@backstage-community/plugin-rbac-backend/config.d.ts

/*
 * Copyright 2024 The Backstage Authors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
export interface Config {
  permission: {
    rbac: {
      'policies-csv-file'?: string;
      /**
       * The path to the yaml file containing the conditional policies
       * @visibility frontend
       */
      conditionalPoliciesFile?: string;
      /**
       * Allow for reloading of the CSV and conditional policies files.
       * @visibility frontend
       */
      policyFileReload?: boolean;
      /**
       * Optional configuration for admins
       * @visibility frontend
       */
      admin?: {
        /**
         * The list of users and / or groups with admin access
         * @visibility frontend
         */
        users?: Array<{
          /**
           * @visibility frontend
           */
          name: string;
        }>;
        /**
         * The list of super users that will have allow all access, should be a list of only users
         * @visibility frontend
         */
        superUsers?: Array<{
          /**
           * @visibility frontend
           */
          name: string;
        }>;
      };
      /**
       * An optional list of plugin IDs.
       * The RBAC plugin will handle access control for plugins included in this list.
       */
      pluginsWithPermission?: string[];
      /**
       * An optional value that limits the depth when building the hierarchy group graph
       * @visibility frontend
       */
      maxDepth?: number;
      /**
       * An optional value that controls evaluation order between basic permission policy and conditional policy for permissions.
       * - Default: "conditional"
       * - "basic": prefer permission policy first
       * - "conditional": prefer conditional policies first
       * @visibility frontend
       */
      policyDecisionPrecedence?: 'basic' | 'conditional';
      /**
       * Configuration for assigning a default role with permissions
       * to all authenticated users.
       */
      defaultPermissions?: {
        /**
         * The default role to assign to all authenticated users.
         */
        defaultRole: string;
        /**
         * The list of baseline basic permissions assigned to the default role.
         */
        basicPermissions: Array<{
          /**
           * Permission name or resource type, for example `catalog.entity.read` or `catalog-entity`.
           */
          permission: string;
          /**
           * Action for the permission. Defaults to `use` when omitted.
           */
          action: 'create' | 'read' | 'update' | 'delete' | 'use';
        }>;
      };
      /**
       * Optional validation tuning for conditional policies.
       */
      validation?: {
        /**
         * Limits for conditional policy payload shape and nesting.
         */
        conditionalPolicies?: {
          /**
           * Maximum nesting depth for conditional criteria trees.
           */
          maxConditionDepth?: number;
          /**
           * Maximum total number of criteria nodes in a condition tree.
           */
          maxConditionNodeCount?: number;
          /**
           * Maximum number of items in `allOf`/`anyOf` criteria arrays.
           */
          maxCriteriaItems?: number;
        };
        /**
         * Limits for YAML-based conditional policy file ingestion.
         */
        conditionalPoliciesFile?: {
          /**
           * Maximum size in bytes for the conditional policies YAML file.
           */
          maxBytes?: number;
          /**
           * Maximum number of YAML documents allowed in the conditional file.
           */
          maxDocuments?: number;
        };
      };
    };
  };
}