// packages/backend/src/modules/permissionPolicy.ts
import { createBackendModule, coreServices } from '@backstage/backend-plugin-api';
import { PolicyDecision, AuthorizeResult, isPermission } from '@backstage/plugin-permission-common';
import {
  catalogConditions,
  createCatalogConditionalDecision,
} from '@backstage/plugin-permission-backend-module-catalog';
import {
  catalogEntityReadPermission,
  catalogEntityUpdatePermission,
  catalogEntityDeletePermission,
} from '@backstage/plugin-catalog-backend';

class OwnerBasedPolicy {
  async handle(request: PolicyQuery): Promise<PolicyDecision> {
    const { user } = request;

    // 1. READ: todos los usuarios autenticados pueden ver
    if (isPermission(request.permission, catalogEntityReadPermission)) {
      return { result: AuthorizeResult.ALLOW };
    }

    // 2. UPDATE: solo el owner
    if (isPermission(request.permission, catalogEntityUpdatePermission)) {
      return createCatalogConditionalDecision(
        request.permission,
        catalogConditions.isEntityOwner({
          claims: user?.info.ownershipEntityRefs ?? [],
        }),
      );
    }

    // 3. DELETE: solo admins del grupo `platform-admins`
    if (isPermission(request.permission, catalogEntityDeletePermission)) {
      const isPlatformAdmin = user?.info.memberOf?.some(
        (g) => g.split('/').pop() === 'platform-admins',
      );
      return isPlatformAdmin
        ? { result: AuthorizeResult.ALLOW }
        : { result: AuthorizeResult.DENY };
    }

    // Por defecto: DENY (fail-closed)
    return { result: AuthorizeResult.DENY };
  }
}

export default createBackendModule({
  pluginId: 'permission',
  moduleId: 'owner-based-policy',
  register(env) {
    env.registerInit({
      deps: { logger: coreServices.logger },
      async init({ logger }) {
        logger.info('Owner-based policy registered');
        // Aquí registras la policy en el PermissionBackend
      },
    });
  },
});

// packages/app/src/components/EntityCard.tsx
import { usePermission } from '@backstage/plugin-permission-react';
import { catalogEntityUpdatePermission } from '@backstage/plugin-catalog-backend';

export const EditableEntityCard = ({ entity }: Props) => {
  const { allowed, loading } = usePermission({
    permission: catalogEntityUpdatePermission,
    resourceRef: entity.metadata.name,
  });

  if (loading) return <CircularProgress />;

  if (!allowed) {
    // El usuario no puede editar: mostrar vista de solo lectura
    return <ReadOnlyEntityCard entity={entity} />;
  }

  return <EditableEntityCardContent entity={entity} />;
};

// En el catalog processor
const customCondition = createCatalogConditionalDecision(
  request.permission,
  {
    pluginId: 'catalog',
    resourceType: 'catalog-entity',
    params: {
      team: extractTeamFromEntity(entity),
    },
    // La condición se evalúa en el catalog, no en la policy
    evaluate: (params, request) => {
      const user = request.user;
      const isTeamMember = user?.info.memberOf?.some(
        (g) => g === `group:team-${params.team}-owners`,
      );
      return isTeamMember;
    },
  },
);

// En el catalog backend
const entities = await db.entities({
  filter: { 'metadata.namespace': 'default' },
  conditions: { isTeamMember: { team: 'payments' } },
});

// packages/backend/src/modules/opa-policy.ts
import { createBackendModule } from '@backstage/backend-plugin-api';
import axios from 'axios';
import { AuthorizeResult, PolicyDecision, isPermission } from '@backstage/plugin-permission-common';

interface OpaInput {
  user: { name: string; groups: string[] };
  permission: { name: string; resource?: string };
  resource?: { kind: string; namespace: string; name: string };
}

class OpaPolicy {
  async handle(request: PolicyQuery): Promise<PolicyDecision> {
    const input: OpaInput = {
      user: {
        name: request.user?.identity.userEntityRef ?? 'unknown',
        groups: (request.user?.info.memberOf ?? []).map((g) => g.split('/').pop()!),
      },
      permission: {
        name: request.permission.name,
        resource: 'resourceRef' in request.permission ? request.permission.resourceRef : undefined,
      },
      resource: this.extractResource(request),
    };

    const { data } = await axios.post(
      'http://opa-server:8181/v1/data/backstage/allow',
      { input },
      { timeout: 200 },
    );

    if (data.result === true) {
      return { result: AuthorizeResult.ALLOW };
    }
    return { result: AuthorizeResult.DENY };
  }
}

# policies/backstage.rego
package backstage

default allow = false

# Admins pueden hacer todo
allow {
    input.user.groups[_] == "platform-admins"
}

# Owners pueden editar sus entidades
allow {
    input.permission.name == "catalog.entity.update"
    data.entities[input.resource.name].owner == input.user.name
}

# Tech writers pueden leer techdocs
allow {
    input.permission.name == "catalog.entity.read"
    input.resource.kind == "Component"
    input.user.groups[_] == "tech-writers"
}

// PermissionEventListener
class AuditListener {
  async onEvent(event: PermissionEvent) {
    if (event.decision === AuthorizeResult.DENY) {
      logger.warn({
        msg: 'Permission denied',
        user: event.user.identity.userEntityRef,
        permission: event.permission.name,
        resource: event.resourceRef,
        timestamp: new Date().toISOString(),
      });

      // Enviar al SIEM
      await siem.send({
        event_type: 'permission_denied',
        severity: event.permission.name.includes('delete') ? 'high' : 'medium',
        // ...
      });
    }
  }
}