@mondaydotcomorg/monday-authorization 3.1.2-feature-bashanye-enhance-profile-selection-release-process.51e4fbf → 3.1.2

package/dist/attributions-service.d.ts

@@ -1,5 +1,5 @@
 import { Context, ExecutionContext } from '@mondaydotcomorg/trident-backend-api';
-export declare enum PlatformProfile {
+declare enum PlatformProfile {
     API_INTERNAL = "api-internal",
     SLOW = "slow",
     INTERNAL = "internal"
@@ -9,4 +9,5 @@ export declare function getExecutionContext(context: Context): ExecutionContext;
 export declare function getAttributionsFromApi(): {
     [key: string]: string;
 };
+export {};
 //# sourceMappingURL=attributions-service.d.ts.map

package/dist/attributions-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,oBAAY,eAAe;IACzB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}
+{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,aAAK,eAAe;IAClB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}

package/dist/attributions-service.js

@@ -7,27 +7,27 @@ const APP_NAME_VARIABLE_KEY = 'APP_NAME';
 const APP_NAME_HEADER_NAME = 'x-caller-app-name-from-sdk';
 const FROM_SDK_HEADER_SUFFIX = `-from-sdk`;
 let didSendFailureLogOnce = false;
-exports.PlatformProfile = void 0;
+var PlatformProfile;
 (function (PlatformProfile) {
     PlatformProfile["API_INTERNAL"] = "api-internal";
     PlatformProfile["SLOW"] = "slow";
     PlatformProfile["INTERNAL"] = "internal";
-})(exports.PlatformProfile || (exports.PlatformProfile = {}));
+})(PlatformProfile || (PlatformProfile = {}));
 function getProfile() {
     const tridentContext = tridentBackendApi.Api.getPart('context');
     if (!tridentContext) {
-        return exports.PlatformProfile.INTERNAL;
+        return PlatformProfile.INTERNAL;
     }
     const { mondayRequestSource } = getExecutionContext(tridentContext);
     switch (mondayRequestSource) {
         case 'api': {
-            return exports.PlatformProfile.API_INTERNAL;
+            return PlatformProfile.API_INTERNAL;
         }
         case 'slow': {
-            return exports.PlatformProfile.SLOW;
+            return PlatformProfile.SLOW;
         }
         default:
-            return exports.PlatformProfile.INTERNAL;
+            return PlatformProfile.INTERNAL;
     }
 }
 function getExecutionContext(context) {

package/dist/authorization-service.d.ts

@@ -28,9 +28,23 @@ export declare class AuthorizationService {
     private static fetchIsUserGrantedWithFeature;
     private static getCachedKeyName;
     static canActionInScope(accountId: number, userId: number, action: string, scope: ScopeOptions): Promise<ScopedActionPermit>;
-    private static getProfile;
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param scopedActions
+     */
+    private static canActionInScopeMultiple_withoutPlatformProfile;
     static canActionInScopeMultiple(accountId: number, userId: number, scopedActions: ScopedAction[]): Promise<ScopedActionResponseObject[]>;
     private static isAuthorizedSingular;
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param authorizationRequestObjects
+     * @private
+     */
+    private static isAuthorizedMultiple_withoutPlatformProfile;
     private static isAuthorizedMultiple;
 }
 export declare function setRedisClient(client: any, grantedFeatureRedisExpirationInSeconds?: number): void;

package/dist/authorization-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAY1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B,OAAO,CAAC,MAAM,CAAC,UAAU;WAwBZ,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBAkEnB,oBAAoB;mBAUpB,oBAAoB;CAmF1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}
+{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAS,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAQ1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;OAKG;mBACkB,+CAA+C;WAgDvD,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBA4EnB,oBAAoB;IAUzC;;;;;;OAMG;mBACkB,2CAA2C;mBAiE3C,oBAAoB;CAiG1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}

package/dist/authorization-service.js

@@ -4,6 +4,7 @@ const perf_hooks = require('perf_hooks');
 const snakeCase = require('lodash/snakeCase.js');
 const camelCase = require('lodash/camelCase.js');
 const mapKeys = require('lodash/mapKeys.js');
+const mondayFetch = require('@mondaydotcomorg/monday-fetch');
 const tridentBackendApi = require('@mondaydotcomorg/trident-backend-api');
 const mondayFetchApi = require('@mondaydotcomorg/monday-fetch-api');
 const igniteSdk = require('@mondaydotcomorg/ignite-sdk');
@@ -20,9 +21,6 @@ const mapKeys__default = /*#__PURE__*/_interopDefault(mapKeys);
 const GRANTED_FEATURE_CACHE_EXPIRATION_SECONDS = 5 * 60;
 const PLATFORM_AUTHORIZE_PATH = '/internal_ms/authorization/authorize';
 const PLATFORM_CAN_ACTIONS_IN_SCOPES_PATH = '/internal_ms/authorization/can_actions_in_scopes';
-const ALLOWED_SDK_PLATFORM_PROFILES_KEY = 'allowed-sdk-platform-profiles';
-const IN_RELEASE_SDK_PLATFORM_PROFILES_KEY = 'in-release-sdk-platform-profile';
-const PLATFORM_PROFILE_RELEASE_FF = 'sdk-platform-profiles';
 function setRequestFetchOptions(customMondayFetchOptions) {
     authorizationInternalService.AuthorizationInternalService.setRequestFetchOptions(customMondayFetchOptions);
 }
@@ -77,33 +75,61 @@ class AuthorizationService {
         const scopedActionResponseObjects = await this.canActionInScopeMultiple(accountId, userId, scopedActions);
         return scopedActionResponseObjects[0].permit;
     }
-    static getProfile(accountId, userId) {
-        const appName = process.env.APP_NAME ?? 'INVALID_APP_NAME';
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param scopedActions
+     */
+    static async canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions) {
+        const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
+        const scopedActionsPayload = scopedActions.map(scopedAction => {
+            return { ...scopedAction, scope: mapKeys__default.default(scopedAction.scope, (_, key) => snakeCase__default.default(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
+        });
+        const attributionHeaders = attributionsService.getAttributionsFromApi();
+        const response = await mondayFetch.fetch(getCanActionsInScopesUrl(), {
+            method: 'POST',
+            headers: {
+                Authorization: internalAuthToken,
+                'Content-Type': 'application/json',
+                ...attributionHeaders,
+            },
+            timeout: authorizationInternalService.AuthorizationInternalService.getRequestTimeout(),
+            body: JSON.stringify({
+                user_id: userId,
+                scoped_actions: scopedActionsPayload,
+            }),
+        }, authorizationInternalService.AuthorizationInternalService.getRequestFetchOptions());
+        authorizationInternalService.AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'canActionInScopeMultiple');
+        const responseBody = await response.json();
+        const camelCaseKeys = obj => Object.fromEntries(Object.entries(obj).map(([key, value]) => [camelCase__default.default(key), value]));
+        const scopedActionsResponseObjects = responseBody.result.map(responseObject => {
+            const { scopedAction, permit } = responseObject;
+            const { scope } = scopedAction;
+            const transformKeys = obj => camelCaseKeys(obj);
+            return {
+                ...responseObject,
+                scopedAction: { ...scopedAction, scope: transformKeys(scope) },
+                permit: transformKeys(permit),
+            };
+        });
+        return scopedActionsResponseObjects;
+    }
+    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
+        // gradually release the new platform profile features
         if (!this.igniteClient) {
-            authorizationInternalService.logger.error({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, failing request');
-            throw new Error('AuthorizationService: igniteClient is not set, failing request');
-        }
-        if (this.igniteClient.configuration
-            .getObjectValue(ALLOWED_SDK_PLATFORM_PROFILES_KEY, [])
-            .includes(appName)) {
-            return attributionsService.getProfile();
+            authorizationInternalService.logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
         }
-        if (this.igniteClient.configuration
-            .getObjectValue(IN_RELEASE_SDK_PLATFORM_PROFILES_KEY, [])
-            .includes(appName) &&
-            this.igniteClient.isReleased(PLATFORM_PROFILE_RELEASE_FF, { accountId, userId })) {
-            return attributionsService.getProfile();
+        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
+            return AuthorizationService.canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions);
         }
-        return attributionsService.PlatformProfile.INTERNAL;
-    }
-    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
-        const profile = this.getProfile(accountId, userId);
         const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const scopedActionsPayload = scopedActions.map(scopedAction => {
             return { ...scopedAction, scope: mapKeys__default.default(scopedAction.scope, (_, key) => snakeCase__default.default(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
         });
         const attributionHeaders = attributionsService.getAttributionsFromApi();
         const httpClient = tridentBackendApi.Api.getPart('httpClient');
+        const profile = attributionsService.getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -157,12 +183,67 @@ class AuthorizationService {
         const { authorizationObjects } = createAuthorizationParams(resources, action);
         return this.isAuthorizedMultiple(accountId, userId, authorizationObjects);
     }
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param authorizationRequestObjects
+     * @private
+     */
+    static async isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects) {
+        const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
+        const startTime = perf_hooks.performance.now();
+        const attributionHeaders = attributionsService.getAttributionsFromApi();
+        const response = await mondayFetch.fetch(getAuthorizeUrl(), {
+            method: 'POST',
+            headers: {
+                Authorization: internalAuthToken,
+                'Content-Type': 'application/json',
+                ...attributionHeaders,
+            },
+            timeout: authorizationInternalService.AuthorizationInternalService.getRequestTimeout(),
+            body: JSON.stringify({
+                user_id: userId,
+                authorize_request_objects: authorizationRequestObjects,
+            }),
+        }, authorizationInternalService.AuthorizationInternalService.getRequestFetchOptions());
+        const endTime = perf_hooks.performance.now();
+        const time = endTime - startTime;
+        const responseStatus = response.status;
+        authorizationInternalService.AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'isAuthorizedMultiple');
+        const responseBody = await response.json();
+        const unauthorizedObjects = [];
+        responseBody.result.forEach(function (isAuthorized, index) {
+            const authorizationObject = authorizationRequestObjects[index];
+            if (!isAuthorized) {
+                unauthorizedObjects.push(authorizationObject);
+            }
+            prometheusService.sendAuthorizationCheckResponseTimeMetric(authorizationObject.resource_type, authorizationObject.action, isAuthorized, responseStatus, time);
+        });
+        if (unauthorizedObjects.length > 0) {
+            authorizationInternalService.logger.info({
+                resources: JSON.stringify(unauthorizedObjects),
+            }, 'AuthorizationService: resource is unauthorized');
+            const unauthorizedIds = unauthorizedObjects
+                .filter(obj => !!obj.resource_id)
+                .map(obj => obj.resource_id);
+            return { isAuthorized: false, unauthorizedIds, unauthorizedObjects };
+        }
+        return { isAuthorized: true };
+    }
     static async isAuthorizedMultiple(accountId, userId, authorizationRequestObjects) {
-        const profile = this.getProfile(accountId, userId);
+        // gradually release the new platform profile features
+        if (!this.igniteClient) {
+            authorizationInternalService.logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
+        }
+        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
+            return AuthorizationService.isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects);
+        }
         const internalAuthToken = authorizationInternalService.AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const startTime = perf_hooks.performance.now();
         const attributionHeaders = attributionsService.getAttributionsFromApi();
         const httpClient = tridentBackendApi.Api.getPart('httpClient');
+        const profile = attributionsService.getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -232,7 +313,7 @@ function setRedisClient(client, grantedFeatureRedisExpirationInSeconds = GRANTED
 }
 async function setIgniteClient() {
     AuthorizationService.igniteClient = await igniteSdk.getIgniteClient({
-        namespace: ['authorization-sdk'],
+        namespace: ['authorization'],
     });
 }
 function createAuthorizationParams(resources, action) {
@@ -251,6 +332,12 @@ function createAuthorizationParams(resources, action) {
     };
     return params;
 }
+function getAuthorizeUrl() {
+    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/authorize`;
+}
+function getCanActionsInScopesUrl() {
+    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/can_actions_in_scopes`;
+}
 
 exports.AuthorizationService = AuthorizationService;
 exports.createAuthorizationParams = createAuthorizationParams;

package/dist/esm/attributions-service.d.ts

@@ -1,5 +1,5 @@
 import { Context, ExecutionContext } from '@mondaydotcomorg/trident-backend-api';
-export declare enum PlatformProfile {
+declare enum PlatformProfile {
     API_INTERNAL = "api-internal",
     SLOW = "slow",
     INTERNAL = "internal"
@@ -9,4 +9,5 @@ export declare function getExecutionContext(context: Context): ExecutionContext;
 export declare function getAttributionsFromApi(): {
     [key: string]: string;
 };
+export {};
 //# sourceMappingURL=attributions-service.d.ts.map

package/dist/esm/attributions-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,oBAAY,eAAe;IACzB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}
+{"version":3,"file":"attributions-service.d.ts","sourceRoot":"","sources":["../../src/attributions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAStF,aAAK,eAAe;IAClB,YAAY,iBAAiB;IAC7B,IAAI,SAAS;IACb,QAAQ,aAAa;CACtB;AAED,wBAAgB,UAAU,oBAiBzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAEtE;AAED,wBAAgB,sBAAsB,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAqClE"}

package/dist/esm/attributions-service.mjs

@@ -76,4 +76,4 @@ function tryJsonParse(value) {
     }
 }
 
-export { PlatformProfile, getAttributionsFromApi, getExecutionContext, getProfile };
+export { getAttributionsFromApi, getExecutionContext, getProfile };

package/dist/esm/authorization-service.d.ts

@@ -28,9 +28,23 @@ export declare class AuthorizationService {
     private static fetchIsUserGrantedWithFeature;
     private static getCachedKeyName;
     static canActionInScope(accountId: number, userId: number, action: string, scope: ScopeOptions): Promise<ScopedActionPermit>;
-    private static getProfile;
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param scopedActions
+     */
+    private static canActionInScopeMultiple_withoutPlatformProfile;
     static canActionInScopeMultiple(accountId: number, userId: number, scopedActions: ScopedAction[]): Promise<ScopedActionResponseObject[]>;
     private static isAuthorizedSingular;
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param authorizationRequestObjects
+     * @private
+     */
+    private static isAuthorizedMultiple_withoutPlatformProfile;
     private static isAuthorizedMultiple;
 }
 export declare function setRedisClient(client: any, grantedFeatureRedisExpirationInSeconds?: number): void;

package/dist/esm/authorization-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAY1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B,OAAO,CAAC,MAAM,CAAC,UAAU;WAwBZ,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBAkEnB,oBAAoB;mBAUpB,oBAAoB;CAmF1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}
+{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../../src/authorization-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAS,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,OAAO,EAAmB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7F,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACb,MAAM,kCAAkC,CAAC;AAQ1C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,wBAAwB,EAAE,kBAAkB,QAElF;AAeD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,WAAW,CAAC,MAAC;IACpB,MAAM,CAAC,sCAAsC,CAAC,EAAE,MAAM,CAAC;IACvD,MAAM,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAEnC;;;OAGG;WACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC;WAEhB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,2BAA2B,EAAE,mBAAmB,EAAE,GACjD,OAAO,CAAC,iBAAiB,CAAC;IAY7B;;;OAGG;WACU,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,OAAO,CAAC;mBAkBE,6BAA6B;IAclD,OAAO,CAAC,MAAM,CAAC,gBAAgB;WAIlB,gBAAgB,CAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;OAKG;mBACkB,+CAA+C;WAgDvD,wBAAwB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,YAAY,EAAE,GAC5B,OAAO,CAAC,0BAA0B,EAAE,CAAC;mBA4EnB,oBAAoB;IAUzC;;;;;;OAMG;mBACkB,2CAA2C;mBAiE3C,oBAAoB;CAiG1C;AAED,wBAAgB,cAAc,CAC5B,MAAM,KAAA,EACN,sCAAsC,GAAE,MAAiD,QAY1F;AAED,wBAAsB,eAAe,kBAIpC;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAepG"}

package/dist/esm/authorization-service.mjs

@@ -2,19 +2,17 @@ import { performance } from 'perf_hooks';
 import snakeCase from 'lodash/snakeCase.js';
 import camelCase from 'lodash/camelCase.js';
 import mapKeys from 'lodash/mapKeys.js';
+import { fetch } from '@mondaydotcomorg/monday-fetch';
 import { Api } from '@mondaydotcomorg/trident-backend-api';
 import { HttpFetcherError } from '@mondaydotcomorg/monday-fetch-api';
 import { getIgniteClient } from '@mondaydotcomorg/ignite-sdk';
 import { sendAuthorizationCheckResponseTimeMetric } from './prometheus-service.mjs';
 import { AuthorizationInternalService, logger } from './authorization-internal-service.mjs';
-import { getProfile, PlatformProfile, getAttributionsFromApi } from './attributions-service.mjs';
+import { getAttributionsFromApi, getProfile } from './attributions-service.mjs';
 
 const GRANTED_FEATURE_CACHE_EXPIRATION_SECONDS = 5 * 60;
 const PLATFORM_AUTHORIZE_PATH = '/internal_ms/authorization/authorize';
 const PLATFORM_CAN_ACTIONS_IN_SCOPES_PATH = '/internal_ms/authorization/can_actions_in_scopes';
-const ALLOWED_SDK_PLATFORM_PROFILES_KEY = 'allowed-sdk-platform-profiles';
-const IN_RELEASE_SDK_PLATFORM_PROFILES_KEY = 'in-release-sdk-platform-profile';
-const PLATFORM_PROFILE_RELEASE_FF = 'sdk-platform-profiles';
 function setRequestFetchOptions(customMondayFetchOptions) {
     AuthorizationInternalService.setRequestFetchOptions(customMondayFetchOptions);
 }
@@ -69,33 +67,61 @@ class AuthorizationService {
         const scopedActionResponseObjects = await this.canActionInScopeMultiple(accountId, userId, scopedActions);
         return scopedActionResponseObjects[0].permit;
     }
-    static getProfile(accountId, userId) {
-        const appName = process.env.APP_NAME ?? 'INVALID_APP_NAME';
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param scopedActions
+     */
+    static async canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions) {
+        const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
+        const scopedActionsPayload = scopedActions.map(scopedAction => {
+            return { ...scopedAction, scope: mapKeys(scopedAction.scope, (_, key) => snakeCase(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
+        });
+        const attributionHeaders = getAttributionsFromApi();
+        const response = await fetch(getCanActionsInScopesUrl(), {
+            method: 'POST',
+            headers: {
+                Authorization: internalAuthToken,
+                'Content-Type': 'application/json',
+                ...attributionHeaders,
+            },
+            timeout: AuthorizationInternalService.getRequestTimeout(),
+            body: JSON.stringify({
+                user_id: userId,
+                scoped_actions: scopedActionsPayload,
+            }),
+        }, AuthorizationInternalService.getRequestFetchOptions());
+        AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'canActionInScopeMultiple');
+        const responseBody = await response.json();
+        const camelCaseKeys = obj => Object.fromEntries(Object.entries(obj).map(([key, value]) => [camelCase(key), value]));
+        const scopedActionsResponseObjects = responseBody.result.map(responseObject => {
+            const { scopedAction, permit } = responseObject;
+            const { scope } = scopedAction;
+            const transformKeys = obj => camelCaseKeys(obj);
+            return {
+                ...responseObject,
+                scopedAction: { ...scopedAction, scope: transformKeys(scope) },
+                permit: transformKeys(permit),
+            };
+        });
+        return scopedActionsResponseObjects;
+    }
+    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
+        // gradually release the new platform profile features
         if (!this.igniteClient) {
-            logger.error({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, failing request');
-            throw new Error('AuthorizationService: igniteClient is not set, failing request');
-        }
-        if (this.igniteClient.configuration
-            .getObjectValue(ALLOWED_SDK_PLATFORM_PROFILES_KEY, [])
-            .includes(appName)) {
-            return getProfile();
+            logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
         }
-        if (this.igniteClient.configuration
-            .getObjectValue(IN_RELEASE_SDK_PLATFORM_PROFILES_KEY, [])
-            .includes(appName) &&
-            this.igniteClient.isReleased(PLATFORM_PROFILE_RELEASE_FF, { accountId, userId })) {
-            return getProfile();
+        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
+            return AuthorizationService.canActionInScopeMultiple_withoutPlatformProfile(accountId, userId, scopedActions);
         }
-        return PlatformProfile.INTERNAL;
-    }
-    static async canActionInScopeMultiple(accountId, userId, scopedActions) {
-        const profile = this.getProfile(accountId, userId);
         const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const scopedActionsPayload = scopedActions.map(scopedAction => {
             return { ...scopedAction, scope: mapKeys(scopedAction.scope, (_, key) => snakeCase(key)) }; // for example: { workspaceId: 1 } => { workspace_id: 1 }
         });
         const attributionHeaders = getAttributionsFromApi();
         const httpClient = Api.getPart('httpClient');
+        const profile = getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -149,12 +175,67 @@ class AuthorizationService {
         const { authorizationObjects } = createAuthorizationParams(resources, action);
         return this.isAuthorizedMultiple(accountId, userId, authorizationObjects);
     }
+    /**
+     * @deprecated - gradually phasing this out
+     * @param accountId
+     * @param userId
+     * @param authorizationRequestObjects
+     * @private
+     */
+    static async isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects) {
+        const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
+        const startTime = performance.now();
+        const attributionHeaders = getAttributionsFromApi();
+        const response = await fetch(getAuthorizeUrl(), {
+            method: 'POST',
+            headers: {
+                Authorization: internalAuthToken,
+                'Content-Type': 'application/json',
+                ...attributionHeaders,
+            },
+            timeout: AuthorizationInternalService.getRequestTimeout(),
+            body: JSON.stringify({
+                user_id: userId,
+                authorize_request_objects: authorizationRequestObjects,
+            }),
+        }, AuthorizationInternalService.getRequestFetchOptions());
+        const endTime = performance.now();
+        const time = endTime - startTime;
+        const responseStatus = response.status;
+        AuthorizationInternalService.throwOnHttpErrorIfNeeded(response, 'isAuthorizedMultiple');
+        const responseBody = await response.json();
+        const unauthorizedObjects = [];
+        responseBody.result.forEach(function (isAuthorized, index) {
+            const authorizationObject = authorizationRequestObjects[index];
+            if (!isAuthorized) {
+                unauthorizedObjects.push(authorizationObject);
+            }
+            sendAuthorizationCheckResponseTimeMetric(authorizationObject.resource_type, authorizationObject.action, isAuthorized, responseStatus, time);
+        });
+        if (unauthorizedObjects.length > 0) {
+            logger.info({
+                resources: JSON.stringify(unauthorizedObjects),
+            }, 'AuthorizationService: resource is unauthorized');
+            const unauthorizedIds = unauthorizedObjects
+                .filter(obj => !!obj.resource_id)
+                .map(obj => obj.resource_id);
+            return { isAuthorized: false, unauthorizedIds, unauthorizedObjects };
+        }
+        return { isAuthorized: true };
+    }
     static async isAuthorizedMultiple(accountId, userId, authorizationRequestObjects) {
-        const profile = this.getProfile(accountId, userId);
+        // gradually release the new platform profile features
+        if (!this.igniteClient) {
+            logger.warn({ tag: 'authorization-service' }, 'AuthorizationService: igniteClient is not set, using new platform profile feature');
+        }
+        else if (!this.igniteClient.isReleased('sdk-platform-profiles', { accountId, userId })) {
+            return AuthorizationService.isAuthorizedMultiple_withoutPlatformProfile(accountId, userId, authorizationRequestObjects);
+        }
         const internalAuthToken = AuthorizationInternalService.generateInternalAuthToken(accountId, userId);
         const startTime = performance.now();
         const attributionHeaders = getAttributionsFromApi();
         const httpClient = Api.getPart('httpClient');
+        const profile = getProfile();
         let response;
         try {
             response = await httpClient.fetch({
@@ -224,7 +305,7 @@ function setRedisClient(client, grantedFeatureRedisExpirationInSeconds = GRANTED
 }
 async function setIgniteClient() {
     AuthorizationService.igniteClient = await getIgniteClient({
-        namespace: ['authorization-sdk'],
+        namespace: ['authorization'],
     });
 }
 function createAuthorizationParams(resources, action) {
@@ -243,5 +324,11 @@ function createAuthorizationParams(resources, action) {
     };
     return params;
 }
+function getAuthorizeUrl() {
+    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/authorize`;
+}
+function getCanActionsInScopesUrl() {
+    return `${process.env.MONDAY_INTERNAL_URL}/internal_ms/authorization/can_actions_in_scopes`;
+}
 
 export { AuthorizationService, createAuthorizationParams, setIgniteClient, setRedisClient, setRequestFetchOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/monday-authorization",
-  "version": "3.1.2-feature-bashanye-enhance-profile-selection-release-process.51e4fbf",
+  "version": "3.1.2",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "license": "BSD-3-Clause",