From 7500c99ecc79ebfee748d196d6d8fb1e75e658e7 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Thu, 30 Jan 2025 15:38:22 +0100 Subject: [PATCH] permission-node: refactor PermissionRuleAccessor to PermissionRuleset Signed-off-by: Patrik Oldsberg --- .changeset/gold-rabbits-change.md | 2 +- .changeset/gorgeous-shoes-stare.md | 2 +- .changeset/witty-ducks-cross.md | 2 +- ...04-authorizing-access-to-paginated-data.md | 2 +- .../permissionsRegistryServiceFactory.ts | 4 +-- packages/backend-plugin-api/report.api.md | 6 ++--- .../definitions/PermissionsRegistryService.ts | 6 ++--- .../src/next/services/mockServices.ts | 2 +- .../src/service/CatalogBuilder.ts | 2 +- plugins/permission-node/report.api.md | 14 +++++----- .../integration/createConditionTransformer.ts | 12 ++++----- .../createPermissionIntegrationRouter.ts | 27 ++++++++++--------- plugins/permission-node/src/types.ts | 8 +++--- 13 files changed, 48 insertions(+), 41 deletions(-) diff --git a/.changeset/gold-rabbits-change.md b/.changeset/gold-rabbits-change.md index 0ede93af58..4d124a5d51 100644 --- a/.changeset/gold-rabbits-change.md +++ b/.changeset/gold-rabbits-change.md @@ -2,4 +2,4 @@ '@backstage/plugin-permission-node': patch --- -Added a new `PermissionRuleAccessor` type that encapsulates a lookup function for permission rules, which can be created by the new `PermissionsRegistryService` via the `getRuleAccessor` method. The `createConditionTransformer` and `createConditionAuthorizer` functions have been adapted to receive these accessors as arguments, with their older counterparts being deprecated. +Added a new `PermissionRuleset` type that encapsulates a lookup function for permission rules, which can be created by the new `PermissionsRegistryService` via the `getPermissionRuleset` method. The `createConditionTransformer` and `createConditionAuthorizer` functions have been adapted to receive these accessors as arguments, with their older counterparts being deprecated. diff --git a/.changeset/gorgeous-shoes-stare.md b/.changeset/gorgeous-shoes-stare.md index c5748b14bc..a67a185892 100644 --- a/.changeset/gorgeous-shoes-stare.md +++ b/.changeset/gorgeous-shoes-stare.md @@ -2,4 +2,4 @@ '@backstage/backend-test-utils': patch --- -Added the new `getRuleAccessor` method to `mockServices.permissionsRegistry`. +Added the new `getPermissionRuleset` method to `mockServices.permissionsRegistry`. diff --git a/.changeset/witty-ducks-cross.md b/.changeset/witty-ducks-cross.md index b374f0a116..f0defba897 100644 --- a/.changeset/witty-ducks-cross.md +++ b/.changeset/witty-ducks-cross.md @@ -3,4 +3,4 @@ '@backstage/backend-defaults': patch --- -Updated `PermissionsRegistryService` to use `PermissionResourceRef`s and added the `getRuleAccessor` method. +Updated `PermissionsRegistryService` to use `PermissionResourceRef`s and added the `getPermissionRuleset` method. diff --git a/docs/permissions/plugin-authors/04-authorizing-access-to-paginated-data.md b/docs/permissions/plugin-authors/04-authorizing-access-to-paginated-data.md index 1a65c1f51a..c03183bbf0 100644 --- a/docs/permissions/plugin-authors/04-authorizing-access-to-paginated-data.md +++ b/docs/permissions/plugin-authors/04-authorizing-access-to-paginated-data.md @@ -142,7 +142,7 @@ import { /* highlight-add-start */ const transformConditions = createConditionTransformer( - permissionsRegistry.getRuleAccessor(todoListPermissionResourceRef) + permissionsRegistry.getPermissionRuleset(todoListPermissionResourceRef) ); /* highlight-add-end */ diff --git a/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts b/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts index 4619ff634b..993fb4e946 100644 --- a/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts +++ b/packages/backend-defaults/src/entrypoints/permissionsRegistry/permissionsRegistryServiceFactory.ts @@ -74,8 +74,8 @@ export const permissionsRegistryServiceFactory = createServiceFactory({ } router.addPermissionRules(rules); }, - getRuleAccessor(resourceRef) { - return router.getRuleAccessor(resourceRef); + getPermissionRuleset(resourceRef) { + return router.getPermissionRuleset(resourceRef); }, } satisfies PermissionsRegistryService; }, diff --git a/packages/backend-plugin-api/report.api.md b/packages/backend-plugin-api/report.api.md index bb8cd63539..384ae31481 100644 --- a/packages/backend-plugin-api/report.api.md +++ b/packages/backend-plugin-api/report.api.md @@ -21,7 +21,7 @@ import { PermissionAttributes } from '@backstage/plugin-permission-common'; import { PermissionEvaluator } from '@backstage/plugin-permission-common'; import { PermissionResourceRef } from '@backstage/plugin-permission-node'; import { PermissionRule } from '@backstage/plugin-permission-node'; -import { PermissionRuleAccessor } from '@backstage/plugin-permission-node'; +import { PermissionRuleset } from '@backstage/plugin-permission-node'; import { QueryPermissionRequest } from '@backstage/plugin-permission-common'; import { QueryPermissionResponse } from '@backstage/plugin-permission-common'; import { Readable } from 'stream'; @@ -475,9 +475,9 @@ export interface PermissionsRegistryService { TQuery >, ): void; - getRuleAccessor( + getPermissionRuleset( resourceRef: PermissionResourceRef, - ): PermissionRuleAccessor; + ): PermissionRuleset; } // @public diff --git a/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts b/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts index bc9d8dd223..edd41e0cbc 100644 --- a/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts +++ b/packages/backend-plugin-api/src/services/definitions/PermissionsRegistryService.ts @@ -18,7 +18,7 @@ import { Permission } from '@backstage/plugin-permission-common'; import { PermissionResourceRef, PermissionRule, - PermissionRuleAccessor, + PermissionRuleset, } from '@backstage/plugin-permission-node'; /** @@ -148,7 +148,7 @@ export interface PermissionsRegistryService { * * Primarily intended for use with {@link @backstage/plugin-permission-node#createConditionAuthorizer} and {@link @backstage/plugin-permission-node#createConditionTransformer}. */ - getRuleAccessor( + getPermissionRuleset( resourceRef: PermissionResourceRef, - ): PermissionRuleAccessor; + ): PermissionRuleset; } diff --git a/packages/backend-test-utils/src/next/services/mockServices.ts b/packages/backend-test-utils/src/next/services/mockServices.ts index 9c6b033505..baeae53a77 100644 --- a/packages/backend-test-utils/src/next/services/mockServices.ts +++ b/packages/backend-test-utils/src/next/services/mockServices.ts @@ -489,7 +489,7 @@ export namespace mockServices { addPermissionRules: jest.fn(), addPermissions: jest.fn(), addResourceType: jest.fn(), - getRuleAccessor: jest.fn(), + getPermissionRuleset: jest.fn(), })); } diff --git a/plugins/catalog-backend/src/service/CatalogBuilder.ts b/plugins/catalog-backend/src/service/CatalogBuilder.ts index 7e00d6dc62..7f70e2732d 100644 --- a/plugins/catalog-backend/src/service/CatalogBuilder.ts +++ b/plugins/catalog-backend/src/service/CatalogBuilder.ts @@ -561,7 +561,7 @@ export class CatalogBuilder { permissionsService, permissionsRegistry ? createConditionTransformer( - permissionsRegistry.getRuleAccessor( + permissionsRegistry.getPermissionRuleset( catalogEntityPermissionResourceRef, ), ) diff --git a/plugins/permission-node/report.api.md b/plugins/permission-node/report.api.md index adfeec0039..9131d6e2a9 100644 --- a/plugins/permission-node/report.api.md +++ b/plugins/permission-node/report.api.md @@ -79,7 +79,7 @@ export type ConditionTransformer = ( // @public export function createConditionAuthorizer( - permissionRuleAccessor: PermissionRuleAccessor, + permissionRuleset: PermissionRuleset, ): (decision: PolicyDecision, resource: TResource | undefined) => boolean; // @public @deprecated (undocumented) @@ -130,7 +130,7 @@ export const createConditionFactory: < // @public export function createConditionTransformer( - permissionRuleAccessor: PermissionRuleAccessor, + permissionRuleset: PermissionRuleset, ): ConditionTransformer; // @public @deprecated (undocumented) @@ -173,9 +173,9 @@ export function createPermissionIntegrationRouter< TResource >, ): void; - getRuleAccessor( + getPermissionRuleset( resourceRef: PermissionResourceRef, - ): PermissionRuleAccessor; + ): PermissionRuleset; }; // @public @@ -351,11 +351,13 @@ export type PermissionRule< }; // @public -export type PermissionRuleAccessor< +export type PermissionRuleset< TResource = unknown, TQuery = unknown, TResourceType extends string = string, -> = (name: string) => PermissionRule; +> = { + getRuleByName(name: string): PermissionRule; +}; // @public export type PolicyQuery = { diff --git a/plugins/permission-node/src/integration/createConditionTransformer.ts b/plugins/permission-node/src/integration/createConditionTransformer.ts index a7dbabc903..21608a1f50 100644 --- a/plugins/permission-node/src/integration/createConditionTransformer.ts +++ b/plugins/permission-node/src/integration/createConditionTransformer.ts @@ -20,7 +20,7 @@ import { PermissionCondition, PermissionCriteria, } from '@backstage/plugin-permission-common'; -import { PermissionRule, PermissionRuleAccessor } from '../types'; +import { PermissionRule, PermissionRuleset } from '../types'; import { createGetRule, isAndCriteria, @@ -77,11 +77,11 @@ export type ConditionTransformer = ( * @public */ export function createConditionTransformer( - permissionRuleAccessor: PermissionRuleAccessor, + permissionRuleset: PermissionRuleset, ): ConditionTransformer; /** * @public - * @deprecated Use the version of `createConditionTransformer` that accepts a `PermissionRuleAccessor` instead. + * @deprecated Use the version of `createConditionTransformer` that accepts a `PermissionRuleset` instead. */ export function createConditionTransformer< TQuery, @@ -90,11 +90,11 @@ export function createConditionTransformer< export function createConditionTransformer( permissionRules: | PermissionRule[] - | PermissionRuleAccessor, + | PermissionRuleset, ): ConditionTransformer { const getRule = - typeof permissionRules === 'function' - ? permissionRules + 'getRuleByName' in permissionRules + ? (n: string) => permissionRules.getRuleByName(n) : createGetRule(permissionRules); return conditions => mapConditions(conditions, getRule); diff --git a/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts b/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts index a85fe2d085..b215044ed8 100644 --- a/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts +++ b/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts @@ -30,7 +30,7 @@ import { PermissionCriteria, PolicyDecision, } from '@backstage/plugin-permission-common'; -import { PermissionRule, PermissionRuleAccessor } from '../types'; +import { PermissionRule, PermissionRuleset } from '../types'; import { NoInfer, createGetRule, @@ -165,11 +165,11 @@ const applyConditions = ( * @public */ export function createConditionAuthorizer( - permissionRuleAccessor: PermissionRuleAccessor, + permissionRuleset: PermissionRuleset, ): (decision: PolicyDecision, resource: TResource | undefined) => boolean; /** * @public - * @deprecated Use the version of `createConditionAuthorizer` that accepts a `PermissionRuleAccessor` instead. + * @deprecated Use the version of `createConditionAuthorizer` that accepts a `PermissionRuleset` instead. */ export function createConditionAuthorizer( rules: PermissionRule[], @@ -177,9 +177,12 @@ export function createConditionAuthorizer( export function createConditionAuthorizer( rules: | PermissionRule[] - | PermissionRuleAccessor, + | PermissionRuleset, ): (decision: PolicyDecision, resource: TResource | undefined) => boolean { - const getRule = typeof rules === 'function' ? rules : createGetRule(rules); + const getRule = + 'getRuleByName' in rules + ? (n: string) => rules.getRuleByName(n) + : createGetRule(rules); return ( decision: PolicyDecision, @@ -439,9 +442,9 @@ export function createPermissionIntegrationRouter< TResource >, ): void; - getRuleAccessor( + getPermissionRuleset( resourceRef: PermissionResourceRef, - ): PermissionRuleAccessor; + ): PermissionRuleset; } { const store = new PermissionIntegrationMetadataStore(); @@ -531,12 +534,12 @@ export function createPermissionIntegrationRouter< ) { store.addResourceType(resource); }, - getRuleAccessor( + getPermissionRuleset( resourceRef: PermissionResourceRef, - ): PermissionRuleAccessor { - return store.getRuleMapper( - resourceRef.resourceType, - ) as PermissionRuleAccessor; + ): PermissionRuleset { + return { + getRuleByName: store.getRuleMapper(resourceRef.resourceType), + } as PermissionRuleset; }, }); } diff --git a/plugins/permission-node/src/types.ts b/plugins/permission-node/src/types.ts index da071aa4d9..975a78acf0 100644 --- a/plugins/permission-node/src/types.ts +++ b/plugins/permission-node/src/types.ts @@ -72,14 +72,16 @@ export type PermissionRule< * * @remarks * - * Accessed via {@link @backstage/backend-plugin-api#PermissionsRegistryService.getRuleAccessor}. + * Accessed via {@link @backstage/backend-plugin-api#PermissionsRegistryService.getPermissionRuleset}. * * Will throw an error if a rule with the provided name does not exist. * * @public */ -export type PermissionRuleAccessor< +export type PermissionRuleset< TResource = unknown, TQuery = unknown, TResourceType extends string = string, -> = (name: string) => PermissionRule; +> = { + getRuleByName(name: string): PermissionRule; +};