catalog-backend: add type parameter to CatalogPermissionRule type

Previously the CatalogPermissionRule type had a fixed type of unknown[]
for the parameters expected in the `apply` and `toQuery` methods. This
meant that conditions generated for these rules would always have
unknown parameters too, which makes using them in policies much more
difficult.

To address this, this commit introduces a mandatory type parameter for
CatalogPermissionRule which is expected to be set to a tuple
corresponding to the expected parameters.

Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>

plugins/catalog-backend/api-report.md

@@ -307,9 +307,10 @@ export type CatalogEnvironment = {
 };
 
 // @public
-export type CatalogPermissionRule = PermissionRule<
+export type CatalogPermissionRule<TParams extends unknown[]> = PermissionRule<
   Entity,
-  EntitiesSearchFilter
+  EntitiesSearchFilter,
+  TParams
 >;
 
 // Warning: (ae-missing-release-tag) "CatalogProcessingEngine" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1311,7 +1312,9 @@ export class NextCatalogBuilder {
   addEntityPolicy(...policies: EntityPolicy[]): NextCatalogBuilder;
   // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
   addEntityProvider(...providers: EntityProvider[]): NextCatalogBuilder;
-  addPermissionRules(...permissionRules: CatalogPermissionRule[]): void;
+  addPermissionRules(
+    ...permissionRules: CatalogPermissionRule<unknown[]>[]
+  ): void;
   // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
   addProcessor(...processors: CatalogProcessor[]): NextCatalogBuilder;
   build(): Promise<{
@@ -1359,7 +1362,7 @@ export interface NextRouterOptions {
   // (undocumented)
   logger: Logger_2;
   // (undocumented)
-  permissionRules?: CatalogPermissionRule[];
+  permissionRules?: CatalogPermissionRule<unknown[]>[];
   // (undocumented)
   refreshService?: RefreshService;
 }
@@ -1394,12 +1397,12 @@ export function parseEntityYaml(
 
 // @public
 export const permissionRules: {
-  hasAnnotation: CatalogPermissionRule;
-  hasLabel: CatalogPermissionRule;
-  hasMetadata: CatalogPermissionRule;
-  hasSpec: CatalogPermissionRule;
-  isEntityKind: CatalogPermissionRule;
-  isEntityOwner: CatalogPermissionRule;
+  hasAnnotation: CatalogPermissionRule<[annotation: string]>;
+  hasLabel: CatalogPermissionRule<[label: string]>;
+  hasMetadata: CatalogPermissionRule<[key: string, value?: string | undefined]>;
+  hasSpec: CatalogPermissionRule<[key: string, value?: string | undefined]>;
+  isEntityKind: CatalogPermissionRule<[kinds: string[]]>;
+  isEntityOwner: CatalogPermissionRule<[claims: string[]]>;
 };
 
 // Warning: (ae-missing-release-tag) "PlaceholderProcessor" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)

plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts

@@ -21,7 +21,7 @@ import { get } from 'lodash';
 
 export function createPropertyRule(
   propertyType: 'metadata' | 'spec',
-): CatalogPermissionRule {
+): CatalogPermissionRule<[key: string, value?: string]> {
   return {
     name: `HAS_${propertyType.toUpperCase()}`,
     description: `Allow entities which have the specified ${propertyType} subfield.`,

plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts

@@ -23,7 +23,7 @@ import { CatalogPermissionRule } from '../types';
  * annotation on a given entity.
  * @public
  */
-export const hasAnnotation: CatalogPermissionRule = {
+export const hasAnnotation: CatalogPermissionRule<[annotation: string]> = {
   name: 'HAS_ANNOTATION',
   description:
     'Allow entities which are annotated with the specified annotation',

plugins/catalog-backend/src/permissions/rules/hasLabel.ts

@@ -23,7 +23,7 @@ import { CatalogPermissionRule } from '../types';
  * label in its metadata.
  * @public
  */
-export const hasLabel: CatalogPermissionRule = {
+export const hasLabel: CatalogPermissionRule<[label: string]> = {
   name: 'HAS_LABEL',
   description: 'Allow entities which have the specified label metadata.',
   apply: (resource: Entity, label: string) =>

plugins/catalog-backend/src/permissions/rules/isEntityKind.ts

@@ -22,7 +22,7 @@ import { CatalogPermissionRule } from '../types';
  * kind.
  * @public
  */
-export const isEntityKind: CatalogPermissionRule = {
+export const isEntityKind: CatalogPermissionRule<[kinds: string[]]> = {
   name: 'IS_ENTITY_KIND',
   description: 'Allow entities with the specified kind',
   apply(resource: Entity, kinds: string[]) {

plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts

@@ -27,7 +27,7 @@ import { CatalogPermissionRule } from '../types';
  * owner.
  * @public
  */
-export const isEntityOwner: CatalogPermissionRule = {
+export const isEntityOwner: CatalogPermissionRule<[claims: string[]]> = {
   name: 'IS_ENTITY_OWNER',
   description: 'Allow entities owned by the current user',
   apply: (resource: Entity, claims: string[]) => {

plugins/catalog-backend/src/permissions/types.ts

@@ -24,7 +24,8 @@ import { EntitiesSearchFilter } from '../catalog/types';
  *
  * @public
  */
-export type CatalogPermissionRule = PermissionRule<
+export type CatalogPermissionRule<TParams extends unknown[]> = PermissionRule<
   Entity,
-  EntitiesSearchFilter
+  EntitiesSearchFilter,
+  TParams
 >;

plugins/catalog-backend/src/service/NextCatalogBuilder.ts

@@ -130,7 +130,7 @@ export class NextCatalogBuilder {
       maxSeconds: 150,
     });
   private locationAnalyzer: LocationAnalyzer | undefined = undefined;
-  private permissionRules: CatalogPermissionRule[];
+  private permissionRules: CatalogPermissionRule<unknown[]>[];
 
   constructor(env: CatalogEnvironment) {
     this.env = env;
@@ -331,7 +331,7 @@ export class NextCatalogBuilder {
    *
    * @param permissionRules - Additional permission rules
    */
-  addPermissionRules(...permissionRules: CatalogPermissionRule[]) {
+  addPermissionRules(...permissionRules: CatalogPermissionRule<unknown[]>[]) {
     this.permissionRules.push(...permissionRules);
   }
 

plugins/catalog-backend/src/service/NextRouter.ts

@@ -49,7 +49,7 @@ export interface NextRouterOptions {
   refreshService?: RefreshService;
   logger: Logger;
   config: Config;
-  permissionRules?: CatalogPermissionRule[];
+  permissionRules?: CatalogPermissionRule<unknown[]>[];
 }
 
 export async function createNextRouter(