permission: do not forward resourceRefs for basic permissions

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>

plugins/permission-common/src/PermissionClient.test.ts

@@ -266,16 +266,31 @@ describe('PermissionClient', () => {
     });
 
     it('should include a request body', async () => {
-      await client.authorize([mockAuthorizeConditional]);
+      const basicPermission = createPermission({
+        name: 'test.permission-basic',
+        attributes: {},
+      });
+
+      await client.authorize([
+        { permission: mockPermission, resourceRef: 'foo:bar' },
+        { permission: mockPermission, resourceRef: 'foo:car' },
+        { permission: mockPermission, resourceRef: 'foo:baz' },
+        { permission: basicPermission },
+      ]);
 
       const request = mockAuthorizeHandler.mock.calls[0][0];
 
       expect(request.body).toEqual({
         items: [
-          expect.objectContaining({
+          {
+            id: expect.any(String),
             permission: mockPermission,
-            resourceRefs: ['foo:bar'],
-          }),
+            resourceRefs: ['foo:bar', 'foo:car', 'foo:baz'],
+          },
+          {
+            id: expect.any(String),
+            permission: basicPermission,
+          },
         ],
       });
     });
@@ -447,7 +462,6 @@ describe('PermissionClient', () => {
               name: 'test.permission3',
               attributes: {},
             },
-            resourceRefs: [],
             id: expect.any(String),
           },
           {

plugins/permission-common/src/PermissionClient.ts

@@ -32,7 +32,13 @@ import {
   IdentifiedPermissionMessage,
 } from './types/api';
 import { DiscoveryApi } from './types/discovery';
-import { AuthorizeRequestOptions, Permission } from './types/permission';
+import {
+  AuthorizeRequestOptions,
+  BasicPermission,
+  Permission,
+  ResourcePermission,
+} from './types/permission';
+import { isResourcePermission } from './permissions';
 
 const permissionCriteriaSchema: z.ZodSchema<
   PermissionCriteria<PermissionCondition>
@@ -199,14 +205,21 @@ export class PermissionClient implements PermissionEvaluator {
     for (const query of queries) {
       const { permission, resourceRef } = query;
 
-      request[permission.name] ||= {
-        permission,
-        resourceRefs: [],
-        id: uuid.v4(),
-      };
+      if (isResourcePermission(permission)) {
+        request[permission.name] ||= {
+          permission,
+          resourceRefs: [],
+          id: uuid.v4(),
+        };
+      } else {
+        request[permission.name] ||= {
+          permission,
+          id: uuid.v4(),
+        };
+      }
 
       if (resourceRef) {
-        request[permission.name].resourceRefs.push(resourceRef);
+        request[permission.name].resourceRefs?.push(resourceRef);
       }
     }
 
@@ -257,7 +270,10 @@ export class PermissionClient implements PermissionEvaluator {
   }
 }
 
-export type BatchedAuthorizePermissionRequest = IdentifiedPermissionMessage<{
-  permission: Permission;
-  resourceRefs: string[];
-}>;
+export type BatchedAuthorizePermissionRequest = IdentifiedPermissionMessage<
+  | {
+      permission: BasicPermission;
+      resourceRefs?: undefined;
+    }
+  | { permission: ResourcePermission; resourceRefs: string[] }
+>;