@backstage/backend-app-api 0.5.14 → 0.6.0-next.1

package/CHANGELOG.md

@@ -1,44 +1,49 @@
 # @backstage/backend-app-api
 
-## 0.5.14
+## 0.6.0-next.1
 
 ### Patch Changes
 
-- ac1310f: Fixed an issue where configuration schema for the purpose of redacting secrets from logs was not being read correctly.
+- 81e0120: Fixed an issue where configuration schema for the purpose of redacting secrets from logs was not being read correctly.
+- f235ca7: Make sure to not filter out schemas in `createConfigSecretEnumerator`
 - Updated dependencies
-  - @backstage/backend-common@0.21.3
-  - @backstage/backend-tasks@0.5.18
-  - @backstage/plugin-auth-node@0.4.8
-  - @backstage/plugin-permission-node@0.7.24
-  - @backstage/cli-node@0.2.3
-  - @backstage/config-loader@1.6.2
-  - @backstage/backend-plugin-api@0.6.13
+  - @backstage/config@1.2.0-next.1
+  - @backstage/config-loader@1.7.0-next.1
+  - @backstage/backend-common@0.21.4-next.1
+  - @backstage/backend-plugin-api@0.6.14-next.1
+  - @backstage/backend-tasks@0.5.19-next.1
+  - @backstage/plugin-auth-node@0.4.9-next.1
+  - @backstage/plugin-permission-node@0.7.25-next.1
+  - @backstage/cli-common@0.1.13
+  - @backstage/cli-node@0.2.4-next.0
+  - @backstage/errors@1.2.4-next.0
+  - @backstage/types@1.1.1
 
-## 0.5.13
+## 0.6.0-next.0
 
-### Patch Changes
+### Minor Changes
 
-- Updated dependencies
-  - @backstage/backend-common@0.21.2
-  - @backstage/backend-tasks@0.5.17
-  - @backstage/plugin-auth-node@0.4.7
-  - @backstage/plugin-permission-node@0.7.23
-  - @backstage/backend-plugin-api@0.6.12
-  - @backstage/cli-node@0.2.3
-  - @backstage/config-loader@1.6.2
+- 4a3d434: **BREAKING**: For users that have migrated to the new backend system, incoming requests will now be rejected if they are not properly authenticated (e.g. with a Backstage bearer token or a backend token). Please see the [Auth Service Migration tutorial](https://backstage.io/docs/tutorials/auth-service-migration) for more information on how to circumvent this behavior in the short term and how to properly leverage it in the longer term.
 
-## 0.5.12
+  Added service factories for the new [`auth`](https://backstage.io/docs/backend-system/core-services/auth/), [`httpAuth`](https://backstage.io/docs/backend-system/core-services/http-auth), and [`userInfo`](https://backstage.io/docs/backend-system/core-services/user-info) services that were created as part of [BEP-0003](https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution).
 
 ### Patch Changes
 
+- 999224f: Bump dependency `minimatch` to v9
+- 0502d82: Updated the `permissionsServiceFactory` to forward the `AuthService` to the implementation.
+- 9802004: Made the `DefaultUserInfoService` claims check stricter
 - Updated dependencies
-  - @backstage/backend-common@0.21.1
-  - @backstage/backend-tasks@0.5.16
-  - @backstage/plugin-auth-node@0.4.6
-  - @backstage/plugin-permission-node@0.7.22
-  - @backstage/backend-plugin-api@0.6.11
-  - @backstage/cli-node@0.2.3
-  - @backstage/config-loader@1.6.2
+  - @backstage/backend-common@0.21.3-next.0
+  - @backstage/plugin-auth-node@0.4.8-next.0
+  - @backstage/errors@1.2.4-next.0
+  - @backstage/backend-plugin-api@0.6.13-next.0
+  - @backstage/backend-tasks@0.5.18-next.0
+  - @backstage/plugin-permission-node@0.7.24-next.0
+  - @backstage/cli-node@0.2.4-next.0
+  - @backstage/config-loader@1.6.3-next.0
+  - @backstage/config@1.1.2-next.0
+  - @backstage/cli-common@0.1.13
+  - @backstage/types@1.1.1
 
 ## 0.5.11
 

package/alpha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/backend-app-api",
-  "version": "0.5.14",
+  "version": "0.6.0-next.1",
   "main": "../dist/alpha.cjs.js",
   "types": "../dist/alpha.d.ts"
 }

package/config.d.ts

@@ -15,6 +15,26 @@
  */
 
 export interface Config {
+  backend?: {
+    auth?: {
+      /**
+       * This disables the otherwise default auth policy, which requires all
+       * requests to be authenticated with either user or service credentials.
+       *
+       * Disabling this check means that the backend will no longer block
+       * unauthenticated requests, but instead allow them to pass through to
+       * plugins.
+       *
+       * If permissions are enabled, unauthenticated requests will be treated
+       * exactly as such, leaving it to the permission policy to determine what
+       * permissions should be allowed for an unauthenticated identity. Note
+       * that this will also apply to service-to-service calls between plugins
+       * unless you configure credentials for service calls.
+       */
+      dangerouslyDisableDefaultAuthPolicy?: boolean;
+    };
+  };
+
   /** Discovery options. */
   discovery?: {
     /**