Reworked authorization of conditions to use a single export by combing getRule and applyConditions into

createIsAuthorized

Signed-off-by: Harry Hogg <hhogg@spotify.com>
Co-authored-by: Vincenzo Scamporlino <vincenzos@spotify.com>

plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts

@@ -126,7 +126,7 @@ export type MetadataResponse = {
   rules: MetadataResponseSerializedRule[];
 };
 
-export const applyConditions = <TResourceType extends string, TResource>(
+const applyConditions = <TResourceType extends string, TResource>(
   criteria: PermissionCriteria<PermissionCondition<TResourceType>>,
   resource: TResource | undefined,
   getRule: (name: string) => PermissionRule<TResource, unknown, TResourceType>,
@@ -160,6 +160,27 @@ export const applyConditions = <TResourceType extends string, TResource>(
   return rule.apply(resource, criteria.params ?? {});
 };
 
+/**
+
+ * Takes some permission conditions and returns a definitive authorization result
+ * on the resource to which they apply.
+ *
+ * @public
+ */
+export const createIsAuthorized = <
+  TResourceType extends string,
+  TResource,
+  TQuery,
+>(
+  rules: PermissionRule<TResource, TQuery, string>[],
+) => {
+  const getRule = createGetRule(rules);
+  return (
+    criteria: PermissionCriteria<PermissionCondition<TResourceType>>,
+    resource: TResource | undefined,
+  ) => applyConditions(criteria, resource, getRule);
+};
+
 /**
  * Options for creating a permission integration router specific
  * for a particular resource type.

plugins/permission-node/src/integration/index.ts

@@ -19,9 +19,4 @@ export * from './createConditionExports';
 export * from './createConditionTransformer';
 export * from './createPermissionIntegrationRouter';
 export * from './createPermissionRule';
-export {
-  createGetRule,
-  isAndCriteria,
-  isOrCriteria,
-  isNotCriteria,
-} from './util';
+export { isAndCriteria, isOrCriteria, isNotCriteria } from './util';

plugins/scaffolder-backend/src/service/router.ts

@@ -32,7 +32,6 @@ import {
   TaskSpec,
   TemplateEntityV1beta3,
   templateEntityV1beta3Validator,
-  TemplateParameter,
   templateParameterReadPermission,
   TemplateProperty,
   templatePropertyReadPermission,
@@ -63,12 +62,11 @@ import {
   AuthorizeResult,
   PermissionEvaluator,
 } from '@backstage/plugin-permission-common';
-import {
-  applyConditions,
-  createGetRule,
-} from '@backstage/plugin-permission-node';
+import { createIsAuthorized } from '@backstage/plugin-permission-node';
 import { scaffolderStepRules } from './rules';
 
+const isAuthorized = createIsAuthorized(Object.values(scaffolderStepRules));
+
 /**
  * RouterOptions
  *
@@ -266,8 +264,6 @@ export async function createRouter(
     additionalTemplateGlobals,
   });
 
-  const getRule = createGetRule(Object.values(scaffolderStepRules));
-
   router
     .get(
       '/v2/templates/:namespace/:kind/:name/parameter-schema',
@@ -598,16 +594,12 @@ export async function createRouter(
     } else if (parameterDecision.result === AuthorizeResult.CONDITIONAL) {
       if (Array.isArray(template.spec.parameters)) {
         template.spec.parameters = template.spec.parameters.filter(step =>
-          applyConditions(parameterDecision.conditions, step, getRule),
+          isAuthorized(parameterDecision.conditions, step),
         );
       } else {
         if (
           template.spec.parameters &&
-          !applyConditions(
-            parameterDecision.conditions,
-            template.spec.parameters,
-            getRule,
-          )
+          !isAuthorized(parameterDecision.conditions, template.spec.parameters)
         ) {
           template.spec.parameters = undefined;
         }
@@ -631,7 +623,7 @@ export async function createRouter(
           parameter.properties = Object.entries(
             parameter.properties || {},
           ).reduce<Record<string, TemplateProperty>>((acc, [key, value]) => {
-            if (applyConditions(propertyDecision.conditions, value, getRule)) {
+            if (isAuthorized(propertyDecision.conditions, value)) {
               acc[key] = value;
             }
             return acc;
@@ -643,7 +635,7 @@ export async function createRouter(
           template.spec.parameters.properties = Object.entries(
             template.spec.parameters.properties || {},
           ).reduce<Record<string, TemplateProperty>>((acc, [key, value]) => {
-            if (applyConditions(propertyDecision.conditions, value, getRule)) {
+            if (isAuthorized(propertyDecision.conditions, value)) {
               acc[key] = value;
             }
             return acc;
@@ -657,7 +649,7 @@ export async function createRouter(
       template.spec.steps = [];
     } else if (stepDecision.result === AuthorizeResult.CONDITIONAL) {
       template.spec.steps = template.spec.steps.filter(step =>
-        applyConditions(stepDecision.conditions, step, getRule),
+        isAuthorized(stepDecision.conditions, step),
       );
     }