@backstage/backend-app-api 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -1,16 +1,67 @@
 # @backstage/backend-app-api
 
-## 0.7.2
+## 0.7.3
 
 ### Patch Changes
 
-- b6b59c5: Redact `meta` fields too with the logger
+- 4cd5ff0: Add ability to configure the Node.js HTTP Server when configuring the root HTTP Router service
+- e8199b1: Move the JWKS registration outside of the lifecycle middleware
+- d229dc4: Move path utilities from `backend-common` to the `backend-plugin-api` package.
+- dc8c5dd: The default `TokenManager` implementation no longer requires keys to be configured in production, but it will throw an errors when generating or authenticating tokens. The default `AuthService` implementation will now also provide additional context if such an error is throw when falling back to using the `TokenManager` service to generate tokens for outgoing requests.
+- 025641b: Redact `meta` fields too with the logger
+- 09f8988: Remove explicit `alg` check for user tokens in `verifyToken`
+- 5863e02: Internal refactor to only create one external token handler
+- a1dc547: Added support for camel case CSP directives in app-config. For example:
 
-## 0.7.1
+  ```yaml
+  backend:
+    csp:
+      upgradeInsecureRequests: false
+  ```
+
+- 329cc34: Added logging of all plugins being initialized, periodic status, and completion.
+- Updated dependencies
+  - @backstage/backend-common@0.22.0
+  - @backstage/backend-plugin-api@0.6.18
+  - @backstage/backend-tasks@0.5.23
+  - @backstage/plugin-auth-node@0.4.13
+  - @backstage/plugin-permission-node@0.7.29
+
+## 0.7.2-next.1
+
+### Patch Changes
+
+- 09f8988: Remove explicit `alg` check for user tokens in `verifyToken`
+- Updated dependencies
+  - @backstage/backend-common@0.22.0-next.1
+  - @backstage/backend-tasks@0.5.23-next.1
+  - @backstage/plugin-auth-node@0.4.13-next.1
+  - @backstage/plugin-permission-node@0.7.29-next.1
+  - @backstage/cli-node@0.2.5
+  - @backstage/config-loader@1.8.0
+  - @backstage/backend-plugin-api@0.6.18-next.1
+
+## 0.7.1-next.0
 
 ### Patch Changes
 
-- 3554ebe: Move the JWKS registration outside of the lifecycle middleware
+- 4cd5ff0: Add ability to configure the Node.js HTTP Server when configuring the root HTTP Router service
+- e8199b1: Move the JWKS registration outside of the lifecycle middleware
+- dc8c5dd: The default `TokenManager` implementation no longer requires keys to be configured in production, but it will throw an errors when generating or authenticating tokens. The default `AuthService` implementation will now also provide additional context if such an error is throw when falling back to using the `TokenManager` service to generate tokens for outgoing requests.
+- 025641b: Redact `meta` fields too with the logger
+- 5863e02: Internal refactor to only create one external token handler
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.4.13-next.0
+  - @backstage/backend-common@0.21.8-next.0
+  - @backstage/backend-plugin-api@0.6.18-next.0
+  - @backstage/backend-tasks@0.5.23-next.0
+  - @backstage/cli-common@0.1.13
+  - @backstage/cli-node@0.2.5
+  - @backstage/config@1.2.0
+  - @backstage/config-loader@1.8.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+  - @backstage/plugin-permission-node@0.7.29-next.0
 
 ## 0.7.0
 

package/alpha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/backend-app-api",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "main": "../dist/alpha.cjs.js",
   "types": "../dist/alpha.d.ts"
 }

package/dist/index.cjs.js

@@ -15,6 +15,7 @@ var cors = require('cors');
 var helmet = require('helmet');
 var morgan = require('morgan');
 var compression = require('compression');
+var kebabCase = require('lodash/kebabCase');
 var minimatch = require('minimatch');
 var errors = require('@backstage/errors');
 var crypto = require('crypto');
@@ -22,14 +23,14 @@ var winston = require('winston');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var alpha = require('@backstage/backend-plugin-api/alpha');
 var luxon = require('luxon');
-var backendCommon = require('@backstage/backend-common');
 var jose = require('jose');
 var uuid = require('uuid');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
+var types = require('@backstage/types');
+var backendCommon = require('@backstage/backend-common');
 var backendAppApi = require('@backstage/backend-app-api');
 var cookie = require('cookie');
 var Router = require('express-promise-router');
-var types = require('@backstage/types');
 var pathToRegexp = require('path-to-regexp');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
@@ -66,6 +67,7 @@ var cors__default = /*#__PURE__*/_interopDefaultCompat(cors);
 var helmet__default = /*#__PURE__*/_interopDefaultCompat(helmet);
 var morgan__default = /*#__PURE__*/_interopDefaultCompat(morgan);
 var compression__default = /*#__PURE__*/_interopDefaultCompat(compression);
+var kebabCase__default = /*#__PURE__*/_interopDefaultCompat(kebabCase);
 var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
 var express__default = /*#__PURE__*/_interopDefaultCompat(express);
 var trimEnd__default = /*#__PURE__*/_interopDefaultCompat(trimEnd);
@@ -536,10 +538,11 @@ function applyCspDirectives(directives) {
   delete result["form-action"];
   if (directives) {
     for (const [key, value] of Object.entries(directives)) {
+      const kebabCaseKey = kebabCase__default.default(key);
       if (value === false) {
-        delete result[key];
+        delete result[kebabCaseKey];
       } else {
-        result[key] = value;
+        result[kebabCaseKey] = value;
       }
     }
   }
@@ -618,7 +621,7 @@ var __accessCheck$e = (obj, member, msg) => {
 };
 var __privateGet$c = (obj, member, getter) => {
   __accessCheck$e(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$e = (obj, member, value) => {
   if (member.has(obj))
@@ -627,7 +630,7 @@ var __privateAdd$e = (obj, member, value) => {
 };
 var __privateSet$a = (obj, member, value, setter) => {
   __accessCheck$e(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var _config, _logger;
@@ -811,7 +814,7 @@ var __accessCheck$d = (obj, member, msg) => {
 };
 var __privateGet$b = (obj, member, getter) => {
   __accessCheck$d(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$d = (obj, member, value) => {
   if (member.has(obj))
@@ -820,7 +823,7 @@ var __privateAdd$d = (obj, member, value) => {
 };
 var __privateSet$9 = (obj, member, value, setter) => {
   __accessCheck$d(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var _winston, _addRedactions;
@@ -948,7 +951,7 @@ var __accessCheck$c = (obj, member, msg) => {
 };
 var __privateGet$a = (obj, member, getter) => {
   __accessCheck$c(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$c = (obj, member, value) => {
   if (member.has(obj))
@@ -957,7 +960,7 @@ var __privateAdd$c = (obj, member, value) => {
 };
 var __privateSet$8 = (obj, member, value, setter) => {
   __accessCheck$c(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var _hasStarted$1, _startupTasks$1, _hasShutdown, _shutdownTasks;
@@ -1042,7 +1045,7 @@ var __accessCheck$b = (obj, member, msg) => {
 };
 var __privateGet$9 = (obj, member, getter) => {
   __accessCheck$b(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$b = (obj, member, value) => {
   if (member.has(obj))
@@ -1051,7 +1054,7 @@ var __privateAdd$b = (obj, member, value) => {
 };
 var __privateSet$7 = (obj, member, value, setter) => {
   __accessCheck$b(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var _hasStarted, _startupTasks;
@@ -1122,7 +1125,7 @@ var __accessCheck$a = (obj, member, msg) => {
 };
 var __privateGet$8 = (obj, member, getter) => {
   __accessCheck$a(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$a = (obj, member, value) => {
   if (member.has(obj))
@@ -1131,7 +1134,7 @@ var __privateAdd$a = (obj, member, value) => {
 };
 var __privateSet$6 = (obj, member, value, setter) => {
   __accessCheck$a(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod$7 = (obj, member, method) => {
@@ -1331,7 +1334,7 @@ var __accessCheck$9 = (obj, member, msg) => {
 };
 var __privateGet$7 = (obj, member, getter) => {
   __accessCheck$9(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$9 = (obj, member, value) => {
   if (member.has(obj))
@@ -1340,7 +1343,7 @@ var __privateAdd$9 = (obj, member, value) => {
 };
 var __privateSet$5 = (obj, member, value, setter) => {
   __accessCheck$9(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod$6 = (obj, member, method) => {
@@ -1564,13 +1567,59 @@ checkForMissingDeps_fn = function(factory, pluginId) {
 };
 let ServiceRegistry = _ServiceRegistry;
 
+const LOGGER_INTERVAL_MAX = 6e4;
+function joinIds(ids) {
+  return [...ids].map((id) => `'${id}'`).join(", ");
+}
+function createInitializationLogger(pluginIds, rootLogger) {
+  const logger = rootLogger == null ? void 0 : rootLogger.child({ type: "initialization" });
+  const starting = new Set(pluginIds);
+  const started = /* @__PURE__ */ new Set();
+  logger == null ? void 0 : logger.info(`Plugin initialization started: ${joinIds(pluginIds)}`);
+  const getInitStatus = () => {
+    let status = "";
+    if (started.size > 0) {
+      status = `, newly initialized: ${joinIds(started)}`;
+      started.clear();
+    }
+    if (starting.size > 0) {
+      status += `, still initializing: ${joinIds(starting)}`;
+    }
+    return status;
+  };
+  let interval = 1e3;
+  let prevInterval = 0;
+  let timeout;
+  const onTimeout = () => {
+    logger == null ? void 0 : logger.info(`Plugin initialization in progress${getInitStatus()}`);
+    const nextInterval = Math.min(interval + prevInterval, LOGGER_INTERVAL_MAX);
+    prevInterval = interval;
+    interval = nextInterval;
+    timeout = setTimeout(onTimeout, nextInterval);
+  };
+  timeout = setTimeout(onTimeout, interval);
+  return {
+    onPluginStarted(pluginId) {
+      starting.delete(pluginId);
+      started.add(pluginId);
+    },
+    onAllStarted() {
+      logger == null ? void 0 : logger.info(`Plugin initialization complete${getInitStatus()}`);
+      if (timeout) {
+        clearTimeout(timeout);
+        timeout = void 0;
+      }
+    }
+  };
+}
+
 var __accessCheck$8 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
 var __privateGet$6 = (obj, member, getter) => {
   __accessCheck$8(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$8 = (obj, member, value) => {
   if (member.has(obj))
@@ -1579,7 +1628,7 @@ var __privateAdd$8 = (obj, member, value) => {
 };
 var __privateSet$4 = (obj, member, value, setter) => {
   __accessCheck$8(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod$5 = (obj, member, method) => {
@@ -1768,6 +1817,10 @@ doStart_fn = async function() {
     }
   }
   const allPluginIds = [...pluginInits.keys()];
+  const initLogger = createInitializationLogger(
+    allPluginIds,
+    await __privateGet$6(this, _serviceRegistry).get(backendPluginApi.coreServices.rootLogger, "root")
+  );
   await Promise.all(
     allPluginIds.map(async (pluginId) => {
       await __privateGet$6(this, _serviceRegistry).initializeEagerServicesWithScope(
@@ -1814,12 +1867,14 @@ doStart_fn = async function() {
           );
         });
       }
+      initLogger.onPluginStarted(pluginId);
       const lifecycleService2 = await __privateMethod$5(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
       await lifecycleService2.startup();
     })
   );
   const lifecycleService = await __privateMethod$5(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
   await lifecycleService.startup();
+  initLogger.onAllStarted();
   if (process.env.NODE_ENV !== "test") {
     const rootLogger = await __privateGet$6(this, _serviceRegistry).get(
       backendPluginApi.coreServices.rootLogger,
@@ -1870,7 +1925,7 @@ var __accessCheck$7 = (obj, member, msg) => {
 };
 var __privateGet$5 = (obj, member, getter) => {
   __accessCheck$7(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$7 = (obj, member, value) => {
   if (member.has(obj))
@@ -1879,7 +1934,7 @@ var __privateAdd$7 = (obj, member, value) => {
 };
 var __privateSet$3 = (obj, member, value, setter) => {
   __accessCheck$7(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var _initializer;
@@ -1948,7 +2003,7 @@ function createSpecializedBackend(options) {
 const MIGRATIONS_TABLE = "backstage_backend_public_keys__knex_migrations";
 const TABLE = "backstage_backend_public_keys__keys";
 function applyDatabaseMigrations(knex) {
-  const migrationsDir = backendCommon.resolvePackagePath(
+  const migrationsDir = backendPluginApi.resolvePackagePath(
     "@backstage/backend-app-api",
     "migrations"
   );
@@ -2147,7 +2202,12 @@ class DefaultAuthService {
             targetPluginId
           });
         }
-        return this.tokenManager.getToken();
+        return this.tokenManager.getToken().catch((error) => {
+          throw new errors.ForwardedError(
+            `Unable to generate legacy token for communication with the '${targetPluginId}' plugin. You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage`,
+            error
+          );
+        });
       case "user": {
         const { token } = internalForward;
         if (!token) {
@@ -2205,7 +2265,7 @@ var __accessCheck$5 = (obj, member, msg) => {
 };
 var __privateGet$4 = (obj, member, getter) => {
   __accessCheck$5(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$5 = (obj, member, value) => {
   if (member.has(obj))
@@ -2214,7 +2274,7 @@ var __privateAdd$5 = (obj, member, value) => {
 };
 var __privateSet$2 = (obj, member, value, setter) => {
   __accessCheck$5(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var _keyStore, _keyStoreUpdated;
@@ -2292,7 +2352,7 @@ class PluginTokenHandler {
       options.logger,
       options.ownPluginId,
       options.publicKeyStore,
-      options.keyDurationSeconds,
+      Math.round(types.durationToMilliseconds(options.keyDuration) / 1e3),
       (_a = options.algorithm) != null ? _a : "ES256",
       options.discovery
     );
@@ -2462,18 +2522,16 @@ var __privateMethod$3 = (obj, member, method) => {
 };
 var _getTokenVerificationOptions, getTokenVerificationOptions_fn;
 const _UserTokenHandler = class _UserTokenHandler {
-  constructor(algorithms, jwksClient) {
-    this.algorithms = algorithms;
+  constructor(jwksClient) {
     this.jwksClient = jwksClient;
     __privateAdd$4(this, _getTokenVerificationOptions);
   }
   static create(options) {
-    const algorithms = ["ES256"];
     const jwksClient = new JwksClient(async () => {
       const url = await options.discovery.getBaseUrl("auth");
       return new URL(`${url}/.well-known/jwks.json`);
     });
-    return new _UserTokenHandler(algorithms, jwksClient);
+    return new _UserTokenHandler(jwksClient);
   }
   async verifyToken(token) {
     const verifyOpts = __privateMethod$3(this, _getTokenVerificationOptions, getTokenVerificationOptions_fn).call(this, token);
@@ -2546,14 +2604,12 @@ getTokenVerificationOptions_fn = function(token) {
     const { typ } = jose.decodeProtectedHeader(token);
     if (typ === pluginAuthNode.tokenTypes.user.typParam) {
       return {
-        algorithms: this.algorithms,
         requiredClaims: ["iat", "exp", "sub"],
         typ: pluginAuthNode.tokenTypes.user.typParam
       };
     }
     if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
       return {
-        algorithms: this.algorithms,
         requiredClaims: ["iat", "exp", "sub"],
         typ: pluginAuthNode.tokenTypes.limitedUser.typParam
       };
@@ -2561,7 +2617,6 @@ getTokenVerificationOptions_fn = function(token) {
     const { aud } = jose.decodeJwt(token);
     if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
       return {
-        algorithms: this.algorithms,
         audience: pluginAuthNode.tokenTypes.user.audClaim
       };
     }
@@ -2577,7 +2632,7 @@ var __accessCheck$3 = (obj, member, msg) => {
 };
 var __privateGet$3 = (obj, member, getter) => {
   __accessCheck$3(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$3 = (obj, member, value) => {
   if (member.has(obj))
@@ -2651,7 +2706,7 @@ var __accessCheck$2 = (obj, member, msg) => {
 };
 var __privateGet$2 = (obj, member, getter) => {
   __accessCheck$2(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$2 = (obj, member, value) => {
   if (member.has(obj))
@@ -2753,7 +2808,16 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
     // new auth services in the new backend system.
     tokenManager: backendPluginApi.coreServices.tokenManager
   },
-  async factory({ config, discovery, plugin, tokenManager, logger, database }) {
+  async createRootContext({ config, logger }) {
+    const externalTokens = ExternalTokenHandler.create({
+      config,
+      logger
+    });
+    return {
+      externalTokens
+    };
+  },
+  async factory({ config, discovery, plugin, tokenManager, logger, database }, { externalTokens }) {
     const disableDefaultAuthPolicy = Boolean(
       config.getOptionalBoolean(
         "backend.auth.dangerouslyDisableDefaultAuthPolicy"
@@ -2768,15 +2832,11 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
     });
     const pluginTokens = PluginTokenHandler.create({
       ownPluginId: plugin.getId(),
-      keyDurationSeconds: 60 * 60,
+      keyDuration: { hours: 1 },
       logger,
       publicKeyStore,
       discovery
     });
-    const externalTokens = ExternalTokenHandler.create({
-      config,
-      logger
-    });
     return new DefaultAuthService(
       userTokens,
       pluginTokens,
@@ -2940,7 +3000,7 @@ var __accessCheck$1 = (obj, member, msg) => {
 };
 var __privateGet$1 = (obj, member, getter) => {
   __accessCheck$1(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd$1 = (obj, member, value) => {
   if (member.has(obj))
@@ -2949,7 +3009,7 @@ var __privateAdd$1 = (obj, member, value) => {
 };
 var __privateSet$1 = (obj, member, value, setter) => {
   __accessCheck$1(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod$1 = (obj, member, method) => {
@@ -3381,7 +3441,7 @@ var __accessCheck = (obj, member, msg) => {
 };
 var __privateGet = (obj, member, getter) => {
   __accessCheck(obj, member, "read from private field");
-  return getter ? getter.call(obj) : member.get(obj);
+  return member.get(obj);
 };
 var __privateAdd = (obj, member, value) => {
   if (member.has(obj))
@@ -3390,7 +3450,7 @@ var __privateAdd = (obj, member, value) => {
 };
 var __privateSet = (obj, member, value, setter) => {
   __accessCheck(obj, member, "write to private field");
-  setter ? setter.call(obj, value) : member.set(obj, value);
+  member.set(obj, value);
   return value;
 };
 var __privateMethod = (obj, member, method) => {
@@ -3472,15 +3532,8 @@ findConflictingPath_fn = function(newPath) {
 };
 let DefaultRootHttpRouter = _DefaultRootHttpRouter;
 
-function defaultConfigure(context) {
-  const { app, routes, middleware } = context;
-  app.use(middleware.helmet());
-  app.use(middleware.cors());
-  app.use(middleware.compression());
-  app.use(middleware.logging());
-  app.use(routes);
-  app.use(middleware.notFound());
-  app.use(middleware.error());
+function defaultConfigure({ applyDefaults }) {
+  applyDefaults();
 }
 const rootHttpRouterServiceFactory = backendPluginApi.createServiceFactory(
   (options) => ({
@@ -3496,19 +3549,30 @@ const rootHttpRouterServiceFactory = backendPluginApi.createServiceFactory(
       const app = express__default.default();
       const router = DefaultRootHttpRouter.create({ indexPath });
       const middleware = MiddlewareFactory.create({ config, logger });
+      const routes = router.handler();
+      const server = await createHttpServer(
+        app,
+        readHttpServerOptions(config.getOptionalConfig("backend")),
+        { logger }
+      );
       configure({
         app,
-        routes: router.handler(),
+        server,
+        routes,
         middleware,
         config,
         logger,
-        lifecycle
+        lifecycle,
+        applyDefaults() {
+          app.use(middleware.helmet());
+          app.use(middleware.cors());
+          app.use(middleware.compression());
+          app.use(middleware.logging());
+          app.use(routes);
+          app.use(middleware.notFound());
+          app.use(middleware.error());
+        }
       });
-      const server = await createHttpServer(
-        app,
-        readHttpServerOptions(config.getOptionalConfig("backend")),
-        { logger }
-      );
       lifecycle.addShutdownHook(() => server.stop());
       await server.start();
       return router;
@@ -3562,7 +3626,8 @@ const tokenManagerServiceFactory = backendPluginApi.createServiceFactory({
   },
   createRootContext({ config, logger }) {
     return backendCommon.ServerTokenManager.fromConfig(config, {
-      logger
+      logger,
+      allowDisabledTokenManager: true
     });
   },
   async factory(_deps, tokenManager) {