@backstage-community/plugin-rbac-backend/dist/admin-permissions/admin-creation.cjs.js

'use strict';

var auditor = require('../auditor/auditor.cjs.js');
var helper = require('../helper.cjs.js');
var policiesValidation = require('../validation/policies-validation.cjs.js');

const ADMIN_ROLE_NAME = "role:default/rbac_admin";
const ADMIN_ROLE_AUTHOR = "application configuration";
const DEF_ADMIN_ROLE_DESCRIPTION = "The default permission policy for the admin role allows for the creation, deletion, updating, and reading of roles and permission policies.";
const getAdminRoleMetadata = () => {
  const currentDate = /* @__PURE__ */ new Date();
  return {
    source: "configuration",
    roleEntityRef: ADMIN_ROLE_NAME,
    description: DEF_ADMIN_ROLE_DESCRIPTION,
    author: ADMIN_ROLE_AUTHOR,
    modifiedBy: ADMIN_ROLE_AUTHOR,
    lastModified: currentDate.toUTCString(),
    createdAt: currentDate.toUTCString()
  };
};
const useAdminsFromConfig = async (admins, enf, auditor$1, roleMetadataStorage, knex) => {
  const addedGroupPolicies = /* @__PURE__ */ new Map();
  const newGroupPolicies = /* @__PURE__ */ new Map();
  for (const admin of admins) {
    const entityRef = admin.getString("name").toLocaleLowerCase("en-US");
    policiesValidation.validateEntityReference(entityRef);
    addedGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);
    if (!await enf.hasGroupingPolicy(...[entityRef, ADMIN_ROLE_NAME])) {
      newGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);
    }
  }
  const adminRoleMeta = await roleMetadataStorage.findRoleMetadata(ADMIN_ROLE_NAME);
  const addedRoleMembers = Array.from(newGroupPolicies.entries());
  const meta = {
    ...getAdminRoleMetadata(),
    members: addedRoleMembers.map((gp) => gp[0])
  };
  const auditorEvent = await auditor$1.createEvent({
    eventId: auditor.RoleEvents.ROLE_WRITE,
    severityLevel: "medium",
    meta: {
      actionType: adminRoleMeta ? auditor.ActionType.UPDATE : auditor.ActionType.CREATE,
      source: meta.source
    }
  });
  const trx = await knex.transaction();
  try {
    if (!adminRoleMeta) {
      await roleMetadataStorage.createRoleMetadata(getAdminRoleMetadata(), trx);
    } else if (adminRoleMeta.source === "legacy") {
      await roleMetadataStorage.updateRoleMetadata(
        getAdminRoleMetadata(),
        ADMIN_ROLE_NAME,
        trx
      );
    }
    await enf.addGroupingPolicies(
      addedRoleMembers,
      getAdminRoleMetadata(),
      void 0,
      trx
    );
    await trx.commit();
    await auditorEvent.success({
      meta
    });
  } catch (error) {
    await trx.rollback(error);
    await auditorEvent.fail({
      error,
      meta
    });
    throw error;
  }
  const configGroupPolicies = await enf.getFilteredGroupingPolicy(
    1,
    ADMIN_ROLE_NAME
  );
  await helper.removeTheDifference(
    configGroupPolicies.map((gp) => gp[0]),
    Array.from(addedGroupPolicies.keys()),
    "configuration",
    ADMIN_ROLE_NAME,
    enf,
    auditor$1,
    ADMIN_ROLE_AUTHOR
  );
};
const addAdminPermissions = async (policies, enf, auditor$1) => {
  const policiesToAdd = [];
  for (const policy of policies) {
    if (!await enf.hasPolicy(...policy)) {
      policiesToAdd.push(policy);
    }
  }
  const auditorEvent = await auditor$1.createEvent({
    eventId: auditor.PermissionEvents.POLICY_WRITE,
    severityLevel: "medium",
    meta: { actionType: auditor.ActionType.CREATE, source: "configuration" }
  });
  try {
    await enf.addPolicies(policiesToAdd);
    await auditorEvent.success({
      meta: { policies: policiesToAdd }
    });
  } catch (error) {
    await auditorEvent.fail({
      error,
      meta: { policies: policiesToAdd }
    });
  }
};
const removeOldCreateAdminPermissions = async (enf, auditor$1) => {
  const policyEntityCreate = [
    "role:default/rbac_admin",
    "policy-entity",
    "create",
    "allow"
  ];
  if (await enf.hasPolicy(...policyEntityCreate)) {
    const auditorEvent = await auditor$1.createEvent({
      eventId: auditor.PermissionEvents.POLICY_WRITE,
      severityLevel: "medium",
      meta: { actionType: auditor.ActionType.DELETE, source: "configuration" }
    });
    try {
      await enf.removePolicy(policyEntityCreate);
      await auditorEvent.success({
        meta: { policy: policyEntityCreate }
      });
    } catch (error) {
      await auditorEvent.fail({
        error,
        meta: { policy: policyEntityCreate }
      });
    }
  }
};
const setAdminPermissions = async (enf, auditor) => {
  await removeOldCreateAdminPermissions(enf, auditor);
  const adminPermissions = [
    [ADMIN_ROLE_NAME, "policy-entity", "read", "allow"],
    [ADMIN_ROLE_NAME, "policy.entity.create", "create", "allow"],
    [ADMIN_ROLE_NAME, "policy-entity", "delete", "allow"],
    [ADMIN_ROLE_NAME, "policy-entity", "update", "allow"],
    // Needed for the RBAC frontend plugin.
    [ADMIN_ROLE_NAME, "catalog-entity", "read", "allow"]
  ];
  await addAdminPermissions(adminPermissions, enf, auditor);
};

exports.ADMIN_ROLE_AUTHOR = ADMIN_ROLE_AUTHOR;
exports.ADMIN_ROLE_NAME = ADMIN_ROLE_NAME;
exports.setAdminPermissions = setAdminPermissions;
exports.useAdminsFromConfig = useAdminsFromConfig;
//# sourceMappingURL=admin-creation.cjs.js.map