@platform-mesh/portal-server-lib 0.9.95 → 0.9.97

package/src/portal-options/services/permissions/permissions.controller.spec.ts

@@ -0,0 +1,143 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { HeaderParserService } from '@openmfp/portal-server-lib';
+import { Test, TestingModule } from '@nestjs/testing';
+import { mock } from 'jest-mock-extended';
+import { PermissionsController } from './permissions.controller.js';
+import { PermissionsProxyService } from './permissions-proxy.service.js';
+import { AuthorizationRequest, Permission } from './models/permissions.model.js';
+
+function makeBody(
+  overrides: Partial<AuthorizationRequest> = {},
+): AuthorizationRequest {
+  return {
+    token: 'ignored-body-token',
+    organization: 'my-org',
+    accountPath: 'sub-path',
+    checks: [
+      {
+        resource: 'HttpBins',
+        group: 'example.com',
+        namespace: 'default',
+        name: 'my-bin',
+        actions: ['get', 'delete'],
+      },
+    ],
+    ...overrides,
+  };
+}
+
+const request = {} as Request;
+
+describe('PermissionsController', () => {
+  let controller: PermissionsController;
+  let proxyService: jest.Mocked<PermissionsProxyService>;
+  let headerParser: jest.Mocked<HeaderParserService>;
+
+  beforeEach(async () => {
+    proxyService = mock<PermissionsProxyService>();
+    headerParser = mock<HeaderParserService>();
+    headerParser.extractBearerToken.mockReturnValue('header-token');
+
+    const module: TestingModule = await Test.createTestingModule({
+      controllers: [PermissionsController],
+      providers: [
+        { provide: PermissionsProxyService, useValue: proxyService },
+        { provide: HeaderParserService, useValue: headerParser },
+      ],
+    }).compile();
+
+    controller = module.get(PermissionsController);
+  });
+
+  describe('checkResource', () => {
+    it('extracts the token from the request header and forwards it to the proxy', async () => {
+      proxyService.checkResourceInstance.mockResolvedValue([]);
+
+      const body = makeBody();
+      await controller.checkResource(request, body);
+
+      expect(headerParser.extractBearerToken).toHaveBeenCalledWith(request);
+      expect(proxyService.checkResourceInstance).toHaveBeenCalledWith({
+        ...body,
+        token: 'header-token',
+      });
+    });
+
+    it('overrides any token present in the body with the header token', async () => {
+      proxyService.checkResourceInstance.mockResolvedValue([]);
+
+      await controller.checkResource(request, makeBody({ token: 'body-token' }));
+
+      const passedReq = proxyService.checkResourceInstance.mock.calls[0][0];
+      expect(passedReq.token).toBe('header-token');
+    });
+
+    it('throws UnauthorizedException when no bearer token is present', async () => {
+      headerParser.extractBearerToken.mockReturnValue(undefined);
+
+      await expect(
+        controller.checkResource(request, makeBody()),
+      ).rejects.toBeInstanceOf(UnauthorizedException);
+
+      expect(proxyService.checkResourceInstance).not.toHaveBeenCalled();
+    });
+
+    it('returns the proxy result when defined', async () => {
+      const proxyResult: Permission[] = [
+        {
+          resource: 'HttpBin',
+          namespace: 'default',
+          name: 'my-bin',
+          actions: ['get', 'delete'],
+        },
+      ];
+      proxyService.checkResourceInstance.mockResolvedValue(proxyResult);
+
+      const result = await controller.checkResource(request, makeBody());
+
+      expect(result).toEqual(proxyResult);
+    });
+
+    it('returns empty array when proxy returns undefined (fail-open)', async () => {
+      proxyService.checkResourceInstance.mockResolvedValue(undefined);
+
+      const result = await controller.checkResource(request, makeBody());
+
+      expect(result).toEqual([]);
+    });
+
+    it('returns empty array when proxy returns empty array', async () => {
+      proxyService.checkResourceInstance.mockResolvedValue([]);
+
+      const result = await controller.checkResource(request, makeBody());
+
+      expect(result).toEqual([]);
+    });
+
+    it('returns multiple Permission entries from proxy', async () => {
+      const permissions: Permission[] = [
+        { resource: 'HttpBin', namespace: 'default', name: 'bin-1', actions: ['get'] },
+        { resource: 'HttpBin', namespace: 'other', name: 'bin-2', actions: ['delete'] },
+      ];
+      proxyService.checkResourceInstance.mockResolvedValue(permissions);
+
+      const result = await controller.checkResource(request, makeBody());
+
+      expect(result).toHaveLength(2);
+      expect(result).toEqual(permissions);
+    });
+
+    it('passes checks array from body unchanged to proxy', async () => {
+      proxyService.checkResourceInstance.mockResolvedValue([]);
+
+      const body = makeBody({
+        checks: [{ resource: 'Foos', group: 'foo', actions: ['list'] }],
+      });
+      await controller.checkResource(request, body);
+
+      const passedReq = proxyService.checkResourceInstance.mock.calls[0][0];
+      expect(passedReq.checks[0].resource).toBe('Foos');
+      expect(passedReq.checks[0].actions).toEqual(['list']);
+    });
+  });
+});

package/src/portal-options/services/permissions/permissions.controller.ts

@@ -0,0 +1,31 @@
+import { Body, Controller, Post, Req, UnauthorizedException } from '@nestjs/common';
+import { HeaderParserService } from '@openmfp/portal-server-lib';
+import { AuthorizationRequest, Permission } from './models/permissions.model.js';
+import { PermissionsProxyService } from './permissions-proxy.service.js';
+
+@Controller('rest/permissions')
+export class PermissionsController {
+  constructor(
+    private readonly permissionsProxyService: PermissionsProxyService,
+    private readonly headerParser: HeaderParserService,
+  ) {}
+
+  @Post('resource-check')
+  async checkResource(
+    @Req() request: Request,
+    @Body() body: AuthorizationRequest,
+  ): Promise<Permission[]> {
+    const token = this.headerParser.extractBearerToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException();
+    }
+
+    const result = await this.permissionsProxyService.checkResourceInstance({
+      ...body,
+      token,
+    });
+
+    return result ?? [];
+  }
+}

package/src/portal-options/utils/account-hierarchy-resolver.ts

@@ -8,7 +8,7 @@ export const updateEntityTypeFromAccountPath = (
   accountPath: string,
 ): ContentConfiguration => {
   contentConfiguration.luigiConfigFragment.data.nodes.forEach((node) => {
-    if (!node.entityType.includes(ACCOUNT_ENTITY_TYPE)) {
+    if (!node.entityType?.includes(ACCOUNT_ENTITY_TYPE)) {
       return;
     }
 
@@ -31,8 +31,9 @@ export const updateAccountNodeChildren = (
   contentConfiguration: ContentConfiguration,
   accountPath: string,
 ): ContentConfiguration => {
-  const accountChildrenNode =
-    contentConfiguration.luigiConfigFragment.data.nodes[0]?.children?.[0];
+  const children =
+    contentConfiguration.luigiConfigFragment.data.nodes[0]?.children;
+  const accountChildrenNode = Array.isArray(children) ? children[0] : undefined;
 
   if (accountChildrenNode) {
     const nextHierarchyLevel =
@@ -40,11 +41,13 @@ export const updateAccountNodeChildren = (
     const previousPathSegment = accountChildrenNode.pathSegment;
     const nextPathSegment = `:${nextHierarchyLevel}_${ACCOUNT_ENTITY_TYPE}Id`;
 
-    replaceStringDeep(
-      accountChildrenNode,
-      previousPathSegment,
-      nextPathSegment,
-    );
+    if (previousPathSegment) {
+      replaceStringDeep(
+        accountChildrenNode,
+        previousPathSegment,
+        nextPathSegment,
+      );
+    }
   }
 
   return contentConfiguration;
@@ -62,4 +65,6 @@ export const processContentConfigurationForAccountHierarchy = (
 
     return updateEntityTypeFromAccountPath(contentConfiguration, accountPath);
   }
+
+  return contentConfiguration;
 };

package/src/portal-options/utils/build-workspace-path.util.spec.ts

@@ -0,0 +1,59 @@
+import { buildWorkspacePath } from './build-workspace-path.util.js';
+
+describe('buildWorkspacePath', () => {
+  it('returns the root when no segments are provided', () => {
+    expect(buildWorkspacePath()).toBe('root:orgs');
+  });
+
+  it('returns the root for an empty segments array', () => {
+    expect(buildWorkspacePath([])).toBe('root:orgs');
+  });
+
+  it('appends a single organization segment', () => {
+    expect(buildWorkspacePath(['orgX'])).toBe('root:orgs:orgX');
+  });
+
+  it('appends organization and account segments in order', () => {
+    expect(buildWorkspacePath(['org', 'account'])).toBe(
+      'root:orgs:org:account',
+    );
+  });
+
+  it('skips a leading undefined organization and keeps the account', () => {
+    expect(buildWorkspacePath([undefined, 'accY'])).toBe('root:orgs:accY');
+  });
+
+  it('skips a trailing undefined account and keeps the organization', () => {
+    expect(buildWorkspacePath(['orgX', undefined])).toBe('root:orgs:orgX');
+  });
+
+  it('treats a composite path segment verbatim as one segment', () => {
+    expect(buildWorkspacePath(['sub:a'])).toBe('root:orgs:sub:a');
+  });
+
+  it('appends a composite account path segment after the root', () => {
+    expect(buildWorkspacePath(['acc1:acc2'])).toBe('root:orgs:acc1:acc2');
+  });
+
+  it('skips empty-string, null and undefined segments', () => {
+    expect(buildWorkspacePath(['', null, undefined])).toBe('root:orgs');
+    expect(buildWorkspacePath(['org', '', 'acc'])).toBe('root:orgs:org:acc');
+  });
+
+  describe('call-site parity', () => {
+    it('matches kcp-k8s buildWorkspacePath([organization, account])', () => {
+      expect(buildWorkspacePath(['org1', 'acc1'])).toBe('root:orgs:org1:acc1');
+      expect(buildWorkspacePath(['org1', undefined])).toBe('root:orgs:org1');
+      expect(buildWorkspacePath([undefined, undefined])).toBe('root:orgs');
+    });
+
+    it('matches authz-webhook buildWorkspacePath([organization, accountPath])', () => {
+      // organization + composite accountPath → both joined
+      expect(buildWorkspacePath(['org', 'acc1:acc2'])).toBe(
+        'root:orgs:org:acc1:acc2',
+      );
+      // accountPath empty → only organization
+      expect(buildWorkspacePath(['my-org', ''])).toBe('root:orgs:my-org');
+    });
+  });
+});

package/src/portal-options/utils/build-workspace-path.util.ts

@@ -0,0 +1,21 @@
+/**
+ * Builds a KCP workspace/cluster path rooted at `root:orgs`.
+ *
+ * Truthy segments are appended in order, each prefixed with `:`. Empty,
+ * `undefined` or `null` segments are skipped. A segment may itself be a
+ * composite path (e.g. `sub:a`) — it is appended verbatim as a single segment,
+ * so `['org', 'account']` yields `root:orgs:org:account` while `['sub:a']`
+ * yields `root:orgs:sub:a`.
+ *
+ * This is the minimal common abstraction shared by the two call sites:
+ *  - kcp-k8s: `buildWorkspacePath([organization, account])`
+ *  - authz-webhook: `buildWorkspacePath([organization, accountPath])`
+ */
+export function buildWorkspacePath(
+  segments: (string | undefined | null)[] = [],
+): string {
+  return segments.reduce<string>(
+    (path, segment) => (segment ? `${path}:${segment}` : path),
+    'root:orgs',
+  );
+}

package/src/portal-options/utils/extract-resource-definitions.util.spec.ts

@@ -0,0 +1,303 @@
+import { ContentConfiguration } from '@openmfp/portal-server-lib';
+import { PermissionsDefinition } from '../services/permissions/models/permissions.model.js';
+import { extractResourceDefinitions } from './extract-resource-definitions.util.js';
+
+function makeCC(
+  nodes: ContentConfiguration['luigiConfigFragment']['data']['nodes'] = [],
+): ContentConfiguration {
+  return {
+    name: 'test',
+    creationTimestamp: '',
+    luigiConfigFragment: { data: { nodes } },
+  };
+}
+
+function makePd(
+  overrides: Partial<PermissionsDefinition> = {},
+): PermissionsDefinition {
+  return {
+    group: 'core.platform-mesh.io',
+    resource: 'Accounts',
+    entityActions: ['get', 'update', 'delete'],
+    resourceActions: ['create', 'list'],
+    entityContextKey: 'entityName',
+    ...overrides,
+  };
+}
+
+describe('extractResourceDefinitions', () => {
+  it('returns empty array for empty content configurations', () => {
+    expect(extractResourceDefinitions([])).toEqual([]);
+  });
+
+  it('returns empty array when no nodes have resourceDefinition', () => {
+    const result = extractResourceDefinitions([makeCC([{ context: {} }])]);
+    expect(result).toEqual([]);
+  });
+
+  it('ignores resourceDefinition without entity', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              permissionsDefinition: makePd(),
+            },
+          },
+        },
+      ]),
+    ]);
+    expect(result).toEqual([]);
+  });
+
+  it('ignores resourceDefinition with entity but without permissionsDefinition', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Foo',
+            },
+          },
+        },
+      ]),
+    ]);
+    expect(result).toEqual([]);
+  });
+
+  it('collects resourceDefinition that has entity and permissionsDefinition', () => {
+    const pd = makePd();
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Account',
+              permissionsDefinition: pd,
+            },
+          },
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      entity: 'Account',
+      permissionsDefinition: pd,
+    });
+  });
+
+  it('merges duplicate entities across nodes, set-deduping resourceActions', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Account',
+              permissionsDefinition: makePd({
+                resourceActions: ['create', 'list'],
+              }),
+            },
+          },
+        },
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Account',
+              permissionsDefinition: makePd({
+                resourceActions: ['list', 'watch'],
+              }),
+            },
+          },
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].entity).toBe('Account');
+    // 'list' appears in both → deduplicated
+    expect(result[0].permissionsDefinition?.resourceActions).toEqual([
+      'create',
+      'list',
+      'watch',
+    ]);
+  });
+
+  it('merges duplicate entities across content configurations, set-deduping resourceActions', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Pod',
+              permissionsDefinition: makePd({
+                resource: 'Pods',
+                resourceActions: ['list', 'create'],
+              }),
+            },
+          },
+        },
+      ]),
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Pod',
+              permissionsDefinition: makePd({
+                resource: 'Pods',
+                resourceActions: ['create', 'watch'],
+              }),
+            },
+          },
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].permissionsDefinition?.resourceActions).toEqual([
+      'list',
+      'create',
+      'watch',
+    ]);
+  });
+
+  it('keeps the latest permissionsDefinition fields when merging duplicates', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Account',
+              permissionsDefinition: makePd({ group: 'old.group' }),
+            },
+          },
+        },
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Account',
+              permissionsDefinition: makePd({ group: 'new.group' }),
+            },
+          },
+        },
+      ]),
+    ]);
+
+    expect(result[0].permissionsDefinition?.group).toBe('new.group');
+  });
+
+  it('collects resource definitions from nested children nodes', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {},
+          children: [
+            {
+              context: {
+                resourceDefinition: {
+                  entity: 'NestedEntity',
+                  permissionsDefinition: makePd(),
+                },
+              },
+            },
+          ],
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].entity).toBe('NestedEntity');
+  });
+
+  it('handles deeply nested children nodes', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {},
+          children: [
+            {
+              context: {},
+              children: [
+                {
+                  context: {
+                    resourceDefinition: {
+                      entity: 'DeepEntity',
+                      permissionsDefinition: makePd(),
+                    },
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].entity).toBe('DeepEntity');
+  });
+
+  it('collects definitions from multiple content configurations', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Alpha',
+              permissionsDefinition: makePd({ resource: 'Alphas' }),
+            },
+          },
+        },
+      ]),
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Beta',
+              permissionsDefinition: makePd({ resource: 'Betas' }),
+            },
+          },
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(2);
+    const entities = result.map((r) => r.entity);
+    expect(entities).toContain('Alpha');
+    expect(entities).toContain('Beta');
+  });
+
+  it('handles content configurations with null or missing nodes gracefully', () => {
+    const noNodes = {
+      name: 'empty',
+      creationTimestamp: '',
+      luigiConfigFragment: { data: {} },
+    } as unknown as ContentConfiguration;
+
+    expect(() => extractResourceDefinitions([noNodes])).not.toThrow();
+    expect(extractResourceDefinitions([noNodes])).toEqual([]);
+  });
+
+  it('treats an undefined resourceActions as an empty list when merging', () => {
+    const result = extractResourceDefinitions([
+      makeCC([
+        {
+          context: {
+            resourceDefinition: {
+              entity: 'Account',
+              permissionsDefinition: {
+                group: 'g',
+                resource: 'Accounts',
+                entityActions: ['get'],
+                entityContextKey: 'entityName',
+              } as unknown as PermissionsDefinition,
+            },
+          },
+        },
+      ]),
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0].permissionsDefinition?.resourceActions).toEqual([]);
+  });
+});

package/src/portal-options/utils/extract-resource-definitions.util.ts

@@ -0,0 +1,62 @@
+import { ContentConfiguration } from '@openmfp/portal-server-lib';
+import { PermissionsDefinition } from '../services/permissions/models/permissions.model.js';
+
+export interface ResourceDefinitionLocal {
+  entity: string;
+  permissionsDefinition?: PermissionsDefinition;
+}
+
+function mergeResourceActions(
+  existing: string[] | undefined,
+  incoming: string[] | undefined,
+): string[] {
+  return [...new Set([...(existing ?? []), ...(incoming ?? [])])];
+}
+
+function collectFromNodes(
+  nodes: ContentConfiguration['luigiConfigFragment']['data']['nodes'],
+  acc: Map<string, ResourceDefinitionLocal>,
+): void {
+  for (const node of nodes) {
+    const rd = node.context?.['resourceDefinition'] as
+      | ResourceDefinitionLocal
+      | undefined;
+
+    if (rd?.entity !== undefined && rd.permissionsDefinition !== undefined) {
+      const existing = acc.get(rd.entity);
+
+      // Keep the latest permissionsDefinition, but union its resourceActions
+      // with the previously collected one's (dedupe across duplicate entities).
+      acc.set(rd.entity, {
+        ...rd,
+        permissionsDefinition: {
+          ...rd.permissionsDefinition,
+          resourceActions: mergeResourceActions(
+            existing?.permissionsDefinition?.resourceActions,
+            rd.permissionsDefinition.resourceActions,
+          ),
+        },
+      });
+    }
+
+    const children = node.children;
+    if (Array.isArray(children) && children.length > 0) {
+      collectFromNodes(children, acc);
+    }
+  }
+}
+
+export function extractResourceDefinitions(
+  contentConfigurations: ContentConfiguration[],
+): ResourceDefinitionLocal[] {
+  const acc = new Map<string, ResourceDefinitionLocal>();
+
+  for (const cc of contentConfigurations) {
+    const nodes = cc.luigiConfigFragment?.data?.nodes;
+    if (Array.isArray(nodes)) {
+      collectFromNodes(nodes, acc);
+    }
+  }
+
+  return Array.from(acc.values());
+}

package/tsconfig.json

@@ -13,6 +13,7 @@
     "emitDecoratorMetadata": true,
     "experimentalDecorators": true,
     "sourceMap": true,
-    "skipLibCheck": true
+    "skipLibCheck": true,
+    "types": ["jest"]
   },
 }