From 13d15f7bfcf39006dbb475cf2a7aa18d3d02dd7b Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Thu, 15 May 2025 20:51:20 +0200
Subject: [PATCH 1/2] permission-common: fix basic permission validation

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../src/PermissionClient.test.ts              |  2 +-
 .../permission-common/src/PermissionClient.ts | 28 +++++++++++--------
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/plugins/permission-common/src/PermissionClient.test.ts b/plugins/permission-common/src/PermissionClient.test.ts
index b55e5da94d..4ddfadadda 100644
--- a/plugins/permission-common/src/PermissionClient.test.ts
+++ b/plugins/permission-common/src/PermissionClient.test.ts
@@ -407,7 +407,7 @@ describe('PermissionClient', () => {
                 },
                 {
                   id: req.body.items[1].id,
-                  result: [AuthorizeResult.DENY],
+                  result: AuthorizeResult.DENY,
                 },
                 {
                   id: req.body.items[2].id,
diff --git a/plugins/permission-common/src/PermissionClient.ts b/plugins/permission-common/src/PermissionClient.ts
index 93c3d5152f..61adc9279a 100644
--- a/plugins/permission-common/src/PermissionClient.ts
+++ b/plugins/permission-common/src/PermissionClient.ts
@@ -60,14 +60,16 @@ const authorizePermissionResponseSchema: z.ZodSchema<AuthorizePermissionResponse
       .or(z.literal(AuthorizeResult.DENY)),
   });
 
-const authorizePermissionResponseBatchSchema = z.object({
-  result: z.array(
-    z.union([
-      z.literal(AuthorizeResult.ALLOW),
-      z.literal(AuthorizeResult.DENY),
-    ]),
-  ),
-});
+const authorizePermissionResponseBatchSchema = z
+  .object({
+    result: z.array(
+      z.union([
+        z.literal(AuthorizeResult.ALLOW),
+        z.literal(AuthorizeResult.DENY),
+      ]),
+    ),
+  })
+  .or(authorizePermissionResponseSchema);
 
 const queryPermissionResponseSchema: z.ZodSchema<QueryPermissionResponse> =
   z.union([
@@ -240,9 +242,13 @@ export class PermissionClient implements PermissionEvaluator {
       const { id } = request[query.permission.name];
 
       const item = responsesById[id];
-      return {
-        result: query.resourceRef ? item.result.shift()! : item.result[0],
-      };
+
+      if (Array.isArray(item.result)) {
+        return {
+          result: query.resourceRef ? item.result.shift()! : item.result[0],
+        };
+      }
+      return { result: item.result };
     });
   }
 

From 37328b1b50a41fed9e705c15ade9e281da844522 Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Thu, 15 May 2025 20:51:36 +0200
Subject: [PATCH 2/2] permission-common: basic permission changeset

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .changeset/shaggy-gifts-beam.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/shaggy-gifts-beam.md

diff --git a/.changeset/shaggy-gifts-beam.md b/.changeset/shaggy-gifts-beam.md
new file mode 100644
index 0000000000..f2957fc2c3
--- /dev/null
+++ b/.changeset/shaggy-gifts-beam.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-permission-common': patch
+---
+
+Fixed an issue causing `PermissionClient` to throw an error when authorizing basic permissions with the `permission.EXPERIMENTAL_enableBatchedRequests` config enabled.