From 8fe84eadaf5a414240aac2ba7d57141a4a5122a5 Mon Sep 17 00:00:00 2001 From: MT Lewis Date: Thu, 6 Jan 2022 16:46:17 +0000 Subject: [PATCH] catalog-backend: add type parameter to CatalogPermissionRule type Previously the CatalogPermissionRule type had a fixed type of unknown[] for the parameters expected in the `apply` and `toQuery` methods. This meant that conditions generated for these rules would always have unknown parameters too, which makes using them in policies much more difficult. To address this, this commit introduces a mandatory type parameter for CatalogPermissionRule which is expected to be set to a tuple corresponding to the expected parameters. Signed-off-by: MT Lewis --- plugins/catalog-backend/api-report.md | 23 +++++++++++-------- .../permissions/rules/createPropertyRule.ts | 2 +- .../src/permissions/rules/hasAnnotation.ts | 2 +- .../src/permissions/rules/hasLabel.ts | 2 +- .../src/permissions/rules/isEntityKind.ts | 2 +- .../src/permissions/rules/isEntityOwner.ts | 2 +- .../catalog-backend/src/permissions/types.ts | 5 ++-- .../src/service/NextCatalogBuilder.ts | 4 ++-- .../catalog-backend/src/service/NextRouter.ts | 2 +- 9 files changed, 24 insertions(+), 20 deletions(-) diff --git a/plugins/catalog-backend/api-report.md b/plugins/catalog-backend/api-report.md index 6d7834001a..33f0fab18e 100644 --- a/plugins/catalog-backend/api-report.md +++ b/plugins/catalog-backend/api-report.md @@ -307,9 +307,10 @@ export type CatalogEnvironment = { }; // @public -export type CatalogPermissionRule = PermissionRule< +export type CatalogPermissionRule = PermissionRule< Entity, - EntitiesSearchFilter + EntitiesSearchFilter, + TParams >; // Warning: (ae-missing-release-tag) "CatalogProcessingEngine" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) @@ -1311,7 +1312,9 @@ export class NextCatalogBuilder { addEntityPolicy(...policies: EntityPolicy[]): NextCatalogBuilder; // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen addEntityProvider(...providers: EntityProvider[]): NextCatalogBuilder; - addPermissionRules(...permissionRules: CatalogPermissionRule[]): void; + addPermissionRules( + ...permissionRules: CatalogPermissionRule[] + ): void; // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen addProcessor(...processors: CatalogProcessor[]): NextCatalogBuilder; build(): Promise<{ @@ -1359,7 +1362,7 @@ export interface NextRouterOptions { // (undocumented) logger: Logger_2; // (undocumented) - permissionRules?: CatalogPermissionRule[]; + permissionRules?: CatalogPermissionRule[]; // (undocumented) refreshService?: RefreshService; } @@ -1394,12 +1397,12 @@ export function parseEntityYaml( // @public export const permissionRules: { - hasAnnotation: CatalogPermissionRule; - hasLabel: CatalogPermissionRule; - hasMetadata: CatalogPermissionRule; - hasSpec: CatalogPermissionRule; - isEntityKind: CatalogPermissionRule; - isEntityOwner: CatalogPermissionRule; + hasAnnotation: CatalogPermissionRule<[annotation: string]>; + hasLabel: CatalogPermissionRule<[label: string]>; + hasMetadata: CatalogPermissionRule<[key: string, value?: string | undefined]>; + hasSpec: CatalogPermissionRule<[key: string, value?: string | undefined]>; + isEntityKind: CatalogPermissionRule<[kinds: string[]]>; + isEntityOwner: CatalogPermissionRule<[claims: string[]]>; }; // Warning: (ae-missing-release-tag) "PlaceholderProcessor" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) diff --git a/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts b/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts index 92e53f930f..254eb164da 100644 --- a/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts +++ b/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts @@ -21,7 +21,7 @@ import { get } from 'lodash'; export function createPropertyRule( propertyType: 'metadata' | 'spec', -): CatalogPermissionRule { +): CatalogPermissionRule<[key: string, value?: string]> { return { name: `HAS_${propertyType.toUpperCase()}`, description: `Allow entities which have the specified ${propertyType} subfield.`, diff --git a/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts b/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts index 57ded3d779..baab28d838 100644 --- a/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts +++ b/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts @@ -23,7 +23,7 @@ import { CatalogPermissionRule } from '../types'; * annotation on a given entity. * @public */ -export const hasAnnotation: CatalogPermissionRule = { +export const hasAnnotation: CatalogPermissionRule<[annotation: string]> = { name: 'HAS_ANNOTATION', description: 'Allow entities which are annotated with the specified annotation', diff --git a/plugins/catalog-backend/src/permissions/rules/hasLabel.ts b/plugins/catalog-backend/src/permissions/rules/hasLabel.ts index f93c5aeae6..a790f1441f 100644 --- a/plugins/catalog-backend/src/permissions/rules/hasLabel.ts +++ b/plugins/catalog-backend/src/permissions/rules/hasLabel.ts @@ -23,7 +23,7 @@ import { CatalogPermissionRule } from '../types'; * label in its metadata. * @public */ -export const hasLabel: CatalogPermissionRule = { +export const hasLabel: CatalogPermissionRule<[label: string]> = { name: 'HAS_LABEL', description: 'Allow entities which have the specified label metadata.', apply: (resource: Entity, label: string) => diff --git a/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts b/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts index 64fcf7482d..024188939f 100644 --- a/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts +++ b/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts @@ -22,7 +22,7 @@ import { CatalogPermissionRule } from '../types'; * kind. * @public */ -export const isEntityKind: CatalogPermissionRule = { +export const isEntityKind: CatalogPermissionRule<[kinds: string[]]> = { name: 'IS_ENTITY_KIND', description: 'Allow entities with the specified kind', apply(resource: Entity, kinds: string[]) { diff --git a/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts b/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts index e89159e6b4..e450cdf721 100644 --- a/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts +++ b/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts @@ -27,7 +27,7 @@ import { CatalogPermissionRule } from '../types'; * owner. * @public */ -export const isEntityOwner: CatalogPermissionRule = { +export const isEntityOwner: CatalogPermissionRule<[claims: string[]]> = { name: 'IS_ENTITY_OWNER', description: 'Allow entities owned by the current user', apply: (resource: Entity, claims: string[]) => { diff --git a/plugins/catalog-backend/src/permissions/types.ts b/plugins/catalog-backend/src/permissions/types.ts index cc2b8f4d45..4a0d9dc1fc 100644 --- a/plugins/catalog-backend/src/permissions/types.ts +++ b/plugins/catalog-backend/src/permissions/types.ts @@ -24,7 +24,8 @@ import { EntitiesSearchFilter } from '../catalog/types'; * * @public */ -export type CatalogPermissionRule = PermissionRule< +export type CatalogPermissionRule = PermissionRule< Entity, - EntitiesSearchFilter + EntitiesSearchFilter, + TParams >; diff --git a/plugins/catalog-backend/src/service/NextCatalogBuilder.ts b/plugins/catalog-backend/src/service/NextCatalogBuilder.ts index 1dcb632e64..e707423670 100644 --- a/plugins/catalog-backend/src/service/NextCatalogBuilder.ts +++ b/plugins/catalog-backend/src/service/NextCatalogBuilder.ts @@ -130,7 +130,7 @@ export class NextCatalogBuilder { maxSeconds: 150, }); private locationAnalyzer: LocationAnalyzer | undefined = undefined; - private permissionRules: CatalogPermissionRule[]; + private permissionRules: CatalogPermissionRule[]; constructor(env: CatalogEnvironment) { this.env = env; @@ -331,7 +331,7 @@ export class NextCatalogBuilder { * * @param permissionRules - Additional permission rules */ - addPermissionRules(...permissionRules: CatalogPermissionRule[]) { + addPermissionRules(...permissionRules: CatalogPermissionRule[]) { this.permissionRules.push(...permissionRules); } diff --git a/plugins/catalog-backend/src/service/NextRouter.ts b/plugins/catalog-backend/src/service/NextRouter.ts index 7aae564a45..948424ec88 100644 --- a/plugins/catalog-backend/src/service/NextRouter.ts +++ b/plugins/catalog-backend/src/service/NextRouter.ts @@ -49,7 +49,7 @@ export interface NextRouterOptions { refreshService?: RefreshService; logger: Logger; config: Config; - permissionRules?: CatalogPermissionRule[]; + permissionRules?: CatalogPermissionRule[]; } export async function createNextRouter(