search: throw error for unexpected non-resource permissions when authorizing result-by-result

We only reach this point in the code for types where the initial
authorization returned CONDITIONAL -- ALLOWs return early immediately
above, and types where the decision was DENY get filtered out entirely
when querying.

This means the call to isResourcePermission here is mostly about
narrowing the types, since the only way for it to be false is if the
PermissionPolicy returned a CONDITIONAL decision for a non-resource
permission, which can't happen - it would throw an error during
validation in the permission-backend.

Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>

plugins/search-backend/src/service/AuthorizedSearchEngine.ts

@@ -198,14 +198,27 @@ export class AuthorizedSearchEngine implements SearchEngine {
           const permission = this.types[result.type]?.visibilityPermission;
           const resourceRef = result.document.authorization?.resourceRef;
 
-          if (
-            !permission ||
-            !isResourcePermission(permission) ||
-            !resourceRef
-          ) {
+          if (!permission || !resourceRef) {
             return result;
           }
 
+          // We only reach this point in the code for types where the initial
+          // authorization returned CONDITIONAL -- ALLOWs return early
+          // immediately above, and types where the decision was DENY get
+          // filtered out entirely when querying.
+          //
+          // This means the call to isResourcePermission here is mostly about
+          // narrowing the type of permission - the only way to get here with a
+          // non-resource permission is if the PermissionPolicy returns a
+          // CONDITIONAL decision for a non-resource permission, which can't
+          // happen - it would throw an error during validation in the
+          // permission-backend.
+          if (!isResourcePermission(permission)) {
+            throw new Error(
+              `Unexpected conditional decision returned for non-resource permission "${permission.name}"`,
+            );
+          }
+
           return authorizer
             .load({ permission, resourceRef })
             .then(decision =>