@backstage/backend-defaults 0.12.1-next.1 → 0.12.2

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @backstage/backend-defaults
 
+## 0.12.2
+
+### Patch Changes
+
+- Backport security fixes
+
+## 0.12.1
+
+### Patch Changes
+
+- 33bd4d0: Deduplicate discovered features discovered with discoveryFeatureLoader
+- 4eda590: Fixed cache namespace and key prefix separator configuration to properly use configured values instead of hardcoded plugin ID. The cache manager now correctly combines the configured namespace with plugin IDs using the configured separator for Redis and Valkey. Memcache and memory store continue to use plugin ID as namespace.
+- f244e61: Add `backend.logger` config options to configure the `RootLoggerService`.
+
+  Read more about the new configuration options in the
+  [Root Logger Service](https://backstage.io/docs/backend-system/core-services/root-logger/)
+  documentation.
+
+- Updated dependencies
+  - @backstage/config-loader@1.10.3
+  - @backstage/plugin-auth-node@0.6.7
+  - @backstage/plugin-events-node@0.4.15
+  - @backstage/integration@1.18.0
+  - @backstage/types@1.2.2
+  - @backstage/backend-app-api@1.2.7
+  - @backstage/backend-plugin-api@1.4.3
+  - @backstage/plugin-permission-node@0.10.4
+
 ## 0.12.1-next.1
 
 ### Patch Changes

package/config.d.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import { HumanDuration } from '@backstage/types';
+import { HumanDuration, JsonObject } from '@backstage/types';
 
 export interface Config {
   app: {
@@ -985,6 +985,66 @@ export interface Config {
       headers?: { [name: string]: string };
     };
 
+    /**
+     * Options to configure the default RootLoggerService.
+     */
+    logger?: {
+      /**
+       * Configures the global log level for messages.
+       *
+       * This can also be configured using the LOG_LEVEL environment variable, which
+       * takes precedence over this configuration.
+       *
+       * Defaults to 'info'.
+       */
+      level?: 'debug' | 'info' | 'warn' | 'error';
+
+      /**
+       * Additional metadata to include with every log entry.
+       */
+      meta?: JsonObject;
+
+      /**
+       * List of logger overrides.
+       *
+       * Can be used to configure a different level for logs matching certain criterias.
+       * For example, it can be used to ignore 'info' logs of given plugins.
+       *
+       * @example
+       *
+       * ```yaml
+       * logger:
+       *   level: info
+       *   overrides:
+       *     # For catalog and auth plugins, messages less important than 'warn' will be ignored.
+       *     - matchers:
+       *         plugin: [catalog, auth]
+       *       level: warn
+       *     # Ignore all messages that starts with 'Forget'
+       *     - matchers:
+       *         message: '/^Forget/'
+       *       level: warn
+       * ```
+       */
+      overrides?: Array<{
+        /**
+         * Conditions that must be met to override the log level.
+         *
+         * A matcher can be:
+         *
+         * - A string (exact match or regex pattern delimited by slashes, e.g. `/pattern/`)
+         * - A non-string value (compared by strict equality)
+         * - An array of matchers (returns true if any matcher matches)
+         */
+        matchers: JsonObject;
+
+        /**
+         * Log level to use for matched entries.
+         */
+        level: 'debug' | 'info' | 'warn' | 'error';
+      }>;
+    };
+
     /**
      * Rate limiting options. Defining this as `true` will enable rate limiting with default values.
      */

package/dist/PackageDiscoveryService.cjs.js

@@ -111,7 +111,7 @@ class PackageDiscoveryService {
         }
       }
     }
-    return { features };
+    return { features: Array.from(new Set(features)) };
   }
 }
 

package/dist/PackageDiscoveryService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"PackageDiscoveryService.cjs.js","sources":["../src/PackageDiscoveryService.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fs from 'fs-extra';\nimport { resolve as resolvePath, dirname } from 'path';\n\nimport {\n  BackendFeature,\n  RootConfigService,\n  RootLoggerService,\n} from '@backstage/backend-plugin-api';\nimport { BackstagePackageJson } from '@backstage/cli-node';\nimport { isError } from '@backstage/errors';\n\nconst DETECTED_PACKAGE_ROLES = [\n  'node-library',\n  'backend',\n  'backend-plugin',\n  'backend-plugin-module',\n];\n\n/** @internal */\nfunction isBackendFeature(value: unknown): value is BackendFeature {\n  return (\n    !!value &&\n    ['object', 'function'].includes(typeof value) &&\n    (value as BackendFeature).$$type === '@backstage/BackendFeature'\n  );\n}\n\n/** @internal */\nfunction isBackendFeatureFactory(\n  value: unknown,\n): value is () => BackendFeature {\n  return (\n    !!value &&\n    typeof value === 'function' &&\n    (value as any).$$type === '@backstage/BackendFeatureFactory'\n  );\n}\n\n/** @internal */\nasync function findClosestPackageDir(\n  searchDir: string,\n): Promise<string | undefined> {\n  let path = searchDir;\n\n  // Some confidence check to avoid infinite loop\n  for (let i = 0; i < 1000; i++) {\n    const packagePath = resolvePath(path, 'package.json');\n    const exists = await fs.pathExists(packagePath);\n    if (exists) {\n      return path;\n    }\n\n    const newPath = dirname(path);\n    if (newPath === path) {\n      return undefined;\n    }\n    path = newPath;\n  }\n\n  throw new Error(\n    `Iteration limit reached when searching for root package.json at ${searchDir}`,\n  );\n}\n\n/** @internal */\nexport class PackageDiscoveryService {\n  constructor(\n    private readonly config: RootConfigService,\n    private readonly logger: RootLoggerService,\n  ) {}\n\n  getDependencyNames(path: string) {\n    const { dependencies } = require(path) as BackstagePackageJson;\n    const packagesConfig = this.config.getOptional('backend.packages');\n\n    const dependencyNames = Object.keys(dependencies || {});\n\n    if (packagesConfig === 'all') {\n      return dependencyNames;\n    }\n\n    const includedPackagesConfig = this.config.getOptionalStringArray(\n      'backend.packages.include',\n    );\n\n    const includedPackages = includedPackagesConfig\n      ? new Set(includedPackagesConfig)\n      : dependencyNames;\n    const excludedPackagesSet = new Set(\n      this.config.getOptionalStringArray('backend.packages.exclude'),\n    );\n\n    return [...includedPackages].filter(name => !excludedPackagesSet.has(name));\n  }\n\n  async getBackendFeatures(): Promise<{ features: Array<BackendFeature> }> {\n    const packagesConfig = this.config.getOptional('backend.packages');\n    if (!packagesConfig || Object.keys(packagesConfig).length === 0) {\n      return { features: [] };\n    }\n\n    const packageDir = await findClosestPackageDir(process.argv[1]);\n    if (!packageDir) {\n      throw new Error('Package discovery failed to find package.json');\n    }\n    const dependencyNames = this.getDependencyNames(\n      resolvePath(packageDir, 'package.json'),\n    );\n\n    const features: BackendFeature[] = [];\n\n    for (const name of dependencyNames) {\n      let depPkg: BackstagePackageJson;\n      try {\n        const packageJsonPath = require.resolve(`${name}/package.json`, {\n          paths: [packageDir],\n        });\n        depPkg = require(packageJsonPath) as BackstagePackageJson;\n      } catch (error) {\n        // Handle packages with \"exports\" field that don't export ./package.json\n        if (isError(error) && error.code === 'ERR_PACKAGE_PATH_NOT_EXPORTED') {\n          continue; // Skip packages that don't export package.json - they can't be Backstage packages\n        }\n        throw error;\n      }\n      if (\n        !depPkg?.backstage?.role ||\n        !DETECTED_PACKAGE_ROLES.includes(depPkg.backstage.role)\n      ) {\n        continue; // Not a backstage backend package, ignore\n      }\n\n      const exportedModulePaths = [\n        require.resolve(name, {\n          paths: [packageDir],\n        }),\n      ];\n\n      // Find modules exported as alpha\n      try {\n        exportedModulePaths.push(\n          require.resolve(`${name}/alpha`, { paths: [packageDir] }),\n        );\n      } catch {\n        /* ignore */\n      }\n\n      for (const modulePath of exportedModulePaths) {\n        const mod = require(modulePath);\n\n        if (isBackendFeature(mod.default)) {\n          this.logger.info(`Detected: ${name}`);\n          features.push(mod.default);\n        }\n        if (isBackendFeatureFactory(mod.default)) {\n          this.logger.info(`Detected: ${name}`);\n          features.push(mod.default());\n        }\n      }\n    }\n\n    return { features };\n  }\n}\n"],"names":["resolvePath","fs","dirname","isError"],"mappings":";;;;;;;;;;AA2BA,MAAM,sBAAA,GAAyB;AAAA,EAC7B,cAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAGA,SAAS,iBAAiB,KAAA,EAAyC;AACjE,EAAA,OACE,CAAC,CAAC,KAAA,IACF,CAAC,QAAA,EAAU,UAAU,CAAA,CAAE,QAAA,CAAS,OAAO,KAAK,CAAA,IAC3C,KAAA,CAAyB,MAAA,KAAW,2BAAA;AAEzC;AAGA,SAAS,wBACP,KAAA,EAC+B;AAC/B,EAAA,OACE,CAAC,CAAC,KAAA,IACF,OAAO,KAAA,KAAU,UAAA,IAChB,MAAc,MAAA,KAAW,kCAAA;AAE9B;AAGA,eAAe,sBACb,SAAA,EAC6B;AAC7B,EAAA,IAAI,IAAA,GAAO,SAAA;AAGX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAM,CAAA,EAAA,EAAK;AAC7B,IAAA,MAAM,WAAA,GAAcA,oBAAA,CAAY,IAAA,EAAM,cAAc,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAMC,mBAAA,CAAG,UAAA,CAAW,WAAW,CAAA;AAC9C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAUC,qBAAQ,IAAI,CAAA;AAC5B,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,GAAO,OAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,mEAAmE,SAAS,CAAA;AAAA,GAC9E;AACF;AAGO,MAAM,uBAAA,CAAwB;AAAA,EACnC,WAAA,CACmB,QACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA,EAEH,mBAAmB,IAAA,EAAc;AAC/B,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,OAAA,CAAQ,IAAI,CAAA;AACrC,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,kBAAkB,CAAA;AAEjE,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,YAAA,IAAgB,EAAE,CAAA;AAEtD,IAAA,IAAI,mBAAmB,KAAA,EAAO;AAC5B,MAAA,OAAO,eAAA;AAAA,IACT;AAEA,IAAA,MAAM,sBAAA,GAAyB,KAAK,MAAA,CAAO,sBAAA;AAAA,MACzC;AAAA,KACF;AAEA,IAAA,MAAM,gBAAA,GAAmB,sBAAA,GACrB,IAAI,GAAA,CAAI,sBAAsB,CAAA,GAC9B,eAAA;AACJ,IAAA,MAAM,sBAAsB,IAAI,GAAA;AAAA,MAC9B,IAAA,CAAK,MAAA,CAAO,sBAAA,CAAuB,0BAA0B;AAAA,KAC/D;AAEA,IAAA,OAAO,CAAC,GAAG,gBAAgB,CAAA,CAAE,MAAA,CAAO,UAAQ,CAAC,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EAC5E;AAAA,EAEA,MAAM,kBAAA,GAAmE;AACvE,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,kBAAkB,CAAA;AACjE,IAAA,IAAI,CAAC,cAAA,IAAkB,MAAA,CAAO,KAAK,cAAc,CAAA,CAAE,WAAW,CAAA,EAAG;AAC/D,MAAA,OAAO,EAAE,QAAA,EAAU,EAAC,EAAE;AAAA,IACxB;AAEA,IAAA,MAAM,aAAa,MAAM,qBAAA,CAAsB,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,kBAAkB,IAAA,CAAK,kBAAA;AAAA,MAC3BF,oBAAA,CAAY,YAAY,cAAc;AAAA,KACxC;AAEA,IAAA,MAAM,WAA6B,EAAC;AAEpC,IAAA,KAAA,MAAW,QAAQ,eAAA,EAAiB;AAClC,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,aAAA,CAAA,EAAiB;AAAA,UAC9D,KAAA,EAAO,CAAC,UAAU;AAAA,SACnB,CAAA;AACD,QAAA,MAAA,GAAS,QAAQ,eAAe,CAAA;AAAA,MAClC,SAAS,KAAA,EAAO;AAEd,QAAA,IAAIG,cAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,SAAS,+BAAA,EAAiC;AACpE,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,IACE,CAAC,MAAA,EAAQ,SAAA,EAAW,IAAA,IACpB,CAAC,uBAAuB,QAAA,CAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,EACtD;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,mBAAA,GAAsB;AAAA,QAC1B,OAAA,CAAQ,QAAQ,IAAA,EAAM;AAAA,UACpB,KAAA,EAAO,CAAC,UAAU;AAAA,SACnB;AAAA,OACH;AAGA,MAAA,IAAI;AACF,QAAA,mBAAA,CAAoB,IAAA;AAAA,UAClB,OAAA,CAAQ,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAU,EAAE,KAAA,EAAO,CAAC,UAAU,CAAA,EAAG;AAAA,SAC1D;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAEA,MAAA,KAAA,MAAW,cAAc,mBAAA,EAAqB;AAC5C,QAAA,MAAM,GAAA,GAAM,QAAQ,UAAU,CAAA;AAE9B,QAAA,IAAI,gBAAA,CAAiB,GAAA,CAAI,OAAO,CAAA,EAAG;AACjC,UAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,UAAA,QAAA,CAAS,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,QAC3B;AACA,QAAA,IAAI,uBAAA,CAAwB,GAAA,CAAI,OAAO,CAAA,EAAG;AACxC,UAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,UAAA,QAAA,CAAS,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,QAAA,EAAS;AAAA,EACpB;AACF;;;;"}
+{"version":3,"file":"PackageDiscoveryService.cjs.js","sources":["../src/PackageDiscoveryService.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fs from 'fs-extra';\nimport { resolve as resolvePath, dirname } from 'path';\n\nimport {\n  BackendFeature,\n  RootConfigService,\n  RootLoggerService,\n} from '@backstage/backend-plugin-api';\nimport { BackstagePackageJson } from '@backstage/cli-node';\nimport { isError } from '@backstage/errors';\n\nconst DETECTED_PACKAGE_ROLES = [\n  'node-library',\n  'backend',\n  'backend-plugin',\n  'backend-plugin-module',\n];\n\n/** @internal */\nfunction isBackendFeature(value: unknown): value is BackendFeature {\n  return (\n    !!value &&\n    ['object', 'function'].includes(typeof value) &&\n    (value as BackendFeature).$$type === '@backstage/BackendFeature'\n  );\n}\n\n/** @internal */\nfunction isBackendFeatureFactory(\n  value: unknown,\n): value is () => BackendFeature {\n  return (\n    !!value &&\n    typeof value === 'function' &&\n    (value as any).$$type === '@backstage/BackendFeatureFactory'\n  );\n}\n\n/** @internal */\nasync function findClosestPackageDir(\n  searchDir: string,\n): Promise<string | undefined> {\n  let path = searchDir;\n\n  // Some confidence check to avoid infinite loop\n  for (let i = 0; i < 1000; i++) {\n    const packagePath = resolvePath(path, 'package.json');\n    const exists = await fs.pathExists(packagePath);\n    if (exists) {\n      return path;\n    }\n\n    const newPath = dirname(path);\n    if (newPath === path) {\n      return undefined;\n    }\n    path = newPath;\n  }\n\n  throw new Error(\n    `Iteration limit reached when searching for root package.json at ${searchDir}`,\n  );\n}\n\n/** @internal */\nexport class PackageDiscoveryService {\n  constructor(\n    private readonly config: RootConfigService,\n    private readonly logger: RootLoggerService,\n  ) {}\n\n  getDependencyNames(path: string) {\n    const { dependencies } = require(path) as BackstagePackageJson;\n    const packagesConfig = this.config.getOptional('backend.packages');\n\n    const dependencyNames = Object.keys(dependencies || {});\n\n    if (packagesConfig === 'all') {\n      return dependencyNames;\n    }\n\n    const includedPackagesConfig = this.config.getOptionalStringArray(\n      'backend.packages.include',\n    );\n\n    const includedPackages = includedPackagesConfig\n      ? new Set(includedPackagesConfig)\n      : dependencyNames;\n    const excludedPackagesSet = new Set(\n      this.config.getOptionalStringArray('backend.packages.exclude'),\n    );\n\n    return [...includedPackages].filter(name => !excludedPackagesSet.has(name));\n  }\n\n  async getBackendFeatures(): Promise<{ features: Array<BackendFeature> }> {\n    const packagesConfig = this.config.getOptional('backend.packages');\n    if (!packagesConfig || Object.keys(packagesConfig).length === 0) {\n      return { features: [] };\n    }\n\n    const packageDir = await findClosestPackageDir(process.argv[1]);\n    if (!packageDir) {\n      throw new Error('Package discovery failed to find package.json');\n    }\n    const dependencyNames = this.getDependencyNames(\n      resolvePath(packageDir, 'package.json'),\n    );\n\n    const features: BackendFeature[] = [];\n\n    for (const name of dependencyNames) {\n      let depPkg: BackstagePackageJson;\n      try {\n        const packageJsonPath = require.resolve(`${name}/package.json`, {\n          paths: [packageDir],\n        });\n        depPkg = require(packageJsonPath) as BackstagePackageJson;\n      } catch (error) {\n        // Handle packages with \"exports\" field that don't export ./package.json\n        if (isError(error) && error.code === 'ERR_PACKAGE_PATH_NOT_EXPORTED') {\n          continue; // Skip packages that don't export package.json - they can't be Backstage packages\n        }\n        throw error;\n      }\n      if (\n        !depPkg?.backstage?.role ||\n        !DETECTED_PACKAGE_ROLES.includes(depPkg.backstage.role)\n      ) {\n        continue; // Not a backstage backend package, ignore\n      }\n\n      const exportedModulePaths = [\n        require.resolve(name, {\n          paths: [packageDir],\n        }),\n      ];\n\n      // Find modules exported as alpha\n      try {\n        exportedModulePaths.push(\n          require.resolve(`${name}/alpha`, { paths: [packageDir] }),\n        );\n      } catch {\n        /* ignore */\n      }\n\n      for (const modulePath of exportedModulePaths) {\n        const mod = require(modulePath);\n\n        if (isBackendFeature(mod.default)) {\n          this.logger.info(`Detected: ${name}`);\n          features.push(mod.default);\n        }\n        if (isBackendFeatureFactory(mod.default)) {\n          this.logger.info(`Detected: ${name}`);\n          features.push(mod.default());\n        }\n      }\n    }\n\n    return { features: Array.from(new Set(features)) };\n  }\n}\n"],"names":["resolvePath","fs","dirname","isError"],"mappings":";;;;;;;;;;AA2BA,MAAM,sBAAA,GAAyB;AAAA,EAC7B,cAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAGA,SAAS,iBAAiB,KAAA,EAAyC;AACjE,EAAA,OACE,CAAC,CAAC,KAAA,IACF,CAAC,QAAA,EAAU,UAAU,CAAA,CAAE,QAAA,CAAS,OAAO,KAAK,CAAA,IAC3C,KAAA,CAAyB,MAAA,KAAW,2BAAA;AAEzC;AAGA,SAAS,wBACP,KAAA,EAC+B;AAC/B,EAAA,OACE,CAAC,CAAC,KAAA,IACF,OAAO,KAAA,KAAU,UAAA,IAChB,MAAc,MAAA,KAAW,kCAAA;AAE9B;AAGA,eAAe,sBACb,SAAA,EAC6B;AAC7B,EAAA,IAAI,IAAA,GAAO,SAAA;AAGX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAM,CAAA,EAAA,EAAK;AAC7B,IAAA,MAAM,WAAA,GAAcA,oBAAA,CAAY,IAAA,EAAM,cAAc,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAMC,mBAAA,CAAG,UAAA,CAAW,WAAW,CAAA;AAC9C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAUC,qBAAQ,IAAI,CAAA;AAC5B,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,GAAO,OAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,mEAAmE,SAAS,CAAA;AAAA,GAC9E;AACF;AAGO,MAAM,uBAAA,CAAwB;AAAA,EACnC,WAAA,CACmB,QACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA,EAEH,mBAAmB,IAAA,EAAc;AAC/B,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,OAAA,CAAQ,IAAI,CAAA;AACrC,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,kBAAkB,CAAA;AAEjE,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,IAAA,CAAK,YAAA,IAAgB,EAAE,CAAA;AAEtD,IAAA,IAAI,mBAAmB,KAAA,EAAO;AAC5B,MAAA,OAAO,eAAA;AAAA,IACT;AAEA,IAAA,MAAM,sBAAA,GAAyB,KAAK,MAAA,CAAO,sBAAA;AAAA,MACzC;AAAA,KACF;AAEA,IAAA,MAAM,gBAAA,GAAmB,sBAAA,GACrB,IAAI,GAAA,CAAI,sBAAsB,CAAA,GAC9B,eAAA;AACJ,IAAA,MAAM,sBAAsB,IAAI,GAAA;AAAA,MAC9B,IAAA,CAAK,MAAA,CAAO,sBAAA,CAAuB,0BAA0B;AAAA,KAC/D;AAEA,IAAA,OAAO,CAAC,GAAG,gBAAgB,CAAA,CAAE,MAAA,CAAO,UAAQ,CAAC,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EAC5E;AAAA,EAEA,MAAM,kBAAA,GAAmE;AACvE,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,kBAAkB,CAAA;AACjE,IAAA,IAAI,CAAC,cAAA,IAAkB,MAAA,CAAO,KAAK,cAAc,CAAA,CAAE,WAAW,CAAA,EAAG;AAC/D,MAAA,OAAO,EAAE,QAAA,EAAU,EAAC,EAAE;AAAA,IACxB;AAEA,IAAA,MAAM,aAAa,MAAM,qBAAA,CAAsB,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,CAAA;AAC9D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,kBAAkB,IAAA,CAAK,kBAAA;AAAA,MAC3BF,oBAAA,CAAY,YAAY,cAAc;AAAA,KACxC;AAEA,IAAA,MAAM,WAA6B,EAAC;AAEpC,IAAA,KAAA,MAAW,QAAQ,eAAA,EAAiB;AAClC,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,aAAA,CAAA,EAAiB;AAAA,UAC9D,KAAA,EAAO,CAAC,UAAU;AAAA,SACnB,CAAA;AACD,QAAA,MAAA,GAAS,QAAQ,eAAe,CAAA;AAAA,MAClC,SAAS,KAAA,EAAO;AAEd,QAAA,IAAIG,cAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,SAAS,+BAAA,EAAiC;AACpE,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,IACE,CAAC,MAAA,EAAQ,SAAA,EAAW,IAAA,IACpB,CAAC,uBAAuB,QAAA,CAAS,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,EACtD;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,mBAAA,GAAsB;AAAA,QAC1B,OAAA,CAAQ,QAAQ,IAAA,EAAM;AAAA,UACpB,KAAA,EAAO,CAAC,UAAU;AAAA,SACnB;AAAA,OACH;AAGA,MAAA,IAAI;AACF,QAAA,mBAAA,CAAoB,IAAA;AAAA,UAClB,OAAA,CAAQ,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,MAAA,CAAA,EAAU,EAAE,KAAA,EAAO,CAAC,UAAU,CAAA,EAAG;AAAA,SAC1D;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAEA,MAAA,KAAA,MAAW,cAAc,mBAAA,EAAqB;AAC5C,QAAA,MAAM,GAAA,GAAM,QAAQ,UAAU,CAAA;AAE9B,QAAA,IAAI,gBAAA,CAAiB,GAAA,CAAI,OAAO,CAAA,EAAG;AACjC,UAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,UAAA,QAAA,CAAS,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,QAC3B;AACA,QAAA,IAAI,uBAAA,CAAwB,GAAA,CAAI,OAAO,CAAA,EAAG;AACxC,UAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AACpC,UAAA,QAAA,CAAS,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,UAAU,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,QAAQ,CAAC,CAAA,EAAE;AAAA,EACnD;AACF;;;;"}

package/dist/entrypoints/rootLogger/WinstonLogger.cjs.js

@@ -3,19 +3,26 @@
 var winston = require('winston');
 var tripleBeam = require('triple-beam');
 var escapeRegExp = require('../../lib/escapeRegExp.cjs.js');
+var types = require('./types.cjs.js');
+var utils = require('./utils.cjs.js');
 
 class WinstonLogger {
   #winston;
   #addRedactions;
+  #setLevelOverrides;
   /**
    * Creates a {@link WinstonLogger} instance.
    */
   static create(options) {
+    const defaultLogLevel = process.env.LOG_LEVEL || options.level || "info";
     const redacter = WinstonLogger.redacter();
+    const logLevelFilter = WinstonLogger.logLevelFilter(defaultLogLevel);
     const defaultFormatter = process.env.NODE_ENV === "production" ? winston.format.json() : WinstonLogger.colorFormat();
     let logger = winston.createLogger({
-      level: process.env.LOG_LEVEL || options.level || "info",
+      // Lowest level possible as we let the logLevelFilter do the filtering
+      level: "silly",
       format: winston.format.combine(
+        logLevelFilter.format,
         options.format ?? defaultFormatter,
         redacter.format
       ),
@@ -24,7 +31,7 @@ class WinstonLogger {
     if (options.meta) {
       logger = logger.child(options.meta);
     }
-    return new WinstonLogger(logger, redacter.add);
+    return new WinstonLogger(logger, redacter.add, logLevelFilter.setOverrides);
   }
   /**
    * Creates a winston log formatter for redacting secrets.
@@ -95,9 +102,39 @@ class WinstonLogger {
       })
     );
   }
-  constructor(winston, addRedactions) {
+  /**
+   * Formatter that filters log levels using overrides, falling back to the default level when no criteria match.
+   */
+  static logLevelFilter(defaultLogLevel) {
+    const overrides = [];
+    return {
+      format: winston.format((log) => {
+        for (const override of overrides) {
+          if (override.predicate(log)) {
+            if (types.winstonLevels[log.level] > types.winstonLevels[override.level]) {
+              return false;
+            }
+            return log;
+          }
+        }
+        if (types.winstonLevels[log.level] > types.winstonLevels[defaultLogLevel]) {
+          return false;
+        }
+        return log;
+      })(),
+      setOverrides: (newOverrides) => {
+        const newOverridesPredicates = newOverrides.map((o) => ({
+          predicate: utils.createLogMatcher(o.matchers),
+          level: o.level
+        }));
+        overrides.splice(0, overrides.length, ...newOverridesPredicates);
+      }
+    };
+  }
+  constructor(winston, addRedactions, setLevelOverrides) {
     this.#winston = winston;
     this.#addRedactions = addRedactions;
+    this.#setLevelOverrides = setLevelOverrides;
   }
   error(message, meta) {
     this.#winston.error(message, meta);
@@ -117,6 +154,9 @@ class WinstonLogger {
   addRedactions(redactions) {
     this.#addRedactions?.(redactions);
   }
+  setLevelOverrides(overrides) {
+    this.#setLevelOverrides?.(overrides);
+  }
 }
 
 exports.WinstonLogger = WinstonLogger;

package/dist/entrypoints/rootLogger/WinstonLogger.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"WinstonLogger.cjs.js","sources":["../../../src/entrypoints/rootLogger/WinstonLogger.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  LoggerService,\n  RootLoggerService,\n} from '@backstage/backend-plugin-api';\nimport { JsonObject } from '@backstage/types';\nimport { Format, TransformableInfo } from 'logform';\nimport {\n  Logger,\n  format,\n  createLogger,\n  transports,\n  transport as Transport,\n} from 'winston';\nimport { MESSAGE } from 'triple-beam';\nimport { escapeRegExp } from '../../lib/escapeRegExp';\n\n/**\n * @public\n */\nexport interface WinstonLoggerOptions {\n  meta?: JsonObject;\n  level?: string;\n  format?: Format;\n  transports?: Transport[];\n}\n\n/**\n * A {@link @backstage/backend-plugin-api#LoggerService} implementation based on winston.\n *\n * @public\n */\nexport class WinstonLogger implements RootLoggerService {\n  #winston: Logger;\n  #addRedactions?: (redactions: Iterable<string>) => void;\n\n  /**\n   * Creates a {@link WinstonLogger} instance.\n   */\n  static create(options: WinstonLoggerOptions): WinstonLogger {\n    const redacter = WinstonLogger.redacter();\n    const defaultFormatter =\n      process.env.NODE_ENV === 'production'\n        ? format.json()\n        : WinstonLogger.colorFormat();\n\n    let logger = createLogger({\n      level: process.env.LOG_LEVEL || options.level || 'info',\n      format: format.combine(\n        options.format ?? defaultFormatter,\n        redacter.format,\n      ),\n      transports: options.transports ?? new transports.Console(),\n    });\n\n    if (options.meta) {\n      logger = logger.child(options.meta);\n    }\n\n    return new WinstonLogger(logger, redacter.add);\n  }\n\n  /**\n   * Creates a winston log formatter for redacting secrets.\n   */\n  static redacter(): {\n    format: Format;\n    add: (redactions: Iterable<string>) => void;\n  } {\n    const redactionSet = new Set<string>();\n\n    let redactionPattern: RegExp | undefined = undefined;\n\n    return {\n      format: format((obj: TransformableInfo) => {\n        if (!redactionPattern || !obj) {\n          return obj;\n        }\n\n        obj[MESSAGE] = obj[MESSAGE]?.replace?.(redactionPattern, '***');\n\n        return obj;\n      })(),\n      add(newRedactions) {\n        let added = 0;\n        for (const redactionToTrim of newRedactions) {\n          // Skip null or undefined values\n          if (redactionToTrim === null || redactionToTrim === undefined) {\n            continue;\n          }\n          // Trimming the string ensures that we don't accdentally get extra\n          // newlines or other whitespace interfering with the redaction; this\n          // can happen for example when using string literals in yaml\n          const redaction = redactionToTrim.trim();\n          // Exclude secrets that are empty or just one character in length. These\n          // typically mean that you are running local dev or tests, or using the\n          // --lax flag which sets things to just 'x'.\n          if (redaction.length <= 1) {\n            continue;\n          }\n          if (!redactionSet.has(redaction)) {\n            redactionSet.add(redaction);\n            added += 1;\n          }\n        }\n        if (added > 0) {\n          const redactions = Array.from(redactionSet)\n            .map(r => escapeRegExp(r))\n            .join('|');\n          redactionPattern = new RegExp(`(${redactions})`, 'g');\n        }\n      },\n    };\n  }\n\n  /**\n   * Creates a pretty printed winston log formatter.\n   */\n  static colorFormat(): Format {\n    const colorizer = format.colorize();\n\n    return format.combine(\n      format.timestamp(),\n      format.colorize({\n        colors: {\n          timestamp: 'dim',\n          prefix: 'blue',\n          field: 'cyan',\n          debug: 'grey',\n        },\n      }),\n      format.printf((info: TransformableInfo) => {\n        const { timestamp, level, message, plugin, service, ...fields } = info;\n        const prefix = plugin || service;\n        const timestampColor = colorizer.colorize('timestamp', timestamp);\n        const prefixColor = colorizer.colorize('prefix', prefix);\n\n        const extraFields = Object.entries(fields)\n          .map(([key, value]) => {\n            let stringValue = '';\n\n            try {\n              stringValue = JSON.stringify(value);\n            } catch (e) {\n              stringValue = '[field value not castable to string]';\n            }\n\n            return `${colorizer.colorize('field', `${key}`)}=${stringValue}`;\n          })\n          .join(' ');\n\n        return `${timestampColor} ${prefixColor} ${level} ${message} ${extraFields}`;\n      }),\n    );\n  }\n\n  private constructor(\n    winston: Logger,\n    addRedactions?: (redactions: Iterable<string>) => void,\n  ) {\n    this.#winston = winston;\n    this.#addRedactions = addRedactions;\n  }\n\n  error(message: string, meta?: JsonObject): void {\n    this.#winston.error(message, meta);\n  }\n\n  warn(message: string, meta?: JsonObject): void {\n    this.#winston.warn(message, meta);\n  }\n\n  info(message: string, meta?: JsonObject): void {\n    this.#winston.info(message, meta);\n  }\n\n  debug(message: string, meta?: JsonObject): void {\n    this.#winston.debug(message, meta);\n  }\n\n  child(meta: JsonObject): LoggerService {\n    return new WinstonLogger(this.#winston.child(meta));\n  }\n\n  addRedactions(redactions: Iterable<string>) {\n    this.#addRedactions?.(redactions);\n  }\n}\n"],"names":["format","createLogger","transports","MESSAGE","escapeRegExp"],"mappings":";;;;;;AA+CO,MAAM,aAAA,CAA2C;AAAA,EACtD,QAAA;AAAA,EACA,cAAA;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OAAO,OAAA,EAA8C;AAC1D,IAAA,MAAM,QAAA,GAAW,cAAc,QAAA,EAAS;AACxC,IAAA,MAAM,gBAAA,GACJ,QAAQ,GAAA,CAAI,QAAA,KAAa,eACrBA,cAAA,CAAO,IAAA,EAAK,GACZ,aAAA,CAAc,WAAA,EAAY;AAEhC,IAAA,IAAI,SAASC,oBAAA,CAAa;AAAA,MACxB,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,QAAQ,KAAA,IAAS,MAAA;AAAA,MACjD,QAAQD,cAAA,CAAO,OAAA;AAAA,QACb,QAAQ,MAAA,IAAU,gBAAA;AAAA,QAClB,QAAA,CAAS;AAAA,OACX;AAAA,MACA,UAAA,EAAY,OAAA,CAAQ,UAAA,IAAc,IAAIE,mBAAW,OAAA;AAAQ,KAC1D,CAAA;AAED,IAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,MAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,IAAI,aAAA,CAAc,MAAA,EAAQ,QAAA,CAAS,GAAG,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,QAAA,GAGL;AACA,IAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AAErC,IAAA,IAAI,gBAAA,GAAuC,MAAA;AAE3C,IAAA,OAAO;AAAA,MACL,MAAA,EAAQF,cAAA,CAAO,CAAC,GAAA,KAA2B;AACzC,QAAA,IAAI,CAAC,gBAAA,IAAoB,CAAC,GAAA,EAAK;AAC7B,UAAA,OAAO,GAAA;AAAA,QACT;AAEA,QAAA,GAAA,CAAIG,kBAAO,CAAA,GAAI,GAAA,CAAIA,kBAAO,CAAA,EAAG,OAAA,GAAU,kBAAkB,KAAK,CAAA;AAE9D,QAAA,OAAO,GAAA;AAAA,MACT,CAAC,CAAA,EAAE;AAAA,MACH,IAAI,aAAA,EAAe;AACjB,QAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,QAAA,KAAA,MAAW,mBAAmB,aAAA,EAAe;AAE3C,UAAA,IAAI,eAAA,KAAoB,IAAA,IAAQ,eAAA,KAAoB,MAAA,EAAW;AAC7D,YAAA;AAAA,UACF;AAIA,UAAA,MAAM,SAAA,GAAY,gBAAgB,IAAA,EAAK;AAIvC,UAAA,IAAI,SAAA,CAAU,UAAU,CAAA,EAAG;AACzB,YAAA;AAAA,UACF;AACA,UAAA,IAAI,CAAC,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,YAAA,YAAA,CAAa,IAAI,SAAS,CAAA;AAC1B,YAAA,KAAA,IAAS,CAAA;AAAA,UACX;AAAA,QACF;AACA,QAAA,IAAI,QAAQ,CAAA,EAAG;AACb,UAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,CAAK,YAAY,CAAA,CACvC,GAAA,CAAI,CAAA,CAAA,KAAKC,yBAAA,CAAa,CAAC,CAAC,CAAA,CACxB,IAAA,CAAK,GAAG,CAAA;AACX,UAAA,gBAAA,GAAmB,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,UAAU,KAAK,GAAG,CAAA;AAAA,QACtD;AAAA,MACF;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,WAAA,GAAsB;AAC3B,IAAA,MAAM,SAAA,GAAYJ,eAAO,QAAA,EAAS;AAElC,IAAA,OAAOA,cAAA,CAAO,OAAA;AAAA,MACZA,eAAO,SAAA,EAAU;AAAA,MACjBA,eAAO,QAAA,CAAS;AAAA,QACd,MAAA,EAAQ;AAAA,UACN,SAAA,EAAW,KAAA;AAAA,UACX,MAAA,EAAQ,MAAA;AAAA,UACR,KAAA,EAAO,MAAA;AAAA,UACP,KAAA,EAAO;AAAA;AACT,OACD,CAAA;AAAA,MACDA,cAAA,CAAO,MAAA,CAAO,CAAC,IAAA,KAA4B;AACzC,QAAA,MAAM,EAAE,WAAW,KAAA,EAAO,OAAA,EAAS,QAAQ,OAAA,EAAS,GAAG,QAAO,GAAI,IAAA;AAClE,QAAA,MAAM,SAAS,MAAA,IAAU,OAAA;AACzB,QAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,QAAA,CAAS,WAAA,EAAa,SAAS,CAAA;AAChE,QAAA,MAAM,WAAA,GAAc,SAAA,CAAU,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAEvD,QAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CACtC,IAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AACrB,UAAA,IAAI,WAAA,GAAc,EAAA;AAElB,UAAA,IAAI;AACF,YAAA,WAAA,GAAc,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,UACpC,SAAS,CAAA,EAAG;AACV,YAAA,WAAA,GAAc,sCAAA;AAAA,UAChB;AAEA,UAAA,OAAO,CAAA,EAAG,UAAU,QAAA,CAAS,OAAA,EAAS,GAAG,GAAG,CAAA,CAAE,CAAC,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,QAChE,CAAC,CAAA,CACA,IAAA,CAAK,GAAG,CAAA;AAEX,QAAA,OAAO,CAAA,EAAG,cAAc,CAAA,CAAA,EAAI,WAAW,IAAI,KAAK,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,MAC5E,CAAC;AAAA,KACH;AAAA,EACF;AAAA,EAEQ,WAAA,CACN,SACA,aAAA,EACA;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,cAAA,GAAiB,aAAA;AAAA,EACxB;AAAA,EAEA,KAAA,CAAM,SAAiB,IAAA,EAAyB;AAC9C,IAAA,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,OAAA,EAAS,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,IAAA,CAAK,SAAiB,IAAA,EAAyB;AAC7C,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAAA,EAClC;AAAA,EAEA,IAAA,CAAK,SAAiB,IAAA,EAAyB;AAC7C,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAAA,EAClC;AAAA,EAEA,KAAA,CAAM,SAAiB,IAAA,EAAyB;AAC9C,IAAA,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,OAAA,EAAS,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAA,EAAiC;AACrC,IAAA,OAAO,IAAI,aAAA,CAAc,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,EACpD;AAAA,EAEA,cAAc,UAAA,EAA8B;AAC1C,IAAA,IAAA,CAAK,iBAAiB,UAAU,CAAA;AAAA,EAClC;AACF;;;;"}
+{"version":3,"file":"WinstonLogger.cjs.js","sources":["../../../src/entrypoints/rootLogger/WinstonLogger.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  LoggerService,\n  RootLoggerService,\n} from '@backstage/backend-plugin-api';\nimport { JsonObject } from '@backstage/types';\nimport { Format, TransformableInfo } from 'logform';\nimport {\n  Logger,\n  format,\n  createLogger,\n  transports,\n  transport as Transport,\n  config as winstonConfig,\n} from 'winston';\nimport { MESSAGE } from 'triple-beam';\nimport { escapeRegExp } from '../../lib/escapeRegExp';\nimport { winstonLevels, WinstonLoggerLevelOverride } from './types';\nimport { createLogMatcher } from './utils';\n\n/**\n * @public\n */\nexport interface WinstonLoggerOptions {\n  meta?: JsonObject;\n  level?: string;\n  format?: Format;\n  transports?: Transport[];\n}\n\n/**\n * A {@link @backstage/backend-plugin-api#LoggerService} implementation based on winston.\n *\n * @public\n */\nexport class WinstonLogger implements RootLoggerService {\n  #winston: Logger;\n  #addRedactions?: (redactions: Iterable<string>) => void;\n  #setLevelOverrides?: (overrides: WinstonLoggerLevelOverride[]) => void;\n\n  /**\n   * Creates a {@link WinstonLogger} instance.\n   */\n  static create(options: WinstonLoggerOptions): WinstonLogger {\n    const defaultLogLevel = process.env.LOG_LEVEL || options.level || 'info';\n\n    const redacter = WinstonLogger.redacter();\n    const logLevelFilter = WinstonLogger.logLevelFilter(defaultLogLevel);\n\n    const defaultFormatter =\n      process.env.NODE_ENV === 'production'\n        ? format.json()\n        : WinstonLogger.colorFormat();\n\n    let logger = createLogger({\n      // Lowest level possible as we let the logLevelFilter do the filtering\n      level: 'silly',\n      format: format.combine(\n        logLevelFilter.format,\n        options.format ?? defaultFormatter,\n        redacter.format,\n      ),\n      transports: options.transports ?? new transports.Console(),\n    });\n\n    if (options.meta) {\n      logger = logger.child(options.meta);\n    }\n\n    return new WinstonLogger(logger, redacter.add, logLevelFilter.setOverrides);\n  }\n\n  /**\n   * Creates a winston log formatter for redacting secrets.\n   */\n  static redacter(): {\n    format: Format;\n    add: (redactions: Iterable<string>) => void;\n  } {\n    const redactionSet = new Set<string>();\n\n    let redactionPattern: RegExp | undefined = undefined;\n\n    return {\n      format: format((obj: TransformableInfo) => {\n        if (!redactionPattern || !obj) {\n          return obj;\n        }\n\n        obj[MESSAGE] = obj[MESSAGE]?.replace?.(redactionPattern, '***');\n\n        return obj;\n      })(),\n      add(newRedactions) {\n        let added = 0;\n        for (const redactionToTrim of newRedactions) {\n          // Skip null or undefined values\n          if (redactionToTrim === null || redactionToTrim === undefined) {\n            continue;\n          }\n          // Trimming the string ensures that we don't accdentally get extra\n          // newlines or other whitespace interfering with the redaction; this\n          // can happen for example when using string literals in yaml\n          const redaction = redactionToTrim.trim();\n          // Exclude secrets that are empty or just one character in length. These\n          // typically mean that you are running local dev or tests, or using the\n          // --lax flag which sets things to just 'x'.\n          if (redaction.length <= 1) {\n            continue;\n          }\n          if (!redactionSet.has(redaction)) {\n            redactionSet.add(redaction);\n            added += 1;\n          }\n        }\n        if (added > 0) {\n          const redactions = Array.from(redactionSet)\n            .map(r => escapeRegExp(r))\n            .join('|');\n          redactionPattern = new RegExp(`(${redactions})`, 'g');\n        }\n      },\n    };\n  }\n\n  /**\n   * Creates a pretty printed winston log formatter.\n   */\n  static colorFormat(): Format {\n    const colorizer = format.colorize();\n\n    return format.combine(\n      format.timestamp(),\n      format.colorize({\n        colors: {\n          timestamp: 'dim',\n          prefix: 'blue',\n          field: 'cyan',\n          debug: 'grey',\n        },\n      }),\n      format.printf((info: TransformableInfo) => {\n        const { timestamp, level, message, plugin, service, ...fields } = info;\n        const prefix = plugin || service;\n        const timestampColor = colorizer.colorize('timestamp', timestamp);\n        const prefixColor = colorizer.colorize('prefix', prefix);\n\n        const extraFields = Object.entries(fields)\n          .map(([key, value]) => {\n            let stringValue = '';\n\n            try {\n              stringValue = JSON.stringify(value);\n            } catch (e) {\n              stringValue = '[field value not castable to string]';\n            }\n\n            return `${colorizer.colorize('field', `${key}`)}=${stringValue}`;\n          })\n          .join(' ');\n\n        return `${timestampColor} ${prefixColor} ${level} ${message} ${extraFields}`;\n      }),\n    );\n  }\n\n  /**\n   * Formatter that filters log levels using overrides, falling back to the default level when no criteria match.\n   */\n  static logLevelFilter(\n    defaultLogLevel: keyof winstonConfig.NpmConfigSetLevels,\n  ): {\n    format: Format;\n    setOverrides: (overrides: WinstonLoggerLevelOverride[]) => void;\n  } {\n    const overrides: {\n      predicate: (log: TransformableInfo) => boolean;\n      level: string;\n    }[] = [];\n\n    return {\n      format: format(log => {\n        for (const override of overrides) {\n          if (override.predicate(log)) {\n            // Discard the log if the log level is below the override\n            // eg, if the override level is 'warn' (1) and the log is 'debug' (5)\n            if (winstonLevels[log.level] > winstonLevels[override.level]) {\n              return false;\n            }\n\n            return log;\n          }\n        }\n\n        // Ignore logs that are below the global level\n        // eg, if the global level is 'warn' (1) and the log level is 'debug' (5)\n        if (winstonLevels[log.level] > winstonLevels[defaultLogLevel]) {\n          return false;\n        }\n\n        return log;\n      })(),\n      setOverrides: newOverrides => {\n        const newOverridesPredicates = newOverrides.map(o => ({\n          predicate: createLogMatcher(o.matchers),\n          level: o.level,\n        }));\n        // Replace the content while preserving the reference to support live config updates\n        overrides.splice(0, overrides.length, ...newOverridesPredicates);\n      },\n    };\n  }\n\n  private constructor(\n    winston: Logger,\n    addRedactions?: (redactions: Iterable<string>) => void,\n    setLevelOverrides?: (overrides: WinstonLoggerLevelOverride[]) => void,\n  ) {\n    this.#winston = winston;\n    this.#addRedactions = addRedactions;\n    this.#setLevelOverrides = setLevelOverrides;\n  }\n\n  error(message: string, meta?: JsonObject): void {\n    this.#winston.error(message, meta);\n  }\n\n  warn(message: string, meta?: JsonObject): void {\n    this.#winston.warn(message, meta);\n  }\n\n  info(message: string, meta?: JsonObject): void {\n    this.#winston.info(message, meta);\n  }\n\n  debug(message: string, meta?: JsonObject): void {\n    this.#winston.debug(message, meta);\n  }\n\n  child(meta: JsonObject): LoggerService {\n    return new WinstonLogger(this.#winston.child(meta));\n  }\n\n  addRedactions(redactions: Iterable<string>) {\n    this.#addRedactions?.(redactions);\n  }\n\n  setLevelOverrides(overrides: WinstonLoggerLevelOverride[]) {\n    this.#setLevelOverrides?.(overrides);\n  }\n}\n"],"names":["format","createLogger","transports","MESSAGE","escapeRegExp","winstonLevels","createLogMatcher"],"mappings":";;;;;;;;AAkDO,MAAM,aAAA,CAA2C;AAAA,EACtD,QAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OAAO,OAAA,EAA8C;AAC1D,IAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,QAAQ,KAAA,IAAS,MAAA;AAElE,IAAA,MAAM,QAAA,GAAW,cAAc,QAAA,EAAS;AACxC,IAAA,MAAM,cAAA,GAAiB,aAAA,CAAc,cAAA,CAAe,eAAe,CAAA;AAEnE,IAAA,MAAM,gBAAA,GACJ,QAAQ,GAAA,CAAI,QAAA,KAAa,eACrBA,cAAA,CAAO,IAAA,EAAK,GACZ,aAAA,CAAc,WAAA,EAAY;AAEhC,IAAA,IAAI,SAASC,oBAAA,CAAa;AAAA;AAAA,MAExB,KAAA,EAAO,OAAA;AAAA,MACP,QAAQD,cAAA,CAAO,OAAA;AAAA,QACb,cAAA,CAAe,MAAA;AAAA,QACf,QAAQ,MAAA,IAAU,gBAAA;AAAA,QAClB,QAAA,CAAS;AAAA,OACX;AAAA,MACA,UAAA,EAAY,OAAA,CAAQ,UAAA,IAAc,IAAIE,mBAAW,OAAA;AAAQ,KAC1D,CAAA;AAED,IAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,MAAA,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,IAAI,aAAA,CAAc,MAAA,EAAQ,QAAA,CAAS,GAAA,EAAK,eAAe,YAAY,CAAA;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,QAAA,GAGL;AACA,IAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AAErC,IAAA,IAAI,gBAAA,GAAuC,MAAA;AAE3C,IAAA,OAAO;AAAA,MACL,MAAA,EAAQF,cAAA,CAAO,CAAC,GAAA,KAA2B;AACzC,QAAA,IAAI,CAAC,gBAAA,IAAoB,CAAC,GAAA,EAAK;AAC7B,UAAA,OAAO,GAAA;AAAA,QACT;AAEA,QAAA,GAAA,CAAIG,kBAAO,CAAA,GAAI,GAAA,CAAIA,kBAAO,CAAA,EAAG,OAAA,GAAU,kBAAkB,KAAK,CAAA;AAE9D,QAAA,OAAO,GAAA;AAAA,MACT,CAAC,CAAA,EAAE;AAAA,MACH,IAAI,aAAA,EAAe;AACjB,QAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,QAAA,KAAA,MAAW,mBAAmB,aAAA,EAAe;AAE3C,UAAA,IAAI,eAAA,KAAoB,IAAA,IAAQ,eAAA,KAAoB,MAAA,EAAW;AAC7D,YAAA;AAAA,UACF;AAIA,UAAA,MAAM,SAAA,GAAY,gBAAgB,IAAA,EAAK;AAIvC,UAAA,IAAI,SAAA,CAAU,UAAU,CAAA,EAAG;AACzB,YAAA;AAAA,UACF;AACA,UAAA,IAAI,CAAC,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,EAAG;AAChC,YAAA,YAAA,CAAa,IAAI,SAAS,CAAA;AAC1B,YAAA,KAAA,IAAS,CAAA;AAAA,UACX;AAAA,QACF;AACA,QAAA,IAAI,QAAQ,CAAA,EAAG;AACb,UAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,CAAK,YAAY,CAAA,CACvC,GAAA,CAAI,CAAA,CAAA,KAAKC,yBAAA,CAAa,CAAC,CAAC,CAAA,CACxB,IAAA,CAAK,GAAG,CAAA;AACX,UAAA,gBAAA,GAAmB,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,UAAU,KAAK,GAAG,CAAA;AAAA,QACtD;AAAA,MACF;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,WAAA,GAAsB;AAC3B,IAAA,MAAM,SAAA,GAAYJ,eAAO,QAAA,EAAS;AAElC,IAAA,OAAOA,cAAA,CAAO,OAAA;AAAA,MACZA,eAAO,SAAA,EAAU;AAAA,MACjBA,eAAO,QAAA,CAAS;AAAA,QACd,MAAA,EAAQ;AAAA,UACN,SAAA,EAAW,KAAA;AAAA,UACX,MAAA,EAAQ,MAAA;AAAA,UACR,KAAA,EAAO,MAAA;AAAA,UACP,KAAA,EAAO;AAAA;AACT,OACD,CAAA;AAAA,MACDA,cAAA,CAAO,MAAA,CAAO,CAAC,IAAA,KAA4B;AACzC,QAAA,MAAM,EAAE,WAAW,KAAA,EAAO,OAAA,EAAS,QAAQ,OAAA,EAAS,GAAG,QAAO,GAAI,IAAA;AAClE,QAAA,MAAM,SAAS,MAAA,IAAU,OAAA;AACzB,QAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,QAAA,CAAS,WAAA,EAAa,SAAS,CAAA;AAChE,QAAA,MAAM,WAAA,GAAc,SAAA,CAAU,QAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAEvD,QAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CACtC,IAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AACrB,UAAA,IAAI,WAAA,GAAc,EAAA;AAElB,UAAA,IAAI;AACF,YAAA,WAAA,GAAc,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,UACpC,SAAS,CAAA,EAAG;AACV,YAAA,WAAA,GAAc,sCAAA;AAAA,UAChB;AAEA,UAAA,OAAO,CAAA,EAAG,UAAU,QAAA,CAAS,OAAA,EAAS,GAAG,GAAG,CAAA,CAAE,CAAC,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,QAChE,CAAC,CAAA,CACA,IAAA,CAAK,GAAG,CAAA;AAEX,QAAA,OAAO,CAAA,EAAG,cAAc,CAAA,CAAA,EAAI,WAAW,IAAI,KAAK,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,MAC5E,CAAC;AAAA,KACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,eACL,eAAA,EAIA;AACA,IAAA,MAAM,YAGA,EAAC;AAEP,IAAA,OAAO;AAAA,MACL,MAAA,EAAQA,eAAO,CAAA,GAAA,KAAO;AACpB,QAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,UAAA,IAAI,QAAA,CAAS,SAAA,CAAU,GAAG,CAAA,EAAG;AAG3B,YAAA,IAAIK,oBAAc,GAAA,CAAI,KAAK,IAAIA,mBAAA,CAAc,QAAA,CAAS,KAAK,CAAA,EAAG;AAC5D,cAAA,OAAO,KAAA;AAAA,YACT;AAEA,YAAA,OAAO,GAAA;AAAA,UACT;AAAA,QACF;AAIA,QAAA,IAAIA,oBAAc,GAAA,CAAI,KAAK,CAAA,GAAIA,mBAAA,CAAc,eAAe,CAAA,EAAG;AAC7D,UAAA,OAAO,KAAA;AAAA,QACT;AAEA,QAAA,OAAO,GAAA;AAAA,MACT,CAAC,CAAA,EAAE;AAAA,MACH,cAAc,CAAA,YAAA,KAAgB;AAC5B,QAAA,MAAM,sBAAA,GAAyB,YAAA,CAAa,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACpD,SAAA,EAAWC,sBAAA,CAAiB,CAAA,CAAE,QAAQ,CAAA;AAAA,UACtC,OAAO,CAAA,CAAE;AAAA,SACX,CAAE,CAAA;AAEF,QAAA,SAAA,CAAU,MAAA,CAAO,CAAA,EAAG,SAAA,CAAU,MAAA,EAAQ,GAAG,sBAAsB,CAAA;AAAA,MACjE;AAAA,KACF;AAAA,EACF;AAAA,EAEQ,WAAA,CACN,OAAA,EACA,aAAA,EACA,iBAAA,EACA;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,cAAA,GAAiB,aAAA;AACtB,IAAA,IAAA,CAAK,kBAAA,GAAqB,iBAAA;AAAA,EAC5B;AAAA,EAEA,KAAA,CAAM,SAAiB,IAAA,EAAyB;AAC9C,IAAA,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,OAAA,EAAS,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,IAAA,CAAK,SAAiB,IAAA,EAAyB;AAC7C,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAAA,EAClC;AAAA,EAEA,IAAA,CAAK,SAAiB,IAAA,EAAyB;AAC7C,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,IAAI,CAAA;AAAA,EAClC;AAAA,EAEA,KAAA,CAAM,SAAiB,IAAA,EAAyB;AAC9C,IAAA,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,OAAA,EAAS,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAA,EAAiC;AACrC,IAAA,OAAO,IAAI,aAAA,CAAc,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,EACpD;AAAA,EAEA,cAAc,UAAA,EAA8B;AAC1C,IAAA,IAAA,CAAK,iBAAiB,UAAU,CAAA;AAAA,EAClC;AAAA,EAEA,kBAAkB,SAAA,EAAyC;AACzD,IAAA,IAAA,CAAK,qBAAqB,SAAS,CAAA;AAAA,EACrC;AACF;;;;"}

package/dist/entrypoints/rootLogger/config.cjs.js

@@ -0,0 +1,32 @@
+'use strict';
+
+var types = require('./types.cjs.js');
+
+const getRootLoggerConfig = (config) => {
+  const level = config.getOptionalString("backend.logger.level");
+  const meta = config.getOptionalConfig("backend.logger.meta")?.get();
+  const overridesConfig = config.getOptionalConfigArray(
+    "backend.logger.overrides"
+  );
+  const overrides = overridesConfig?.map((override, i) => {
+    const overrideLevel = override.getString("level");
+    if (types.winstonLevels[overrideLevel] === void 0) {
+      throw new Error(
+        `Invalid config at backend.logger.overrides[${i}].level, '${overrideLevel}' is not a valid logging level, must be one of 'error', 'warn', 'info' or 'debug'.`
+      );
+    }
+    const matchers = override.getConfig("matchers").get();
+    return {
+      matchers,
+      level: overrideLevel
+    };
+  });
+  return {
+    meta,
+    level,
+    overrides
+  };
+};
+
+exports.getRootLoggerConfig = getRootLoggerConfig;
+//# sourceMappingURL=config.cjs.js.map

package/dist/entrypoints/rootLogger/config.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.cjs.js","sources":["../../../src/entrypoints/rootLogger/config.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { RootConfigService } from '@backstage/backend-plugin-api';\nimport { JsonObject } from '@backstage/types';\nimport {\n  RootLoggerConfig,\n  winstonLevels,\n  WinstonLoggerLevelOverrideMatchers,\n} from './types';\n\nexport const getRootLoggerConfig = (\n  config: RootConfigService,\n): RootLoggerConfig => {\n  const level = config.getOptionalString('backend.logger.level');\n  const meta = config\n    .getOptionalConfig('backend.logger.meta')\n    ?.get<JsonObject>();\n\n  const overridesConfig = config.getOptionalConfigArray(\n    'backend.logger.overrides',\n  );\n  const overrides = overridesConfig?.map((override, i) => {\n    const overrideLevel = override.getString('level');\n    if (winstonLevels[overrideLevel] === undefined) {\n      throw new Error(\n        `Invalid config at backend.logger.overrides[${i}].level, '${overrideLevel}' is not a valid logging level, must be one of 'error', 'warn', 'info' or 'debug'.`,\n      );\n    }\n\n    const matchers = override\n      .getConfig('matchers')\n      .get<WinstonLoggerLevelOverrideMatchers>();\n\n    return {\n      matchers,\n      level: overrideLevel,\n    };\n  });\n\n  return {\n    meta,\n    level,\n    overrides,\n  };\n};\n"],"names":["winstonLevels"],"mappings":";;;;AAuBO,MAAM,mBAAA,GAAsB,CACjC,MAAA,KACqB;AACrB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,iBAAA,CAAkB,sBAAsB,CAAA;AAC7D,EAAA,MAAM,IAAA,GAAO,MAAA,CACV,iBAAA,CAAkB,qBAAqB,GACtC,GAAA,EAAgB;AAEpB,EAAA,MAAM,kBAAkB,MAAA,CAAO,sBAAA;AAAA,IAC7B;AAAA,GACF;AACA,EAAA,MAAM,SAAA,GAAY,eAAA,EAAiB,GAAA,CAAI,CAAC,UAAU,CAAA,KAAM;AACtD,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,SAAA,CAAU,OAAO,CAAA;AAChD,IAAA,IAAIA,mBAAA,CAAc,aAAa,CAAA,KAAM,MAAA,EAAW;AAC9C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,2CAAA,EAA8C,CAAC,CAAA,UAAA,EAAa,aAAa,CAAA,kFAAA;AAAA,OAC3E;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CACd,SAAA,CAAU,UAAU,EACpB,GAAA,EAAwC;AAE3C,IAAA,OAAO;AAAA,MACL,QAAA;AAAA,MACA,KAAA,EAAO;AAAA,KACT;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,KAAA;AAAA,IACA;AAAA,GACF;AACF;;;;"}

package/dist/entrypoints/rootLogger/rootLoggerServiceFactory.cjs.js

@@ -2,26 +2,33 @@
 
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var winston = require('winston');
-var WinstonLogger = require('./WinstonLogger.cjs.js');
 var createConfigSecretEnumerator = require('../rootConfig/createConfigSecretEnumerator.cjs.js');
+var WinstonLogger = require('./WinstonLogger.cjs.js');
+var config = require('./config.cjs.js');
 
 const rootLoggerServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.rootLogger,
   deps: {
     config: backendPluginApi.coreServices.rootConfig
   },
-  async factory({ config }) {
+  async factory({ config: config$1 }) {
+    const rootLoggerConfig = config.getRootLoggerConfig(config$1);
     const logger = WinstonLogger.WinstonLogger.create({
       meta: {
-        service: "backstage"
+        service: "backstage",
+        ...rootLoggerConfig.meta
       },
-      level: process.env.LOG_LEVEL || "info",
+      level: process.env.LOG_LEVEL || rootLoggerConfig.level || "info",
       format: process.env.NODE_ENV === "production" ? winston.format.json() : WinstonLogger.WinstonLogger.colorFormat(),
       transports: [new winston.transports.Console()]
     });
     const secretEnumerator = await createConfigSecretEnumerator.createConfigSecretEnumerator({ logger });
-    logger.addRedactions(secretEnumerator(config));
-    config.subscribe?.(() => logger.addRedactions(secretEnumerator(config)));
+    logger.addRedactions(secretEnumerator(config$1));
+    config$1.subscribe?.(() => logger.addRedactions(secretEnumerator(config$1)));
+    logger.setLevelOverrides(rootLoggerConfig.overrides ?? []);
+    config$1.subscribe?.(
+      () => logger.setLevelOverrides(config.getRootLoggerConfig(config$1).overrides ?? [])
+    );
     return logger;
   }
 });

package/dist/entrypoints/rootLogger/rootLoggerServiceFactory.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"rootLoggerServiceFactory.cjs.js","sources":["../../../src/entrypoints/rootLogger/rootLoggerServiceFactory.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createServiceFactory,\n  coreServices,\n} from '@backstage/backend-plugin-api';\nimport { transports, format } from 'winston';\nimport { WinstonLogger } from '../rootLogger/WinstonLogger';\nimport { createConfigSecretEnumerator } from '../rootConfig/createConfigSecretEnumerator';\n\n/**\n * Root-level logging.\n *\n * See {@link @backstage/backend-plugin-api#RootLoggerService}\n * and {@link https://backstage.io/docs/backend-system/core-services/root-logger | the service docs}\n * for more information.\n *\n * @public\n */\nexport const rootLoggerServiceFactory = createServiceFactory({\n  service: coreServices.rootLogger,\n  deps: {\n    config: coreServices.rootConfig,\n  },\n  async factory({ config }) {\n    const logger = WinstonLogger.create({\n      meta: {\n        service: 'backstage',\n      },\n      level: process.env.LOG_LEVEL || 'info',\n      format:\n        process.env.NODE_ENV === 'production'\n          ? format.json()\n          : WinstonLogger.colorFormat(),\n      transports: [new transports.Console()],\n    });\n\n    const secretEnumerator = await createConfigSecretEnumerator({ logger });\n    logger.addRedactions(secretEnumerator(config));\n    config.subscribe?.(() => logger.addRedactions(secretEnumerator(config)));\n\n    return logger;\n  },\n});\n"],"names":["createServiceFactory","coreServices","WinstonLogger","format","transports","createConfigSecretEnumerator"],"mappings":";;;;;;;AAiCO,MAAM,2BAA2BA,qCAAA,CAAqB;AAAA,EAC3D,SAASC,6BAAA,CAAa,UAAA;AAAA,EACtB,IAAA,EAAM;AAAA,IACJ,QAAQA,6BAAA,CAAa;AAAA,GACvB;AAAA,EACA,MAAM,OAAA,CAAQ,EAAE,MAAA,EAAO,EAAG;AACxB,IAAA,MAAM,MAAA,GAASC,4BAAc,MAAA,CAAO;AAAA,MAClC,IAAA,EAAM;AAAA,QACJ,OAAA,EAAS;AAAA,OACX;AAAA,MACA,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,MAAA;AAAA,MAChC,MAAA,EACE,QAAQ,GAAA,CAAI,QAAA,KAAa,eACrBC,cAAA,CAAO,IAAA,EAAK,GACZD,2BAAA,CAAc,WAAA,EAAY;AAAA,MAChC,UAAA,EAAY,CAAC,IAAIE,kBAAA,CAAW,SAAS;AAAA,KACtC,CAAA;AAED,IAAA,MAAM,gBAAA,GAAmB,MAAMC,yDAAA,CAA6B,EAAE,QAAQ,CAAA;AACtE,IAAA,MAAA,CAAO,aAAA,CAAc,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAC7C,IAAA,MAAA,CAAO,YAAY,MAAM,MAAA,CAAO,cAAc,gBAAA,CAAiB,MAAM,CAAC,CAAC,CAAA;AAEvE,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAC;;;;"}
+{"version":3,"file":"rootLoggerServiceFactory.cjs.js","sources":["../../../src/entrypoints/rootLogger/rootLoggerServiceFactory.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createServiceFactory,\n} from '@backstage/backend-plugin-api';\nimport { format, transports } from 'winston';\nimport { createConfigSecretEnumerator } from '../rootConfig/createConfigSecretEnumerator';\nimport { WinstonLogger } from '../rootLogger/WinstonLogger';\nimport { getRootLoggerConfig } from './config';\n\n/**\n * Root-level logging.\n *\n * See {@link @backstage/backend-plugin-api#RootLoggerService}\n * and {@link https://backstage.io/docs/backend-system/core-services/root-logger | the service docs}\n * for more information.\n *\n * @public\n */\nexport const rootLoggerServiceFactory = createServiceFactory({\n  service: coreServices.rootLogger,\n  deps: {\n    config: coreServices.rootConfig,\n  },\n  async factory({ config }) {\n    const rootLoggerConfig = getRootLoggerConfig(config);\n\n    const logger = WinstonLogger.create({\n      meta: {\n        service: 'backstage',\n        ...rootLoggerConfig.meta,\n      },\n      level: process.env.LOG_LEVEL || rootLoggerConfig.level || 'info',\n      format:\n        process.env.NODE_ENV === 'production'\n          ? format.json()\n          : WinstonLogger.colorFormat(),\n      transports: [new transports.Console()],\n    });\n\n    const secretEnumerator = await createConfigSecretEnumerator({ logger });\n    logger.addRedactions(secretEnumerator(config));\n    config.subscribe?.(() => logger.addRedactions(secretEnumerator(config)));\n\n    logger.setLevelOverrides(rootLoggerConfig.overrides ?? []);\n    config.subscribe?.(() =>\n      logger.setLevelOverrides(getRootLoggerConfig(config).overrides ?? []),\n    );\n\n    return logger;\n  },\n});\n"],"names":["createServiceFactory","coreServices","config","getRootLoggerConfig","WinstonLogger","format","transports","createConfigSecretEnumerator"],"mappings":";;;;;;;;AAkCO,MAAM,2BAA2BA,qCAAA,CAAqB;AAAA,EAC3D,SAASC,6BAAA,CAAa,UAAA;AAAA,EACtB,IAAA,EAAM;AAAA,IACJ,QAAQA,6BAAA,CAAa;AAAA,GACvB;AAAA,EACA,MAAM,OAAA,CAAQ,UAAEC,QAAA,EAAO,EAAG;AACxB,IAAA,MAAM,gBAAA,GAAmBC,2BAAoBD,QAAM,CAAA;AAEnD,IAAA,MAAM,MAAA,GAASE,4BAAc,MAAA,CAAO;AAAA,MAClC,IAAA,EAAM;AAAA,QACJ,OAAA,EAAS,WAAA;AAAA,QACT,GAAG,gBAAA,CAAiB;AAAA,OACtB;AAAA,MACA,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,iBAAiB,KAAA,IAAS,MAAA;AAAA,MAC1D,MAAA,EACE,QAAQ,GAAA,CAAI,QAAA,KAAa,eACrBC,cAAA,CAAO,IAAA,EAAK,GACZD,2BAAA,CAAc,WAAA,EAAY;AAAA,MAChC,UAAA,EAAY,CAAC,IAAIE,kBAAA,CAAW,SAAS;AAAA,KACtC,CAAA;AAED,IAAA,MAAM,gBAAA,GAAmB,MAAMC,yDAAA,CAA6B,EAAE,QAAQ,CAAA;AACtE,IAAA,MAAA,CAAO,aAAA,CAAc,gBAAA,CAAiBL,QAAM,CAAC,CAAA;AAC7C,IAAAA,QAAA,CAAO,YAAY,MAAM,MAAA,CAAO,cAAc,gBAAA,CAAiBA,QAAM,CAAC,CAAC,CAAA;AAEvE,IAAA,MAAA,CAAO,iBAAA,CAAkB,gBAAA,CAAiB,SAAA,IAAa,EAAE,CAAA;AACzD,IAAAA,QAAA,CAAO,SAAA;AAAA,MAAY,MACjB,OAAO,iBAAA,CAAkBC,0BAAA,CAAoBD,QAAM,CAAA,CAAE,SAAA,IAAa,EAAE;AAAA,KACtE;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAC;;;;"}

package/dist/entrypoints/rootLogger/types.cjs.js

@@ -0,0 +1,8 @@
+'use strict';
+
+var winston = require('winston');
+
+const winstonLevels = winston.config.npm.levels;
+
+exports.winstonLevels = winstonLevels;
+//# sourceMappingURL=types.cjs.js.map

package/dist/entrypoints/rootLogger/types.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.cjs.js","sources":["../../../src/entrypoints/rootLogger/types.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { JsonObject, JsonPrimitive } from '@backstage/types';\nimport { config as winstonConfig } from 'winston';\n\n/**\n * @public\n */\nexport type WinstonLoggerLevelOverrideMatchers = {\n  [key: string]: JsonPrimitive | JsonPrimitive[] | undefined;\n};\n\n/**\n * @public\n */\nexport type WinstonLoggerLevelOverride = {\n  matchers: WinstonLoggerLevelOverrideMatchers;\n  level: string;\n};\n\nexport type RootLoggerConfig = {\n  level?: string;\n  meta?: JsonObject;\n  overrides?: WinstonLoggerLevelOverride[];\n};\n\nexport const winstonLevels = winstonConfig.npm.levels;\n"],"names":["winstonConfig"],"mappings":";;;;AAuCO,MAAM,aAAA,GAAgBA,eAAc,GAAA,CAAI;;;;"}

package/dist/entrypoints/rootLogger/utils.cjs.js

@@ -0,0 +1,38 @@
+'use strict';
+
+const parseRegex = (s) => {
+  if (!s.startsWith("/")) return null;
+  const lastSlash = s.lastIndexOf("/");
+  if (lastSlash <= 0) return null;
+  const pattern = s.slice(1, lastSlash);
+  const flags = s.slice(lastSlash + 1);
+  try {
+    return new RegExp(pattern, flags);
+  } catch {
+    return null;
+  }
+};
+const createLogFieldMatcher = (matcher) => {
+  if (Array.isArray(matcher)) {
+    const fns = matcher.map((m) => createLogFieldMatcher(m));
+    return (logField) => fns.some((fn) => fn(logField));
+  }
+  if (typeof matcher !== "string") {
+    return (logField) => logField === matcher;
+  }
+  const regex = parseRegex(matcher);
+  if (regex) {
+    return (logField) => typeof logField === "string" && regex.test(logField);
+  }
+  return (logField) => logField === matcher;
+};
+const createLogMatcher = (matchers) => {
+  const logFieldMatchers = Object.entries(matchers).map(([key, m]) => {
+    const fn = createLogFieldMatcher(m);
+    return [key, fn];
+  });
+  return (log) => logFieldMatchers.every(([key, fn]) => fn(log[key]));
+};
+
+exports.createLogMatcher = createLogMatcher;
+//# sourceMappingURL=utils.cjs.js.map

package/dist/entrypoints/rootLogger/utils.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.cjs.js","sources":["../../../src/entrypoints/rootLogger/utils.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { TransformableInfo } from 'logform';\nimport { WinstonLoggerLevelOverrideMatchers } from './types';\n\n/** Parse a slash-delimited regex like `/pattern/flags` into a RegExp, or null if not a regex-string */\nconst parseRegex = (s: string): RegExp | null => {\n  if (!s.startsWith('/')) return null;\n  const lastSlash = s.lastIndexOf('/');\n  if (lastSlash <= 0) return null;\n\n  const pattern = s.slice(1, lastSlash);\n  const flags = s.slice(lastSlash + 1);\n\n  try {\n    return new RegExp(pattern, flags);\n  } catch {\n    return null; // fall back to treating it as a plain string\n  }\n};\n\n/**\n * Create a predicate function that determines whether a log field matches a given matcher.\n *\n * The matcher can be:\n * - A string (exact match or regex pattern delimited by slashes, e.g. `/pattern/`)\n * - A non-string value (compared by strict equality)\n * - An array of matchers (returns true if any matcher matches)\n *\n * @param matcher - The matcher or array of matchers to compare against the log field.\n * @returns A function that takes a log field and returns `true` if it matches the matcher, otherwise `false`.\n */\nconst createLogFieldMatcher = (\n  matcher: WinstonLoggerLevelOverrideMatchers[0],\n): ((logField: unknown) => boolean) => {\n  // Array of matchers: create predicates for each element and OR them together\n  if (Array.isArray(matcher)) {\n    const fns = matcher.map(m => createLogFieldMatcher(m));\n    return (logField: unknown) => fns.some(fn => fn(logField));\n  }\n\n  // Non-string matcher: strict equality\n  if (typeof matcher !== 'string') {\n    return (logField: unknown) => logField === matcher;\n  }\n\n  // String matcher: maybe a slash-delimited regex (/pattern/flags)\n  const regex = parseRegex(matcher);\n  if (regex) {\n    return (logField: unknown) =>\n      typeof logField === 'string' && regex.test(logField);\n  }\n\n  // Plain string matcher: strict equality\n  return (logField: unknown) => logField === matcher;\n};\n\n/**\n * Create a predicate function that determines whether a log entry matches\n * all specified override matchers.\n *\n * Iterates over each key-matcher pair in the provided `matchers` object,\n * retrieves the corresponding field from the `log` object, and checks if\n * the field matches the matcher using `isLogFieldMatching`. Returns `true`\n * only if all matchers are satisfied.\n *\n * @param matchers - An object where each key corresponds to a log field and each value is a matcher to test against that field.\n * @returns A function that takes a log entry and returns `true` if it matches all specified matchers, otherwise `false`.\n */\nexport const createLogMatcher = (\n  matchers: WinstonLoggerLevelOverrideMatchers,\n): ((log: TransformableInfo) => boolean) => {\n  const logFieldMatchers = Object.entries(matchers).map(([key, m]) => {\n    const fn = createLogFieldMatcher(m);\n    return [key, fn] as const;\n  });\n\n  return (log: TransformableInfo) =>\n    logFieldMatchers.every(([key, fn]) => fn(log[key]));\n};\n"],"names":[],"mappings":";;AAoBA,MAAM,UAAA,GAAa,CAAC,CAAA,KAA6B;AAC/C,EAAA,IAAI,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,GAAG,OAAO,IAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,WAAA,CAAY,GAAG,CAAA;AACnC,EAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAE3B,EAAA,MAAM,OAAA,GAAU,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AAEnC,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,MAAA,CAAO,OAAA,EAAS,KAAK,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AAaA,MAAM,qBAAA,GAAwB,CAC5B,OAAA,KACqC;AAErC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC1B,IAAA,MAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,qBAAA,CAAsB,CAAC,CAAC,CAAA;AACrD,IAAA,OAAO,CAAC,QAAA,KAAsB,GAAA,CAAI,KAAK,CAAA,EAAA,KAAM,EAAA,CAAG,QAAQ,CAAC,CAAA;AAAA,EAC3D;AAGA,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,CAAC,aAAsB,QAAA,KAAa,OAAA;AAAA,EAC7C;AAGA,EAAA,MAAM,KAAA,GAAQ,WAAW,OAAO,CAAA;AAChC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO,CAAC,QAAA,KACN,OAAO,aAAa,QAAA,IAAY,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,EACvD;AAGA,EAAA,OAAO,CAAC,aAAsB,QAAA,KAAa,OAAA;AAC7C,CAAA;AAcO,MAAM,gBAAA,GAAmB,CAC9B,QAAA,KAC0C;AAC1C,EAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,CAAE,IAAI,CAAC,CAAC,GAAA,EAAK,CAAC,CAAA,KAAM;AAClE,IAAA,MAAM,EAAA,GAAK,sBAAsB,CAAC,CAAA;AAClC,IAAA,OAAO,CAAC,KAAK,EAAE,CAAA;AAAA,EACjB,CAAC,CAAA;AAED,EAAA,OAAO,CAAC,GAAA,KACN,gBAAA,CAAiB,KAAA,CAAM,CAAC,CAAC,GAAA,EAAK,EAAE,CAAA,KAAM,EAAA,CAAG,GAAA,CAAI,GAAG,CAAC,CAAC,CAAA;AACtD;;;;"}

package/dist/entrypoints/urlReader/lib/FetchUrlReader.cjs.js

@@ -8,6 +8,8 @@ function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'defau
 
 var platformPath__default = /*#__PURE__*/_interopDefaultCompat(platformPath);
 
+const REDIRECT_STATUS_CODES = [301, 302, 307, 308];
+const MAX_REDIRECTS = 5;
 const isInRange = (num, [start, end]) => {
   return num >= start && num <= end;
 };
@@ -36,6 +38,26 @@ const parsePortPredicate = (port) => {
   }
   return (url) => !url.port;
 };
+function predicateFromConfig(config) {
+  const allow = config.getOptionalConfigArray("backend.reading.allow")?.map((allowConfig) => {
+    const paths = allowConfig.getOptionalStringArray("paths");
+    const checkPath = paths ? (url) => {
+      const targetPath = platformPath__default.default.posix.normalize(url.pathname);
+      return paths.some(
+        (allowedPath) => targetPath.startsWith(allowedPath)
+      );
+    } : (_url) => true;
+    const host = allowConfig.getString("host");
+    const [hostname, port] = host.split(":");
+    const checkPort = parsePortPredicate(port);
+    if (hostname.startsWith("*.")) {
+      const suffix = hostname.slice(1);
+      return (url) => url.hostname.endsWith(suffix) && checkPath(url) && checkPort(url);
+    }
+    return (url) => url.hostname === hostname && checkPath(url) && checkPort(url);
+  });
+  return allow?.length ? (url) => allow.some((p) => p(url)) : () => false;
+}
 class FetchUrlReader {
   /**
    * The factory creates a single reader that will be used for reading any URL that's listed
@@ -50,64 +72,72 @@ class FetchUrlReader {
    *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.
    */
   static factory = ({ config }) => {
-    const predicates = config.getOptionalConfigArray("backend.reading.allow")?.map((allowConfig) => {
-      const paths = allowConfig.getOptionalStringArray("paths");
-      const checkPath = paths ? (url) => {
-        const targetPath = platformPath__default.default.posix.normalize(url.pathname);
-        return paths.some(
-          (allowedPath) => targetPath.startsWith(allowedPath)
-        );
-      } : (_url) => true;
-      const host = allowConfig.getString("host");
-      const [hostname, port] = host.split(":");
-      const checkPort = parsePortPredicate(port);
-      if (hostname.startsWith("*.")) {
-        const suffix = hostname.slice(1);
-        return (url) => url.hostname.endsWith(suffix) && checkPath(url) && checkPort(url);
-      }
-      return (url) => url.hostname === hostname && checkPath(url) && checkPort(url);
-    }) ?? [];
-    const reader = new FetchUrlReader();
-    const predicate = (url) => predicates.some((p) => p(url));
+    const predicate = predicateFromConfig(config);
+    const reader = new FetchUrlReader({ predicate });
     return [{ reader, predicate }];
   };
+  static fromConfig(config) {
+    return new FetchUrlReader({ predicate: predicateFromConfig(config) });
+  }
+  #predicate;
+  constructor(options) {
+    this.#predicate = options.predicate;
+  }
   async read(url) {
     const response = await this.readUrl(url);
     return response.buffer();
   }
   async readUrl(url, options) {
-    let response;
-    try {
-      response = await fetch(url, {
-        headers: {
-          ...options?.etag && { "If-None-Match": options.etag },
-          ...options?.lastModifiedAfter && {
-            "If-Modified-Since": options.lastModifiedAfter.toUTCString()
+    let currentUrl = url;
+    for (let redirectCount = 0; redirectCount < MAX_REDIRECTS; redirectCount += 1) {
+      const parsedUrl = new URL(currentUrl);
+      if (!this.#predicate(parsedUrl)) {
+        throw new Error(
+          `URL not allowed by backend.reading.allow configuration: ${currentUrl}`
+        );
+      }
+      let response;
+      try {
+        response = await fetch(currentUrl, {
+          headers: {
+            ...options?.etag && { "If-None-Match": options.etag },
+            ...options?.lastModifiedAfter && {
+              "If-Modified-Since": options.lastModifiedAfter.toUTCString()
+            },
+            ...options?.token && { Authorization: `Bearer ${options.token}` }
           },
-          ...options?.token && { Authorization: `Bearer ${options.token}` }
-        },
-        // TODO(freben): The signal cast is there because pre-3.x versions of
-        // node-fetch have a very slightly deviating AbortSignal type signature.
-        // The difference does not affect us in practice however. The cast can
-        // be removed after we support ESM for CLI dependencies and migrate to
-        // version 3 of node-fetch.
-        // https://github.com/backstage/backstage/issues/8242
-        signal: options?.signal
-      });
-    } catch (e) {
-      throw new Error(`Unable to read ${url}, ${e}`);
-    }
-    if (response.status === 304) {
-      throw new errors.NotModifiedError();
-    }
-    if (response.ok) {
-      return ReadUrlResponseFactory.ReadUrlResponseFactory.fromResponse(response);
-    }
-    const message = `could not read ${url}, ${response.status} ${response.statusText}`;
-    if (response.status === 404) {
-      throw new errors.NotFoundError(message);
+          // Handle redirects manually to validate targets against the allowlist
+          redirect: "manual",
+          // TODO(freben): The signal cast is there because pre-3.x versions of
+          // node-fetch have a very slightly deviating AbortSignal type signature.
+          // The difference does not affect us in practice however. The cast can
+          // be removed after we support ESM for CLI dependencies and migrate to
+          // version 3 of node-fetch.
+          // https://github.com/backstage/backstage/issues/8242
+          signal: options?.signal
+        });
+      } catch (e) {
+        throw new Error(`Unable to read ${currentUrl}, ${e}`);
+      }
+      if (response.ok) {
+        return ReadUrlResponseFactory.ReadUrlResponseFactory.fromResponse(response);
+      }
+      if (response.status === 304) {
+        throw new errors.NotModifiedError();
+      }
+      const location = response.headers.get("location");
+      if (!REDIRECT_STATUS_CODES.includes(response.status) || !location) {
+        const message = `could not read ${currentUrl}, ${response.status} ${response.statusText}`;
+        if (response.status === 404) {
+          throw new errors.NotFoundError(message);
+        }
+        throw new Error(message);
+      }
+      currentUrl = new URL(location, currentUrl).toString();
     }
-    throw new Error(message);
+    throw new Error(
+      `Too many redirects (max ${MAX_REDIRECTS}) when reading ${url}`
+    );
   }
   async readTree() {
     throw new Error("FetchUrlReader does not implement readTree");

package/dist/entrypoints/urlReader/lib/FetchUrlReader.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"FetchUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/FetchUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport {\n  assertError,\n  NotFoundError,\n  NotModifiedError,\n} from '@backstage/errors';\nimport { ReaderFactory } from './types';\nimport path from 'path';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\n\nconst isInRange = (num: number, [start, end]: [number, number]) => {\n  return num >= start && num <= end;\n};\n\nconst parsePortRange = (port: string): [number, number] => {\n  const isRange = port.includes('-');\n  if (isRange) {\n    const range = port\n      .split('-')\n      .map(v => parseInt(v, 10))\n      .filter(Boolean) as [number, number];\n    if (range.length !== 2) throw new Error(`Port range is not valid: ${port}`);\n    const [start, end] = range;\n    if (start <= 0 || end <= 0 || start > end)\n      throw new Error(`Port range is not valid: [${start}, ${end}]`);\n    return range;\n  }\n  const parsedPort = parseInt(port, 10);\n  return [parsedPort, parsedPort];\n};\n\nconst parsePortPredicate = (port: string | undefined) => {\n  if (port) {\n    const range = parsePortRange(port);\n    return (url: URL) => {\n      if (url.port) return isInRange(parseInt(url.port, 10), range);\n\n      if (url.protocol === 'http:') return isInRange(80, range);\n      if (url.protocol === 'https:') return isInRange(443, range);\n      return false;\n    };\n  }\n  return (url: URL) => !url.port;\n};\n\n/**\n * A {@link @backstage/backend-plugin-api#UrlReaderService} that does a plain fetch of the URL.\n *\n * @public\n */\nexport class FetchUrlReader implements UrlReaderService {\n  /**\n   * The factory creates a single reader that will be used for reading any URL that's listed\n   * in configuration at `backend.reading.allow`. The allow list contains a list of objects describing\n   * targets to allow, containing the following fields:\n   *\n   * `host`:\n   *   Either full hostnames to match, or subdomain wildcard matchers with a leading '*'.\n   *   For example 'example.com' and '*.example.com' are valid values, 'prod.*.example.com' is not.\n   *\n   * `paths`:\n   *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.\n   */\n  static factory: ReaderFactory = ({ config }) => {\n    const predicates =\n      config\n        .getOptionalConfigArray('backend.reading.allow')\n        ?.map(allowConfig => {\n          const paths = allowConfig.getOptionalStringArray('paths');\n          const checkPath = paths\n            ? (url: URL) => {\n                const targetPath = path.posix.normalize(url.pathname);\n                return paths.some(allowedPath =>\n                  targetPath.startsWith(allowedPath),\n                );\n              }\n            : (_url: URL) => true;\n          const host = allowConfig.getString('host');\n          const [hostname, port] = host.split(':');\n\n          const checkPort = parsePortPredicate(port);\n\n          if (hostname.startsWith('*.')) {\n            const suffix = hostname.slice(1);\n            return (url: URL) =>\n              url.hostname.endsWith(suffix) && checkPath(url) && checkPort(url);\n          }\n          return (url: URL) =>\n            url.hostname === hostname && checkPath(url) && checkPort(url);\n        }) ?? [];\n\n    const reader = new FetchUrlReader();\n    const predicate = (url: URL) => predicates.some(p => p(url));\n    return [{ reader, predicate }];\n  };\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    let response: Response;\n    try {\n      response = await fetch(url, {\n        headers: {\n          ...(options?.etag && { 'If-None-Match': options.etag }),\n          ...(options?.lastModifiedAfter && {\n            'If-Modified-Since': options.lastModifiedAfter.toUTCString(),\n          }),\n          ...(options?.token && { Authorization: `Bearer ${options.token}` }),\n        },\n        // TODO(freben): The signal cast is there because pre-3.x versions of\n        // node-fetch have a very slightly deviating AbortSignal type signature.\n        // The difference does not affect us in practice however. The cast can\n        // be removed after we support ESM for CLI dependencies and migrate to\n        // version 3 of node-fetch.\n        // https://github.com/backstage/backstage/issues/8242\n        signal: options?.signal as any,\n      });\n    } catch (e) {\n      throw new Error(`Unable to read ${url}, ${e}`);\n    }\n\n    if (response.status === 304) {\n      throw new NotModifiedError();\n    }\n\n    if (response.ok) {\n      return ReadUrlResponseFactory.fromResponse(response);\n    }\n\n    const message = `could not read ${url}, ${response.status} ${response.statusText}`;\n    if (response.status === 404) {\n      throw new NotFoundError(message);\n    }\n    throw new Error(message);\n  }\n\n  async readTree(): Promise<UrlReaderServiceReadTreeResponse> {\n    throw new Error('FetchUrlReader does not implement readTree');\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { pathname } = new URL(url);\n\n    if (pathname.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (error) {\n      assertError(error);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    return 'fetch{}';\n  }\n}\n"],"names":["path","NotModifiedError","ReadUrlResponseFactory","NotFoundError","assertError"],"mappings":";;;;;;;;;;AAiCA,MAAM,YAAY,CAAC,GAAA,EAAa,CAAC,KAAA,EAAO,GAAG,CAAA,KAAwB;AACjE,EAAA,OAAO,GAAA,IAAO,SAAS,GAAA,IAAO,GAAA;AAChC,CAAA;AAEA,MAAM,cAAA,GAAiB,CAAC,IAAA,KAAmC;AACzD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,KAAA,GAAQ,IAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,CAAA,KAAK,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA,CACxB,OAAO,OAAO,CAAA;AACjB,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAE,CAAA;AAC1E,IAAA,MAAM,CAAC,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AACrB,IAAA,IAAI,KAAA,IAAS,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,KAAA,GAAQ,GAAA;AACpC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,KAAK,CAAA,EAAA,EAAK,GAAG,CAAA,CAAA,CAAG,CAAA;AAC/D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,IAAA,EAAM,EAAE,CAAA;AACpC,EAAA,OAAO,CAAC,YAAY,UAAU,CAAA;AAChC,CAAA;AAEA,MAAM,kBAAA,GAAqB,CAAC,IAAA,KAA6B;AACvD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAI,CAAA;AACjC,IAAA,OAAO,CAAC,GAAA,KAAa;AACnB,MAAA,IAAI,GAAA,CAAI,MAAM,OAAO,SAAA,CAAU,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAG,KAAK,CAAA;AAE5D,MAAA,IAAI,IAAI,QAAA,KAAa,OAAA,EAAS,OAAO,SAAA,CAAU,IAAI,KAAK,CAAA;AACxD,MAAA,IAAI,IAAI,QAAA,KAAa,QAAA,EAAU,OAAO,SAAA,CAAU,KAAK,KAAK,CAAA;AAC1D,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAA,KAAa,CAAC,GAAA,CAAI,IAAA;AAC5B,CAAA;AAOO,MAAM,cAAA,CAA2C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAatD,OAAO,OAAA,GAAyB,CAAC,EAAE,QAAO,KAAM;AAC9C,IAAA,MAAM,aACJ,MAAA,CACG,sBAAA,CAAuB,uBAAuB,CAAA,EAC7C,IAAI,CAAA,WAAA,KAAe;AACnB,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,sBAAA,CAAuB,OAAO,CAAA;AACxD,MAAA,MAAM,SAAA,GAAY,KAAA,GACd,CAAC,GAAA,KAAa;AACZ,QAAA,MAAM,UAAA,GAAaA,6BAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAI,QAAQ,CAAA;AACpD,QAAA,OAAO,KAAA,CAAM,IAAA;AAAA,UAAK,CAAA,WAAA,KAChB,UAAA,CAAW,UAAA,CAAW,WAAW;AAAA,SACnC;AAAA,MACF,CAAA,GACA,CAAC,IAAA,KAAc,IAAA;AACnB,MAAA,MAAM,IAAA,GAAO,WAAA,CAAY,SAAA,CAAU,MAAM,CAAA;AACzC,MAAA,MAAM,CAAC,QAAA,EAAU,IAAI,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAEvC,MAAA,MAAM,SAAA,GAAY,mBAAmB,IAAI,CAAA;AAEzC,MAAA,IAAI,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC7B,QAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA;AAC/B,QAAA,OAAO,CAAC,GAAA,KACN,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,MACpE;AACA,MAAA,OAAO,CAAC,QACN,GAAA,CAAI,QAAA,KAAa,YAAY,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IAChE,CAAC,KAAK,EAAC;AAEX,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,EAAe;AAClC,IAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KAAa,UAAA,CAAW,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,GAAG,CAAC,CAAA;AAC3D,IAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAAA,EAC/B,CAAA;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,MAAM,GAAA,EAAK;AAAA,QAC1B,OAAA,EAAS;AAAA,UACP,GAAI,OAAA,EAAS,IAAA,IAAQ,EAAE,eAAA,EAAiB,QAAQ,IAAA,EAAK;AAAA,UACrD,GAAI,SAAS,iBAAA,IAAqB;AAAA,YAChC,mBAAA,EAAqB,OAAA,CAAQ,iBAAA,CAAkB,WAAA;AAAY,WAC7D;AAAA,UACA,GAAI,SAAS,KAAA,IAAS,EAAE,eAAe,CAAA,OAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,CAAA;AAAG,SACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,QAAQ,OAAA,EAAS;AAAA,OAClB,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,IAC7B;AAEA,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,OAAOC,6CAAA,CAAuB,aAAa,QAAQ,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,OAAA,GAAU,kBAAkB,GAAG,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAChF,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,IAAIC,qBAAc,OAAO,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,EACzB;AAAA,EAEA,MAAM,QAAA,GAAsD;AAC1D,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,IAAI,IAAI,GAAG,CAAA;AAEhC,IAAA,IAAI,QAAA,CAAS,KAAA,CAAM,MAAM,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAAC,kBAAA,CAAY,KAAK,CAAA;AACjB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"FetchUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/FetchUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport {\n  assertError,\n  NotFoundError,\n  NotModifiedError,\n} from '@backstage/errors';\nimport { ReaderFactory } from './types';\nimport path from 'path';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { Config } from '@backstage/config';\n\nconst REDIRECT_STATUS_CODES = [301, 302, 307, 308];\nconst MAX_REDIRECTS = 5;\n\nconst isInRange = (num: number, [start, end]: [number, number]) => {\n  return num >= start && num <= end;\n};\n\nconst parsePortRange = (port: string): [number, number] => {\n  const isRange = port.includes('-');\n  if (isRange) {\n    const range = port\n      .split('-')\n      .map(v => parseInt(v, 10))\n      .filter(Boolean) as [number, number];\n    if (range.length !== 2) throw new Error(`Port range is not valid: ${port}`);\n    const [start, end] = range;\n    if (start <= 0 || end <= 0 || start > end)\n      throw new Error(`Port range is not valid: [${start}, ${end}]`);\n    return range;\n  }\n  const parsedPort = parseInt(port, 10);\n  return [parsedPort, parsedPort];\n};\n\nconst parsePortPredicate = (port: string | undefined) => {\n  if (port) {\n    const range = parsePortRange(port);\n    return (url: URL) => {\n      if (url.port) return isInRange(parseInt(url.port, 10), range);\n\n      if (url.protocol === 'http:') return isInRange(80, range);\n      if (url.protocol === 'https:') return isInRange(443, range);\n      return false;\n    };\n  }\n  return (url: URL) => !url.port;\n};\n\nfunction predicateFromConfig(config: Config): (url: URL) => boolean {\n  const allow = config\n    .getOptionalConfigArray('backend.reading.allow')\n    ?.map(allowConfig => {\n      const paths = allowConfig.getOptionalStringArray('paths');\n      const checkPath = paths\n        ? (url: URL) => {\n            const targetPath = path.posix.normalize(url.pathname);\n            return paths.some(allowedPath =>\n              targetPath.startsWith(allowedPath),\n            );\n          }\n        : (_url: URL) => true;\n      const host = allowConfig.getString('host');\n      const [hostname, port] = host.split(':');\n\n      const checkPort = parsePortPredicate(port);\n\n      if (hostname.startsWith('*.')) {\n        const suffix = hostname.slice(1);\n        return (url: URL) =>\n          url.hostname.endsWith(suffix) && checkPath(url) && checkPort(url);\n      }\n\n      return (url: URL) =>\n        url.hostname === hostname && checkPath(url) && checkPort(url);\n    });\n\n  return allow?.length ? url => allow.some(p => p(url)) : () => false;\n}\n\n/**\n * A {@link @backstage/backend-plugin-api#UrlReaderService} that does a plain fetch of the URL.\n *\n * @public\n */\nexport class FetchUrlReader implements UrlReaderService {\n  /**\n   * The factory creates a single reader that will be used for reading any URL that's listed\n   * in configuration at `backend.reading.allow`. The allow list contains a list of objects describing\n   * targets to allow, containing the following fields:\n   *\n   * `host`:\n   *   Either full hostnames to match, or subdomain wildcard matchers with a leading '*'.\n   *   For example 'example.com' and '*.example.com' are valid values, 'prod.*.example.com' is not.\n   *\n   * `paths`:\n   *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.\n   */\n  static factory: ReaderFactory = ({ config }) => {\n    const predicate = predicateFromConfig(config);\n    const reader = new FetchUrlReader({ predicate });\n    return [{ reader, predicate }];\n  };\n\n  static fromConfig(config: Config): FetchUrlReader {\n    return new FetchUrlReader({ predicate: predicateFromConfig(config) });\n  }\n\n  readonly #predicate: (url: URL) => boolean;\n\n  private constructor(options: { predicate: (url: URL) => boolean }) {\n    this.#predicate = options.predicate;\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    let currentUrl = url;\n\n    for (\n      let redirectCount = 0;\n      redirectCount < MAX_REDIRECTS;\n      redirectCount += 1\n    ) {\n      // Validate URL against predicate if configured\n      const parsedUrl = new URL(currentUrl);\n      if (!this.#predicate(parsedUrl)) {\n        throw new Error(\n          `URL not allowed by backend.reading.allow configuration: ${currentUrl}`,\n        );\n      }\n\n      let response: Response;\n      try {\n        response = await fetch(currentUrl, {\n          headers: {\n            ...(options?.etag && { 'If-None-Match': options.etag }),\n            ...(options?.lastModifiedAfter && {\n              'If-Modified-Since': options.lastModifiedAfter.toUTCString(),\n            }),\n            ...(options?.token && { Authorization: `Bearer ${options.token}` }),\n          },\n          // Handle redirects manually to validate targets against the allowlist\n          redirect: 'manual',\n          // TODO(freben): The signal cast is there because pre-3.x versions of\n          // node-fetch have a very slightly deviating AbortSignal type signature.\n          // The difference does not affect us in practice however. The cast can\n          // be removed after we support ESM for CLI dependencies and migrate to\n          // version 3 of node-fetch.\n          // https://github.com/backstage/backstage/issues/8242\n          signal: options?.signal as any,\n        });\n      } catch (e) {\n        throw new Error(`Unable to read ${currentUrl}, ${e}`);\n      }\n\n      if (response.ok) {\n        return ReadUrlResponseFactory.fromResponse(response);\n      }\n\n      if (response.status === 304) {\n        throw new NotModifiedError();\n      }\n\n      const location = response.headers.get('location');\n      if (!REDIRECT_STATUS_CODES.includes(response.status) || !location) {\n        const message = `could not read ${currentUrl}, ${response.status} ${response.statusText}`;\n        if (response.status === 404) {\n          throw new NotFoundError(message);\n        }\n        throw new Error(message);\n      }\n\n      // Follow the redirect\n      currentUrl = new URL(location, currentUrl).toString();\n    }\n\n    throw new Error(\n      `Too many redirects (max ${MAX_REDIRECTS}) when reading ${url}`,\n    );\n  }\n\n  async readTree(): Promise<UrlReaderServiceReadTreeResponse> {\n    throw new Error('FetchUrlReader does not implement readTree');\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { pathname } = new URL(url);\n\n    if (pathname.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (error) {\n      assertError(error);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    return 'fetch{}';\n  }\n}\n"],"names":["path","ReadUrlResponseFactory","NotModifiedError","NotFoundError","assertError"],"mappings":";;;;;;;;;;AAkCA,MAAM,qBAAA,GAAwB,CAAC,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AACjD,MAAM,aAAA,GAAgB,CAAA;AAEtB,MAAM,YAAY,CAAC,GAAA,EAAa,CAAC,KAAA,EAAO,GAAG,CAAA,KAAwB;AACjE,EAAA,OAAO,GAAA,IAAO,SAAS,GAAA,IAAO,GAAA;AAChC,CAAA;AAEA,MAAM,cAAA,GAAiB,CAAC,IAAA,KAAmC;AACzD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,KAAA,GAAQ,IAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,CAAA,KAAK,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA,CACxB,OAAO,OAAO,CAAA;AACjB,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAE,CAAA;AAC1E,IAAA,MAAM,CAAC,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AACrB,IAAA,IAAI,KAAA,IAAS,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,KAAA,GAAQ,GAAA;AACpC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,KAAK,CAAA,EAAA,EAAK,GAAG,CAAA,CAAA,CAAG,CAAA;AAC/D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,IAAA,EAAM,EAAE,CAAA;AACpC,EAAA,OAAO,CAAC,YAAY,UAAU,CAAA;AAChC,CAAA;AAEA,MAAM,kBAAA,GAAqB,CAAC,IAAA,KAA6B;AACvD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAI,CAAA;AACjC,IAAA,OAAO,CAAC,GAAA,KAAa;AACnB,MAAA,IAAI,GAAA,CAAI,MAAM,OAAO,SAAA,CAAU,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAG,KAAK,CAAA;AAE5D,MAAA,IAAI,IAAI,QAAA,KAAa,OAAA,EAAS,OAAO,SAAA,CAAU,IAAI,KAAK,CAAA;AACxD,MAAA,IAAI,IAAI,QAAA,KAAa,QAAA,EAAU,OAAO,SAAA,CAAU,KAAK,KAAK,CAAA;AAC1D,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAA,KAAa,CAAC,GAAA,CAAI,IAAA;AAC5B,CAAA;AAEA,SAAS,oBAAoB,MAAA,EAAuC;AAClE,EAAA,MAAM,QAAQ,MAAA,CACX,sBAAA,CAAuB,uBAAuB,CAAA,EAC7C,IAAI,CAAA,WAAA,KAAe;AACnB,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,sBAAA,CAAuB,OAAO,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,KAAA,GACd,CAAC,GAAA,KAAa;AACZ,MAAA,MAAM,UAAA,GAAaA,6BAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAI,QAAQ,CAAA;AACpD,MAAA,OAAO,KAAA,CAAM,IAAA;AAAA,QAAK,CAAA,WAAA,KAChB,UAAA,CAAW,UAAA,CAAW,WAAW;AAAA,OACnC;AAAA,IACF,CAAA,GACA,CAAC,IAAA,KAAc,IAAA;AACnB,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,SAAA,CAAU,MAAM,CAAA;AACzC,IAAA,MAAM,CAAC,QAAA,EAAU,IAAI,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAEvC,IAAA,MAAM,SAAA,GAAY,mBAAmB,IAAI,CAAA;AAEzC,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC7B,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA;AAC/B,MAAA,OAAO,CAAC,GAAA,KACN,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,CAAC,QACN,GAAA,CAAI,QAAA,KAAa,YAAY,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,EAChE,CAAC,CAAA;AAEH,EAAA,OAAO,KAAA,EAAO,MAAA,GAAS,CAAA,GAAA,KAAO,KAAA,CAAM,IAAA,CAAK,OAAK,CAAA,CAAE,GAAG,CAAC,CAAA,GAAI,MAAM,KAAA;AAChE;AAOO,MAAM,cAAA,CAA2C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAatD,OAAO,OAAA,GAAyB,CAAC,EAAE,QAAO,KAAM;AAC9C,IAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAAe,EAAE,WAAW,CAAA;AAC/C,IAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAAA,EAC/B,CAAA;AAAA,EAEA,OAAO,WAAW,MAAA,EAAgC;AAChD,IAAA,OAAO,IAAI,cAAA,CAAe,EAAE,WAAW,mBAAA,CAAoB,MAAM,GAAG,CAAA;AAAA,EACtE;AAAA,EAES,UAAA;AAAA,EAED,YAAY,OAAA,EAA+C;AACjE,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,SAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,IAAI,UAAA,GAAa,GAAA;AAEjB,IAAA,KAAA,IACM,aAAA,GAAgB,CAAA,EACpB,aAAA,GAAgB,aAAA,EAChB,iBAAiB,CAAA,EACjB;AAEA,MAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AACpC,MAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,2DAA2D,UAAU,CAAA;AAAA,SACvE;AAAA,MACF;AAEA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,MAAM,UAAA,EAAY;AAAA,UACjC,OAAA,EAAS;AAAA,YACP,GAAI,OAAA,EAAS,IAAA,IAAQ,EAAE,eAAA,EAAiB,QAAQ,IAAA,EAAK;AAAA,YACrD,GAAI,SAAS,iBAAA,IAAqB;AAAA,cAChC,mBAAA,EAAqB,OAAA,CAAQ,iBAAA,CAAkB,WAAA;AAAY,aAC7D;AAAA,YACA,GAAI,SAAS,KAAA,IAAS,EAAE,eAAe,CAAA,OAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,CAAA;AAAG,WACnE;AAAA;AAAA,UAEA,QAAA,EAAU,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOV,QAAQ,OAAA,EAAS;AAAA,SAClB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,UAAU,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,MACtD;AAEA,MAAA,IAAI,SAAS,EAAA,EAAI;AACf,QAAA,OAAOC,6CAAA,CAAuB,aAAa,QAAQ,CAAA;AAAA,MACrD;AAEA,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,qBAAA,CAAsB,QAAA,CAAS,SAAS,MAAM,CAAA,IAAK,CAAC,QAAA,EAAU;AACjE,QAAA,MAAM,OAAA,GAAU,kBAAkB,UAAU,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AACvF,QAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,UAAA,MAAM,IAAIC,qBAAc,OAAO,CAAA;AAAA,QACjC;AACA,QAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,MACzB;AAGA,MAAA,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,EAAE,QAAA,EAAS;AAAA,IACtD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,aAAa,CAAA,eAAA,EAAkB,GAAG,CAAA;AAAA,KAC/D;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAAsD;AAC1D,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,IAAI,IAAI,GAAG,CAAA;AAEhC,IAAA,IAAI,QAAA,CAAS,KAAA,CAAM,MAAM,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAAC,kBAAA,CAAY,KAAK,CAAA;AACjB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}

package/dist/entrypoints/urlReader/lib/tree/ReadableArrayResponse.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var backendPluginApi = require('@backstage/backend-plugin-api');
 var concatStream = require('concat-stream');
 var platformPath = require('path');
 var getRawBody = require('raw-body');
@@ -65,7 +66,7 @@ class ReadableArrayResponse {
     const dir = options?.targetDir ?? await fs__default.default.mkdtemp(platformPath__default.default.join(this.workDir, "backstage-"));
     for (let i = 0; i < this.stream.length; i++) {
       if (!this.stream[i].path.endsWith("/")) {
-        const filePath = platformPath__default.default.join(dir, this.stream[i].path);
+        const filePath = backendPluginApi.resolveSafeChildPath(dir, this.stream[i].path);
         await fs__default.default.mkdir(platformPath.dirname(filePath), { recursive: true });
         await pipeline(this.stream[i].data, fs__default.default.createWriteStream(filePath));
       }

package/dist/entrypoints/urlReader/lib/tree/ReadableArrayResponse.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReadableArrayResponse.cjs.js","sources":["../../../../../src/entrypoints/urlReader/lib/tree/ReadableArrayResponse.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadTreeResponseDirOptions,\n  UrlReaderServiceReadTreeResponseFile,\n} from '@backstage/backend-plugin-api';\nimport concatStream from 'concat-stream';\nimport platformPath, { dirname } from 'path';\nimport getRawBody from 'raw-body';\nimport fs from 'fs-extra';\nimport { promisify } from 'util';\nimport tar from 'tar';\nimport { pipeline as pipelineCb, Readable } from 'stream';\nimport { FromReadableArrayOptions } from '../types';\n\nconst pipeline = promisify(pipelineCb);\n\n/**\n * Wraps a array of Readable objects into a tree response reader.\n */\nexport class ReadableArrayResponse implements UrlReaderServiceReadTreeResponse {\n  private read = false;\n\n  constructor(\n    private readonly stream: FromReadableArrayOptions,\n    private readonly workDir: string,\n    public readonly etag: string,\n  ) {\n    this.etag = etag;\n  }\n\n  // Make sure the input stream is only read once\n  private onlyOnce() {\n    if (this.read) {\n      throw new Error('Response has already been read');\n    }\n    this.read = true;\n  }\n\n  async files(): Promise<UrlReaderServiceReadTreeResponseFile[]> {\n    this.onlyOnce();\n\n    const files = Array<UrlReaderServiceReadTreeResponseFile>();\n\n    for (let i = 0; i < this.stream.length; i++) {\n      if (!this.stream[i].path.endsWith('/')) {\n        files.push({\n          path: this.stream[i].path,\n          content: () => getRawBody(this.stream[i].data),\n          lastModifiedAt: this.stream[i]?.lastModifiedAt,\n        });\n      }\n    }\n\n    return files;\n  }\n\n  async archive(): Promise<NodeJS.ReadableStream> {\n    const tmpDir = await this.dir();\n\n    try {\n      const data = await new Promise<Buffer>(async resolve => {\n        await pipeline(\n          tar.create({ cwd: tmpDir }, ['']),\n          concatStream(resolve),\n        );\n      });\n      return Readable.from(data);\n    } finally {\n      await fs.remove(tmpDir);\n    }\n  }\n\n  async dir(\n    options?: UrlReaderServiceReadTreeResponseDirOptions,\n  ): Promise<string> {\n    this.onlyOnce();\n\n    const dir =\n      options?.targetDir ??\n      (await fs.mkdtemp(platformPath.join(this.workDir, 'backstage-')));\n\n    for (let i = 0; i < this.stream.length; i++) {\n      if (!this.stream[i].path.endsWith('/')) {\n        const filePath = platformPath.join(dir, this.stream[i].path);\n        await fs.mkdir(dirname(filePath), { recursive: true });\n        await pipeline(this.stream[i].data, fs.createWriteStream(filePath));\n      }\n    }\n\n    return dir;\n  }\n}\n"],"names":["promisify","pipelineCb","getRawBody","tar","concatStream","Readable","fs","platformPath","dirname"],"mappings":";;;;;;;;;;;;;;;;;;AA8BA,MAAM,QAAA,GAAWA,eAAUC,eAAU,CAAA;AAK9B,MAAM,qBAAA,CAAkE;AAAA,EAG7E,WAAA,CACmB,MAAA,EACA,OAAA,EACD,IAAA,EAChB;AAHiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACD,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAEhB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EARQ,IAAA,GAAO,KAAA;AAAA;AAAA,EAWP,QAAA,GAAW;AACjB,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAyD;AAC7D,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,QAAQ,KAAA,EAA4C;AAE1D,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AAC3C,MAAA,IAAI,CAAC,KAAK,MAAA,CAAO,CAAC,EAAE,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,IAAA,EAAM,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,CAAE,IAAA;AAAA,UACrB,SAAS,MAAMC,2BAAA,CAAW,KAAK,MAAA,CAAO,CAAC,EAAE,IAAI,CAAA;AAAA,UAC7C,cAAA,EAAgB,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG;AAAA,SACjC,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,GAA0C;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,EAAI;AAE9B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAI,OAAA,CAAgB,OAAM,OAAA,KAAW;AACtD,QAAA,MAAM,QAAA;AAAA,UACJC,oBAAA,CAAI,OAAO,EAAE,GAAA,EAAK,QAAO,EAAG,CAAC,EAAE,CAAC,CAAA;AAAA,UAChCC,8BAAa,OAAO;AAAA,SACtB;AAAA,MACF,CAAC,CAAA;AACD,MAAA,OAAOC,eAAA,CAAS,KAAK,IAAI,CAAA;AAAA,IAC3B,CAAA,SAAE;AACA,MAAA,MAAMC,mBAAA,CAAG,OAAO,MAAM,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,OAAA,EACiB;AACjB,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,GAAA,GACJ,OAAA,EAAS,SAAA,IACR,MAAMA,mBAAA,CAAG,OAAA,CAAQC,6BAAA,CAAa,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,YAAY,CAAC,CAAA;AAEjE,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AAC3C,MAAA,IAAI,CAAC,KAAK,MAAA,CAAO,CAAC,EAAE,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,QAAA,MAAM,QAAA,GAAWA,8BAAa,IAAA,CAAK,GAAA,EAAK,KAAK,MAAA,CAAO,CAAC,EAAE,IAAI,CAAA;AAC3D,QAAA,MAAMD,mBAAA,CAAG,MAAME,oBAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACrD,QAAA,MAAM,QAAA,CAAS,KAAK,MAAA,CAAO,CAAC,EAAE,IAAA,EAAMF,mBAAA,CAAG,iBAAA,CAAkB,QAAQ,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"ReadableArrayResponse.cjs.js","sources":["../../../../../src/entrypoints/urlReader/lib/tree/ReadableArrayResponse.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  resolveSafeChildPath,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadTreeResponseDirOptions,\n  UrlReaderServiceReadTreeResponseFile,\n} from '@backstage/backend-plugin-api';\nimport concatStream from 'concat-stream';\nimport platformPath, { dirname } from 'path';\nimport getRawBody from 'raw-body';\nimport fs from 'fs-extra';\nimport { promisify } from 'util';\nimport tar from 'tar';\nimport { pipeline as pipelineCb, Readable } from 'stream';\nimport { FromReadableArrayOptions } from '../types';\n\nconst pipeline = promisify(pipelineCb);\n\n/**\n * Wraps a array of Readable objects into a tree response reader.\n */\nexport class ReadableArrayResponse implements UrlReaderServiceReadTreeResponse {\n  private read = false;\n\n  constructor(\n    private readonly stream: FromReadableArrayOptions,\n    private readonly workDir: string,\n    public readonly etag: string,\n  ) {\n    this.etag = etag;\n  }\n\n  // Make sure the input stream is only read once\n  private onlyOnce() {\n    if (this.read) {\n      throw new Error('Response has already been read');\n    }\n    this.read = true;\n  }\n\n  async files(): Promise<UrlReaderServiceReadTreeResponseFile[]> {\n    this.onlyOnce();\n\n    const files = Array<UrlReaderServiceReadTreeResponseFile>();\n\n    for (let i = 0; i < this.stream.length; i++) {\n      if (!this.stream[i].path.endsWith('/')) {\n        files.push({\n          path: this.stream[i].path,\n          content: () => getRawBody(this.stream[i].data),\n          lastModifiedAt: this.stream[i]?.lastModifiedAt,\n        });\n      }\n    }\n\n    return files;\n  }\n\n  async archive(): Promise<NodeJS.ReadableStream> {\n    const tmpDir = await this.dir();\n\n    try {\n      const data = await new Promise<Buffer>(async resolve => {\n        await pipeline(\n          tar.create({ cwd: tmpDir }, ['']),\n          concatStream(resolve),\n        );\n      });\n      return Readable.from(data);\n    } finally {\n      await fs.remove(tmpDir);\n    }\n  }\n\n  async dir(\n    options?: UrlReaderServiceReadTreeResponseDirOptions,\n  ): Promise<string> {\n    this.onlyOnce();\n\n    const dir =\n      options?.targetDir ??\n      (await fs.mkdtemp(platformPath.join(this.workDir, 'backstage-')));\n\n    for (let i = 0; i < this.stream.length; i++) {\n      if (!this.stream[i].path.endsWith('/')) {\n        const filePath = resolveSafeChildPath(dir, this.stream[i].path);\n        await fs.mkdir(dirname(filePath), { recursive: true });\n        await pipeline(this.stream[i].data, fs.createWriteStream(filePath));\n      }\n    }\n\n    return dir;\n  }\n}\n"],"names":["promisify","pipelineCb","getRawBody","tar","concatStream","Readable","fs","platformPath","resolveSafeChildPath","dirname"],"mappings":";;;;;;;;;;;;;;;;;;;AA+BA,MAAM,QAAA,GAAWA,eAAUC,eAAU,CAAA;AAK9B,MAAM,qBAAA,CAAkE;AAAA,EAG7E,WAAA,CACmB,MAAA,EACA,OAAA,EACD,IAAA,EAChB;AAHiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACD,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAEhB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EARQ,IAAA,GAAO,KAAA;AAAA;AAAA,EAWP,QAAA,GAAW;AACjB,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAyD;AAC7D,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,QAAQ,KAAA,EAA4C;AAE1D,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AAC3C,MAAA,IAAI,CAAC,KAAK,MAAA,CAAO,CAAC,EAAE,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,QAAA,KAAA,CAAM,IAAA,CAAK;AAAA,UACT,IAAA,EAAM,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,CAAE,IAAA;AAAA,UACrB,SAAS,MAAMC,2BAAA,CAAW,KAAK,MAAA,CAAO,CAAC,EAAE,IAAI,CAAA;AAAA,UAC7C,cAAA,EAAgB,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG;AAAA,SACjC,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,GAA0C;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,EAAI;AAE9B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAI,OAAA,CAAgB,OAAM,OAAA,KAAW;AACtD,QAAA,MAAM,QAAA;AAAA,UACJC,oBAAA,CAAI,OAAO,EAAE,GAAA,EAAK,QAAO,EAAG,CAAC,EAAE,CAAC,CAAA;AAAA,UAChCC,8BAAa,OAAO;AAAA,SACtB;AAAA,MACF,CAAC,CAAA;AACD,MAAA,OAAOC,eAAA,CAAS,KAAK,IAAI,CAAA;AAAA,IAC3B,CAAA,SAAE;AACA,MAAA,MAAMC,mBAAA,CAAG,OAAO,MAAM,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,OAAA,EACiB;AACjB,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,GAAA,GACJ,OAAA,EAAS,SAAA,IACR,MAAMA,mBAAA,CAAG,OAAA,CAAQC,6BAAA,CAAa,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,YAAY,CAAC,CAAA;AAEjE,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AAC3C,MAAA,IAAI,CAAC,KAAK,MAAA,CAAO,CAAC,EAAE,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtC,QAAA,MAAM,WAAWC,qCAAA,CAAqB,GAAA,EAAK,KAAK,MAAA,CAAO,CAAC,EAAE,IAAI,CAAA;AAC9D,QAAA,MAAMF,mBAAA,CAAG,MAAMG,oBAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACrD,QAAA,MAAM,QAAA,CAAS,KAAK,MAAA,CAAO,CAAC,EAAE,IAAA,EAAMH,mBAAA,CAAG,iBAAA,CAAkB,QAAQ,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AACF;;;;"}

package/dist/entrypoints/urlReader/lib/tree/TarArchiveResponse.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var backendPluginApi = require('@backstage/backend-plugin-api');
 var concatStream = require('concat-stream');
 var fs = require('fs-extra');
 var platformPath = require('path');
@@ -115,6 +116,17 @@ class TarArchiveResponse {
           if (filterError) {
             return false;
           }
+          const entry = stat;
+          if ((entry.type === "SymbolicLink" || entry.type === "Link") && entry.linkpath) {
+            const strippedPath = path.split("/").slice(strip).join("/");
+            const linkDir = platformPath__default.default.dirname(
+              platformPath__default.default.join(dir, strippedPath)
+            );
+            const targetPath = platformPath__default.default.resolve(linkDir, entry.linkpath);
+            if (!backendPluginApi.isChildPath(dir, targetPath)) {
+              return false;
+            }
+          }
           const relativePath = this.stripFirstDirectory ? util$1.stripFirstDirectoryFromPath(path) : path;
           if (this.subPath && !relativePath.startsWith(this.subPath)) {
             return false;

package/dist/entrypoints/urlReader/lib/tree/TarArchiveResponse.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"TarArchiveResponse.cjs.js","sources":["../../../../../src/entrypoints/urlReader/lib/tree/TarArchiveResponse.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadTreeResponseDirOptions,\n  UrlReaderServiceReadTreeResponseFile,\n} from '@backstage/backend-plugin-api';\nimport concatStream from 'concat-stream';\nimport fs from 'fs-extra';\nimport platformPath from 'path';\nimport { pipeline as pipelineCb, Readable } from 'stream';\nimport tar, { Parse, ParseStream, ReadEntry } from 'tar';\nimport { promisify } from 'util';\nimport { stripFirstDirectoryFromPath } from './util';\n\n// Tar types for `Parse` is not a proper constructor, but it should be\nconst TarParseStream = Parse as unknown as { new (): ParseStream };\n\nconst pipeline = promisify(pipelineCb);\n\n/**\n * Wraps a tar archive stream into a tree response reader.\n */\nexport class TarArchiveResponse implements UrlReaderServiceReadTreeResponse {\n  private read = false;\n\n  constructor(\n    private readonly stream: Readable,\n    private readonly subPath: string,\n    private readonly workDir: string,\n    public readonly etag: string,\n    private readonly filter?: (path: string, info: { size: number }) => boolean,\n    private readonly stripFirstDirectory: boolean = true,\n  ) {\n    if (subPath) {\n      if (!subPath.endsWith('/')) {\n        this.subPath += '/';\n      }\n      if (subPath.startsWith('/')) {\n        throw new TypeError(\n          `TarArchiveResponse subPath must not start with a /, got '${subPath}'`,\n        );\n      }\n    }\n\n    this.etag = etag;\n  }\n\n  // Make sure the input stream is only read once\n  private onlyOnce() {\n    if (this.read) {\n      throw new Error('Response has already been read');\n    }\n    this.read = true;\n  }\n\n  async files(): Promise<UrlReaderServiceReadTreeResponseFile[]> {\n    this.onlyOnce();\n\n    const files = Array<UrlReaderServiceReadTreeResponseFile>();\n    const parser = new TarParseStream();\n\n    parser.on('entry', (entry: ReadEntry & Readable) => {\n      if (entry.type === 'Directory') {\n        entry.resume();\n        return;\n      }\n\n      // File path relative to the root extracted directory. Will remove the\n      // top level dir name from the path since its name is hard to predetermine.\n      const relativePath = this.stripFirstDirectory\n        ? stripFirstDirectoryFromPath(entry.path)\n        : entry.path;\n\n      if (this.subPath) {\n        if (!relativePath.startsWith(this.subPath)) {\n          entry.resume();\n          return;\n        }\n      }\n\n      const path = relativePath.slice(this.subPath.length);\n      if (this.filter) {\n        if (!this.filter(path, { size: entry.remain })) {\n          entry.resume();\n          return;\n        }\n      }\n\n      const content = new Promise<Buffer>(async resolve => {\n        await pipeline(entry, concatStream(resolve));\n      });\n\n      files.push({\n        path,\n        content: () => content,\n      });\n\n      entry.resume();\n    });\n\n    await pipeline(this.stream, parser);\n\n    return files;\n  }\n\n  async archive(): Promise<Readable> {\n    if (!this.subPath) {\n      this.onlyOnce();\n\n      return this.stream;\n    }\n\n    // TODO(Rugvip): method for repacking a tar with a subpath is to simply extract into a\n    //               tmp dir and recreate the archive. Would be nicer to stream things instead.\n    const tmpDir = await this.dir();\n\n    try {\n      const data = await new Promise<Buffer>(async resolve => {\n        await pipeline(\n          tar.create({ cwd: tmpDir }, ['']),\n          concatStream(resolve),\n        );\n      });\n      return Readable.from(data);\n    } finally {\n      await fs.remove(tmpDir);\n    }\n  }\n\n  async dir(\n    options?: UrlReaderServiceReadTreeResponseDirOptions,\n  ): Promise<string> {\n    this.onlyOnce();\n\n    const dir =\n      options?.targetDir ??\n      (await fs.mkdtemp(platformPath.join(this.workDir, 'backstage-')));\n\n    // Equivalent of tar --strip-components=N\n    // When no subPath is given, remove just 1 top level directory\n    let strip = this.subPath ? this.subPath.split('/').length : 1;\n    if (!this.stripFirstDirectory) {\n      strip--;\n    }\n\n    let filterError: Error | undefined = undefined;\n    await pipeline(\n      this.stream,\n      tar.extract({\n        strip,\n        cwd: dir,\n        filter: (path, stat) => {\n          // Filter errors will short-circuit the rest of the filtering and then throw\n          if (filterError) {\n            return false;\n          }\n\n          // File path relative to the root extracted directory. Will remove the\n          // top level dir name from the path since its name is hard to predetermine.\n          const relativePath = this.stripFirstDirectory\n            ? stripFirstDirectoryFromPath(path)\n            : path;\n          if (this.subPath && !relativePath.startsWith(this.subPath)) {\n            return false;\n          }\n          if (this.filter) {\n            const innerPath = path.split('/').slice(strip).join('/');\n            try {\n              return this.filter(innerPath, { size: stat.size });\n            } catch (error) {\n              filterError = error;\n              return false;\n            }\n          }\n          return true;\n        },\n      }),\n    );\n\n    if (filterError) {\n      // If the dir was provided we don't want to remove it, but if it wasn't it means\n      // we created a temporary directory and we should remove it.\n      if (!options?.targetDir) {\n        await fs.remove(dir).catch(() => {});\n      }\n      throw filterError;\n    }\n\n    return dir;\n  }\n}\n"],"names":["Parse","promisify","pipelineCb","stripFirstDirectoryFromPath","concatStream","tar","Readable","fs","platformPath"],"mappings":";;;;;;;;;;;;;;;;;AA8BA,MAAM,cAAA,GAAiBA,SAAA;AAEvB,MAAM,QAAA,GAAWC,eAAUC,eAAU,CAAA;AAK9B,MAAM,kBAAA,CAA+D;AAAA,EAG1E,YACmB,MAAA,EACA,OAAA,EACA,SACD,IAAA,EACC,MAAA,EACA,sBAA+B,IAAA,EAChD;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACD,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACC,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AAEjB,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,QAAA,IAAA,CAAK,OAAA,IAAW,GAAA;AAAA,MAClB;AACA,MAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,QAAA,MAAM,IAAI,SAAA;AAAA,UACR,4DAA4D,OAAO,CAAA,CAAA;AAAA,SACrE;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAtBQ,IAAA,GAAO,KAAA;AAAA;AAAA,EAyBP,QAAA,GAAW;AACjB,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAyD;AAC7D,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,QAAQ,KAAA,EAA4C;AAC1D,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,EAAe;AAElC,IAAA,MAAA,CAAO,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAgC;AAClD,MAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC9B,QAAA,KAAA,CAAM,MAAA,EAAO;AACb,QAAA;AAAA,MACF;AAIA,MAAA,MAAM,eAAe,IAAA,CAAK,mBAAA,GACtBC,mCAA4B,KAAA,CAAM,IAAI,IACtC,KAAA,CAAM,IAAA;AAEV,MAAA,IAAI,KAAK,OAAA,EAAS;AAChB,QAAA,IAAI,CAAC,YAAA,CAAa,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AAC1C,UAAA,KAAA,CAAM,MAAA,EAAO;AACb,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,CAAM,IAAA,CAAK,QAAQ,MAAM,CAAA;AACnD,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,IAAI,CAAC,KAAK,MAAA,CAAO,IAAA,EAAM,EAAE,IAAA,EAAM,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAG;AAC9C,UAAA,KAAA,CAAM,MAAA,EAAO;AACb,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAgB,OAAM,OAAA,KAAW;AACnD,QAAA,MAAM,QAAA,CAAS,KAAA,EAAOC,6BAAA,CAAa,OAAO,CAAC,CAAA;AAAA,MAC7C,CAAC,CAAA;AAED,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,IAAA;AAAA,QACA,SAAS,MAAM;AAAA,OAChB,CAAA;AAED,MAAA,KAAA,CAAM,MAAA,EAAO;AAAA,IACf,CAAC,CAAA;AAED,IAAA,MAAM,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,MAAM,CAAA;AAElC,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,GAA6B;AACjC,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,IAAA,CAAK,QAAA,EAAS;AAEd,MAAA,OAAO,IAAA,CAAK,MAAA;AAAA,IACd;AAIA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,EAAI;AAE9B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAI,OAAA,CAAgB,OAAM,OAAA,KAAW;AACtD,QAAA,MAAM,QAAA;AAAA,UACJC,oBAAA,CAAI,OAAO,EAAE,GAAA,EAAK,QAAO,EAAG,CAAC,EAAE,CAAC,CAAA;AAAA,UAChCD,8BAAa,OAAO;AAAA,SACtB;AAAA,MACF,CAAC,CAAA;AACD,MAAA,OAAOE,eAAA,CAAS,KAAK,IAAI,CAAA;AAAA,IAC3B,CAAA,SAAE;AACA,MAAA,MAAMC,mBAAA,CAAG,OAAO,MAAM,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,OAAA,EACiB;AACjB,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,GAAA,GACJ,OAAA,EAAS,SAAA,IACR,MAAMA,mBAAA,CAAG,OAAA,CAAQC,6BAAA,CAAa,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,YAAY,CAAC,CAAA;AAIjE,IAAA,IAAI,KAAA,GAAQ,KAAK,OAAA,GAAU,IAAA,CAAK,QAAQ,KAAA,CAAM,GAAG,EAAE,MAAA,GAAS,CAAA;AAC5D,IAAA,IAAI,CAAC,KAAK,mBAAA,EAAqB;AAC7B,MAAA,KAAA,EAAA;AAAA,IACF;AAEA,IAAA,IAAI,WAAA,GAAiC,MAAA;AACrC,IAAA,MAAM,QAAA;AAAA,MACJ,IAAA,CAAK,MAAA;AAAA,MACLH,qBAAI,OAAA,CAAQ;AAAA,QACV,KAAA;AAAA,QACA,GAAA,EAAK,GAAA;AAAA,QACL,MAAA,EAAQ,CAAC,IAAA,EAAM,IAAA,KAAS;AAEtB,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,OAAO,KAAA;AAAA,UACT;AAIA,UAAA,MAAM,YAAA,GAAe,IAAA,CAAK,mBAAA,GACtBF,kCAAA,CAA4B,IAAI,CAAA,GAChC,IAAA;AACJ,UAAA,IAAI,KAAK,OAAA,IAAW,CAAC,aAAa,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AAC1D,YAAA,OAAO,KAAA;AAAA,UACT;AACA,UAAA,IAAI,KAAK,MAAA,EAAQ;AACf,YAAA,MAAM,SAAA,GAAY,KAAK,KAAA,CAAM,GAAG,EAAE,KAAA,CAAM,KAAK,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACvD,YAAA,IAAI;AACF,cAAA,OAAO,KAAK,MAAA,CAAO,SAAA,EAAW,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AAAA,YACnD,SAAS,KAAA,EAAO;AACd,cAAA,WAAA,GAAc,KAAA;AACd,cAAA,OAAO,KAAA;AAAA,YACT;AAAA,UACF;AACA,UAAA,OAAO,IAAA;AAAA,QACT;AAAA,OACD;AAAA,KACH;AAEA,IAAA,IAAI,WAAA,EAAa;AAGf,MAAA,IAAI,CAAC,SAAS,SAAA,EAAW;AACvB,QAAA,MAAMI,mBAAA,CAAG,MAAA,CAAO,GAAG,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACrC;AACA,MAAA,MAAM,WAAA;AAAA,IACR;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"TarArchiveResponse.cjs.js","sources":["../../../../../src/entrypoints/urlReader/lib/tree/TarArchiveResponse.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  isChildPath,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadTreeResponseDirOptions,\n  UrlReaderServiceReadTreeResponseFile,\n} from '@backstage/backend-plugin-api';\nimport concatStream from 'concat-stream';\nimport fs from 'fs-extra';\nimport platformPath from 'path';\nimport { pipeline as pipelineCb, Readable } from 'stream';\nimport tar, { FileStat, Parse, ParseStream, ReadEntry } from 'tar';\nimport { promisify } from 'util';\nimport { stripFirstDirectoryFromPath } from './util';\n\n// Tar types for `Parse` is not a proper constructor, but it should be\nconst TarParseStream = Parse as unknown as { new (): ParseStream };\n\nconst pipeline = promisify(pipelineCb);\n\n/**\n * Wraps a tar archive stream into a tree response reader.\n */\nexport class TarArchiveResponse implements UrlReaderServiceReadTreeResponse {\n  private read = false;\n\n  constructor(\n    private readonly stream: Readable,\n    private readonly subPath: string,\n    private readonly workDir: string,\n    public readonly etag: string,\n    private readonly filter?: (path: string, info: { size: number }) => boolean,\n    private readonly stripFirstDirectory: boolean = true,\n  ) {\n    if (subPath) {\n      if (!subPath.endsWith('/')) {\n        this.subPath += '/';\n      }\n      if (subPath.startsWith('/')) {\n        throw new TypeError(\n          `TarArchiveResponse subPath must not start with a /, got '${subPath}'`,\n        );\n      }\n    }\n\n    this.etag = etag;\n  }\n\n  // Make sure the input stream is only read once\n  private onlyOnce() {\n    if (this.read) {\n      throw new Error('Response has already been read');\n    }\n    this.read = true;\n  }\n\n  async files(): Promise<UrlReaderServiceReadTreeResponseFile[]> {\n    this.onlyOnce();\n\n    const files = Array<UrlReaderServiceReadTreeResponseFile>();\n    const parser = new TarParseStream();\n\n    parser.on('entry', (entry: ReadEntry & Readable) => {\n      if (entry.type === 'Directory') {\n        entry.resume();\n        return;\n      }\n\n      // File path relative to the root extracted directory. Will remove the\n      // top level dir name from the path since its name is hard to predetermine.\n      const relativePath = this.stripFirstDirectory\n        ? stripFirstDirectoryFromPath(entry.path)\n        : entry.path;\n\n      if (this.subPath) {\n        if (!relativePath.startsWith(this.subPath)) {\n          entry.resume();\n          return;\n        }\n      }\n\n      const path = relativePath.slice(this.subPath.length);\n      if (this.filter) {\n        if (!this.filter(path, { size: entry.remain })) {\n          entry.resume();\n          return;\n        }\n      }\n\n      const content = new Promise<Buffer>(async resolve => {\n        await pipeline(entry, concatStream(resolve));\n      });\n\n      files.push({\n        path,\n        content: () => content,\n      });\n\n      entry.resume();\n    });\n\n    await pipeline(this.stream, parser);\n\n    return files;\n  }\n\n  async archive(): Promise<Readable> {\n    if (!this.subPath) {\n      this.onlyOnce();\n\n      return this.stream;\n    }\n\n    // TODO(Rugvip): method for repacking a tar with a subpath is to simply extract into a\n    //               tmp dir and recreate the archive. Would be nicer to stream things instead.\n    const tmpDir = await this.dir();\n\n    try {\n      const data = await new Promise<Buffer>(async resolve => {\n        await pipeline(\n          tar.create({ cwd: tmpDir }, ['']),\n          concatStream(resolve),\n        );\n      });\n      return Readable.from(data);\n    } finally {\n      await fs.remove(tmpDir);\n    }\n  }\n\n  async dir(\n    options?: UrlReaderServiceReadTreeResponseDirOptions,\n  ): Promise<string> {\n    this.onlyOnce();\n\n    const dir =\n      options?.targetDir ??\n      (await fs.mkdtemp(platformPath.join(this.workDir, 'backstage-')));\n\n    // Equivalent of tar --strip-components=N\n    // When no subPath is given, remove just 1 top level directory\n    let strip = this.subPath ? this.subPath.split('/').length : 1;\n    if (!this.stripFirstDirectory) {\n      strip--;\n    }\n\n    let filterError: Error | undefined = undefined;\n    await pipeline(\n      this.stream,\n      tar.extract({\n        strip,\n        cwd: dir,\n        filter: (path, stat) => {\n          // Filter errors will short-circuit the rest of the filtering and then throw\n          if (filterError) {\n            return false;\n          }\n\n          // Block symlinks/hardlinks that escape the extraction directory\n          const entry = stat as FileStat & { type?: string; linkpath?: string };\n          if (\n            (entry.type === 'SymbolicLink' || entry.type === 'Link') &&\n            entry.linkpath\n          ) {\n            const strippedPath = path.split('/').slice(strip).join('/');\n            const linkDir = platformPath.dirname(\n              platformPath.join(dir, strippedPath),\n            );\n            const targetPath = platformPath.resolve(linkDir, entry.linkpath);\n            if (!isChildPath(dir, targetPath)) {\n              return false;\n            }\n          }\n\n          // File path relative to the root extracted directory. Will remove the\n          // top level dir name from the path since its name is hard to predetermine.\n          const relativePath = this.stripFirstDirectory\n            ? stripFirstDirectoryFromPath(path)\n            : path;\n          if (this.subPath && !relativePath.startsWith(this.subPath)) {\n            return false;\n          }\n          if (this.filter) {\n            const innerPath = path.split('/').slice(strip).join('/');\n            try {\n              return this.filter(innerPath, { size: stat.size });\n            } catch (error) {\n              filterError = error;\n              return false;\n            }\n          }\n          return true;\n        },\n      }),\n    );\n\n    if (filterError) {\n      // If the dir was provided we don't want to remove it, but if it wasn't it means\n      // we created a temporary directory and we should remove it.\n      if (!options?.targetDir) {\n        await fs.remove(dir).catch(() => {});\n      }\n      throw filterError;\n    }\n\n    return dir;\n  }\n}\n"],"names":["Parse","promisify","pipelineCb","stripFirstDirectoryFromPath","concatStream","tar","Readable","fs","platformPath","isChildPath"],"mappings":";;;;;;;;;;;;;;;;;;AA+BA,MAAM,cAAA,GAAiBA,SAAA;AAEvB,MAAM,QAAA,GAAWC,eAAUC,eAAU,CAAA;AAK9B,MAAM,kBAAA,CAA+D;AAAA,EAG1E,YACmB,MAAA,EACA,OAAA,EACA,SACD,IAAA,EACC,MAAA,EACA,sBAA+B,IAAA,EAChD;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACD,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACC,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AAEjB,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,QAAA,IAAA,CAAK,OAAA,IAAW,GAAA;AAAA,MAClB;AACA,MAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,QAAA,MAAM,IAAI,SAAA;AAAA,UACR,4DAA4D,OAAO,CAAA,CAAA;AAAA,SACrE;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAtBQ,IAAA,GAAO,KAAA;AAAA;AAAA,EAyBP,QAAA,GAAW;AACjB,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAA,GAAyD;AAC7D,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,QAAQ,KAAA,EAA4C;AAC1D,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,EAAe;AAElC,IAAA,MAAA,CAAO,EAAA,CAAG,OAAA,EAAS,CAAC,KAAA,KAAgC;AAClD,MAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC9B,QAAA,KAAA,CAAM,MAAA,EAAO;AACb,QAAA;AAAA,MACF;AAIA,MAAA,MAAM,eAAe,IAAA,CAAK,mBAAA,GACtBC,mCAA4B,KAAA,CAAM,IAAI,IACtC,KAAA,CAAM,IAAA;AAEV,MAAA,IAAI,KAAK,OAAA,EAAS;AAChB,QAAA,IAAI,CAAC,YAAA,CAAa,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AAC1C,UAAA,KAAA,CAAM,MAAA,EAAO;AACb,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,CAAM,IAAA,CAAK,QAAQ,MAAM,CAAA;AACnD,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,IAAI,CAAC,KAAK,MAAA,CAAO,IAAA,EAAM,EAAE,IAAA,EAAM,KAAA,CAAM,MAAA,EAAQ,CAAA,EAAG;AAC9C,UAAA,KAAA,CAAM,MAAA,EAAO;AACb,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAgB,OAAM,OAAA,KAAW;AACnD,QAAA,MAAM,QAAA,CAAS,KAAA,EAAOC,6BAAA,CAAa,OAAO,CAAC,CAAA;AAAA,MAC7C,CAAC,CAAA;AAED,MAAA,KAAA,CAAM,IAAA,CAAK;AAAA,QACT,IAAA;AAAA,QACA,SAAS,MAAM;AAAA,OAChB,CAAA;AAED,MAAA,KAAA,CAAM,MAAA,EAAO;AAAA,IACf,CAAC,CAAA;AAED,IAAA,MAAM,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,MAAM,CAAA;AAElC,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,GAA6B;AACjC,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,IAAA,CAAK,QAAA,EAAS;AAEd,MAAA,OAAO,IAAA,CAAK,MAAA;AAAA,IACd;AAIA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,EAAI;AAE9B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAI,OAAA,CAAgB,OAAM,OAAA,KAAW;AACtD,QAAA,MAAM,QAAA;AAAA,UACJC,oBAAA,CAAI,OAAO,EAAE,GAAA,EAAK,QAAO,EAAG,CAAC,EAAE,CAAC,CAAA;AAAA,UAChCD,8BAAa,OAAO;AAAA,SACtB;AAAA,MACF,CAAC,CAAA;AACD,MAAA,OAAOE,eAAA,CAAS,KAAK,IAAI,CAAA;AAAA,IAC3B,CAAA,SAAE;AACA,MAAA,MAAMC,mBAAA,CAAG,OAAO,MAAM,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,OAAA,EACiB;AACjB,IAAA,IAAA,CAAK,QAAA,EAAS;AAEd,IAAA,MAAM,GAAA,GACJ,OAAA,EAAS,SAAA,IACR,MAAMA,mBAAA,CAAG,OAAA,CAAQC,6BAAA,CAAa,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,YAAY,CAAC,CAAA;AAIjE,IAAA,IAAI,KAAA,GAAQ,KAAK,OAAA,GAAU,IAAA,CAAK,QAAQ,KAAA,CAAM,GAAG,EAAE,MAAA,GAAS,CAAA;AAC5D,IAAA,IAAI,CAAC,KAAK,mBAAA,EAAqB;AAC7B,MAAA,KAAA,EAAA;AAAA,IACF;AAEA,IAAA,IAAI,WAAA,GAAiC,MAAA;AACrC,IAAA,MAAM,QAAA;AAAA,MACJ,IAAA,CAAK,MAAA;AAAA,MACLH,qBAAI,OAAA,CAAQ;AAAA,QACV,KAAA;AAAA,QACA,GAAA,EAAK,GAAA;AAAA,QACL,MAAA,EAAQ,CAAC,IAAA,EAAM,IAAA,KAAS;AAEtB,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,OAAO,KAAA;AAAA,UACT;AAGA,UAAA,MAAM,KAAA,GAAQ,IAAA;AACd,UAAA,IAAA,CACG,MAAM,IAAA,KAAS,cAAA,IAAkB,MAAM,IAAA,KAAS,MAAA,KACjD,MAAM,QAAA,EACN;AACA,YAAA,MAAM,YAAA,GAAe,KAAK,KAAA,CAAM,GAAG,EAAE,KAAA,CAAM,KAAK,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC1D,YAAA,MAAM,UAAUG,6BAAA,CAAa,OAAA;AAAA,cAC3BA,6BAAA,CAAa,IAAA,CAAK,GAAA,EAAK,YAAY;AAAA,aACrC;AACA,YAAA,MAAM,UAAA,GAAaA,6BAAA,CAAa,OAAA,CAAQ,OAAA,EAAS,MAAM,QAAQ,CAAA;AAC/D,YAAA,IAAI,CAACC,4BAAA,CAAY,GAAA,EAAK,UAAU,CAAA,EAAG;AACjC,cAAA,OAAO,KAAA;AAAA,YACT;AAAA,UACF;AAIA,UAAA,MAAM,YAAA,GAAe,IAAA,CAAK,mBAAA,GACtBN,kCAAA,CAA4B,IAAI,CAAA,GAChC,IAAA;AACJ,UAAA,IAAI,KAAK,OAAA,IAAW,CAAC,aAAa,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AAC1D,YAAA,OAAO,KAAA;AAAA,UACT;AACA,UAAA,IAAI,KAAK,MAAA,EAAQ;AACf,YAAA,MAAM,SAAA,GAAY,KAAK,KAAA,CAAM,GAAG,EAAE,KAAA,CAAM,KAAK,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACvD,YAAA,IAAI;AACF,cAAA,OAAO,KAAK,MAAA,CAAO,SAAA,EAAW,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,CAAA;AAAA,YACnD,SAAS,KAAA,EAAO;AACd,cAAA,WAAA,GAAc,KAAA;AACd,cAAA,OAAO,KAAA;AAAA,YACT;AAAA,UACF;AACA,UAAA,OAAO,IAAA;AAAA,QACT;AAAA,OACD;AAAA,KACH;AAEA,IAAA,IAAI,WAAA,EAAa;AAGf,MAAA,IAAI,CAAC,SAAS,SAAA,EAAW;AACvB,QAAA,MAAMI,mBAAA,CAAG,MAAA,CAAO,GAAG,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACrC;AACA,MAAA,MAAM,WAAA;AAAA,IACR;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AACF;;;;"}

package/dist/package.json.cjs.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "0.12.1-next.1";
+var version = "0.12.2";
 var packageinfo = {
 	version: version};
 

package/dist/rootLogger.d.ts

@@ -1,8 +1,8 @@
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
 import { RootLoggerService, LoggerService } from '@backstage/backend-plugin-api';
-import { JsonObject } from '@backstage/types';
+import { JsonPrimitive, JsonObject } from '@backstage/types';
 import { Format } from 'logform';
-import { transport } from 'winston';
+import { transport, config } from 'winston';
 
 /**
  * Root-level logging.
@@ -15,6 +15,20 @@ import { transport } from 'winston';
  */
 declare const rootLoggerServiceFactory: _backstage_backend_plugin_api.ServiceFactory<_backstage_backend_plugin_api.RootLoggerService, "root", "singleton">;
 
+/**
+ * @public
+ */
+type WinstonLoggerLevelOverrideMatchers = {
+    [key: string]: JsonPrimitive | JsonPrimitive[] | undefined;
+};
+/**
+ * @public
+ */
+type WinstonLoggerLevelOverride = {
+    matchers: WinstonLoggerLevelOverrideMatchers;
+    level: string;
+};
+
 /**
  * @public
  */
@@ -46,6 +60,13 @@ declare class WinstonLogger implements RootLoggerService {
      * Creates a pretty printed winston log formatter.
      */
     static colorFormat(): Format;
+    /**
+     * Formatter that filters log levels using overrides, falling back to the default level when no criteria match.
+     */
+    static logLevelFilter(defaultLogLevel: keyof config.NpmConfigSetLevels): {
+        format: Format;
+        setOverrides: (overrides: WinstonLoggerLevelOverride[]) => void;
+    };
     private constructor();
     error(message: string, meta?: JsonObject): void;
     warn(message: string, meta?: JsonObject): void;
@@ -53,6 +74,7 @@ declare class WinstonLogger implements RootLoggerService {
     debug(message: string, meta?: JsonObject): void;
     child(meta: JsonObject): LoggerService;
     addRedactions(redactions: Iterable<string>): void;
+    setLevelOverrides(overrides: WinstonLoggerLevelOverride[]): void;
 }
 
-export { WinstonLogger, type WinstonLoggerOptions, rootLoggerServiceFactory };
+export { WinstonLogger, type WinstonLoggerLevelOverride, type WinstonLoggerLevelOverrideMatchers, type WinstonLoggerOptions, rootLoggerServiceFactory };

package/dist/urlReader.d.ts

@@ -3,6 +3,7 @@ import { RootConfigService, LoggerService, UrlReaderServiceReadTreeResponse, Url
 import { AzureIntegration, AzureDevOpsCredentialsProvider, BitbucketCloudIntegration, BitbucketIntegration, BitbucketServerIntegration, GerritIntegration, GithubIntegration, GithubCredentialsProvider, GitLabIntegration, GiteaIntegration, HarnessIntegration, AwsS3Integration, AzureCredentialsManager, AzureBlobStorageIntergation } from '@backstage/integration';
 import { Readable } from 'stream';
 import { AwsCredentialsManager } from '@backstage/integration-aws-node';
+import { Config } from '@backstage/config';
 
 /**
  * A predicate that decides whether a specific {@link @backstage/backend-plugin-api#UrlReaderService} can handle a
@@ -373,6 +374,7 @@ declare class AzureBlobStorageUrlReader implements UrlReaderService {
  * @public
  */
 declare class FetchUrlReader implements UrlReaderService {
+    #private;
     /**
      * The factory creates a single reader that will be used for reading any URL that's listed
      * in configuration at `backend.reading.allow`. The allow list contains a list of objects describing
@@ -386,6 +388,8 @@ declare class FetchUrlReader implements UrlReaderService {
      *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.
      */
     static factory: ReaderFactory;
+    static fromConfig(config: Config): FetchUrlReader;
+    private constructor();
     read(url: string): Promise<Buffer>;
     readUrl(url: string, options?: UrlReaderServiceReadUrlOptions): Promise<UrlReaderServiceReadUrlResponse>;
     readTree(): Promise<UrlReaderServiceReadTreeResponse>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/backend-defaults",
-  "version": "0.12.1-next.1",
+  "version": "0.12.2",
   "description": "Backend defaults used by Backstage backend apps",
   "backstage": {
     "role": "node-library"
@@ -216,19 +216,19 @@
     "@aws-sdk/credential-providers": "^3.350.0",
     "@aws-sdk/types": "^3.347.0",
     "@azure/storage-blob": "^12.5.0",
-    "@backstage/backend-app-api": "1.2.7-next.0",
-    "@backstage/backend-dev-utils": "0.1.5",
-    "@backstage/backend-plugin-api": "1.4.3-next.0",
-    "@backstage/cli-node": "0.2.14",
-    "@backstage/config": "1.3.3",
-    "@backstage/config-loader": "1.10.3-next.0",
-    "@backstage/errors": "1.2.7",
-    "@backstage/integration": "1.18.0-next.0",
-    "@backstage/integration-aws-node": "0.1.17",
-    "@backstage/plugin-auth-node": "0.6.7-next.1",
-    "@backstage/plugin-events-node": "0.4.15-next.0",
-    "@backstage/plugin-permission-node": "0.10.4-next.0",
-    "@backstage/types": "1.2.1",
+    "@backstage/backend-app-api": "^1.2.7",
+    "@backstage/backend-dev-utils": "^0.1.5",
+    "@backstage/backend-plugin-api": "^1.4.3",
+    "@backstage/cli-node": "^0.2.14",
+    "@backstage/config": "^1.3.4",
+    "@backstage/config-loader": "^1.10.4",
+    "@backstage/errors": "^1.2.7",
+    "@backstage/integration": "^1.18.0",
+    "@backstage/integration-aws-node": "^0.1.17",
+    "@backstage/plugin-auth-node": "^0.6.7",
+    "@backstage/plugin-events-node": "^0.4.15",
+    "@backstage/plugin-permission-node": "^0.10.4",
+    "@backstage/types": "^1.2.2",
     "@google-cloud/storage": "^7.0.0",
     "@keyv/memcache": "^2.0.1",
     "@keyv/redis": "^4.0.1",
@@ -284,9 +284,9 @@
   },
   "devDependencies": {
     "@aws-sdk/util-stream-node": "^3.350.0",
-    "@backstage/backend-plugin-api": "1.4.3-next.0",
-    "@backstage/backend-test-utils": "1.9.0-next.1",
-    "@backstage/cli": "0.34.2-next.2",
+    "@backstage/backend-plugin-api": "^1.4.3",
+    "@backstage/backend-test-utils": "^1.9.0",
+    "@backstage/cli": "^0.34.3",
     "@google-cloud/cloud-sql-connector": "^1.4.0",
     "@types/archiver": "^6.0.0",
     "@types/base64-stream": "^1.0.2",