@backstage/backend-app-api 0.5.12 → 0.6.0-next.0

package/dist/index.cjs.js

@@ -23,10 +23,13 @@ var crypto = require('crypto');
 var winston = require('winston');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var alpha = require('@backstage/backend-plugin-api/alpha');
+var jose = require('jose');
 var backendCommon = require('@backstage/backend-common');
 var backendAppApi = require('@backstage/backend-app-api');
+var cookie = require('cookie');
 var PromiseRouter = require('express-promise-router');
 var types = require('@backstage/types');
+var pathToRegexp = require('path-to-regexp');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
@@ -609,31 +612,31 @@ function applyInternalErrorFilter(error, logger) {
   return error;
 }
 
-var __accessCheck$8 = (obj, member, msg) => {
+var __accessCheck$a = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$8 = (obj, member, getter) => {
-  __accessCheck$8(obj, member, "read from private field");
+var __privateGet$9 = (obj, member, getter) => {
+  __accessCheck$a(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$8 = (obj, member, value) => {
+var __privateAdd$a = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$8 = (obj, member, value, setter) => {
-  __accessCheck$8(obj, member, "write to private field");
+var __privateSet$9 = (obj, member, value, setter) => {
+  __accessCheck$a(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _config, _logger;
 const _MiddlewareFactory = class _MiddlewareFactory {
   constructor(options) {
-    __privateAdd$8(this, _config, void 0);
-    __privateAdd$8(this, _logger, void 0);
-    __privateSet$8(this, _config, options.config);
-    __privateSet$8(this, _logger, options.logger);
+    __privateAdd$a(this, _config, void 0);
+    __privateAdd$a(this, _logger, void 0);
+    __privateSet$9(this, _config, options.config);
+    __privateSet$9(this, _logger, options.logger);
   }
   /**
    * Creates a new {@link MiddlewareFactory}.
@@ -679,7 +682,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   logging() {
-    const logger = __privateGet$8(this, _logger).child({
+    const logger = __privateGet$9(this, _logger).child({
       type: "incomingRequest"
     });
     return morgan__default["default"]("combined", {
@@ -703,7 +706,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   helmet() {
-    return helmet__default["default"](readHelmetOptions(__privateGet$8(this, _config).getOptionalConfig("backend")));
+    return helmet__default["default"](readHelmetOptions(__privateGet$9(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Returns a middleware that implements the cors library.
@@ -718,7 +721,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   cors() {
-    return cors__default["default"](readCorsOptions(__privateGet$8(this, _config).getOptionalConfig("backend")));
+    return cors__default["default"](readCorsOptions(__privateGet$9(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Express middleware to handle errors during request processing.
@@ -743,7 +746,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
   error(options = {}) {
     var _a;
     const showStackTraces = (_a = options.showStackTraces) != null ? _a : process.env.NODE_ENV === "development";
-    const logger = __privateGet$8(this, _logger).child({
+    const logger = __privateGet$9(this, _logger).child({
       type: "errorHandler"
     });
     return (rawError, req, res, next) => {
@@ -802,31 +805,31 @@ const escapeRegExp = (text) => {
   return text.replace(/[.*+?^${}(\)|[\]\\]/g, "\\$&");
 };
 
-var __accessCheck$7 = (obj, member, msg) => {
+var __accessCheck$9 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$7 = (obj, member, getter) => {
-  __accessCheck$7(obj, member, "read from private field");
+var __privateGet$8 = (obj, member, getter) => {
+  __accessCheck$9(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$7 = (obj, member, value) => {
+var __privateAdd$9 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$7 = (obj, member, value, setter) => {
-  __accessCheck$7(obj, member, "write to private field");
+var __privateSet$8 = (obj, member, value, setter) => {
+  __accessCheck$9(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _winston, _addRedactions;
 const _WinstonLogger = class _WinstonLogger {
   constructor(winston, addRedactions) {
-    __privateAdd$7(this, _winston, void 0);
-    __privateAdd$7(this, _addRedactions, void 0);
-    __privateSet$7(this, _winston, winston);
-    __privateSet$7(this, _addRedactions, addRedactions);
+    __privateAdd$9(this, _winston, void 0);
+    __privateAdd$9(this, _addRedactions, void 0);
+    __privateSet$8(this, _winston, winston);
+    __privateSet$8(this, _addRedactions, addRedactions);
   }
   /**
    * Creates a {@link WinstonLogger} instance.
@@ -907,44 +910,44 @@ const _WinstonLogger = class _WinstonLogger {
     );
   }
   error(message, meta) {
-    __privateGet$7(this, _winston).error(message, meta);
+    __privateGet$8(this, _winston).error(message, meta);
   }
   warn(message, meta) {
-    __privateGet$7(this, _winston).warn(message, meta);
+    __privateGet$8(this, _winston).warn(message, meta);
   }
   info(message, meta) {
-    __privateGet$7(this, _winston).info(message, meta);
+    __privateGet$8(this, _winston).info(message, meta);
   }
   debug(message, meta) {
-    __privateGet$7(this, _winston).debug(message, meta);
+    __privateGet$8(this, _winston).debug(message, meta);
   }
   child(meta) {
-    return new _WinstonLogger(__privateGet$7(this, _winston).child(meta));
+    return new _WinstonLogger(__privateGet$8(this, _winston).child(meta));
   }
   addRedactions(redactions) {
     var _a;
-    (_a = __privateGet$7(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
+    (_a = __privateGet$8(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
   }
 };
 _winston = new WeakMap();
 _addRedactions = new WeakMap();
 let WinstonLogger = _WinstonLogger;
 
-var __accessCheck$6 = (obj, member, msg) => {
+var __accessCheck$8 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$6 = (obj, member, getter) => {
-  __accessCheck$6(obj, member, "read from private field");
+var __privateGet$7 = (obj, member, getter) => {
+  __accessCheck$8(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$6 = (obj, member, value) => {
+var __privateAdd$8 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$6 = (obj, member, value, setter) => {
-  __accessCheck$6(obj, member, "write to private field");
+var __privateSet$7 = (obj, member, value, setter) => {
+  __accessCheck$8(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
@@ -952,25 +955,25 @@ var _hasStarted$1, _startupTasks$1, _hasShutdown, _shutdownTasks;
 class BackendLifecycleImpl {
   constructor(logger) {
     this.logger = logger;
-    __privateAdd$6(this, _hasStarted$1, false);
-    __privateAdd$6(this, _startupTasks$1, []);
-    __privateAdd$6(this, _hasShutdown, false);
-    __privateAdd$6(this, _shutdownTasks, []);
+    __privateAdd$8(this, _hasStarted$1, false);
+    __privateAdd$8(this, _startupTasks$1, []);
+    __privateAdd$8(this, _hasShutdown, false);
+    __privateAdd$8(this, _shutdownTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$6(this, _hasStarted$1)) {
+    if (__privateGet$7(this, _hasStarted$1)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$6(this, _startupTasks$1).push({ hook, options });
+    __privateGet$7(this, _startupTasks$1).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$6(this, _hasStarted$1)) {
+    if (__privateGet$7(this, _hasStarted$1)) {
       return;
     }
-    __privateSet$6(this, _hasStarted$1, true);
-    this.logger.debug(`Running ${__privateGet$6(this, _startupTasks$1).length} startup tasks...`);
+    __privateSet$7(this, _hasStarted$1, true);
+    this.logger.debug(`Running ${__privateGet$7(this, _startupTasks$1).length} startup tasks...`);
     await Promise.all(
-      __privateGet$6(this, _startupTasks$1).map(async ({ hook, options }) => {
+      __privateGet$7(this, _startupTasks$1).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -983,21 +986,21 @@ class BackendLifecycleImpl {
     );
   }
   addShutdownHook(hook, options) {
-    if (__privateGet$6(this, _hasShutdown)) {
+    if (__privateGet$7(this, _hasShutdown)) {
       throw new Error("Attempted to add shutdown hook after shutdown");
     }
-    __privateGet$6(this, _shutdownTasks).push({ hook, options });
+    __privateGet$7(this, _shutdownTasks).push({ hook, options });
   }
   async shutdown() {
-    if (__privateGet$6(this, _hasShutdown)) {
+    if (__privateGet$7(this, _hasShutdown)) {
       return;
     }
-    __privateSet$6(this, _hasShutdown, true);
+    __privateSet$7(this, _hasShutdown, true);
     this.logger.debug(
-      `Running ${__privateGet$6(this, _shutdownTasks).length} shutdown tasks...`
+      `Running ${__privateGet$7(this, _shutdownTasks).length} shutdown tasks...`
     );
     await Promise.all(
-      __privateGet$6(this, _shutdownTasks).map(async ({ hook, options }) => {
+      __privateGet$7(this, _shutdownTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1024,21 +1027,21 @@ const rootLifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$5 = (obj, member, msg) => {
+var __accessCheck$7 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$5 = (obj, member, getter) => {
-  __accessCheck$5(obj, member, "read from private field");
+var __privateGet$6 = (obj, member, getter) => {
+  __accessCheck$7(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$5 = (obj, member, value) => {
+var __privateAdd$7 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$5 = (obj, member, value, setter) => {
-  __accessCheck$5(obj, member, "write to private field");
+var __privateSet$6 = (obj, member, value, setter) => {
+  __accessCheck$7(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
@@ -1048,25 +1051,25 @@ class BackendPluginLifecycleImpl {
     this.logger = logger;
     this.rootLifecycle = rootLifecycle;
     this.pluginMetadata = pluginMetadata;
-    __privateAdd$5(this, _hasStarted, false);
-    __privateAdd$5(this, _startupTasks, []);
+    __privateAdd$7(this, _hasStarted, false);
+    __privateAdd$7(this, _startupTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$5(this, _hasStarted)) {
+    if (__privateGet$6(this, _hasStarted)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$5(this, _startupTasks).push({ hook, options });
+    __privateGet$6(this, _startupTasks).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$5(this, _hasStarted)) {
+    if (__privateGet$6(this, _hasStarted)) {
       return;
     }
-    __privateSet$5(this, _hasStarted, true);
+    __privateSet$6(this, _hasStarted, true);
     this.logger.debug(
-      `Running ${__privateGet$5(this, _startupTasks).length} plugin startup tasks...`
+      `Running ${__privateGet$6(this, _startupTasks).length} plugin startup tasks...`
     );
     await Promise.all(
-      __privateGet$5(this, _startupTasks).map(async ({ hook, options }) => {
+      __privateGet$6(this, _startupTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1104,26 +1107,26 @@ const lifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$4 = (obj, member, msg) => {
+var __accessCheck$6 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$4 = (obj, member, getter) => {
-  __accessCheck$4(obj, member, "read from private field");
+var __privateGet$5 = (obj, member, getter) => {
+  __accessCheck$6(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$4 = (obj, member, value) => {
+var __privateAdd$6 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$4 = (obj, member, value, setter) => {
-  __accessCheck$4(obj, member, "write to private field");
+var __privateSet$5 = (obj, member, value, setter) => {
+  __accessCheck$6(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$3 = (obj, member, method) => {
-  __accessCheck$4(obj, member, "access private method");
+var __privateMethod$5 = (obj, member, method) => {
+  __accessCheck$6(obj, member, "access private method");
   return method;
 };
 var _nodeIds, _cycleKeys, _getCycleKey, getCycleKey_fn, _nodes, _allProvided;
@@ -1143,21 +1146,21 @@ class Node {
 }
 const _CycleKeySet = class _CycleKeySet {
   constructor(nodes) {
-    __privateAdd$4(this, _getCycleKey);
-    __privateAdd$4(this, _nodeIds, void 0);
-    __privateAdd$4(this, _cycleKeys, void 0);
-    __privateSet$4(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
-    __privateSet$4(this, _cycleKeys, /* @__PURE__ */ new Set());
+    __privateAdd$6(this, _getCycleKey);
+    __privateAdd$6(this, _nodeIds, void 0);
+    __privateAdd$6(this, _cycleKeys, void 0);
+    __privateSet$5(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
+    __privateSet$5(this, _cycleKeys, /* @__PURE__ */ new Set());
   }
   static from(nodes) {
     return new _CycleKeySet(nodes);
   }
   tryAdd(path) {
-    const cycleKey = __privateMethod$3(this, _getCycleKey, getCycleKey_fn).call(this, path);
-    if (__privateGet$4(this, _cycleKeys).has(cycleKey)) {
+    const cycleKey = __privateMethod$5(this, _getCycleKey, getCycleKey_fn).call(this, path);
+    if (__privateGet$5(this, _cycleKeys).has(cycleKey)) {
       return false;
     }
-    __privateGet$4(this, _cycleKeys).add(cycleKey);
+    __privateGet$5(this, _cycleKeys).add(cycleKey);
     return true;
   }
 };
@@ -1165,18 +1168,18 @@ _nodeIds = new WeakMap();
 _cycleKeys = new WeakMap();
 _getCycleKey = new WeakSet();
 getCycleKey_fn = function(path) {
-  return path.map((n) => __privateGet$4(this, _nodeIds).get(n)).sort().join(",");
+  return path.map((n) => __privateGet$5(this, _nodeIds).get(n)).sort().join(",");
 };
 let CycleKeySet = _CycleKeySet;
 const _DependencyGraph = class _DependencyGraph {
   constructor(nodes) {
-    __privateAdd$4(this, _nodes, void 0);
-    __privateAdd$4(this, _allProvided, void 0);
-    __privateSet$4(this, _nodes, nodes);
-    __privateSet$4(this, _allProvided, /* @__PURE__ */ new Set());
-    for (const node of __privateGet$4(this, _nodes).values()) {
+    __privateAdd$6(this, _nodes, void 0);
+    __privateAdd$6(this, _allProvided, void 0);
+    __privateSet$5(this, _nodes, nodes);
+    __privateSet$5(this, _allProvided, /* @__PURE__ */ new Set());
+    for (const node of __privateGet$5(this, _nodes).values()) {
       for (const produced of node.provides) {
-        __privateGet$4(this, _allProvided).add(produced);
+        __privateGet$5(this, _allProvided).add(produced);
       }
     }
   }
@@ -1200,9 +1203,9 @@ const _DependencyGraph = class _DependencyGraph {
    */
   findUnsatisfiedDeps() {
     const unsatisfiedDependencies = [];
-    for (const node of __privateGet$4(this, _nodes).values()) {
+    for (const node of __privateGet$5(this, _nodes).values()) {
       const unsatisfied = Array.from(node.consumes).filter(
-        (id) => !__privateGet$4(this, _allProvided).has(id)
+        (id) => !__privateGet$5(this, _allProvided).has(id)
       );
       if (unsatisfied.length > 0) {
         unsatisfiedDependencies.push({ value: node.value, unsatisfied });
@@ -1222,8 +1225,8 @@ const _DependencyGraph = class _DependencyGraph {
    * form a cycle, with the same node as the first and last element of the array.
    */
   *detectCircularDependencies() {
-    const cycleKeys = CycleKeySet.from(__privateGet$4(this, _nodes));
-    for (const startNode of __privateGet$4(this, _nodes)) {
+    const cycleKeys = CycleKeySet.from(__privateGet$5(this, _nodes));
+    for (const startNode of __privateGet$5(this, _nodes)) {
       const visited = /* @__PURE__ */ new Set();
       const stack = new Array([
         startNode,
@@ -1236,7 +1239,7 @@ const _DependencyGraph = class _DependencyGraph {
         }
         visited.add(node);
         for (const consumed of node.consumes) {
-          const providerNodes = __privateGet$4(this, _nodes).filter(
+          const providerNodes = __privateGet$5(this, _nodes).filter(
             (other) => other.provides.has(consumed)
           );
           for (const provider of providerNodes) {
@@ -1265,9 +1268,9 @@ const _DependencyGraph = class _DependencyGraph {
    * Dependencies of nodes that are not produced by any other nodes will be ignored.
    */
   async parallelTopologicalTraversal(fn) {
-    const allProvided = __privateGet$4(this, _allProvided);
+    const allProvided = __privateGet$5(this, _allProvided);
     const producedSoFar = /* @__PURE__ */ new Set();
-    const waiting = new Set(__privateGet$4(this, _nodes).values());
+    const waiting = new Set(__privateGet$5(this, _nodes).values());
     const visited = /* @__PURE__ */ new Set();
     const results = new Array();
     let inFlight = 0;
@@ -1313,26 +1316,26 @@ _nodes = new WeakMap();
 _allProvided = new WeakMap();
 let DependencyGraph = _DependencyGraph;
 
-var __accessCheck$3 = (obj, member, msg) => {
+var __accessCheck$5 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$3 = (obj, member, getter) => {
-  __accessCheck$3(obj, member, "read from private field");
+var __privateGet$4 = (obj, member, getter) => {
+  __accessCheck$5(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$3 = (obj, member, value) => {
+var __privateAdd$5 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$3 = (obj, member, value, setter) => {
-  __accessCheck$3(obj, member, "write to private field");
+var __privateSet$4 = (obj, member, value, setter) => {
+  __accessCheck$5(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$2 = (obj, member, method) => {
-  __accessCheck$3(obj, member, "access private method");
+var __privateMethod$4 = (obj, member, method) => {
+  __accessCheck$5(obj, member, "access private method");
   return method;
 };
 var _providedFactories, _loadedDefaultFactories, _implementations, _rootServiceImplementations, _addedFactoryIds, _instantiatedFactories, _resolveFactory, resolveFactory_fn, _checkForMissingDeps, checkForMissingDeps_fn;
@@ -1355,19 +1358,19 @@ const pluginMetadataServiceFactory = backendPluginApi.createServiceFactory(
 );
 const _ServiceRegistry = class _ServiceRegistry {
   constructor(factories) {
-    __privateAdd$3(this, _resolveFactory);
-    __privateAdd$3(this, _checkForMissingDeps);
-    __privateAdd$3(this, _providedFactories, void 0);
-    __privateAdd$3(this, _loadedDefaultFactories, void 0);
-    __privateAdd$3(this, _implementations, void 0);
-    __privateAdd$3(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
-    __privateAdd$3(this, _addedFactoryIds, /* @__PURE__ */ new Set());
-    __privateAdd$3(this, _instantiatedFactories, /* @__PURE__ */ new Set());
-    __privateSet$3(this, _providedFactories, new Map(
+    __privateAdd$5(this, _resolveFactory);
+    __privateAdd$5(this, _checkForMissingDeps);
+    __privateAdd$5(this, _providedFactories, void 0);
+    __privateAdd$5(this, _loadedDefaultFactories, void 0);
+    __privateAdd$5(this, _implementations, void 0);
+    __privateAdd$5(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
+    __privateAdd$5(this, _addedFactoryIds, /* @__PURE__ */ new Set());
+    __privateAdd$5(this, _instantiatedFactories, /* @__PURE__ */ new Set());
+    __privateSet$4(this, _providedFactories, new Map(
       factories.map((sf) => [sf.service.id, toInternalServiceFactory(sf)])
     ));
-    __privateSet$3(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
-    __privateSet$3(this, _implementations, /* @__PURE__ */ new Map());
+    __privateSet$4(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
+    __privateSet$4(this, _implementations, /* @__PURE__ */ new Map());
   }
   static create(factories) {
     const registry = new _ServiceRegistry(factories);
@@ -1376,7 +1379,7 @@ const _ServiceRegistry = class _ServiceRegistry {
   }
   checkForCircularDeps() {
     const graph = DependencyGraph.fromIterable(
-      Array.from(__privateGet$3(this, _providedFactories)).map(
+      Array.from(__privateGet$4(this, _providedFactories)).map(
         ([serviceId, serviceFactory]) => ({
           value: serviceId,
           provides: [serviceId],
@@ -1398,30 +1401,30 @@ const _ServiceRegistry = class _ServiceRegistry {
         `The ${backendPluginApi.coreServices.pluginMetadata.id} service cannot be overridden`
       );
     }
-    if (__privateGet$3(this, _addedFactoryIds).has(factoryId)) {
+    if (__privateGet$4(this, _addedFactoryIds).has(factoryId)) {
       throw new Error(
         `Duplicate service implementations provided for ${factoryId}`
       );
     }
-    if (__privateGet$3(this, _instantiatedFactories).has(factoryId)) {
+    if (__privateGet$4(this, _instantiatedFactories).has(factoryId)) {
       throw new Error(
         `Unable to set service factory with id ${factoryId}, service has already been instantiated`
       );
     }
-    __privateGet$3(this, _addedFactoryIds).add(factoryId);
-    __privateGet$3(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
+    __privateGet$4(this, _addedFactoryIds).add(factoryId);
+    __privateGet$4(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
   }
   getServiceRefs() {
-    return Array.from(__privateGet$3(this, _providedFactories).values()).map((f) => f.service);
+    return Array.from(__privateGet$4(this, _providedFactories).values()).map((f) => f.service);
   }
   get(ref, pluginId) {
     var _a;
-    __privateGet$3(this, _instantiatedFactories).add(ref.id);
-    return (_a = __privateMethod$2(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
+    __privateGet$4(this, _instantiatedFactories).add(ref.id);
+    return (_a = __privateMethod$4(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
       if (factory.service.scope === "root") {
-        let existing = __privateGet$3(this, _rootServiceImplementations).get(factory);
+        let existing = __privateGet$4(this, _rootServiceImplementations).get(factory);
         if (!existing) {
-          __privateMethod$2(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+          __privateMethod$4(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
           const rootDeps = new Array();
           for (const [name, serviceRef] of Object.entries(factory.deps)) {
             if (serviceRef.scope !== "root") {
@@ -1435,13 +1438,13 @@ const _ServiceRegistry = class _ServiceRegistry {
           existing = Promise.all(rootDeps).then(
             (entries) => factory.factory(Object.fromEntries(entries), void 0)
           );
-          __privateGet$3(this, _rootServiceImplementations).set(factory, existing);
+          __privateGet$4(this, _rootServiceImplementations).set(factory, existing);
         }
         return existing;
       }
-      let implementation = __privateGet$3(this, _implementations).get(factory);
+      let implementation = __privateGet$4(this, _implementations).get(factory);
       if (!implementation) {
-        __privateMethod$2(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+        __privateMethod$4(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
         const rootDeps = new Array();
         for (const [name, serviceRef] of Object.entries(factory.deps)) {
           if (serviceRef.scope === "root") {
@@ -1463,7 +1466,7 @@ const _ServiceRegistry = class _ServiceRegistry {
           }),
           byPlugin: /* @__PURE__ */ new Map()
         };
-        __privateGet$3(this, _implementations).set(factory, implementation);
+        __privateGet$4(this, _implementations).set(factory, implementation);
       }
       let result = implementation.byPlugin.get(pluginId);
       if (!result) {
@@ -1501,18 +1504,18 @@ resolveFactory_fn = function(ref, pluginId) {
       toInternalServiceFactory(pluginMetadataServiceFactory({ pluginId }))
     );
   }
-  let resolvedFactory = __privateGet$3(this, _providedFactories).get(ref.id);
+  let resolvedFactory = __privateGet$4(this, _providedFactories).get(ref.id);
   const { __defaultFactory: defaultFactory } = ref;
   if (!resolvedFactory && !defaultFactory) {
     return void 0;
   }
   if (!resolvedFactory) {
-    let loadedFactory = __privateGet$3(this, _loadedDefaultFactories).get(defaultFactory);
+    let loadedFactory = __privateGet$4(this, _loadedDefaultFactories).get(defaultFactory);
     if (!loadedFactory) {
       loadedFactory = Promise.resolve().then(() => defaultFactory(ref)).then(
         (f) => toInternalServiceFactory(typeof f === "function" ? f() : f)
       );
-      __privateGet$3(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
+      __privateGet$4(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
     }
     resolvedFactory = loadedFactory.catch((error) => {
       throw new Error(
@@ -1530,7 +1533,7 @@ checkForMissingDeps_fn = function(factory, pluginId) {
     if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
       return false;
     }
-    if (__privateGet$3(this, _providedFactories).get(ref.id)) {
+    if (__privateGet$4(this, _providedFactories).get(ref.id)) {
       return false;
     }
     return !ref.__defaultFactory;
@@ -1544,52 +1547,52 @@ checkForMissingDeps_fn = function(factory, pluginId) {
 };
 let ServiceRegistry = _ServiceRegistry;
 
-var __accessCheck$2 = (obj, member, msg) => {
+var __accessCheck$4 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$2 = (obj, member, getter) => {
-  __accessCheck$2(obj, member, "read from private field");
+var __privateGet$3 = (obj, member, getter) => {
+  __accessCheck$4(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$2 = (obj, member, value) => {
+var __privateAdd$4 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$2 = (obj, member, value, setter) => {
-  __accessCheck$2(obj, member, "write to private field");
+var __privateSet$3 = (obj, member, value, setter) => {
+  __accessCheck$4(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$1 = (obj, member, method) => {
-  __accessCheck$2(obj, member, "access private method");
+var __privateMethod$3 = (obj, member, method) => {
+  __accessCheck$4(obj, member, "access private method");
   return method;
 };
 var _startPromise, _features, _extensionPoints, _serviceRegistry, _registeredFeatures, _getInitDeps, getInitDeps_fn, _addFeature, addFeature_fn, _doStart, doStart_fn, _getRootLifecycleImpl, getRootLifecycleImpl_fn, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn;
 class BackendInitializer {
   constructor(defaultApiFactories) {
-    __privateAdd$2(this, _getInitDeps);
-    __privateAdd$2(this, _addFeature);
-    __privateAdd$2(this, _doStart);
+    __privateAdd$4(this, _getInitDeps);
+    __privateAdd$4(this, _addFeature);
+    __privateAdd$4(this, _doStart);
     // Bit of a hacky way to grab the lifecycle services, potentially find a nicer way to do this
-    __privateAdd$2(this, _getRootLifecycleImpl);
-    __privateAdd$2(this, _getPluginLifecycleImpl);
-    __privateAdd$2(this, _startPromise, void 0);
-    __privateAdd$2(this, _features, new Array());
-    __privateAdd$2(this, _extensionPoints, /* @__PURE__ */ new Map());
-    __privateAdd$2(this, _serviceRegistry, void 0);
-    __privateAdd$2(this, _registeredFeatures, new Array());
-    __privateSet$2(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
+    __privateAdd$4(this, _getRootLifecycleImpl);
+    __privateAdd$4(this, _getPluginLifecycleImpl);
+    __privateAdd$4(this, _startPromise, void 0);
+    __privateAdd$4(this, _features, new Array());
+    __privateAdd$4(this, _extensionPoints, /* @__PURE__ */ new Map());
+    __privateAdd$4(this, _serviceRegistry, void 0);
+    __privateAdd$4(this, _registeredFeatures, new Array());
+    __privateSet$3(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
   }
   add(feature) {
-    if (__privateGet$2(this, _startPromise)) {
+    if (__privateGet$3(this, _startPromise)) {
       throw new Error("feature can not be added after the backend has started");
     }
-    __privateGet$2(this, _registeredFeatures).push(Promise.resolve(feature));
+    __privateGet$3(this, _registeredFeatures).push(Promise.resolve(feature));
   }
   async start() {
-    if (__privateGet$2(this, _startPromise)) {
+    if (__privateGet$3(this, _startPromise)) {
       throw new Error("Backend has already started");
     }
     const exitHandler = async () => {
@@ -1607,18 +1610,18 @@ class BackendInitializer {
     process.addListener("SIGTERM", exitHandler);
     process.addListener("SIGINT", exitHandler);
     process.addListener("beforeExit", exitHandler);
-    __privateSet$2(this, _startPromise, __privateMethod$1(this, _doStart, doStart_fn).call(this));
-    await __privateGet$2(this, _startPromise);
+    __privateSet$3(this, _startPromise, __privateMethod$3(this, _doStart, doStart_fn).call(this));
+    await __privateGet$3(this, _startPromise);
   }
   async stop() {
-    if (!__privateGet$2(this, _startPromise)) {
+    if (!__privateGet$3(this, _startPromise)) {
       return;
     }
     try {
-      await __privateGet$2(this, _startPromise);
+      await __privateGet$3(this, _startPromise);
     } catch (error) {
     }
-    const lifecycleService = await __privateMethod$1(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+    const lifecycleService = await __privateMethod$3(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
     await lifecycleService.shutdown();
   }
 }
@@ -1632,7 +1635,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
   const result = /* @__PURE__ */ new Map();
   const missingRefs = /* @__PURE__ */ new Set();
   for (const [name, ref] of Object.entries(deps)) {
-    const ep = __privateGet$2(this, _extensionPoints).get(ref.id);
+    const ep = __privateGet$3(this, _extensionPoints).get(ref.id);
     if (ep) {
       if (ep.pluginId !== pluginId) {
         throw new Error(
@@ -1641,7 +1644,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
       }
       result.set(name, ep.impl);
     } else {
-      const impl = await __privateGet$2(this, _serviceRegistry).get(
+      const impl = await __privateGet$3(this, _serviceRegistry).get(
         ref,
         pluginId
       );
@@ -1668,14 +1671,14 @@ addFeature_fn = function(feature) {
     );
   }
   if (isServiceFactory(feature)) {
-    __privateGet$2(this, _serviceRegistry).add(feature);
+    __privateGet$3(this, _serviceRegistry).add(feature);
   } else if (isInternalBackendFeature(feature)) {
     if (feature.version !== "v1") {
       throw new Error(
         `Failed to add feature, invalid version '${feature.version}'`
       );
     }
-    __privateGet$2(this, _features).push(feature);
+    __privateGet$3(this, _features).push(feature);
   } else {
     throw new Error(
       `Failed to add feature, invalid feature ${JSON.stringify(feature)}`
@@ -1684,39 +1687,39 @@ addFeature_fn = function(feature) {
 };
 _doStart = new WeakSet();
 doStart_fn = async function() {
-  __privateGet$2(this, _serviceRegistry).checkForCircularDeps();
-  for (const feature of __privateGet$2(this, _registeredFeatures)) {
-    __privateMethod$1(this, _addFeature, addFeature_fn).call(this, await feature);
+  __privateGet$3(this, _serviceRegistry).checkForCircularDeps();
+  for (const feature of __privateGet$3(this, _registeredFeatures)) {
+    __privateMethod$3(this, _addFeature, addFeature_fn).call(this, await feature);
   }
-  const featureDiscovery = await __privateGet$2(this, _serviceRegistry).get(
+  const featureDiscovery = await __privateGet$3(this, _serviceRegistry).get(
     alpha.featureDiscoveryServiceRef,
     "root"
   );
   if (featureDiscovery) {
     const { features } = await featureDiscovery.getBackendFeatures();
     for (const feature of features) {
-      __privateMethod$1(this, _addFeature, addFeature_fn).call(this, feature);
+      __privateMethod$3(this, _addFeature, addFeature_fn).call(this, feature);
     }
-    __privateGet$2(this, _serviceRegistry).checkForCircularDeps();
+    __privateGet$3(this, _serviceRegistry).checkForCircularDeps();
   }
-  for (const ref of __privateGet$2(this, _serviceRegistry).getServiceRefs()) {
+  for (const ref of __privateGet$3(this, _serviceRegistry).getServiceRefs()) {
     if (ref.scope === "root") {
-      await __privateGet$2(this, _serviceRegistry).get(ref, "root");
+      await __privateGet$3(this, _serviceRegistry).get(ref, "root");
     }
   }
   const pluginInits = /* @__PURE__ */ new Map();
   const moduleInits = /* @__PURE__ */ new Map();
-  for (const feature of __privateGet$2(this, _features)) {
+  for (const feature of __privateGet$3(this, _features)) {
     for (const r of feature.getRegistrations()) {
       const provides = /* @__PURE__ */ new Set();
       if (r.type === "plugin" || r.type === "module") {
         for (const [extRef, extImpl] of r.extensionPoints) {
-          if (__privateGet$2(this, _extensionPoints).has(extRef.id)) {
+          if (__privateGet$3(this, _extensionPoints).has(extRef.id)) {
             throw new Error(
               `ExtensionPoint with ID '${extRef.id}' is already registered`
             );
           }
-          __privateGet$2(this, _extensionPoints).set(extRef.id, {
+          __privateGet$3(this, _extensionPoints).set(extRef.id, {
             impl: extImpl,
             pluginId: r.pluginId
           });
@@ -1776,7 +1779,7 @@ doStart_fn = async function() {
         }
         await tree.parallelTopologicalTraversal(
           async ({ moduleId, moduleInit }) => {
-            const moduleDeps = await __privateMethod$1(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
+            const moduleDeps = await __privateMethod$3(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
             await moduleInit.init.func(moduleDeps).catch((error) => {
               throw new errors.ForwardedError(
                 `Module '${moduleId}' for plugin '${pluginId}' startup failed`,
@@ -1788,7 +1791,7 @@ doStart_fn = async function() {
       }
       const pluginInit = pluginInits.get(pluginId);
       if (pluginInit) {
-        const pluginDeps = await __privateMethod$1(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
+        const pluginDeps = await __privateMethod$3(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
         await pluginInit.init.func(pluginDeps).catch((error) => {
           throw new errors.ForwardedError(
             `Plugin '${pluginId}' startup failed`,
@@ -1796,14 +1799,14 @@ doStart_fn = async function() {
           );
         });
       }
-      const lifecycleService2 = await __privateMethod$1(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
+      const lifecycleService2 = await __privateMethod$3(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
       await lifecycleService2.startup();
     })
   );
-  const lifecycleService = await __privateMethod$1(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+  const lifecycleService = await __privateMethod$3(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
   await lifecycleService.startup();
   if (process.env.NODE_ENV !== "test") {
-    const rootLogger = await __privateGet$2(this, _serviceRegistry).get(
+    const rootLogger = await __privateGet$3(this, _serviceRegistry).get(
       backendPluginApi.coreServices.rootLogger,
       "root"
     );
@@ -1819,7 +1822,7 @@ doStart_fn = async function() {
 };
 _getRootLifecycleImpl = new WeakSet();
 getRootLifecycleImpl_fn = async function() {
-  const lifecycleService = await __privateGet$2(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$3(this, _serviceRegistry).get(
     backendPluginApi.coreServices.rootLifecycle,
     "root"
   );
@@ -1830,7 +1833,7 @@ getRootLifecycleImpl_fn = async function() {
 };
 _getPluginLifecycleImpl = new WeakSet();
 getPluginLifecycleImpl_fn = async function(pluginId) {
-  const lifecycleService = await __privateGet$2(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$3(this, _serviceRegistry).get(
     backendPluginApi.coreServices.lifecycle,
     pluginId
   );
@@ -1846,42 +1849,42 @@ function isInternalBackendFeature(feature) {
   return typeof feature.getRegistrations === "function";
 }
 
-var __accessCheck$1 = (obj, member, msg) => {
+var __accessCheck$3 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$1 = (obj, member, getter) => {
-  __accessCheck$1(obj, member, "read from private field");
+var __privateGet$2 = (obj, member, getter) => {
+  __accessCheck$3(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$1 = (obj, member, value) => {
+var __privateAdd$3 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$1 = (obj, member, value, setter) => {
-  __accessCheck$1(obj, member, "write to private field");
+var __privateSet$2 = (obj, member, value, setter) => {
+  __accessCheck$3(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _initializer;
 class BackstageBackend {
   constructor(defaultServiceFactories) {
-    __privateAdd$1(this, _initializer, void 0);
-    __privateSet$1(this, _initializer, new BackendInitializer(defaultServiceFactories));
+    __privateAdd$3(this, _initializer, void 0);
+    __privateSet$2(this, _initializer, new BackendInitializer(defaultServiceFactories));
   }
   add(feature) {
     if (isPromise(feature)) {
-      __privateGet$1(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
+      __privateGet$2(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
     } else {
-      __privateGet$1(this, _initializer).add(unwrapFeature(feature));
+      __privateGet$2(this, _initializer).add(unwrapFeature(feature));
     }
   }
   async start() {
-    await __privateGet$1(this, _initializer).start();
+    await __privateGet$2(this, _initializer).start();
   }
   async stop() {
-    await __privateGet$1(this, _initializer).stop();
+    await __privateGet$2(this, _initializer).stop();
   }
 }
 _initializer = new WeakMap();
@@ -1927,6 +1930,176 @@ function createSpecializedBackend(options) {
   return new BackstageBackend(services);
 }
 
+var __accessCheck$2 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateAdd$2 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateMethod$2 = (obj, member, method) => {
+  __accessCheck$2(obj, member, "access private method");
+  return method;
+};
+var _getJwtExpiration, getJwtExpiration_fn;
+function createCredentialsWithServicePrincipal(sub, token) {
+  return {
+    $$type: "@backstage/BackstageCredentials",
+    version: "v1",
+    token,
+    principal: {
+      type: "service",
+      subject: sub
+    }
+  };
+}
+function createCredentialsWithUserPrincipal(sub, token, expiresAt) {
+  return {
+    $$type: "@backstage/BackstageCredentials",
+    version: "v1",
+    token,
+    expiresAt,
+    principal: {
+      type: "user",
+      userEntityRef: sub
+    }
+  };
+}
+function createCredentialsWithNonePrincipal() {
+  return {
+    $$type: "@backstage/BackstageCredentials",
+    version: "v1",
+    principal: {
+      type: "none"
+    }
+  };
+}
+function toInternalBackstageCredentials(credentials) {
+  if (credentials.$$type !== "@backstage/BackstageCredentials") {
+    throw new Error("Invalid credential type");
+  }
+  const internalCredentials = credentials;
+  if (internalCredentials.version !== "v1") {
+    throw new Error(
+      `Invalid credential version ${internalCredentials.version}`
+    );
+  }
+  return internalCredentials;
+}
+class DefaultAuthService {
+  constructor(tokenManager, identity, pluginId, disableDefaultAuthPolicy) {
+    this.tokenManager = tokenManager;
+    this.identity = identity;
+    this.pluginId = pluginId;
+    this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;
+    __privateAdd$2(this, _getJwtExpiration);
+  }
+  // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
+  async authenticate(token) {
+    const { sub, aud } = jose.decodeJwt(token);
+    if (sub === "backstage-server" && !aud) {
+      await this.tokenManager.authenticate(token);
+      return createCredentialsWithServicePrincipal("external:backstage-plugin");
+    }
+    const identity = await this.identity.getIdentity({
+      request: {
+        headers: { authorization: `Bearer ${token}` }
+      }
+    });
+    if (!identity) {
+      throw new errors.AuthenticationError("Invalid user token");
+    }
+    return createCredentialsWithUserPrincipal(
+      identity.identity.userEntityRef,
+      token,
+      __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
+    );
+  }
+  isPrincipal(credentials, type) {
+    const principal = credentials.principal;
+    if (type === "unknown") {
+      return true;
+    }
+    if (principal.type !== type) {
+      return false;
+    }
+    return true;
+  }
+  async getNoneCredentials() {
+    return createCredentialsWithNonePrincipal();
+  }
+  async getOwnServiceCredentials() {
+    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);
+  }
+  async getPluginRequestToken(options) {
+    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);
+    const { type } = internalForward.principal;
+    if (type === "none" && this.disableDefaultAuthPolicy) {
+      return { token: "" };
+    }
+    switch (type) {
+      case "service":
+        return this.tokenManager.getToken();
+      case "user":
+        if (!internalForward.token) {
+          throw new Error("User credentials is unexpectedly missing token");
+        }
+        return { token: internalForward.token };
+      default:
+        throw new errors.AuthenticationError(
+          `Refused to issue service token for credential type '${type}'`
+        );
+    }
+  }
+  async getLimitedUserToken(credentials) {
+    const internalCredentials = toInternalBackstageCredentials(credentials);
+    const { token } = internalCredentials;
+    if (!token) {
+      throw new errors.AuthenticationError(
+        "User credentials is unexpectedly missing token"
+      );
+    }
+    return { token, expiresAt: __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token) };
+  }
+}
+_getJwtExpiration = new WeakSet();
+getJwtExpiration_fn = function(token) {
+  const { exp } = jose.decodeJwt(token);
+  if (!exp) {
+    throw new errors.AuthenticationError("User token is missing expiration");
+  }
+  return new Date(exp * 1e3);
+};
+const authServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.auth,
+  deps: {
+    config: backendPluginApi.coreServices.rootConfig,
+    logger: backendPluginApi.coreServices.rootLogger,
+    plugin: backendPluginApi.coreServices.pluginMetadata,
+    identity: backendPluginApi.coreServices.identity,
+    // Re-using the token manager makes sure that we use the same generated keys for
+    // development as plugins that have not yet been migrated. It's important that this
+    // keeps working as long as there are plugins that have not been migrated to the
+    // new auth services in the new backend system.
+    tokenManager: backendPluginApi.coreServices.tokenManager
+  },
+  async factory({ config, plugin, identity, tokenManager }) {
+    const disableDefaultAuthPolicy = Boolean(
+      config.getOptionalBoolean(
+        "backend.auth.dangerouslyDisableDefaultAuthPolicy"
+      )
+    );
+    return new DefaultAuthService(
+      tokenManager,
+      identity,
+      plugin.getId(),
+      disableDefaultAuthPolicy
+    );
+  }
+});
+
 const cacheServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.cache,
   deps: {
@@ -2071,6 +2244,208 @@ const discoveryServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
+var __accessCheck$1 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet$1 = (obj, member, getter) => {
+  __accessCheck$1(obj, member, "read from private field");
+  return getter ? getter.call(obj) : member.get(obj);
+};
+var __privateAdd$1 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateSet$1 = (obj, member, value, setter) => {
+  __accessCheck$1(obj, member, "write to private field");
+  setter ? setter.call(obj, value) : member.set(obj, value);
+  return value;
+};
+var __privateMethod$1 = (obj, member, method) => {
+  __accessCheck$1(obj, member, "access private method");
+  return method;
+};
+var _auth, _discovery, _pluginId, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn, _getCredentials, getCredentials_fn, _getLimitedCredentials, getLimitedCredentials_fn, _existingCookieExpiration, existingCookieExpiration_fn;
+const FIVE_MINUTES_MS = 5 * 60 * 1e3;
+const BACKSTAGE_AUTH_COOKIE = "backstage-auth";
+function getTokenFromRequest(req) {
+  const authHeader = req.headers.authorization;
+  if (typeof authHeader === "string") {
+    const matches = authHeader.match(/^Bearer[ ]+(\S+)$/i);
+    const token = matches == null ? void 0 : matches[1];
+    if (token) {
+      return token;
+    }
+  }
+  return void 0;
+}
+function getCookieFromRequest(req) {
+  const cookieHeader = req.headers.cookie;
+  if (cookieHeader) {
+    const cookies = cookie.parse(cookieHeader);
+    const token = cookies[BACKSTAGE_AUTH_COOKIE];
+    if (token) {
+      return token;
+    }
+  }
+  return void 0;
+}
+function willExpireSoon(expiresAt) {
+  return Date.now() + FIVE_MINUTES_MS > expiresAt.getTime();
+}
+const credentialsSymbol = Symbol("backstage-credentials");
+const limitedCredentialsSymbol = Symbol("backstage-limited-credentials");
+class DefaultHttpAuthService {
+  constructor(auth, discovery, pluginId) {
+    __privateAdd$1(this, _extractCredentialsFromRequest);
+    __privateAdd$1(this, _extractLimitedCredentialsFromRequest);
+    __privateAdd$1(this, _getCredentials);
+    __privateAdd$1(this, _getLimitedCredentials);
+    __privateAdd$1(this, _existingCookieExpiration);
+    __privateAdd$1(this, _auth, void 0);
+    __privateAdd$1(this, _discovery, void 0);
+    __privateAdd$1(this, _pluginId, void 0);
+    __privateSet$1(this, _auth, auth);
+    __privateSet$1(this, _discovery, discovery);
+    __privateSet$1(this, _pluginId, pluginId);
+  }
+  async credentials(req, options) {
+    const credentials = (options == null ? void 0 : options.allowLimitedAccess) ? await __privateMethod$1(this, _getLimitedCredentials, getLimitedCredentials_fn).call(this, req) : await __privateMethod$1(this, _getCredentials, getCredentials_fn).call(this, req);
+    const allowed = options == null ? void 0 : options.allow;
+    if (!allowed) {
+      return credentials;
+    }
+    if (__privateGet$1(this, _auth).isPrincipal(credentials, "none")) {
+      if (allowed.includes("none")) {
+        return credentials;
+      }
+      throw new errors.AuthenticationError("Missing credentials");
+    } else if (__privateGet$1(this, _auth).isPrincipal(credentials, "user")) {
+      if (allowed.includes("user")) {
+        return credentials;
+      }
+      throw new errors.NotAllowedError(
+        `This endpoint does not allow 'user' credentials`
+      );
+    } else if (__privateGet$1(this, _auth).isPrincipal(credentials, "service")) {
+      if (allowed.includes("service")) {
+        return credentials;
+      }
+      throw new errors.NotAllowedError(
+        `This endpoint does not allow 'service' credentials`
+      );
+    }
+    throw new errors.NotAllowedError(
+      "Unknown principal type, this should never happen"
+    );
+  }
+  async issueUserCookie(res, options) {
+    if (res.headersSent) {
+      throw new Error("Failed to issue user cookie, headers were already sent");
+    }
+    let credentials;
+    if (options == null ? void 0 : options.credentials) {
+      if (!__privateGet$1(this, _auth).isPrincipal(options.credentials, "user")) {
+        throw new errors.AuthenticationError(
+          "Refused to issue cookie for non-user principal"
+        );
+      }
+      credentials = options.credentials;
+    } else {
+      credentials = await this.credentials(res.req, { allow: ["user"] });
+    }
+    const existingExpiresAt = await __privateMethod$1(this, _existingCookieExpiration, existingCookieExpiration_fn).call(this, res.req);
+    if (existingExpiresAt && !willExpireSoon(existingExpiresAt)) {
+      return { expiresAt: existingExpiresAt };
+    }
+    const originHeader = res.req.headers.origin;
+    const origin = !originHeader || originHeader === "null" ? void 0 : originHeader;
+    const externalBaseUrlStr = await __privateGet$1(this, _discovery).getExternalBaseUrl(
+      __privateGet$1(this, _pluginId)
+    );
+    const externalBaseUrl = new URL(origin != null ? origin : externalBaseUrlStr);
+    const { token, expiresAt } = await __privateGet$1(this, _auth).getLimitedUserToken(
+      credentials
+    );
+    if (!token) {
+      throw new Error("User credentials is unexpectedly missing token");
+    }
+    const secure = externalBaseUrl.protocol === "https:" || externalBaseUrl.hostname === "localhost";
+    res.cookie(BACKSTAGE_AUTH_COOKIE, token, {
+      domain: externalBaseUrl.hostname,
+      httpOnly: true,
+      expires: expiresAt,
+      secure,
+      priority: "high",
+      sameSite: secure ? "none" : "lax"
+    });
+    return { expiresAt };
+  }
+}
+_auth = new WeakMap();
+_discovery = new WeakMap();
+_pluginId = new WeakMap();
+_extractCredentialsFromRequest = new WeakSet();
+extractCredentialsFromRequest_fn = async function(req) {
+  const token = getTokenFromRequest(req);
+  if (!token) {
+    return await __privateGet$1(this, _auth).getNoneCredentials();
+  }
+  return await __privateGet$1(this, _auth).authenticate(token);
+};
+_extractLimitedCredentialsFromRequest = new WeakSet();
+extractLimitedCredentialsFromRequest_fn = async function(req) {
+  const token = getTokenFromRequest(req);
+  if (token) {
+    return await __privateGet$1(this, _auth).authenticate(token, {
+      allowLimitedAccess: true
+    });
+  }
+  const cookie = getCookieFromRequest(req);
+  if (cookie) {
+    return await __privateGet$1(this, _auth).authenticate(cookie, {
+      allowLimitedAccess: true
+    });
+  }
+  return await __privateGet$1(this, _auth).getNoneCredentials();
+};
+_getCredentials = new WeakSet();
+getCredentials_fn = async function(req) {
+  var _a;
+  return (_a = req[credentialsSymbol]) != null ? _a : req[credentialsSymbol] = __privateMethod$1(this, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn).call(this, req);
+};
+_getLimitedCredentials = new WeakSet();
+getLimitedCredentials_fn = async function(req) {
+  var _a;
+  return (_a = req[limitedCredentialsSymbol]) != null ? _a : req[limitedCredentialsSymbol] = __privateMethod$1(this, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn).call(this, req);
+};
+_existingCookieExpiration = new WeakSet();
+existingCookieExpiration_fn = async function(req) {
+  const existingCookie = getCookieFromRequest(req);
+  if (!existingCookie) {
+    return void 0;
+  }
+  const existingCredentials = await __privateGet$1(this, _auth).authenticate(existingCookie, {
+    allowLimitedAccess: true
+  });
+  if (!__privateGet$1(this, _auth).isPrincipal(existingCredentials, "user")) {
+    return void 0;
+  }
+  return existingCredentials.expiresAt;
+};
+const httpAuthServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.httpAuth,
+  deps: {
+    auth: backendPluginApi.coreServices.auth,
+    discovery: backendPluginApi.coreServices.discovery,
+    plugin: backendPluginApi.coreServices.pluginMetadata
+  },
+  async factory({ auth, discovery, plugin }) {
+    return new DefaultHttpAuthService(auth, discovery, plugin.getId());
+  }
+});
+
 const DEFAULT_TIMEOUT = { seconds: 5 };
 function createLifecycleMiddleware(options) {
   const { lifecycle, startupRequestPauseTimeout = DEFAULT_TIMEOUT } = options;
@@ -2115,24 +2490,87 @@ function createLifecycleMiddleware(options) {
   };
 }
 
+function createPathPolicyPredicate(policyPath) {
+  if (policyPath === "/" || policyPath === "*") {
+    return () => true;
+  }
+  const pathRegex = pathToRegexp.pathToRegexp(policyPath, void 0, {
+    end: false
+  });
+  return (path) => {
+    return pathRegex.test(path);
+  };
+}
+function createCredentialsBarrier(options) {
+  const { httpAuth, config } = options;
+  const disableDefaultAuthPolicy = config.getOptionalBoolean(
+    "backend.auth.dangerouslyDisableDefaultAuthPolicy"
+  );
+  if (disableDefaultAuthPolicy) {
+    return {
+      middleware: (_req, _res, next) => next(),
+      addAuthPolicy: () => {
+      }
+    };
+  }
+  const unauthenticatedPredicates = new Array();
+  const cookiePredicates = new Array();
+  const middleware = (req, _, next) => {
+    const allowsUnauthenticated = unauthenticatedPredicates.some(
+      (predicate) => predicate(req.path)
+    );
+    if (allowsUnauthenticated) {
+      next();
+      return;
+    }
+    const allowsCookie = cookiePredicates.some(
+      (predicate) => predicate(req.path)
+    );
+    httpAuth.credentials(req, {
+      allow: ["user", "service"],
+      allowLimitedAccess: allowsCookie
+    }).then(
+      () => next(),
+      (err) => next(err)
+    );
+  };
+  const addAuthPolicy = (policy) => {
+    if (policy.allow === "unauthenticated") {
+      unauthenticatedPredicates.push(createPathPolicyPredicate(policy.path));
+    } else if (policy.allow === "user-cookie") {
+      cookiePredicates.push(createPathPolicyPredicate(policy.path));
+    } else {
+      throw new Error("Invalid auth policy");
+    }
+  };
+  return { middleware, addAuthPolicy };
+}
+
 const httpRouterServiceFactory = backendPluginApi.createServiceFactory(
   (options) => ({
     service: backendPluginApi.coreServices.httpRouter,
     deps: {
       plugin: backendPluginApi.coreServices.pluginMetadata,
+      config: backendPluginApi.coreServices.rootConfig,
       lifecycle: backendPluginApi.coreServices.lifecycle,
-      rootHttpRouter: backendPluginApi.coreServices.rootHttpRouter
+      rootHttpRouter: backendPluginApi.coreServices.rootHttpRouter,
+      httpAuth: backendPluginApi.coreServices.httpAuth
     },
-    async factory({ plugin, rootHttpRouter, lifecycle }) {
+    async factory({ httpAuth, config, plugin, rootHttpRouter, lifecycle }) {
       var _a;
       const getPath = (_a = options == null ? void 0 : options.getPath) != null ? _a : (id) => `/api/${id}`;
       const path = getPath(plugin.getId());
       const router = PromiseRouter__default["default"]();
       rootHttpRouter.use(path, router);
+      const credentialsBarrier = createCredentialsBarrier({ httpAuth, config });
       router.use(createLifecycleMiddleware({ lifecycle }));
+      router.use(credentialsBarrier.middleware);
       return {
         use(handler) {
           router.use(handler);
+        },
+        addAuthPolicy(policy) {
+          credentialsBarrier.addAuthPolicy(policy);
         }
       };
     }
@@ -2165,12 +2603,14 @@ const loggerServiceFactory = backendPluginApi.createServiceFactory({
 const permissionsServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.permissions,
   deps: {
+    auth: backendPluginApi.coreServices.auth,
     config: backendPluginApi.coreServices.rootConfig,
     discovery: backendPluginApi.coreServices.discovery,
     tokenManager: backendPluginApi.coreServices.tokenManager
   },
-  async factory({ config, discovery, tokenManager }) {
+  async factory({ auth, config, discovery, tokenManager }) {
     return pluginPermissionNode.ServerPermissionClient.fromConfig(config, {
+      auth,
       discovery,
       tokenManager
     });
@@ -2383,10 +2823,40 @@ const urlReaderServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
+class DefaultUserInfoService {
+  async getUserInfo(credentials) {
+    const internalCredentials = toInternalBackstageCredentials(credentials);
+    if (internalCredentials.principal.type !== "user") {
+      throw new Error("Only user credentials are supported");
+    }
+    if (!internalCredentials.token) {
+      throw new Error("User credentials is unexpectedly missing token");
+    }
+    const { sub: userEntityRef, ent: ownershipEntityRefs = [] } = jose.decodeJwt(
+      internalCredentials.token
+    );
+    if (typeof userEntityRef !== "string") {
+      throw new Error("User entity ref must be a string");
+    }
+    if (!Array.isArray(ownershipEntityRefs) || ownershipEntityRefs.some((ref) => typeof ref !== "string")) {
+      throw new Error("Ownership entity refs must be an array of strings");
+    }
+    return { userEntityRef, ownershipEntityRefs };
+  }
+}
+const userInfoServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.userInfo,
+  deps: {},
+  async factory() {
+    return new DefaultUserInfoService();
+  }
+});
+
 exports.DefaultRootHttpRouter = DefaultRootHttpRouter;
 exports.HostDiscovery = HostDiscovery;
 exports.MiddlewareFactory = MiddlewareFactory;
 exports.WinstonLogger = WinstonLogger;
+exports.authServiceFactory = authServiceFactory;
 exports.cacheServiceFactory = cacheServiceFactory;
 exports.createConfigSecretEnumerator = createConfigSecretEnumerator;
 exports.createHttpServer = createHttpServer;
@@ -2394,6 +2864,7 @@ exports.createLifecycleMiddleware = createLifecycleMiddleware;
 exports.createSpecializedBackend = createSpecializedBackend;
 exports.databaseServiceFactory = databaseServiceFactory;
 exports.discoveryServiceFactory = discoveryServiceFactory;
+exports.httpAuthServiceFactory = httpAuthServiceFactory;
 exports.httpRouterServiceFactory = httpRouterServiceFactory;
 exports.identityServiceFactory = identityServiceFactory;
 exports.lifecycleServiceFactory = lifecycleServiceFactory;
@@ -2410,4 +2881,5 @@ exports.rootLoggerServiceFactory = rootLoggerServiceFactory;
 exports.schedulerServiceFactory = schedulerServiceFactory;
 exports.tokenManagerServiceFactory = tokenManagerServiceFactory;
 exports.urlReaderServiceFactory = urlReaderServiceFactory;
+exports.userInfoServiceFactory = userInfoServiceFactory;
 //# sourceMappingURL=index.cjs.js.map