Merge pull request #29975 from backstage/fix/permissions-basic-validation

Fix: basic permission validation

.changeset/shaggy-gifts-beam.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-permission-common': patch
+---
+
+Fixed an issue causing `PermissionClient` to throw an error when authorizing basic permissions with the `permission.EXPERIMENTAL_enableBatchedRequests` config enabled.

plugins/permission-common/src/PermissionClient.test.ts

@@ -407,7 +407,7 @@ describe('PermissionClient', () => {
                 },
                 {
                   id: req.body.items[1].id,
-                  result: [AuthorizeResult.DENY],
+                  result: AuthorizeResult.DENY,
                 },
                 {
                   id: req.body.items[2].id,

plugins/permission-common/src/PermissionClient.ts

@@ -60,14 +60,16 @@ const authorizePermissionResponseSchema: z.ZodSchema<AuthorizePermissionResponse
       .or(z.literal(AuthorizeResult.DENY)),
   });
 
-const authorizePermissionResponseBatchSchema = z.object({
-  result: z.array(
-    z.union([
-      z.literal(AuthorizeResult.ALLOW),
-      z.literal(AuthorizeResult.DENY),
-    ]),
-  ),
-});
+const authorizePermissionResponseBatchSchema = z
+  .object({
+    result: z.array(
+      z.union([
+        z.literal(AuthorizeResult.ALLOW),
+        z.literal(AuthorizeResult.DENY),
+      ]),
+    ),
+  })
+  .or(authorizePermissionResponseSchema);
 
 const queryPermissionResponseSchema: z.ZodSchema<QueryPermissionResponse> =
   z.union([
@@ -240,9 +242,13 @@ export class PermissionClient implements PermissionEvaluator {
       const { id } = request[query.permission.name];
 
       const item = responsesById[id];
-      return {
-        result: query.resourceRef ? item.result.shift()! : item.result[0],
-      };
+
+      if (Array.isArray(item.result)) {
+        return {
+          result: query.resourceRef ? item.result.shift()! : item.result[0],
+        };
+      }
+      return { result: item.result };
     });
   }