permissions: add a discriminator type to Permission

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

plugins/permission-common/api-report.md

@@ -54,10 +54,7 @@ export enum AuthorizeResult {
 }
 
 // @public
-export type BasicPermission = {
-  name: string;
-  attributes: PermissionAttributes;
-};
+export type BasicPermission = PermissionBase<'basic', {}>;
 
 // @public
 export function createPermission<TResourceType extends string>(input: {
@@ -122,6 +119,14 @@ export interface PermissionAuthorizer {
   ): Promise<AuthorizeDecision[]>;
 }
 
+// @public
+export type PermissionBase<TType extends string, TFields extends object> = {
+  name: string;
+  attributes: PermissionAttributes;
+} & {
+  type: TType;
+} & TFields;
+
 // @public
 export class PermissionClient implements PermissionAuthorizer {
   constructor(options: { discovery: DiscoveryApi; config: Config });
@@ -145,7 +150,11 @@ export type PermissionCriteria<TQuery> =
   | TQuery;
 
 // @public
-export type ResourcePermission<T extends string = string> = BasicPermission & {
-  resourceType: T;
-};
+export type ResourcePermission<TResourceType extends string = string> =
+  PermissionBase<
+    'resource',
+    {
+      resourceType: TResourceType;
+    }
+  >;
 ```

plugins/permission-common/src/permissions/createPermission.ts

@@ -41,10 +41,27 @@ export function createPermission(input: {
   name: string;
   attributes: PermissionAttributes;
 }): BasicPermission;
-export function createPermission(input: {
+export function createPermission({
+  name,
+  attributes,
+  resourceType,
+}: {
   name: string;
   attributes: PermissionAttributes;
   resourceType?: string;
 }): Permission {
-  return input;
+  if (resourceType) {
+    return {
+      type: 'resource',
+      name,
+      attributes,
+      resourceType,
+    };
+  }
+
+  return {
+    type: 'basic',
+    name,
+    attributes,
+  };
 }

plugins/permission-common/src/types/index.ts

@@ -33,6 +33,7 @@ export type {
   PermissionAttributes,
   Permission,
   PermissionAuthorizer,
+  PermissionBase,
   ResourcePermission,
   AuthorizeRequestOptions,
 } from './permission';

plugins/permission-common/src/types/permission.ts

@@ -25,6 +25,23 @@ export type PermissionAttributes = {
   action?: 'create' | 'read' | 'update' | 'delete';
 };
 
+/**
+ * Generic type for building {@link Permission} types.
+ * @public
+ */
+export type PermissionBase<TType extends string, TFields extends object> = {
+  /**
+   * The name of the permission.
+   */
+  name: string;
+  /**
+   * {@link PermissionAttributes} which describe characteristics of the permission, to help
+   * policy authors make consistent decisions for similar permissions without referring to them
+   * all by name.
+   */
+  attributes: PermissionAttributes;
+} & { type: TType } & TFields;
+
 /**
  * A permission that can be checked through authorization.
  *
@@ -44,31 +61,24 @@ export type Permission = BasicPermission | ResourcePermission;
  * A standard {@link Permission} with no additional capabilities or restrictions.
  * @public
  */
-export type BasicPermission = {
-  /**
-   * The name of the permission.
-   */
-  name: string;
-  /**
-   * {@link PermissionAttributes} which describe characteristics of the permission, to help
-   * policy authors make consistent decisions for similar permissions without referring to them
-   * all by name.
-   */
-  attributes: PermissionAttributes;
-};
+export type BasicPermission = PermissionBase<'basic', {}>;
 
 /**
  * ResourcePermissions are {@link Permission}s that can be authorized based on
  * characteristics of a resource such a catalog entity.
  * @public
  */
-export type ResourcePermission<T extends string = string> = BasicPermission & {
-  /**
-   * Denotes the type of the resource whose resourceRef should be passed when
-   * authorizing.
-   */
-  resourceType: T;
-};
+export type ResourcePermission<TResourceType extends string = string> =
+  PermissionBase<
+    'resource',
+    {
+      /**
+       * Denotes the type of the resource whose resourceRef should be passed when
+       * authorizing.
+       */
+      resourceType: TResourceType;
+    }
+  >;
 
 /**
  * A client interacting with the permission backend can implement this authorizer interface.