@platform-mesh/portal-server-lib 0.9.95 → 0.9.97

package/dist/portal-options/services/permissions/permissions-proxy.service.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { extractResourceDefinitions } from '../../utils/extract-resource-definitions.util.js';
+import { AuthzWebhookService } from './adapters/authz-webhook.service.js';
+let PermissionsProxyService = class PermissionsProxyService {
+    authzWebhook;
+    constructor(authzWebhook) {
+        this.authzWebhook = authzWebhook;
+    }
+    async resolvePermissions(token, organization, accountPath, contentConfigurations) {
+        const resourceDefinitions = extractResourceDefinitions(contentConfigurations);
+        const checks = resourceDefinitions
+            .map((rd) => rd.permissionsDefinition)
+            .filter((pd) => !!pd && pd.resourceActions.length > 0)
+            .map((pd) => ({
+            resource: pd.resource,
+            group: pd.group,
+            actions: pd.resourceActions,
+        }));
+        if (!checks.length) {
+            return undefined;
+        }
+        const req = {
+            token,
+            organization,
+            accountPath,
+            checks,
+        };
+        return this.authzWebhook.checkActionsForResource(req);
+    }
+    async checkResourceInstance(req) {
+        return this.authzWebhook.checkActionsForInstance(req);
+    }
+};
+PermissionsProxyService = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [AuthzWebhookService])
+], PermissionsProxyService);
+export { PermissionsProxyService };
+//# sourceMappingURL=permissions-proxy.service.js.map

package/dist/portal-options/services/permissions/permissions-proxy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-proxy.service.js","sourceRoot":"","sources":["../../../../src/portal-options/services/permissions/permissions-proxy.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAQnE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAA7B,YAA6B,YAAiC;QAAjC,iBAAY,GAAZ,YAAY,CAAqB;IAAG,CAAC;IAGlE,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,YAAoB,EACpB,WAAmB,EACnB,qBAA6C;QAE7C,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,qBAAqB,CACtB,CAAC;QAEF,MAAM,MAAM,GAAG,mBAAmB;aAC/B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC;aACrC,MAAM,CACL,CAAC,EAAE,EAA+B,EAAE,CAClC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CACxC;aACA,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACZ,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,OAAO,EAAE,EAAE,CAAC,eAAe;SAC5B,CAAC,CAAC,CAAC;QAEN,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAyB;YAChC,KAAK;YACL,YAAY;YACZ,WAAW;YACX,MAAM;SACP,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAGD,KAAK,CAAC,qBAAqB,CACzB,GAAyB;QAEzB,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;CACF,CAAA;AA9CY,uBAAuB;IADnC,UAAU,EAAE;qCAEgC,mBAAmB;GADnD,uBAAuB,CA8CnC"}

package/dist/portal-options/services/permissions/permissions.controller.d.ts

@@ -0,0 +1,9 @@
+import { HeaderParserService } from '@openmfp/portal-server-lib';
+import { AuthorizationRequest, Permission } from './models/permissions.model.js';
+import { PermissionsProxyService } from './permissions-proxy.service.js';
+export declare class PermissionsController {
+    private readonly permissionsProxyService;
+    private readonly headerParser;
+    constructor(permissionsProxyService: PermissionsProxyService, headerParser: HeaderParserService);
+    checkResource(request: Request, body: AuthorizationRequest): Promise<Permission[]>;
+}

package/dist/portal-options/services/permissions/permissions.controller.js

@@ -0,0 +1,49 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Body, Controller, Post, Req, UnauthorizedException } from '@nestjs/common';
+import { HeaderParserService } from '@openmfp/portal-server-lib';
+import { PermissionsProxyService } from './permissions-proxy.service.js';
+let PermissionsController = class PermissionsController {
+    permissionsProxyService;
+    headerParser;
+    constructor(permissionsProxyService, headerParser) {
+        this.permissionsProxyService = permissionsProxyService;
+        this.headerParser = headerParser;
+    }
+    async checkResource(request, body) {
+        const token = this.headerParser.extractBearerToken(request);
+        if (!token) {
+            throw new UnauthorizedException();
+        }
+        const result = await this.permissionsProxyService.checkResourceInstance({
+            ...body,
+            token,
+        });
+        return result ?? [];
+    }
+};
+__decorate([
+    Post('resource-check'),
+    __param(0, Req()),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Request, Object]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "checkResource", null);
+PermissionsController = __decorate([
+    Controller('rest/permissions'),
+    __metadata("design:paramtypes", [PermissionsProxyService,
+        HeaderParserService])
+], PermissionsController);
+export { PermissionsController };
+//# sourceMappingURL=permissions.controller.js.map

package/dist/portal-options/services/permissions/permissions.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.controller.js","sourceRoot":"","sources":["../../../../src/portal-options/services/permissions/permissions.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEb;IACA;IAFnB,YACmB,uBAAgD,EAChD,YAAiC;QADjC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAqB;IACjD,CAAC;IAGE,AAAN,KAAK,CAAC,aAAa,CACV,OAAgB,EACf,IAA0B;QAElC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,CAAC;YACtE,GAAG,IAAI;YACP,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AAjBO;IADL,IAAI,CAAC,gBAAgB,CAAC;IAEpB,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,IAAI,EAAE,CAAA;;qCADS,OAAO;;0DAexB;AAvBU,qBAAqB;IADjC,UAAU,CAAC,kBAAkB,CAAC;qCAGe,uBAAuB;QAClC,mBAAmB;GAHzC,qBAAqB,CAwBjC"}

package/dist/portal-options/utils/account-hierarchy-resolver.js

@@ -2,7 +2,7 @@ import { replaceStringDeep } from './replace-string-deep.js';
 const ACCOUNT_ENTITY_TYPE = 'core_platform-mesh_io_account';
 export const updateEntityTypeFromAccountPath = (contentConfiguration, accountPath) => {
     contentConfiguration.luigiConfigFragment.data.nodes.forEach((node) => {
-        if (!node.entityType.includes(ACCOUNT_ENTITY_TYPE)) {
+        if (!node.entityType?.includes(ACCOUNT_ENTITY_TYPE)) {
             return;
         }
         const accountPathParts = accountPath
@@ -15,12 +15,15 @@ export const updateEntityTypeFromAccountPath = (contentConfiguration, accountPat
     return contentConfiguration;
 };
 export const updateAccountNodeChildren = (contentConfiguration, accountPath) => {
-    const accountChildrenNode = contentConfiguration.luigiConfigFragment.data.nodes[0]?.children?.[0];
+    const children = contentConfiguration.luigiConfigFragment.data.nodes[0]?.children;
+    const accountChildrenNode = Array.isArray(children) ? children[0] : undefined;
     if (accountChildrenNode) {
         const nextHierarchyLevel = accountPath.split(':').filter(Boolean).length + 1;
         const previousPathSegment = accountChildrenNode.pathSegment;
         const nextPathSegment = `:${nextHierarchyLevel}_${ACCOUNT_ENTITY_TYPE}Id`;
-        replaceStringDeep(accountChildrenNode, previousPathSegment, nextPathSegment);
+        if (previousPathSegment) {
+            replaceStringDeep(accountChildrenNode, previousPathSegment, nextPathSegment);
+        }
     }
     return contentConfiguration;
 };
@@ -32,5 +35,6 @@ export const processContentConfigurationForAccountHierarchy = (contentConfigurat
         }
         return updateEntityTypeFromAccountPath(contentConfiguration, accountPath);
     }
+    return contentConfiguration;
 };
 //# sourceMappingURL=account-hierarchy-resolver.js.map

package/dist/portal-options/utils/account-hierarchy-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-hierarchy-resolver.js","sourceRoot":"","sources":["../../../src/portal-options/utils/account-hierarchy-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW;aACjC,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC;aAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CACvC,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,MAAM,mBAAmB,GACvB,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,kBAAkB,GACtB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,WAAW,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;QAE1E,iBAAiB,CACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAC5D,oBAA0C,EAC1C,OAA4B,EACN,EAAE;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7C,yBAAyB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,+BAA+B,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"account-hierarchy-resolver.js","sourceRoot":"","sources":["../../../src/portal-options/utils/account-hierarchy-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW;aACjC,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC;aAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CACvC,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,MAAM,QAAQ,GACZ,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACnE,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,kBAAkB,GACtB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,WAAW,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;QAE1E,IAAI,mBAAmB,EAAE,CAAC;YACxB,iBAAiB,CACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAC5D,oBAA0C,EAC1C,OAA4B,EACN,EAAE;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7C,yBAAyB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,+BAA+B,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC"}

package/dist/portal-options/utils/build-workspace-path.util.d.ts

@@ -0,0 +1 @@
+export declare function buildWorkspacePath(segments?: (string | undefined | null)[]): string;

package/dist/portal-options/utils/build-workspace-path.util.js

@@ -0,0 +1,4 @@
+export function buildWorkspacePath(segments = []) {
+    return segments.reduce((path, segment) => (segment ? `${path}:${segment}` : path), 'root:orgs');
+}
+//# sourceMappingURL=build-workspace-path.util.js.map

package/dist/portal-options/utils/build-workspace-path.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-workspace-path.util.js","sourceRoot":"","sources":["../../../src/portal-options/utils/build-workspace-path.util.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,kBAAkB,CAChC,WAA0C,EAAE;IAE5C,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAC1D,WAAW,CACZ,CAAC;AACJ,CAAC"}

package/dist/portal-options/utils/extract-resource-definitions.util.d.ts

@@ -0,0 +1,7 @@
+import { ContentConfiguration } from '@openmfp/portal-server-lib';
+import { PermissionsDefinition } from '../services/permissions/models/permissions.model.js';
+export interface ResourceDefinitionLocal {
+    entity: string;
+    permissionsDefinition?: PermissionsDefinition;
+}
+export declare function extractResourceDefinitions(contentConfigurations: ContentConfiguration[]): ResourceDefinitionLocal[];

package/dist/portal-options/utils/extract-resource-definitions.util.js

@@ -0,0 +1,33 @@
+function mergeResourceActions(existing, incoming) {
+    return [...new Set([...(existing ?? []), ...(incoming ?? [])])];
+}
+function collectFromNodes(nodes, acc) {
+    for (const node of nodes) {
+        const rd = node.context?.['resourceDefinition'];
+        if (rd?.entity !== undefined && rd.permissionsDefinition !== undefined) {
+            const existing = acc.get(rd.entity);
+            acc.set(rd.entity, {
+                ...rd,
+                permissionsDefinition: {
+                    ...rd.permissionsDefinition,
+                    resourceActions: mergeResourceActions(existing?.permissionsDefinition?.resourceActions, rd.permissionsDefinition.resourceActions),
+                },
+            });
+        }
+        const children = node.children;
+        if (Array.isArray(children) && children.length > 0) {
+            collectFromNodes(children, acc);
+        }
+    }
+}
+export function extractResourceDefinitions(contentConfigurations) {
+    const acc = new Map();
+    for (const cc of contentConfigurations) {
+        const nodes = cc.luigiConfigFragment?.data?.nodes;
+        if (Array.isArray(nodes)) {
+            collectFromNodes(nodes, acc);
+        }
+    }
+    return Array.from(acc.values());
+}
+//# sourceMappingURL=extract-resource-definitions.util.js.map

package/dist/portal-options/utils/extract-resource-definitions.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-resource-definitions.util.js","sourceRoot":"","sources":["../../../src/portal-options/utils/extract-resource-definitions.util.ts"],"names":[],"mappings":"AAQA,SAAS,oBAAoB,CAC3B,QAA8B,EAC9B,QAA8B;IAE9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmE,EACnE,GAAyC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAEjC,CAAC;QAEd,IAAI,EAAE,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAIpC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE;gBACjB,GAAG,EAAE;gBACL,qBAAqB,EAAE;oBACrB,GAAG,EAAE,CAAC,qBAAqB;oBAC3B,eAAe,EAAE,oBAAoB,CACnC,QAAQ,EAAE,qBAAqB,EAAE,eAAe,EAChD,EAAE,CAAC,qBAAqB,CAAC,eAAe,CACzC;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,qBAA6C;IAE7C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEvD,KAAK,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,EAAE,CAAC,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platform-mesh/portal-server-lib",
-  "version": "0.9.95",
+  "version": "0.9.97",
   "author": "Platform Mesh",
   "license": "Apache-2.0",
   "publishConfig": {

package/src/portal-options/index.ts

@@ -7,3 +7,7 @@ export * from './service-providers/content-configuration-service-providers.servi
 export * from './service-providers/kubernetes-service-providers.service.js';
 
 export * from './services/kcp-k8s.service.js';
+export * from './services/permissions/adapters/authz-webhook.service.js';
+export * from './services/permissions/models/permissions.model.js';
+export * from './services/permissions/permissions-proxy.service.js';
+export * from './services/permissions/permissions.controller.js';

package/src/portal-options/logout-callback.service.spec.ts

@@ -63,10 +63,36 @@ describe('PMLogoutService', () => {
     expect(httpService.post).toHaveBeenCalledWith(
       'https://keycloak/logout',
       expect.any(URLSearchParams),
-      { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } },
+      {
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        auth: { username: 'client-id', password: 'secret' },
+      },
     );
   });
 
+  it('should not send the client secret as a form parameter', async () => {
+    const mockRequest = {} as Request;
+    const mockResponse = {} as Response;
+
+    (authConfigService.getAuthConfig as jest.Mock).mockResolvedValue({
+      clientId: 'client-id',
+      clientSecret: 'secret',
+      endSessionUrl: 'https://keycloak/logout',
+    });
+    (cookiesService.getAuthCookie as jest.Mock).mockReturnValue(
+      'refresh-token',
+    );
+    (httpService.post as jest.Mock).mockReturnValue(of({ data: {} }));
+
+    await service.handleLogout(mockRequest, mockResponse);
+
+    const body = (httpService.post as jest.Mock).mock
+      .calls[0][1] as URLSearchParams;
+    expect(body.get('refresh_token')).toBe('refresh-token');
+    expect(body.get('client_secret')).toBeNull();
+    expect(body.get('client_id')).toBeNull();
+  });
+
   it('should return logoutWithIdToken URL when logout fails', async () => {
     const mockRequest = {
       query: {
@@ -105,9 +131,39 @@ describe('PMLogoutService', () => {
     const result = (service as any).logoutWithIdToken(
       request,
       'https://kc/logout',
+      'client-id',
     );
     expect(result).toBe(
       'https://kc/logout?id_token_hint=token123&post_logout_redirect_uri=https%3A%2F%2Fexample.com',
     );
   });
+
+  it('logoutWithIdToken should fall back to client_id when no id token is present', () => {
+    const request = {
+      query: { post_logout_redirect_uri: 'https://example.com' },
+    } as unknown as Request;
+
+    const result = (service as any).logoutWithIdToken(
+      request,
+      'https://kc/logout',
+      'client-id',
+    );
+
+    expect(result).toBe(
+      'https://kc/logout?client_id=client-id&post_logout_redirect_uri=https%3A%2F%2Fexample.com',
+    );
+    expect(result).not.toContain('id_token_hint');
+  });
+
+  it('logoutWithIdToken should omit an absent post logout redirect uri', () => {
+    const request = { query: {} } as unknown as Request;
+
+    const result = (service as any).logoutWithIdToken(
+      request,
+      'https://kc/logout',
+      'client-id',
+    );
+
+    expect(result).toBe('https://kc/logout?client_id=client-id');
+  });
 });

package/src/portal-options/logout-callback.service.ts

@@ -29,14 +29,20 @@ export class PMLogoutService implements LogoutCallback {
       const refreshToken = this.cookiesService.getAuthCookie(request);
 
       const body = new URLSearchParams({
-        client_id: authConfig.clientId,
-        client_secret: authConfig.clientSecret,
         refresh_token: refreshToken,
       });
 
+      // Client credentials go in the Authorization header, not the form body:
+      // the client is registered with token_endpoint_auth_method
+      // client_secret_basic, and an IdP that enforces it rejects credentials
+      // sent as form parameters with unauthorized_client.
       await firstValueFrom(
         this.httpService.post(authConfig.endSessionUrl, body, {
           headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          auth: {
+            username: authConfig.clientId,
+            password: authConfig.clientSecret,
+          },
         }),
       );
     } catch (error: any) {
@@ -45,16 +51,36 @@ export class PMLogoutService implements LogoutCallback {
         error?.response?.data || error.message,
       );
       this.logger.warn('Trying to log out with the id token');
-      return this.logoutWithIdToken(request, authConfig.endSessionUrl);
+      return this.logoutWithIdToken(
+        request,
+        authConfig.endSessionUrl,
+        authConfig.clientId,
+      );
     }
   }
 
-  private logoutWithIdToken(request: Request, endSessionUrl: string) {
+  private logoutWithIdToken(
+    request: Request,
+    endSessionUrl: string,
+    clientId: string,
+  ) {
     const { id_token_hint, post_logout_redirect_uri } = request.query;
-    const params = new URLSearchParams({
-      id_token_hint: String(id_token_hint || ''),
-      post_logout_redirect_uri: String(post_logout_redirect_uri || ''),
-    });
+    const params = new URLSearchParams();
+
+    // RP-initiated logout honours post_logout_redirect_uri only together with
+    // id_token_hint or client_id. An empty id_token_hint is not a no-op: the
+    // IdP rejects the request ("Missing parameters: id_token_hint") and the
+    // user is stranded on an error page instead of being signed out.
+    if (id_token_hint) {
+      params.set('id_token_hint', String(id_token_hint));
+    } else {
+      params.set('client_id', clientId);
+    }
+
+    if (post_logout_redirect_uri) {
+      params.set('post_logout_redirect_uri', String(post_logout_redirect_uri));
+    }
+
     return `${endSessionUrl}?${params}`;
   }
 }

package/src/portal-options/service-providers/content-configuration-service-providers.service.spec.ts

@@ -1,4 +1,5 @@
 import { RequestContext } from '../pm-request-context-provider.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
 import { ContentConfigurationServiceProvidersService } from './content-configuration-service-providers.service.js';
 import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { GraphQLClient } from 'graphql-request';
@@ -18,9 +19,15 @@ describe('ContentConfigurationServiceProvidersService', () => {
   let service: ContentConfigurationServiceProvidersService;
   let mockClient: jest.Mocked<GraphQLClient>;
   let context: RequestContext;
+  let permissionsProxyService: jest.Mocked<PermissionsProxyService>;
 
   beforeEach(() => {
-    service = new ContentConfigurationServiceProvidersService();
+    permissionsProxyService = {
+      resolvePermissions: jest.fn().mockResolvedValue([]),
+    } as unknown as jest.Mocked<PermissionsProxyService>;
+    service = new ContentConfigurationServiceProvidersService(
+      permissionsProxyService,
+    );
     mockClient = new GraphQLClient('') as any;
     (GraphQLClient as jest.Mock).mockReturnValue(mockClient);
     context = {

package/src/portal-options/service-providers/content-configuration-service-providers.service.ts

@@ -1,8 +1,3 @@
-import { RequestContext } from '../pm-request-context-provider.js';
-import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
-import { contentConfigurationsQuery } from './contentconfigurations-query.js';
-import { ContentConfigurationQueryResponse } from './models/contentconfigurations.js';
-import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { Injectable } from '@nestjs/common';
 import {
   ContentConfiguration,
@@ -10,9 +5,17 @@ import {
   ServiceProviderService,
 } from '@openmfp/portal-server-lib';
 import { GraphQLClient } from 'graphql-request';
+import { RequestContext } from '../pm-request-context-provider.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
+import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
+import { contentConfigurationsQuery } from './contentconfigurations-query.js';
+import { ContentConfigurationQueryResponse } from './models/contentconfigurations.js';
+import { welcomeNodeConfig } from './models/welcome-node-config.js';
 
 @Injectable()
 export class ContentConfigurationServiceProvidersService implements ServiceProviderService {
+  constructor(private permissionsProxyService: PermissionsProxyService) {}
+
   async getServiceProviders(
     token: string,
     entities: string[],
@@ -31,7 +34,7 @@ export class ContentConfigurationServiceProvidersService implements ServiceProvi
       throw new Error('Context with organization is required');
     }
 
-    let url = context.crdGatewayApiUrl.replace(
+    let url = context.crdGatewayApiUrl!.replace(
       'kubernetes-graphql-gateway/root',
       'kubernetes-graphql-gateway/virtual-workspace/contentconfigurations/root',
     );
@@ -112,6 +115,13 @@ export class ContentConfigurationServiceProvidersService implements ServiceProvi
             }
           });
 
+      const nodesPermissions = await this.permissionsProxyService.resolvePermissions(
+        token,
+        context.organization,
+        accountPath ?? '',
+        contentConfigurations,
+      );
+
       return {
         rawServiceProviders: [
           {
@@ -119,6 +129,7 @@ export class ContentConfigurationServiceProvidersService implements ServiceProvi
             displayName: '',
             creationTimestamp: '',
             contentConfiguration: contentConfigurations,
+            nodeContext: { nodesPermissions },
           },
         ],
       };

package/src/portal-options/service-providers/kubernetes-service-providers.service.spec.ts

@@ -1,5 +1,6 @@
 import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
 import { KcpKubernetesService } from '../services/kcp-k8s.service.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
 import { KubernetesServiceProvidersService } from './kubernetes-service-providers.service.js';
 import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { Test, TestingModule } from '@nestjs/testing';
@@ -34,6 +35,7 @@ jest.mock('@kubernetes/client-node/dist/gen/middleware.js', () => ({
 describe('KubernetesServiceProvidersService', () => {
   let service: KubernetesServiceProvidersService;
   let kcpKubernetesServiceMock: jest.Mocked<KcpKubernetesService>;
+  let permissionsProxyServiceMock: jest.Mocked<PermissionsProxyService>;
 
   const mockToken = 'test-token-123';
   const mockEntities = ['test-entity'];
@@ -44,6 +46,9 @@ describe('KubernetesServiceProvidersService', () => {
 
   beforeEach(async () => {
     kcpKubernetesServiceMock = mock<KcpKubernetesService>();
+    permissionsProxyServiceMock = {
+      resolvePermissions: jest.fn().mockResolvedValue([]),
+    } as unknown as jest.Mocked<PermissionsProxyService>;
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [
@@ -52,6 +57,10 @@ describe('KubernetesServiceProvidersService', () => {
           provide: KcpKubernetesService,
           useValue: kcpKubernetesServiceMock,
         },
+        {
+          provide: PermissionsProxyService,
+          useValue: permissionsProxyServiceMock,
+        },
       ],
     }).compile();
 
@@ -443,7 +452,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,
@@ -477,7 +486,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,
@@ -524,7 +533,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,
@@ -560,7 +569,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,

package/src/portal-options/service-providers/kubernetes-service-providers.service.ts

@@ -1,17 +1,21 @@
-import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
-import { KcpKubernetesService } from '../services/kcp-k8s.service.js';
-import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
-import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { Injectable } from '@nestjs/common';
 import {
   ContentConfiguration,
   ServiceProviderResponse,
   ServiceProviderService,
 } from '@openmfp/portal-server-lib';
+import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
+import { KcpKubernetesService } from '../services/kcp-k8s.service.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
+import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
+import { welcomeNodeConfig } from './models/welcome-node-config.js';
 
 @Injectable()
 export class KubernetesServiceProvidersService implements ServiceProviderService {
-  constructor(private kcpKubernetesService: KcpKubernetesService) {}
+  constructor(
+    private kcpKubernetesService: KcpKubernetesService,
+    private permissionsProxyService: PermissionsProxyService,
+  ) {}
 
   async getServiceProviders(
     token: string,
@@ -30,7 +34,7 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
     if (!context?.organization) {
       throw new Error('Context with organization is required');
     }
-
+    
     const response = await this.listContentConfigurationsForEntity(
       token,
       context as K8sRequestContext,
@@ -62,6 +66,15 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
         return contentConfiguration;
       });
 
+    const accountPath =
+      context?.accountPath ?? context?.['core_platform-mesh_io_account'] ?? '';
+    const nodesPermissions = await this.permissionsProxyService.resolvePermissions(
+      token,
+      context.organization,
+      accountPath,
+      contentConfigurations,
+    );
+
     return {
       rawServiceProviders: [
         {
@@ -69,6 +82,7 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
           displayName: '',
           creationTimestamp: '',
           contentConfiguration: contentConfigurations,
+          nodeContext: { nodesPermissions },
         },
       ],
     };
@@ -90,12 +104,11 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
         context,
         token,
       );
-    } catch (error) {
+    } catch (error: any) {
       console.error(error);
 
       if (error.code == 429 || error.statusCode == 429) {
         await new Promise((resolve) => setTimeout(resolve, 1000));
-        console.log('Retry after 1 second reading kubernetes resources.');
         return await this.kcpKubernetesService.listClusterCustomObjectInKcpVirtualWorkspace(
           gvr,
           context,