Merge pull request #13905 from backstage/permissions/schema

Permissions - Add a required parameter schema

plugins/permission-common/api-report.md

@@ -4,6 +4,7 @@
 
 ```ts
 import { Config } from '@backstage/config';
+import { JsonPrimitive } from '@backstage/types';
 
 // @public
 export type AllOfCriteria<TQuery> = {
@@ -172,11 +173,11 @@ export class PermissionClient implements PermissionEvaluator {
 // @public
 export type PermissionCondition<
   TResourceType extends string = string,
-  TParams extends unknown[] = unknown[],
+  TParams extends PermissionRuleParams = PermissionRuleParams,
 > = {
   resourceType: TResourceType;
   rule: string;
-  params: TParams;
+  params?: TParams;
 };
 
 // @public
@@ -203,6 +204,14 @@ export type PermissionMessageBatch<T> = {
   items: IdentifiedPermissionMessage<T>[];
 };
 
+// @public
+export type PermissionRuleParam = undefined | JsonPrimitive | JsonPrimitive[];
+
+// @public
+export type PermissionRuleParams =
+  | undefined
+  | Record<string, PermissionRuleParam>;
+
 // @public
 export type PolicyDecision =
   | DefinitivePolicyDecision

plugins/permission-common/package.json

@@ -43,6 +43,7 @@
   "dependencies": {
     "@backstage/config": "workspace:^",
     "@backstage/errors": "workspace:^",
+    "@backstage/types": "workspace:^",
     "cross-fetch": "^3.1.5",
     "uuid": "^8.0.0",
     "zod": "^3.11.6"

plugins/permission-common/src/PermissionClient.test.ts

@@ -227,7 +227,7 @@ describe('PermissionClient', () => {
             conditions: {
               resourceType: 'test-resource',
               rule: 'FOO',
-              params: ['bar'],
+              params: { foo: 'bar' },
             },
           }),
         );
@@ -275,7 +275,7 @@ describe('PermissionClient', () => {
           conditions: {
             rule: 'FOO',
             resourceType: 'test-resource',
-            params: ['bar'],
+            params: { foo: 'bar' },
           },
         }),
       );

plugins/permission-common/src/PermissionClient.ts

@@ -41,7 +41,7 @@ const permissionCriteriaSchema: z.ZodSchema<
     .object({
       rule: z.string(),
       resourceType: z.string(),
-      params: z.array(z.unknown()),
+      params: z.record(z.any()),
     })
     .or(z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }))
     .or(z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }))

plugins/permission-common/src/types/api.ts

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import { JsonPrimitive } from '@backstage/types';
 import { ResourcePermission } from '.';
 import { Permission } from './permission';
 
@@ -101,11 +102,11 @@ export type PolicyDecision =
  */
 export type PermissionCondition<
   TResourceType extends string = string,
-  TParams extends unknown[] = unknown[],
+  TParams extends PermissionRuleParams = PermissionRuleParams,
 > = {
   resourceType: TResourceType;
   rule: string;
-  params: TParams;
+  params?: TParams;
 };
 
 /**
@@ -148,6 +149,22 @@ export type PermissionCriteria<TQuery> =
   | NotCriteria<TQuery>
   | TQuery;
 
+/**
+ * A parameter to a permission rule.
+ *
+ * @public
+ */
+export type PermissionRuleParam = undefined | JsonPrimitive | JsonPrimitive[];
+
+/**
+ * Types that can be used as parameters to permission rules.
+ *
+ * @public
+ */
+export type PermissionRuleParams =
+  | undefined
+  | Record<string, PermissionRuleParam>;
+
 /**
  * An individual request sent to the permission backend.
  * @public

plugins/permission-common/src/types/index.ts

@@ -33,6 +33,8 @@ export type {
   PolicyDecision,
   PermissionCondition,
   PermissionCriteria,
+  PermissionRuleParam,
+  PermissionRuleParams,
   AllOfCriteria,
   AnyOfCriteria,
   NotCriteria,