@spotify/backstage-plugin-rbac-common 0.5.13 → 0.5.14

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @spotify/backstage-plugin-rbac-common
 
+## 0.5.14
+
+### Patch Changes
+
+- Updated dependency `uuid` to `^10.0.0`.
+- Added additional plugin metadata to `package.json`.
+- Upgraded Backstage to v1.28.2
+
 ## 0.5.13
 
 ### Patch Changes

package/dist/api.esm.js

@@ -0,0 +1,2 @@
+import{z as e}from"zod";import{PolicyDecisionParser as i,PermissionParser as t}from"./permissionSchema.esm.js";import{PolicyConfigParser as r,PolicyTitleParser as n,PolicyConfigOptionsParser as a,RolesParser as p,RoleDecisionParser as P,PolicyParser as l}from"./schema.esm.js";const c=r,o=r.extend({name:n.optional(),options:a.optional(),roles:p.optional()}),m=e.object({description:e.string().optional(),update:o.optional()}),u=e.object({decision:i,decisionOrigin:e.array(P)}),y=e.object({permission:t,policyConfig:r,roleIds:e.array(e.string())}),b=e.object({id:e.string()}),R=e.object({authorized:e.boolean()}),s=e.object({name:e.string().optional(),type:e.enum(["user","group","all","unknown"]),entityRef:e.string()}),g=e.object({members:e.array(s)}),f=e.object({items:e.array(l),nextCursor:e.string().optional(),prevCursor:e.string().optional(),totalItems:e.number()});export{R as AuthorizeResponseParser,c as CreateDraftRequestParser,b as DraftResponseParser,s as MemberResponseParser,f as PolicyResponseParser,m as PublishVersionRequestParser,g as SearchMemberResponseParser,y as TestPolicyDecisionRequestParser,u as TestPolicyDecisionResponseParser,o as UpdateDraftRequestParser};
+//# sourceMappingURL=api.esm.js.map

package/dist/index.cjs.js

@@ -1,2 +1,2 @@
-"use strict";var e=require("zod"),a=require("@backstage/plugin-permission-common"),u=require("@backstage/catalog-model"),g=require("uuid");const f=(i,s)=>`${i} must be at least ${s} characters`,h=(i,s)=>`${i} must be less than ${s} characters`,b="Untitled policy",U=":backstageUser",R=e.z.object({rule:e.z.string(),params:e.z.record(e.z.any()).optional()}),c=e.z.lazy(()=>e.z.union([e.z.object({allOf:e.z.array(c).nonempty()}).strict(),e.z.object({anyOf:e.z.array(c).nonempty()}).strict(),e.z.object({not:c}).strict(),R])),m=e.z.object({pluginId:e.z.string().min(1).describe("Plugin ID that defines the permission and rules used."),resourceType:e.z.string().min(1).describe("Resource type associated with the conditions used."),conditions:c}),D=e.z.union([e.z.literal("allow"),e.z.literal("deny")]),d=e.z.union([D,m]),C=e.z.union([e.z.literal("*"),e.z.object({name:e.z.string().optional().describe("Name that must match the incoming permission request."),actions:e.z.array(e.z.string()).optional().describe("Actions that must be present on the incoming permission's attributes."),resourceType:e.z.string().min(1).optional().describe("Resource type that must match that of the incoming permission request.")})]),j=e.z.string().default(()=>g.v4().split("-")[0]).describe("ID of the permission."),A=e.z.object({id:j,match:C.describe("Values used to match against the incoming permission request."),decision:d.describe("Authorization result or conditions to send if this role permission applies.")}).refine(({decision:i,match:s})=>N(i)?s!=="*"&&(s==null?void 0:s.resourceType)!==void 0:!0,{path:["match","resourceType"],message:"match.resourceType is required for conditional decisions."}),O=e.z.array(A).superRefine((i,s)=>{const r=y(i,"id");r>=0&&s.addIssue({code:e.z.ZodIssueCode.custom,message:"Permission ids must be unique",path:[r,"id"]})}).describe("Permission decisions used to determine authorization responses."),w=e.z.string().refine(L,{message:"Invalid entity ref for member.",path:[]}).transform(i=>u.stringifyEntityRef(u.parseEntityRef(i,{defaultKind:"group",defaultNamespace:"default"}))),T=e.z.string().default(()=>g.v4().split("-")[0]).describe("ID of the role."),q=e.z.object({name:e.z.string().min(1,{message:f("Role name",1)}).max(1024,{message:h("Role name",1024)}).describe("Name of the role."),id:T,members:e.z.union([e.z.literal("*"),e.z.array(w).min(1)]).describe("Entity references used to map users to this role. These entities don't need to exist in the catalog."),permissions:O}),P=e.z.array(q).default([]).superRefine((i,s)=>{const r=y(i,"name");r>=0&&s.addIssue({code:e.z.ZodIssueCode.custom,message:"Role names must be unique",path:[r,"name"]});const t=y(i,"id");t>=0&&s.addIssue({code:e.z.ZodIssueCode.custom,message:"Role ids must be unique",path:[t,"id"]})}),I=e.z.object({decision:d.describe("The authorization result or conditions the corresponding role resulted in"),roleId:T.describe("The id of the role that resulted in the decision"),rolePermissionId:j.describe("The id of the role permission that resulted in the decisions.")}),z=e.z.string().min(1,{message:f("Policy name",1)}).max(1024,{message:h("Policy name",1024)}).default(b).describe("Name of the policy."),v=e.z.union([e.z.literal("first-match"),e.z.literal("any-allow")]),p=e.z.object({resolutionStrategy:v}).default({resolutionStrategy:"first-match"}),o=e.z.object({name:z,options:p,roles:P}),B=o.default({roles:[]});function L(i){try{return u.parseEntityRef(i,{defaultKind:"group",defaultNamespace:"default"}),!0}catch{return!1}}function y(i,s){let r=0;const t=new Set;for(;r<i.length;){const n=i[r][s];if(t.has(n))return r;t.add(n),r++}return-1}function N(i){return typeof i!="string"}function $(i){const s=Object.entries(i);return s.length===1&&s[0][0]==="allOf"&&Array.isArray(s[0][1])}function V(i){const s=Object.entries(i);return s.length===1&&s[0][0]==="anyOf"&&Array.isArray(s[0][1])}function Z(i){const s=Object.entries(i);return s.length===1&&s[0][0]==="not"&&!Array.isArray(s[0][1])}const M=o.extend({id:e.z.string(),createdAt:e.z.string(),createdBy:e.z.string(),updatedAt:e.z.string(),updatedBy:e.z.string(),description:e.z.string().optional().nullable(),lastPublishedAt:e.z.string().optional().nullable(),lastPublishedBy:e.z.string().optional().nullable(),status:e.z.enum(["draft","active","inactive"])}),x=e.z.object({action:e.z.union([e.z.literal("create"),e.z.literal("read"),e.z.literal("update"),e.z.literal("delete")]).optional()}),K=e.z.union([e.z.object({type:e.z.literal("basic"),name:e.z.string(),attributes:x}),e.z.object({type:e.z.literal("resource"),name:e.z.string(),attributes:x,resourceType:e.z.string()})]),l=e.z.lazy(()=>e.z.object({rule:e.z.string(),resourceType:e.z.string(),params:e.z.record(e.z.any()).optional()}).or(e.z.object({anyOf:e.z.array(l).nonempty()})).or(e.z.object({allOf:e.z.array(l).nonempty()})).or(e.z.object({not:l}))),W=e.z.object({result:e.z.union([e.z.literal(a.AuthorizeResult.ALLOW),e.z.literal(a.AuthorizeResult.DENY)])}),Y=m.extend({result:e.z.literal(a.AuthorizeResult.CONDITIONAL),conditions:l}),F=e.z.union([W,Y]),G=o,E=o.extend({name:z.optional(),options:p.optional(),roles:P.optional()}),H=e.z.object({description:e.z.string().optional(),update:E.optional()}),J=e.z.object({decision:F,decisionOrigin:e.z.array(I)}),Q=e.z.object({permission:K,policyConfig:o,roleIds:e.z.array(e.z.string())}),X=e.z.object({id:e.z.string()}),_=e.z.object({authorized:e.z.boolean()}),S=e.z.object({name:e.z.string().optional(),type:e.z.enum(["user","group","all","unknown"]),entityRef:e.z.string()}),ee=e.z.object({members:e.z.array(S)}),se=e.z.object({items:e.z.array(M),nextCursor:e.z.string().optional(),prevCursor:e.z.string().optional(),totalItems:e.z.number()}),ie=(i,s)=>s?s===i.name:!0,re=(i,s)=>s?a.isResourcePermission(i)&&s===i.resourceType:!0,te=(i,s)=>s?s.some(r=>r===i.attributes.action):!0,k=(i,s)=>s==="*"?!0:ie(i,s.name)&&re(i,s.resourceType)&&te(i,s.actions),oe=(i,s)=>i.permissions.filter(({match:r})=>k(s,r)),ne=(i,s)=>i.kind!==s.kind||i.namespace!==s.namespace?!1:s.name==="*"?!0:i.name===s.name;function ae(i,s){const r={};if(i)for(const[t,n]of Object.entries(i))r[t]=s(n);return r}exports.AuthorizeResponseParser=_,exports.BackstageUserPlaceholder=U,exports.ConditionalDecisionParser=m,exports.CreateDraftRequestParser=G,exports.DefaultingPolicyConfigParser=B,exports.DraftResponseParser=X,exports.LiteralDecisionParser=D,exports.MemberResponseParser=S,exports.PermissionConditionParser=R,exports.PermissionDecisionParser=d,exports.PermissionMatchParser=C,exports.PolicyConfigOptionsParser=p,exports.PolicyConfigParser=o,exports.PolicyDefaultName=b,exports.PolicyParser=M,exports.PolicyResponseParser=se,exports.PolicyRoleResolutionStrategyParser=v,exports.PolicyTitleParser=z,exports.PublishVersionRequestParser=H,exports.RoleDecisionParser=I,exports.RoleParser=q,exports.RolePermissionParser=A,exports.RolePermissionsParser=O,exports.RolesParser=P,exports.SearchMemberResponseParser=ee,exports.TestPolicyDecisionRequestParser=Q,exports.TestPolicyDecisionResponseParser=J,exports.UpdateDraftRequestParser=E,exports.getMatchingRolePermissions=oe,exports.isAllOfPermissionCriteria=$,exports.isAnyOfPermissionCriteria=V,exports.isConditionalDecision=N,exports.isMatchingPermission=k,exports.isNotPermissionCriteria=Z,exports.mapParams=ae,exports.matchesEntityRef=ne;
+"use strict";var e=require("zod"),a=require("@backstage/plugin-permission-common"),u=require("@backstage/catalog-model"),g=require("uuid");const f=(r,s)=>`${r} must be at least ${s} characters`,h=(r,s)=>`${r} must be less than ${s} characters`,b="Untitled policy",U=":backstageUser",R=e.z.object({rule:e.z.string(),params:e.z.record(e.z.any()).optional()}),c=e.z.lazy(()=>e.z.union([e.z.object({allOf:e.z.array(c).nonempty()}).strict(),e.z.object({anyOf:e.z.array(c).nonempty()}).strict(),e.z.object({not:c}).strict(),R])),m=e.z.object({pluginId:e.z.string().min(1).describe("Plugin ID that defines the permission and rules used."),resourceType:e.z.string().min(1).describe("Resource type associated with the conditions used."),conditions:c}),D=e.z.union([e.z.literal("allow"),e.z.literal("deny")]),d=e.z.union([D,m]),C=e.z.union([e.z.literal("*"),e.z.object({name:e.z.string().optional().describe("Name that must match the incoming permission request."),actions:e.z.array(e.z.string()).optional().describe("Actions that must be present on the incoming permission's attributes."),resourceType:e.z.string().min(1).optional().describe("Resource type that must match that of the incoming permission request.")})]),j=e.z.string().default(()=>g.v4().split("-")[0]).describe("ID of the permission."),A=e.z.object({id:j,match:C.describe("Values used to match against the incoming permission request."),decision:d.describe("Authorization result or conditions to send if this role permission applies.")}).refine(({decision:r,match:s})=>N(r)?s!=="*"&&s?.resourceType!==void 0:!0,{path:["match","resourceType"],message:"match.resourceType is required for conditional decisions."}),O=e.z.array(A).superRefine((r,s)=>{const i=y(r,"id");i>=0&&s.addIssue({code:e.z.ZodIssueCode.custom,message:"Permission ids must be unique",path:[i,"id"]})}).describe("Permission decisions used to determine authorization responses."),w=e.z.string().refine(L,{message:"Invalid entity ref for member.",path:[]}).transform(r=>u.stringifyEntityRef(u.parseEntityRef(r,{defaultKind:"group",defaultNamespace:"default"}))),T=e.z.string().default(()=>g.v4().split("-")[0]).describe("ID of the role."),q=e.z.object({name:e.z.string().min(1,{message:f("Role name",1)}).max(1024,{message:h("Role name",1024)}).describe("Name of the role."),id:T,members:e.z.union([e.z.literal("*"),e.z.array(w).min(1)]).describe("Entity references used to map users to this role. These entities don't need to exist in the catalog."),permissions:O}),P=e.z.array(q).default([]).superRefine((r,s)=>{const i=y(r,"name");i>=0&&s.addIssue({code:e.z.ZodIssueCode.custom,message:"Role names must be unique",path:[i,"name"]});const t=y(r,"id");t>=0&&s.addIssue({code:e.z.ZodIssueCode.custom,message:"Role ids must be unique",path:[t,"id"]})}),I=e.z.object({decision:d.describe("The authorization result or conditions the corresponding role resulted in"),roleId:T.describe("The id of the role that resulted in the decision"),rolePermissionId:j.describe("The id of the role permission that resulted in the decisions.")}),z=e.z.string().min(1,{message:f("Policy name",1)}).max(1024,{message:h("Policy name",1024)}).default(b).describe("Name of the policy."),v=e.z.union([e.z.literal("first-match"),e.z.literal("any-allow")]),p=e.z.object({resolutionStrategy:v}).default({resolutionStrategy:"first-match"}),o=e.z.object({name:z,options:p,roles:P}),B=o.default({roles:[]});function L(r){try{return u.parseEntityRef(r,{defaultKind:"group",defaultNamespace:"default"}),!0}catch{return!1}}function y(r,s){let i=0;const t=new Set;for(;i<r.length;){const n=r[i][s];if(t.has(n))return i;t.add(n),i++}return-1}function N(r){return typeof r!="string"}function $(r){const s=Object.entries(r);return s.length===1&&s[0][0]==="allOf"&&Array.isArray(s[0][1])}function V(r){const s=Object.entries(r);return s.length===1&&s[0][0]==="anyOf"&&Array.isArray(s[0][1])}function Z(r){const s=Object.entries(r);return s.length===1&&s[0][0]==="not"&&!Array.isArray(s[0][1])}const M=o.extend({id:e.z.string(),createdAt:e.z.string(),createdBy:e.z.string(),updatedAt:e.z.string(),updatedBy:e.z.string(),description:e.z.string().optional().nullable(),lastPublishedAt:e.z.string().optional().nullable(),lastPublishedBy:e.z.string().optional().nullable(),status:e.z.enum(["draft","active","inactive"])}),x=e.z.object({action:e.z.union([e.z.literal("create"),e.z.literal("read"),e.z.literal("update"),e.z.literal("delete")]).optional()}),K=e.z.union([e.z.object({type:e.z.literal("basic"),name:e.z.string(),attributes:x}),e.z.object({type:e.z.literal("resource"),name:e.z.string(),attributes:x,resourceType:e.z.string()})]),l=e.z.lazy(()=>e.z.object({rule:e.z.string(),resourceType:e.z.string(),params:e.z.record(e.z.any()).optional()}).or(e.z.object({anyOf:e.z.array(l).nonempty()})).or(e.z.object({allOf:e.z.array(l).nonempty()})).or(e.z.object({not:l}))),W=e.z.object({result:e.z.union([e.z.literal(a.AuthorizeResult.ALLOW),e.z.literal(a.AuthorizeResult.DENY)])}),Y=m.extend({result:e.z.literal(a.AuthorizeResult.CONDITIONAL),conditions:l}),F=e.z.union([W,Y]),G=o,E=o.extend({name:z.optional(),options:p.optional(),roles:P.optional()}),H=e.z.object({description:e.z.string().optional(),update:E.optional()}),J=e.z.object({decision:F,decisionOrigin:e.z.array(I)}),Q=e.z.object({permission:K,policyConfig:o,roleIds:e.z.array(e.z.string())}),X=e.z.object({id:e.z.string()}),_=e.z.object({authorized:e.z.boolean()}),S=e.z.object({name:e.z.string().optional(),type:e.z.enum(["user","group","all","unknown"]),entityRef:e.z.string()}),ee=e.z.object({members:e.z.array(S)}),se=e.z.object({items:e.z.array(M),nextCursor:e.z.string().optional(),prevCursor:e.z.string().optional(),totalItems:e.z.number()}),re=(r,s)=>s?s===r.name:!0,ie=(r,s)=>s?a.isResourcePermission(r)&&s===r.resourceType:!0,te=(r,s)=>s?s.some(i=>i===r.attributes.action):!0,k=(r,s)=>s==="*"?!0:re(r,s.name)&&ie(r,s.resourceType)&&te(r,s.actions),oe=(r,s)=>r.permissions.filter(({match:i})=>k(s,i)),ne=(r,s)=>r.kind!==s.kind||r.namespace!==s.namespace?!1:s.name==="*"?!0:r.name===s.name;function ae(r,s){const i={};if(r)for(const[t,n]of Object.entries(r))i[t]=s(n);return i}exports.AuthorizeResponseParser=_,exports.BackstageUserPlaceholder=U,exports.ConditionalDecisionParser=m,exports.CreateDraftRequestParser=G,exports.DefaultingPolicyConfigParser=B,exports.DraftResponseParser=X,exports.LiteralDecisionParser=D,exports.MemberResponseParser=S,exports.PermissionConditionParser=R,exports.PermissionDecisionParser=d,exports.PermissionMatchParser=C,exports.PolicyConfigOptionsParser=p,exports.PolicyConfigParser=o,exports.PolicyDefaultName=b,exports.PolicyParser=M,exports.PolicyResponseParser=se,exports.PolicyRoleResolutionStrategyParser=v,exports.PolicyTitleParser=z,exports.PublishVersionRequestParser=H,exports.RoleDecisionParser=I,exports.RoleParser=q,exports.RolePermissionParser=A,exports.RolePermissionsParser=O,exports.RolesParser=P,exports.SearchMemberResponseParser=ee,exports.TestPolicyDecisionRequestParser=Q,exports.TestPolicyDecisionResponseParser=J,exports.UpdateDraftRequestParser=E,exports.getMatchingRolePermissions=oe,exports.isAllOfPermissionCriteria=$,exports.isAnyOfPermissionCriteria=V,exports.isConditionalDecision=N,exports.isMatchingPermission=k,exports.isNotPermissionCriteria=Z,exports.mapParams=ae,exports.matchesEntityRef=ne;
 //# sourceMappingURL=index.cjs.js.map