@platform-mesh/portal-server-lib 0.9.96 → 0.9.97

package/dist/portal-options/services/permissions/permissions.controller.js

@@ -0,0 +1,49 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Body, Controller, Post, Req, UnauthorizedException } from '@nestjs/common';
+import { HeaderParserService } from '@openmfp/portal-server-lib';
+import { PermissionsProxyService } from './permissions-proxy.service.js';
+let PermissionsController = class PermissionsController {
+    permissionsProxyService;
+    headerParser;
+    constructor(permissionsProxyService, headerParser) {
+        this.permissionsProxyService = permissionsProxyService;
+        this.headerParser = headerParser;
+    }
+    async checkResource(request, body) {
+        const token = this.headerParser.extractBearerToken(request);
+        if (!token) {
+            throw new UnauthorizedException();
+        }
+        const result = await this.permissionsProxyService.checkResourceInstance({
+            ...body,
+            token,
+        });
+        return result ?? [];
+    }
+};
+__decorate([
+    Post('resource-check'),
+    __param(0, Req()),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Request, Object]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "checkResource", null);
+PermissionsController = __decorate([
+    Controller('rest/permissions'),
+    __metadata("design:paramtypes", [PermissionsProxyService,
+        HeaderParserService])
+], PermissionsController);
+export { PermissionsController };
+//# sourceMappingURL=permissions.controller.js.map

package/dist/portal-options/services/permissions/permissions.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.controller.js","sourceRoot":"","sources":["../../../../src/portal-options/services/permissions/permissions.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEb;IACA;IAFnB,YACmB,uBAAgD,EAChD,YAAiC;QADjC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,iBAAY,GAAZ,YAAY,CAAqB;IACjD,CAAC;IAGE,AAAN,KAAK,CAAC,aAAa,CACV,OAAgB,EACf,IAA0B;QAElC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,CAAC;YACtE,GAAG,IAAI;YACP,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AAjBO;IADL,IAAI,CAAC,gBAAgB,CAAC;IAEpB,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,IAAI,EAAE,CAAA;;qCADS,OAAO;;0DAexB;AAvBU,qBAAqB;IADjC,UAAU,CAAC,kBAAkB,CAAC;qCAGe,uBAAuB;QAClC,mBAAmB;GAHzC,qBAAqB,CAwBjC"}

package/dist/portal-options/utils/account-hierarchy-resolver.js

@@ -2,7 +2,7 @@ import { replaceStringDeep } from './replace-string-deep.js';
 const ACCOUNT_ENTITY_TYPE = 'core_platform-mesh_io_account';
 export const updateEntityTypeFromAccountPath = (contentConfiguration, accountPath) => {
     contentConfiguration.luigiConfigFragment.data.nodes.forEach((node) => {
-        if (!node.entityType.includes(ACCOUNT_ENTITY_TYPE)) {
+        if (!node.entityType?.includes(ACCOUNT_ENTITY_TYPE)) {
             return;
         }
         const accountPathParts = accountPath
@@ -15,12 +15,15 @@ export const updateEntityTypeFromAccountPath = (contentConfiguration, accountPat
     return contentConfiguration;
 };
 export const updateAccountNodeChildren = (contentConfiguration, accountPath) => {
-    const accountChildrenNode = contentConfiguration.luigiConfigFragment.data.nodes[0]?.children?.[0];
+    const children = contentConfiguration.luigiConfigFragment.data.nodes[0]?.children;
+    const accountChildrenNode = Array.isArray(children) ? children[0] : undefined;
     if (accountChildrenNode) {
         const nextHierarchyLevel = accountPath.split(':').filter(Boolean).length + 1;
         const previousPathSegment = accountChildrenNode.pathSegment;
         const nextPathSegment = `:${nextHierarchyLevel}_${ACCOUNT_ENTITY_TYPE}Id`;
-        replaceStringDeep(accountChildrenNode, previousPathSegment, nextPathSegment);
+        if (previousPathSegment) {
+            replaceStringDeep(accountChildrenNode, previousPathSegment, nextPathSegment);
+        }
     }
     return contentConfiguration;
 };
@@ -32,5 +35,6 @@ export const processContentConfigurationForAccountHierarchy = (contentConfigurat
         }
         return updateEntityTypeFromAccountPath(contentConfiguration, accountPath);
     }
+    return contentConfiguration;
 };
 //# sourceMappingURL=account-hierarchy-resolver.js.map

package/dist/portal-options/utils/account-hierarchy-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-hierarchy-resolver.js","sourceRoot":"","sources":["../../../src/portal-options/utils/account-hierarchy-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW;aACjC,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC;aAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CACvC,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,MAAM,mBAAmB,GACvB,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,kBAAkB,GACtB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,WAAW,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;QAE1E,iBAAiB,CACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAC5D,oBAA0C,EAC1C,OAA4B,EACN,EAAE;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7C,yBAAyB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,+BAA+B,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"account-hierarchy-resolver.js","sourceRoot":"","sources":["../../../src/portal-options/utils/account-hierarchy-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW;aACjC,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC;aAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CACvC,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,oBAA0C,EAC1C,WAAmB,EACG,EAAE;IACxB,MAAM,QAAQ,GACZ,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACnE,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,kBAAkB,GACtB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,WAAW,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;QAE1E,IAAI,mBAAmB,EAAE,CAAC;YACxB,iBAAiB,CACf,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAC5D,oBAA0C,EAC1C,OAA4B,EACN,EAAE;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7C,yBAAyB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,+BAA+B,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC,CAAC"}

package/dist/portal-options/utils/build-workspace-path.util.d.ts

@@ -0,0 +1 @@
+export declare function buildWorkspacePath(segments?: (string | undefined | null)[]): string;

package/dist/portal-options/utils/build-workspace-path.util.js

@@ -0,0 +1,4 @@
+export function buildWorkspacePath(segments = []) {
+    return segments.reduce((path, segment) => (segment ? `${path}:${segment}` : path), 'root:orgs');
+}
+//# sourceMappingURL=build-workspace-path.util.js.map

package/dist/portal-options/utils/build-workspace-path.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-workspace-path.util.js","sourceRoot":"","sources":["../../../src/portal-options/utils/build-workspace-path.util.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,kBAAkB,CAChC,WAA0C,EAAE;IAE5C,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAC1D,WAAW,CACZ,CAAC;AACJ,CAAC"}

package/dist/portal-options/utils/extract-resource-definitions.util.d.ts

@@ -0,0 +1,7 @@
+import { ContentConfiguration } from '@openmfp/portal-server-lib';
+import { PermissionsDefinition } from '../services/permissions/models/permissions.model.js';
+export interface ResourceDefinitionLocal {
+    entity: string;
+    permissionsDefinition?: PermissionsDefinition;
+}
+export declare function extractResourceDefinitions(contentConfigurations: ContentConfiguration[]): ResourceDefinitionLocal[];

package/dist/portal-options/utils/extract-resource-definitions.util.js

@@ -0,0 +1,33 @@
+function mergeResourceActions(existing, incoming) {
+    return [...new Set([...(existing ?? []), ...(incoming ?? [])])];
+}
+function collectFromNodes(nodes, acc) {
+    for (const node of nodes) {
+        const rd = node.context?.['resourceDefinition'];
+        if (rd?.entity !== undefined && rd.permissionsDefinition !== undefined) {
+            const existing = acc.get(rd.entity);
+            acc.set(rd.entity, {
+                ...rd,
+                permissionsDefinition: {
+                    ...rd.permissionsDefinition,
+                    resourceActions: mergeResourceActions(existing?.permissionsDefinition?.resourceActions, rd.permissionsDefinition.resourceActions),
+                },
+            });
+        }
+        const children = node.children;
+        if (Array.isArray(children) && children.length > 0) {
+            collectFromNodes(children, acc);
+        }
+    }
+}
+export function extractResourceDefinitions(contentConfigurations) {
+    const acc = new Map();
+    for (const cc of contentConfigurations) {
+        const nodes = cc.luigiConfigFragment?.data?.nodes;
+        if (Array.isArray(nodes)) {
+            collectFromNodes(nodes, acc);
+        }
+    }
+    return Array.from(acc.values());
+}
+//# sourceMappingURL=extract-resource-definitions.util.js.map

package/dist/portal-options/utils/extract-resource-definitions.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-resource-definitions.util.js","sourceRoot":"","sources":["../../../src/portal-options/utils/extract-resource-definitions.util.ts"],"names":[],"mappings":"AAQA,SAAS,oBAAoB,CAC3B,QAA8B,EAC9B,QAA8B;IAE9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAmE,EACnE,GAAyC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAEjC,CAAC;QAEd,IAAI,EAAE,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAIpC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE;gBACjB,GAAG,EAAE;gBACL,qBAAqB,EAAE;oBACrB,GAAG,EAAE,CAAC,qBAAqB;oBAC3B,eAAe,EAAE,oBAAoB,CACnC,QAAQ,EAAE,qBAAqB,EAAE,eAAe,EAChD,EAAE,CAAC,qBAAqB,CAAC,eAAe,CACzC;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,qBAA6C;IAE7C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEvD,KAAK,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,EAAE,CAAC,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platform-mesh/portal-server-lib",
-  "version": "0.9.96",
+  "version": "0.9.97",
   "author": "Platform Mesh",
   "license": "Apache-2.0",
   "publishConfig": {

package/src/portal-options/index.ts

@@ -7,3 +7,7 @@ export * from './service-providers/content-configuration-service-providers.servi
 export * from './service-providers/kubernetes-service-providers.service.js';
 
 export * from './services/kcp-k8s.service.js';
+export * from './services/permissions/adapters/authz-webhook.service.js';
+export * from './services/permissions/models/permissions.model.js';
+export * from './services/permissions/permissions-proxy.service.js';
+export * from './services/permissions/permissions.controller.js';

package/src/portal-options/service-providers/content-configuration-service-providers.service.spec.ts

@@ -1,4 +1,5 @@
 import { RequestContext } from '../pm-request-context-provider.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
 import { ContentConfigurationServiceProvidersService } from './content-configuration-service-providers.service.js';
 import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { GraphQLClient } from 'graphql-request';
@@ -18,9 +19,15 @@ describe('ContentConfigurationServiceProvidersService', () => {
   let service: ContentConfigurationServiceProvidersService;
   let mockClient: jest.Mocked<GraphQLClient>;
   let context: RequestContext;
+  let permissionsProxyService: jest.Mocked<PermissionsProxyService>;
 
   beforeEach(() => {
-    service = new ContentConfigurationServiceProvidersService();
+    permissionsProxyService = {
+      resolvePermissions: jest.fn().mockResolvedValue([]),
+    } as unknown as jest.Mocked<PermissionsProxyService>;
+    service = new ContentConfigurationServiceProvidersService(
+      permissionsProxyService,
+    );
     mockClient = new GraphQLClient('') as any;
     (GraphQLClient as jest.Mock).mockReturnValue(mockClient);
     context = {

package/src/portal-options/service-providers/content-configuration-service-providers.service.ts

@@ -1,8 +1,3 @@
-import { RequestContext } from '../pm-request-context-provider.js';
-import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
-import { contentConfigurationsQuery } from './contentconfigurations-query.js';
-import { ContentConfigurationQueryResponse } from './models/contentconfigurations.js';
-import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { Injectable } from '@nestjs/common';
 import {
   ContentConfiguration,
@@ -10,9 +5,17 @@ import {
   ServiceProviderService,
 } from '@openmfp/portal-server-lib';
 import { GraphQLClient } from 'graphql-request';
+import { RequestContext } from '../pm-request-context-provider.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
+import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
+import { contentConfigurationsQuery } from './contentconfigurations-query.js';
+import { ContentConfigurationQueryResponse } from './models/contentconfigurations.js';
+import { welcomeNodeConfig } from './models/welcome-node-config.js';
 
 @Injectable()
 export class ContentConfigurationServiceProvidersService implements ServiceProviderService {
+  constructor(private permissionsProxyService: PermissionsProxyService) {}
+
   async getServiceProviders(
     token: string,
     entities: string[],
@@ -31,7 +34,7 @@ export class ContentConfigurationServiceProvidersService implements ServiceProvi
       throw new Error('Context with organization is required');
     }
 
-    let url = context.crdGatewayApiUrl.replace(
+    let url = context.crdGatewayApiUrl!.replace(
       'kubernetes-graphql-gateway/root',
       'kubernetes-graphql-gateway/virtual-workspace/contentconfigurations/root',
     );
@@ -112,6 +115,13 @@ export class ContentConfigurationServiceProvidersService implements ServiceProvi
             }
           });
 
+      const nodesPermissions = await this.permissionsProxyService.resolvePermissions(
+        token,
+        context.organization,
+        accountPath ?? '',
+        contentConfigurations,
+      );
+
       return {
         rawServiceProviders: [
           {
@@ -119,6 +129,7 @@ export class ContentConfigurationServiceProvidersService implements ServiceProvi
             displayName: '',
             creationTimestamp: '',
             contentConfiguration: contentConfigurations,
+            nodeContext: { nodesPermissions },
           },
         ],
       };

package/src/portal-options/service-providers/kubernetes-service-providers.service.spec.ts

@@ -1,5 +1,6 @@
 import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
 import { KcpKubernetesService } from '../services/kcp-k8s.service.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
 import { KubernetesServiceProvidersService } from './kubernetes-service-providers.service.js';
 import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { Test, TestingModule } from '@nestjs/testing';
@@ -34,6 +35,7 @@ jest.mock('@kubernetes/client-node/dist/gen/middleware.js', () => ({
 describe('KubernetesServiceProvidersService', () => {
   let service: KubernetesServiceProvidersService;
   let kcpKubernetesServiceMock: jest.Mocked<KcpKubernetesService>;
+  let permissionsProxyServiceMock: jest.Mocked<PermissionsProxyService>;
 
   const mockToken = 'test-token-123';
   const mockEntities = ['test-entity'];
@@ -44,6 +46,9 @@ describe('KubernetesServiceProvidersService', () => {
 
   beforeEach(async () => {
     kcpKubernetesServiceMock = mock<KcpKubernetesService>();
+    permissionsProxyServiceMock = {
+      resolvePermissions: jest.fn().mockResolvedValue([]),
+    } as unknown as jest.Mocked<PermissionsProxyService>;
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [
@@ -52,6 +57,10 @@ describe('KubernetesServiceProvidersService', () => {
           provide: KcpKubernetesService,
           useValue: kcpKubernetesServiceMock,
         },
+        {
+          provide: PermissionsProxyService,
+          useValue: permissionsProxyServiceMock,
+        },
       ],
     }).compile();
 
@@ -443,7 +452,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,
@@ -477,7 +486,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,
@@ -524,7 +533,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,
@@ -560,7 +569,7 @@ describe('KubernetesServiceProvidersService', () => {
       },
     );
 
-    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock);
+    const svc = new KubernetesServiceProvidersService(kcpKubernetesServiceMock, permissionsProxyServiceMock);
     const res = await svc.getServiceProviders('token', ['main'], {
       organization: 'org',
       isSubDomain: true,

package/src/portal-options/service-providers/kubernetes-service-providers.service.ts

@@ -1,17 +1,21 @@
-import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
-import { KcpKubernetesService } from '../services/kcp-k8s.service.js';
-import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
-import { welcomeNodeConfig } from './models/welcome-node-config.js';
 import { Injectable } from '@nestjs/common';
 import {
   ContentConfiguration,
   ServiceProviderResponse,
   ServiceProviderService,
 } from '@openmfp/portal-server-lib';
+import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
+import { KcpKubernetesService } from '../services/kcp-k8s.service.js';
+import { PermissionsProxyService } from '../services/permissions/permissions-proxy.service.js';
+import { processContentConfigurationForAccountHierarchy } from '../utils/account-hierarchy-resolver.js';
+import { welcomeNodeConfig } from './models/welcome-node-config.js';
 
 @Injectable()
 export class KubernetesServiceProvidersService implements ServiceProviderService {
-  constructor(private kcpKubernetesService: KcpKubernetesService) {}
+  constructor(
+    private kcpKubernetesService: KcpKubernetesService,
+    private permissionsProxyService: PermissionsProxyService,
+  ) {}
 
   async getServiceProviders(
     token: string,
@@ -30,7 +34,7 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
     if (!context?.organization) {
       throw new Error('Context with organization is required');
     }
-
+    
     const response = await this.listContentConfigurationsForEntity(
       token,
       context as K8sRequestContext,
@@ -62,6 +66,15 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
         return contentConfiguration;
       });
 
+    const accountPath =
+      context?.accountPath ?? context?.['core_platform-mesh_io_account'] ?? '';
+    const nodesPermissions = await this.permissionsProxyService.resolvePermissions(
+      token,
+      context.organization,
+      accountPath,
+      contentConfigurations,
+    );
+
     return {
       rawServiceProviders: [
         {
@@ -69,6 +82,7 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
           displayName: '',
           creationTimestamp: '',
           contentConfiguration: contentConfigurations,
+          nodeContext: { nodesPermissions },
         },
       ],
     };
@@ -90,12 +104,11 @@ export class KubernetesServiceProvidersService implements ServiceProviderService
         context,
         token,
       );
-    } catch (error) {
+    } catch (error: any) {
       console.error(error);
 
       if (error.code == 429 || error.statusCode == 429) {
         await new Promise((resolve) => setTimeout(resolve, 1000));
-        console.log('Retry after 1 second reading kubernetes resources.');
         return await this.kcpKubernetesService.listClusterCustomObjectInKcpVirtualWorkspace(
           gvr,
           context,

package/src/portal-options/services/kcp-k8s.service.ts

@@ -1,4 +1,5 @@
 import { K8sRequestContext, K8sResourceDescriptor } from '../models/k8s.js';
+import { buildWorkspacePath } from '../utils/build-workspace-path.util.js';
 import { getOrganization } from '../utils/domain.js';
 import {
   CoreV1Api,
@@ -65,20 +66,8 @@ export class KcpKubernetesService {
     return this.k8sCoreV1Api;
   }
 
-  private buildWorkspacePath(organization?: string, account?: string) {
-    let path = `root:orgs`;
-    if (organization) {
-      path += `:${organization}`;
-    }
-    if (account) {
-      path += `:${account}`; // FIXME: how are nested accounts and paths handled in the portal?
-    }
-
-    return path;
-  }
-
   getKcpVirtualWorkspaceUrl(organization: string, account: string) {
-    const path = this.buildWorkspacePath(organization, account);
+    const path = buildWorkspacePath([organization, account]);
     return new URL(
       `${this.baseUrl.origin}/services/contentconfigurations/clusters/${path}`,
     );
@@ -90,14 +79,14 @@ export class KcpKubernetesService {
     workspacePath?: string,
   ) {
     const path =
-      workspacePath || this.buildWorkspacePath(organization, account);
+      workspacePath || buildWorkspacePath([organization, account]);
     return new URL(`${this.baseUrl.origin}/clusters/${path}`);
   }
 
   getKcpWorkspacePublicUrl(request: Request) {
     const organization = getOrganization(request);
     const account = request.query?.['core_platform-mesh_io_account'];
-    const path = this.buildWorkspacePath(organization, account);
+    const path = buildWorkspacePath([organization, account]);
 
     const kcpUrl = process.env.KCP_URL || '';
     if (kcpUrl) {