@backstage-community/plugin-rbac-backend/dist/auditor/rest-interceptor.cjs.js

'use strict';

var auditor = require('./auditor.cjs.js');

const eventMap = {
  "/policies": {
    POST: auditor.PermissionEvents.POLICY_WRITE,
    PUT: auditor.PermissionEvents.POLICY_WRITE,
    DELETE: auditor.PermissionEvents.POLICY_WRITE,
    GET: auditor.PermissionEvents.POLICY_READ
  },
  "/roles/conditions": {
    POST: auditor.ConditionEvents.CONDITION_WRITE,
    PUT: auditor.ConditionEvents.CONDITION_WRITE,
    DELETE: auditor.ConditionEvents.CONDITION_WRITE,
    GET: auditor.ConditionEvents.CONDITION_READ
  },
  "/roles": {
    POST: auditor.RoleEvents.ROLE_WRITE,
    PUT: auditor.RoleEvents.ROLE_WRITE,
    DELETE: auditor.RoleEvents.ROLE_WRITE,
    GET: auditor.RoleEvents.ROLE_READ
  },
  "/plugins/policies": {
    GET: auditor.ListPluginPoliciesEvents.PLUGIN_POLICIES_READ
  },
  "/plugins/condition-rules": {
    GET: auditor.ListConditionEvents.CONDITION_RULES_READ
  },
  "/plugins/id": {
    GET: auditor.ListPluginIDsEvents.PLUGIN_IDS_READ,
    POST: auditor.ListPluginIDsEvents.PLUGIN_IDS_WRITE,
    DELETE: auditor.ListPluginIDsEvents.PLUGIN_IDS_WRITE
  }
};
const eventToActionMap = {
  POST: auditor.ActionType.CREATE,
  PUT: auditor.ActionType.UPDATE,
  DELETE: auditor.ActionType.DELETE
};
function getRequestAuditorMeta(req, eventId) {
  const meta = {
    ...req.method in eventToActionMap ? { actionType: eventToActionMap[req.method] } : {},
    source: "rest"
  };
  if (req.method !== "GET") {
    return meta;
  }
  let extraMeta = {};
  const hasQuery = Object.keys(req.query).length > 0;
  const hasParams = Object.keys(req.params).length > 0;
  switch (eventId) {
    case auditor.PermissionEvents.POLICY_READ:
      if (hasParams) {
        extraMeta = {
          queryType: "by-role",
          entityRef: `${req.params.kind}:${req.params.namespace}/${req.params.name}`
        };
        break;
      }
      extraMeta = {
        queryType: hasQuery ? "by-query" : "all",
        ...hasQuery ? { query: req.query } : {}
      };
      break;
    case auditor.RoleEvents.ROLE_READ:
      extraMeta = {
        queryType: hasParams ? "by-role" : "all",
        ...hasParams ? {
          entityRef: `${req.params.kind}:${req.params.namespace}/${req.params.name}`
        } : {}
      };
      break;
    case auditor.ConditionEvents.CONDITION_READ:
      if (hasParams) {
        extraMeta = {
          queryType: "by-id",
          id: req.params.id
        };
        break;
      }
      extraMeta = {
        queryType: hasQuery ? "by-query" : "all",
        ...hasQuery ? { query: req.query } : {}
      };
      break;
  }
  return { ...meta, ...extraMeta };
}
function logAuditorEvent(auditor) {
  return async (req, resp, next) => {
    let auditorEvent;
    const matchedPath = Object.keys(eventMap).find(
      (path) => req.path.startsWith(path)
    );
    if (matchedPath) {
      const methodEvent = eventMap[matchedPath][req.method];
      if (methodEvent) {
        const meta = getRequestAuditorMeta(req, methodEvent);
        auditorEvent = await auditor.createEvent({
          eventId: methodEvent,
          severityLevel: "medium",
          request: req,
          meta
        });
      }
    }
    resp.on("finish", async () => {
      const meta = {
        response: { status: resp.statusCode },
        ...resp.locals.meta ?? {}
      };
      if (resp.statusCode < 400) {
        await auditorEvent?.success({ meta });
      } else {
        const error = resp.locals.error ?? new Error(resp.statusMessage);
        await auditorEvent?.fail({
          error,
          meta
        });
      }
    });
    next();
  };
}
function setAuditorError() {
  return async (err, _req, resp, next) => {
    resp.locals.error = err;
    next(err);
  };
}

exports.logAuditorEvent = logAuditorEvent;
exports.setAuditorError = setAuditorError;
//# sourceMappingURL=rest-interceptor.cjs.js.map