12 @@ __decorate([
 __decorate([
     (0, utils_1.preLazy)()
 ], PermissionService.prototype, "deleteRoles", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeResourcePolicyList", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeEnvAuthzConfig", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "modifyEnvAuthzConfig", null);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cloudbase/manager-node",
-    "version": "5.5.4",
+    "version": "5.5.5",
     "description": "The node manage service api for cloudbase.",
     "main": "lib/index.js",
     "scripts": {

package/types/interfaces/tcb.interface.d.ts

@@ -484,6 +484,10 @@ export interface EnvBaseInfo {
         Key: string;
         Value: string;
     }>;
+    Meta?: Array<{
+        Key: string;
+        Value: string;
+    }>;
     CreateTime?: string;
     UpdateTime?: string;
     EnvPreferences?: Record<string, any>;

package/types/permission/index.d.ts

@@ -1,13 +1,20 @@
 import { Environment } from '../environment';
-import { ModifyResourcePermissionOptions, ModifyResourcePermissionResp, DescribeResourcePermissionOptions, DescribeResourcePermissionResp, CreateRoleOptions, CreateRoleResp, DescribeRoleListOptions, DescribeRoleListResp, ModifyRoleOptions, ModifyRoleResp, DeleteRolesOptions, DeleteRolesResp } from './types';
+import { ModifyResourcePermissionOptions, ModifyResourcePermissionResp, DescribeResourcePermissionOptions, DescribeResourcePermissionResp, CreateRoleOptions, CreateRoleResp, DescribeRoleListOptions, DescribeRoleListResp, ModifyRoleOptions, ModifyRoleResp, DeleteRolesOptions, DeleteRolesResp, DescribeResourcePolicyListOptions, DescribeResourcePolicyListResp, DescribeEnvAuthzConfigOptions, DescribeEnvAuthzConfigResp, ModifyEnvAuthzConfigOptions } from './types';
 export declare class PermissionService {
     private environment;
     private tcbService;
+    private lowcodeService;
     constructor(environment: Environment);
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 modifyEnvAuthzConfig 替代
+     */
     modifyResourcePermission(options: ModifyResourcePermissionOptions): Promise<{
         Data: ModifyResourcePermissionResp;
         RequestId: string;
     }>;
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 describeResourcePolicyList 或 describeEnvAuthzConfig 替代
+     */
     describeResourcePermission(options: DescribeResourcePermissionOptions): Promise<{
         Data: DescribeResourcePermissionResp;
         RequestId: string;
@@ -28,4 +35,43 @@ export declare class PermissionService {
         Data: DeleteRolesResp;
         RequestId: string;
     }>;
+    /**
+     * 拉取环境下的所有用户自定义的网关鉴权策略列表
+     * 注意：PG 环境无需调用，直接按照无存量策略处理；
+     * 若环境 meta 中 authz_engine 值为 opa，则网关策略不生效，无需调用
+     */
+    describeResourcePolicyList(options?: DescribeResourcePolicyListOptions): Promise<{
+        Data: DescribeResourcePolicyListResp;
+        RequestId: string;
+    }>;
+    /**
+     * 拉取环境下的鉴权策略配置
+     * key: authz.platform.extension.rego - 单独为该环境配置的策略
+     * key: authz.user.rego - 用户配置的策略
+     */
+    describeEnvAuthzConfig(options: DescribeEnvAuthzConfigOptions): Promise<{
+        Item: DescribeEnvAuthzConfigResp;
+        RequestId: string;
+    }>;
+    /**
+     * 保存用户编写的 rego 策略，保存后旧网关鉴权将直接失效
+     */
+    modifyEnvAuthzConfig(options: ModifyEnvAuthzConfigOptions): Promise<{
+        AffectedRows: number;
+        RequestId: string;
+    }>;
+    /**
+     * 获取完整的环境基础信息（含 PostgreSQL、Meta 等字段）
+     */
+    private getEnvBaseInfo;
+    /**
+     * 判断当前环境是否为 PostgreSQL 环境
+     * PostgreSQL 是数组且长度 > 0 时为 PG 环境
+     */
+    private isPostgresqlEnv;
+    /**
+     * 判断当前环境的 authz_engine 是否为 opa
+     * 从环境 Meta 中查找 Key 为 authz_engine 的标签，Value 为 opa 表示已切到 OPA
+     */
+    private isOpaAuthzEngine;
 }

package/types/permission/types.d.ts

@@ -125,3 +125,37 @@ export interface DeleteRolesResp {
     SuccessCount?: number;
     FailedCount?: number;
 }
+export interface ResourcePolicyItem {
+    Effect?: string;
+    IsAccess?: boolean;
+    PolicyId?: string;
+    ResourceId?: string;
+    ResourceName?: string;
+    ResourceTitle?: string;
+    ResourceType?: string;
+    RoleId?: string;
+    RoleIdentity?: string;
+    RoleName?: string;
+    SafeRule?: string;
+}
+export interface DescribeResourcePolicyListOptions {
+    resourceType?: string;
+}
+export interface DescribeResourcePolicyListResp {
+    PolicyList: ResourcePolicyItem[];
+    Total: string;
+}
+export interface DescribeEnvAuthzConfigOptions {
+    key: 'authz.platform.extension.rego' | 'authz.user.rego';
+}
+export interface DescribeEnvAuthzConfigResp {
+    Key: string;
+    Value: string;
+}
+export interface ModifyEnvAuthzConfigOptions {
+    key: 'authz.user.rego';
+    value: string;
+}
+export interface ModifyEnvAuthzConfigResp {
+    AffectedRows: number;
+}