permissions: ensure returned conditions match permission in PermissionPolicy#handle (#10075)

* permission-node: fix signature of permission rule in test suites

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

* permission-common: add isPermission helper for comparing permissions

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

* permission-node: adjust createConditionExports for more type safety

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

* permissions: add resourceType property to PermissionCondition and PermissionRule

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

* catalog: handle changes to PermissionCondition and PermissionRule types

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

* catalog-backend: avoid re-exporting alpha import

cf. https://github.com/backstage/backstage/pull/10128

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

* Update changeset

Signed-off-by: Joe Porpeglia <josephp@spotify.com>

* Resolve api-report conflict

Signed-off-by: Joon Park <joonp@spotify.com>

Co-authored-by: Joe Porpeglia <josephp@spotify.com>
Co-authored-by: Joon Park <joonp@spotify.com>

plugins/permission-common/api-report.md

@@ -89,6 +89,12 @@ export function isCreatePermission(permission: Permission): boolean;
 // @public
 export function isDeletePermission(permission: Permission): boolean;
 
+// @public
+export function isPermission<T extends Permission>(
+  permission: Permission,
+  comparedPermission: T,
+): permission is T;
+
 // @public
 export function isReadPermission(permission: Permission): boolean;
 
@@ -141,7 +147,11 @@ export class PermissionClient implements PermissionAuthorizer {
 }
 
 // @public
-export type PermissionCondition<TParams extends unknown[] = unknown[]> = {
+export type PermissionCondition<
+  TResourceType extends string = string,
+  TParams extends unknown[] = unknown[],
+> = {
+  resourceType: TResourceType;
   rule: string;
   params: TParams;
 };

plugins/permission-common/src/PermissionClient.ts

@@ -41,6 +41,7 @@ const permissionCriteriaSchema: z.ZodSchema<
   z
     .object({
       rule: z.string(),
+      resourceType: z.string(),
       params: z.array(z.unknown()),
     })
     .strict()

plugins/permission-common/src/permissions/util.ts

@@ -16,6 +16,17 @@
 
 import { Permission, ResourcePermission } from '../types';
 
+/**
+ * Check if the two parameters are equivalent permissions.
+ * @public
+ */
+export function isPermission<T extends Permission>(
+  permission: Permission,
+  comparedPermission: T,
+): permission is T {
+  return permission.name === comparedPermission.name;
+}
+
 /**
  * Check if a given permission is a {@link ResourcePermission}. When
  * `resourceType` is supplied as the second parameter, also checks if

plugins/permission-common/src/types/api.ts

@@ -98,7 +98,11 @@ export type PolicyDecision =
  * claims from a identity token.
  * @public
  */
-export type PermissionCondition<TParams extends unknown[] = unknown[]> = {
+export type PermissionCondition<
+  TResourceType extends string = string,
+  TParams extends unknown[] = unknown[],
+> = {
+  resourceType: TResourceType;
   rule: string;
   params: TParams;
 };