@spotify/backstage-plugin-rbac-common 0.5.13 → 0.5.14

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{z as e}from"zod";import{AuthorizeResult as l,isResourcePermission as S}from"@backstage/plugin-permission-common";import{stringifyEntityRef as $,parseEntityRef as b}from"@backstage/catalog-model";import{v4 as g}from"uuid";const h=(s,t)=>`${s} must be at least ${t} characters`,P=(s,t)=>`${s} must be less than ${t} characters`,R="Untitled policy",B=":backstageUser",j=e.object({rule:e.string(),params:e.record(e.any()).optional()}),a=e.lazy(()=>e.union([e.object({allOf:e.array(a).nonempty()}).strict(),e.object({anyOf:e.array(a).nonempty()}).strict(),e.object({not:a}).strict(),j])),u=e.object({pluginId:e.string().min(1).describe("Plugin ID that defines the permission and rules used."),resourceType:e.string().min(1).describe("Resource type associated with the conditions used."),conditions:a}),C=e.union([e.literal("allow"),e.literal("deny")]),m=e.union([C,u]),D=e.union([e.literal("*"),e.object({name:e.string().optional().describe("Name that must match the incoming permission request."),actions:e.array(e.string()).optional().describe("Actions that must be present on the incoming permission's attributes."),resourceType:e.string().min(1).optional().describe("Resource type that must match that of the incoming permission request.")})]),A=e.string().default(()=>g().split("-")[0]).describe("ID of the permission."),I=e.object({id:A,match:D.describe("Values used to match against the incoming permission request."),decision:m.describe("Authorization result or conditions to send if this role permission applies.")}).refine(({decision:s,match:t})=>z(s)?t!=="*"&&(t==null?void 0:t.resourceType)!==void 0:!0,{path:["match","resourceType"],message:"match.resourceType is required for conditional decisions."}),O=e.array(I).superRefine((s,t)=>{const i=f(s,"id");i>=0&&t.addIssue({code:e.ZodIssueCode.custom,message:"Permission ids must be unique",path:[i,"id"]})}).describe("Permission decisions used to determine authorization responses."),L=e.string().refine(Z,{message:"Invalid entity ref for member.",path:[]}).transform(s=>$(b(s,{defaultKind:"group",defaultNamespace:"default"}))),T=e.string().default(()=>g().split("-")[0]).describe("ID of the role."),q=e.object({name:e.string().min(1,{message:h("Role name",1)}).max(1024,{message:P("Role name",1024)}).describe("Name of the role."),id:T,members:e.union([e.literal("*"),e.array(L).min(1)]).describe("Entity references used to map users to this role. These entities don't need to exist in the catalog."),permissions:O}),d=e.array(q).default([]).superRefine((s,t)=>{const i=f(s,"name");i>=0&&t.addIssue({code:e.ZodIssueCode.custom,message:"Role names must be unique",path:[i,"name"]});const r=f(s,"id");r>=0&&t.addIssue({code:e.ZodIssueCode.custom,message:"Role ids must be unique",path:[r,"id"]})}),N=e.object({decision:m.describe("The authorization result or conditions the corresponding role resulted in"),roleId:T.describe("The id of the role that resulted in the decision"),rolePermissionId:A.describe("The id of the role permission that resulted in the decisions.")}),p=e.string().min(1,{message:h("Policy name",1)}).max(1024,{message:P("Policy name",1024)}).default(R).describe("Name of the policy."),x=e.union([e.literal("first-match"),e.literal("any-allow")]),y=e.object({resolutionStrategy:x}).default({resolutionStrategy:"first-match"}),o=e.object({name:p,options:y,roles:d}),U=o.default({roles:[]});function Z(s){try{return b(s,{defaultKind:"group",defaultNamespace:"default"}),!0}catch{return!1}}function f(s,t){let i=0;const r=new Set;for(;i<s.length;){const n=s[i][t];if(r.has(n))return i;r.add(n),i++}return-1}function z(s){return typeof s!="string"}function K(s){const t=Object.entries(s);return t.length===1&&t[0][0]==="allOf"&&Array.isArray(t[0][1])}function V(s){const t=Object.entries(s);return t.length===1&&t[0][0]==="anyOf"&&Array.isArray(t[0][1])}function W(s){const t=Object.entries(s);return t.length===1&&t[0][0]==="not"&&!Array.isArray(t[0][1])}const v=o.extend({id:e.string(),createdAt:e.string(),createdBy:e.string(),updatedAt:e.string(),updatedBy:e.string(),description:e.string().optional().nullable(),lastPublishedAt:e.string().optional().nullable(),lastPublishedBy:e.string().optional().nullable(),status:e.enum(["draft","active","inactive"])}),k=e.object({action:e.union([e.literal("create"),e.literal("read"),e.literal("update"),e.literal("delete")]).optional()}),Y=e.union([e.object({type:e.literal("basic"),name:e.string(),attributes:k}),e.object({type:e.literal("resource"),name:e.string(),attributes:k,resourceType:e.string()})]),c=e.lazy(()=>e.object({rule:e.string(),resourceType:e.string(),params:e.record(e.any()).optional()}).or(e.object({anyOf:e.array(c).nonempty()})).or(e.object({allOf:e.array(c).nonempty()})).or(e.object({not:c}))),F=e.object({result:e.union([e.literal(l.ALLOW),e.literal(l.DENY)])}),G=u.extend({result:e.literal(l.CONDITIONAL),conditions:c}),H=e.union([F,G]),J=o,w=o.extend({name:p.optional(),options:y.optional(),roles:d.optional()}),Q=e.object({description:e.string().optional(),update:w.optional()}),X=e.object({decision:H,decisionOrigin:e.array(N)}),_=e.object({permission:Y,policyConfig:o,roleIds:e.array(e.string())}),ee=e.object({id:e.string()}),te=e.object({authorized:e.boolean()}),E=e.object({name:e.string().optional(),type:e.enum(["user","group","all","unknown"]),entityRef:e.string()}),se=e.object({members:e.array(E)}),ie=e.object({items:e.array(v),nextCursor:e.string().optional(),prevCursor:e.string().optional(),totalItems:e.number()}),re=(s,t)=>t?t===s.name:!0,oe=(s,t)=>t?S(s)&&t===s.resourceType:!0,ne=(s,t)=>t?t.some(i=>i===s.attributes.action):!0,M=(s,t)=>t==="*"?!0:re(s,t.name)&&oe(s,t.resourceType)&&ne(s,t.actions),ae=(s,t)=>s.permissions.filter(({match:i})=>M(t,i)),ce=(s,t)=>s.kind!==t.kind||s.namespace!==t.namespace?!1:t.name==="*"?!0:s.name===t.name;function le(s,t){const i={};if(s)for(const[r,n]of Object.entries(s))i[r]=t(n);return i}export{te as AuthorizeResponseParser,B as BackstageUserPlaceholder,u as ConditionalDecisionParser,J as CreateDraftRequestParser,U as DefaultingPolicyConfigParser,ee as DraftResponseParser,C as LiteralDecisionParser,E as MemberResponseParser,j as PermissionConditionParser,m as PermissionDecisionParser,D as PermissionMatchParser,y as PolicyConfigOptionsParser,o as PolicyConfigParser,R as PolicyDefaultName,v as PolicyParser,ie as PolicyResponseParser,x as PolicyRoleResolutionStrategyParser,p as PolicyTitleParser,Q as PublishVersionRequestParser,N as RoleDecisionParser,q as RoleParser,I as RolePermissionParser,O as RolePermissionsParser,d as RolesParser,se as SearchMemberResponseParser,_ as TestPolicyDecisionRequestParser,X as TestPolicyDecisionResponseParser,w as UpdateDraftRequestParser,ae as getMatchingRolePermissions,K as isAllOfPermissionCriteria,V as isAnyOfPermissionCriteria,z as isConditionalDecision,M as isMatchingPermission,W as isNotPermissionCriteria,le as mapParams,ce as matchesEntityRef};
+import{AuthorizeResponseParser as s,CreateDraftRequestParser as i,DraftResponseParser as o,MemberResponseParser as a,PolicyResponseParser as P,PublishVersionRequestParser as n,SearchMemberResponseParser as t,TestPolicyDecisionRequestParser as l,TestPolicyDecisionResponseParser as c,UpdateDraftRequestParser as m}from"./api.esm.js";import{getMatchingRolePermissions as f,isMatchingPermission as p,matchesEntityRef as y}from"./matching.esm.js";import{BackstageUserPlaceholder as C,ConditionalDecisionParser as g,DefaultingPolicyConfigParser as u,LiteralDecisionParser as h,PermissionConditionParser as d,PermissionDecisionParser as M,PermissionMatchParser as q,PolicyConfigOptionsParser as x,PolicyConfigParser as b,PolicyDefaultName as A,PolicyParser as O,PolicyRoleResolutionStrategyParser as T,PolicyTitleParser as N,RoleDecisionParser as S,RoleParser as U,RolePermissionParser as k,RolePermissionsParser as z,RolesParser as B,isAllOfPermissionCriteria as E,isAnyOfPermissionCriteria as L,isConditionalDecision as V,isNotPermissionCriteria as j}from"./schema.esm.js";import{mapParams as w}from"./utils.esm.js";export{s as AuthorizeResponseParser,C as BackstageUserPlaceholder,g as ConditionalDecisionParser,i as CreateDraftRequestParser,u as DefaultingPolicyConfigParser,o as DraftResponseParser,h as LiteralDecisionParser,a as MemberResponseParser,d as PermissionConditionParser,M as PermissionDecisionParser,q as PermissionMatchParser,x as PolicyConfigOptionsParser,b as PolicyConfigParser,A as PolicyDefaultName,O as PolicyParser,P as PolicyResponseParser,T as PolicyRoleResolutionStrategyParser,N as PolicyTitleParser,n as PublishVersionRequestParser,S as RoleDecisionParser,U as RoleParser,k as RolePermissionParser,z as RolePermissionsParser,B as RolesParser,t as SearchMemberResponseParser,l as TestPolicyDecisionRequestParser,c as TestPolicyDecisionResponseParser,m as UpdateDraftRequestParser,f as getMatchingRolePermissions,E as isAllOfPermissionCriteria,L as isAnyOfPermissionCriteria,V as isConditionalDecision,p as isMatchingPermission,j as isNotPermissionCriteria,w as mapParams,y as matchesEntityRef};
 //# sourceMappingURL=index.esm.js.map

package/dist/matching.esm.js

@@ -0,0 +1,2 @@
+import{isResourcePermission as t}from"@backstage/plugin-permission-common";const a=(i,s)=>s?s===i.name:!0,m=(i,s)=>s?t(i)&&s===i.resourceType:!0,n=(i,s)=>s?s.some(e=>e===i.attributes.action):!0,o=(i,s)=>s==="*"?!0:a(i,s.name)&&m(i,s.resourceType)&&n(i,s.actions),r=(i,s)=>i.permissions.filter(({match:e})=>o(s,e)),c=(i,s)=>i.kind!==s.kind||i.namespace!==s.namespace?!1:s.name==="*"?!0:i.name===s.name;export{r as getMatchingRolePermissions,o as isMatchingPermission,c as matchesEntityRef};
+//# sourceMappingURL=matching.esm.js.map

package/dist/permissionSchema.esm.js

@@ -0,0 +1,2 @@
+import{AuthorizeResult as i}from"@backstage/plugin-permission-common";import{z as e}from"zod";import{ConditionalDecisionParser as a}from"./schema.esm.js";const t=e.object({action:e.union([e.literal("create"),e.literal("read"),e.literal("update"),e.literal("delete")]).optional()}),s=e.union([e.object({type:e.literal("basic"),name:e.string(),attributes:t}),e.object({type:e.literal("resource"),name:e.string(),attributes:t,resourceType:e.string()})]),r=e.lazy(()=>e.object({rule:e.string(),resourceType:e.string(),params:e.record(e.any()).optional()}).or(e.object({anyOf:e.array(r).nonempty()})).or(e.object({allOf:e.array(r).nonempty()})).or(e.object({not:r}))),o=e.object({result:e.union([e.literal(i.ALLOW),e.literal(i.DENY)])}),n=a.extend({result:e.literal(i.CONDITIONAL),conditions:r}),l=e.union([o,n]);export{n as ConditionalPolicyDecisionParser,o as DefinitivePolicyDecisionParser,t as PermissionAttributesParser,r as PermissionCriteriaParser,s as PermissionParser,l as PolicyDecisionParser};
+//# sourceMappingURL=permissionSchema.esm.js.map

package/dist/schema.esm.js

@@ -0,0 +1,2 @@
+import{stringifyEntityRef as N,parseEntityRef as d}from"@backstage/catalog-model";import{v4 as u}from"uuid";import{z as e}from"zod";import{minCharacters as m,maxCharacters as f}from"./validationMessages.esm.js";const p="Untitled policy",x=":backstageUser",h=e.object({rule:e.string(),params:e.record(e.any()).optional()}),o=e.lazy(()=>e.union([e.object({allOf:e.array(o).nonempty()}).strict(),e.object({anyOf:e.array(o).nonempty()}).strict(),e.object({not:o}).strict(),h])),g=e.object({pluginId:e.string().min(1).describe("Plugin ID that defines the permission and rules used."),resourceType:e.string().min(1).describe("Resource type associated with the conditions used."),conditions:o}),y=e.union([e.literal("allow"),e.literal("deny")]),n=e.union([y,g]),b=e.union([e.literal("*"),e.object({name:e.string().optional().describe("Name that must match the incoming permission request."),actions:e.array(e.string()).optional().describe("Actions that must be present on the incoming permission's attributes."),resourceType:e.string().min(1).optional().describe("Resource type that must match that of the incoming permission request.")})]),P=e.string().default(()=>u().split("-")[0]).describe("ID of the permission."),R=e.object({id:P,match:b.describe("Values used to match against the incoming permission request."),decision:n.describe("Authorization result or conditions to send if this role permission applies.")}).refine(({decision:t,match:i})=>q(t)?i!=="*"&&i?.resourceType!==void 0:!0,{path:["match","resourceType"],message:"match.resourceType is required for conditional decisions."}),j=e.array(R).superRefine((t,i)=>{const s=c(t,"id");s>=0&&i.addIssue({code:e.ZodIssueCode.custom,message:"Permission ids must be unique",path:[s,"id"]})}).describe("Permission decisions used to determine authorization responses."),v=e.string().refine(B,{message:"Invalid entity ref for member.",path:[]}).transform(t=>N(d(t,{defaultKind:"group",defaultNamespace:"default"}))),C=e.string().default(()=>u().split("-")[0]).describe("ID of the role."),A=e.object({name:e.string().min(1,{message:m("Role name",1)}).max(1024,{message:f("Role name",1024)}).describe("Name of the role."),id:C,members:e.union([e.literal("*"),e.array(v).min(1)]).describe("Entity references used to map users to this role. These entities don't need to exist in the catalog."),permissions:j}),I=e.array(A).default([]).superRefine((t,i)=>{const s=c(t,"name");s>=0&&i.addIssue({code:e.ZodIssueCode.custom,message:"Role names must be unique",path:[s,"name"]});const r=c(t,"id");r>=0&&i.addIssue({code:e.ZodIssueCode.custom,message:"Role ids must be unique",path:[r,"id"]})}),z=e.object({decision:n.describe("The authorization result or conditions the corresponding role resulted in"),roleId:C.describe("The id of the role that resulted in the decision"),rolePermissionId:P.describe("The id of the role permission that resulted in the decisions.")}),D=e.string().min(1,{message:m("Policy name",1)}).max(1024,{message:f("Policy name",1024)}).default(p).describe("Name of the policy."),O=e.union([e.literal("first-match"),e.literal("any-allow")]),T=e.object({resolutionStrategy:O}).default({resolutionStrategy:"first-match"}),a=e.object({name:D,options:T,roles:I}),w=a.default({roles:[]});function B(t){try{return d(t,{defaultKind:"group",defaultNamespace:"default"}),!0}catch{return!1}}function c(t,i){let s=0;const r=new Set;for(;s<t.length;){const l=t[s][i];if(r.has(l))return s;r.add(l),s++}return-1}function q(t){return typeof t!="string"}function S(t){const i=Object.entries(t);return i.length===1&&i[0][0]==="allOf"&&Array.isArray(i[0][1])}function E(t){const i=Object.entries(t);return i.length===1&&i[0][0]==="anyOf"&&Array.isArray(i[0][1])}function U(t){const i=Object.entries(t);return i.length===1&&i[0][0]==="not"&&!Array.isArray(i[0][1])}const Z=a.extend({id:e.string(),createdAt:e.string(),createdBy:e.string(),updatedAt:e.string(),updatedBy:e.string(),description:e.string().optional().nullable(),lastPublishedAt:e.string().optional().nullable(),lastPublishedBy:e.string().optional().nullable(),status:e.enum(["draft","active","inactive"])});export{x as BackstageUserPlaceholder,g as ConditionalDecisionParser,w as DefaultingPolicyConfigParser,y as LiteralDecisionParser,h as PermissionConditionParser,n as PermissionDecisionParser,b as PermissionMatchParser,T as PolicyConfigOptionsParser,a as PolicyConfigParser,p as PolicyDefaultName,Z as PolicyParser,O as PolicyRoleResolutionStrategyParser,D as PolicyTitleParser,z as RoleDecisionParser,A as RoleParser,R as RolePermissionParser,j as RolePermissionsParser,I as RolesParser,S as isAllOfPermissionCriteria,E as isAnyOfPermissionCriteria,q as isConditionalDecision,U as isNotPermissionCriteria};
+//# sourceMappingURL=schema.esm.js.map

package/dist/utils.esm.js

@@ -0,0 +1,2 @@
+function s(r,n){const t={};if(r)for(const[o,e]of Object.entries(r))t[o]=n(e);return t}export{s as mapParams};
+//# sourceMappingURL=utils.esm.js.map

package/dist/validationMessages.esm.js

@@ -0,0 +1,2 @@
+const s=(a,t)=>`${a} must be at least ${t} characters`,e=(a,t)=>`${a} must be less than ${t} characters`;export{e as maxCharacters,s as minCharacters};
+//# sourceMappingURL=validationMessages.esm.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spotify/backstage-plugin-rbac-common",
   "description": "Control access to actions and data in Backstage with ease.",
-  "version": "0.5.13",
+  "version": "0.5.14",
   "license": "SEE LICENSE IN LICENSE.md",
   "homepage": "https://backstage.spotify.com",
   "main": "dist/index.cjs.js",
@@ -12,7 +12,14 @@
     "types": "dist/index.d.ts"
   },
   "backstage": {
-    "role": "common-library"
+    "role": "common-library",
+    "pluginId": "rbac",
+    "pluginPackages": [
+      "@spotify/backstage-plugin-rbac",
+      "@spotify/backstage-plugin-rbac-backend",
+      "@spotify/backstage-plugin-rbac-common",
+      "@spotify/backstage-plugin-rbac-node"
+    ]
   },
   "sideEffects": false,
   "scripts": {
@@ -24,14 +31,14 @@
     "postpack": "backstage-cli package postpack"
   },
   "dependencies": {
-    "@backstage/catalog-model": "^1.4.5",
-    "@backstage/plugin-permission-common": "^0.7.13",
+    "@backstage/catalog-model": "^1.5.0",
+    "@backstage/plugin-permission-common": "^0.7.14",
     "@backstage/types": "^1.1.1",
-    "uuid": "^9.0.0",
+    "uuid": "^10.0.0",
     "zod": "^3.20.0"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.26.3"
+    "@backstage/cli": "^0.26.9"
   },
   "files": [
     "dist",