@kuadrant/kuadrant-backstage-plugin-backend 0.0.2-dev-0b744dd → 0.2.0

package/dist/router.cjs.js

@@ -9,7 +9,7 @@ var Router = require('express-promise-router');
 var cors = require('cors');
 var crypto = require('crypto');
 var k8sClient = require('./k8s-client.cjs.js');
-var alpha = require('./alpha.cjs.js');
+var module$1 = require('./module.cjs.js');
 var permissions = require('./permissions.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
@@ -36,6 +36,38 @@ async function getUserIdentity(req, httpAuth, userInfo) {
     groups
   };
 }
+async function verifyApiKeyUpdatePermission(credentials, userEntityRef, namespace, apiProductName, k8sClient, permissions$1) {
+  const updateAllDecision = await permissions$1.authorize(
+    [{ permission: permissions.kuadrantApiKeyUpdateAllPermission }],
+    { credentials }
+  );
+  if (updateAllDecision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW) {
+    return;
+  }
+  const updateOwnDecision = await permissions$1.authorize(
+    [{ permission: permissions.kuadrantApiKeyUpdateOwnPermission }],
+    { credentials }
+  );
+  if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+    throw new errors.NotAllowedError("unauthorised");
+  }
+  let apiProduct;
+  try {
+    apiProduct = await k8sClient.getCustomResource(
+      "devportal.kuadrant.io",
+      "v1alpha1",
+      namespace,
+      "apiproducts",
+      apiProductName
+    );
+  } catch (error) {
+    throw new errors.InputError(`APIProduct '${apiProductName}' not found in namespace '${namespace}' - cannot verify ownership`);
+  }
+  const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
+  if (owner !== userEntityRef) {
+    throw new errors.NotAllowedError("you can only update requests for your own api products");
+  }
+}
 async function createRouter({
   httpAuth,
   userInfo,
@@ -155,7 +187,7 @@ async function createRouter({
         "apiproducts",
         apiProduct
       );
-      const provider = alpha.getAPIProductEntityProvider();
+      const provider = module$1.getAPIProductEntityProvider();
       if (provider) {
         await provider.refresh();
       }
@@ -239,7 +271,7 @@ async function createRouter({
         "apiproducts",
         name
       );
-      const provider = alpha.getAPIProductEntityProvider();
+      const provider = module$1.getAPIProductEntityProvider();
       if (provider) {
         await provider.refresh();
       }
@@ -257,7 +289,7 @@ async function createRouter({
     try {
       const credentials = await httpAuth.credentials(req);
       const decision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiProductListPermission }],
+        [{ permission: permissions.kuadrantHttpRouteListPermission }],
         { credentials }
       );
       if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
@@ -274,8 +306,37 @@ async function createRouter({
       }
     }
   });
+  router.get("/httproutes/:namespace/:name", async (req, res) => {
+    try {
+      const credentials = await httpAuth.credentials(req);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantHttpRouteListPermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
+      }
+      const { namespace, name } = req.params;
+      const data = await k8sClient$1.getCustomResource("gateway.networking.k8s.io", "v1", namespace, "httproutes", name);
+      res.json(data);
+    } catch (error) {
+      console.error("error fetching httproute:", error);
+      if (error instanceof errors.NotAllowedError) {
+        res.status(403).json({ error: error.message });
+      } else {
+        res.status(500).json({ error: "failed to fetch httproute" });
+      }
+    }
+  });
   router.patch("/apiproducts/:namespace/:name", async (req, res) => {
     const patchSchema = zod.z.object({
+      metadata: zod.z.object({
+        labels: zod.z.object({
+          // allow updating lifecycle phase via edit apiproduct dialog
+          // synced to backstage catalog entity's lifecycle field
+          lifecycle: zod.z.enum(["experimental", "production", "deprecated", "retired"]).optional()
+        }).partial().optional()
+      }).partial().optional(),
       spec: zod.z.object({
         displayName: zod.z.string().optional(),
         description: zod.z.string().optional(),
@@ -290,7 +351,7 @@ async function createRouter({
         }).partial().optional(),
         documentation: zod.z.object({
           docsURL: zod.z.string().optional(),
-          openAPISpec: zod.z.string().optional()
+          openAPISpecURL: zod.z.string().optional()
         }).partial().optional()
       }).partial()
     });
@@ -326,6 +387,18 @@ async function createRouter({
       if (req.body.metadata?.annotations) {
         delete req.body.metadata.annotations["backstage.io/owner"];
       }
+      if (parsed.data.spec?.publishStatus === "Published" && parsed.data.metadata?.labels?.lifecycle === "retired") {
+        throw new errors.InputError("cannot publish a retired API product");
+      }
+      if (parsed.data.metadata?.labels?.lifecycle === "retired") {
+        const existing = await k8sClient$1.getCustomResource("devportal.kuadrant.io", "v1alpha1", namespace, "apiproducts", name);
+        if (existing.spec?.publishStatus === "Published") {
+          if (!parsed.data.spec) {
+            parsed.data.spec = {};
+          }
+          parsed.data.spec.publishStatus = "Draft";
+        }
+      }
       const updated = await k8sClient$1.patchCustomResource(
         "devportal.kuadrant.io",
         "v1alpha1",
@@ -334,7 +407,7 @@ async function createRouter({
         name,
         parsed.data
       );
-      const provider = alpha.getAPIProductEntityProvider();
+      const provider = module$1.getAPIProductEntityProvider();
       if (provider) {
         await provider.refresh();
       }
@@ -368,18 +441,20 @@ async function createRouter({
             name: policy.metadata.name,
             namespace: policy.metadata.namespace
           },
-          // only expose targetRef to allow UI to match PlanPolicy -> HTTPRoute
-          targetRef: policy.spec?.targetRef ? {
-            kind: policy.spec.targetRef.kind,
-            name: policy.spec.targetRef.name,
-            namespace: policy.spec.targetRef.namespace
-          } : void 0,
-          // only expose plan tier info, no other spec details
-          plans: (policy.spec?.plans || []).map((plan) => ({
-            tier: plan.tier,
-            description: plan.description,
-            limits: plan.limits
-          }))
+          spec: policy.spec ? {
+            // expose targetRef to allow UI to match PlanPolicy -> HTTPRoute
+            targetRef: policy.spec.targetRef ? {
+              kind: policy.spec.targetRef.kind,
+              name: policy.spec.targetRef.name,
+              namespace: policy.spec.targetRef.namespace
+            } : void 0,
+            plans: (policy.spec.plans || []).map((plan) => ({
+              tier: plan.tier,
+              description: plan.description,
+              limits: plan.limits
+            }))
+          } : {},
+          status: policy.status
         }))
       };
       res.json(filtered);
@@ -479,7 +554,8 @@ async function createRouter({
       if (error instanceof errors.NotAllowedError) {
         res.status(403).json({ error: error.message });
       } else {
-        res.status(500).json({ error: "failed to create api key request" });
+        const errorMessage = error instanceof Error ? error.message : "failed to create api key request";
+        res.status(500).json({ error: errorMessage });
       }
     }
   });
@@ -592,30 +668,14 @@ async function createRouter({
       if (!apiProductName) {
         throw new errors.InputError("apiProductRef.name is required in APIKey spec");
       }
-      const apiProduct = await k8sClient$1.getCustomResource(
-        "devportal.kuadrant.io",
-        "v1alpha1",
+      await verifyApiKeyUpdatePermission(
+        credentials,
+        userEntityRef,
         namespace,
-        "apiproducts",
-        apiProductName
-      );
-      const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
-      const updateAllDecision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyUpdateAllPermission }],
-        { credentials }
+        apiProductName,
+        k8sClient$1,
+        permissions$1
       );
-      if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        const updateOwnDecision = await permissions$1.authorize(
-          [{ permission: permissions.kuadrantApiKeyUpdateOwnPermission }],
-          { credentials }
-        );
-        if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-          throw new errors.NotAllowedError("unauthorised");
-        }
-        if (owner !== userEntityRef) {
-          throw new errors.NotAllowedError("you can only approve requests for your own api products");
-        }
-      }
       const status = {
         phase: "Approved",
         reviewedBy,
@@ -661,30 +721,14 @@ async function createRouter({
       if (!apiProductName) {
         throw new errors.InputError("apiProductRef.name is required in APIKey spec");
       }
-      const apiProduct = await k8sClient$1.getCustomResource(
-        "devportal.kuadrant.io",
-        "v1alpha1",
+      await verifyApiKeyUpdatePermission(
+        credentials,
+        userEntityRef,
         namespace,
-        "apiproducts",
-        apiProductName
+        apiProductName,
+        k8sClient$1,
+        permissions$1
       );
-      const owner = apiProduct.metadata?.annotations?.["backstage.io/owner"];
-      const updateAllDecision = await permissions$1.authorize(
-        [{ permission: permissions.kuadrantApiKeyUpdateAllPermission }],
-        { credentials }
-      );
-      if (updateAllDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-        const updateOwnDecision = await permissions$1.authorize(
-          [{ permission: permissions.kuadrantApiKeyUpdateOwnPermission }],
-          { credentials }
-        );
-        if (updateOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
-          throw new errors.NotAllowedError("unauthorised");
-        }
-        if (owner !== userEntityRef) {
-          throw new errors.NotAllowedError("you can only reject requests for your own api products");
-        }
-      }
       const status = {
         phase: "Rejected",
         reviewedBy,
@@ -1141,6 +1185,82 @@ async function createRouter({
       }
     }
   });
+  router.get("/authpolicies", async (req, res) => {
+    try {
+      const credentials = await httpAuth.credentials(req);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantAuthPolicyListPermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
+      }
+      const data = await k8sClient$1.listCustomResources("kuadrant.io", "v1", "authpolicies");
+      const filtered = {
+        items: (data.items || []).map((policy) => ({
+          metadata: {
+            name: policy.metadata.name,
+            namespace: policy.metadata.namespace
+          },
+          spec: policy.spec ? {
+            // expose targetRef to allow UI to match AuthPolicy -> HTTPRoute
+            targetRef: policy.spec.targetRef ? {
+              kind: policy.spec.targetRef.kind,
+              name: policy.spec.targetRef.name,
+              namespace: policy.spec.targetRef.namespace
+            } : void 0
+          } : {},
+          status: policy.status
+        }))
+      };
+      res.json(filtered);
+    } catch (error) {
+      console.error("error fetching authpolicies:", error);
+      if (error instanceof errors.NotAllowedError) {
+        res.status(403).json({ error: error.message });
+      } else {
+        res.status(500).json({ error: "failed to fetch authpolicies" });
+      }
+    }
+  });
+  router.get("/ratelimitpolicies", async (req, res) => {
+    try {
+      const credentials = await httpAuth.credentials(req);
+      const decision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantRateLimitPolicyListPermission }],
+        { credentials }
+      );
+      if (decision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        throw new errors.NotAllowedError("unauthorised");
+      }
+      const data = await k8sClient$1.listCustomResources("kuadrant.io", "v1", "ratelimitpolicies");
+      const filtered = {
+        items: (data.items || []).map((policy) => ({
+          metadata: {
+            name: policy.metadata.name,
+            namespace: policy.metadata.namespace
+          },
+          spec: policy.spec ? {
+            // expose targetRef to allow UI to match AuthPolicy -> HTTPRoute
+            targetRef: policy.spec.targetRef ? {
+              kind: policy.spec.targetRef.kind,
+              name: policy.spec.targetRef.name,
+              namespace: policy.spec.targetRef.namespace
+            } : void 0
+          } : {},
+          status: policy.status
+        }))
+      };
+      res.json(filtered);
+    } catch (error) {
+      console.error("error fetching ratelimitpolicies:", error);
+      if (error instanceof errors.NotAllowedError) {
+        res.status(403).json({ error: error.message });
+      } else {
+        res.status(500).json({ error: "failed to fetch ratelimitpolicies" });
+      }
+    }
+  });
   router.use(pluginPermissionNode.createPermissionIntegrationRouter({
     permissions: permissions.kuadrantPermissions
   }));