@mondaydotcomorg/monday-authorization 3.1.1-feature-bashanye-fix-platform-url.d268e4c → 3.1.2-feature-bashanye-enhance-profile-selection-release-process.51e4fbf

package/dist/attributions-service.d.ts

@@ -1,5 +1,5 @@
 import { Context, ExecutionContext } from '@mondaydotcomorg/trident-backend-api';
-declare enum PlatformProfile {
+export declare enum PlatformProfile {
     API_INTERNAL = "api-internal",
     SLOW = "slow",
     INTERNAL = "internal"
@@ -9,5 +9,4 @@ export declare function getExecutionContext(context: Context): ExecutionContext;
 export declare function getAttributionsFromApi(): {
     [key: string]: string;
 };
-export {};
 //# sourceMappingURL=attributions-service.d.ts.map

package/dist/attributions-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,aAAK,eAAe;IAClB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}
+{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,oBAAY,eAAe;IACzB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}

package/dist/attributions-service.js

@@ -7,27 +7,27 @@ const APP_NAME_VARIABLE_KEY = 'APP_NAME';
 const APP_NAME_HEADER_NAME = 'x-caller-app-name-from-sdk';
 const FROM_SDK_HEADER_SUFFIX = `-from-sdk`;
 let didSendFailureLogOnce = false;
-var PlatformProfile;
+exports.PlatformProfile = void 0;
 (function (PlatformProfile) {
     PlatformProfile["API_INTERNAL"] = "api-internal";
     PlatformProfile["SLOW"] = "slow";
     PlatformProfile["INTERNAL"] = "internal";
-})(PlatformProfile || (PlatformProfile = {}));
+})(exports.PlatformProfile || (exports.PlatformProfile = {}));
 function getProfile() {
     const tridentContext = tridentBackendApi.Api.getPart('context');
     if (!tridentContext) {
-        return PlatformProfile.INTERNAL;
+        return exports.PlatformProfile.INTERNAL;
     }
     const { mondayRequestSource } = getExecutionContext(tridentContext);
     switch (mondayRequestSource) {
         case 'api': {
-            return PlatformProfile.API_INTERNAL;
+            return exports.PlatformProfile.API_INTERNAL;
         }
         case 'slow': {
-            return PlatformProfile.SLOW;
+            return exports.PlatformProfile.SLOW;
         }
         default:
-            return PlatformProfile.INTERNAL;
+            return exports.PlatformProfile.INTERNAL;
     }
 }
 function getExecutionContext(context) {

package/dist/authorization-service.d.ts

@@ -28,23 +28,9 @@ export declare class AuthorizationService {
     private static fetchIsUserGrantedWithFeature;
     private static getCachedKeyName;
     static canActionInScope(accountId: number, userId: number, action: string, scope: ScopeOptions): Promise<ScopedActionPermit>;
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param scopedActions
-     */
-    private static canActionInScopeMultiple_withoutPlatformProfile;
+    private static getProfile;
     static canActionInScopeMultiple(accountId: number, userId: number, scopedActions: ScopedAction[]): Promise<ScopedActionResponseObject[]>;
     private static isAuthorizedSingular;
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param authorizationRequestObjects
-     * @private
-     */
-    private static isAuthorizedMultiple_withoutPlatformProfile;
     private static isAuthorizedMultiple;
 }
 export declare function setRedisClient(client: any, grantedFeatureRedisExpirationInSeconds?: number): void;

package/dist/authorization-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAS,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAQ1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;OAKG;mBACkB,+CAA+C;WAgDvD,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBA4EnB,oBAAoB;IAUzC;;;;;;OAMG;mBACkB,2CAA2C;mBAiE3C,oBAAoB;CAiG1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}
+{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAY1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B,OAAO,CAAC,MAAM,CAAC,UAAU;WAwBZ,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBAkEnB,oBAAoB;mBAUpB,oBAAoB;CAmF1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}

package/dist/authorization-service.js

@@ -4,7 +4,6 @@ const perf_hooks = require('perf_hooks');
 const snakeCase = require('lodash/snakeCase.js');
 const camelCase = require('lodash/camelCase.js');
 const mapKeys = require('lodash/mapKeys.js');
-const mondayFetch = require('@mondaydotcomorg/monday-fetch');
 const tridentBackendApi = require('@mondaydotcomorg/trident-backend-api');
 const mondayFetchApi = require('@mondaydotcomorg/monday-fetch-api');
 const igniteSdk = require('@mondaydotcomorg/ignite-sdk');
@@ -21,6 +20,9 @@ const mapKeys__default = /*#__PURE__*/_interopDefault(mapKeys);
 const GRANTED_FEATURE_CACHE_EXPIRATION_SECONDS = 5 * 60;
 const PLATFORM_AUTHORIZE_PATH = '/internal_ms/authorization/authorize';
 const PLATFORM_CAN_ACTIONS_IN_SCOPES_PATH = '/internal_ms/authorization/can_actions_in_scopes';
+const ALLOWED_SDK_PLATFORM_PROFILES_KEY = 'allowed-sdk-platform-profiles';
+const IN_RELEASE_SDK_PLATFORM_PROFILES_KEY = 'in-release-sdk-platform-profile';
+const PLATFORM_PROFILE_RELEASE_FF = 'sdk-platform-profiles';
 function setRequestFetchOptions(customMondayFetchOptions) {
     authorizationInternalService.AuthorizationInternalService.setRequestFetchOptions(customMondayFetchOptions);
 }
@@ -75,61 +77,33 @@ class AuthorizationService {
         const scopedActionResponseObjects = await this.canActionInScopeMultiple(accountId, userId, scopedActions);
         return scopedActionResponseObjects[0].permit;
     }
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param scopedActions
-     */
-    static async canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions) {
-        const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
-        const scopedActionsPayload = scopedActions.map(scopedAction => {
-            return { ...scopedAction, scope: mapKeys__default.default(scopedAction.scope, (_, key) => snakeCase__default.default(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
-        });
-        const attributionHeaders = attributionsService.getAttributionsFromApi();
-        const response = await mondayFetch.fetch(getCanActionsInScopesUrl(), {
-            method: 'POST',
-            headers: {
-                Authorization: internalAuthToken,
-                'Content-Type': 'application/json',
-                ...attributionHeaders,
-            },
-            timeout: authorizationInternalService.AuthorizationInternalService.getRequestTimeout(),
-            body: JSON.stringify({
-                user_id: userId,
-                scoped_actions: scopedActionsPayload,
-            }),
-        }, authorizationInternalService.AuthorizationInternalService.getRequestFetchOptions());
-        authorizationInternalService.AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'canActionInScopeMultiple');
-        const responseBody = await response.json();
-        const camelCaseKeys = obj => Object.fromEntries(Object.entries(obj).map(([key, value]) => [camelCase__default.default(key), value]));
-        const scopedActionsResponseObjects = responseBody.result.map(responseObject => {
-            const { scopedAction, permit } = responseObject;
-            const { scope } = scopedAction;
-            const transformKeys = obj => camelCaseKeys(obj);
-            return {
-                ...responseObject,
-                scopedAction: { ...scopedAction, scope: transformKeys(scope) },
-                permit: transformKeys(permit),
-            };
-        });
-        return scopedActionsResponseObjects;
-    }
-    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
-        // gradually release the new platform profile features
+    static getProfile(accountId, userId) {
+        const appName = process.env.APP_NAME ?? 'INVALID_APP_NAME';
         if (!this.igniteClient) {
-            authorizationInternalService.logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
+            authorizationInternalService.logger.error({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, failing request');
+            throw new Error('AuthorizationService: igniteClient is not set, failing request');
+        }
+        if (this.igniteClient.configuration
+            .getObjectValue(ALLOWED_SDK_PLATFORM_PROFILES_KEY, [])
+            .includes(appName)) {
+            return attributionsService.getProfile();
         }
-        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
-            return AuthorizationService.canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions);
+        if (this.igniteClient.configuration
+            .getObjectValue(IN_RELEASE_SDK_PLATFORM_PROFILES_KEY, [])
+            .includes(appName) &&
+            this.igniteClient.isReleased(PLATFORM_PROFILE_RELEASE_FF, { accountId, userId })) {
+            return attributionsService.getProfile();
         }
+        return attributionsService.PlatformProfile.INTERNAL;
+    }
+    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
+        const profile = this.getProfile(accountId, userId);
         const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const scopedActionsPayload = scopedActions.map(scopedAction => {
             return { ...scopedAction, scope: mapKeys__default.default(scopedAction.scope, (_, key) => snakeCase__default.default(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
         });
         const attributionHeaders = attributionsService.getAttributionsFromApi();
         const httpClient = tridentBackendApi.Api.getPart('httpClient');
-        const profile = attributionsService.getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -183,67 +157,12 @@ class AuthorizationService {
         const { authorizationObjects } = createAuthorizationParams(resources, action);
         return this.isAuthorizedMultiple(accountId, userId, authorizationObjects);
     }
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param authorizationRequestObjects
-     * @private
-     */
-    static async isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects) {
-        const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
-        const startTime = perf_hooks.performance.now();
-        const attributionHeaders = attributionsService.getAttributionsFromApi();
-        const response = await mondayFetch.fetch(getAuthorizeUrl(), {
-            method: 'POST',
-            headers: {
-                Authorization: internalAuthToken,
-                'Content-Type': 'application/json',
-                ...attributionHeaders,
-            },
-            timeout: authorizationInternalService.AuthorizationInternalService.getRequestTimeout(),
-            body: JSON.stringify({
-                user_id: userId,
-                authorize_request_objects: authorizationRequestObjects,
-            }),
-        }, authorizationInternalService.AuthorizationInternalService.getRequestFetchOptions());
-        const endTime = perf_hooks.performance.now();
-        const time = endTime - startTime;
-        const responseStatus = response.status;
-        authorizationInternalService.AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'isAuthorizedMultiple');
-        const responseBody = await response.json();
-        const unauthorizedObjects = [];
-        responseBody.result.forEach(function (isAuthorized, index) {
-            const authorizationObject = authorizationRequestObjects[index];
-            if (!isAuthorized) {
-                unauthorizedObjects.push(authorizationObject);
-            }
-            prometheusService.sendAuthorizationCheckResponseTimeMetric(authorizationObject.resource_type, authorizationObject.action, isAuthorized, responseStatus, time);
-        });
-        if (unauthorizedObjects.length > 0) {
-            authorizationInternalService.logger.info({
-                resources: JSON.stringify(unauthorizedObjects),
-            }, 'AuthorizationService: resource is unauthorized');
-            const unauthorizedIds = unauthorizedObjects
-                .filter(obj => !!obj.resource_id)
-                .map(obj => obj.resource_id);
-            return { isAuthorized: false, unauthorizedIds, unauthorizedObjects };
-        }
-        return { isAuthorized: true };
-    }
     static async isAuthorizedMultiple(accountId, userId, authorizationRequestObjects) {
-        // gradually release the new platform profile features
-        if (!this.igniteClient) {
-            authorizationInternalService.logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
-        }
-        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
-            return AuthorizationService.isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects);
-        }
+        const profile = this.getProfile(accountId, userId);
         const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const startTime = perf_hooks.performance.now();
         const attributionHeaders = attributionsService.getAttributionsFromApi();
         const httpClient = tridentBackendApi.Api.getPart('httpClient');
-        const profile = attributionsService.getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -313,7 +232,7 @@ function setRedisClient(client, grantedFeatureRedisExpirationInSeconds = GRANTED
 }
 async function setIgniteClient() {
     AuthorizationService.igniteClient = await igniteSdk.getIgniteClient({
-        namespace: ['authorization'],
+        namespace: ['authorization-sdk'],
     });
 }
 function createAuthorizationParams(resources, action) {
@@ -332,12 +251,6 @@ function createAuthorizationParams(resources, action) {
     };
     return params;
 }
-function getAuthorizeUrl() {
-    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/authorize`;
-}
-function getCanActionsInScopesUrl() {
-    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/can_actions_in_scopes`;
-}
 
 exports.AuthorizationService = AuthorizationService;
 exports.createAuthorizationParams = createAuthorizationParams;

package/dist/esm/attributions-service.d.ts

@@ -1,5 +1,5 @@
 import { Context, ExecutionContext } from '@mondaydotcomorg/trident-backend-api';
-declare enum PlatformProfile {
+export declare enum PlatformProfile {
     API_INTERNAL = "api-internal",
     SLOW = "slow",
     INTERNAL = "internal"
@@ -9,5 +9,4 @@ export declare function getExecutionContext(context: Context): ExecutionContext;
 export declare function getAttributionsFromApi(): {
     [key: string]: string;
 };
-export {};
 //# sourceMappingURL=attributions-service.d.ts.map

package/dist/esm/attributions-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,aAAK,eAAe;IAClB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}
+{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,oBAAY,eAAe;IACzB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}

package/dist/esm/attributions-service.mjs

@@ -76,4 +76,4 @@ function tryJsonParse(value) {
     }
 }
 
-export { getAttributionsFromApi, getExecutionContext, getProfile };
+export { PlatformProfile, getAttributionsFromApi, getExecutionContext, getProfile };

package/dist/esm/authorization-service.d.ts

@@ -28,23 +28,9 @@ export declare class AuthorizationService {
     private static fetchIsUserGrantedWithFeature;
     private static getCachedKeyName;
     static canActionInScope(accountId: number, userId: number, action: string, scope: ScopeOptions): Promise<ScopedActionPermit>;
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param scopedActions
-     */
-    private static canActionInScopeMultiple_withoutPlatformProfile;
+    private static getProfile;
     static canActionInScopeMultiple(accountId: number, userId: number, scopedActions: ScopedAction[]): Promise<ScopedActionResponseObject[]>;
     private static isAuthorizedSingular;
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param authorizationRequestObjects
-     * @private
-     */
-    private static isAuthorizedMultiple_withoutPlatformProfile;
     private static isAuthorizedMultiple;
 }
 export declare function setRedisClient(client: any, grantedFeatureRedisExpirationInSeconds?: number): void;

package/dist/esm/authorization-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAS,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAQ1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;OAKG;mBACkB,+CAA+C;WAgDvD,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBA4EnB,oBAAoB;IAUzC;;;;;;OAMG;mBACkB,2CAA2C;mBAiE3C,oBAAoB;CAiG1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}
+{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAY1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B,OAAO,CAAC,MAAM,CAAC,UAAU;WAwBZ,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBAkEnB,oBAAoB;mBAUpB,oBAAoB;CAmF1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}

package/dist/esm/authorization-service.mjs

@@ -2,17 +2,19 @@ import { performance } from 'perf_hooks';
 import snakeCase from 'lodash/snakeCase.js';
 import camelCase from 'lodash/camelCase.js';
 import mapKeys from 'lodash/mapKeys.js';
-import { fetch } from '@mondaydotcomorg/monday-fetch';
 import { Api } from '@mondaydotcomorg/trident-backend-api';
 import { HttpFetcherError } from '@mondaydotcomorg/monday-fetch-api';
 import { getIgniteClient } from '@mondaydotcomorg/ignite-sdk';
 import { sendAuthorizationCheckResponseTimeMetric } from './prometheus-service.mjs';
 import { AuthorizationInternalService, logger } from './authorization-internal-service.mjs';
-import { getAttributionsFromApi, getProfile } from './attributions-service.mjs';
+import { getProfile, PlatformProfile, getAttributionsFromApi } from './attributions-service.mjs';
 
 const GRANTED_FEATURE_CACHE_EXPIRATION_SECONDS = 5 * 60;
 const PLATFORM_AUTHORIZE_PATH = '/internal_ms/authorization/authorize';
 const PLATFORM_CAN_ACTIONS_IN_SCOPES_PATH = '/internal_ms/authorization/can_actions_in_scopes';
+const ALLOWED_SDK_PLATFORM_PROFILES_KEY = 'allowed-sdk-platform-profiles';
+const IN_RELEASE_SDK_PLATFORM_PROFILES_KEY = 'in-release-sdk-platform-profile';
+const PLATFORM_PROFILE_RELEASE_FF = 'sdk-platform-profiles';
 function setRequestFetchOptions(customMondayFetchOptions) {
     AuthorizationInternalService.setRequestFetchOptions(customMondayFetchOptions);
 }
@@ -67,61 +69,33 @@ class AuthorizationService {
         const scopedActionResponseObjects = await this.canActionInScopeMultiple(accountId, userId, scopedActions);
         return scopedActionResponseObjects[0].permit;
     }
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param scopedActions
-     */
-    static async canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions) {
-        const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
-        const scopedActionsPayload = scopedActions.map(scopedAction => {
-            return { ...scopedAction, scope: mapKeys(scopedAction.scope, (_, key) => snakeCase(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
-        });
-        const attributionHeaders = getAttributionsFromApi();
-        const response = await fetch(getCanActionsInScopesUrl(), {
-            method: 'POST',
-            headers: {
-                Authorization: internalAuthToken,
-                'Content-Type': 'application/json',
-                ...attributionHeaders,
-            },
-            timeout: AuthorizationInternalService.getRequestTimeout(),
-            body: JSON.stringify({
-                user_id: userId,
-                scoped_actions: scopedActionsPayload,
-            }),
-        }, AuthorizationInternalService.getRequestFetchOptions());
-        AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'canActionInScopeMultiple');
-        const responseBody = await response.json();
-        const camelCaseKeys = obj => Object.fromEntries(Object.entries(obj).map(([key, value]) => [camelCase(key), value]));
-        const scopedActionsResponseObjects = responseBody.result.map(responseObject => {
-            const { scopedAction, permit } = responseObject;
-            const { scope } = scopedAction;
-            const transformKeys = obj => camelCaseKeys(obj);
-            return {
-                ...responseObject,
-                scopedAction: { ...scopedAction, scope: transformKeys(scope) },
-                permit: transformKeys(permit),
-            };
-        });
-        return scopedActionsResponseObjects;
-    }
-    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
-        // gradually release the new platform profile features
+    static getProfile(accountId, userId) {
+        const appName = process.env.APP_NAME ?? 'INVALID_APP_NAME';
         if (!this.igniteClient) {
-            logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
+            logger.error({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, failing request');
+            throw new Error('AuthorizationService: igniteClient is not set, failing request');
+        }
+        if (this.igniteClient.configuration
+            .getObjectValue(ALLOWED_SDK_PLATFORM_PROFILES_KEY, [])
+            .includes(appName)) {
+            return getProfile();
         }
-        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
-            return AuthorizationService.canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions);
+        if (this.igniteClient.configuration
+            .getObjectValue(IN_RELEASE_SDK_PLATFORM_PROFILES_KEY, [])
+            .includes(appName) &&
+            this.igniteClient.isReleased(PLATFORM_PROFILE_RELEASE_FF, { accountId, userId })) {
+            return getProfile();
         }
+        return PlatformProfile.INTERNAL;
+    }
+    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
+        const profile = this.getProfile(accountId, userId);
         const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const scopedActionsPayload = scopedActions.map(scopedAction => {
             return { ...scopedAction, scope: mapKeys(scopedAction.scope, (_, key) => snakeCase(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
         });
         const attributionHeaders = getAttributionsFromApi();
         const httpClient = Api.getPart('httpClient');
-        const profile = getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -175,67 +149,12 @@ class AuthorizationService {
         const { authorizationObjects } = createAuthorizationParams(resources, action);
         return this.isAuthorizedMultiple(accountId, userId, authorizationObjects);
     }
-    /**
-     * @deprecated - gradually phasing this out
-     * @param accountId
-     * @param userId
-     * @param authorizationRequestObjects
-     * @private
-     */
-    static async isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects) {
-        const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
-        const startTime = performance.now();
-        const attributionHeaders = getAttributionsFromApi();
-        const response = await fetch(getAuthorizeUrl(), {
-            method: 'POST',
-            headers: {
-                Authorization: internalAuthToken,
-                'Content-Type': 'application/json',
-                ...attributionHeaders,
-            },
-            timeout: AuthorizationInternalService.getRequestTimeout(),
-            body: JSON.stringify({
-                user_id: userId,
-                authorize_request_objects: authorizationRequestObjects,
-            }),
-        }, AuthorizationInternalService.getRequestFetchOptions());
-        const endTime = performance.now();
-        const time = endTime - startTime;
-        const responseStatus = response.status;
-        AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'isAuthorizedMultiple');
-        const responseBody = await response.json();
-        const unauthorizedObjects = [];
-        responseBody.result.forEach(function (isAuthorized, index) {
-            const authorizationObject = authorizationRequestObjects[index];
-            if (!isAuthorized) {
-                unauthorizedObjects.push(authorizationObject);
-            }
-            sendAuthorizationCheckResponseTimeMetric(authorizationObject.resource_type, authorizationObject.action, isAuthorized, responseStatus, time);
-        });
-        if (unauthorizedObjects.length > 0) {
-            logger.info({
-                resources: JSON.stringify(unauthorizedObjects),
-            }, 'AuthorizationService: resource is unauthorized');
-            const unauthorizedIds = unauthorizedObjects
-                .filter(obj => !!obj.resource_id)
-                .map(obj => obj.resource_id);
-            return { isAuthorized: false, unauthorizedIds, unauthorizedObjects };
-        }
-        return { isAuthorized: true };
-    }
     static async isAuthorizedMultiple(accountId, userId, authorizationRequestObjects) {
-        // gradually release the new platform profile features
-        if (!this.igniteClient) {
-            logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
-        }
-        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
-            return AuthorizationService.isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects);
-        }
+        const profile = this.getProfile(accountId, userId);
         const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const startTime = performance.now();
         const attributionHeaders = getAttributionsFromApi();
         const httpClient = Api.getPart('httpClient');
-        const profile = getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -305,7 +224,7 @@ function setRedisClient(client, grantedFeatureRedisExpirationInSeconds = GRANTED
 }
 async function setIgniteClient() {
     AuthorizationService.igniteClient = await getIgniteClient({
-        namespace: ['authorization'],
+        namespace: ['authorization-sdk'],
     });
 }
 function createAuthorizationParams(resources, action) {
@@ -324,11 +243,5 @@ function createAuthorizationParams(resources, action) {
     };
     return params;
 }
-function getAuthorizeUrl() {
-    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/authorize`;
-}
-function getCanActionsInScopesUrl() {
-    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/can_actions_in_scopes`;
-}
 
 export { AuthorizationService, createAuthorizationParams, setIgniteClient, setRedisClient, setRequestFetchOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/monday-authorization",
-  "version": "3.1.1-feature-bashanye-fix-platform-url.d268e4c",
+  "version": "3.1.2-feature-bashanye-enhance-profile-selection-release-process.51e4fbf",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "license": "BSD-3-Clause",