From 4f3c58fda2136eb0038a39d54804acb06a8419ea Mon Sep 17 00:00:00 2001
From: Michael Lumish <mlumish@google.com>
Date: Thu, 12 Mar 2026 13:50:10 -0700
Subject: [PATCH] grpc-js-xds: Update RBAC code to handle Node type change, pin
 @types/node

---
 packages/grpc-js-xds/package.json | 2 +-
 packages/grpc-js-xds/src/rbac.ts  | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/packages/grpc-js-xds/package.json b/packages/grpc-js-xds/package.json
index 15b8d65a4..7b331caac 100644
--- a/packages/grpc-js-xds/package.json
+++ b/packages/grpc-js-xds/package.json
@@ -38,7 +38,7 @@
     "@types/gulp": "^4.0.6",
     "@types/gulp-mocha": "0.0.32",
     "@types/mocha": "^5.2.6",
-    "@types/node": ">=20.11.20",
+    "@types/node": "25.5.0",
     "@types/yargs": "^15.0.5",
     "grpc-health-check": "file:../grpc-health-check",
     "gts": "^5.0.1",
diff --git a/packages/grpc-js-xds/src/rbac.ts b/packages/grpc-js-xds/src/rbac.ts
index b1d8558f0..31f8cb0cc 100644
--- a/packages/grpc-js-xds/src/rbac.ts
+++ b/packages/grpc-js-xds/src/rbac.ts
@@ -225,7 +225,14 @@ export class AuthenticatedPrincipal implements PrincipalRule {
         }
       }
     }
-    return this.nameMatcher.apply(info.peerCertificate.subject.CN);
+    if (info.peerCertificate.subject.CN) {
+      if (Array.isArray(info.peerCertificate.subject.CN)) {
+        return info.peerCertificate.subject.CN.some(entry => this.nameMatcher!.apply(entry));
+      } else {
+        return this.nameMatcher.apply(info.peerCertificate.subject.CN);
+      }
+    }
+    return false;
   }
   toString(): string {
     return `Authenticated(principal=${this.nameMatcher?.toString() ?? null})`;