@backstage-community/plugin-rbac-backend/dist/service/policy-builder.cjs.js

'use strict';

var database = require('@backstage/backend-defaults/database');
var catalogClient = require('@backstage/catalog-client');
var casbin = require('casbin');
var casbinAdapterFactory = require('../database/casbin-adapter-factory.cjs.js');
var conditionalStorage = require('../database/conditional-storage.cjs.js');
var migration = require('../database/migration.cjs.js');
var roleMetadata = require('../database/role-metadata.cjs.js');
var allowAllPolicy = require('../policies/allow-all-policy.cjs.js');
var permissionPolicy = require('../policies/permission-policy.cjs.js');
var connectProviders = require('../providers/connect-providers.cjs.js');
var roleManager = require('../role-manager/role-manager.cjs.js');
var enforcerDelegate = require('./enforcer-delegate.cjs.js');
var permissionModel = require('./permission-model.cjs.js');
var pluginEndpoints = require('./plugin-endpoints.cjs.js');
var policiesRestApi = require('./policies-rest-api.cjs.js');
var pluginRbacCommon = require('@backstage-community/plugin-rbac-common');
require('../permissions/conditions.cjs.js');
var rules = require('../permissions/rules.cjs.js');
var resource = require('../permissions/resource.cjs.js');
var extraPermissionEnabledPluginsStorage = require('../database/extra-permission-enabled-plugins-storage.cjs.js');
var extendableIdProvider = require('./extendable-id-provider.cjs.js');
var defaultPermissions = require('../default-permissions/default-permissions.cjs.js');
var conditionValidation = require('../validation/condition-validation.cjs.js');

class PolicyBuilder {
  static async build(env, pluginIdProvider = { getPluginIds: () => [] }, rbacProviders) {
    const databaseManager = database.DatabaseManager.fromConfig(env.config).forPlugin(
      "permission",
      { logger: env.logger, lifecycle: env.lifecycle }
    );
    const databaseClient = await databaseManager.getClient();
    const adapter = await new casbinAdapterFactory.CasbinDBAdapterFactory(
      env.config,
      databaseClient
    ).createAdapter();
    const enf = await casbin.newEnforcer(casbin.newModelFromString(permissionModel.MODEL), adapter);
    await enf.loadPolicy();
    enf.enableAutoSave(true);
    const catalogClient$1 = new catalogClient.CatalogClient({ discoveryApi: env.discovery });
    const catalogDBClient = await database.DatabaseManager.fromConfig(env.config).forPlugin("catalog", { logger: env.logger, lifecycle: env.lifecycle }).getClient();
    const defPermReader = new defaultPermissions.DefaultPermissionsReader(env.config);
    const rm = new roleManager.BackstageRoleManager(
      catalogClient$1,
      env.logger,
      catalogDBClient,
      databaseClient,
      env.config,
      env.auth,
      defPermReader
    );
    enf.setRoleManager(rm);
    enf.enableAutoBuildRoleLinks(false);
    await enf.buildRoleLinks();
    await migration.migrate(databaseManager);
    const conditionStorage = new conditionalStorage.DataBaseConditionalStorage(databaseClient);
    const roleMetadataStorage = new roleMetadata.DataBaseRoleMetadataStorage(databaseClient);
    const enforcerDelegate$1 = new enforcerDelegate.EnforcerDelegate(
      enf,
      env.auditor,
      conditionStorage,
      roleMetadataStorage,
      databaseClient
    );
    const defPermSyncher = new defaultPermissions.DefaultPermissionsSyncher(
      roleMetadataStorage,
      enforcerDelegate$1,
      defPermReader
    );
    await defPermSyncher.sync();
    env.permissionsRegistry.addResourceType({
      resourceRef: resource.permissionMetadataResourceRef,
      getResources: (resourceRefs) => Promise.all(
        resourceRefs.map((ref) => {
          if (ref === roleMetadataStorage.getCachedDefaultRoleMetadata()?.roleEntityRef) {
            return roleMetadataStorage.getCachedDefaultRoleMetadata();
          }
          return roleMetadataStorage.findRoleMetadata(ref);
        })
      ),
      permissions: pluginRbacCommon.policyEntityPermissions,
      rules: Object.values(rules.rules)
    });
    if (rbacProviders) {
      await connectProviders.connectRBACProviders(
        rbacProviders,
        enforcerDelegate$1,
        roleMetadataStorage,
        conditionStorage,
        env.logger,
        env.auditor
      );
    }
    const extraPluginsIdStorage = new extraPermissionEnabledPluginsStorage.PermissionDependentPluginDatabaseStore(
      databaseClient
    );
    const extendablePluginIdProvider = new extendableIdProvider.ExtendablePluginIdProvider(
      extraPluginsIdStorage,
      pluginIdProvider,
      env.config
    );
    await extendablePluginIdProvider.handleConflictedPluginIds();
    const pluginPermMetaData = new pluginEndpoints.PluginPermissionMetadataCollector({
      deps: {
        discovery: env.discovery,
        pluginIdProvider: extendablePluginIdProvider,
        logger: env.logger,
        config: env.config
      }
    });
    const isPluginEnabled = env.config.getOptionalBoolean("permission.enabled");
    const conditionValidationLimits = isPluginEnabled ? conditionValidation.resolveConditionValidationLimits(
      conditionValidation.readConditionValidationLimitsFromConfig(env.config)
    ) : conditionValidation.resolveConditionValidationLimits({});
    if (isPluginEnabled) {
      env.logger.info("RBAC backend plugin was enabled");
      env.policy.setPolicy(
        await permissionPolicy.RBACPermissionPolicy.build(
          env.logger,
          env.auditor,
          env.config,
          conditionStorage,
          enforcerDelegate$1,
          roleMetadataStorage,
          databaseClient,
          pluginPermMetaData,
          env.userInfo,
          env.auth,
          conditionValidationLimits
        )
      );
    } else {
      env.logger.warn(
        "RBAC backend plugin was disabled by application config permission.enabled: false"
      );
      env.policy.setPolicy(new allowAllPolicy.AllowAllPolicy());
    }
    const options = {
      config: env.config,
      logger: env.logger,
      auth: env.auth,
      httpAuth: env.httpAuth,
      permissions: env.permissions,
      permissionsRegistry: env.permissionsRegistry,
      auditor: env.auditor
    };
    const server = new policiesRestApi.PoliciesServer(
      options,
      enforcerDelegate$1,
      conditionStorage,
      pluginPermMetaData,
      roleMetadataStorage,
      extraPluginsIdStorage,
      extendablePluginIdProvider,
      conditionValidationLimits,
      rbacProviders
    );
    return server.serve();
  }
}

exports.PolicyBuilder = PolicyBuilder;
//# sourceMappingURL=policy-builder.cjs.js.map