permission-backend: accept resourceRef as array

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>

plugins/permission-node/src/integration/createPermissionIntegrationRouter.test.ts

@@ -567,7 +567,7 @@ describe('createPermissionIntegrationRouter', () => {
       });
     });
 
-    describe('batched requests with resourceRefs', () => {
+    describe('batched requests with resourceRef as an array', () => {
       let response: Response;
 
       beforeEach(async () => {
@@ -587,7 +587,7 @@ describe('createPermissionIntegrationRouter', () => {
             items: [
               {
                 id: '123',
-                resourceRefs: [
+                resourceRef: [
                   'default:test/resource-1',
                   'default:test/resource-2',
                 ],

plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts

@@ -58,22 +58,12 @@ const permissionCriteriaSchema: z.ZodSchema<
 
 const applyConditionsRequestSchema = z.object({
   items: z.array(
-    z.union([
-      z.object({
-        id: z.string(),
-        resourceRef: z.string(),
-        resourceRefs: z.undefined().optional(),
-        resourceType: z.string(),
-        conditions: permissionCriteriaSchema,
-      }),
-      z.object({
-        id: z.string(),
-        resourceRef: z.undefined().optional(),
-        resourceRefs: z.array(z.string()),
-        resourceType: z.string(),
-        conditions: permissionCriteriaSchema,
-      }),
-    ]),
+    z.object({
+      id: z.string(),
+      resourceRef: z.union([z.string(), z.array(z.string()).nonempty()]),
+      resourceType: z.string(),
+      conditions: permissionCriteriaSchema,
+    }),
   ),
 });
 
@@ -83,20 +73,11 @@ const applyConditionsRequestSchema = z.object({
  *
  * @public
  */
-export type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<
-  | {
-      resourceRef: string;
-      resourceRefs?: undefined;
-      resourceType: string;
-      conditions: PermissionCriteria<PermissionCondition>;
-    }
-  | {
-      resourceRef?: undefined;
-      resourceRefs: string[];
-      resourceType: string;
-      conditions: PermissionCriteria<PermissionCondition>;
-    }
->;
+export type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{
+  resourceRef: string | string[];
+  resourceType: string;
+  conditions: PermissionCriteria<PermissionCondition>;
+}>;
 
 /**
  * A batch of {@link ApplyConditionsRequestEntry} objects.
@@ -536,7 +517,7 @@ export function createPermissionIntegrationRouter<
           requestedType,
           requests
             .filter(r => r.resourceType === requestedType)
-            .map(i => i.resourceRefs ?? [i.resourceRef])
+            .map(i => i.resourceRef)
             .flat(),
         );
       }
@@ -544,8 +525,8 @@ export function createPermissionIntegrationRouter<
       res.json({
         items: requests.map(request => ({
           id: request.id,
-          result: request.resourceRefs
-            ? request.resourceRefs.map(resourceRef =>
+          result: Array.isArray(request.resourceRef)
+            ? request.resourceRef.map(resourceRef =>
                 authorizeResult(
                   request.conditions,
                   resourcesByType[request.resourceType][resourceRef],