@backstage-community/plugin-rbac-backend/dist/validation/condition-validation.cjs.js

'use strict';

var helper = require('../helper.cjs.js');

function validateRoleCondition(condition) {
  if (!condition.roleEntityRef) {
    throw new Error(`'roleEntityRef' must be specified in the role condition`);
  }
  if (!condition.result) {
    throw new Error(`'result' must be specified in the role condition`);
  }
  if (!condition.pluginId) {
    throw new Error(`'pluginId' must be specified in the role condition`);
  }
  if (!condition.resourceType) {
    throw new Error(`'resourceType' must be specified in the role condition`);
  }
  if (!condition.permissionMapping || condition.permissionMapping.length === 0) {
    throw new Error(
      `'permissionMapping' must be non empty array in the role condition`
    );
  }
  const nonActionValue = condition.permissionMapping.find(
    (action) => !helper.isPermissionAction(action)
  );
  if (nonActionValue) {
    throw new Error(
      `'permissionMapping' array contains non action value: '${nonActionValue}'`
    );
  }
  if (condition.resourceType === "policy-entity" && condition.permissionMapping.includes("create")) {
    throw new Error(
      `Conditional policy can not be created for resource type 'policy-entity' with the permission action 'create'`
    );
  }
  if (!condition.conditions) {
    throw new Error(`'conditions' must be specified in the role condition`);
  }
  if (condition.conditions) {
    validatePermissionCondition(
      condition.conditions,
      "roleCondition.conditions"
    );
  }
}
function validatePermissionCondition(conditionOrCriteria, jsonPathLocator) {
  validateCriteria(conditionOrCriteria, jsonPathLocator);
  if ("not" in conditionOrCriteria) {
    validatePermissionCondition(
      conditionOrCriteria.not,
      `${jsonPathLocator}.not`
    );
    return;
  }
  if ("allOf" in conditionOrCriteria) {
    if (!Array.isArray(conditionOrCriteria.allOf) || conditionOrCriteria.allOf.length === 0) {
      throw new Error(
        `${jsonPathLocator}.allOf criteria must be non empty array`
      );
    }
    for (const [index, elem] of conditionOrCriteria.allOf.entries()) {
      validatePermissionCondition(elem, `${jsonPathLocator}.allOf[${index}]`);
    }
    return;
  }
  if ("anyOf" in conditionOrCriteria) {
    if (!Array.isArray(conditionOrCriteria.anyOf) || conditionOrCriteria.anyOf.length === 0) {
      throw new Error(
        `${jsonPathLocator}.anyOf criteria must be non empty array`
      );
    }
    for (const [index, elem] of conditionOrCriteria.anyOf.entries()) {
      validatePermissionCondition(elem, `${jsonPathLocator}.anyOf[${index}]`);
    }
  }
}
function validateRule(conditionOrCriteria, jsonPathLocator) {
  if (!("resourceType" in conditionOrCriteria)) {
    throw new Error(
      `'resourceType' must be specified in the ${jsonPathLocator}.condition`
    );
  }
  if (!("rule" in conditionOrCriteria)) {
    throw new Error(
      `'rule' must be specified in the ${jsonPathLocator}.condition`
    );
  }
}
function validateCriteria(conditionOrCriteria, jsonPathLocator) {
  const criteriaList = ["allOf", "anyOf", "not"];
  const found = [];
  for (const crit of criteriaList) {
    if (crit in conditionOrCriteria) {
      found.push(crit);
    }
  }
  if (found.length > 1) {
    throw new Error(
      `RBAC plugin does not support parallel conditions, consider reworking request to include nested condition criteria. Conditional criteria causing the error ${found}.`
    );
  } else if (found.length === 0) {
    validateRule(conditionOrCriteria, jsonPathLocator);
  }
  if (found.length === 1 && "rule" in conditionOrCriteria) {
    throw new Error(
      `RBAC plugin does not support parallel conditions alongside rules, consider reworking request to include nested condition criteria. Conditional criteria causing the error ${found}, 'rule: ${conditionOrCriteria.rule}'.`
    );
  }
}

exports.validateRoleCondition = validateRoleCondition;
//# sourceMappingURL=condition-validation.cjs.js.map