4c:I[660678,["/_next/static/chunks/20vupibmlshzb.js","/_next/static/chunks/3eovj1gu-bjw1.js","/_next/static/chunks/2q_x8l-di126-.js","/_next/static/chunks/04kz9z9erb5pj.js","/_next/static/chunks/2tyt9gku8ey_0.js","/_next/static/chunks/42v15axvkggmn.js","/_next/static/chunks/1tn3vgyyt035x.js","/_next/static/chunks/1ktauzq9ei9mo.js","/_next/static/chunks/0pp6seif9t0rh.js","/_next/static/chunks/249fa55fpcpma.js","/_next/static/chunks/2l_pdz1zw97kb.js","/_next/static/chunks/0uqg54syxwimi.js","/_next/static/chunks/2zsozgmktfobm.js","/_next/static/chunks/0xxaccqovlo_0.js","/_next/static/chunks/2b-g6207t1j8h.js","/_next/static/chunks/0ikb_zcn6ko_-.js","/_next/static/chunks/41fvkphgorge9.js","/_next/static/chunks/0r5clpcpovnal.js","/_next/static/chunks/1z4166yeqe57a.js","/_next/static/chunks/3kiaqhagwgl86.js","/_next/static/chunks/2641m2aqdum9a.js","/_next/static/chunks/29ekwac278lf7.js","/_next/static/chunks/2wvj_s69djr8_.js","/_next/static/chunks/0zqsumpmqyldp.js","/_next/static/chunks/3-906s1ue5fj3.js","/_next/static/chunks/19sysl43b65_0.js","/_next/static/chunks/3e6jpsp89g16i.js","/_next/static/chunks/3k4z_-jn1dhb2.js","/_next/static/chunks/3wm_vt3m1isne.js","/_next/static/chunks/2f-vun-i4kotn.js","/_next/static/chunks/27_w1s7kumugb.js","/_next/static/chunks/1aa0ev8j8xlhb.js","/_next/static/chunks/2t_5zfez2-77k.js","/_next/static/chunks/2sbypsk68olcq.js","/_next/static/chunks/3ct_g7ncgigz0.js"],"HydrationBoundary"] 4b:Taee,{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://app.codemod.com/registry#website","url":"https://app.codemod.com/registry","name":"Codemod Registry"},{"@type":"Organization","@id":"https://app.codemod.com#org","name":"backstage","url":"https://app.codemod.com","logo":"https://avatars.githubusercontent.com/u/72526453?v=4"},{"@type":"BreadcrumbList","@id":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Registry","item":"https://app.codemod.com/registry"},{"@type":"ListItem","position":2,"name":"@backstage/migrate-policy-query-user","item":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user"}]},{"@type":"WebPage","@id":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user#webpage","url":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user","name":"migrate-policy-query-user - Codemod Registry","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","isPartOf":{"@id":"https://app.codemod.com/registry#website"},"author":{"@id":"https://app.codemod.com#org"},"breadcrumb":{"@id":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user#breadcrumb"},"mainEntity":{"@id":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user#sourcecode"}},{"@type":"SoftwareSourceCode","@id":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user#sourcecode","name":"@backstage/migrate-policy-query-user","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","url":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user","publisher":{"@id":"https://app.codemod.com#org"},"image":"https://avatars.githubusercontent.com/u/72526453?v=4","isAccessibleForFree":true,"license":"Apache-2.0","codeRepository":"https://github.com/backstage/codemods","version":"0.2.3","keywords":["backstage","migration","permission-node","PolicyQueryUser","1.51.0"],"datePublished":"2026-06-01 19:43:18.820362+00","dateModified":"2026-07-22 20:12:58.806642+00"},{"@type":"SoftwareApplication","@id":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user#app","name":"migrate-policy-query-user codemod","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","url":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user","publisher":{"@id":"https://app.codemod.com#org"},"softwareVersion":"0.2.3","applicationCategory":"DeveloperApplication","operatingSystem":"Cross-platform","offers":{"@type":"Offer","price":"0","priceCurrency":"USD","availability":"https://schema.org/InStock"}}]}4d:Tf47,# @backstage/migrate-policy-query-user Backstage 1.51.0 migration codemod that updates usages of the now-removed `token`, `expiresInSeconds`, and `identity` fields on `PolicyQueryUser` from `@backstage/plugin-permission-node`. ## What it does ### Field removals In Backstage 1.51.0, the `PolicyQueryUser` type from `@backstage/plugin-permission-node` removed the `token`, `expiresInSeconds`, and `identity` fields. This codemod detects and migrates these usages. ### Destructuring patterns Removes `token` and `expiresInSeconds` from destructuring patterns and renames `identity` to `info`: ```ts // Before async handle(request: PolicyQuery, user?: PolicyQueryUser) { const { token, identity, credentials } = user; } // After async handle(request: PolicyQuery, user?: PolicyQueryUser) { const { info, credentials } = user; // TODO(backstage-codemod): migrate to credentials via coreServices.auth } ``` When `identity` is aliased (`{ identity: userIdentity }`), the alias is preserved under the new key (`{ info: userIdentity }`). ### Property access Renames `identity` member access to `info`: ```ts // Before const refs = user?.identity.ownershipEntityRefs // After const refs = user?.info.ownershipEntityRefs ``` ### Mock object literals Detects mock object literals that match the `PolicyQueryUser` shape (containing `credentials` plus `token` or `identity`) and removes the deprecated fields while preserving nested object structure: ```ts // Before const user = { token: 'mock-token', credentials: { $$type: '@backstage/BackstageCredentials', principal: {} }, identity: { userEntityRef: 'user:default/guest', ownershipEntityRefs: [] }, } // After const user = { credentials: { $$type: '@backstage/BackstageCredentials', principal: {} }, info: { userEntityRef: 'user:default/guest', ownershipEntityRefs: [] }, } ``` ### TODO comments When `token` is used in statements (e.g., passed to downstream APIs), the codemod inserts a TODO comment indicating manual migration to `coreServices.auth` credentials is needed: ```ts // TODO(backstage-codemod): migrate to credentials via coreServices.auth ``` ### Import gating The codemod only transforms files that import from `@backstage/plugin-permission-node`, avoiding false positives on unrelated `identity` or `token` usages. ### Known limitations - **Untyped parameters**: Destructuring patterns are only transformed when the parameter has an explicit `PolicyQueryUser` type annotation. Untyped parameters require manual migration or the AI fixup step. - **`expiresInSeconds` member access**: While `expiresInSeconds` is removed from destructuring patterns and object literals, member access like `user.expiresInSeconds` may need the AI fixup step. ### Optional: AI fixup step Enable with `--param aiFixup=true` to address edge cases: - Handles `token` usages that need migration to `coreServices.auth` credentials - Catches untyped `PolicyQueryUser` parameters - Verifies remaining `identity` references are migrated ## Installation ```bash # From registry yarn dlx codemod@latest run @backstage/migrate-policy-query-user -t /path/to/target ``` ## Usage (from this repo) ```bash # AST codemod only (deterministic) yarn dlx codemod@latest workflow run \ -w codemods/v1.51.0/migrate-policy-query-user/workflow.yaml \ -t /path/to/your/backstage-repo # AST codemod + AI fixup for edge cases yarn dlx codemod@latest workflow run \ -w codemods/v1.51.0/migrate-policy-query-user/workflow.yaml \ -t /path/to/your/backstage-repo \ --param aiFixup=true # Dry run (preview changes) yarn dlx codemod@latest workflow run \ -w codemods/v1.51.0/migrate-policy-query-user/workflow.yaml \ -t /path/to/your/backstage-repo \ --dry-run ``` ## Development From the repo root: ```bash yarn install yarn workspace @backstage/migrate-policy-query-user test ``` Or from this package directory: ```bash yarn test ``` e:[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$4b"}}],["$","$L4c",null,{"state":{"mutations":[],"queries":[{"dehydratedAt":1791299488452,"state":{"data":{"json":{"id":"63c3fddb-d9f6-4188-b9c8-2c6898657638","name":"migrate-policy-query-user","displayName":"@backstage/migrate-policy-query-user","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","scope":"backstage","visibility":"public","downloadCount":45,"executionCount":1,"createdAt":"2026-06-01 19:43:18.820362+00","updatedAt":"2026-07-22 20:12:58.806642+00","latestVersion":"0.2.3","keywords":["backstage","migration","permission-node","PolicyQueryUser","1.51.0"],"starCount":0,"author":"Paul Schultz","homepage":null,"repository":"https://github.com/backstage/codemods","license":"Apache-2.0","access":"public","documentation":null,"bugsUrl":null,"readme":"$4d","htmlURL":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user","organization":{"id":"7b129592-a10a-42f8-8dcb-46b0edd84f1e","name":"backstage","slug":"backstage","avatarUrl":"https://avatars.githubusercontent.com/u/72526453?v=4"},"owner":{"id":"498826df-6a91-4c45-9aed-18bea7ba2d4d","username":"cdedreuille","name":"Charles de Dreuille","avatarUrl":"https://avatars.githubusercontent.com/u/1540635?v=4"},"isLegacy":false,"versions":[{"version":{"id":"6e0acc65-ae3c-4eed-951b-c1ef9c707f66","packageId":"63c3fddb-d9f6-4188-b9c8-2c6898657638","version":"0.2.3","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","manifest":{"name":"@backstage/migrate-policy-query-user","author":"Paul Schultz","license":"Apache-2.0","targets":{"versions":{},"languages":["tsx","ts"],"frameworks":[]},"version":"0.2.3","keywords":["backstage","migration","permission-node","PolicyQueryUser","1.51.0"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","repository":"https://github.com/backstage/codemods","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","dependencies":[],"schema_version":"1.0"},"checksum":"0604489a09f29748be4a7fc803a09606b1f8d713fcb1599f3fb6584d32b0946f","size":8647,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/backstage/migrate-policy-query-user/0.2.3/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"languages":["typescript"],"frameworks":[]},"dependencies":[],"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]},"validated":false,"validationErrors":null,"publishedBy":"498826df-6a91-4c45-9aed-18bea7ba2d4d","deprecated":false,"deprecationMessage":null,"downloadCount":22,"cachedTestCases":{"input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","isValid":true,"examples":[{"name":"aliased-identity-destructure","path":"tests/aliased-identity-destructure","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","filename":"input.ts"},{"name":"empty-destructuring-await","path":"tests/empty-destructuring-await","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nasync function example() {\n const { token }: PolicyQueryUser = await fetchUser();\n await doSomething(token);\n}\n\nasync function fetchUser(): Promise {\n return {} as PolicyQueryUser;\n}\n\nasync function doSomething(_token: string) {}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nasync function example() {\n await fetchUser();\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n}\n\nasync function fetchUser(): Promise {\n return {} as PolicyQueryUser;\n}\n\nasync function doSomething(_token: string) {}\n","filename":"input.ts"},{"name":"mock-object-literal","path":"tests/mock-object-literal","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n token: 'mock-token',\n expiresInSeconds: 3600,\n identity: {\n type: 'user',\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","filename":"input.ts"},{"name":"no-op-unrelated-token","path":"tests/no-op-unrelated-token","input":"import { PermissionPolicy, PolicyQuery, PolicyQueryUser } from '@backstage/plugin-permission-node';\n\n// The codemod must NOT touch `token` fields in non-PolicyQueryUser patterns,\n// even when the file imports from @backstage/plugin-permission-node.\nasync function handleAutocomplete(req: any) {\n const { token, context } = req.body;\n if (!token) throw new Error('Missing token');\n return { token, context };\n}\n\ntype AutocompleteHandler = ({ resource, token, context }: {\n resource: string;\n token: string;\n context: Record;\n}) => Promise<{ results: { id: string }[] }>;\n\nexport { handleAutocomplete, AutocompleteHandler };\n","output":"import { PermissionPolicy, PolicyQuery, PolicyQueryUser } from '@backstage/plugin-permission-node';\n\n// The codemod must NOT touch `token` fields in non-PolicyQueryUser patterns,\n// even when the file imports from @backstage/plugin-permission-node.\nasync function handleAutocomplete(req: any) {\n const { token, context } = req.body;\n if (!token) throw new Error('Missing token');\n return { token, context };\n}\n\ntype AutocompleteHandler = ({ resource, token, context }: {\n resource: string;\n token: string;\n context: Record;\n}) => Promise<{ results: { id: string }[] }>;\n\nexport { handleAutocomplete, AutocompleteHandler };\n","filename":"input.ts"},{"name":"policy-handler-destructure","path":"tests/policy-handler-destructure","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, identity, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = identity.userEntityRef;\n await validateToken(token);\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = info.userEntityRef;\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","filename":"input.ts"},{"name":"policy-handler-property-access","path":"tests/policy-handler-property-access","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.identity.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.info.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","filename":"input.ts"},{"name":"token-in-used-declaration","path":"tests/token-in-used-declaration","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\ninterface TaskSecrets {\n backstageToken: string;\n otherSecret: string;\n}\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, credentials }: PolicyQueryUser,\n ) {\n const secrets: TaskSecrets = {\n backstageToken: token,\n otherSecret: 'foo',\n };\n\n await this.retryTask({ secrets, taskId: '123' });\n return { result: 'ALLOW' };\n }\n\n async retryTask(_opts: { secrets: TaskSecrets; taskId: string }) {}\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\ninterface TaskSecrets {\n backstageToken: string;\n otherSecret: string;\n}\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { credentials }: PolicyQueryUser,\n ) {\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n const secrets: TaskSecrets = {\n backstageToken: token,\n otherSecret: 'foo',\n };\n\n await this.retryTask({ secrets, taskId: '123' });\n return { result: 'ALLOW' };\n }\n\n async retryTask(_opts: { secrets: TaskSecrets; taskId: string }) {}\n}\n","filename":"input.ts"}]},"defaultWorkflowName":"default","createdAt":"2026-07-22T20:12:58.806Z","updatedAt":"2026-09-05 16:15:37.872921+00"},"publishedBy":{"id":"498826df-6a91-4c45-9aed-18bea7ba2d4d","username":"cdedreuille","name":"Charles de Dreuille"},"insightsTemplate":{"packageVersionId":"6e0acc65-ae3c-4eed-951b-c1ef9c707f66","status":"ready","generatedAt":"2026-07-22T20:15:44.895Z"},"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]}}],"packageBehavior":"workflow-only","isBundle":false,"bundleChildren":[],"parentBundles":[{"id":"b0e1826f-2ae6-4df9-adb9-49f9570eee78","parentWorkflowName":"default","parentNodeId":"apply-recipe","parentStepId":null,"parentStepName":"Migrate PolicyQueryUser off removed token/identity fields","childSourceRaw":"@backstage/migrate-policy-query-user","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-19T16:07:47.926Z","updatedAt":"2026-07-22 20:12:59.079999+00","parentPackage":{"id":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","name":"v1-51-0-migration-recipe","displayName":"@backstage/v1-51-0-migration-recipe","description":"Backstage 1.51.0: Migration recipe that runs every @backstage v1.51.0 codemod from the registry in a safe order.","scope":"backstage","visibility":"public","access":"public","latestVersion":"0.2.3","author":"Paul Schultz"},"parentPackageVersion":{"id":"fc7bc6d5-a4e7-4083-a2b0-3b162cfe21a2","packageId":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","version":"0.2.2"}},{"id":"d7f24c90-1bd2-4e06-b68f-76e9de9b22bc","parentWorkflowName":"default","parentNodeId":"apply-recipe","parentStepId":null,"parentStepName":"Migrate PolicyQueryUser off removed token/identity fields","childSourceRaw":"@backstage/migrate-policy-query-user","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-19T16:07:44.975Z","updatedAt":"2026-07-22 20:12:59.09171+00","parentPackage":{"id":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","name":"v1-51-0-migration-recipe","displayName":"@backstage/v1-51-0-migration-recipe","description":"Backstage 1.51.0: Migration recipe that runs every @backstage v1.51.0 codemod from the registry in a safe order.","scope":"backstage","visibility":"public","access":"public","latestVersion":"0.2.3","author":"Paul Schultz"},"parentPackageVersion":{"id":"90aae98f-9e86-48b7-9b5a-d987cfca5071","packageId":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","version":"0.2.1"}},{"id":"4810b8e1-e457-45a3-a427-c7a83f8965c5","parentWorkflowName":"default","parentNodeId":"apply-recipe","parentStepId":null,"parentStepName":"Migrate PolicyQueryUser off removed token/identity fields","childSourceRaw":"@backstage/migrate-policy-query-user","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-19T16:07:53.122Z","updatedAt":"2026-07-22 20:12:59.103645+00","parentPackage":{"id":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","name":"v1-51-0-migration-recipe","displayName":"@backstage/v1-51-0-migration-recipe","description":"Backstage 1.51.0: Migration recipe that runs every @backstage v1.51.0 codemod from the registry in a safe order.","scope":"backstage","visibility":"public","access":"public","latestVersion":"0.2.3","author":"Paul Schultz"},"parentPackageVersion":{"id":"e7e81a44-d0b9-42ca-b5cf-ebc101f91285","packageId":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","version":"0.2.0"}},{"id":"e60c6429-df82-4dd0-8986-4e3c043f8c5e","parentWorkflowName":"default","parentNodeId":"apply-recipe","parentStepId":null,"parentStepName":"Migrate PolicyQueryUser off removed token/identity fields","childSourceRaw":"@backstage/migrate-policy-query-user","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-07-22T20:13:00.594Z","updatedAt":"2026-07-22 20:13:00.594852+00","parentPackage":{"id":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","name":"v1-51-0-migration-recipe","displayName":"@backstage/v1-51-0-migration-recipe","description":"Backstage 1.51.0: Migration recipe that runs every @backstage v1.51.0 codemod from the registry in a safe order.","scope":"backstage","visibility":"public","access":"public","latestVersion":"0.2.3","author":"Paul Schultz"},"parentPackageVersion":{"id":"55ad31c0-5843-4ac9-a7be-1e1afece4b34","packageId":"d6794190-b1bc-40a3-90fc-6943ad4e4d87","version":"0.2.3"}}]},{"version":{"id":"9f052302-5ef3-465b-987b-48be55372c26","packageId":"63c3fddb-d9f6-4188-b9c8-2c6898657638","version":"0.2.2","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","manifest":{"name":"@backstage/migrate-policy-query-user","author":"Paul Schultz","license":"Apache-2.0","targets":{"versions":{},"languages":["tsx","ts"],"frameworks":[]},"version":"0.2.2","keywords":["backstage","migration","permission-node","PolicyQueryUser","1.51.0"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","repository":"https://github.com/backstage/codemods","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","dependencies":[],"schema_version":"1.0"},"checksum":"d1a4bd366b703526e13e0c55340d06e139ddda8d8d689d0cf9a4825e0680a017","size":8439,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/backstage/migrate-policy-query-user/0.2.2/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"languages":["typescript"],"frameworks":[]},"dependencies":[],"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]},"validated":false,"validationErrors":null,"publishedBy":"498826df-6a91-4c45-9aed-18bea7ba2d4d","deprecated":false,"deprecationMessage":null,"downloadCount":9,"cachedTestCases":{"input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","isValid":true,"examples":[{"name":"aliased-identity-destructure","path":"tests/aliased-identity-destructure","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","filename":"input.ts"},{"name":"empty-destructuring-await","path":"tests/empty-destructuring-await","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nasync function example() {\n const { token }: PolicyQueryUser = await fetchUser();\n await doSomething(token);\n}\n\nasync function fetchUser(): Promise {\n return {} as PolicyQueryUser;\n}\n\nasync function doSomething(_token: string) {}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nasync function example() {\n await fetchUser();\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n}\n\nasync function fetchUser(): Promise {\n return {} as PolicyQueryUser;\n}\n\nasync function doSomething(_token: string) {}\n","filename":"input.ts"},{"name":"mock-object-literal","path":"tests/mock-object-literal","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n token: 'mock-token',\n expiresInSeconds: 3600,\n identity: {\n type: 'user',\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","filename":"input.ts"},{"name":"no-op-unrelated-token","path":"tests/no-op-unrelated-token","input":"import { PermissionPolicy, PolicyQuery, PolicyQueryUser } from '@backstage/plugin-permission-node';\n\n// The codemod must NOT touch `token` fields in non-PolicyQueryUser patterns,\n// even when the file imports from @backstage/plugin-permission-node.\nasync function handleAutocomplete(req: any) {\n const { token, context } = req.body;\n if (!token) throw new Error('Missing token');\n return { token, context };\n}\n\ntype AutocompleteHandler = ({ resource, token, context }: {\n resource: string;\n token: string;\n context: Record;\n}) => Promise<{ results: { id: string }[] }>;\n\nexport { handleAutocomplete, AutocompleteHandler };\n","output":"import { PermissionPolicy, PolicyQuery, PolicyQueryUser } from '@backstage/plugin-permission-node';\n\n// The codemod must NOT touch `token` fields in non-PolicyQueryUser patterns,\n// even when the file imports from @backstage/plugin-permission-node.\nasync function handleAutocomplete(req: any) {\n const { token, context } = req.body;\n if (!token) throw new Error('Missing token');\n return { token, context };\n}\n\ntype AutocompleteHandler = ({ resource, token, context }: {\n resource: string;\n token: string;\n context: Record;\n}) => Promise<{ results: { id: string }[] }>;\n\nexport { handleAutocomplete, AutocompleteHandler };\n","filename":"input.ts"},{"name":"policy-handler-destructure","path":"tests/policy-handler-destructure","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, identity, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = identity.userEntityRef;\n await validateToken(token);\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = info.userEntityRef;\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","filename":"input.ts"},{"name":"policy-handler-property-access","path":"tests/policy-handler-property-access","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.identity.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.info.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","filename":"input.ts"},{"name":"token-in-used-declaration","path":"tests/token-in-used-declaration","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\ninterface TaskSecrets {\n backstageToken: string;\n otherSecret: string;\n}\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, credentials }: PolicyQueryUser,\n ) {\n const secrets: TaskSecrets = {\n backstageToken: token,\n otherSecret: 'foo',\n };\n\n await this.retryTask({ secrets, taskId: '123' });\n return { result: 'ALLOW' };\n }\n\n async retryTask(_opts: { secrets: TaskSecrets; taskId: string }) {}\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\ninterface TaskSecrets {\n backstageToken: string;\n otherSecret: string;\n}\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { credentials }: PolicyQueryUser,\n ) {\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n const secrets: TaskSecrets = {\n backstageToken: token,\n otherSecret: 'foo',\n };\n\n await this.retryTask({ secrets, taskId: '123' });\n return { result: 'ALLOW' };\n }\n\n async retryTask(_opts: { secrets: TaskSecrets; taskId: string }) {}\n}\n","filename":"input.ts"}]},"defaultWorkflowName":"default","createdAt":"2026-06-17T17:57:12.269Z","updatedAt":"2026-09-06 12:29:40.194517+00"},"publishedBy":{"id":"498826df-6a91-4c45-9aed-18bea7ba2d4d","username":"cdedreuille","name":"Charles de Dreuille"},"insightsTemplate":{"packageVersionId":"9f052302-5ef3-465b-987b-48be55372c26","status":"ready","generatedAt":"2026-07-21T16:22:08.988Z"},"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]}}],"packageBehavior":"workflow-only","isBundle":false,"bundleChildren":[],"parentBundles":[]},{"version":{"id":"97f3ae03-b312-4d4e-baa8-1e7151414ee0","packageId":"63c3fddb-d9f6-4188-b9c8-2c6898657638","version":"0.2.1","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","manifest":{"name":"@backstage/migrate-policy-query-user","author":"Paul Schultz","license":"MIT","targets":{"versions":{},"languages":["tsx","ts"],"frameworks":[]},"version":"0.2.1","keywords":["backstage","migration","permission-node","PolicyQueryUser","1.51.0"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","repository":"https://github.com/backstage/codemods","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","dependencies":[],"schema_version":"1.0"},"checksum":"f970b4fefa04d531e764805ce11533d2862664c0baab0aa0a0e7a20721cc1e9e","size":8527,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/backstage/migrate-policy-query-user/0.2.1/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"languages":["typescript"],"frameworks":[]},"dependencies":[],"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]},"validated":false,"validationErrors":null,"publishedBy":"498826df-6a91-4c45-9aed-18bea7ba2d4d","deprecated":false,"deprecationMessage":null,"downloadCount":7,"cachedTestCases":{"input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","isValid":true,"examples":[{"name":"aliased-identity-destructure","path":"tests/aliased-identity-destructure","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","filename":"input.ts"},{"name":"empty-destructuring-await","path":"tests/empty-destructuring-await","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nasync function example() {\n const { token }: PolicyQueryUser = await fetchUser();\n await doSomething(token);\n}\n\nasync function fetchUser(): Promise {\n return {} as PolicyQueryUser;\n}\n\nasync function doSomething(_token: string) {}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nasync function example() {\n await fetchUser();\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n}\n\nasync function fetchUser(): Promise {\n return {} as PolicyQueryUser;\n}\n\nasync function doSomething(_token: string) {}\n","filename":"input.ts"},{"name":"mock-object-literal","path":"tests/mock-object-literal","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n token: 'mock-token',\n expiresInSeconds: 3600,\n identity: {\n type: 'user',\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","filename":"input.ts"},{"name":"no-op-unrelated-token","path":"tests/no-op-unrelated-token","input":"import { PermissionPolicy, PolicyQuery, PolicyQueryUser } from '@backstage/plugin-permission-node';\n\n// The codemod must NOT touch `token` fields in non-PolicyQueryUser patterns,\n// even when the file imports from @backstage/plugin-permission-node.\nasync function handleAutocomplete(req: any) {\n const { token, context } = req.body;\n if (!token) throw new Error('Missing token');\n return { token, context };\n}\n\ntype AutocompleteHandler = ({ resource, token, context }: {\n resource: string;\n token: string;\n context: Record;\n}) => Promise<{ results: { id: string }[] }>;\n\nexport { handleAutocomplete, AutocompleteHandler };\n","output":"import { PermissionPolicy, PolicyQuery, PolicyQueryUser } from '@backstage/plugin-permission-node';\n\n// The codemod must NOT touch `token` fields in non-PolicyQueryUser patterns,\n// even when the file imports from @backstage/plugin-permission-node.\nasync function handleAutocomplete(req: any) {\n const { token, context } = req.body;\n if (!token) throw new Error('Missing token');\n return { token, context };\n}\n\ntype AutocompleteHandler = ({ resource, token, context }: {\n resource: string;\n token: string;\n context: Record;\n}) => Promise<{ results: { id: string }[] }>;\n\nexport { handleAutocomplete, AutocompleteHandler };\n","filename":"input.ts"},{"name":"policy-handler-destructure","path":"tests/policy-handler-destructure","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, identity, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = identity.userEntityRef;\n await validateToken(token);\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = info.userEntityRef;\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","filename":"input.ts"},{"name":"policy-handler-property-access","path":"tests/policy-handler-property-access","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.identity.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.info.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","filename":"input.ts"},{"name":"token-in-used-declaration","path":"tests/token-in-used-declaration","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\ninterface TaskSecrets {\n backstageToken: string;\n otherSecret: string;\n}\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, credentials }: PolicyQueryUser,\n ) {\n const secrets: TaskSecrets = {\n backstageToken: token,\n otherSecret: 'foo',\n };\n\n await this.retryTask({ secrets, taskId: '123' });\n return { result: 'ALLOW' };\n }\n\n async retryTask(_opts: { secrets: TaskSecrets; taskId: string }) {}\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\ninterface TaskSecrets {\n backstageToken: string;\n otherSecret: string;\n}\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { credentials }: PolicyQueryUser,\n ) {\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n const secrets: TaskSecrets = {\n backstageToken: token,\n otherSecret: 'foo',\n };\n\n await this.retryTask({ secrets, taskId: '123' });\n return { result: 'ALLOW' };\n }\n\n async retryTask(_opts: { secrets: TaskSecrets; taskId: string }) {}\n}\n","filename":"input.ts"}]},"defaultWorkflowName":"default","createdAt":"2026-06-03T19:08:57.220Z","updatedAt":"2026-09-06 12:29:40.298146+00"},"publishedBy":{"id":"498826df-6a91-4c45-9aed-18bea7ba2d4d","username":"cdedreuille","name":"Charles de Dreuille"},"insightsTemplate":null,"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]}}],"packageBehavior":"workflow-only","isBundle":false,"bundleChildren":[],"parentBundles":[]},{"version":{"id":"2e93417d-b3d7-40eb-b6e1-5e011d031054","packageId":"63c3fddb-d9f6-4188-b9c8-2c6898657638","version":"0.2.0","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","manifest":{"name":"@backstage/migrate-policy-query-user","author":"Paul Schultz","license":"MIT","targets":{"versions":{},"languages":["tsx","ts"],"frameworks":[]},"version":"0.2.0","keywords":["backstage","migration","permission-node","PolicyQueryUser","1.51.0"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","repository":"https://github.com/backstage/codemods","description":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","dependencies":[],"schema_version":"1.0"},"checksum":"34436dc0ddc063e290b7d4aa63e0e6719e30bc017108f90affe45117e1f893d7","size":7040,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/backstage/migrate-policy-query-user/0.2.0/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"languages":["typescript"],"frameworks":[]},"dependencies":[],"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]},"validated":false,"validationErrors":null,"publishedBy":"498826df-6a91-4c45-9aed-18bea7ba2d4d","deprecated":false,"deprecationMessage":null,"downloadCount":7,"cachedTestCases":{"input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","isValid":true,"examples":[{"name":"aliased-identity-destructure","path":"tests/aliased-identity-destructure","input":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { identity: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","output":"import {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info: userIdentity, credentials }: PolicyQueryUser,\n ) {\n return userIdentity.userEntityRef;\n }\n}\n","filename":"input.ts"},{"name":"mock-object-literal","path":"tests/mock-object-literal","input":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n token: 'mock-token',\n expiresInSeconds: 3600,\n identity: {\n type: 'user',\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","output":"import { PolicyQueryUser } from '@backstage/plugin-permission-node';\n\nexport function createMockUser(): PolicyQueryUser {\n return {\n credentials: { $$type: '@backstage/BackstageCredentials', principal: {} },\n info: {\n userEntityRef: 'user:default/guest',\n ownershipEntityRefs: ['user:default/guest'],\n },\n };\n}\n","filename":"input.ts"},{"name":"policy-handler-destructure","path":"tests/policy-handler-destructure","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { token, identity, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = identity.userEntityRef;\n await validateToken(token);\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n { info, credentials }: PolicyQueryUser,\n ): Promise {\n const sub = info.userEntityRef;\n // TODO(backstage-codemod): migrate to credentials via coreServices.auth\n return { result: AuthorizeResult.ALLOW };\n }\n}\n\nasync function validateToken(_token: string) {}\n","filename":"input.ts"},{"name":"policy-handler-property-access","path":"tests/policy-handler-property-access","input":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.identity.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","output":"import {\n AuthorizeResult,\n PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport {\n PermissionPolicy,\n PolicyQuery,\n PolicyQueryUser,\n} from '@backstage/plugin-permission-node';\n\nclass CustomPermissionPolicy implements PermissionPolicy {\n async handle(\n request: PolicyQuery,\n user?: PolicyQueryUser,\n ): Promise {\n const refs = user?.info.ownershipEntityRefs ?? [];\n return { result: AuthorizeResult.ALLOW };\n }\n}\n","filename":"input.ts"}]},"defaultWorkflowName":"default","createdAt":"2026-06-01T19:43:18.820Z","updatedAt":"2026-09-06 12:29:40.383421+00"},"publishedBy":{"id":"498826df-6a91-4c45-9aed-18bea7ba2d4d","username":"cdedreuille","name":"Charles de Dreuille"},"insightsTemplate":null,"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":["tsx"],"stepTypes":["js-ast-grep","ai"],"workflowMetadata":{"nodes":[{"id":"apply-transforms","name":"Apply AST Transformations","steps":[{"name":"Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields","type":"js-ast-grep","language":"tsx","semanticAnalysis":"file"}]},{"id":"ai-fixup","name":"AI fixup for edge cases","steps":[{"name":"Fix remaining edge cases that require contextual understanding","type":"ai"}]}]}}],"packageBehavior":"workflow-only","isBundle":false,"bundleChildren":[],"parentBundles":[]}],"distTags":{"latest":"0.2.3"},"latestPackageBehavior":"workflow-only","cachedTestCases":"$e:1:props:state:queries:0:state:data:json:versions:0:version:cachedTestCases"},"meta":{"values":{"versions.0.version.createdAt":["Date"],"versions.0.insightsTemplate.generatedAt":["Date"],"versions.0.parentBundles.0.createdAt":["Date"],"versions.0.parentBundles.1.createdAt":["Date"],"versions.0.parentBundles.2.createdAt":["Date"],"versions.0.parentBundles.3.createdAt":["Date"],"versions.1.version.createdAt":["Date"],"versions.1.insightsTemplate.generatedAt":["Date"],"versions.2.version.createdAt":["Date"],"versions.3.version.createdAt":["Date"]},"referentialEqualities":{"cachedTestCases":["versions.0.version.cachedTestCases"]}}},"dataUpdateCount":1,"dataUpdatedAt":1791299488451,"error":null,"errorUpdateCount":0,"errorUpdatedAt":0,"fetchFailureCount":0,"fetchFailureReason":null,"fetchMeta":null,"isInvalidated":false,"status":"success","fetchStatus":"idle"},"queryKey":[["registry","getPackage"],{"input":{"name":"migrate-policy-query-user","scope":"backstage"},"type":"query"}],"queryHash":"[[\"registry\",\"getPackage\"],{\"input\":{\"name\":\"migrate-policy-query-user\",\"scope\":\"backstage\"},\"type\":\"query\"}]"}]},"children":"$L4e"}]] 1f:null 23:[["$","title","0",{"children":"backstage/migrate-policy-query-user - Codemod Registry"}],["$","meta","1",{"name":"description","content":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields"}],["$","meta","2",{"name":"author","content":"backstage"}],["$","meta","3",{"name":"keywords","content":"migrate-policy-query-user, codemod, code transformation, automated refactoring, package, registry, backstage, migration, permission-node, PolicyQueryUser, 1.51.0"}],["$","meta","4",{"name":"creator","content":"backstage"}],["$","meta","5",{"name":"publisher","content":"Codemod"}],["$","meta","6",{"name":"robots","content":"index, follow"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-video-preview:-1, max-image-preview:large, max-snippet:-1"}],["$","meta","8",{"name":"application-name","content":"Codemod Registry"}],["$","meta","9",{"name":"apple-mobile-web-app-title","content":"Codemod"}],["$","meta","10",{"name":"apple-mobile-web-app-capable","content":"yes"}],["$","meta","11",{"name":"apple-mobile-web-app-status-bar-style","content":"default"}],["$","meta","12",{"name":"format-detection","content":"telephone=no"}],["$","meta","13",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","14",{"name":"msapplication-config","content":"/browserconfig.xml"}],["$","meta","15",{"name":"msapplication-TileColor","content":"#000000"}],["$","meta","16",{"name":"msapplication-tap-highlight","content":"no"}],["$","meta","17",{"name":"theme-color","content":"#000000"}],["$","meta","18",{"name":"viewport","content":"width=device-width, initial-scale=1"}],["$","link","19",{"rel":"canonical","href":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user"}],["$","meta","20",{"property":"og:title","content":"backstage/migrate-policy-query-user - Codemod Registry"}],["$","meta","21",{"property":"og:description","content":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields"}],["$","meta","22",{"property":"og:url","content":"https://app.codemod.com/registry/@backstage/migrate-policy-query-user"}],["$","meta","23",{"property":"og:site_name","content":"Codemod Registry"}],["$","meta","24",{"property":"og:locale","content":"en_US"}],["$","meta","25",{"property":"og:image","content":"https://app.codemod.com/api/og/registry/@backstage/migrate-policy-query-user"}],["$","meta","26",{"property":"og:image:width","content":"1200"}],["$","meta","27",{"property":"og:image:height","content":"630"}],["$","meta","28",{"property":"og:image:alt","content":"migrate-policy-query-user package"}],["$","meta","29",{"property":"og:type","content":"website"}],["$","meta","30",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","31",{"name":"twitter:site","content":"@codemod"}],["$","meta","32",{"name":"twitter:creator","content":"@codemod"}],["$","meta","33",{"name":"twitter:title","content":"backstage/migrate-policy-query-user - Codemod Registry"}],["$","meta","34",{"name":"twitter:description","content":"Backstage 1.51.0: Migrate PolicyQueryUser off removed token, expiresInSeconds, and identity fields"}],["$","meta","35",{"name":"twitter:image","content":"https://app.codemod.com/api/og/registry/@backstage/migrate-policy-query-user"}]]