@backstage/backend-app-api 0.7.0-next.1 → 0.7.1-next.0

package/dist/index.cjs.js

@@ -21,15 +21,15 @@ var crypto = require('crypto');
 var winston = require('winston');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var alpha = require('@backstage/backend-plugin-api/alpha');
-var jose = require('jose');
-var pluginAuthNode = require('@backstage/plugin-auth-node');
-var uuid = require('uuid');
 var luxon = require('luxon');
 var backendCommon = require('@backstage/backend-common');
+var jose = require('jose');
+var uuid = require('uuid');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var types = require('@backstage/types');
 var backendAppApi = require('@backstage/backend-app-api');
 var cookie = require('cookie');
 var Router = require('express-promise-router');
-var types = require('@backstage/types');
 var pathToRegexp = require('path-to-regexp');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
@@ -612,31 +612,31 @@ function applyInternalErrorFilter(error, logger) {
   return error;
 }
 
-var __accessCheck$c = (obj, member, msg) => {
+var __accessCheck$e = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$b = (obj, member, getter) => {
-  __accessCheck$c(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$c = (obj, member, getter) => {
+  __accessCheck$e(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$c = (obj, member, value) => {
+var __privateAdd$e = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$b = (obj, member, value, setter) => {
-  __accessCheck$c(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$a = (obj, member, value, setter) => {
+  __accessCheck$e(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
 var _config, _logger;
 const _MiddlewareFactory = class _MiddlewareFactory {
   constructor(options) {
-    __privateAdd$c(this, _config, void 0);
-    __privateAdd$c(this, _logger, void 0);
-    __privateSet$b(this, _config, options.config);
-    __privateSet$b(this, _logger, options.logger);
+    __privateAdd$e(this, _config, void 0);
+    __privateAdd$e(this, _logger, void 0);
+    __privateSet$a(this, _config, options.config);
+    __privateSet$a(this, _logger, options.logger);
   }
   /**
    * Creates a new {@link MiddlewareFactory}.
@@ -682,7 +682,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   logging() {
-    const logger = __privateGet$b(this, _logger).child({
+    const logger = __privateGet$c(this, _logger).child({
       type: "incomingRequest"
     });
     return morgan__default.default("combined", {
@@ -706,7 +706,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   helmet() {
-    return helmet__default.default(readHelmetOptions(__privateGet$b(this, _config).getOptionalConfig("backend")));
+    return helmet__default.default(readHelmetOptions(__privateGet$c(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Returns a middleware that implements the cors library.
@@ -721,7 +721,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   cors() {
-    return cors__default.default(readCorsOptions(__privateGet$b(this, _config).getOptionalConfig("backend")));
+    return cors__default.default(readCorsOptions(__privateGet$c(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Express middleware to handle errors during request processing.
@@ -746,7 +746,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
   error(options = {}) {
     var _a;
     const showStackTraces = (_a = options.showStackTraces) != null ? _a : process.env.NODE_ENV === "development";
-    const logger = __privateGet$b(this, _logger).child({
+    const logger = __privateGet$c(this, _logger).child({
       type: "errorHandler"
     });
     return (rawError, req, res, next) => {
@@ -805,31 +805,31 @@ const escapeRegExp = (text) => {
   return text.replace(/[.*+?^${}(\)|[\]\\]/g, "\\$&");
 };
 
-var __accessCheck$b = (obj, member, msg) => {
+var __accessCheck$d = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$a = (obj, member, getter) => {
-  __accessCheck$b(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$b = (obj, member, getter) => {
+  __accessCheck$d(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$b = (obj, member, value) => {
+var __privateAdd$d = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$a = (obj, member, value, setter) => {
-  __accessCheck$b(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$9 = (obj, member, value, setter) => {
+  __accessCheck$d(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
 var _winston, _addRedactions;
 const _WinstonLogger = class _WinstonLogger {
   constructor(winston, addRedactions) {
-    __privateAdd$b(this, _winston, void 0);
-    __privateAdd$b(this, _addRedactions, void 0);
-    __privateSet$a(this, _winston, winston);
-    __privateSet$a(this, _addRedactions, addRedactions);
+    __privateAdd$d(this, _winston, void 0);
+    __privateAdd$d(this, _addRedactions, void 0);
+    __privateSet$9(this, _winston, winston);
+    __privateSet$9(this, _addRedactions, addRedactions);
   }
   /**
    * Creates a {@link WinstonLogger} instance.
@@ -857,16 +857,21 @@ const _WinstonLogger = class _WinstonLogger {
   static redacter() {
     const redactionSet = /* @__PURE__ */ new Set();
     let redactionPattern = void 0;
-    return {
-      format: winston.format((info) => {
-        if (redactionPattern && typeof info.message === "string") {
-          info.message = info.message.replace(redactionPattern, "[REDACTED]");
-        }
-        if (redactionPattern && typeof info.stack === "string") {
-          info.stack = info.stack.replace(redactionPattern, "[REDACTED]");
+    const replace = (obj) => {
+      var _a;
+      for (const key in obj) {
+        if (obj.hasOwnProperty(key)) {
+          if (typeof obj[key] === "object") {
+            obj[key] = replace(obj[key]);
+          } else if (typeof obj[key] === "string") {
+            obj[key] = (_a = obj[key]) == null ? void 0 : _a.replace(redactionPattern, "[REDACTED]");
+          }
         }
-        return info;
-      })(),
+      }
+      return obj;
+    };
+    return {
+      format: winston.format(replace)(),
       add(newRedactions) {
         let added = 0;
         for (const redactionToTrim of newRedactions) {
@@ -914,70 +919,70 @@ const _WinstonLogger = class _WinstonLogger {
     );
   }
   error(message, meta) {
-    __privateGet$a(this, _winston).error(message, meta);
+    __privateGet$b(this, _winston).error(message, meta);
   }
   warn(message, meta) {
-    __privateGet$a(this, _winston).warn(message, meta);
+    __privateGet$b(this, _winston).warn(message, meta);
   }
   info(message, meta) {
-    __privateGet$a(this, _winston).info(message, meta);
+    __privateGet$b(this, _winston).info(message, meta);
   }
   debug(message, meta) {
-    __privateGet$a(this, _winston).debug(message, meta);
+    __privateGet$b(this, _winston).debug(message, meta);
   }
   child(meta) {
-    return new _WinstonLogger(__privateGet$a(this, _winston).child(meta));
+    return new _WinstonLogger(__privateGet$b(this, _winston).child(meta));
   }
   addRedactions(redactions) {
     var _a;
-    (_a = __privateGet$a(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
+    (_a = __privateGet$b(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
   }
 };
 _winston = new WeakMap();
 _addRedactions = new WeakMap();
 let WinstonLogger = _WinstonLogger;
 
-var __accessCheck$a = (obj, member, msg) => {
+var __accessCheck$c = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$9 = (obj, member, getter) => {
-  __accessCheck$a(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$a = (obj, member, getter) => {
+  __accessCheck$c(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$a = (obj, member, value) => {
+var __privateAdd$c = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$9 = (obj, member, value, setter) => {
-  __accessCheck$a(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$8 = (obj, member, value, setter) => {
+  __accessCheck$c(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
 var _hasStarted$1, _startupTasks$1, _hasShutdown, _shutdownTasks;
 class BackendLifecycleImpl {
   constructor(logger) {
     this.logger = logger;
-    __privateAdd$a(this, _hasStarted$1, false);
-    __privateAdd$a(this, _startupTasks$1, []);
-    __privateAdd$a(this, _hasShutdown, false);
-    __privateAdd$a(this, _shutdownTasks, []);
+    __privateAdd$c(this, _hasStarted$1, false);
+    __privateAdd$c(this, _startupTasks$1, []);
+    __privateAdd$c(this, _hasShutdown, false);
+    __privateAdd$c(this, _shutdownTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$9(this, _hasStarted$1)) {
+    if (__privateGet$a(this, _hasStarted$1)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$9(this, _startupTasks$1).push({ hook, options });
+    __privateGet$a(this, _startupTasks$1).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$9(this, _hasStarted$1)) {
+    if (__privateGet$a(this, _hasStarted$1)) {
       return;
     }
-    __privateSet$9(this, _hasStarted$1, true);
-    this.logger.debug(`Running ${__privateGet$9(this, _startupTasks$1).length} startup tasks...`);
+    __privateSet$8(this, _hasStarted$1, true);
+    this.logger.debug(`Running ${__privateGet$a(this, _startupTasks$1).length} startup tasks...`);
     await Promise.all(
-      __privateGet$9(this, _startupTasks$1).map(async ({ hook, options }) => {
+      __privateGet$a(this, _startupTasks$1).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -990,21 +995,21 @@ class BackendLifecycleImpl {
     );
   }
   addShutdownHook(hook, options) {
-    if (__privateGet$9(this, _hasShutdown)) {
+    if (__privateGet$a(this, _hasShutdown)) {
       throw new Error("Attempted to add shutdown hook after shutdown");
     }
-    __privateGet$9(this, _shutdownTasks).push({ hook, options });
+    __privateGet$a(this, _shutdownTasks).push({ hook, options });
   }
   async shutdown() {
-    if (__privateGet$9(this, _hasShutdown)) {
+    if (__privateGet$a(this, _hasShutdown)) {
       return;
     }
-    __privateSet$9(this, _hasShutdown, true);
+    __privateSet$8(this, _hasShutdown, true);
     this.logger.debug(
-      `Running ${__privateGet$9(this, _shutdownTasks).length} shutdown tasks...`
+      `Running ${__privateGet$a(this, _shutdownTasks).length} shutdown tasks...`
     );
     await Promise.all(
-      __privateGet$9(this, _shutdownTasks).map(async ({ hook, options }) => {
+      __privateGet$a(this, _shutdownTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1031,22 +1036,22 @@ const rootLifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$9 = (obj, member, msg) => {
+var __accessCheck$b = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$8 = (obj, member, getter) => {
-  __accessCheck$9(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$9 = (obj, member, getter) => {
+  __accessCheck$b(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$9 = (obj, member, value) => {
+var __privateAdd$b = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$8 = (obj, member, value, setter) => {
-  __accessCheck$9(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$7 = (obj, member, value, setter) => {
+  __accessCheck$b(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
 var _hasStarted, _startupTasks;
@@ -1055,25 +1060,25 @@ class BackendPluginLifecycleImpl {
     this.logger = logger;
     this.rootLifecycle = rootLifecycle;
     this.pluginMetadata = pluginMetadata;
-    __privateAdd$9(this, _hasStarted, false);
-    __privateAdd$9(this, _startupTasks, []);
+    __privateAdd$b(this, _hasStarted, false);
+    __privateAdd$b(this, _startupTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$8(this, _hasStarted)) {
+    if (__privateGet$9(this, _hasStarted)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$8(this, _startupTasks).push({ hook, options });
+    __privateGet$9(this, _startupTasks).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$8(this, _hasStarted)) {
+    if (__privateGet$9(this, _hasStarted)) {
       return;
     }
-    __privateSet$8(this, _hasStarted, true);
+    __privateSet$7(this, _hasStarted, true);
     this.logger.debug(
-      `Running ${__privateGet$8(this, _startupTasks).length} plugin startup tasks...`
+      `Running ${__privateGet$9(this, _startupTasks).length} plugin startup tasks...`
     );
     await Promise.all(
-      __privateGet$8(this, _startupTasks).map(async ({ hook, options }) => {
+      __privateGet$9(this, _startupTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1111,26 +1116,26 @@ const lifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$8 = (obj, member, msg) => {
+var __accessCheck$a = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$7 = (obj, member, getter) => {
-  __accessCheck$8(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$8 = (obj, member, getter) => {
+  __accessCheck$a(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$8 = (obj, member, value) => {
+var __privateAdd$a = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$7 = (obj, member, value, setter) => {
-  __accessCheck$8(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$6 = (obj, member, value, setter) => {
+  __accessCheck$a(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
-var __privateMethod$6 = (obj, member, method) => {
-  __accessCheck$8(obj, member, "access private method");
+var __privateMethod$7 = (obj, member, method) => {
+  __accessCheck$a(obj, member, "access private method");
   return method;
 };
 var _nodeIds, _cycleKeys, _getCycleKey, getCycleKey_fn, _nodes, _allProvided;
@@ -1150,21 +1155,21 @@ class Node {
 }
 const _CycleKeySet = class _CycleKeySet {
   constructor(nodes) {
-    __privateAdd$8(this, _getCycleKey);
-    __privateAdd$8(this, _nodeIds, void 0);
-    __privateAdd$8(this, _cycleKeys, void 0);
-    __privateSet$7(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
-    __privateSet$7(this, _cycleKeys, /* @__PURE__ */ new Set());
+    __privateAdd$a(this, _getCycleKey);
+    __privateAdd$a(this, _nodeIds, void 0);
+    __privateAdd$a(this, _cycleKeys, void 0);
+    __privateSet$6(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
+    __privateSet$6(this, _cycleKeys, /* @__PURE__ */ new Set());
   }
   static from(nodes) {
     return new _CycleKeySet(nodes);
   }
   tryAdd(path) {
-    const cycleKey = __privateMethod$6(this, _getCycleKey, getCycleKey_fn).call(this, path);
-    if (__privateGet$7(this, _cycleKeys).has(cycleKey)) {
+    const cycleKey = __privateMethod$7(this, _getCycleKey, getCycleKey_fn).call(this, path);
+    if (__privateGet$8(this, _cycleKeys).has(cycleKey)) {
       return false;
     }
-    __privateGet$7(this, _cycleKeys).add(cycleKey);
+    __privateGet$8(this, _cycleKeys).add(cycleKey);
     return true;
   }
 };
@@ -1172,18 +1177,18 @@ _nodeIds = new WeakMap();
 _cycleKeys = new WeakMap();
 _getCycleKey = new WeakSet();
 getCycleKey_fn = function(path) {
-  return path.map((n) => __privateGet$7(this, _nodeIds).get(n)).sort().join(",");
+  return path.map((n) => __privateGet$8(this, _nodeIds).get(n)).sort().join(",");
 };
 let CycleKeySet = _CycleKeySet;
 const _DependencyGraph = class _DependencyGraph {
   constructor(nodes) {
-    __privateAdd$8(this, _nodes, void 0);
-    __privateAdd$8(this, _allProvided, void 0);
-    __privateSet$7(this, _nodes, nodes);
-    __privateSet$7(this, _allProvided, /* @__PURE__ */ new Set());
-    for (const node of __privateGet$7(this, _nodes).values()) {
+    __privateAdd$a(this, _nodes, void 0);
+    __privateAdd$a(this, _allProvided, void 0);
+    __privateSet$6(this, _nodes, nodes);
+    __privateSet$6(this, _allProvided, /* @__PURE__ */ new Set());
+    for (const node of __privateGet$8(this, _nodes).values()) {
       for (const produced of node.provides) {
-        __privateGet$7(this, _allProvided).add(produced);
+        __privateGet$8(this, _allProvided).add(produced);
       }
     }
   }
@@ -1207,9 +1212,9 @@ const _DependencyGraph = class _DependencyGraph {
    */
   findUnsatisfiedDeps() {
     const unsatisfiedDependencies = [];
-    for (const node of __privateGet$7(this, _nodes).values()) {
+    for (const node of __privateGet$8(this, _nodes).values()) {
       const unsatisfied = Array.from(node.consumes).filter(
-        (id) => !__privateGet$7(this, _allProvided).has(id)
+        (id) => !__privateGet$8(this, _allProvided).has(id)
       );
       if (unsatisfied.length > 0) {
         unsatisfiedDependencies.push({ value: node.value, unsatisfied });
@@ -1229,8 +1234,8 @@ const _DependencyGraph = class _DependencyGraph {
    * form a cycle, with the same node as the first and last element of the array.
    */
   *detectCircularDependencies() {
-    const cycleKeys = CycleKeySet.from(__privateGet$7(this, _nodes));
-    for (const startNode of __privateGet$7(this, _nodes)) {
+    const cycleKeys = CycleKeySet.from(__privateGet$8(this, _nodes));
+    for (const startNode of __privateGet$8(this, _nodes)) {
       const visited = /* @__PURE__ */ new Set();
       const stack = new Array([
         startNode,
@@ -1243,7 +1248,7 @@ const _DependencyGraph = class _DependencyGraph {
         }
         visited.add(node);
         for (const consumed of node.consumes) {
-          const providerNodes = __privateGet$7(this, _nodes).filter(
+          const providerNodes = __privateGet$8(this, _nodes).filter(
             (other) => other.provides.has(consumed)
           );
           for (const provider of providerNodes) {
@@ -1272,9 +1277,9 @@ const _DependencyGraph = class _DependencyGraph {
    * Dependencies of nodes that are not produced by any other nodes will be ignored.
    */
   async parallelTopologicalTraversal(fn) {
-    const allProvided = __privateGet$7(this, _allProvided);
+    const allProvided = __privateGet$8(this, _allProvided);
     const producedSoFar = /* @__PURE__ */ new Set();
-    const waiting = new Set(__privateGet$7(this, _nodes).values());
+    const waiting = new Set(__privateGet$8(this, _nodes).values());
     const visited = /* @__PURE__ */ new Set();
     const results = new Array();
     let inFlight = 0;
@@ -1320,26 +1325,26 @@ _nodes = new WeakMap();
 _allProvided = new WeakMap();
 let DependencyGraph = _DependencyGraph;
 
-var __accessCheck$7 = (obj, member, msg) => {
+var __accessCheck$9 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$6 = (obj, member, getter) => {
-  __accessCheck$7(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$7 = (obj, member, getter) => {
+  __accessCheck$9(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$7 = (obj, member, value) => {
+var __privateAdd$9 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$6 = (obj, member, value, setter) => {
-  __accessCheck$7(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$5 = (obj, member, value, setter) => {
+  __accessCheck$9(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
-var __privateMethod$5 = (obj, member, method) => {
-  __accessCheck$7(obj, member, "access private method");
+var __privateMethod$6 = (obj, member, method) => {
+  __accessCheck$9(obj, member, "access private method");
   return method;
 };
 var _providedFactories, _loadedDefaultFactories, _implementations, _rootServiceImplementations, _addedFactoryIds, _instantiatedFactories, _resolveFactory, resolveFactory_fn, _checkForMissingDeps, checkForMissingDeps_fn;
@@ -1362,19 +1367,19 @@ const pluginMetadataServiceFactory = backendPluginApi.createServiceFactory(
 );
 const _ServiceRegistry = class _ServiceRegistry {
   constructor(factories) {
-    __privateAdd$7(this, _resolveFactory);
-    __privateAdd$7(this, _checkForMissingDeps);
-    __privateAdd$7(this, _providedFactories, void 0);
-    __privateAdd$7(this, _loadedDefaultFactories, void 0);
-    __privateAdd$7(this, _implementations, void 0);
-    __privateAdd$7(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
-    __privateAdd$7(this, _addedFactoryIds, /* @__PURE__ */ new Set());
-    __privateAdd$7(this, _instantiatedFactories, /* @__PURE__ */ new Set());
-    __privateSet$6(this, _providedFactories, new Map(
+    __privateAdd$9(this, _resolveFactory);
+    __privateAdd$9(this, _checkForMissingDeps);
+    __privateAdd$9(this, _providedFactories, void 0);
+    __privateAdd$9(this, _loadedDefaultFactories, void 0);
+    __privateAdd$9(this, _implementations, void 0);
+    __privateAdd$9(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
+    __privateAdd$9(this, _addedFactoryIds, /* @__PURE__ */ new Set());
+    __privateAdd$9(this, _instantiatedFactories, /* @__PURE__ */ new Set());
+    __privateSet$5(this, _providedFactories, new Map(
       factories.map((sf) => [sf.service.id, toInternalServiceFactory(sf)])
     ));
-    __privateSet$6(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
-    __privateSet$6(this, _implementations, /* @__PURE__ */ new Map());
+    __privateSet$5(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
+    __privateSet$5(this, _implementations, /* @__PURE__ */ new Map());
   }
   static create(factories) {
     const registry = new _ServiceRegistry(factories);
@@ -1383,7 +1388,7 @@ const _ServiceRegistry = class _ServiceRegistry {
   }
   checkForCircularDeps() {
     const graph = DependencyGraph.fromIterable(
-      Array.from(__privateGet$6(this, _providedFactories)).map(
+      Array.from(__privateGet$7(this, _providedFactories)).map(
         ([serviceId, serviceFactory]) => ({
           value: serviceId,
           provides: [serviceId],
@@ -1405,21 +1410,21 @@ const _ServiceRegistry = class _ServiceRegistry {
         `The ${backendPluginApi.coreServices.pluginMetadata.id} service cannot be overridden`
       );
     }
-    if (__privateGet$6(this, _addedFactoryIds).has(factoryId)) {
+    if (__privateGet$7(this, _addedFactoryIds).has(factoryId)) {
       throw new Error(
         `Duplicate service implementations provided for ${factoryId}`
       );
     }
-    if (__privateGet$6(this, _instantiatedFactories).has(factoryId)) {
+    if (__privateGet$7(this, _instantiatedFactories).has(factoryId)) {
       throw new Error(
         `Unable to set service factory with id ${factoryId}, service has already been instantiated`
       );
     }
-    __privateGet$6(this, _addedFactoryIds).add(factoryId);
-    __privateGet$6(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
+    __privateGet$7(this, _addedFactoryIds).add(factoryId);
+    __privateGet$7(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
   }
   async initializeEagerServicesWithScope(scope, pluginId = "root") {
-    for (const factory of __privateGet$6(this, _providedFactories).values()) {
+    for (const factory of __privateGet$7(this, _providedFactories).values()) {
       if (factory.service.scope === scope) {
         if (scope === "root" && factory.initialization !== "lazy") {
           await this.get(factory.service, pluginId);
@@ -1431,12 +1436,12 @@ const _ServiceRegistry = class _ServiceRegistry {
   }
   get(ref, pluginId) {
     var _a;
-    __privateGet$6(this, _instantiatedFactories).add(ref.id);
-    return (_a = __privateMethod$5(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
+    __privateGet$7(this, _instantiatedFactories).add(ref.id);
+    return (_a = __privateMethod$6(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
       if (factory.service.scope === "root") {
-        let existing = __privateGet$6(this, _rootServiceImplementations).get(factory);
+        let existing = __privateGet$7(this, _rootServiceImplementations).get(factory);
         if (!existing) {
-          __privateMethod$5(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+          __privateMethod$6(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
           const rootDeps = new Array();
           for (const [name, serviceRef] of Object.entries(factory.deps)) {
             if (serviceRef.scope !== "root") {
@@ -1450,13 +1455,13 @@ const _ServiceRegistry = class _ServiceRegistry {
           existing = Promise.all(rootDeps).then(
             (entries) => factory.factory(Object.fromEntries(entries), void 0)
           );
-          __privateGet$6(this, _rootServiceImplementations).set(factory, existing);
+          __privateGet$7(this, _rootServiceImplementations).set(factory, existing);
         }
         return existing;
       }
-      let implementation = __privateGet$6(this, _implementations).get(factory);
+      let implementation = __privateGet$7(this, _implementations).get(factory);
       if (!implementation) {
-        __privateMethod$5(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+        __privateMethod$6(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
         const rootDeps = new Array();
         for (const [name, serviceRef] of Object.entries(factory.deps)) {
           if (serviceRef.scope === "root") {
@@ -1478,7 +1483,7 @@ const _ServiceRegistry = class _ServiceRegistry {
           }),
           byPlugin: /* @__PURE__ */ new Map()
         };
-        __privateGet$6(this, _implementations).set(factory, implementation);
+        __privateGet$7(this, _implementations).set(factory, implementation);
       }
       let result = implementation.byPlugin.get(pluginId);
       if (!result) {
@@ -1516,18 +1521,18 @@ resolveFactory_fn = function(ref, pluginId) {
       toInternalServiceFactory(pluginMetadataServiceFactory({ pluginId }))
     );
   }
-  let resolvedFactory = __privateGet$6(this, _providedFactories).get(ref.id);
+  let resolvedFactory = __privateGet$7(this, _providedFactories).get(ref.id);
   const { __defaultFactory: defaultFactory } = ref;
   if (!resolvedFactory && !defaultFactory) {
     return void 0;
   }
   if (!resolvedFactory) {
-    let loadedFactory = __privateGet$6(this, _loadedDefaultFactories).get(defaultFactory);
+    let loadedFactory = __privateGet$7(this, _loadedDefaultFactories).get(defaultFactory);
     if (!loadedFactory) {
       loadedFactory = Promise.resolve().then(() => defaultFactory(ref)).then(
         (f) => toInternalServiceFactory(typeof f === "function" ? f() : f)
       );
-      __privateGet$6(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
+      __privateGet$7(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
     }
     resolvedFactory = loadedFactory.catch((error) => {
       throw new Error(
@@ -1545,7 +1550,7 @@ checkForMissingDeps_fn = function(factory, pluginId) {
     if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
       return false;
     }
-    if (__privateGet$6(this, _providedFactories).get(ref.id)) {
+    if (__privateGet$7(this, _providedFactories).get(ref.id)) {
       return false;
     }
     return !ref.__defaultFactory;
@@ -1559,52 +1564,52 @@ checkForMissingDeps_fn = function(factory, pluginId) {
 };
 let ServiceRegistry = _ServiceRegistry;
 
-var __accessCheck$6 = (obj, member, msg) => {
+var __accessCheck$8 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$5 = (obj, member, getter) => {
-  __accessCheck$6(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$6 = (obj, member, getter) => {
+  __accessCheck$8(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$6 = (obj, member, value) => {
+var __privateAdd$8 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$5 = (obj, member, value, setter) => {
-  __accessCheck$6(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$4 = (obj, member, value, setter) => {
+  __accessCheck$8(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
-var __privateMethod$4 = (obj, member, method) => {
-  __accessCheck$6(obj, member, "access private method");
+var __privateMethod$5 = (obj, member, method) => {
+  __accessCheck$8(obj, member, "access private method");
   return method;
 };
 var _startPromise, _features, _extensionPoints, _serviceRegistry, _registeredFeatures, _getInitDeps, getInitDeps_fn, _addFeature, addFeature_fn, _doStart, doStart_fn, _getRootLifecycleImpl, getRootLifecycleImpl_fn, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn;
 class BackendInitializer {
   constructor(defaultApiFactories) {
-    __privateAdd$6(this, _getInitDeps);
-    __privateAdd$6(this, _addFeature);
-    __privateAdd$6(this, _doStart);
+    __privateAdd$8(this, _getInitDeps);
+    __privateAdd$8(this, _addFeature);
+    __privateAdd$8(this, _doStart);
     // Bit of a hacky way to grab the lifecycle services, potentially find a nicer way to do this
-    __privateAdd$6(this, _getRootLifecycleImpl);
-    __privateAdd$6(this, _getPluginLifecycleImpl);
-    __privateAdd$6(this, _startPromise, void 0);
-    __privateAdd$6(this, _features, new Array());
-    __privateAdd$6(this, _extensionPoints, /* @__PURE__ */ new Map());
-    __privateAdd$6(this, _serviceRegistry, void 0);
-    __privateAdd$6(this, _registeredFeatures, new Array());
-    __privateSet$5(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
+    __privateAdd$8(this, _getRootLifecycleImpl);
+    __privateAdd$8(this, _getPluginLifecycleImpl);
+    __privateAdd$8(this, _startPromise, void 0);
+    __privateAdd$8(this, _features, new Array());
+    __privateAdd$8(this, _extensionPoints, /* @__PURE__ */ new Map());
+    __privateAdd$8(this, _serviceRegistry, void 0);
+    __privateAdd$8(this, _registeredFeatures, new Array());
+    __privateSet$4(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
   }
   add(feature) {
-    if (__privateGet$5(this, _startPromise)) {
+    if (__privateGet$6(this, _startPromise)) {
       throw new Error("feature can not be added after the backend has started");
     }
-    __privateGet$5(this, _registeredFeatures).push(Promise.resolve(feature));
+    __privateGet$6(this, _registeredFeatures).push(Promise.resolve(feature));
   }
   async start() {
-    if (__privateGet$5(this, _startPromise)) {
+    if (__privateGet$6(this, _startPromise)) {
       throw new Error("Backend has already started");
     }
     const exitHandler = async () => {
@@ -1622,18 +1627,18 @@ class BackendInitializer {
     process.addListener("SIGTERM", exitHandler);
     process.addListener("SIGINT", exitHandler);
     process.addListener("beforeExit", exitHandler);
-    __privateSet$5(this, _startPromise, __privateMethod$4(this, _doStart, doStart_fn).call(this));
-    await __privateGet$5(this, _startPromise);
+    __privateSet$4(this, _startPromise, __privateMethod$5(this, _doStart, doStart_fn).call(this));
+    await __privateGet$6(this, _startPromise);
   }
   async stop() {
-    if (!__privateGet$5(this, _startPromise)) {
+    if (!__privateGet$6(this, _startPromise)) {
       return;
     }
     try {
-      await __privateGet$5(this, _startPromise);
+      await __privateGet$6(this, _startPromise);
     } catch (error) {
     }
-    const lifecycleService = await __privateMethod$4(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+    const lifecycleService = await __privateMethod$5(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
     await lifecycleService.shutdown();
   }
 }
@@ -1647,7 +1652,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
   const result = /* @__PURE__ */ new Map();
   const missingRefs = /* @__PURE__ */ new Set();
   for (const [name, ref] of Object.entries(deps)) {
-    const ep = __privateGet$5(this, _extensionPoints).get(ref.id);
+    const ep = __privateGet$6(this, _extensionPoints).get(ref.id);
     if (ep) {
       if (ep.pluginId !== pluginId) {
         throw new Error(
@@ -1656,7 +1661,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
       }
       result.set(name, ep.impl);
     } else {
-      const impl = await __privateGet$5(this, _serviceRegistry).get(
+      const impl = await __privateGet$6(this, _serviceRegistry).get(
         ref,
         pluginId
       );
@@ -1683,14 +1688,14 @@ addFeature_fn = function(feature) {
     );
   }
   if (isServiceFactory(feature)) {
-    __privateGet$5(this, _serviceRegistry).add(feature);
+    __privateGet$6(this, _serviceRegistry).add(feature);
   } else if (isInternalBackendFeature(feature)) {
     if (feature.version !== "v1") {
       throw new Error(
         `Failed to add feature, invalid version '${feature.version}'`
       );
     }
-    __privateGet$5(this, _features).push(feature);
+    __privateGet$6(this, _features).push(feature);
   } else {
     throw new Error(
       `Failed to add feature, invalid feature ${JSON.stringify(feature)}`
@@ -1699,35 +1704,35 @@ addFeature_fn = function(feature) {
 };
 _doStart = new WeakSet();
 doStart_fn = async function() {
-  __privateGet$5(this, _serviceRegistry).checkForCircularDeps();
-  for (const feature of __privateGet$5(this, _registeredFeatures)) {
-    __privateMethod$4(this, _addFeature, addFeature_fn).call(this, await feature);
+  __privateGet$6(this, _serviceRegistry).checkForCircularDeps();
+  for (const feature of __privateGet$6(this, _registeredFeatures)) {
+    __privateMethod$5(this, _addFeature, addFeature_fn).call(this, await feature);
   }
-  const featureDiscovery = await __privateGet$5(this, _serviceRegistry).get(
+  const featureDiscovery = await __privateGet$6(this, _serviceRegistry).get(
     alpha.featureDiscoveryServiceRef,
     "root"
   );
   if (featureDiscovery) {
     const { features } = await featureDiscovery.getBackendFeatures();
     for (const feature of features) {
-      __privateMethod$4(this, _addFeature, addFeature_fn).call(this, feature);
+      __privateMethod$5(this, _addFeature, addFeature_fn).call(this, feature);
     }
-    __privateGet$5(this, _serviceRegistry).checkForCircularDeps();
+    __privateGet$6(this, _serviceRegistry).checkForCircularDeps();
   }
-  await __privateGet$5(this, _serviceRegistry).initializeEagerServicesWithScope("root");
+  await __privateGet$6(this, _serviceRegistry).initializeEagerServicesWithScope("root");
   const pluginInits = /* @__PURE__ */ new Map();
   const moduleInits = /* @__PURE__ */ new Map();
-  for (const feature of __privateGet$5(this, _features)) {
+  for (const feature of __privateGet$6(this, _features)) {
     for (const r of feature.getRegistrations()) {
       const provides = /* @__PURE__ */ new Set();
       if (r.type === "plugin" || r.type === "module") {
         for (const [extRef, extImpl] of r.extensionPoints) {
-          if (__privateGet$5(this, _extensionPoints).has(extRef.id)) {
+          if (__privateGet$6(this, _extensionPoints).has(extRef.id)) {
             throw new Error(
               `ExtensionPoint with ID '${extRef.id}' is already registered`
             );
           }
-          __privateGet$5(this, _extensionPoints).set(extRef.id, {
+          __privateGet$6(this, _extensionPoints).set(extRef.id, {
             impl: extImpl,
             pluginId: r.pluginId
           });
@@ -1765,7 +1770,7 @@ doStart_fn = async function() {
   const allPluginIds = [...pluginInits.keys()];
   await Promise.all(
     allPluginIds.map(async (pluginId) => {
-      await __privateGet$5(this, _serviceRegistry).initializeEagerServicesWithScope(
+      await __privateGet$6(this, _serviceRegistry).initializeEagerServicesWithScope(
         "plugin",
         pluginId
       );
@@ -1789,7 +1794,7 @@ doStart_fn = async function() {
         }
         await tree.parallelTopologicalTraversal(
           async ({ moduleId, moduleInit }) => {
-            const moduleDeps = await __privateMethod$4(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
+            const moduleDeps = await __privateMethod$5(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
             await moduleInit.init.func(moduleDeps).catch((error) => {
               throw new errors.ForwardedError(
                 `Module '${moduleId}' for plugin '${pluginId}' startup failed`,
@@ -1801,7 +1806,7 @@ doStart_fn = async function() {
       }
       const pluginInit = pluginInits.get(pluginId);
       if (pluginInit) {
-        const pluginDeps = await __privateMethod$4(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
+        const pluginDeps = await __privateMethod$5(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
         await pluginInit.init.func(pluginDeps).catch((error) => {
           throw new errors.ForwardedError(
             `Plugin '${pluginId}' startup failed`,
@@ -1809,14 +1814,14 @@ doStart_fn = async function() {
           );
         });
       }
-      const lifecycleService2 = await __privateMethod$4(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
+      const lifecycleService2 = await __privateMethod$5(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
       await lifecycleService2.startup();
     })
   );
-  const lifecycleService = await __privateMethod$4(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+  const lifecycleService = await __privateMethod$5(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
   await lifecycleService.startup();
   if (process.env.NODE_ENV !== "test") {
-    const rootLogger = await __privateGet$5(this, _serviceRegistry).get(
+    const rootLogger = await __privateGet$6(this, _serviceRegistry).get(
       backendPluginApi.coreServices.rootLogger,
       "root"
     );
@@ -1832,7 +1837,7 @@ doStart_fn = async function() {
 };
 _getRootLifecycleImpl = new WeakSet();
 getRootLifecycleImpl_fn = async function() {
-  const lifecycleService = await __privateGet$5(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$6(this, _serviceRegistry).get(
     backendPluginApi.coreServices.rootLifecycle,
     "root"
   );
@@ -1843,7 +1848,7 @@ getRootLifecycleImpl_fn = async function() {
 };
 _getPluginLifecycleImpl = new WeakSet();
 getPluginLifecycleImpl_fn = async function(pluginId) {
-  const lifecycleService = await __privateGet$5(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$6(this, _serviceRegistry).get(
     backendPluginApi.coreServices.lifecycle,
     pluginId
   );
@@ -1859,42 +1864,42 @@ function isInternalBackendFeature(feature) {
   return typeof feature.getRegistrations === "function";
 }
 
-var __accessCheck$5 = (obj, member, msg) => {
+var __accessCheck$7 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$4 = (obj, member, getter) => {
-  __accessCheck$5(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+var __privateGet$5 = (obj, member, getter) => {
+  __accessCheck$7(obj, member, "read from private field");
+  return member.get(obj);
 };
-var __privateAdd$5 = (obj, member, value) => {
+var __privateAdd$7 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$4 = (obj, member, value, setter) => {
-  __accessCheck$5(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+var __privateSet$3 = (obj, member, value, setter) => {
+  __accessCheck$7(obj, member, "write to private field");
+  member.set(obj, value);
   return value;
 };
 var _initializer;
 class BackstageBackend {
   constructor(defaultServiceFactories) {
-    __privateAdd$5(this, _initializer, void 0);
-    __privateSet$4(this, _initializer, new BackendInitializer(defaultServiceFactories));
+    __privateAdd$7(this, _initializer, void 0);
+    __privateSet$3(this, _initializer, new BackendInitializer(defaultServiceFactories));
   }
   add(feature) {
     if (isPromise(feature)) {
-      __privateGet$4(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
+      __privateGet$5(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
     } else {
-      __privateGet$4(this, _initializer).add(unwrapFeature(feature));
+      __privateGet$5(this, _initializer).add(unwrapFeature(feature));
     }
   }
   async start() {
-    await __privateGet$4(this, _initializer).start();
+    await __privateGet$5(this, _initializer).start();
   }
   async stop() {
-    await __privateGet$4(this, _initializer).stop();
+    await __privateGet$5(this, _initializer).stop();
   }
 }
 _initializer = new WeakMap();
@@ -1940,199 +1945,327 @@ function createSpecializedBackend(options) {
   return new BackstageBackend(services);
 }
 
-var __accessCheck$4 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$3 = (obj, member, getter) => {
-  __accessCheck$4(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
-};
-var __privateAdd$4 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$3 = (obj, member, value, setter) => {
-  __accessCheck$4(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
-  return value;
-};
-var _keyStore, _keyStoreUpdated;
-const CLOCK_MARGIN_S = 10;
-class JwksClient {
-  constructor(getEndpoint) {
-    this.getEndpoint = getEndpoint;
-    __privateAdd$4(this, _keyStore, void 0);
-    __privateAdd$4(this, _keyStoreUpdated, 0);
+const MIGRATIONS_TABLE = "backstage_backend_public_keys__knex_migrations";
+const TABLE = "backstage_backend_public_keys__keys";
+function applyDatabaseMigrations(knex) {
+  const migrationsDir = backendCommon.resolvePackagePath(
+    "@backstage/backend-app-api",
+    "migrations"
+  );
+  return knex.migrate.latest({
+    directory: migrationsDir,
+    tableName: MIGRATIONS_TABLE
+  });
+}
+class DatabaseKeyStore {
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
   }
-  get getKey() {
-    if (!__privateGet$3(this, _keyStore)) {
-      throw new errors.AuthenticationError(
-        "refreshKeyStore must be called before jwksClient.getKey"
-      );
+  static async create(options) {
+    var _a;
+    const { database, logger } = options;
+    const client = await database.getClient();
+    if (!((_a = database.migrations) == null ? void 0 : _a.skip)) {
+      await applyDatabaseMigrations(client);
     }
-    return __privateGet$3(this, _keyStore);
+    return new DatabaseKeyStore(client, logger);
   }
-  /**
-   * If the last keystore refresh is stale, update the keystore URL to the latest
-   */
-  async refreshKeyStore(rawJwtToken) {
-    const payload = await jose.decodeJwt(rawJwtToken);
-    const header = await jose.decodeProtectedHeader(rawJwtToken);
-    let keyStoreHasKey;
-    try {
-      if (__privateGet$3(this, _keyStore)) {
-        const [_, rawPayload, rawSignature] = rawJwtToken.split(".");
-        keyStoreHasKey = await __privateGet$3(this, _keyStore).call(this, header, {
-          payload: rawPayload,
-          signature: rawSignature
-        });
+  async addKey(options) {
+    await this.client(TABLE).insert({
+      id: options.key.kid,
+      key: JSON.stringify(options.key),
+      expires_at: options.expiresAt.toISOString()
+    });
+  }
+  async listKeys() {
+    const rows = await this.client(TABLE).select();
+    const keys = rows.map((row) => ({
+      id: row.id,
+      key: JSON.parse(row.key),
+      expiresAt: new Date(row.expires_at)
+    }));
+    const validKeys = [];
+    const expiredKeys = [];
+    for (const key of keys) {
+      if (luxon.DateTime.fromJSDate(key.expiresAt) < luxon.DateTime.local()) {
+        expiredKeys.push(key);
+      } else {
+        validKeys.push(key);
       }
-    } catch (error) {
-      keyStoreHasKey = false;
     }
-    const issuedAfterLastRefresh = (payload == null ? void 0 : payload.iat) && payload.iat > __privateGet$3(this, _keyStoreUpdated) - CLOCK_MARGIN_S;
-    if (!__privateGet$3(this, _keyStore) || !keyStoreHasKey && issuedAfterLastRefresh) {
-      const endpoint = await this.getEndpoint();
-      __privateSet$3(this, _keyStore, jose.createRemoteJWKSet(endpoint));
-      __privateSet$3(this, _keyStoreUpdated, Date.now() / 1e3);
+    if (expiredKeys.length > 0) {
+      const kids = expiredKeys.map(({ key }) => key.kid);
+      this.logger.info(
+        `Removing expired plugin service keys, '${kids.join("', '")}'`
+      );
+      this.client(TABLE).delete().whereIn("id", kids).catch((error) => {
+        this.logger.error(
+          "Failed to remove expired plugin service keys",
+          error
+        );
+      });
     }
+    return { keys: validKeys };
   }
 }
-_keyStore = new WeakMap();
-_keyStoreUpdated = new WeakMap();
 
-var __accessCheck$3 = (obj, member, msg) => {
+function createCredentialsWithServicePrincipal(sub, token) {
+  return {
+    $$type: "@backstage/BackstageCredentials",
+    version: "v1",
+    token,
+    principal: {
+      type: "service",
+      subject: sub
+    }
+  };
+}
+function createCredentialsWithUserPrincipal(sub, token, expiresAt) {
+  return {
+    $$type: "@backstage/BackstageCredentials",
+    version: "v1",
+    token,
+    expiresAt,
+    principal: {
+      type: "user",
+      userEntityRef: sub
+    }
+  };
+}
+function createCredentialsWithNonePrincipal() {
+  return {
+    $$type: "@backstage/BackstageCredentials",
+    version: "v1",
+    principal: {
+      type: "none"
+    }
+  };
+}
+function toInternalBackstageCredentials(credentials) {
+  if (credentials.$$type !== "@backstage/BackstageCredentials") {
+    throw new Error("Invalid credential type");
+  }
+  const internalCredentials = credentials;
+  if (internalCredentials.version !== "v1") {
+    throw new Error(
+      `Invalid credential version ${internalCredentials.version}`
+    );
+  }
+  return internalCredentials;
+}
+
+var __accessCheck$6 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$2 = (obj, member, getter) => {
-  __accessCheck$3(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
-};
-var __privateAdd$3 = (obj, member, value) => {
+var __privateAdd$6 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$2 = (obj, member, value, setter) => {
-  __accessCheck$3(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
-  return value;
-};
-var __privateMethod$3 = (obj, member, method) => {
-  __accessCheck$3(obj, member, "access private method");
+var __privateMethod$4 = (obj, member, method) => {
+  __accessCheck$6(obj, member, "access private method");
   return method;
 };
-var _jwksClient, _algorithms, _getTokenVerificationOptions, getTokenVerificationOptions_fn;
-class UserTokenHandler {
-  constructor(options) {
-    __privateAdd$3(this, _getTokenVerificationOptions);
-    __privateAdd$3(this, _jwksClient, void 0);
-    __privateAdd$3(this, _algorithms, void 0);
-    __privateSet$2(this, _algorithms, ["ES256"]);
-    __privateSet$2(this, _jwksClient, new JwksClient(async () => {
-      const url = await options.discovery.getBaseUrl("auth");
-      return new URL(`${url}/.well-known/jwks.json`);
-    }));
+var _getJwtExpiration, getJwtExpiration_fn;
+class DefaultAuthService {
+  constructor(userTokenHandler, pluginTokenHandler, externalTokenHandler, tokenManager, pluginId, disableDefaultAuthPolicy, publicKeyStore) {
+    this.userTokenHandler = userTokenHandler;
+    this.pluginTokenHandler = pluginTokenHandler;
+    this.externalTokenHandler = externalTokenHandler;
+    this.tokenManager = tokenManager;
+    this.pluginId = pluginId;
+    this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;
+    this.publicKeyStore = publicKeyStore;
+    __privateAdd$6(this, _getJwtExpiration);
   }
-  async verifyToken(token) {
-    const verifyOpts = __privateMethod$3(this, _getTokenVerificationOptions, getTokenVerificationOptions_fn).call(this, token);
-    if (!verifyOpts) {
-      return void 0;
+  // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
+  async authenticate(token) {
+    const pluginResult = await this.pluginTokenHandler.verifyToken(token);
+    if (pluginResult) {
+      if (pluginResult.limitedUserToken) {
+        const userResult2 = await this.userTokenHandler.verifyToken(
+          pluginResult.limitedUserToken
+        );
+        if (!userResult2) {
+          throw new errors.AuthenticationError(
+            "Invalid user token in plugin token obo claim"
+          );
+        }
+        return createCredentialsWithUserPrincipal(
+          userResult2.userEntityRef,
+          pluginResult.limitedUserToken,
+          __privateMethod$4(this, _getJwtExpiration, getJwtExpiration_fn).call(this, pluginResult.limitedUserToken)
+        );
+      }
+      return createCredentialsWithServicePrincipal(pluginResult.subject);
     }
-    await __privateGet$2(this, _jwksClient).refreshKeyStore(token);
-    const { payload } = await jose.jwtVerify(
-      token,
-      __privateGet$2(this, _jwksClient).getKey,
-      verifyOpts
-    ).catch((e) => {
-      throw new errors.AuthenticationError("Invalid token", e);
-    });
-    const userEntityRef = payload.sub;
-    if (!userEntityRef) {
-      throw new errors.AuthenticationError("No user sub found in token");
+    const userResult = await this.userTokenHandler.verifyToken(token);
+    if (userResult) {
+      return createCredentialsWithUserPrincipal(
+        userResult.userEntityRef,
+        token,
+        __privateMethod$4(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
+      );
     }
-    return { userEntityRef };
+    const externalResult = await this.externalTokenHandler.verifyToken(token);
+    if (externalResult) {
+      return createCredentialsWithServicePrincipal(externalResult.subject);
+    }
+    throw new errors.AuthenticationError("Illegal token");
   }
-  createLimitedUserToken(backstageToken) {
-    const [headerRaw, payloadRaw] = backstageToken.split(".");
-    const header = JSON.parse(
-      new TextDecoder().decode(jose.base64url.decode(headerRaw))
-    );
-    const payload = JSON.parse(
-      new TextDecoder().decode(jose.base64url.decode(payloadRaw))
-    );
-    const tokenType = header.typ;
-    if (!tokenType || tokenType === pluginAuthNode.tokenTypes.limitedUser.typParam) {
-      return { token: backstageToken, expiresAt: new Date(payload.exp * 1e3) };
+  isPrincipal(credentials, type) {
+    const principal = credentials.principal;
+    if (type === "unknown") {
+      return true;
     }
-    if (tokenType !== pluginAuthNode.tokenTypes.user.typParam) {
+    if (principal.type !== type) {
+      return false;
+    }
+    return true;
+  }
+  async getNoneCredentials() {
+    return createCredentialsWithNonePrincipal();
+  }
+  async getOwnServiceCredentials() {
+    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);
+  }
+  async getPluginRequestToken(options) {
+    const { targetPluginId } = options;
+    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);
+    const { type } = internalForward.principal;
+    if (type === "none" && this.disableDefaultAuthPolicy) {
+      return { token: "" };
+    }
+    const targetSupportsNewAuth = await this.pluginTokenHandler.isTargetPluginSupported(targetPluginId);
+    switch (type) {
+      case "service":
+        if (targetSupportsNewAuth) {
+          return this.pluginTokenHandler.issueToken({
+            pluginId: this.pluginId,
+            targetPluginId
+          });
+        }
+        return this.tokenManager.getToken().catch((error) => {
+          throw new errors.ForwardedError(
+            `Unable to generate legacy token for communication with the '${targetPluginId}' plugin. You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage`,
+            error
+          );
+        });
+      case "user": {
+        const { token } = internalForward;
+        if (!token) {
+          throw new Error("User credentials is unexpectedly missing token");
+        }
+        if (targetSupportsNewAuth) {
+          const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(
+            token
+          );
+          return this.pluginTokenHandler.issueToken({
+            pluginId: this.pluginId,
+            targetPluginId,
+            onBehalfOf
+          });
+        }
+        if (this.userTokenHandler.isLimitedUserToken(token)) {
+          throw new errors.AuthenticationError(
+            `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens or the plugin doesn't exist`
+          );
+        }
+        return { token };
+      }
+      default:
+        throw new errors.AuthenticationError(
+          `Refused to issue service token for credential type '${type}'`
+        );
+    }
+  }
+  async getLimitedUserToken(credentials) {
+    const { token: backstageToken } = toInternalBackstageCredentials(credentials);
+    if (!backstageToken) {
       throw new errors.AuthenticationError(
-        "Failed to create limited user token, invalid token type"
+        "User credentials is unexpectedly missing token"
       );
     }
-    const limitedUserToken = [
-      jose.base64url.encode(
-        JSON.stringify({
-          typ: pluginAuthNode.tokenTypes.limitedUser.typParam,
-          alg: header.alg,
-          kid: header.kid
-        })
-      ),
-      jose.base64url.encode(
-        JSON.stringify({
-          sub: payload.sub,
-          ent: payload.ent,
-          iat: payload.iat,
-          exp: payload.exp
-        })
-      ),
-      payload.uip
-    ].join(".");
-    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1e3) };
+    return this.userTokenHandler.createLimitedUserToken(backstageToken);
   }
-  isLimitedUserToken(token) {
-    try {
-      const { typ } = jose.decodeProtectedHeader(token);
-      return typ === pluginAuthNode.tokenTypes.limitedUser.typParam;
-    } catch {
-      return false;
-    }
+  async listPublicServiceKeys() {
+    const { keys } = await this.publicKeyStore.listKeys();
+    return { keys: keys.map(({ key }) => key) };
   }
 }
-_jwksClient = new WeakMap();
-_algorithms = new WeakMap();
-_getTokenVerificationOptions = new WeakSet();
-getTokenVerificationOptions_fn = function(token) {
-  try {
-    const { typ } = jose.decodeProtectedHeader(token);
-    if (typ === pluginAuthNode.tokenTypes.user.typParam) {
-      return {
-        algorithms: __privateGet$2(this, _algorithms),
-        requiredClaims: ["iat", "exp", "sub"],
-        typ: pluginAuthNode.tokenTypes.user.typParam
-      };
+_getJwtExpiration = new WeakSet();
+getJwtExpiration_fn = function(token) {
+  const { exp } = jose.decodeJwt(token);
+  if (!exp) {
+    throw new errors.AuthenticationError("User token is missing expiration");
+  }
+  return new Date(exp * 1e3);
+};
+
+var __accessCheck$5 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet$4 = (obj, member, getter) => {
+  __accessCheck$5(obj, member, "read from private field");
+  return member.get(obj);
+};
+var __privateAdd$5 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateSet$2 = (obj, member, value, setter) => {
+  __accessCheck$5(obj, member, "write to private field");
+  member.set(obj, value);
+  return value;
+};
+var _keyStore, _keyStoreUpdated;
+const CLOCK_MARGIN_S = 10;
+class JwksClient {
+  constructor(getEndpoint) {
+    this.getEndpoint = getEndpoint;
+    __privateAdd$5(this, _keyStore, void 0);
+    __privateAdd$5(this, _keyStoreUpdated, 0);
+  }
+  get getKey() {
+    if (!__privateGet$4(this, _keyStore)) {
+      throw new errors.AuthenticationError(
+        "refreshKeyStore must be called before jwksClient.getKey"
+      );
     }
-    if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
-      return {
-        algorithms: __privateGet$2(this, _algorithms),
-        requiredClaims: ["iat", "exp", "sub"],
-        typ: pluginAuthNode.tokenTypes.limitedUser.typParam
-      };
+    return __privateGet$4(this, _keyStore);
+  }
+  /**
+   * If the last keystore refresh is stale, update the keystore URL to the latest
+   */
+  async refreshKeyStore(rawJwtToken) {
+    const payload = await jose.decodeJwt(rawJwtToken);
+    const header = await jose.decodeProtectedHeader(rawJwtToken);
+    let keyStoreHasKey;
+    try {
+      if (__privateGet$4(this, _keyStore)) {
+        const [_, rawPayload, rawSignature] = rawJwtToken.split(".");
+        keyStoreHasKey = await __privateGet$4(this, _keyStore).call(this, header, {
+          payload: rawPayload,
+          signature: rawSignature
+        });
+      }
+    } catch (error) {
+      keyStoreHasKey = false;
     }
-    const { aud } = jose.decodeJwt(token);
-    if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
-      return {
-        algorithms: __privateGet$2(this, _algorithms),
-        audience: pluginAuthNode.tokenTypes.user.audClaim
-      };
+    const issuedAfterLastRefresh = (payload == null ? void 0 : payload.iat) && payload.iat > __privateGet$4(this, _keyStoreUpdated) - CLOCK_MARGIN_S;
+    if (!__privateGet$4(this, _keyStore) || !keyStoreHasKey && issuedAfterLastRefresh) {
+      const endpoint = await this.getEndpoint();
+      __privateSet$2(this, _keyStore, jose.createRemoteJWKSet(endpoint));
+      __privateSet$2(this, _keyStoreUpdated, Date.now() / 1e3);
     }
-  } catch {
   }
-  return void 0;
-};
+}
+_keyStore = new WeakMap();
+_keyStoreUpdated = new WeakMap();
 
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
@@ -2164,7 +2297,7 @@ class PluginTokenHandler {
       options.logger,
       options.ownPluginId,
       options.publicKeyStore,
-      options.keyDurationSeconds,
+      Math.round(types.durationToMilliseconds(options.keyDuration) / 1e3),
       (_a = options.algorithm) != null ? _a : "ES256",
       options.discovery
     );
@@ -2319,258 +2452,298 @@ class PluginTokenHandler {
   }
 }
 
-const MIGRATIONS_TABLE = "backstage_backend_public_keys__knex_migrations";
-const TABLE = "backstage_backend_public_keys__keys";
-function applyDatabaseMigrations(knex) {
-  const migrationsDir = backendCommon.resolvePackagePath(
-    "@backstage/backend-app-api",
-    "migrations"
-  );
-  return knex.migrate.latest({
-    directory: migrationsDir,
-    tableName: MIGRATIONS_TABLE
-  });
-}
-class DatabaseKeyStore {
-  constructor(client, logger) {
-    this.client = client;
-    this.logger = logger;
+var __accessCheck$4 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateAdd$4 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateMethod$3 = (obj, member, method) => {
+  __accessCheck$4(obj, member, "access private method");
+  return method;
+};
+var _getTokenVerificationOptions, getTokenVerificationOptions_fn;
+const _UserTokenHandler = class _UserTokenHandler {
+  constructor(algorithms, jwksClient) {
+    this.algorithms = algorithms;
+    this.jwksClient = jwksClient;
+    __privateAdd$4(this, _getTokenVerificationOptions);
+  }
+  static create(options) {
+    const algorithms = ["ES256"];
+    const jwksClient = new JwksClient(async () => {
+      const url = await options.discovery.getBaseUrl("auth");
+      return new URL(`${url}/.well-known/jwks.json`);
+    });
+    return new _UserTokenHandler(algorithms, jwksClient);
+  }
+  async verifyToken(token) {
+    const verifyOpts = __privateMethod$3(this, _getTokenVerificationOptions, getTokenVerificationOptions_fn).call(this, token);
+    if (!verifyOpts) {
+      return void 0;
+    }
+    await this.jwksClient.refreshKeyStore(token);
+    const { payload } = await jose.jwtVerify(
+      token,
+      this.jwksClient.getKey,
+      verifyOpts
+    ).catch((e) => {
+      throw new errors.AuthenticationError("Invalid token", e);
+    });
+    const userEntityRef = payload.sub;
+    if (!userEntityRef) {
+      throw new errors.AuthenticationError("No user sub found in token");
+    }
+    return { userEntityRef };
+  }
+  createLimitedUserToken(backstageToken) {
+    const [headerRaw, payloadRaw] = backstageToken.split(".");
+    const header = JSON.parse(
+      new TextDecoder().decode(jose.base64url.decode(headerRaw))
+    );
+    const payload = JSON.parse(
+      new TextDecoder().decode(jose.base64url.decode(payloadRaw))
+    );
+    const tokenType = header.typ;
+    if (!tokenType || tokenType === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+      return { token: backstageToken, expiresAt: new Date(payload.exp * 1e3) };
+    }
+    if (tokenType !== pluginAuthNode.tokenTypes.user.typParam) {
+      throw new errors.AuthenticationError(
+        "Failed to create limited user token, invalid token type"
+      );
+    }
+    const limitedUserToken = [
+      jose.base64url.encode(
+        JSON.stringify({
+          typ: pluginAuthNode.tokenTypes.limitedUser.typParam,
+          alg: header.alg,
+          kid: header.kid
+        })
+      ),
+      jose.base64url.encode(
+        JSON.stringify({
+          sub: payload.sub,
+          ent: payload.ent,
+          iat: payload.iat,
+          exp: payload.exp
+        })
+      ),
+      payload.uip
+    ].join(".");
+    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1e3) };
+  }
+  isLimitedUserToken(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      return typ === pluginAuthNode.tokenTypes.limitedUser.typParam;
+    } catch {
+      return false;
+    }
+  }
+};
+_getTokenVerificationOptions = new WeakSet();
+getTokenVerificationOptions_fn = function(token) {
+  try {
+    const { typ } = jose.decodeProtectedHeader(token);
+    if (typ === pluginAuthNode.tokenTypes.user.typParam) {
+      return {
+        algorithms: this.algorithms,
+        requiredClaims: ["iat", "exp", "sub"],
+        typ: pluginAuthNode.tokenTypes.user.typParam
+      };
+    }
+    if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+      return {
+        algorithms: this.algorithms,
+        requiredClaims: ["iat", "exp", "sub"],
+        typ: pluginAuthNode.tokenTypes.limitedUser.typParam
+      };
+    }
+    const { aud } = jose.decodeJwt(token);
+    if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
+      return {
+        algorithms: this.algorithms,
+        audience: pluginAuthNode.tokenTypes.user.audClaim
+      };
+    }
+  } catch {
+  }
+  return void 0;
+};
+let UserTokenHandler = _UserTokenHandler;
+
+var __accessCheck$3 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet$3 = (obj, member, getter) => {
+  __accessCheck$3(obj, member, "read from private field");
+  return member.get(obj);
+};
+var __privateAdd$3 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateMethod$2 = (obj, member, method) => {
+  __accessCheck$3(obj, member, "access private method");
+  return method;
+};
+var _entries$1, _doAdd, doAdd_fn;
+class LegacyTokenHandler {
+  constructor() {
+    __privateAdd$3(this, _doAdd);
+    __privateAdd$3(this, _entries$1, []);
   }
-  static async create(options) {
-    var _a;
-    const { database, logger } = options;
-    const client = await database.getClient();
-    if (!((_a = database.migrations) == null ? void 0 : _a.skip)) {
-      await applyDatabaseMigrations(client);
-    }
-    return new DatabaseKeyStore(client, logger);
+  add(options) {
+    __privateMethod$2(this, _doAdd, doAdd_fn).call(this, options.getString("secret"), options.getString("subject"));
   }
-  async addKey(options) {
-    await this.client(TABLE).insert({
-      id: options.key.kid,
-      key: JSON.stringify(options.key),
-      expires_at: options.expiresAt.toISOString()
-    });
+  // used only for the old backend.auth.keys array
+  addOld(options) {
+    __privateMethod$2(this, _doAdd, doAdd_fn).call(this, options.getString("secret"), "external:backstage-plugin");
   }
-  async listKeys() {
-    const rows = await this.client(TABLE).select();
-    const keys = rows.map((row) => ({
-      id: row.id,
-      key: JSON.parse(row.key),
-      expiresAt: new Date(row.expires_at)
-    }));
-    const validKeys = [];
-    const expiredKeys = [];
-    for (const key of keys) {
-      if (luxon.DateTime.fromJSDate(key.expiresAt) < luxon.DateTime.local()) {
-        expiredKeys.push(key);
-      } else {
-        validKeys.push(key);
+  async verifyToken(token) {
+    try {
+      const { alg } = jose.decodeProtectedHeader(token);
+      if (alg !== "HS256") {
+        return void 0;
+      }
+      const { sub, aud } = jose.decodeJwt(token);
+      if (sub !== "backstage-server" || aud) {
+        return void 0;
       }
+    } catch (e) {
+      return void 0;
     }
-    if (expiredKeys.length > 0) {
-      const kids = expiredKeys.map(({ key }) => key.kid);
-      this.logger.info(
-        `Removing expired plugin service keys, '${kids.join("', '")}'`
-      );
-      this.client(TABLE).delete().whereIn("id", kids).catch((error) => {
-        this.logger.error(
-          "Failed to remove expired plugin service keys",
-          error
-        );
-      });
+    for (const entry of __privateGet$3(this, _entries$1)) {
+      try {
+        await jose.jwtVerify(token, entry.key);
+        return { subject: entry.subject };
+      } catch (e) {
+        if (e.code !== "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
+          throw e;
+        }
+      }
     }
-    return { keys: validKeys };
+    return void 0;
   }
 }
+_entries$1 = new WeakMap();
+_doAdd = new WeakSet();
+doAdd_fn = function(secret, subject) {
+  if (!secret.match(/^\S+$/)) {
+    throw new Error("Illegal secret, must be a valid base64 string");
+  }
+  let key;
+  try {
+    key = jose.base64url.decode(secret);
+  } catch {
+    throw new Error("Illegal secret, must be a valid base64 string");
+  }
+  if (!subject.match(/^\S+$/)) {
+    throw new Error("Illegal subject, must be a set of non-space characters");
+  }
+  __privateGet$3(this, _entries$1).push({ key, subject });
+};
 
 var __accessCheck$2 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
+var __privateGet$2 = (obj, member, getter) => {
+  __accessCheck$2(obj, member, "read from private field");
+  return member.get(obj);
+};
 var __privateAdd$2 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateMethod$2 = (obj, member, method) => {
-  __accessCheck$2(obj, member, "access private method");
-  return method;
-};
-var _getJwtExpiration, getJwtExpiration_fn;
-function createCredentialsWithServicePrincipal(sub, token) {
-  return {
-    $$type: "@backstage/BackstageCredentials",
-    version: "v1",
-    token,
-    principal: {
-      type: "service",
-      subject: sub
+var _entries;
+const MIN_TOKEN_LENGTH = 8;
+class StaticTokenHandler {
+  constructor() {
+    __privateAdd$2(this, _entries, []);
+  }
+  add(options) {
+    const token = options.getString("token");
+    if (!token.match(/^\S+$/)) {
+      throw new Error("Illegal token, must be a set of non-space characters");
     }
-  };
-}
-function createCredentialsWithUserPrincipal(sub, token, expiresAt) {
-  return {
-    $$type: "@backstage/BackstageCredentials",
-    version: "v1",
-    token,
-    expiresAt,
-    principal: {
-      type: "user",
-      userEntityRef: sub
+    if (token.length < MIN_TOKEN_LENGTH) {
+      throw new Error(
+        `Illegal token, must be at least ${MIN_TOKEN_LENGTH} characters length`
+      );
     }
-  };
-}
-function createCredentialsWithNonePrincipal() {
-  return {
-    $$type: "@backstage/BackstageCredentials",
-    version: "v1",
-    principal: {
-      type: "none"
+    const subject = options.getString("subject");
+    if (!subject.match(/^\S+$/)) {
+      throw new Error("Illegal subject, must be a set of non-space characters");
     }
-  };
-}
-function toInternalBackstageCredentials(credentials) {
-  if (credentials.$$type !== "@backstage/BackstageCredentials") {
-    throw new Error("Invalid credential type");
+    __privateGet$2(this, _entries).push({ token, subject });
   }
-  const internalCredentials = credentials;
-  if (internalCredentials.version !== "v1") {
-    throw new Error(
-      `Invalid credential version ${internalCredentials.version}`
-    );
+  async verifyToken(token) {
+    const entry = __privateGet$2(this, _entries).find((e) => e.token === token);
+    if (!entry) {
+      return void 0;
+    }
+    return { subject: entry.subject };
   }
-  return internalCredentials;
 }
-class DefaultAuthService {
-  constructor(tokenManager, userTokenHandler, pluginId, disableDefaultAuthPolicy, publicKeyStore, pluginTokenHandler) {
-    this.tokenManager = tokenManager;
-    this.userTokenHandler = userTokenHandler;
-    this.pluginId = pluginId;
-    this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;
-    this.publicKeyStore = publicKeyStore;
-    this.pluginTokenHandler = pluginTokenHandler;
-    __privateAdd$2(this, _getJwtExpiration);
+_entries = new WeakMap();
+
+const NEW_CONFIG_KEY = "backend.auth.externalAccess";
+const OLD_CONFIG_KEY = "backend.auth.keys";
+class ExternalTokenHandler {
+  constructor(handlers) {
+    this.handlers = handlers;
   }
-  // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
-  async authenticate(token) {
-    const pluginResult = await this.pluginTokenHandler.verifyToken(token);
-    if (pluginResult) {
-      if (pluginResult.limitedUserToken) {
-        const userResult2 = await this.userTokenHandler.verifyToken(
-          pluginResult.limitedUserToken
-        );
-        if (!userResult2) {
-          throw new errors.AuthenticationError(
-            "Invalid user token in plugin token obo claim"
-          );
-        }
-        return createCredentialsWithUserPrincipal(
-          userResult2.userEntityRef,
-          pluginResult.limitedUserToken,
-          __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, pluginResult.limitedUserToken)
+  static create(options) {
+    var _a, _b;
+    const { config, logger } = options;
+    const staticHandler = new StaticTokenHandler();
+    const legacyHandler = new LegacyTokenHandler();
+    const handlers = {
+      static: staticHandler,
+      legacy: legacyHandler
+    };
+    const handlerConfigs = (_a = config.getOptionalConfigArray(NEW_CONFIG_KEY)) != null ? _a : [];
+    for (const handlerConfig of handlerConfigs) {
+      const type = handlerConfig.getString("type");
+      const handler = handlers[type];
+      if (!handler) {
+        const valid = Object.keys(handlers).map((k) => `'${k}'`).join(", ");
+        throw new Error(
+          `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`
         );
       }
-      return createCredentialsWithServicePrincipal(pluginResult.subject);
+      handler.add(handlerConfig.getConfig("options"));
     }
-    const userResult = await this.userTokenHandler.verifyToken(token);
-    if (userResult) {
-      return createCredentialsWithUserPrincipal(
-        userResult.userEntityRef,
-        token,
-        __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
+    const legacyConfigs = (_b = config.getOptionalConfigArray(OLD_CONFIG_KEY)) != null ? _b : [];
+    if (legacyConfigs.length) {
+      logger.warn(
+        `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`
       );
     }
-    const { sub, aud } = jose.decodeJwt(token);
-    if (sub === "backstage-server" && !aud) {
-      await this.tokenManager.authenticate(token);
-      return createCredentialsWithServicePrincipal("external:backstage-plugin");
+    for (const handlerConfig of legacyConfigs) {
+      legacyHandler.addOld(handlerConfig);
     }
-    throw new errors.AuthenticationError("Unknown token");
-  }
-  isPrincipal(credentials, type) {
-    const principal = credentials.principal;
-    if (type === "unknown") {
-      return true;
-    }
-    if (principal.type !== type) {
-      return false;
-    }
-    return true;
-  }
-  async getNoneCredentials() {
-    return createCredentialsWithNonePrincipal();
-  }
-  async getOwnServiceCredentials() {
-    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);
+    return new ExternalTokenHandler(Object.values(handlers));
   }
-  async getPluginRequestToken(options) {
-    const { targetPluginId } = options;
-    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);
-    const { type } = internalForward.principal;
-    if (type === "none" && this.disableDefaultAuthPolicy) {
-      return { token: "" };
-    }
-    const targetSupportsNewAuth = await this.pluginTokenHandler.isTargetPluginSupported(targetPluginId);
-    switch (type) {
-      case "service":
-        if (targetSupportsNewAuth) {
-          return this.pluginTokenHandler.issueToken({
-            pluginId: this.pluginId,
-            targetPluginId
-          });
-        }
-        return this.tokenManager.getToken();
-      case "user": {
-        const { token } = internalForward;
-        if (!token) {
-          throw new Error("User credentials is unexpectedly missing token");
-        }
-        if (targetSupportsNewAuth) {
-          const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(
-            token
-          );
-          return this.pluginTokenHandler.issueToken({
-            pluginId: this.pluginId,
-            targetPluginId,
-            onBehalfOf
-          });
-        }
-        if (this.userTokenHandler.isLimitedUserToken(token)) {
-          throw new errors.AuthenticationError(
-            `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens`
-          );
-        }
-        return { token };
+  async verifyToken(token) {
+    for (const handler of this.handlers) {
+      const result = await handler.verifyToken(token);
+      if (result) {
+        return result;
       }
-      default:
-        throw new errors.AuthenticationError(
-          `Refused to issue service token for credential type '${type}'`
-        );
-    }
-  }
-  async getLimitedUserToken(credentials) {
-    const { token: backstageToken } = toInternalBackstageCredentials(credentials);
-    if (!backstageToken) {
-      throw new errors.AuthenticationError(
-        "User credentials is unexpectedly missing token"
-      );
     }
-    return this.userTokenHandler.createLimitedUserToken(backstageToken);
-  }
-  async listPublicServiceKeys() {
-    const { keys } = await this.publicKeyStore.listKeys();
-    return { keys: keys.map(({ key }) => key) };
+    return void 0;
   }
 }
-_getJwtExpiration = new WeakSet();
-getJwtExpiration_fn = function(token) {
-  const { exp } = jose.decodeJwt(token);
-  if (!exp) {
-    throw new errors.AuthenticationError("User token is missing expiration");
-  }
-  return new Date(exp * 1e3);
-};
+
 const authServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.auth,
   deps: {
@@ -2585,26 +2758,43 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
     // new auth services in the new backend system.
     tokenManager: backendPluginApi.coreServices.tokenManager
   },
-  async factory({ config, discovery, plugin, tokenManager, logger, database }) {
+  async createRootContext({ config, logger }) {
+    const externalTokens = ExternalTokenHandler.create({
+      config,
+      logger
+    });
+    return {
+      externalTokens
+    };
+  },
+  async factory({ config, discovery, plugin, tokenManager, logger, database }, { externalTokens }) {
     const disableDefaultAuthPolicy = Boolean(
       config.getOptionalBoolean(
         "backend.auth.dangerouslyDisableDefaultAuthPolicy"
       )
     );
-    const publicKeyStore = await DatabaseKeyStore.create({ database, logger });
+    const publicKeyStore = await DatabaseKeyStore.create({
+      database,
+      logger
+    });
+    const userTokens = UserTokenHandler.create({
+      discovery
+    });
+    const pluginTokens = PluginTokenHandler.create({
+      ownPluginId: plugin.getId(),
+      keyDuration: { hours: 1 },
+      logger,
+      publicKeyStore,
+      discovery
+    });
     return new DefaultAuthService(
+      userTokens,
+      pluginTokens,
+      externalTokens,
       tokenManager,
-      new UserTokenHandler({ discovery }),
       plugin.getId(),
       disableDefaultAuthPolicy,
-      publicKeyStore,
-      PluginTokenHandler.create({
-        ownPluginId: plugin.getId(),
-        keyDurationSeconds: 60 * 60,
-        logger,
-        publicKeyStore,
-        discovery
-      })
+      publicKeyStore
     );
   }
 });
@@ -2760,7 +2950,7 @@ var __accessCheck$1 = (obj, member, msg) => {
 };
 var __privateGet$1 = (obj, member, getter) => {
   __accessCheck$1(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$1 = (obj, member, value) => {
   if (member.has(obj))
@@ -2769,7 +2959,7 @@ var __privateAdd$1 = (obj, member, value) => {
 };
 var __privateSet$1 = (obj, member, value, setter) => {
   __accessCheck$1(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod$1 = (obj, member, method) => {
@@ -2928,13 +3118,11 @@ getLimitedCredentials_fn = async function(req) {
   return (_a = req[limitedCredentialsSymbol]) != null ? _a : req[limitedCredentialsSymbol] = __privateMethod$1(this, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn).call(this, req);
 };
 _getCookieOptions = new WeakSet();
-getCookieOptions_fn = async function(req) {
-  const originHeader = req.headers.origin;
-  const origin = !originHeader || originHeader === "null" ? void 0 : originHeader;
+getCookieOptions_fn = async function(_req) {
   const externalBaseUrlStr = await __privateGet$1(this, _discovery).getExternalBaseUrl(
     __privateGet$1(this, _pluginId)
   );
-  const externalBaseUrl = new URL(origin != null ? origin : externalBaseUrlStr);
+  const externalBaseUrl = new URL(externalBaseUrlStr);
   const secure = externalBaseUrl.protocol === "https:" || externalBaseUrl.hostname === "localhost";
   return {
     domain: externalBaseUrl.hostname,
@@ -3141,8 +3329,8 @@ const httpRouterServiceFactory = backendPluginApi.createServiceFactory(
         httpAuth,
         config
       });
-      router.use(createLifecycleMiddleware({ lifecycle }));
       router.use(createAuthIntegrationRouter({ auth }));
+      router.use(createLifecycleMiddleware({ lifecycle }));
       router.use(credentialsBarrier.middleware);
       router.use(createCookieAuthRefreshMiddleware({ auth, httpAuth }));
       return {
@@ -3203,7 +3391,7 @@ var __accessCheck = (obj, member, msg) => {
 };
 var __privateGet = (obj, member, getter) => {
   __accessCheck(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd = (obj, member, value) => {
   if (member.has(obj))
@@ -3212,7 +3400,7 @@ var __privateAdd = (obj, member, value) => {
 };
 var __privateSet = (obj, member, value, setter) => {
   __accessCheck(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod = (obj, member, method) => {
@@ -3294,15 +3482,8 @@ findConflictingPath_fn = function(newPath) {
 };
 let DefaultRootHttpRouter = _DefaultRootHttpRouter;
 
-function defaultConfigure(context) {
-  const { app, routes, middleware } = context;
-  app.use(middleware.helmet());
-  app.use(middleware.cors());
-  app.use(middleware.compression());
-  app.use(middleware.logging());
-  app.use(routes);
-  app.use(middleware.notFound());
-  app.use(middleware.error());
+function defaultConfigure({ applyDefaults }) {
+  applyDefaults();
 }
 const rootHttpRouterServiceFactory = backendPluginApi.createServiceFactory(
   (options) => ({
@@ -3318,19 +3499,30 @@ const rootHttpRouterServiceFactory = backendPluginApi.createServiceFactory(
       const app = express__default.default();
       const router = DefaultRootHttpRouter.create({ indexPath });
       const middleware = MiddlewareFactory.create({ config, logger });
+      const routes = router.handler();
+      const server = await createHttpServer(
+        app,
+        readHttpServerOptions(config.getOptionalConfig("backend")),
+        { logger }
+      );
       configure({
         app,
-        routes: router.handler(),
+        server,
+        routes,
         middleware,
         config,
         logger,
-        lifecycle
+        lifecycle,
+        applyDefaults() {
+          app.use(middleware.helmet());
+          app.use(middleware.cors());
+          app.use(middleware.compression());
+          app.use(middleware.logging());
+          app.use(routes);
+          app.use(middleware.notFound());
+          app.use(middleware.error());
+        }
       });
-      const server = await createHttpServer(
-        app,
-        readHttpServerOptions(config.getOptionalConfig("backend")),
-        { logger }
-      );
       lifecycle.addShutdownHook(() => server.stop());
       await server.start();
       return router;
@@ -3371,7 +3563,7 @@ const schedulerServiceFactory = backendPluginApi.createServiceFactory({
     return backendTasks.TaskScheduler.forPlugin({
       pluginId: plugin.getId(),
       databaseManager,
-      logger: backendCommon.loggerToWinstonLogger(logger)
+      logger
     });
   }
 });
@@ -3384,7 +3576,8 @@ const tokenManagerServiceFactory = backendPluginApi.createServiceFactory({
   },
   createRootContext({ config, logger }) {
     return backendCommon.ServerTokenManager.fromConfig(config, {
-      logger
+      logger,
+      allowDisabledTokenManager: true
     });
   },
   async factory(_deps, tokenManager) {
@@ -3401,7 +3594,7 @@ const urlReaderServiceFactory = backendPluginApi.createServiceFactory({
   async factory({ config, logger }) {
     return backendCommon.UrlReaders.default({
       config,
-      logger: backendCommon.loggerToWinstonLogger(logger)
+      logger
     });
   }
 });