paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 47 Packages Projects Releases Wiki Activity

permission-backend: accept resourceRef as array

Browse Source 
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
This commit is contained in:
Vincenzo Scamporlino
2025-04-29 10:46:10 +02:00
parent 669038aab8
commit 7853dac010
7 changed files with 47 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/permission-backend/src/service/router.test.ts
+9 -80
View File
@@ -154,7 +154,7 @@ describe('createRouter', () => {
});
});
it('calls the permission policy with batched resourceRefs', async () => {
it('calls the permission policy with batched resourceRef as an array', async () => {
policy.handle.mockResolvedValueOnce({
result: AuthorizeResult.CONDITIONAL,
pluginId: 'test-plugin',
@@ -181,7 +181,7 @@ describe('createRouter', () => {
attributes: {},
resourceType: 'test-resource-1',
},
resourceRefs: ['resource:1', 'resource:2'],
resourceRef: ['resource:1', 'resource:2'],
},
{
id: '234',
@@ -202,7 +202,7 @@ describe('createRouter', () => {
conditions: { params: ['abc'], rule: 'test-rule' },
id: '123',
pluginId: 'test-plugin',
resourceRefs: ['resource:1', 'resource:2'],
resourceRef: ['resource:1', 'resource:2'],
resourceType: 'test-resource-1',
result: 'CONDITIONAL',
},
@@ -611,7 +611,7 @@ describe('createRouter', () => {
});
});
it('leaves conditional results without resourceRefs unchanged', async () => {
it('leaves conditional results without resourceRef unchanged', async () => {
policy.handle
.mockResolvedValueOnce({
result: AuthorizeResult.CONDITIONAL,
@@ -881,79 +881,7 @@ describe('createRouter', () => {
items: [
{
id: '123',
// resource ref should be a string
resourceRef: ['resource:1'],
permission: {
type: 'resource',
name: 'test.permission',
attributes: {},
resourceType: 'test-resource-1',
},
},
],
},
{
items: [
{
id: '123',
resourceRef: ['resource:1'],
permission: {
type: 'resource',
name: 'test.permission',
attributes: {},
resourceType: 'test-resource-1',
},
},
],
},
{
items: [
{
id: '123',
resourceRefs: 'resource:1',
permission: {
type: 'resource',
name: 'test.permission',
attributes: {},
resourceType: 'test-resource-1',
},
},
],
},
{
items: [
{
id: '123',
resourceRefs: [],
permission: {
type: 'resource',
name: 'test.permission',
attributes: {},
resourceType: 'test-resource-1',
},
},
],
},
{
items: [
{
id: '123',
resourceRefs: ['resource:1'],
resourceRef: 'resource:1',
permission: {
type: 'resource',
name: 'test.permission',
attributes: {},
resourceType: 'test-resource-1',
},
},
],
},
{
items: [
{
id: '123',
resourceRefs: ['resource:1'],
permission: {
type: 'basic',
name: 'test.permission',
@@ -966,16 +894,17 @@ describe('createRouter', () => {
items: [
{
id: '123',
resourceRef: 'resource:1',
resourceRef: [],
permission: {
type: 'basic',
type: 'resource',
name: 'test.permission',
attributes: {},
resourceType: 'test-resource-1',
},
},
],
},
])('returns a 400 error for invalid request %#', async requestBody => {
])('returns a 400 error for invalid request %o', async requestBody => {
const response = await request(app).post('/authorize').send(requestBody);
expect(response.status).toEqual(400);
@@ -1017,7 +946,7 @@ describe('createRouter', () => {
);
});
it(`returns a 400 error if the request doesn't contain resourceRef or resourceRefs for credentials not issued by a service`, async () => {
it(`returns a 400 error if the request doesn't contain resourceRef for credentials not issued by a service`, async () => {
policy.handle.mockResolvedValueOnce({
result: AuthorizeResult.CONDITIONAL,
pluginId: 'test-plugin',
plugins/permission-backend/src/service/router.ts
+4 -20
View File
@@ -76,19 +76,13 @@ const evaluatePermissionRequestSchema = z.union([
z.object({
id: z.string(),
resourceRef: z.undefined().optional(),
resourceRefs: z.undefined().optional(),
permission: basicPermissionSchema,
}),
z.object({
id: z.string(),
resourceRef: z.string().optional(),
resourceRefs: z.undefined().optional(),
permission: resourcePermissionSchema,
}),
z.object({
id: z.string(),
resourceRef: z.undefined().optional(),
resourceRefs: z.array(z.string()).nonempty().optional(),
resourceRef: z
.union([z.string(), z.array(z.string()).nonempty()])
.optional(),
permission: resourcePermissionSchema,
}),
]);
@@ -178,14 +172,6 @@ const handleRequest = async (
);
}
if (request.resourceRefs) {
return applyConditionsLoaderFor(decision.pluginId).load({
id: request.id,
resourceRefs: request.resourceRefs,
...decision,
});
}
if (!request.resourceRef) {
return {
id: request.id,
@@ -265,9 +251,7 @@ export async function createRouter(
if (
body.items.some(
r =>
isResourcePermission(r.permission) &&
r.resourceRef === undefined &&
r.resourceRefs === undefined,
isResourcePermission(r.permission) && r.resourceRef === undefined,
)
) {
throw new InputError(