committed by
Joe Porpeglia
parent
0b98a49509
commit
979d4b976f
@@ -8,7 +8,7 @@
|
||||
import { CatalogApi } from '@backstage/catalog-client';
|
||||
import { CatalogEntityDocument } from '@backstage/plugin-catalog-common';
|
||||
import { CompoundEntityRef } from '@backstage/catalog-model';
|
||||
import { ConditionalPolicyDecision } from '@backstage/plugin-permission-node';
|
||||
import { ConditionalPolicyDecision } from '@backstage/plugin-permission-common';
|
||||
import { Conditions } from '@backstage/plugin-permission-node';
|
||||
import { Config } from '@backstage/config';
|
||||
import { DocumentCollatorFactory } from '@backstage/plugin-search-common';
|
||||
|
||||
@@ -15,37 +15,11 @@ export type AnyOfCriteria<TQuery> = {
|
||||
anyOf: NonEmptyArray<PermissionCriteria<TQuery>>;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type AuthorizeDecision =
|
||||
| {
|
||||
result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
|
||||
}
|
||||
| {
|
||||
result: AuthorizeResult.CONDITIONAL;
|
||||
conditions: PermissionCriteria<PermissionCondition>;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type AuthorizeQuery = {
|
||||
permission: Permission;
|
||||
resourceRef?: string;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type AuthorizeRequest = {
|
||||
items: Identified<AuthorizeQuery>[];
|
||||
};
|
||||
|
||||
// @public
|
||||
export type AuthorizeRequestOptions = {
|
||||
token?: string;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type AuthorizeResponse = {
|
||||
items: Identified<AuthorizeDecision>[];
|
||||
};
|
||||
|
||||
// @public
|
||||
export enum AuthorizeResult {
|
||||
ALLOW = 'ALLOW',
|
||||
@@ -56,6 +30,14 @@ export enum AuthorizeResult {
|
||||
// @public
|
||||
export type BasicPermission = PermissionBase<'basic', {}>;
|
||||
|
||||
// @public
|
||||
export type ConditionalPolicyDecision = {
|
||||
result: AuthorizeResult.CONDITIONAL;
|
||||
pluginId: string;
|
||||
resourceType: string;
|
||||
conditions: PermissionCriteria<PermissionCondition>;
|
||||
};
|
||||
|
||||
// @public
|
||||
export function createPermission<TResourceType extends string>(input: {
|
||||
name: string;
|
||||
@@ -69,13 +51,42 @@ export function createPermission(input: {
|
||||
attributes: PermissionAttributes;
|
||||
}): BasicPermission;
|
||||
|
||||
// @public
|
||||
export type DefinitivePolicyDecision = {
|
||||
result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type DiscoveryApi = {
|
||||
getBaseUrl(pluginId: string): Promise<string>;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type Identified<T> = T & {
|
||||
export type EvaluatePermissionRequest = {
|
||||
permission: Permission;
|
||||
resourceRef?: string;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type EvaluatePermissionRequestBatch =
|
||||
PermissionMessageBatch<EvaluatePermissionRequest>;
|
||||
|
||||
// @public
|
||||
export type EvaluatePermissionResponse =
|
||||
| {
|
||||
result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
|
||||
}
|
||||
| {
|
||||
result: AuthorizeResult.CONDITIONAL;
|
||||
conditions: PermissionCriteria<PermissionCondition>;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type EvaluatePermissionResponseBatch =
|
||||
PermissionMessageBatch<EvaluatePermissionResponse>;
|
||||
|
||||
// @public
|
||||
export type IdentifiedPermissionMessage<T> = T & {
|
||||
id: string;
|
||||
};
|
||||
|
||||
@@ -114,9 +125,9 @@ export type PermissionAttributes = {
|
||||
export interface PermissionAuthorizer {
|
||||
// (undocumented)
|
||||
authorize(
|
||||
queries: AuthorizeQuery[],
|
||||
requests: EvaluatePermissionRequest[],
|
||||
options?: AuthorizeRequestOptions,
|
||||
): Promise<AuthorizeDecision[]>;
|
||||
): Promise<EvaluatePermissionResponse[]>;
|
||||
}
|
||||
|
||||
// @public
|
||||
@@ -131,9 +142,9 @@ export type PermissionBase<TType extends string, TFields extends object> = {
|
||||
export class PermissionClient implements PermissionAuthorizer {
|
||||
constructor(options: { discovery: DiscoveryApi; config: Config });
|
||||
authorize(
|
||||
queries: AuthorizeQuery[],
|
||||
queries: EvaluatePermissionRequest[],
|
||||
options?: AuthorizeRequestOptions,
|
||||
): Promise<AuthorizeDecision[]>;
|
||||
): Promise<EvaluatePermissionResponse[]>;
|
||||
}
|
||||
|
||||
// @public
|
||||
@@ -149,6 +160,16 @@ export type PermissionCriteria<TQuery> =
|
||||
| NotCriteria<TQuery>
|
||||
| TQuery;
|
||||
|
||||
// @public
|
||||
export type PermissionMessageBatch<T> = {
|
||||
items: IdentifiedPermissionMessage<T>[];
|
||||
};
|
||||
|
||||
// @public
|
||||
export type PolicyDecision =
|
||||
| DefinitivePolicyDecision
|
||||
| ConditionalPolicyDecision;
|
||||
|
||||
// @public
|
||||
export type ResourcePermission<TResourceType extends string = string> =
|
||||
PermissionBase<
|
||||
|
||||
@@ -5,19 +5,22 @@
|
||||
```ts
|
||||
import { AllOfCriteria } from '@backstage/plugin-permission-common';
|
||||
import { AnyOfCriteria } from '@backstage/plugin-permission-common';
|
||||
import { AuthorizeDecision } from '@backstage/plugin-permission-common';
|
||||
import { AuthorizeQuery } from '@backstage/plugin-permission-common';
|
||||
import { AuthorizeRequestOptions } from '@backstage/plugin-permission-common';
|
||||
import { AuthorizeResult } from '@backstage/plugin-permission-common';
|
||||
import { BackstageIdentityResponse } from '@backstage/plugin-auth-node';
|
||||
import { ConditionalPolicyDecision } from '@backstage/plugin-permission-common';
|
||||
import { Config } from '@backstage/config';
|
||||
import { DefinitivePolicyDecision } from '@backstage/plugin-permission-common';
|
||||
import { EvaluatePermissionRequest } from '@backstage/plugin-permission-common';
|
||||
import { EvaluatePermissionResponse } from '@backstage/plugin-permission-common';
|
||||
import express from 'express';
|
||||
import { Identified } from '@backstage/plugin-permission-common';
|
||||
import { IdentifiedPermissionMessage } from '@backstage/plugin-permission-common';
|
||||
import { NotCriteria } from '@backstage/plugin-permission-common';
|
||||
import { Permission } from '@backstage/plugin-permission-common';
|
||||
import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
|
||||
import { PermissionCondition } from '@backstage/plugin-permission-common';
|
||||
import { PermissionCriteria } from '@backstage/plugin-permission-common';
|
||||
import { PluginEndpointDiscovery } from '@backstage/backend-common';
|
||||
import { PolicyDecision } from '@backstage/plugin-permission-common';
|
||||
import { TokenManager } from '@backstage/backend-common';
|
||||
|
||||
// @public
|
||||
@@ -26,7 +29,7 @@ export type ApplyConditionsRequest = {
|
||||
};
|
||||
|
||||
// @public
|
||||
export type ApplyConditionsRequestEntry = Identified<{
|
||||
export type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{
|
||||
resourceRef: string;
|
||||
resourceType: string;
|
||||
conditions: PermissionCriteria<PermissionCondition>;
|
||||
@@ -38,7 +41,8 @@ export type ApplyConditionsResponse = {
|
||||
};
|
||||
|
||||
// @public
|
||||
export type ApplyConditionsResponseEntry = Identified<DefinitivePolicyDecision>;
|
||||
export type ApplyConditionsResponseEntry =
|
||||
IdentifiedPermissionMessage<DefinitivePolicyDecision>;
|
||||
|
||||
// @public
|
||||
export type Condition<TRule> = TRule extends PermissionRule<
|
||||
@@ -49,14 +53,6 @@ export type Condition<TRule> = TRule extends PermissionRule<
|
||||
? (...params: TParams) => PermissionCondition<TParams>
|
||||
: never;
|
||||
|
||||
// @public
|
||||
export type ConditionalPolicyDecision = {
|
||||
result: AuthorizeResult.CONDITIONAL;
|
||||
pluginId: string;
|
||||
resourceType: string;
|
||||
conditions: PermissionCriteria<PermissionCondition>;
|
||||
};
|
||||
|
||||
// @public
|
||||
export type Conditions<
|
||||
TRules extends Record<string, PermissionRule<any, any>>,
|
||||
@@ -116,11 +112,6 @@ export const createPermissionRule: <
|
||||
rule: PermissionRule<TResource, TQuery, TParams>,
|
||||
) => PermissionRule<TResource, TQuery, TParams>;
|
||||
|
||||
// @public
|
||||
export type DefinitivePolicyDecision = {
|
||||
result: AuthorizeResult.ALLOW | AuthorizeResult.DENY;
|
||||
};
|
||||
|
||||
// @alpha
|
||||
export const isAndCriteria: <T>(
|
||||
criteria: PermissionCriteria<T>,
|
||||
@@ -147,7 +138,7 @@ export const makeCreatePermissionRule: <TResource, TQuery>() => <
|
||||
export interface PermissionPolicy {
|
||||
// (undocumented)
|
||||
handle(
|
||||
request: PolicyAuthorizeQuery,
|
||||
request: PolicyQuery,
|
||||
user?: BackstageIdentityResponse,
|
||||
): Promise<PolicyDecision>;
|
||||
}
|
||||
@@ -165,20 +156,17 @@ export type PermissionRule<
|
||||
};
|
||||
|
||||
// @public
|
||||
export type PolicyAuthorizeQuery = Omit<AuthorizeQuery, 'resourceRef'>;
|
||||
|
||||
// @public
|
||||
export type PolicyDecision =
|
||||
| DefinitivePolicyDecision
|
||||
| ConditionalPolicyDecision;
|
||||
export type PolicyQuery = {
|
||||
permission: Permission;
|
||||
};
|
||||
|
||||
// @public
|
||||
export class ServerPermissionClient implements PermissionAuthorizer {
|
||||
// (undocumented)
|
||||
authorize(
|
||||
queries: AuthorizeQuery[],
|
||||
requests: EvaluatePermissionRequest[],
|
||||
options?: AuthorizeRequestOptions,
|
||||
): Promise<AuthorizeDecision[]>;
|
||||
): Promise<EvaluatePermissionResponse[]>;
|
||||
// (undocumented)
|
||||
static fromConfig(
|
||||
config: Config,
|
||||
|
||||
@@ -4,11 +4,11 @@
|
||||
|
||||
```ts
|
||||
import { ApiRef } from '@backstage/core-plugin-api';
|
||||
import { AuthorizeDecision } from '@backstage/plugin-permission-common';
|
||||
import { AuthorizeQuery } from '@backstage/plugin-permission-common';
|
||||
import { ComponentProps } from 'react';
|
||||
import { Config } from '@backstage/config';
|
||||
import { DiscoveryApi } from '@backstage/core-plugin-api';
|
||||
import { EvaluatePermissionRequest } from '@backstage/plugin-permission-common';
|
||||
import { EvaluatePermissionResponse } from '@backstage/plugin-permission-common';
|
||||
import { IdentityApi } from '@backstage/core-plugin-api';
|
||||
import { Permission } from '@backstage/plugin-permission-common';
|
||||
import { ReactElement } from 'react';
|
||||
@@ -25,7 +25,9 @@ export type AsyncPermissionResult = {
|
||||
// @public
|
||||
export class IdentityPermissionApi implements PermissionApi {
|
||||
// (undocumented)
|
||||
authorize(request: AuthorizeQuery): Promise<AuthorizeDecision>;
|
||||
authorize(
|
||||
request: EvaluatePermissionRequest,
|
||||
): Promise<EvaluatePermissionResponse>;
|
||||
// (undocumented)
|
||||
static create(options: {
|
||||
config: Config;
|
||||
@@ -36,7 +38,9 @@ export class IdentityPermissionApi implements PermissionApi {
|
||||
|
||||
// @public
|
||||
export type PermissionApi = {
|
||||
authorize(request: AuthorizeQuery): Promise<AuthorizeDecision>;
|
||||
authorize(
|
||||
request: EvaluatePermissionRequest,
|
||||
): Promise<EvaluatePermissionResponse>;
|
||||
};
|
||||
|
||||
// @public
|
||||
|
||||
Reference in New Issue
Block a user