From 13d15f7bfcf39006dbb475cf2a7aa18d3d02dd7b Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Thu, 15 May 2025 20:51:20 +0200
Subject: [PATCH] permission-common: fix basic permission validation

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../src/PermissionClient.test.ts              |  2 +-
 .../permission-common/src/PermissionClient.ts | 28 +++++++++++--------
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/plugins/permission-common/src/PermissionClient.test.ts b/plugins/permission-common/src/PermissionClient.test.ts
index b55e5da94d..4ddfadadda 100644
--- a/plugins/permission-common/src/PermissionClient.test.ts
+++ b/plugins/permission-common/src/PermissionClient.test.ts
@@ -407,7 +407,7 @@ describe('PermissionClient', () => {
                 },
                 {
                   id: req.body.items[1].id,
-                  result: [AuthorizeResult.DENY],
+                  result: AuthorizeResult.DENY,
                 },
                 {
                   id: req.body.items[2].id,
diff --git a/plugins/permission-common/src/PermissionClient.ts b/plugins/permission-common/src/PermissionClient.ts
index 93c3d5152f..61adc9279a 100644
--- a/plugins/permission-common/src/PermissionClient.ts
+++ b/plugins/permission-common/src/PermissionClient.ts
@@ -60,14 +60,16 @@ const authorizePermissionResponseSchema: z.ZodSchema<AuthorizePermissionResponse
       .or(z.literal(AuthorizeResult.DENY)),
   });
 
-const authorizePermissionResponseBatchSchema = z.object({
-  result: z.array(
-    z.union([
-      z.literal(AuthorizeResult.ALLOW),
-      z.literal(AuthorizeResult.DENY),
-    ]),
-  ),
-});
+const authorizePermissionResponseBatchSchema = z
+  .object({
+    result: z.array(
+      z.union([
+        z.literal(AuthorizeResult.ALLOW),
+        z.literal(AuthorizeResult.DENY),
+      ]),
+    ),
+  })
+  .or(authorizePermissionResponseSchema);
 
 const queryPermissionResponseSchema: z.ZodSchema<QueryPermissionResponse> =
   z.union([
@@ -240,9 +242,13 @@ export class PermissionClient implements PermissionEvaluator {
       const { id } = request[query.permission.name];
 
       const item = responsesById[id];
-      return {
-        result: query.resourceRef ? item.result.shift()! : item.result[0],
-      };
+
+      if (Array.isArray(item.result)) {
+        return {
+          result: query.resourceRef ? item.result.shift()! : item.result[0],
+        };
+      }
+      return { result: item.result };
     });
   }