diff --git a/.changeset/gold-rabbits-change.md b/.changeset/gold-rabbits-change.md new file mode 100644 index 0000000000..0ede93af58 --- /dev/null +++ b/.changeset/gold-rabbits-change.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-permission-node': patch +--- + +Added a new `PermissionRuleAccessor` type that encapsulates a lookup function for permission rules, which can be created by the new `PermissionsRegistryService` via the `getRuleAccessor` method. The `createConditionTransformer` and `createConditionAuthorizer` functions have been adapted to receive these accessors as arguments, with their older counterparts being deprecated. diff --git a/plugins/permission-node/report.api.md b/plugins/permission-node/report.api.md index 2bbc548202..2e447ddb1e 100644 --- a/plugins/permission-node/report.api.md +++ b/plugins/permission-node/report.api.md @@ -78,9 +78,14 @@ export type ConditionTransformer = ( ) => PermissionCriteria; // @public -export const createConditionAuthorizer: ( +export function createConditionAuthorizer( + permissionRuleAccessor: PermissionRuleAccessor, +): (decision: PolicyDecision, resource: TResource | undefined) => boolean; + +// @public @deprecated (undocumented) +export function createConditionAuthorizer( rules: PermissionRule[], -) => (decision: PolicyDecision, resource: TResource | undefined) => boolean; +): (decision: PolicyDecision, resource: TResource | undefined) => boolean; // @public export function createConditionExports< @@ -124,12 +129,15 @@ export const createConditionFactory: < ) => (params: TParams) => PermissionCondition; // @public -export const createConditionTransformer: < +export function createConditionTransformer( + permissionRuleAccessor: PermissionRuleAccessor, +): ConditionTransformer; + +// @public @deprecated (undocumented) +export function createConditionTransformer< TQuery, TRules extends PermissionRule[], ->( - permissionRules: [...TRules], -) => ConditionTransformer; +>(permissionRules: [...TRules]): ConditionTransformer; // @public export function createPermissionIntegrationRouter< @@ -331,6 +339,13 @@ export type PermissionRule< toQuery(params: NoInfer_2): PermissionCriteria; }; +// @public +export type PermissionRuleAccessor< + TResource = unknown, + TQuery = unknown, + TResourceType extends string = string, +> = (name: string) => PermissionRule; + // @public export type PolicyQuery = { permission: Permission; diff --git a/plugins/permission-node/src/integration/createConditionTransformer.ts b/plugins/permission-node/src/integration/createConditionTransformer.ts index 4b6f933f79..a7dbabc903 100644 --- a/plugins/permission-node/src/integration/createConditionTransformer.ts +++ b/plugins/permission-node/src/integration/createConditionTransformer.ts @@ -20,7 +20,7 @@ import { PermissionCondition, PermissionCriteria, } from '@backstage/plugin-permission-common'; -import { PermissionRule } from '../types'; +import { PermissionRule, PermissionRuleAccessor } from '../types'; import { createGetRule, isAndCriteria, @@ -76,13 +76,26 @@ export type ConditionTransformer = ( * * @public */ -export const createConditionTransformer = < +export function createConditionTransformer( + permissionRuleAccessor: PermissionRuleAccessor, +): ConditionTransformer; +/** + * @public + * @deprecated Use the version of `createConditionTransformer` that accepts a `PermissionRuleAccessor` instead. + */ +export function createConditionTransformer< TQuery, TRules extends PermissionRule[], ->( - permissionRules: [...TRules], -): ConditionTransformer => { - const getRule = createGetRule(permissionRules); +>(permissionRules: [...TRules]): ConditionTransformer; +export function createConditionTransformer( + permissionRules: + | PermissionRule[] + | PermissionRuleAccessor, +): ConditionTransformer { + const getRule = + typeof permissionRules === 'function' + ? permissionRules + : createGetRule(permissionRules); return conditions => mapConditions(conditions, getRule); -}; +} diff --git a/plugins/permission-node/src/types.ts b/plugins/permission-node/src/types.ts index 0a7e06ed91..da071aa4d9 100644 --- a/plugins/permission-node/src/types.ts +++ b/plugins/permission-node/src/types.ts @@ -66,3 +66,20 @@ export type PermissionRule< */ toQuery(params: NoInfer): PermissionCriteria; }; + +/** + * A function that can be used to look up permission rules by name for a particular resource type. + * + * @remarks + * + * Accessed via {@link @backstage/backend-plugin-api#PermissionsRegistryService.getRuleAccessor}. + * + * Will throw an error if a rule with the provided name does not exist. + * + * @public + */ +export type PermissionRuleAccessor< + TResource = unknown, + TQuery = unknown, + TResourceType extends string = string, +> = (name: string) => PermissionRule;