Move PolicyQuery to permission-node

Signed-off-by: Vincenzo Scamporlino <me@vinzscam.dev>

plugins/permission-node/api-report.md

@@ -5,22 +5,23 @@
 ```ts
 import { AllOfCriteria } from '@backstage/plugin-permission-common';
 import { AnyOfCriteria } from '@backstage/plugin-permission-common';
-import { AuthorizeRequestOptions } from '@backstage/plugin-permission-common';
+import { AuthorizePermissionRequest } from '@backstage/plugin-permission-common';
+import { AuthorizePermissionResponse } from '@backstage/plugin-permission-common';
 import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
 import { ConditionalPolicyDecision } from '@backstage/plugin-permission-common';
 import { Config } from '@backstage/config';
 import { DefinitivePolicyDecision } from '@backstage/plugin-permission-common';
-import { EvaluatePermissionRequest } from '@backstage/plugin-permission-common';
-import { EvaluatePermissionResponse } from '@backstage/plugin-permission-common';
+import { EvaluatorRequestOptions } from '@backstage/plugin-permission-common';
 import express from 'express';
 import { IdentifiedPermissionMessage } from '@backstage/plugin-permission-common';
 import { NotCriteria } from '@backstage/plugin-permission-common';
 import { Permission } from '@backstage/plugin-permission-common';
-import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
 import { PermissionCondition } from '@backstage/plugin-permission-common';
 import { PermissionCriteria } from '@backstage/plugin-permission-common';
+import { PermissionEvaluator } from '@backstage/plugin-permission-common';
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
 import { PolicyDecision } from '@backstage/plugin-permission-common';
+import { QueryPermissionRequest } from '@backstage/plugin-permission-common';
 import { ResourcePermission } from '@backstage/plugin-permission-common';
 import { TokenManager } from '@backstage/backend-common';
 
@@ -178,12 +179,12 @@ export type PolicyQuery = {
 };
 
 // @public
-export class ServerPermissionClient implements PermissionAuthorizer {
+export class ServerPermissionClient implements PermissionEvaluator {
   // (undocumented)
   authorize(
-    requests: EvaluatePermissionRequest[],
-    options?: AuthorizeRequestOptions,
-  ): Promise<EvaluatePermissionResponse[]>;
+    requests: AuthorizePermissionRequest[],
+    options?: EvaluatorRequestOptions,
+  ): Promise<AuthorizePermissionResponse[]>;
   // (undocumented)
   static fromConfig(
     config: Config,
@@ -192,5 +193,10 @@ export class ServerPermissionClient implements PermissionAuthorizer {
       tokenManager: TokenManager;
     },
   ): ServerPermissionClient;
+  // (undocumented)
+  query(
+    queries: QueryPermissionRequest[],
+    options?: EvaluatorRequestOptions,
+  ): Promise<PolicyDecision[]>;
 }
 ```

plugins/permission-node/src/policy/index.ts

@@ -14,4 +14,4 @@
  * limitations under the License.
  */
 
-export type { PermissionPolicy } from './types';
+export type { PermissionPolicy, PolicyQuery } from './types';

plugins/permission-node/src/policy/types.ts

@@ -15,11 +15,25 @@
  */
 
 import {
+  Permission,
   PolicyDecision,
-  PolicyQuery,
 } from '@backstage/plugin-permission-common';
 import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
 
+/**
+ * A query to be evaluated by the {@link PermissionPolicy}.
+ *
+ * @remarks
+ *
+ * Unlike other parts of the permission API, the policy does not accept a resource ref. This keeps
+ * the policy decoupled from the resource loading and condition applying logic.
+ *
+ * @public
+ */
+export type PolicyQuery = {
+  permission: Permission;
+};
+
 /**
  * A policy to evaluate authorization requests for any permissioned action performed in Backstage.
  *