@backstage/backend-defaults 0.13.0 → 0.13.1-next.1

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js

@@ -9,14 +9,6 @@ var types = require('@backstage/types');
 const SECONDS_IN_MS = 1e3;
 const ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;
 class DefaultPluginTokenHandler {
-  constructor(logger, ownPluginId, keySource, algorithm, keyDurationSeconds, discovery) {
-    this.logger = logger;
-    this.ownPluginId = ownPluginId;
-    this.keySource = keySource;
-    this.algorithm = algorithm;
-    this.keyDurationSeconds = keyDurationSeconds;
-    this.discovery = discovery;
-  }
   jwksMap = /* @__PURE__ */ new Map();
   // Tracking state for isTargetPluginSupported
   supportedTargetPlugins = /* @__PURE__ */ new Set();
@@ -31,6 +23,20 @@ class DefaultPluginTokenHandler {
       options.discovery
     );
   }
+  logger;
+  ownPluginId;
+  keySource;
+  algorithm;
+  keyDurationSeconds;
+  discovery;
+  constructor(logger, ownPluginId, keySource, algorithm, keyDurationSeconds, discovery) {
+    this.logger = logger;
+    this.ownPluginId = ownPluginId;
+    this.keySource = keySource;
+    this.algorithm = algorithm;
+    this.keyDurationSeconds = keyDurationSeconds;
+    this.discovery = discovery;
+  }
   async verifyToken(token) {
     try {
       const { typ } = jose.decodeProtectedHeader(token);

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { assertError, AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\n/**\n * @public\n * Issues and verifies {@link https://backstage.io/docs/auth/service-to-service-auth | service-to-service tokens}.\n */\nexport interface PluginTokenHandler {\n  verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined>;\n  issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }>;\n}\n\nexport class DefaultPluginTokenHandler implements PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new DefaultPluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private constructor(\n    private readonly logger: LoggerService,\n    private readonly ownPluginId: string,\n    private readonly keySource: PluginKeySource,\n    private readonly algorithm: string,\n    private readonly keyDurationSeconds: number,\n    private readonly discovery: DiscoveryService,\n  ) {}\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      this.logger.warn('Failed to verify incoming plugin token', e);\n      throw new AuthenticationError('Failed plugin token verification');\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.limitedUserToken };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        assertError(error);\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","assertError","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAA,GAAgB,GAAA;AAEtB,MAAM,yBAAA,GAA4B,gBAAA;AAkC3B,MAAM,yBAAA,CAAwD;AAAA,EAkB3D,YACW,MAAA,EACA,WAAA,EACA,SAAA,EACA,SAAA,EACA,oBACA,SAAA,EACjB;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAChB;AAAA,EAxBK,OAAA,uBAAc,GAAA,EAAwB;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAA,EAAY;AAAA,EACzC,0BAAA,uBAAiC,GAAA,EAA8B;AAAA,EAEvE,OAAO,OAAO,OAAA,EAAkB;AAC9B,IAAA,OAAO,IAAI,yBAAA;AAAA,MACT,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,SAAA;AAAA,MACR,QAAQ,SAAA,IAAa,OAAA;AAAA,MACrB,KAAK,KAAA,CAAMA,4BAAA,CAAuB,OAAA,CAAQ,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAWA,MAAM,YACJ,KAAA,EACqE;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAA,IAAI,GAAA,KAAQC,yBAAA,CAAW,MAAA,CAAO,QAAA,EAAU;AACtC,QAAA,OAAO,KAAA,CAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAOC,cAAA,CAAU,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAA,MAAM,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAA,CAAW,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAA,CAAO,QAAA;AAAA,QACvB,UAAU,IAAA,CAAK,WAAA;AAAA,QACf,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAA,CAAA,KAAK;AACX,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,wCAAA,EAA0C,CAAC,CAAA;AAC5D,MAAA,MAAM,IAAIE,2BAAoB,kCAAkC,CAAA;AAAA,IAClE,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,SAAS,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,gBAAA,EAAkB,QAAQ,GAAA,EAAI;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,OAAA,EAIc;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAA,EAAgB,UAAA,EAAW,GAAI,OAAA;AACjD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,oBAAA,EAAqB;AAEtD,IAAA,MAAM,GAAA,GAAM,QAAA;AACZ,IAAA,MAAM,GAAA,GAAM,cAAA;AACZ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,kBAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,aACR,IAAA,CAAK,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAA,KAAY,aAAa;AAAA,KAC3D,GACA,MAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,YAAY,gBAAA,EAAiB;AACvE,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAA,CAAQ,MAAM,EACnC,kBAAA,CAAmB;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAA,CAAO,QAAA;AAAA,MACvB,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,KAAK,GAAA,CAAI;AAAA,KACV,CAAA,CACA,WAAA,CAAY,GAAG,CAAA,CACf,UAAA,CAAW,GAAG,CAAA,CACd,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAA,EAAM;AAAA,EACjB;AAAA,EAEA,MAAc,wBACZ,cAAA,EACkB;AAClB,IAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,GAAA,CAAI,cAAc,CAAA,EAAG;AACnD,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,UAAA,OAAO,KAAA;AAAA,QACT;AAEA,QAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,QAC5D;AAEA,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,UAAA,MAAM,IAAI,MAAM,CAAA,wCAAA,CAA0C,CAAA;AAAA,QAC5D;AAEA,QAAA,IAAA,CAAK,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAAC,kBAAA,CAAY,KAAK,CAAA;AACjB,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAA,OAAO,KAAA;AAAA,MACT,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,IAAA,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAAA,EAAkB;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,MAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,uBAAA,CAAwB,QAAQ,CAAA,EAAI;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,SAAS,CAAA;AACpC,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { assertError, AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\n/**\n * @public\n * Issues and verifies {@link https://backstage.io/docs/auth/service-to-service-auth | service-to-service tokens}.\n */\nexport interface PluginTokenHandler {\n  verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined>;\n  issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }>;\n}\n\nexport class DefaultPluginTokenHandler implements PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new DefaultPluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private readonly logger: LoggerService;\n  private readonly ownPluginId: string;\n  private readonly keySource: PluginKeySource;\n  private readonly algorithm: string;\n  private readonly keyDurationSeconds: number;\n  private readonly discovery: DiscoveryService;\n\n  private constructor(\n    logger: LoggerService,\n    ownPluginId: string,\n    keySource: PluginKeySource,\n    algorithm: string,\n    keyDurationSeconds: number,\n    discovery: DiscoveryService,\n  ) {\n    this.logger = logger;\n    this.ownPluginId = ownPluginId;\n    this.keySource = keySource;\n    this.algorithm = algorithm;\n    this.keyDurationSeconds = keyDurationSeconds;\n    this.discovery = discovery;\n  }\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      this.logger.warn('Failed to verify incoming plugin token', e);\n      throw new AuthenticationError('Failed plugin token verification');\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.limitedUserToken };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        assertError(error);\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","assertError","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAA,GAAgB,GAAA;AAEtB,MAAM,yBAAA,GAA4B,gBAAA;AAkC3B,MAAM,yBAAA,CAAwD;AAAA,EAC3D,OAAA,uBAAc,GAAA,EAAwB;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAA,EAAY;AAAA,EACzC,0BAAA,uBAAiC,GAAA,EAA8B;AAAA,EAEvE,OAAO,OAAO,OAAA,EAAkB;AAC9B,IAAA,OAAO,IAAI,yBAAA;AAAA,MACT,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,SAAA;AAAA,MACR,QAAQ,SAAA,IAAa,OAAA;AAAA,MACrB,KAAK,KAAA,CAAMA,4BAAA,CAAuB,OAAA,CAAQ,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEiB,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,SAAA;AAAA,EAET,YACN,MAAA,EACA,WAAA,EACA,SAAA,EACA,SAAA,EACA,oBACA,SAAA,EACA;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,MAAM,YACJ,KAAA,EACqE;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAA,IAAI,GAAA,KAAQC,yBAAA,CAAW,MAAA,CAAO,QAAA,EAAU;AACtC,QAAA,OAAO,KAAA,CAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAOC,cAAA,CAAU,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAA,MAAM,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAA,CAAW,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAA,CAAO,QAAA;AAAA,QACvB,UAAU,IAAA,CAAK,WAAA;AAAA,QACf,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAA,CAAA,KAAK;AACX,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,wCAAA,EAA0C,CAAC,CAAA;AAC5D,MAAA,MAAM,IAAIE,2BAAoB,kCAAkC,CAAA;AAAA,IAClE,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,SAAS,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,gBAAA,EAAkB,QAAQ,GAAA,EAAI;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,OAAA,EAIc;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAA,EAAgB,UAAA,EAAW,GAAI,OAAA;AACjD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,oBAAA,EAAqB;AAEtD,IAAA,MAAM,GAAA,GAAM,QAAA;AACZ,IAAA,MAAM,GAAA,GAAM,cAAA;AACZ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,kBAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,aACR,IAAA,CAAK,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAA,KAAY,aAAa;AAAA,KAC3D,GACA,MAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,YAAY,gBAAA,EAAiB;AACvE,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAA,CAAQ,MAAM,EACnC,kBAAA,CAAmB;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAA,CAAO,QAAA;AAAA,MACvB,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,KAAK,GAAA,CAAI;AAAA,KACV,CAAA,CACA,WAAA,CAAY,GAAG,CAAA,CACf,UAAA,CAAW,GAAG,CAAA,CACd,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAA,EAAM;AAAA,EACjB;AAAA,EAEA,MAAc,wBACZ,cAAA,EACkB;AAClB,IAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,GAAA,CAAI,cAAc,CAAA,EAAG;AACnD,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,UAAA,OAAO,KAAA;AAAA,QACT;AAEA,QAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,QAC5D;AAEA,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,UAAA,MAAM,IAAI,MAAM,CAAA,wCAAA,CAA0C,CAAA;AAAA,QAC5D;AAEA,QAAA,IAAA,CAAK,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAAC,kBAAA,CAAY,KAAK,CAAA;AACjB,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAA,OAAO,KAAA;AAAA,MACT,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,IAAA,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAAA,EAAkB;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,MAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,uBAAA,CAAwB,QAAQ,CAAA,EAAI;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,SAAS,CAAA;AACpC,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}

package/dist/entrypoints/auth/plugin/keys/DatabaseKeyStore.cjs.js

@@ -16,10 +16,6 @@ function applyDatabaseMigrations(knex) {
   });
 }
 class DatabaseKeyStore {
-  constructor(client, logger) {
-    this.client = client;
-    this.logger = logger;
-  }
   static async create(options) {
     const { database, logger } = options;
     const client = await database.getClient();
@@ -28,6 +24,12 @@ class DatabaseKeyStore {
     }
     return new DatabaseKeyStore(client, logger);
   }
+  client;
+  logger;
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
+  }
   async addKey(options) {
     await this.client(TABLE).insert({
       id: options.key.kid,

package/dist/entrypoints/auth/plugin/keys/DatabaseKeyStore.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseKeyStore.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/DatabaseKeyStore.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LoggerService,\n  resolvePackagePath,\n} from '@backstage/backend-plugin-api';\nimport { JsonObject } from '@backstage/types';\nimport { Knex } from 'knex';\nimport { DateTime } from 'luxon';\nimport { KeyStore } from './types';\n\nconst MIGRATIONS_TABLE = 'backstage_backend_public_keys__knex_migrations';\n\n/** @internal */\nexport const TABLE = 'backstage_backend_public_keys__keys';\n\ntype Row = {\n  id: string;\n  key: string;\n  expires_at: string;\n};\n\nexport function applyDatabaseMigrations(knex: Knex): Promise<void> {\n  const migrationsDir = resolvePackagePath(\n    '@backstage/backend-defaults',\n    'migrations/auth',\n  );\n\n  return knex.migrate.latest({\n    directory: migrationsDir,\n    tableName: MIGRATIONS_TABLE,\n  });\n}\n\n/** @internal */\nexport class DatabaseKeyStore implements KeyStore {\n  static async create(options: {\n    database: DatabaseService;\n    logger: LoggerService;\n  }) {\n    const { database, logger } = options;\n\n    const client = await database.getClient();\n    if (!database.migrations?.skip) {\n      await applyDatabaseMigrations(client);\n    }\n    return new DatabaseKeyStore(client, logger);\n  }\n\n  private constructor(\n    private readonly client: Knex,\n    private readonly logger: LoggerService,\n  ) {}\n\n  async addKey(options: {\n    id: string;\n    key: JsonObject & { kid: string };\n    expiresAt: Date;\n  }) {\n    await this.client<Row>(TABLE).insert({\n      id: options.key.kid,\n      key: JSON.stringify(options.key),\n      expires_at: options.expiresAt.toISOString(),\n    });\n  }\n\n  async listKeys() {\n    const rows = await this.client<Row>(TABLE).select();\n    const keys = rows.map(row => ({\n      id: row.id,\n      key: JSON.parse(row.key),\n      expiresAt: new Date(row.expires_at),\n    }));\n\n    const validKeys = [];\n    const expiredKeys = [];\n\n    for (const key of keys) {\n      if (DateTime.fromJSDate(key.expiresAt) < DateTime.local()) {\n        expiredKeys.push(key);\n      } else {\n        validKeys.push(key);\n      }\n    }\n\n    // Lazily prune expired keys. This may cause duplicate removals if we have concurrent callers, but w/e\n    if (expiredKeys.length > 0) {\n      const kids = expiredKeys.map(({ key }) => key.kid);\n\n      this.logger.info(\n        `Removing expired plugin service keys, '${kids.join(\"', '\")}'`,\n      );\n\n      // We don't await this, just let it run in the background\n      this.client<Row>(TABLE)\n        .delete()\n        .whereIn('id', kids)\n        .catch(error => {\n          this.logger.error(\n            'Failed to remove expired plugin service keys',\n            error,\n          );\n        });\n    }\n\n    return { keys: validKeys };\n  }\n}\n"],"names":["resolvePackagePath","DateTime"],"mappings":";;;;;AA0BA,MAAM,gBAAA,GAAmB,gDAAA;AAGlB,MAAM,KAAA,GAAQ;AAQd,SAAS,wBAAwB,IAAA,EAA2B;AACjE,EAAA,MAAM,aAAA,GAAgBA,mCAAA;AAAA,IACpB,6BAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAO,IAAA,CAAK,QAAQ,MAAA,CAAO;AAAA,IACzB,SAAA,EAAW,aAAA;AAAA,IACX,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;AAGO,MAAM,gBAAA,CAAqC;AAAA,EAcxC,WAAA,CACW,QACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA,EAhBH,aAAa,OAAO,OAAA,EAGjB;AACD,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,OAAA;AAE7B,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,SAAA,EAAU;AACxC,IAAA,IAAI,CAAC,QAAA,CAAS,UAAA,EAAY,IAAA,EAAM;AAC9B,MAAA,MAAM,wBAAwB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,IAAI,gBAAA,CAAiB,MAAA,EAAQ,MAAM,CAAA;AAAA,EAC5C;AAAA,EAOA,MAAM,OAAO,OAAA,EAIV;AACD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAY,KAAK,CAAA,CAAE,MAAA,CAAO;AAAA,MACnC,EAAA,EAAI,QAAQ,GAAA,CAAI,GAAA;AAAA,MAChB,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC/B,UAAA,EAAY,OAAA,CAAQ,SAAA,CAAU,WAAA;AAAY,KAC3C,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,QAAA,GAAW;AACf,IAAA,MAAM,OAAO,MAAM,IAAA,CAAK,MAAA,CAAY,KAAK,EAAE,MAAA,EAAO;AAClD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,CAAA,GAAA,MAAQ;AAAA,MAC5B,IAAI,GAAA,CAAI,EAAA;AAAA,MACR,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,MACvB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,UAAU;AAAA,KACpC,CAAE,CAAA;AAEF,IAAA,MAAM,YAAY,EAAC;AACnB,IAAA,MAAM,cAAc,EAAC;AAErB,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,IAAIC,eAAS,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,GAAIA,cAAA,CAAS,OAAM,EAAG;AACzD,QAAA,WAAA,CAAY,KAAK,GAAG,CAAA;AAAA,MACtB,CAAA,MAAO;AACL,QAAA,SAAA,CAAU,KAAK,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAGA,IAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAA,GAAO,YAAY,GAAA,CAAI,CAAC,EAAE,GAAA,EAAI,KAAM,IAAI,GAAG,CAAA;AAEjD,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QACV,CAAA,uCAAA,EAA0C,IAAA,CAAK,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAAA,OAC7D;AAGA,MAAA,IAAA,CAAK,MAAA,CAAY,KAAK,CAAA,CACnB,MAAA,EAAO,CACP,QAAQ,IAAA,EAAM,IAAI,CAAA,CAClB,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,UACV,8CAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAAA,EAC3B;AACF;;;;;;"}
+{"version":3,"file":"DatabaseKeyStore.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/DatabaseKeyStore.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LoggerService,\n  resolvePackagePath,\n} from '@backstage/backend-plugin-api';\nimport { JsonObject } from '@backstage/types';\nimport { Knex } from 'knex';\nimport { DateTime } from 'luxon';\nimport { KeyStore } from './types';\n\nconst MIGRATIONS_TABLE = 'backstage_backend_public_keys__knex_migrations';\n\n/** @internal */\nexport const TABLE = 'backstage_backend_public_keys__keys';\n\ntype Row = {\n  id: string;\n  key: string;\n  expires_at: string;\n};\n\nexport function applyDatabaseMigrations(knex: Knex): Promise<void> {\n  const migrationsDir = resolvePackagePath(\n    '@backstage/backend-defaults',\n    'migrations/auth',\n  );\n\n  return knex.migrate.latest({\n    directory: migrationsDir,\n    tableName: MIGRATIONS_TABLE,\n  });\n}\n\n/** @internal */\nexport class DatabaseKeyStore implements KeyStore {\n  static async create(options: {\n    database: DatabaseService;\n    logger: LoggerService;\n  }) {\n    const { database, logger } = options;\n\n    const client = await database.getClient();\n    if (!database.migrations?.skip) {\n      await applyDatabaseMigrations(client);\n    }\n    return new DatabaseKeyStore(client, logger);\n  }\n\n  private readonly client: Knex;\n  private readonly logger: LoggerService;\n\n  private constructor(client: Knex, logger: LoggerService) {\n    this.client = client;\n    this.logger = logger;\n  }\n\n  async addKey(options: {\n    id: string;\n    key: JsonObject & { kid: string };\n    expiresAt: Date;\n  }) {\n    await this.client<Row>(TABLE).insert({\n      id: options.key.kid,\n      key: JSON.stringify(options.key),\n      expires_at: options.expiresAt.toISOString(),\n    });\n  }\n\n  async listKeys() {\n    const rows = await this.client<Row>(TABLE).select();\n    const keys = rows.map(row => ({\n      id: row.id,\n      key: JSON.parse(row.key),\n      expiresAt: new Date(row.expires_at),\n    }));\n\n    const validKeys = [];\n    const expiredKeys = [];\n\n    for (const key of keys) {\n      if (DateTime.fromJSDate(key.expiresAt) < DateTime.local()) {\n        expiredKeys.push(key);\n      } else {\n        validKeys.push(key);\n      }\n    }\n\n    // Lazily prune expired keys. This may cause duplicate removals if we have concurrent callers, but w/e\n    if (expiredKeys.length > 0) {\n      const kids = expiredKeys.map(({ key }) => key.kid);\n\n      this.logger.info(\n        `Removing expired plugin service keys, '${kids.join(\"', '\")}'`,\n      );\n\n      // We don't await this, just let it run in the background\n      this.client<Row>(TABLE)\n        .delete()\n        .whereIn('id', kids)\n        .catch(error => {\n          this.logger.error(\n            'Failed to remove expired plugin service keys',\n            error,\n          );\n        });\n    }\n\n    return { keys: validKeys };\n  }\n}\n"],"names":["resolvePackagePath","DateTime"],"mappings":";;;;;AA0BA,MAAM,gBAAA,GAAmB,gDAAA;AAGlB,MAAM,KAAA,GAAQ;AAQd,SAAS,wBAAwB,IAAA,EAA2B;AACjE,EAAA,MAAM,aAAA,GAAgBA,mCAAA;AAAA,IACpB,6BAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAO,IAAA,CAAK,QAAQ,MAAA,CAAO;AAAA,IACzB,SAAA,EAAW,aAAA;AAAA,IACX,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;AAGO,MAAM,gBAAA,CAAqC;AAAA,EAChD,aAAa,OAAO,OAAA,EAGjB;AACD,IAAA,MAAM,EAAE,QAAA,EAAU,MAAA,EAAO,GAAI,OAAA;AAE7B,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,SAAA,EAAU;AACxC,IAAA,IAAI,CAAC,QAAA,CAAS,UAAA,EAAY,IAAA,EAAM;AAC9B,MAAA,MAAM,wBAAwB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,IAAI,gBAAA,CAAiB,MAAA,EAAQ,MAAM,CAAA;AAAA,EAC5C;AAAA,EAEiB,MAAA;AAAA,EACA,MAAA;AAAA,EAET,WAAA,CAAY,QAAc,MAAA,EAAuB;AACvD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,MAAM,OAAO,OAAA,EAIV;AACD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAY,KAAK,CAAA,CAAE,MAAA,CAAO;AAAA,MACnC,EAAA,EAAI,QAAQ,GAAA,CAAI,GAAA;AAAA,MAChB,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC/B,UAAA,EAAY,OAAA,CAAQ,SAAA,CAAU,WAAA;AAAY,KAC3C,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,QAAA,GAAW;AACf,IAAA,MAAM,OAAO,MAAM,IAAA,CAAK,MAAA,CAAY,KAAK,EAAE,MAAA,EAAO;AAClD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,CAAA,GAAA,MAAQ;AAAA,MAC5B,IAAI,GAAA,CAAI,EAAA;AAAA,MACR,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,MACvB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,UAAU;AAAA,KACpC,CAAE,CAAA;AAEF,IAAA,MAAM,YAAY,EAAC;AACnB,IAAA,MAAM,cAAc,EAAC;AAErB,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,IAAIC,eAAS,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,GAAIA,cAAA,CAAS,OAAM,EAAG;AACzD,QAAA,WAAA,CAAY,KAAK,GAAG,CAAA;AAAA,MACtB,CAAA,MAAO;AACL,QAAA,SAAA,CAAU,KAAK,GAAG,CAAA;AAAA,MACpB;AAAA,IACF;AAGA,IAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAA,GAAO,YAAY,GAAA,CAAI,CAAC,EAAE,GAAA,EAAI,KAAM,IAAI,GAAG,CAAA;AAEjD,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,QACV,CAAA,uCAAA,EAA0C,IAAA,CAAK,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAAA,OAC7D;AAGA,MAAA,IAAA,CAAK,MAAA,CAAY,KAAK,CAAA,CACnB,MAAA,EAAO,CACP,QAAQ,IAAA,EAAM,IAAI,CAAA,CAClB,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,UACV,8CAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAAA,EAC3B;AACF;;;;;;"}

package/dist/entrypoints/auth/plugin/keys/DatabasePluginKeySource.cjs.js

@@ -8,14 +8,18 @@ var DatabaseKeyStore = require('./DatabaseKeyStore.cjs.js');
 const SECONDS_IN_MS = 1e3;
 const KEY_EXPIRATION_MARGIN_FACTOR = 3;
 class DatabasePluginKeySource {
+  privateKeyPromise;
+  keyExpiry;
+  keyStore;
+  logger;
+  keyDurationSeconds;
+  algorithm;
   constructor(keyStore, logger, keyDurationSeconds, algorithm) {
     this.keyStore = keyStore;
     this.logger = logger;
     this.keyDurationSeconds = keyDurationSeconds;
     this.algorithm = algorithm;
   }
-  privateKeyPromise;
-  keyExpiry;
   static async create(options) {
     const keyStore = await DatabaseKeyStore.DatabaseKeyStore.create({
       database: options.database,

package/dist/entrypoints/auth/plugin/keys/DatabasePluginKeySource.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatabasePluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/DatabasePluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DatabaseService, LoggerService } from '@backstage/backend-plugin-api';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { JWK, exportJWK, generateKeyPair } from 'jose';\nimport { v4 as uuid } from 'uuid';\nimport { DatabaseKeyStore } from './DatabaseKeyStore';\nimport { InternalKey, KeyPayload, KeyStore } from './types';\nimport { PluginKeySource } from './types';\n\nconst SECONDS_IN_MS = 1000;\n\n/**\n * The margin for how many times longer we make the public key available\n * compared to how long we use the private key to sign new tokens.\n */\nconst KEY_EXPIRATION_MARGIN_FACTOR = 3;\n\nexport class DatabasePluginKeySource implements PluginKeySource {\n  private privateKeyPromise?: Promise<JWK>;\n  private keyExpiry?: Date;\n\n  constructor(\n    private readonly keyStore: KeyStore,\n    private readonly logger: LoggerService,\n    private readonly keyDurationSeconds: number,\n    private readonly algorithm: string,\n  ) {}\n\n  public static async create(options: {\n    logger: LoggerService;\n    database: DatabaseService;\n    keyDuration: HumanDuration;\n    algorithm?: string;\n  }): Promise<PluginKeySource> {\n    const keyStore = await DatabaseKeyStore.create({\n      database: options.database,\n      logger: options.logger,\n    });\n\n    return new DatabasePluginKeySource(\n      keyStore,\n      options.logger,\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.algorithm ?? 'ES256',\n    );\n  }\n\n  async getPrivateSigningKey(): Promise<JWK> {\n    // Make sure that we only generate one key at a time\n    if (this.privateKeyPromise) {\n      if (this.keyExpiry && this.keyExpiry.getTime() > Date.now()) {\n        return this.privateKeyPromise;\n      }\n      this.logger.info(`Signing key has expired, generating new key`);\n      delete this.privateKeyPromise;\n    }\n\n    this.keyExpiry = new Date(\n      Date.now() + this.keyDurationSeconds * SECONDS_IN_MS,\n    );\n\n    const promise = (async () => {\n      // This generates a new signing key to be used to sign tokens until the next key rotation\n      const kid = uuid();\n      const key = await generateKeyPair(this.algorithm);\n      const publicKey = await exportJWK(key.publicKey);\n      const privateKey = await exportJWK(key.privateKey);\n      publicKey.kid = privateKey.kid = kid;\n      publicKey.alg = privateKey.alg = this.algorithm;\n\n      // We're not allowed to use the key until it has been successfully stored\n      // TODO: some token verification implementations aggressively cache the list of keys, and\n      //       don't attempt to fetch new ones even if they encounter an unknown kid. Therefore we\n      //       may want to keep using the existing key for some period of time until we switch to\n      //       the new one. This also needs to be implemented cross-service though, meaning new services\n      //       that boot up need to be able to grab an existing key to use for signing.\n      this.logger.info(`Created new signing key ${kid}`);\n\n      await this.keyStore.addKey({\n        id: kid,\n        key: publicKey as InternalKey,\n        expiresAt: new Date(\n          Date.now() +\n            this.keyDurationSeconds *\n              SECONDS_IN_MS *\n              KEY_EXPIRATION_MARGIN_FACTOR,\n        ),\n      });\n\n      // At this point we are allowed to start using the new key\n      return privateKey;\n    })();\n\n    this.privateKeyPromise = promise;\n\n    try {\n      // If we fail to generate a new key, we need to clear the state so that\n      // the next caller will try to generate another key.\n      await promise;\n    } catch (error) {\n      this.logger.error(`Failed to generate new signing key, ${error}`);\n      delete this.keyExpiry;\n      delete this.privateKeyPromise;\n    }\n\n    return promise;\n  }\n\n  listKeys(): Promise<{ keys: KeyPayload[] }> {\n    return this.keyStore.listKeys();\n  }\n}\n"],"names":["DatabaseKeyStore","durationToMilliseconds","uuid","generateKeyPair","exportJWK"],"mappings":";;;;;;;AAwBA,MAAM,aAAA,GAAgB,GAAA;AAMtB,MAAM,4BAAA,GAA+B,CAAA;AAE9B,MAAM,uBAAA,CAAmD;AAAA,EAI9D,WAAA,CACmB,QAAA,EACA,MAAA,EACA,kBAAA,EACA,SAAA,EACjB;AAJiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAChB;AAAA,EARK,iBAAA;AAAA,EACA,SAAA;AAAA,EASR,aAAoB,OAAO,OAAA,EAKE;AAC3B,IAAA,MAAM,QAAA,GAAW,MAAMA,iCAAA,CAAiB,MAAA,CAAO;AAAA,MAC7C,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAED,IAAA,OAAO,IAAI,uBAAA;AAAA,MACT,QAAA;AAAA,MACA,OAAA,CAAQ,MAAA;AAAA,MACR,KAAK,KAAA,CAAMC,4BAAA,CAAuB,OAAA,CAAQ,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,QAAQ,SAAA,IAAa;AAAA,KACvB;AAAA,EACF;AAAA,EAEA,MAAM,oBAAA,GAAqC;AAEzC,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,IAAI,IAAA,CAAK,aAAa,IAAA,CAAK,SAAA,CAAU,SAAQ,GAAI,IAAA,CAAK,KAAI,EAAG;AAC3D,QAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,MACd;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,2CAAA,CAA6C,CAAA;AAC9D,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACd;AAEA,IAAA,IAAA,CAAK,YAAY,IAAI,IAAA;AAAA,MACnB,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,kBAAA,GAAqB;AAAA,KACzC;AAEA,IAAA,MAAM,WAAW,YAAY;AAE3B,MAAA,MAAM,MAAMC,OAAA,EAAK;AACjB,MAAA,MAAM,GAAA,GAAM,MAAMC,oBAAA,CAAgB,IAAA,CAAK,SAAS,CAAA;AAChD,MAAA,MAAM,SAAA,GAAY,MAAMC,cAAA,CAAU,GAAA,CAAI,SAAS,CAAA;AAC/C,MAAA,MAAM,UAAA,GAAa,MAAMA,cAAA,CAAU,GAAA,CAAI,UAAU,CAAA;AACjD,MAAA,SAAA,CAAU,GAAA,GAAM,WAAW,GAAA,GAAM,GAAA;AACjC,MAAA,SAAA,CAAU,GAAA,GAAM,UAAA,CAAW,GAAA,GAAM,IAAA,CAAK,SAAA;AAQtC,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAEjD,MAAA,MAAM,IAAA,CAAK,SAAS,MAAA,CAAO;AAAA,QACzB,EAAA,EAAI,GAAA;AAAA,QACJ,GAAA,EAAK,SAAA;AAAA,QACL,WAAW,IAAI,IAAA;AAAA,UACb,IAAA,CAAK,GAAA,EAAI,GACP,IAAA,CAAK,qBACH,aAAA,GACA;AAAA;AACN,OACD,CAAA;AAGD,MAAA,OAAO,UAAA;AAAA,IACT,CAAA,GAAG;AAEH,IAAA,IAAA,CAAK,iBAAA,GAAoB,OAAA;AAEzB,IAAA,IAAI;AAGF,MAAA,MAAM,OAAA;AAAA,IACR,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,oCAAA,EAAuC,KAAK,CAAA,CAAE,CAAA;AAChE,MAAA,OAAO,IAAA,CAAK,SAAA;AACZ,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACd;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,QAAA,GAA4C;AAC1C,IAAA,OAAO,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EAChC;AACF;;;;"}
+{"version":3,"file":"DatabasePluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/DatabasePluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DatabaseService, LoggerService } from '@backstage/backend-plugin-api';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { JWK, exportJWK, generateKeyPair } from 'jose';\nimport { v4 as uuid } from 'uuid';\nimport { DatabaseKeyStore } from './DatabaseKeyStore';\nimport { InternalKey, KeyPayload, KeyStore } from './types';\nimport { PluginKeySource } from './types';\n\nconst SECONDS_IN_MS = 1000;\n\n/**\n * The margin for how many times longer we make the public key available\n * compared to how long we use the private key to sign new tokens.\n */\nconst KEY_EXPIRATION_MARGIN_FACTOR = 3;\n\nexport class DatabasePluginKeySource implements PluginKeySource {\n  private privateKeyPromise?: Promise<JWK>;\n  private keyExpiry?: Date;\n  private readonly keyStore: KeyStore;\n  private readonly logger: LoggerService;\n  private readonly keyDurationSeconds: number;\n  private readonly algorithm: string;\n\n  constructor(\n    keyStore: KeyStore,\n    logger: LoggerService,\n    keyDurationSeconds: number,\n    algorithm: string,\n  ) {\n    this.keyStore = keyStore;\n    this.logger = logger;\n    this.keyDurationSeconds = keyDurationSeconds;\n    this.algorithm = algorithm;\n  }\n\n  public static async create(options: {\n    logger: LoggerService;\n    database: DatabaseService;\n    keyDuration: HumanDuration;\n    algorithm?: string;\n  }): Promise<PluginKeySource> {\n    const keyStore = await DatabaseKeyStore.create({\n      database: options.database,\n      logger: options.logger,\n    });\n\n    return new DatabasePluginKeySource(\n      keyStore,\n      options.logger,\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.algorithm ?? 'ES256',\n    );\n  }\n\n  async getPrivateSigningKey(): Promise<JWK> {\n    // Make sure that we only generate one key at a time\n    if (this.privateKeyPromise) {\n      if (this.keyExpiry && this.keyExpiry.getTime() > Date.now()) {\n        return this.privateKeyPromise;\n      }\n      this.logger.info(`Signing key has expired, generating new key`);\n      delete this.privateKeyPromise;\n    }\n\n    this.keyExpiry = new Date(\n      Date.now() + this.keyDurationSeconds * SECONDS_IN_MS,\n    );\n\n    const promise = (async () => {\n      // This generates a new signing key to be used to sign tokens until the next key rotation\n      const kid = uuid();\n      const key = await generateKeyPair(this.algorithm);\n      const publicKey = await exportJWK(key.publicKey);\n      const privateKey = await exportJWK(key.privateKey);\n      publicKey.kid = privateKey.kid = kid;\n      publicKey.alg = privateKey.alg = this.algorithm;\n\n      // We're not allowed to use the key until it has been successfully stored\n      // TODO: some token verification implementations aggressively cache the list of keys, and\n      //       don't attempt to fetch new ones even if they encounter an unknown kid. Therefore we\n      //       may want to keep using the existing key for some period of time until we switch to\n      //       the new one. This also needs to be implemented cross-service though, meaning new services\n      //       that boot up need to be able to grab an existing key to use for signing.\n      this.logger.info(`Created new signing key ${kid}`);\n\n      await this.keyStore.addKey({\n        id: kid,\n        key: publicKey as InternalKey,\n        expiresAt: new Date(\n          Date.now() +\n            this.keyDurationSeconds *\n              SECONDS_IN_MS *\n              KEY_EXPIRATION_MARGIN_FACTOR,\n        ),\n      });\n\n      // At this point we are allowed to start using the new key\n      return privateKey;\n    })();\n\n    this.privateKeyPromise = promise;\n\n    try {\n      // If we fail to generate a new key, we need to clear the state so that\n      // the next caller will try to generate another key.\n      await promise;\n    } catch (error) {\n      this.logger.error(`Failed to generate new signing key, ${error}`);\n      delete this.keyExpiry;\n      delete this.privateKeyPromise;\n    }\n\n    return promise;\n  }\n\n  listKeys(): Promise<{ keys: KeyPayload[] }> {\n    return this.keyStore.listKeys();\n  }\n}\n"],"names":["DatabaseKeyStore","durationToMilliseconds","uuid","generateKeyPair","exportJWK"],"mappings":";;;;;;;AAwBA,MAAM,aAAA,GAAgB,GAAA;AAMtB,MAAM,4BAAA,GAA+B,CAAA;AAE9B,MAAM,uBAAA,CAAmD;AAAA,EACtD,iBAAA;AAAA,EACA,SAAA;AAAA,EACS,QAAA;AAAA,EACA,MAAA;AAAA,EACA,kBAAA;AAAA,EACA,SAAA;AAAA,EAEjB,WAAA,CACE,QAAA,EACA,MAAA,EACA,kBAAA,EACA,SAAA,EACA;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,aAAoB,OAAO,OAAA,EAKE;AAC3B,IAAA,MAAM,QAAA,GAAW,MAAMA,iCAAA,CAAiB,MAAA,CAAO;AAAA,MAC7C,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAED,IAAA,OAAO,IAAI,uBAAA;AAAA,MACT,QAAA;AAAA,MACA,OAAA,CAAQ,MAAA;AAAA,MACR,KAAK,KAAA,CAAMC,4BAAA,CAAuB,OAAA,CAAQ,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,QAAQ,SAAA,IAAa;AAAA,KACvB;AAAA,EACF;AAAA,EAEA,MAAM,oBAAA,GAAqC;AAEzC,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,IAAI,IAAA,CAAK,aAAa,IAAA,CAAK,SAAA,CAAU,SAAQ,GAAI,IAAA,CAAK,KAAI,EAAG;AAC3D,QAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,MACd;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,2CAAA,CAA6C,CAAA;AAC9D,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACd;AAEA,IAAA,IAAA,CAAK,YAAY,IAAI,IAAA;AAAA,MACnB,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,kBAAA,GAAqB;AAAA,KACzC;AAEA,IAAA,MAAM,WAAW,YAAY;AAE3B,MAAA,MAAM,MAAMC,OAAA,EAAK;AACjB,MAAA,MAAM,GAAA,GAAM,MAAMC,oBAAA,CAAgB,IAAA,CAAK,SAAS,CAAA;AAChD,MAAA,MAAM,SAAA,GAAY,MAAMC,cAAA,CAAU,GAAA,CAAI,SAAS,CAAA;AAC/C,MAAA,MAAM,UAAA,GAAa,MAAMA,cAAA,CAAU,GAAA,CAAI,UAAU,CAAA;AACjD,MAAA,SAAA,CAAU,GAAA,GAAM,WAAW,GAAA,GAAM,GAAA;AACjC,MAAA,SAAA,CAAU,GAAA,GAAM,UAAA,CAAW,GAAA,GAAM,IAAA,CAAK,SAAA;AAQtC,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAEjD,MAAA,MAAM,IAAA,CAAK,SAAS,MAAA,CAAO;AAAA,QACzB,EAAA,EAAI,GAAA;AAAA,QACJ,GAAA,EAAK,SAAA;AAAA,QACL,WAAW,IAAI,IAAA;AAAA,UACb,IAAA,CAAK,GAAA,EAAI,GACP,IAAA,CAAK,qBACH,aAAA,GACA;AAAA;AACN,OACD,CAAA;AAGD,MAAA,OAAO,UAAA;AAAA,IACT,CAAA,GAAG;AAEH,IAAA,IAAA,CAAK,iBAAA,GAAoB,OAAA;AAEzB,IAAA,IAAI;AAGF,MAAA,MAAM,OAAA;AAAA,IACR,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,oCAAA,EAAuC,KAAK,CAAA,CAAE,CAAA;AAChE,MAAA,OAAO,IAAA,CAAK,SAAA;AACZ,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACd;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,QAAA,GAA4C;AAC1C,IAAA,OAAO,IAAA,CAAK,SAAS,QAAA,EAAS;AAAA,EAChC;AACF;;;;"}

package/dist/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.cjs.js

@@ -7,6 +7,8 @@ var jose = require('jose');
 const DEFAULT_ALGORITHM = "ES256";
 const SECONDS_IN_MS = 1e3;
 class StaticConfigPluginKeySource {
+  keyPairs;
+  keyDurationSeconds;
   constructor(keyPairs, keyDurationSeconds) {
     this.keyPairs = keyPairs;
     this.keyDurationSeconds = keyDurationSeconds;

package/dist/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"StaticConfigPluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { promises as fs } from 'fs';\nimport { JWK, exportJWK, importPKCS8, importSPKI } from 'jose';\nimport { KeyLike } from 'jose';\nimport { KeyPayload } from './types';\nimport { PluginKeySource } from './types';\n\nexport type KeyPair = {\n  publicKey: JWK;\n  privateKey?: JWK;\n  keyId: string;\n};\n\nexport type StaticKeyConfig = {\n  publicKeyFile: string;\n  privateKeyFile?: string;\n  keyId: string;\n  algorithm: string;\n};\n\nconst DEFAULT_ALGORITHM = 'ES256';\n\nconst SECONDS_IN_MS = 1000;\n\n/**\n * Key source that loads predefined public/private key pairs from disk.\n *\n * The private key should be represented using the PKCS#8 format,\n * while the public key should be in the SPKI format.\n *\n * @remarks\n *\n * You can generate a public and private key pair, using\n * openssl:\n *\n * Generate a private key using the ES256 algorithm\n * ```sh\n * openssl ecparam -name prime256v1 -genkey -out private.ec.key\n * ```\n * Convert it to PKCS#8 format\n * ```sh\n * openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private.ec.key -out private.key\n * ```\n * Extract the public key\n * ```sh\n * openssl ec -inform PEM -outform PEM -pubout -in private.key -out public.key\n * ```\n *\n * Provide the paths to private.key and public.key as the respective\n * private and public key paths in the `create` method.\n */\nexport class StaticConfigPluginKeySource implements PluginKeySource {\n  private constructor(\n    private readonly keyPairs: KeyPair[],\n    private readonly keyDurationSeconds: number,\n  ) {}\n\n  public static async create(options: {\n    sourceConfig: Config;\n    keyDuration: HumanDuration;\n  }): Promise<PluginKeySource> {\n    const keyConfigs = options.sourceConfig\n      .getConfigArray('static.keys')\n      .map(c => {\n        const staticKeyConfig: StaticKeyConfig = {\n          publicKeyFile: c.getString('publicKeyFile'),\n          privateKeyFile: c.getOptionalString('privateKeyFile'),\n          keyId: c.getString('keyId'),\n          algorithm: c.getOptionalString('algorithm') ?? DEFAULT_ALGORITHM,\n        };\n\n        return staticKeyConfig;\n      });\n\n    const keyPairs = await Promise.all(\n      keyConfigs.map(async k => await this.loadKeyPair(k)),\n    );\n\n    if (keyPairs.length < 1) {\n      throw new Error(\n        'At least one key pair must be provided in static.keys, when the static key store type is used',\n      );\n    } else if (!keyPairs[0].privateKey) {\n      throw new Error(\n        'Private key for signing must be provided in the first key pair in static.keys, when the static key store type is used',\n      );\n    }\n\n    return new StaticConfigPluginKeySource(\n      keyPairs,\n      durationToMilliseconds(options.keyDuration) / SECONDS_IN_MS,\n    );\n  }\n\n  async getPrivateSigningKey(): Promise<JWK> {\n    return this.keyPairs[0].privateKey!;\n  }\n\n  async listKeys(): Promise<{ keys: KeyPayload[] }> {\n    const keys = this.keyPairs.map(k => this.keyPairToStoredKey(k));\n    return { keys };\n  }\n\n  private static async loadKeyPair(options: StaticKeyConfig): Promise<KeyPair> {\n    const algorithm = options.algorithm;\n    const keyId = options.keyId;\n    const publicKey = await this.loadPublicKeyFromFile(\n      options.publicKeyFile,\n      keyId,\n      algorithm,\n    );\n    const privateKey = options.privateKeyFile\n      ? await this.loadPrivateKeyFromFile(\n          options.privateKeyFile,\n          keyId,\n          algorithm,\n        )\n      : undefined;\n\n    return { publicKey, privateKey, keyId };\n  }\n\n  private static async loadPublicKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n  ): Promise<JWK> {\n    return this.loadKeyFromFile(path, keyId, algorithm, importSPKI);\n  }\n\n  private static async loadPrivateKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n  ): Promise<JWK> {\n    return this.loadKeyFromFile(path, keyId, algorithm, importPKCS8);\n  }\n\n  private static async loadKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n    importer: (content: string, algorithm: string) => Promise<KeyLike>,\n  ): Promise<JWK> {\n    const content = await fs.readFile(path, { encoding: 'utf8', flag: 'r' });\n    const key = await importer(content, algorithm);\n    const jwk = await exportJWK(key);\n    jwk.kid = keyId;\n    jwk.alg = algorithm;\n\n    return jwk;\n  }\n\n  private keyPairToStoredKey(keyPair: KeyPair): KeyPayload {\n    const publicKey = {\n      ...keyPair.publicKey,\n      kid: keyPair.keyId,\n    };\n\n    return {\n      key: publicKey,\n      id: keyPair.keyId,\n      expiresAt: new Date(Date.now() + this.keyDurationSeconds * SECONDS_IN_MS),\n    };\n  }\n}\n"],"names":["durationToMilliseconds","importSPKI","importPKCS8","fs","exportJWK"],"mappings":";;;;;;AAqCA,MAAM,iBAAA,GAAoB,OAAA;AAE1B,MAAM,aAAA,GAAgB,GAAA;AA6Bf,MAAM,2BAAA,CAAuD;AAAA,EAC1D,WAAA,CACW,UACA,kBAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AAAA,EAChB;AAAA,EAEH,aAAoB,OAAO,OAAA,EAGE;AAC3B,IAAA,MAAM,aAAa,OAAA,CAAQ,YAAA,CACxB,eAAe,aAAa,CAAA,CAC5B,IAAI,CAAA,CAAA,KAAK;AACR,MAAA,MAAM,eAAA,GAAmC;AAAA,QACvC,aAAA,EAAe,CAAA,CAAE,SAAA,CAAU,eAAe,CAAA;AAAA,QAC1C,cAAA,EAAgB,CAAA,CAAE,iBAAA,CAAkB,gBAAgB,CAAA;AAAA,QACpD,KAAA,EAAO,CAAA,CAAE,SAAA,CAAU,OAAO,CAAA;AAAA,QAC1B,SAAA,EAAW,CAAA,CAAE,iBAAA,CAAkB,WAAW,CAAA,IAAK;AAAA,OACjD;AAEA,MAAA,OAAO,eAAA;AAAA,IACT,CAAC,CAAA;AAEH,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA;AAAA,MAC7B,UAAA,CAAW,IAAI,OAAM,CAAA,KAAK,MAAM,IAAA,CAAK,WAAA,CAAY,CAAC,CAAC;AAAA,KACrD;AAEA,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,QAAA,CAAS,CAAC,EAAE,UAAA,EAAY;AAClC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,2BAAA;AAAA,MACT,QAAA;AAAA,MACAA,4BAAA,CAAuB,OAAA,CAAQ,WAAW,CAAA,GAAI;AAAA,KAChD;AAAA,EACF;AAAA,EAEA,MAAM,oBAAA,GAAqC;AACzC,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,CAAC,CAAA,CAAE,UAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,QAAA,GAA4C;AAChD,IAAA,MAAM,IAAA,GAAO,KAAK,QAAA,CAAS,GAAA,CAAI,OAAK,IAAA,CAAK,kBAAA,CAAmB,CAAC,CAAC,CAAA;AAC9D,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB;AAAA,EAEA,aAAqB,YAAY,OAAA,EAA4C;AAC3E,IAAA,MAAM,YAAY,OAAA,CAAQ,SAAA;AAC1B,IAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,qBAAA;AAAA,MAC3B,OAAA,CAAQ,aAAA;AAAA,MACR,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,GACvB,MAAM,IAAA,CAAK,sBAAA;AAAA,MACT,OAAA,CAAQ,cAAA;AAAA,MACR,KAAA;AAAA,MACA;AAAA,KACF,GACA,MAAA;AAEJ,IAAA,OAAO,EAAE,SAAA,EAAW,UAAA,EAAY,KAAA,EAAM;AAAA,EACxC;AAAA,EAEA,aAAqB,qBAAA,CACnB,IAAA,EACA,KAAA,EACA,SAAA,EACc;AACd,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,IAAA,EAAM,KAAA,EAAO,WAAWC,eAAU,CAAA;AAAA,EAChE;AAAA,EAEA,aAAqB,sBAAA,CACnB,IAAA,EACA,KAAA,EACA,SAAA,EACc;AACd,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,IAAA,EAAM,KAAA,EAAO,WAAWC,gBAAW,CAAA;AAAA,EACjE;AAAA,EAEA,aAAqB,eAAA,CACnB,IAAA,EACA,KAAA,EACA,WACA,QAAA,EACc;AACd,IAAA,MAAM,OAAA,GAAU,MAAMC,WAAA,CAAG,QAAA,CAAS,IAAA,EAAM,EAAE,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAM,GAAA,EAAK,CAAA;AACvE,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,OAAA,EAAS,SAAS,CAAA;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAMC,cAAA,CAAU,GAAG,CAAA;AAC/B,IAAA,GAAA,CAAI,GAAA,GAAM,KAAA;AACV,IAAA,GAAA,CAAI,GAAA,GAAM,SAAA;AAEV,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEQ,mBAAmB,OAAA,EAA8B;AACvD,IAAA,MAAM,SAAA,GAAY;AAAA,MAChB,GAAG,OAAA,CAAQ,SAAA;AAAA,MACX,KAAK,OAAA,CAAQ;AAAA,KACf;AAEA,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,SAAA;AAAA,MACL,IAAI,OAAA,CAAQ,KAAA;AAAA,MACZ,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,qBAAqB,aAAa;AAAA,KAC1E;AAAA,EACF;AACF;;;;"}
+{"version":3,"file":"StaticConfigPluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { promises as fs } from 'fs';\nimport { JWK, exportJWK, importPKCS8, importSPKI } from 'jose';\nimport { KeyLike } from 'jose';\nimport { KeyPayload } from './types';\nimport { PluginKeySource } from './types';\n\nexport type KeyPair = {\n  publicKey: JWK;\n  privateKey?: JWK;\n  keyId: string;\n};\n\nexport type StaticKeyConfig = {\n  publicKeyFile: string;\n  privateKeyFile?: string;\n  keyId: string;\n  algorithm: string;\n};\n\nconst DEFAULT_ALGORITHM = 'ES256';\n\nconst SECONDS_IN_MS = 1000;\n\n/**\n * Key source that loads predefined public/private key pairs from disk.\n *\n * The private key should be represented using the PKCS#8 format,\n * while the public key should be in the SPKI format.\n *\n * @remarks\n *\n * You can generate a public and private key pair, using\n * openssl:\n *\n * Generate a private key using the ES256 algorithm\n * ```sh\n * openssl ecparam -name prime256v1 -genkey -out private.ec.key\n * ```\n * Convert it to PKCS#8 format\n * ```sh\n * openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private.ec.key -out private.key\n * ```\n * Extract the public key\n * ```sh\n * openssl ec -inform PEM -outform PEM -pubout -in private.key -out public.key\n * ```\n *\n * Provide the paths to private.key and public.key as the respective\n * private and public key paths in the `create` method.\n */\nexport class StaticConfigPluginKeySource implements PluginKeySource {\n  private readonly keyPairs: KeyPair[];\n  private readonly keyDurationSeconds: number;\n\n  private constructor(keyPairs: KeyPair[], keyDurationSeconds: number) {\n    this.keyPairs = keyPairs;\n    this.keyDurationSeconds = keyDurationSeconds;\n  }\n\n  public static async create(options: {\n    sourceConfig: Config;\n    keyDuration: HumanDuration;\n  }): Promise<PluginKeySource> {\n    const keyConfigs = options.sourceConfig\n      .getConfigArray('static.keys')\n      .map(c => {\n        const staticKeyConfig: StaticKeyConfig = {\n          publicKeyFile: c.getString('publicKeyFile'),\n          privateKeyFile: c.getOptionalString('privateKeyFile'),\n          keyId: c.getString('keyId'),\n          algorithm: c.getOptionalString('algorithm') ?? DEFAULT_ALGORITHM,\n        };\n\n        return staticKeyConfig;\n      });\n\n    const keyPairs = await Promise.all(\n      keyConfigs.map(async k => await this.loadKeyPair(k)),\n    );\n\n    if (keyPairs.length < 1) {\n      throw new Error(\n        'At least one key pair must be provided in static.keys, when the static key store type is used',\n      );\n    } else if (!keyPairs[0].privateKey) {\n      throw new Error(\n        'Private key for signing must be provided in the first key pair in static.keys, when the static key store type is used',\n      );\n    }\n\n    return new StaticConfigPluginKeySource(\n      keyPairs,\n      durationToMilliseconds(options.keyDuration) / SECONDS_IN_MS,\n    );\n  }\n\n  async getPrivateSigningKey(): Promise<JWK> {\n    return this.keyPairs[0].privateKey!;\n  }\n\n  async listKeys(): Promise<{ keys: KeyPayload[] }> {\n    const keys = this.keyPairs.map(k => this.keyPairToStoredKey(k));\n    return { keys };\n  }\n\n  private static async loadKeyPair(options: StaticKeyConfig): Promise<KeyPair> {\n    const algorithm = options.algorithm;\n    const keyId = options.keyId;\n    const publicKey = await this.loadPublicKeyFromFile(\n      options.publicKeyFile,\n      keyId,\n      algorithm,\n    );\n    const privateKey = options.privateKeyFile\n      ? await this.loadPrivateKeyFromFile(\n          options.privateKeyFile,\n          keyId,\n          algorithm,\n        )\n      : undefined;\n\n    return { publicKey, privateKey, keyId };\n  }\n\n  private static async loadPublicKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n  ): Promise<JWK> {\n    return this.loadKeyFromFile(path, keyId, algorithm, importSPKI);\n  }\n\n  private static async loadPrivateKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n  ): Promise<JWK> {\n    return this.loadKeyFromFile(path, keyId, algorithm, importPKCS8);\n  }\n\n  private static async loadKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n    importer: (content: string, algorithm: string) => Promise<KeyLike>,\n  ): Promise<JWK> {\n    const content = await fs.readFile(path, { encoding: 'utf8', flag: 'r' });\n    const key = await importer(content, algorithm);\n    const jwk = await exportJWK(key);\n    jwk.kid = keyId;\n    jwk.alg = algorithm;\n\n    return jwk;\n  }\n\n  private keyPairToStoredKey(keyPair: KeyPair): KeyPayload {\n    const publicKey = {\n      ...keyPair.publicKey,\n      kid: keyPair.keyId,\n    };\n\n    return {\n      key: publicKey,\n      id: keyPair.keyId,\n      expiresAt: new Date(Date.now() + this.keyDurationSeconds * SECONDS_IN_MS),\n    };\n  }\n}\n"],"names":["durationToMilliseconds","importSPKI","importPKCS8","fs","exportJWK"],"mappings":";;;;;;AAqCA,MAAM,iBAAA,GAAoB,OAAA;AAE1B,MAAM,aAAA,GAAgB,GAAA;AA6Bf,MAAM,2BAAA,CAAuD;AAAA,EACjD,QAAA;AAAA,EACA,kBAAA;AAAA,EAET,WAAA,CAAY,UAAqB,kBAAA,EAA4B;AACnE,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAAA,EAC5B;AAAA,EAEA,aAAoB,OAAO,OAAA,EAGE;AAC3B,IAAA,MAAM,aAAa,OAAA,CAAQ,YAAA,CACxB,eAAe,aAAa,CAAA,CAC5B,IAAI,CAAA,CAAA,KAAK;AACR,MAAA,MAAM,eAAA,GAAmC;AAAA,QACvC,aAAA,EAAe,CAAA,CAAE,SAAA,CAAU,eAAe,CAAA;AAAA,QAC1C,cAAA,EAAgB,CAAA,CAAE,iBAAA,CAAkB,gBAAgB,CAAA;AAAA,QACpD,KAAA,EAAO,CAAA,CAAE,SAAA,CAAU,OAAO,CAAA;AAAA,QAC1B,SAAA,EAAW,CAAA,CAAE,iBAAA,CAAkB,WAAW,CAAA,IAAK;AAAA,OACjD;AAEA,MAAA,OAAO,eAAA;AAAA,IACT,CAAC,CAAA;AAEH,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA;AAAA,MAC7B,UAAA,CAAW,IAAI,OAAM,CAAA,KAAK,MAAM,IAAA,CAAK,WAAA,CAAY,CAAC,CAAC;AAAA,KACrD;AAEA,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF,CAAA,MAAA,IAAW,CAAC,QAAA,CAAS,CAAC,EAAE,UAAA,EAAY;AAClC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,2BAAA;AAAA,MACT,QAAA;AAAA,MACAA,4BAAA,CAAuB,OAAA,CAAQ,WAAW,CAAA,GAAI;AAAA,KAChD;AAAA,EACF;AAAA,EAEA,MAAM,oBAAA,GAAqC;AACzC,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,CAAC,CAAA,CAAE,UAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,QAAA,GAA4C;AAChD,IAAA,MAAM,IAAA,GAAO,KAAK,QAAA,CAAS,GAAA,CAAI,OAAK,IAAA,CAAK,kBAAA,CAAmB,CAAC,CAAC,CAAA;AAC9D,IAAA,OAAO,EAAE,IAAA,EAAK;AAAA,EAChB;AAAA,EAEA,aAAqB,YAAY,OAAA,EAA4C;AAC3E,IAAA,MAAM,YAAY,OAAA,CAAQ,SAAA;AAC1B,IAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,qBAAA;AAAA,MAC3B,OAAA,CAAQ,aAAA;AAAA,MACR,KAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,GACvB,MAAM,IAAA,CAAK,sBAAA;AAAA,MACT,OAAA,CAAQ,cAAA;AAAA,MACR,KAAA;AAAA,MACA;AAAA,KACF,GACA,MAAA;AAEJ,IAAA,OAAO,EAAE,SAAA,EAAW,UAAA,EAAY,KAAA,EAAM;AAAA,EACxC;AAAA,EAEA,aAAqB,qBAAA,CACnB,IAAA,EACA,KAAA,EACA,SAAA,EACc;AACd,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,IAAA,EAAM,KAAA,EAAO,WAAWC,eAAU,CAAA;AAAA,EAChE;AAAA,EAEA,aAAqB,sBAAA,CACnB,IAAA,EACA,KAAA,EACA,SAAA,EACc;AACd,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,IAAA,EAAM,KAAA,EAAO,WAAWC,gBAAW,CAAA;AAAA,EACjE;AAAA,EAEA,aAAqB,eAAA,CACnB,IAAA,EACA,KAAA,EACA,WACA,QAAA,EACc;AACd,IAAA,MAAM,OAAA,GAAU,MAAMC,WAAA,CAAG,QAAA,CAAS,IAAA,EAAM,EAAE,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAM,GAAA,EAAK,CAAA;AACvE,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,OAAA,EAAS,SAAS,CAAA;AAC7C,IAAA,MAAM,GAAA,GAAM,MAAMC,cAAA,CAAU,GAAG,CAAA;AAC/B,IAAA,GAAA,CAAI,GAAA,GAAM,KAAA;AACV,IAAA,GAAA,CAAI,GAAA,GAAM,SAAA;AAEV,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEQ,mBAAmB,OAAA,EAA8B;AACvD,IAAA,MAAM,SAAA,GAAY;AAAA,MAChB,GAAG,OAAA,CAAQ,SAAA;AAAA,MACX,KAAK,OAAA,CAAQ;AAAA,KACf;AAEA,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,SAAA;AAAA,MACL,IAAI,OAAA,CAAQ,KAAA;AAAA,MACZ,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,qBAAqB,aAAa;AAAA,KAC1E;AAAA,EACF;AACF;;;;"}

package/dist/entrypoints/auth/user/UserTokenHandler.cjs.js

@@ -6,10 +6,6 @@ var jose = require('jose');
 var JwksClient = require('../JwksClient.cjs.js');
 
 class UserTokenHandler {
-  constructor(jwksClient, logger) {
-    this.jwksClient = jwksClient;
-    this.logger = logger;
-  }
   static create(options) {
     const jwksClient = new JwksClient.JwksClient(async () => {
       const url = await options.discovery.getBaseUrl("auth");
@@ -17,6 +13,12 @@ class UserTokenHandler {
     });
     return new UserTokenHandler(jwksClient, options.logger);
   }
+  jwksClient;
+  logger;
+  constructor(jwksClient, logger) {
+    this.jwksClient = jwksClient;
+    this.logger = logger;
+  }
   async verifyToken(token) {
     const verifyOpts = this.#getTokenVerificationOptions(token);
     if (!verifyOpts) {

package/dist/entrypoints/auth/user/UserTokenHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/user/UserTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport {\n  base64url,\n  decodeJwt,\n  decodeProtectedHeader,\n  jwtVerify,\n  JWTVerifyOptions,\n} from 'jose';\nimport { JwksClient } from '../JwksClient';\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @internal\n */\nexport class UserTokenHandler {\n  static create(options: {\n    discovery: DiscoveryService;\n    logger: LoggerService;\n  }): UserTokenHandler {\n    const jwksClient = new JwksClient(async () => {\n      const url = await options.discovery.getBaseUrl('auth');\n      return new URL(`${url}/.well-known/jwks.json`);\n    });\n    return new UserTokenHandler(jwksClient, options.logger);\n  }\n\n  constructor(\n    private readonly jwksClient: JwksClient,\n    private readonly logger: LoggerService,\n  ) {}\n\n  async verifyToken(token: string) {\n    const verifyOpts = this.#getTokenVerificationOptions(token);\n    if (!verifyOpts) {\n      return undefined;\n    }\n\n    await this.jwksClient.refreshKeyStore(token);\n\n    // Verify a limited token, ensuring the necessarily claims are present and token type is correct\n    const { payload } = await jwtVerify(\n      token,\n      this.jwksClient.getKey,\n      verifyOpts,\n    ).catch(e => {\n      this.logger.warn('Failed to verify incoming user token', e);\n      throw new AuthenticationError('Failed user token verification');\n    });\n\n    const userEntityRef = payload.sub;\n\n    if (!userEntityRef) {\n      throw new AuthenticationError('No user sub found in token');\n    }\n\n    return { userEntityRef };\n  }\n\n  #getTokenVerificationOptions(token: string): JWTVerifyOptions | undefined {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n\n      if (typ === tokenTypes.user.typParam) {\n        return {\n          requiredClaims: ['iat', 'exp', 'sub'],\n          typ: tokenTypes.user.typParam,\n        };\n      }\n\n      if (typ === tokenTypes.limitedUser.typParam) {\n        return {\n          requiredClaims: ['iat', 'exp', 'sub'],\n          typ: tokenTypes.limitedUser.typParam,\n        };\n      }\n\n      const { aud } = decodeJwt(token);\n      if (aud === tokenTypes.user.audClaim) {\n        return {\n          audience: tokenTypes.user.audClaim,\n        };\n      }\n    } catch {\n      /* ignore */\n    }\n\n    return undefined;\n  }\n\n  createLimitedUserToken(backstageToken: string) {\n    const [headerRaw, payloadRaw] = backstageToken.split('.');\n    const header = JSON.parse(\n      new TextDecoder().decode(base64url.decode(headerRaw)),\n    );\n    const payload = JSON.parse(\n      new TextDecoder().decode(base64url.decode(payloadRaw)),\n    );\n\n    const tokenType = header.typ;\n\n    // Only new user tokens can be used to create a limited user token. If we\n    // can't create a limited token, or the token is already a limited one, we\n    // return the original token\n    if (!tokenType || tokenType === tokenTypes.limitedUser.typParam) {\n      return { token: backstageToken, expiresAt: new Date(payload.exp * 1000) };\n    }\n\n    if (tokenType !== tokenTypes.user.typParam) {\n      throw new AuthenticationError(\n        'Failed to create limited user token, invalid token type',\n      );\n    }\n\n    // NOTE: The order and properties in both the header and payload must match\n    //       the usage in plugins/auth-backend/src/identity/TokenFactory.ts\n    const limitedUserToken = [\n      base64url.encode(\n        JSON.stringify({\n          typ: tokenTypes.limitedUser.typParam,\n          alg: header.alg,\n          kid: header.kid,\n        }),\n      ),\n      base64url.encode(\n        JSON.stringify({\n          sub: payload.sub,\n          iat: payload.iat,\n          exp: payload.exp,\n        }),\n      ),\n      payload.uip,\n    ].join('.');\n\n    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1000) };\n  }\n\n  isLimitedUserToken(token: string): boolean {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      return typ === tokenTypes.limitedUser.typParam;\n    } catch {\n      return false;\n    }\n  }\n}\n"],"names":["JwksClient","jwtVerify","AuthenticationError","decodeProtectedHeader","tokenTypes","decodeJwt","base64url"],"mappings":";;;;;;;AAkCO,MAAM,gBAAA,CAAiB;AAAA,EAY5B,WAAA,CACmB,YACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA,EAdH,OAAO,OAAO,OAAA,EAGO;AACnB,IAAA,MAAM,UAAA,GAAa,IAAIA,qBAAA,CAAW,YAAY;AAC5C,MAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,SAAA,CAAU,WAAW,MAAM,CAAA;AACrD,MAAA,OAAO,IAAI,GAAA,CAAI,CAAA,EAAG,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAC/C,CAAC,CAAA;AACD,IAAA,OAAO,IAAI,gBAAA,CAAiB,UAAA,EAAY,OAAA,CAAQ,MAAM,CAAA;AAAA,EACxD;AAAA,EAOA,MAAM,YAAY,KAAA,EAAe;AAC/B,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,4BAAA,CAA6B,KAAK,CAAA;AAC1D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,CAAK,UAAA,CAAW,eAAA,CAAgB,KAAK,CAAA;AAG3C,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,KAAK,UAAA,CAAW,MAAA;AAAA,MAChB;AAAA,KACF,CAAE,MAAM,CAAA,CAAA,KAAK;AACX,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,sCAAA,EAAwC,CAAC,CAAA;AAC1D,MAAA,MAAM,IAAIC,2BAAoB,gCAAgC,CAAA;AAAA,IAChE,CAAC,CAAA;AAED,IAAA,MAAM,gBAAgB,OAAA,CAAQ,GAAA;AAE9B,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAIA,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,OAAO,EAAE,aAAA,EAAc;AAAA,EACzB;AAAA,EAEA,6BAA6B,KAAA,EAA6C;AACxE,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,0BAAA,CAAsB,KAAK,CAAA;AAE3C,MAAA,IAAI,GAAA,KAAQC,yBAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AACpC,QAAA,OAAO;AAAA,UACL,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,KAAK,CAAA;AAAA,UACpC,GAAA,EAAKA,0BAAW,IAAA,CAAK;AAAA,SACvB;AAAA,MACF;AAEA,MAAA,IAAI,GAAA,KAAQA,yBAAA,CAAW,WAAA,CAAY,QAAA,EAAU;AAC3C,QAAA,OAAO;AAAA,UACL,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,KAAK,CAAA;AAAA,UACpC,GAAA,EAAKA,0BAAW,WAAA,CAAY;AAAA,SAC9B;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,cAAA,CAAU,KAAK,CAAA;AAC/B,MAAA,IAAI,GAAA,KAAQD,yBAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AACpC,QAAA,OAAO;AAAA,UACL,QAAA,EAAUA,0BAAW,IAAA,CAAK;AAAA,SAC5B;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,uBAAuB,cAAA,EAAwB;AAC7C,IAAA,MAAM,CAAC,SAAA,EAAW,UAAU,CAAA,GAAI,cAAA,CAAe,MAAM,GAAG,CAAA;AACxD,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MAClB,IAAI,WAAA,EAAY,CAAE,OAAOE,cAAA,CAAU,MAAA,CAAO,SAAS,CAAC;AAAA,KACtD;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AAAA,MACnB,IAAI,WAAA,EAAY,CAAE,OAAOA,cAAA,CAAU,MAAA,CAAO,UAAU,CAAC;AAAA,KACvD;AAEA,IAAA,MAAM,YAAY,MAAA,CAAO,GAAA;AAKzB,IAAA,IAAI,CAAC,SAAA,IAAa,SAAA,KAAcF,yBAAA,CAAW,YAAY,QAAA,EAAU;AAC/D,MAAA,OAAO,EAAE,OAAO,cAAA,EAAgB,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,EAAE;AAAA,IAC1E;AAEA,IAAA,IAAI,SAAA,KAAcA,yBAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AAC1C,MAAA,MAAM,IAAIF,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAIA,IAAA,MAAM,gBAAA,GAAmB;AAAA,MACvBI,cAAA,CAAU,MAAA;AAAA,QACR,KAAK,SAAA,CAAU;AAAA,UACb,GAAA,EAAKF,0BAAW,WAAA,CAAY,QAAA;AAAA,UAC5B,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SACb;AAAA,OACH;AAAA,MACAE,cAAA,CAAU,MAAA;AAAA,QACR,KAAK,SAAA,CAAU;AAAA,UACb,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,KAAK,OAAA,CAAQ;AAAA,SACd;AAAA,OACH;AAAA,MACA,OAAA,CAAQ;AAAA,KACV,CAAE,KAAK,GAAG,CAAA;AAEV,IAAA,OAAO,EAAE,OAAO,gBAAA,EAAkB,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,EAAE;AAAA,EAC5E;AAAA,EAEA,mBAAmB,KAAA,EAAwB;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIH,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAA,OAAO,GAAA,KAAQC,0BAAW,WAAA,CAAY,QAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;;"}
+{"version":3,"file":"UserTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/user/UserTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport {\n  base64url,\n  decodeJwt,\n  decodeProtectedHeader,\n  jwtVerify,\n  JWTVerifyOptions,\n} from 'jose';\nimport { JwksClient } from '../JwksClient';\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @internal\n */\nexport class UserTokenHandler {\n  static create(options: {\n    discovery: DiscoveryService;\n    logger: LoggerService;\n  }): UserTokenHandler {\n    const jwksClient = new JwksClient(async () => {\n      const url = await options.discovery.getBaseUrl('auth');\n      return new URL(`${url}/.well-known/jwks.json`);\n    });\n    return new UserTokenHandler(jwksClient, options.logger);\n  }\n\n  private readonly jwksClient: JwksClient;\n  private readonly logger: LoggerService;\n\n  constructor(jwksClient: JwksClient, logger: LoggerService) {\n    this.jwksClient = jwksClient;\n    this.logger = logger;\n  }\n\n  async verifyToken(token: string) {\n    const verifyOpts = this.#getTokenVerificationOptions(token);\n    if (!verifyOpts) {\n      return undefined;\n    }\n\n    await this.jwksClient.refreshKeyStore(token);\n\n    // Verify a limited token, ensuring the necessarily claims are present and token type is correct\n    const { payload } = await jwtVerify(\n      token,\n      this.jwksClient.getKey,\n      verifyOpts,\n    ).catch(e => {\n      this.logger.warn('Failed to verify incoming user token', e);\n      throw new AuthenticationError('Failed user token verification');\n    });\n\n    const userEntityRef = payload.sub;\n\n    if (!userEntityRef) {\n      throw new AuthenticationError('No user sub found in token');\n    }\n\n    return { userEntityRef };\n  }\n\n  #getTokenVerificationOptions(token: string): JWTVerifyOptions | undefined {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n\n      if (typ === tokenTypes.user.typParam) {\n        return {\n          requiredClaims: ['iat', 'exp', 'sub'],\n          typ: tokenTypes.user.typParam,\n        };\n      }\n\n      if (typ === tokenTypes.limitedUser.typParam) {\n        return {\n          requiredClaims: ['iat', 'exp', 'sub'],\n          typ: tokenTypes.limitedUser.typParam,\n        };\n      }\n\n      const { aud } = decodeJwt(token);\n      if (aud === tokenTypes.user.audClaim) {\n        return {\n          audience: tokenTypes.user.audClaim,\n        };\n      }\n    } catch {\n      /* ignore */\n    }\n\n    return undefined;\n  }\n\n  createLimitedUserToken(backstageToken: string) {\n    const [headerRaw, payloadRaw] = backstageToken.split('.');\n    const header = JSON.parse(\n      new TextDecoder().decode(base64url.decode(headerRaw)),\n    );\n    const payload = JSON.parse(\n      new TextDecoder().decode(base64url.decode(payloadRaw)),\n    );\n\n    const tokenType = header.typ;\n\n    // Only new user tokens can be used to create a limited user token. If we\n    // can't create a limited token, or the token is already a limited one, we\n    // return the original token\n    if (!tokenType || tokenType === tokenTypes.limitedUser.typParam) {\n      return { token: backstageToken, expiresAt: new Date(payload.exp * 1000) };\n    }\n\n    if (tokenType !== tokenTypes.user.typParam) {\n      throw new AuthenticationError(\n        'Failed to create limited user token, invalid token type',\n      );\n    }\n\n    // NOTE: The order and properties in both the header and payload must match\n    //       the usage in plugins/auth-backend/src/identity/TokenFactory.ts\n    const limitedUserToken = [\n      base64url.encode(\n        JSON.stringify({\n          typ: tokenTypes.limitedUser.typParam,\n          alg: header.alg,\n          kid: header.kid,\n        }),\n      ),\n      base64url.encode(\n        JSON.stringify({\n          sub: payload.sub,\n          iat: payload.iat,\n          exp: payload.exp,\n        }),\n      ),\n      payload.uip,\n    ].join('.');\n\n    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1000) };\n  }\n\n  isLimitedUserToken(token: string): boolean {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      return typ === tokenTypes.limitedUser.typParam;\n    } catch {\n      return false;\n    }\n  }\n}\n"],"names":["JwksClient","jwtVerify","AuthenticationError","decodeProtectedHeader","tokenTypes","decodeJwt","base64url"],"mappings":";;;;;;;AAkCO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,OAAA,EAGO;AACnB,IAAA,MAAM,UAAA,GAAa,IAAIA,qBAAA,CAAW,YAAY;AAC5C,MAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,SAAA,CAAU,WAAW,MAAM,CAAA;AACrD,MAAA,OAAO,IAAI,GAAA,CAAI,CAAA,EAAG,GAAG,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAC/C,CAAC,CAAA;AACD,IAAA,OAAO,IAAI,gBAAA,CAAiB,UAAA,EAAY,OAAA,CAAQ,MAAM,CAAA;AAAA,EACxD;AAAA,EAEiB,UAAA;AAAA,EACA,MAAA;AAAA,EAEjB,WAAA,CAAY,YAAwB,MAAA,EAAuB;AACzD,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,MAAM,YAAY,KAAA,EAAe;AAC/B,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,4BAAA,CAA6B,KAAK,CAAA;AAC1D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,CAAK,UAAA,CAAW,eAAA,CAAgB,KAAK,CAAA;AAG3C,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,KAAK,UAAA,CAAW,MAAA;AAAA,MAChB;AAAA,KACF,CAAE,MAAM,CAAA,CAAA,KAAK;AACX,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,sCAAA,EAAwC,CAAC,CAAA;AAC1D,MAAA,MAAM,IAAIC,2BAAoB,gCAAgC,CAAA;AAAA,IAChE,CAAC,CAAA;AAED,IAAA,MAAM,gBAAgB,OAAA,CAAQ,GAAA;AAE9B,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAIA,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,OAAO,EAAE,aAAA,EAAc;AAAA,EACzB;AAAA,EAEA,6BAA6B,KAAA,EAA6C;AACxE,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,0BAAA,CAAsB,KAAK,CAAA;AAE3C,MAAA,IAAI,GAAA,KAAQC,yBAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AACpC,QAAA,OAAO;AAAA,UACL,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,KAAK,CAAA;AAAA,UACpC,GAAA,EAAKA,0BAAW,IAAA,CAAK;AAAA,SACvB;AAAA,MACF;AAEA,MAAA,IAAI,GAAA,KAAQA,yBAAA,CAAW,WAAA,CAAY,QAAA,EAAU;AAC3C,QAAA,OAAO;AAAA,UACL,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,KAAK,CAAA;AAAA,UACpC,GAAA,EAAKA,0BAAW,WAAA,CAAY;AAAA,SAC9B;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,cAAA,CAAU,KAAK,CAAA;AAC/B,MAAA,IAAI,GAAA,KAAQD,yBAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AACpC,QAAA,OAAO;AAAA,UACL,QAAA,EAAUA,0BAAW,IAAA,CAAK;AAAA,SAC5B;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,uBAAuB,cAAA,EAAwB;AAC7C,IAAA,MAAM,CAAC,SAAA,EAAW,UAAU,CAAA,GAAI,cAAA,CAAe,MAAM,GAAG,CAAA;AACxD,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MAClB,IAAI,WAAA,EAAY,CAAE,OAAOE,cAAA,CAAU,MAAA,CAAO,SAAS,CAAC;AAAA,KACtD;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AAAA,MACnB,IAAI,WAAA,EAAY,CAAE,OAAOA,cAAA,CAAU,MAAA,CAAO,UAAU,CAAC;AAAA,KACvD;AAEA,IAAA,MAAM,YAAY,MAAA,CAAO,GAAA;AAKzB,IAAA,IAAI,CAAC,SAAA,IAAa,SAAA,KAAcF,yBAAA,CAAW,YAAY,QAAA,EAAU;AAC/D,MAAA,OAAO,EAAE,OAAO,cAAA,EAAgB,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,EAAE;AAAA,IAC1E;AAEA,IAAA,IAAI,SAAA,KAAcA,yBAAA,CAAW,IAAA,CAAK,QAAA,EAAU;AAC1C,MAAA,MAAM,IAAIF,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAIA,IAAA,MAAM,gBAAA,GAAmB;AAAA,MACvBI,cAAA,CAAU,MAAA;AAAA,QACR,KAAK,SAAA,CAAU;AAAA,UACb,GAAA,EAAKF,0BAAW,WAAA,CAAY,QAAA;AAAA,UAC5B,KAAK,MAAA,CAAO,GAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SACb;AAAA,OACH;AAAA,MACAE,cAAA,CAAU,MAAA;AAAA,QACR,KAAK,SAAA,CAAU;AAAA,UACb,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,KAAK,OAAA,CAAQ;AAAA,SACd;AAAA,OACH;AAAA,MACA,OAAA,CAAQ;AAAA,KACV,CAAE,KAAK,GAAG,CAAA;AAEV,IAAA,OAAO,EAAE,OAAO,gBAAA,EAAkB,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,EAAE;AAAA,EAC5E;AAAA,EAEA,mBAAmB,KAAA,EAAwB;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIH,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAA,OAAO,GAAA,KAAQC,0BAAW,WAAA,CAAY,QAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;;"}

package/dist/entrypoints/database/DatabaseManager.cjs.js

@@ -9,6 +9,11 @@ function pluginPath(pluginId) {
   return `plugin.${pluginId}`;
 }
 class DatabaseManagerImpl {
+  config;
+  connectors;
+  options;
+  databaseCache;
+  keepaliveIntervals;
   constructor(config, connectors, options, databaseCache = /* @__PURE__ */ new Map(), keepaliveIntervals = /* @__PURE__ */ new Map()) {
     this.config = config;
     this.connectors = connectors;
@@ -131,9 +136,6 @@ class DatabaseManagerImpl {
   }
 }
 class DatabaseManager {
-  constructor(impl) {
-    this.impl = impl;
-  }
   /**
    * Creates a {@link DatabaseManager} from `backend.database` config.
    *
@@ -157,6 +159,10 @@ class DatabaseManager {
       )
     );
   }
+  impl;
+  constructor(impl) {
+    this.impl = impl;
+  }
   /**
    * Generates a DatabaseService for consumption by plugins.
    *

package/dist/entrypoints/database/DatabaseManager.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseManager.cjs.js","sources":["../../../src/entrypoints/database/DatabaseManager.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LifecycleService,\n  LoggerService,\n  RootConfigService,\n  RootLifecycleService,\n  RootLoggerService,\n} from '@backstage/backend-plugin-api';\nimport { Config } from '@backstage/config';\nimport { stringifyError } from '@backstage/errors';\nimport { Knex } from 'knex';\nimport { MysqlConnector } from './connectors/mysql';\nimport { PgConnector } from './connectors/postgres';\nimport { Sqlite3Connector } from './connectors/sqlite3';\nimport { Connector } from './types';\n\n/**\n * Provides a config lookup path for a plugin's config block.\n */\nfunction pluginPath(pluginId: string): string {\n  return `plugin.${pluginId}`;\n}\n\n/**\n * Creation options for {@link DatabaseManager}.\n *\n * @public\n */\nexport type DatabaseManagerOptions = {\n  migrations?: DatabaseService['migrations'];\n  rootLogger?: RootLoggerService;\n  rootLifecycle?: RootLifecycleService;\n};\n\n/**\n * Testable implementation class for {@link DatabaseManager} below.\n */\nexport class DatabaseManagerImpl {\n  constructor(\n    private readonly config: Config,\n    private readonly connectors: Record<string, Connector>,\n    private readonly options?: DatabaseManagerOptions,\n    private readonly databaseCache: Map<string, Promise<Knex>> = new Map(),\n    private readonly keepaliveIntervals: Map<\n      string,\n      NodeJS.Timeout\n    > = new Map(),\n  ) {\n    // If a rootLifecycle service was provided, register a shutdown hook to\n    // clean up any database connections.\n    if (options?.rootLifecycle !== undefined) {\n      options.rootLifecycle.addShutdownHook(async () => {\n        await this.shutdown({ logger: options.rootLogger });\n      });\n    }\n  }\n\n  /**\n   * Generates a DatabaseService for consumption by plugins.\n   *\n   * @param pluginId - The plugin that the database manager should be created for. Plugin names\n   * should be unique as they are used to look up database config overrides under\n   * `backend.database.plugin`.\n   */\n  forPlugin(\n    pluginId: string,\n    deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): DatabaseService {\n    const client = this.getClientType(pluginId).client;\n    const connector = this.connectors[client];\n    if (!connector) {\n      throw new Error(\n        `Unsupported database client type '${client}' specified for plugin '${pluginId}'`,\n      );\n    }\n    const getClient = () => this.getDatabase(pluginId, connector, deps);\n\n    const skip =\n      this.options?.migrations?.skip ??\n      this.config.getOptionalBoolean(`plugin.${pluginId}.skipMigrations`) ??\n      this.config.getOptionalBoolean('skipMigrations') ??\n      false;\n\n    return { getClient, migrations: { skip } };\n  }\n\n  /**\n   * Destroys all known connections.\n   */\n  private async shutdown(deps?: { logger?: LoggerService }): Promise<void> {\n    const pluginIds = Array.from(this.databaseCache.keys());\n    await Promise.allSettled(\n      pluginIds.map(async pluginId => {\n        // We no longer need to keep connections alive.\n        clearInterval(this.keepaliveIntervals.get(pluginId));\n\n        const connection = await this.databaseCache.get(pluginId);\n        if (connection) {\n          if (connection.client.config.includes('sqlite3')) {\n            return; // sqlite3 does not support destroy, it hangs\n          }\n          await connection.destroy().catch((error: unknown) => {\n            deps?.logger?.error(\n              `Problem closing database connection for ${pluginId}: ${stringifyError(\n                error,\n              )}`,\n            );\n          });\n        }\n      }),\n    );\n  }\n\n  /**\n   * Provides the client type which should be used for a given plugin.\n   *\n   * The client type is determined by plugin specific config if present.\n   * Otherwise the base client is used as the fallback.\n   *\n   * @param pluginId - Plugin to get the client type for\n   * @returns Object with client type returned as `client` and boolean\n   *          representing whether or not the client was overridden as\n   *          `overridden`\n   */\n  private getClientType(pluginId: string): {\n    client: string;\n    overridden: boolean;\n  } {\n    const pluginClient = this.config.getOptionalString(\n      `${pluginPath(pluginId)}.client`,\n    );\n\n    const baseClient = this.config.getString('client');\n    const client = pluginClient ?? baseClient;\n    return {\n      client,\n      overridden: client !== baseClient,\n    };\n  }\n\n  /**\n   * Provides a scoped Knex client for a plugin as per application config.\n   *\n   * @param pluginId - Plugin to get a Knex client for\n   * @returns Promise which resolves to a scoped Knex database client for a\n   *          plugin\n   */\n  private async getDatabase(\n    pluginId: string,\n    connector: Connector,\n    deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): Promise<Knex> {\n    if (this.databaseCache.has(pluginId)) {\n      return this.databaseCache.get(pluginId)!;\n    }\n\n    const clientPromise = connector.getClient(pluginId, deps);\n    this.databaseCache.set(pluginId, clientPromise);\n\n    if (process.env.NODE_ENV !== 'test') {\n      clientPromise.then(client =>\n        this.startKeepaliveLoop(pluginId, client, deps.logger),\n      );\n    }\n\n    return clientPromise;\n  }\n\n  private startKeepaliveLoop(\n    pluginId: string,\n    client: Knex,\n    logger: LoggerService,\n  ): void {\n    let lastKeepaliveFailed = false;\n\n    this.keepaliveIntervals.set(\n      pluginId,\n      setInterval(() => {\n        // During testing it can happen that the environment is torn down and\n        // this client is `undefined`, but this interval is still run.\n        client?.raw('select 1').then(\n          () => {\n            lastKeepaliveFailed = false;\n          },\n          (error: unknown) => {\n            if (!lastKeepaliveFailed) {\n              lastKeepaliveFailed = true;\n              logger.warn(\n                `Database keepalive failed for plugin ${pluginId}, ${stringifyError(\n                  error,\n                )}`,\n              );\n            }\n          },\n        );\n      }, 60 * 1000),\n    );\n  }\n}\n\n// NOTE: This class looks odd but is kept around for API compatibility reasons\n/**\n * Manages database connections for Backstage backend plugins.\n *\n * @public\n * @remarks\n *\n * The database manager allows the user to set connection and client settings on\n * a per pluginId basis by defining a database config block under\n * `plugin.<pluginId>` in addition to top level defaults. Optionally, a user may\n * set `prefix` which is used to prefix generated database names if config is\n * not provided.\n */\nexport class DatabaseManager {\n  /**\n   * Creates a {@link DatabaseManager} from `backend.database` config.\n   *\n   * @param config - The loaded application configuration.\n   * @param options - An optional configuration object.\n   */\n  static fromConfig(\n    config: RootConfigService,\n    options?: DatabaseManagerOptions,\n  ): DatabaseManager {\n    const databaseConfig = config.getConfig('backend.database');\n    const prefix =\n      databaseConfig.getOptionalString('prefix') || 'backstage_plugin_';\n    return new DatabaseManager(\n      new DatabaseManagerImpl(\n        databaseConfig,\n        {\n          pg: new PgConnector(databaseConfig, prefix),\n          sqlite3: new Sqlite3Connector(databaseConfig),\n          'better-sqlite3': new Sqlite3Connector(databaseConfig),\n          mysql: new MysqlConnector(databaseConfig, prefix),\n          mysql2: new MysqlConnector(databaseConfig, prefix),\n        },\n        options,\n      ),\n    );\n  }\n\n  private constructor(private readonly impl: DatabaseManagerImpl) {}\n\n  /**\n   * Generates a DatabaseService for consumption by plugins.\n   *\n   * @param pluginId - The plugin that the database manager should be created for. Plugin names\n   * should be unique as they are used to look up database config overrides under\n   * `backend.database.plugin`.\n   */\n  forPlugin(\n    pluginId: string,\n    deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): DatabaseService {\n    return this.impl.forPlugin(pluginId, deps);\n  }\n}\n"],"names":["stringifyError","PgConnector","Sqlite3Connector","MysqlConnector"],"mappings":";;;;;;;AAmCA,SAAS,WAAW,QAAA,EAA0B;AAC5C,EAAA,OAAO,UAAU,QAAQ,CAAA,CAAA;AAC3B;AAgBO,MAAM,mBAAA,CAAoB;AAAA,EAC/B,WAAA,CACmB,MAAA,EACA,UAAA,EACA,OAAA,EACA,aAAA,mBAA4C,IAAI,GAAA,EAAI,EACpD,kBAAA,mBAGb,IAAI,GAAA,EAAI,EACZ;AARiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AAOjB,IAAA,IAAI,OAAA,EAAS,kBAAkB,MAAA,EAAW;AACxC,MAAA,OAAA,CAAQ,aAAA,CAAc,gBAAgB,YAAY;AAChD,QAAA,MAAM,KAAK,QAAA,CAAS,EAAE,MAAA,EAAQ,OAAA,CAAQ,YAAY,CAAA;AAAA,MACpD,CAAC,CAAA;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAA,CACE,UACA,IAAA,EAIiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA,CAAE,MAAA;AAC5C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,MAAM,CAAA,wBAAA,EAA2B,QAAQ,CAAA,CAAA;AAAA,OAChF;AAAA,IACF;AACA,IAAA,MAAM,YAAY,MAAM,IAAA,CAAK,WAAA,CAAY,QAAA,EAAU,WAAW,IAAI,CAAA;AAElE,IAAA,MAAM,OACJ,IAAA,CAAK,OAAA,EAAS,UAAA,EAAY,IAAA,IAC1B,KAAK,MAAA,CAAO,kBAAA,CAAmB,CAAA,OAAA,EAAU,QAAQ,iBAAiB,CAAA,IAClE,IAAA,CAAK,MAAA,CAAO,kBAAA,CAAmB,gBAAgB,CAAA,IAC/C,KAAA;AAEF,IAAA,OAAO,EAAE,SAAA,EAAW,UAAA,EAAY,EAAE,MAAK,EAAE;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,SAAS,IAAA,EAAkD;AACvE,IAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,aAAA,CAAc,MAAM,CAAA;AACtD,IAAA,MAAM,OAAA,CAAQ,UAAA;AAAA,MACZ,SAAA,CAAU,GAAA,CAAI,OAAM,QAAA,KAAY;AAE9B,QAAA,aAAA,CAAc,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAC,CAAA;AAEnD,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,IAAI,QAAQ,CAAA;AACxD,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,IAAI,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAChD,YAAA;AAAA,UACF;AACA,UAAA,MAAM,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACnD,YAAA,IAAA,EAAM,MAAA,EAAQ,KAAA;AAAA,cACZ,CAAA,wCAAA,EAA2C,QAAQ,CAAA,EAAA,EAAKA,qBAAA;AAAA,gBACtD;AAAA,eACD,CAAA;AAAA,aACH;AAAA,UACF,CAAC,CAAA;AAAA,QACH;AAAA,MACF,CAAC;AAAA,KACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,cAAc,QAAA,EAGpB;AACA,IAAA,MAAM,YAAA,GAAe,KAAK,MAAA,CAAO,iBAAA;AAAA,MAC/B,CAAA,EAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,OAAA;AAAA,KACzB;AAEA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACjD,IAAA,MAAM,SAAS,YAAA,IAAgB,UAAA;AAC/B,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,YAAY,MAAA,KAAW;AAAA,KACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,WAAA,CACZ,QAAA,EACA,SAAA,EACA,IAAA,EAIe;AACf,IAAA,IAAI,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,QAAQ,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,QAAQ,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,SAAA,CAAU,QAAA,EAAU,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAE9C,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,MAAA,EAAQ;AACnC,MAAA,aAAA,CAAc,IAAA;AAAA,QAAK,YACjB,IAAA,CAAK,kBAAA,CAAmB,QAAA,EAAU,MAAA,EAAQ,KAAK,MAAM;AAAA,OACvD;AAAA,IACF;AAEA,IAAA,OAAO,aAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,QAAA,EACA,MAAA,EACA,MAAA,EACM;AACN,IAAA,IAAI,mBAAA,GAAsB,KAAA;AAE1B,IAAA,IAAA,CAAK,kBAAA,CAAmB,GAAA;AAAA,MACtB,QAAA;AAAA,MACA,YAAY,MAAM;AAGhB,QAAA,MAAA,EAAQ,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,UACtB,MAAM;AACJ,YAAA,mBAAA,GAAsB,KAAA;AAAA,UACxB,CAAA;AAAA,UACA,CAAC,KAAA,KAAmB;AAClB,YAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,cAAA,mBAAA,GAAsB,IAAA;AACtB,cAAA,MAAA,CAAO,IAAA;AAAA,gBACL,CAAA,qCAAA,EAAwC,QAAQ,CAAA,EAAA,EAAKA,qBAAA;AAAA,kBACnD;AAAA,iBACD,CAAA;AAAA,eACH;AAAA,YACF;AAAA,UACF;AAAA,SACF;AAAA,MACF,CAAA,EAAG,KAAK,GAAI;AAAA,KACd;AAAA,EACF;AACF;AAeO,MAAM,eAAA,CAAgB;AAAA,EA6BnB,YAA6B,IAAA,EAA2B;AAA3B,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAtBjE,OAAO,UAAA,CACL,MAAA,EACA,OAAA,EACiB;AACjB,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,SAAA,CAAU,kBAAkB,CAAA;AAC1D,IAAA,MAAM,MAAA,GACJ,cAAA,CAAe,iBAAA,CAAkB,QAAQ,CAAA,IAAK,mBAAA;AAChD,IAAA,OAAO,IAAI,eAAA;AAAA,MACT,IAAI,mBAAA;AAAA,QACF,cAAA;AAAA,QACA;AAAA,UACE,EAAA,EAAI,IAAIC,oBAAA,CAAY,cAAA,EAAgB,MAAM,CAAA;AAAA,UAC1C,OAAA,EAAS,IAAIC,wBAAA,CAAiB,cAAc,CAAA;AAAA,UAC5C,gBAAA,EAAkB,IAAIA,wBAAA,CAAiB,cAAc,CAAA;AAAA,UACrD,KAAA,EAAO,IAAIC,oBAAA,CAAe,cAAA,EAAgB,MAAM,CAAA;AAAA,UAChD,MAAA,EAAQ,IAAIA,oBAAA,CAAe,cAAA,EAAgB,MAAM;AAAA,SACnD;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAA,CACE,UACA,IAAA,EAIiB;AACjB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,QAAA,EAAU,IAAI,CAAA;AAAA,EAC3C;AACF;;;;;"}
+{"version":3,"file":"DatabaseManager.cjs.js","sources":["../../../src/entrypoints/database/DatabaseManager.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LifecycleService,\n  LoggerService,\n  RootConfigService,\n  RootLifecycleService,\n  RootLoggerService,\n} from '@backstage/backend-plugin-api';\nimport { Config } from '@backstage/config';\nimport { stringifyError } from '@backstage/errors';\nimport { Knex } from 'knex';\nimport { MysqlConnector } from './connectors/mysql';\nimport { PgConnector } from './connectors/postgres';\nimport { Sqlite3Connector } from './connectors/sqlite3';\nimport { Connector } from './types';\n\n/**\n * Provides a config lookup path for a plugin's config block.\n */\nfunction pluginPath(pluginId: string): string {\n  return `plugin.${pluginId}`;\n}\n\n/**\n * Creation options for {@link DatabaseManager}.\n *\n * @public\n */\nexport type DatabaseManagerOptions = {\n  migrations?: DatabaseService['migrations'];\n  rootLogger?: RootLoggerService;\n  rootLifecycle?: RootLifecycleService;\n};\n\n/**\n * Testable implementation class for {@link DatabaseManager} below.\n */\nexport class DatabaseManagerImpl {\n  private readonly config: Config;\n  private readonly connectors: Record<string, Connector>;\n  private readonly options?: DatabaseManagerOptions;\n  private readonly databaseCache: Map<string, Promise<Knex>>;\n  private readonly keepaliveIntervals: Map<string, NodeJS.Timeout>;\n\n  constructor(\n    config: Config,\n    connectors: Record<string, Connector>,\n    options?: DatabaseManagerOptions,\n    databaseCache: Map<string, Promise<Knex>> = new Map(),\n    keepaliveIntervals: Map<string, NodeJS.Timeout> = new Map(),\n  ) {\n    this.config = config;\n    this.connectors = connectors;\n    this.options = options;\n    this.databaseCache = databaseCache;\n    this.keepaliveIntervals = keepaliveIntervals;\n    // If a rootLifecycle service was provided, register a shutdown hook to\n    // clean up any database connections.\n    if (options?.rootLifecycle !== undefined) {\n      options.rootLifecycle.addShutdownHook(async () => {\n        await this.shutdown({ logger: options.rootLogger });\n      });\n    }\n  }\n\n  /**\n   * Generates a DatabaseService for consumption by plugins.\n   *\n   * @param pluginId - The plugin that the database manager should be created for. Plugin names\n   * should be unique as they are used to look up database config overrides under\n   * `backend.database.plugin`.\n   */\n  forPlugin(\n    pluginId: string,\n    deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): DatabaseService {\n    const client = this.getClientType(pluginId).client;\n    const connector = this.connectors[client];\n    if (!connector) {\n      throw new Error(\n        `Unsupported database client type '${client}' specified for plugin '${pluginId}'`,\n      );\n    }\n    const getClient = () => this.getDatabase(pluginId, connector, deps);\n\n    const skip =\n      this.options?.migrations?.skip ??\n      this.config.getOptionalBoolean(`plugin.${pluginId}.skipMigrations`) ??\n      this.config.getOptionalBoolean('skipMigrations') ??\n      false;\n\n    return { getClient, migrations: { skip } };\n  }\n\n  /**\n   * Destroys all known connections.\n   */\n  private async shutdown(deps?: { logger?: LoggerService }): Promise<void> {\n    const pluginIds = Array.from(this.databaseCache.keys());\n    await Promise.allSettled(\n      pluginIds.map(async pluginId => {\n        // We no longer need to keep connections alive.\n        clearInterval(this.keepaliveIntervals.get(pluginId));\n\n        const connection = await this.databaseCache.get(pluginId);\n        if (connection) {\n          if (connection.client.config.includes('sqlite3')) {\n            return; // sqlite3 does not support destroy, it hangs\n          }\n          await connection.destroy().catch((error: unknown) => {\n            deps?.logger?.error(\n              `Problem closing database connection for ${pluginId}: ${stringifyError(\n                error,\n              )}`,\n            );\n          });\n        }\n      }),\n    );\n  }\n\n  /**\n   * Provides the client type which should be used for a given plugin.\n   *\n   * The client type is determined by plugin specific config if present.\n   * Otherwise the base client is used as the fallback.\n   *\n   * @param pluginId - Plugin to get the client type for\n   * @returns Object with client type returned as `client` and boolean\n   *          representing whether or not the client was overridden as\n   *          `overridden`\n   */\n  private getClientType(pluginId: string): {\n    client: string;\n    overridden: boolean;\n  } {\n    const pluginClient = this.config.getOptionalString(\n      `${pluginPath(pluginId)}.client`,\n    );\n\n    const baseClient = this.config.getString('client');\n    const client = pluginClient ?? baseClient;\n    return {\n      client,\n      overridden: client !== baseClient,\n    };\n  }\n\n  /**\n   * Provides a scoped Knex client for a plugin as per application config.\n   *\n   * @param pluginId - Plugin to get a Knex client for\n   * @returns Promise which resolves to a scoped Knex database client for a\n   *          plugin\n   */\n  private async getDatabase(\n    pluginId: string,\n    connector: Connector,\n    deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): Promise<Knex> {\n    if (this.databaseCache.has(pluginId)) {\n      return this.databaseCache.get(pluginId)!;\n    }\n\n    const clientPromise = connector.getClient(pluginId, deps);\n    this.databaseCache.set(pluginId, clientPromise);\n\n    if (process.env.NODE_ENV !== 'test') {\n      clientPromise.then(client =>\n        this.startKeepaliveLoop(pluginId, client, deps.logger),\n      );\n    }\n\n    return clientPromise;\n  }\n\n  private startKeepaliveLoop(\n    pluginId: string,\n    client: Knex,\n    logger: LoggerService,\n  ): void {\n    let lastKeepaliveFailed = false;\n\n    this.keepaliveIntervals.set(\n      pluginId,\n      setInterval(() => {\n        // During testing it can happen that the environment is torn down and\n        // this client is `undefined`, but this interval is still run.\n        client?.raw('select 1').then(\n          () => {\n            lastKeepaliveFailed = false;\n          },\n          (error: unknown) => {\n            if (!lastKeepaliveFailed) {\n              lastKeepaliveFailed = true;\n              logger.warn(\n                `Database keepalive failed for plugin ${pluginId}, ${stringifyError(\n                  error,\n                )}`,\n              );\n            }\n          },\n        );\n      }, 60 * 1000),\n    );\n  }\n}\n\n// NOTE: This class looks odd but is kept around for API compatibility reasons\n/**\n * Manages database connections for Backstage backend plugins.\n *\n * @public\n * @remarks\n *\n * The database manager allows the user to set connection and client settings on\n * a per pluginId basis by defining a database config block under\n * `plugin.<pluginId>` in addition to top level defaults. Optionally, a user may\n * set `prefix` which is used to prefix generated database names if config is\n * not provided.\n */\nexport class DatabaseManager {\n  /**\n   * Creates a {@link DatabaseManager} from `backend.database` config.\n   *\n   * @param config - The loaded application configuration.\n   * @param options - An optional configuration object.\n   */\n  static fromConfig(\n    config: RootConfigService,\n    options?: DatabaseManagerOptions,\n  ): DatabaseManager {\n    const databaseConfig = config.getConfig('backend.database');\n    const prefix =\n      databaseConfig.getOptionalString('prefix') || 'backstage_plugin_';\n    return new DatabaseManager(\n      new DatabaseManagerImpl(\n        databaseConfig,\n        {\n          pg: new PgConnector(databaseConfig, prefix),\n          sqlite3: new Sqlite3Connector(databaseConfig),\n          'better-sqlite3': new Sqlite3Connector(databaseConfig),\n          mysql: new MysqlConnector(databaseConfig, prefix),\n          mysql2: new MysqlConnector(databaseConfig, prefix),\n        },\n        options,\n      ),\n    );\n  }\n\n  private readonly impl: DatabaseManagerImpl;\n\n  private constructor(impl: DatabaseManagerImpl) {\n    this.impl = impl;\n  }\n\n  /**\n   * Generates a DatabaseService for consumption by plugins.\n   *\n   * @param pluginId - The plugin that the database manager should be created for. Plugin names\n   * should be unique as they are used to look up database config overrides under\n   * `backend.database.plugin`.\n   */\n  forPlugin(\n    pluginId: string,\n    deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): DatabaseService {\n    return this.impl.forPlugin(pluginId, deps);\n  }\n}\n"],"names":["stringifyError","PgConnector","Sqlite3Connector","MysqlConnector"],"mappings":";;;;;;;AAmCA,SAAS,WAAW,QAAA,EAA0B;AAC5C,EAAA,OAAO,UAAU,QAAQ,CAAA,CAAA;AAC3B;AAgBO,MAAM,mBAAA,CAAoB;AAAA,EACd,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EAEjB,WAAA,CACE,MAAA,EACA,UAAA,EACA,OAAA,EACA,aAAA,mBAA4C,IAAI,GAAA,EAAI,EACpD,kBAAA,mBAAkD,IAAI,GAAA,EAAI,EAC1D;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACrB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAG1B,IAAA,IAAI,OAAA,EAAS,kBAAkB,MAAA,EAAW;AACxC,MAAA,OAAA,CAAQ,aAAA,CAAc,gBAAgB,YAAY;AAChD,QAAA,MAAM,KAAK,QAAA,CAAS,EAAE,MAAA,EAAQ,OAAA,CAAQ,YAAY,CAAA;AAAA,MACpD,CAAC,CAAA;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAA,CACE,UACA,IAAA,EAIiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA,CAAE,MAAA;AAC5C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,MAAM,CAAA,wBAAA,EAA2B,QAAQ,CAAA,CAAA;AAAA,OAChF;AAAA,IACF;AACA,IAAA,MAAM,YAAY,MAAM,IAAA,CAAK,WAAA,CAAY,QAAA,EAAU,WAAW,IAAI,CAAA;AAElE,IAAA,MAAM,OACJ,IAAA,CAAK,OAAA,EAAS,UAAA,EAAY,IAAA,IAC1B,KAAK,MAAA,CAAO,kBAAA,CAAmB,CAAA,OAAA,EAAU,QAAQ,iBAAiB,CAAA,IAClE,IAAA,CAAK,MAAA,CAAO,kBAAA,CAAmB,gBAAgB,CAAA,IAC/C,KAAA;AAEF,IAAA,OAAO,EAAE,SAAA,EAAW,UAAA,EAAY,EAAE,MAAK,EAAE;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,SAAS,IAAA,EAAkD;AACvE,IAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,aAAA,CAAc,MAAM,CAAA;AACtD,IAAA,MAAM,OAAA,CAAQ,UAAA;AAAA,MACZ,SAAA,CAAU,GAAA,CAAI,OAAM,QAAA,KAAY;AAE9B,QAAA,aAAA,CAAc,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAC,CAAA;AAEnD,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,IAAI,QAAQ,CAAA;AACxD,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,IAAI,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAChD,YAAA;AAAA,UACF;AACA,UAAA,MAAM,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACnD,YAAA,IAAA,EAAM,MAAA,EAAQ,KAAA;AAAA,cACZ,CAAA,wCAAA,EAA2C,QAAQ,CAAA,EAAA,EAAKA,qBAAA;AAAA,gBACtD;AAAA,eACD,CAAA;AAAA,aACH;AAAA,UACF,CAAC,CAAA;AAAA,QACH;AAAA,MACF,CAAC;AAAA,KACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,cAAc,QAAA,EAGpB;AACA,IAAA,MAAM,YAAA,GAAe,KAAK,MAAA,CAAO,iBAAA;AAAA,MAC/B,CAAA,EAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,OAAA;AAAA,KACzB;AAEA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACjD,IAAA,MAAM,SAAS,YAAA,IAAgB,UAAA;AAC/B,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,YAAY,MAAA,KAAW;AAAA,KACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,WAAA,CACZ,QAAA,EACA,SAAA,EACA,IAAA,EAIe;AACf,IAAA,IAAI,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,QAAQ,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,QAAQ,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,SAAA,CAAU,QAAA,EAAU,IAAI,CAAA;AACxD,IAAA,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAE9C,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,MAAA,EAAQ;AACnC,MAAA,aAAA,CAAc,IAAA;AAAA,QAAK,YACjB,IAAA,CAAK,kBAAA,CAAmB,QAAA,EAAU,MAAA,EAAQ,KAAK,MAAM;AAAA,OACvD;AAAA,IACF;AAEA,IAAA,OAAO,aAAA;AAAA,EACT;AAAA,EAEQ,kBAAA,CACN,QAAA,EACA,MAAA,EACA,MAAA,EACM;AACN,IAAA,IAAI,mBAAA,GAAsB,KAAA;AAE1B,IAAA,IAAA,CAAK,kBAAA,CAAmB,GAAA;AAAA,MACtB,QAAA;AAAA,MACA,YAAY,MAAM;AAGhB,QAAA,MAAA,EAAQ,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA;AAAA,UACtB,MAAM;AACJ,YAAA,mBAAA,GAAsB,KAAA;AAAA,UACxB,CAAA;AAAA,UACA,CAAC,KAAA,KAAmB;AAClB,YAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,cAAA,mBAAA,GAAsB,IAAA;AACtB,cAAA,MAAA,CAAO,IAAA;AAAA,gBACL,CAAA,qCAAA,EAAwC,QAAQ,CAAA,EAAA,EAAKA,qBAAA;AAAA,kBACnD;AAAA,iBACD,CAAA;AAAA,eACH;AAAA,YACF;AAAA,UACF;AAAA,SACF;AAAA,MACF,CAAA,EAAG,KAAK,GAAI;AAAA,KACd;AAAA,EACF;AACF;AAeO,MAAM,eAAA,CAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3B,OAAO,UAAA,CACL,MAAA,EACA,OAAA,EACiB;AACjB,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,SAAA,CAAU,kBAAkB,CAAA;AAC1D,IAAA,MAAM,MAAA,GACJ,cAAA,CAAe,iBAAA,CAAkB,QAAQ,CAAA,IAAK,mBAAA;AAChD,IAAA,OAAO,IAAI,eAAA;AAAA,MACT,IAAI,mBAAA;AAAA,QACF,cAAA;AAAA,QACA;AAAA,UACE,EAAA,EAAI,IAAIC,oBAAA,CAAY,cAAA,EAAgB,MAAM,CAAA;AAAA,UAC1C,OAAA,EAAS,IAAIC,wBAAA,CAAiB,cAAc,CAAA;AAAA,UAC5C,gBAAA,EAAkB,IAAIA,wBAAA,CAAiB,cAAc,CAAA;AAAA,UACrD,KAAA,EAAO,IAAIC,oBAAA,CAAe,cAAA,EAAgB,MAAM,CAAA;AAAA,UAChD,MAAA,EAAQ,IAAIA,oBAAA,CAAe,cAAA,EAAgB,MAAM;AAAA,SACnD;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AAAA,EAEiB,IAAA;AAAA,EAET,YAAY,IAAA,EAA2B;AAC7C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAA,CACE,UACA,IAAA,EAIiB;AACjB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,QAAA,EAAU,IAAI,CAAA;AAAA,EAC3C;AACF;;;;;"}

package/dist/entrypoints/database/connectors/mysql.cjs.js

@@ -121,6 +121,8 @@ function normalizeConnection(connection) {
   return typeof connection === "string" || connection instanceof String ? parseMysqlConnectionString(connection) : connection;
 }
 class MysqlConnector {
+  config;
+  prefix;
   constructor(config, prefix) {
     this.config = config;
     this.prefix = prefix;

package/dist/entrypoints/database/connectors/mysql.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"mysql.cjs.js","sources":["../../../../src/entrypoints/database/connectors/mysql.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { LifecycleService, LoggerService } from '@backstage/backend-plugin-api';\nimport { Config, ConfigReader } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { JsonObject } from '@backstage/types';\nimport knexFactory, { Knex } from 'knex';\nimport { merge, omit } from 'lodash';\nimport limiterFactory from 'p-limit';\nimport yn from 'yn';\nimport { Connector } from '../types';\nimport defaultNameOverride from './defaultNameOverride';\nimport { mergeDatabaseConfig } from './mergeDatabaseConfig';\n\n// Limits the number of concurrent DDL operations to 1\nconst ddlLimiter = limiterFactory(1);\n\n/**\n * Creates a knex mysql database connection\n *\n * @param dbConfig - The database config\n * @param overrides - Additional options to merge with the config\n */\nexport function createMysqlDatabaseClient(\n  dbConfig: Config,\n  overrides?: Knex.Config,\n) {\n  const knexConfig = buildMysqlDatabaseConfig(dbConfig, overrides);\n  const database = knexFactory(knexConfig);\n  return database;\n}\n\n/**\n * Builds a knex mysql database connection\n *\n * @param dbConfig - The database config\n * @param overrides - Additional options to merge with the config\n */\nexport function buildMysqlDatabaseConfig(\n  dbConfig: Config,\n  overrides?: Knex.Config,\n) {\n  return mergeDatabaseConfig(\n    dbConfig.get(),\n    {\n      connection: getMysqlConnectionConfig(dbConfig, !!overrides),\n      useNullAsDefault: true,\n    },\n    overrides,\n  );\n}\n\n/**\n * Gets the mysql connection config\n *\n * @param dbConfig - The database config\n * @param parseConnectionString - Flag to explicitly control connection string parsing\n */\nexport function getMysqlConnectionConfig(\n  dbConfig: Config,\n  parseConnectionString?: boolean,\n): Knex.MySqlConnectionConfig | string {\n  const connection = dbConfig.get('connection') as any;\n  const isConnectionString =\n    typeof connection === 'string' || connection instanceof String;\n  const autoParse = typeof parseConnectionString !== 'boolean';\n\n  const shouldParseConnectionString = autoParse\n    ? isConnectionString\n    : parseConnectionString && isConnectionString;\n\n  return shouldParseConnectionString\n    ? parseMysqlConnectionString(connection as string)\n    : connection;\n}\n\n/**\n * Parses a mysql connection string.\n *\n * e.g. mysql://examplename:somepassword@examplehost:3306/dbname\n * @param connectionString - The mysql connection string\n */\nexport function parseMysqlConnectionString(\n  connectionString: string,\n): Knex.MySqlConnectionConfig {\n  try {\n    const {\n      protocol,\n      username,\n      password,\n      port,\n      hostname,\n      pathname,\n      searchParams,\n    } = new URL(connectionString);\n\n    if (protocol !== 'mysql:') {\n      throw new Error(`Unknown protocol ${protocol}`);\n    } else if (!username || !password) {\n      throw new Error(`Missing username/password`);\n    } else if (!pathname.match(/^\\/[^/]+$/)) {\n      throw new Error(`Expected single path segment`);\n    }\n\n    const result: Knex.MySqlConnectionConfig = {\n      user: username,\n      password,\n      host: hostname,\n      port: Number(port || 3306),\n      database: decodeURIComponent(pathname.substring(1)),\n    };\n\n    const ssl = searchParams.get('ssl');\n    if (ssl) {\n      result.ssl = ssl;\n    }\n\n    const debug = searchParams.get('debug');\n    if (debug) {\n      result.debug = yn(debug);\n    }\n\n    return result;\n  } catch (e) {\n    throw new InputError(\n      `Error while parsing MySQL connection string, ${e}`,\n      e,\n    );\n  }\n}\n\n/**\n * Creates the missing mysql database if it does not exist\n *\n * @param dbConfig - The database config\n * @param databases - The names of the databases to create\n */\nexport async function ensureMysqlDatabaseExists(\n  dbConfig: Config,\n  ...databases: Array<string>\n) {\n  const admin = createMysqlDatabaseClient(dbConfig, {\n    connection: {\n      database: null as unknown as string,\n    },\n    pool: {\n      min: 0,\n      acquireTimeoutMillis: 10000,\n    },\n  });\n\n  try {\n    const ensureDatabase = async (database: string) => {\n      await admin.raw(`CREATE DATABASE IF NOT EXISTS ??`, [database]);\n    };\n    await Promise.all(\n      databases.map(async database => {\n        // For initial setup we use a smaller timeout but several retries. Given that this\n        // is a separate connection pool we should never really run into issues with connection\n        // acquisition timeouts, but we do anyway. This might be a bug in knex or some other dependency.\n        let lastErr: Error | undefined = undefined;\n        for (let i = 0; i < 3; i++) {\n          try {\n            return await ddlLimiter(() => ensureDatabase(database));\n          } catch (err) {\n            lastErr = err;\n          }\n          await new Promise(resolve => setTimeout(resolve, 100));\n        }\n        throw lastErr;\n      }),\n    );\n  } finally {\n    await admin.destroy();\n  }\n}\n\n/**\n * Drops the given mysql databases.\n *\n * @param dbConfig - The database config\n * @param databases - The names of the databases to create\n */\nexport async function dropMysqlDatabase(\n  dbConfig: Config,\n  ...databases: Array<string>\n) {\n  const admin = createMysqlDatabaseClient(dbConfig, {\n    connection: {\n      database: null as unknown as string,\n    },\n    pool: {\n      min: 0,\n      acquireTimeoutMillis: 10000,\n    },\n  });\n\n  try {\n    const dropDatabase = async (database: string) => {\n      await admin.raw(`DROP DATABASE ??`, [database]);\n    };\n    await Promise.all(\n      databases.map(async database => {\n        return await ddlLimiter(() => dropDatabase(database));\n      }),\n    );\n  } finally {\n    await admin.destroy();\n  }\n}\n\n/**\n * Provides a config lookup path for a plugin's config block.\n */\nfunction pluginPath(pluginId: string): string {\n  return `plugin.${pluginId}`;\n}\n\nfunction normalizeConnection(\n  connection: Knex.StaticConnectionConfig | JsonObject | string | undefined,\n): Partial<Knex.StaticConnectionConfig> {\n  if (typeof connection === 'undefined' || connection === null) {\n    return {};\n  }\n\n  return typeof connection === 'string' || connection instanceof String\n    ? parseMysqlConnectionString(connection as string)\n    : connection;\n}\n\nexport class MysqlConnector implements Connector {\n  constructor(\n    private readonly config: Config,\n    private readonly prefix: string,\n  ) {}\n\n  async getClient(\n    pluginId: string,\n    _deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): Promise<Knex> {\n    const pluginConfig = new ConfigReader(\n      this.getConfigForPlugin(pluginId) as JsonObject,\n    );\n\n    const databaseName = this.getDatabaseName(pluginId);\n    if (databaseName && this.getEnsureExistsConfig(pluginId)) {\n      try {\n        await ensureMysqlDatabaseExists(pluginConfig, databaseName);\n      } catch (error) {\n        throw new Error(\n          `Failed to connect to the database to make sure that '${databaseName}' exists, ${error}`,\n        );\n      }\n    }\n\n    const pluginDivisionMode = this.getPluginDivisionModeConfig();\n    if (pluginDivisionMode !== 'database') {\n      throw new Error(\n        `The MySQL driver does not support plugin division mode '${pluginDivisionMode}'`,\n      );\n    }\n\n    const databaseClientOverrides = mergeDatabaseConfig(\n      {},\n      this.getDatabaseOverrides(pluginId),\n    );\n\n    const client = createMysqlDatabaseClient(\n      pluginConfig,\n      databaseClientOverrides,\n    );\n\n    return client;\n  }\n\n  /**\n   * Provides the canonical database name for a given plugin.\n   *\n   * This method provides the effective database name which is determined using\n   * global and plugin specific database config. If no explicit database name,\n   * this method will provide a generated name which is the pluginId prefixed\n   * with 'backstage_plugin_'.\n   *\n   * @param pluginId - Lookup the database name for given plugin\n   * @returns String representing the plugin's database name\n   */\n  private getDatabaseName(pluginId: string): string | undefined {\n    const connection = this.getConnectionConfig(pluginId);\n    const databaseName = (connection as Knex.ConnectionConfig)?.database;\n    return databaseName ?? `${this.prefix}${pluginId}`;\n  }\n\n  /**\n   * Provides the client type which should be used for a given plugin.\n   *\n   * The client type is determined by plugin specific config if present.\n   * Otherwise the base client is used as the fallback.\n   *\n   * @param pluginId - Plugin to get the client type for\n   * @returns Object with client type returned as `client` and boolean\n   *          representing whether or not the client was overridden as\n   *          `overridden`\n   */\n  private getClientType(pluginId: string): {\n    client: string;\n    overridden: boolean;\n  } {\n    const pluginClient = this.config.getOptionalString(\n      `${pluginPath(pluginId)}.client`,\n    );\n\n    const baseClient = this.config.getString('client');\n    const client = pluginClient ?? baseClient;\n    return {\n      client,\n      overridden: client !== baseClient,\n    };\n  }\n\n  private getRoleConfig(pluginId: string): string | undefined {\n    return (\n      this.config.getOptionalString(`${pluginPath(pluginId)}.role`) ??\n      this.config.getOptionalString('role')\n    );\n  }\n\n  /**\n   * Provides the knexConfig which should be used for a given plugin.\n   *\n   * @param pluginId - Plugin to get the knexConfig for\n   * @returns The merged knexConfig value or undefined if it isn't specified\n   */\n  private getAdditionalKnexConfig(pluginId: string): JsonObject | undefined {\n    const pluginConfig = this.config\n      .getOptionalConfig(`${pluginPath(pluginId)}.knexConfig`)\n      ?.get<JsonObject>();\n\n    const baseConfig = this.config\n      .getOptionalConfig('knexConfig')\n      ?.get<JsonObject>();\n\n    return merge(baseConfig, pluginConfig);\n  }\n\n  private getEnsureExistsConfig(pluginId: string): boolean {\n    const baseConfig = this.config.getOptionalBoolean('ensureExists') ?? true;\n    return (\n      this.config.getOptionalBoolean(`${pluginPath(pluginId)}.ensureExists`) ??\n      baseConfig\n    );\n  }\n\n  private getPluginDivisionModeConfig(): string {\n    return this.config.getOptionalString('pluginDivisionMode') ?? 'database';\n  }\n\n  /**\n   * Provides a Knex connection plugin config by combining base and plugin\n   * config.\n   *\n   * This method provides a baseConfig for a plugin database connector. If the\n   * client type has not been overridden, the global connection config will be\n   * included with plugin specific config as the base. Values from the plugin\n   * connection take precedence over the base. Base database name is omitted\n   * unless `pluginDivisionMode` is set to `schema`.\n   */\n  private getConnectionConfig(pluginId: string): Knex.StaticConnectionConfig {\n    const { overridden } = this.getClientType(pluginId);\n\n    let baseConnection = normalizeConnection(this.config.get('connection'));\n\n    // Databases cannot be shared unless the `pluginDivisionMode` is set to `schema`. The\n    // `database` property from the base connection is omitted unless `pluginDivisionMode`\n    // is set to `schema`.\n    if (this.getPluginDivisionModeConfig() !== 'schema') {\n      baseConnection = omit(baseConnection, 'database');\n    }\n\n    // get and normalize optional plugin specific database connection\n    const connection = normalizeConnection(\n      this.config.getOptional(`${pluginPath(pluginId)}.connection`),\n    );\n\n    return {\n      // include base connection if client type has not been overridden\n      ...(overridden ? {} : baseConnection),\n      ...connection,\n    } as Knex.StaticConnectionConfig;\n  }\n\n  /**\n   * Provides a Knex database config for a given plugin.\n   *\n   * This method provides a Knex configuration object along with the plugin's\n   * client type.\n   *\n   * @param pluginId - The plugin that the database config should correspond with\n   */\n  private getConfigForPlugin(pluginId: string): Knex.Config {\n    const { client } = this.getClientType(pluginId);\n    const role = this.getRoleConfig(pluginId);\n\n    return {\n      ...this.getAdditionalKnexConfig(pluginId),\n      client,\n      connection: this.getConnectionConfig(pluginId),\n      ...(role && { role }),\n    };\n  }\n\n  /**\n   * Provides a partial `Knex.Config`• database name override for a given plugin.\n   *\n   * @param pluginId - Target plugin to get database name override\n   * @returns Partial `Knex.Config` with database name override\n   */\n  private getDatabaseOverrides(pluginId: string): Knex.Config {\n    const databaseName = this.getDatabaseName(pluginId);\n    return databaseName ? defaultNameOverride(databaseName) : {};\n  }\n}\n"],"names":["limiterFactory","knexFactory","mergeDatabaseConfig","yn","InputError","ConfigReader","merge","omit","defaultNameOverride"],"mappings":";;;;;;;;;;;;;;;;;AA6BA,MAAM,UAAA,GAAaA,gCAAe,CAAC,CAAA;AAQ5B,SAAS,yBAAA,CACd,UACA,SAAA,EACA;AACA,EAAA,MAAM,UAAA,GAAa,wBAAA,CAAyB,QAAA,EAAU,SAAS,CAAA;AAC/D,EAAA,MAAM,QAAA,GAAWC,6BAAY,UAAU,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;AAQO,SAAS,wBAAA,CACd,UACA,SAAA,EACA;AACA,EAAA,OAAOC,uCAAA;AAAA,IACL,SAAS,GAAA,EAAI;AAAA,IACb;AAAA,MACE,UAAA,EAAY,wBAAA,CAAyB,QAAA,EAAU,CAAC,CAAC,SAAS,CAAA;AAAA,MAC1D,gBAAA,EAAkB;AAAA,KACpB;AAAA,IACA;AAAA,GACF;AACF;AAQO,SAAS,wBAAA,CACd,UACA,qBAAA,EACqC;AACrC,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA;AAC5C,EAAA,MAAM,kBAAA,GACJ,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,YAAsB,MAAA;AAC1D,EAAA,MAAM,SAAA,GAAY,OAAO,qBAAA,KAA0B,SAAA;AAEnD,EAAA,MAAM,2BAAA,GAA8B,SAAA,GAChC,kBAAA,GACA,qBAAA,IAAyB,kBAAA;AAE7B,EAAA,OAAO,2BAAA,GACH,0BAAA,CAA2B,UAAoB,CAAA,GAC/C,UAAA;AACN;AAQO,SAAS,2BACd,gBAAA,EAC4B;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM;AAAA,MACJ,QAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAI,GAAA,CAAI,gBAAgB,CAAA;AAE5B,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,QAAQ,CAAA,CAAE,CAAA;AAAA,IAChD,CAAA,MAAA,IAAW,CAAC,QAAA,IAAY,CAAC,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,MAAM,CAAA,yBAAA,CAA2B,CAAA;AAAA,IAC7C,CAAA,MAAA,IAAW,CAAC,QAAA,CAAS,KAAA,CAAM,WAAW,CAAA,EAAG;AACvC,MAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,CAA8B,CAAA;AAAA,IAChD;AAEA,IAAA,MAAM,MAAA,GAAqC;AAAA,MACzC,IAAA,EAAM,QAAA;AAAA,MACN,QAAA;AAAA,MACA,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,IAAI,CAAA;AAAA,MACzB,QAAA,EAAU,kBAAA,CAAmB,QAAA,CAAS,SAAA,CAAU,CAAC,CAAC;AAAA,KACpD;AAEA,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAA,CAAO,GAAA,GAAM,GAAA;AAAA,IACf;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA,CAAO,KAAA,GAAQC,oBAAG,KAAK,CAAA;AAAA,IACzB;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAIC,iBAAA;AAAA,MACR,gDAAgD,CAAC,CAAA,CAAA;AAAA,MACjD;AAAA,KACF;AAAA,EACF;AACF;AAQA,eAAsB,yBAAA,CACpB,aACG,SAAA,EACH;AACA,EAAA,MAAM,KAAA,GAAQ,0BAA0B,QAAA,EAAU;AAAA,IAChD,UAAA,EAAY;AAAA,MACV,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,GAAA,EAAK,CAAA;AAAA,MACL,oBAAA,EAAsB;AAAA;AACxB,GACD,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,GAAiB,OAAO,QAAA,KAAqB;AACjD,MAAA,MAAM,KAAA,CAAM,GAAA,CAAI,CAAA,gCAAA,CAAA,EAAoC,CAAC,QAAQ,CAAC,CAAA;AAAA,IAChE,CAAA;AACA,IAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,MACZ,SAAA,CAAU,GAAA,CAAI,OAAM,QAAA,KAAY;AAI9B,QAAA,IAAI,OAAA,GAA6B,KAAA,CAAA;AACjC,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,UAAA,IAAI;AACF,YAAA,OAAO,MAAM,UAAA,CAAW,MAAM,cAAA,CAAe,QAAQ,CAAC,CAAA;AAAA,UACxD,SAAS,GAAA,EAAK;AACZ,YAAA,OAAA,GAAU,GAAA;AAAA,UACZ;AACA,UAAA,MAAM,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AAAA,QACvD;AACA,QAAA,MAAM,OAAA;AAAA,MACR,CAAC;AAAA,KACH;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,MAAM,OAAA,EAAQ;AAAA,EACtB;AACF;AAuCA,SAAS,WAAW,QAAA,EAA0B;AAC5C,EAAA,OAAO,UAAU,QAAQ,CAAA,CAAA;AAC3B;AAEA,SAAS,oBACP,UAAA,EACsC;AACtC,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,IAAe,UAAA,KAAe,IAAA,EAAM;AAC5D,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,sBAAsB,MAAA,GAC3D,0BAAA,CAA2B,UAAoB,CAAA,GAC/C,UAAA;AACN;AAEO,MAAM,cAAA,CAAoC;AAAA,EAC/C,WAAA,CACmB,QACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA,EAEH,MAAM,SAAA,CACJ,QAAA,EACA,KAAA,EAIe;AACf,IAAA,MAAM,eAAe,IAAIC,mBAAA;AAAA,MACvB,IAAA,CAAK,mBAAmB,QAAQ;AAAA,KAClC;AAEA,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,eAAA,CAAgB,QAAQ,CAAA;AAClD,IAAA,IAAI,YAAA,IAAgB,IAAA,CAAK,qBAAA,CAAsB,QAAQ,CAAA,EAAG;AACxD,MAAA,IAAI;AACF,QAAA,MAAM,yBAAA,CAA0B,cAAc,YAAY,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,qDAAA,EAAwD,YAAY,CAAA,UAAA,EAAa,KAAK,CAAA;AAAA,SACxF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,kBAAA,GAAqB,KAAK,2BAAA,EAA4B;AAC5D,IAAA,IAAI,uBAAuB,UAAA,EAAY;AACrC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,2DAA2D,kBAAkB,CAAA,CAAA;AAAA,OAC/E;AAAA,IACF;AAEA,IAAA,MAAM,uBAAA,GAA0BH,uCAAA;AAAA,MAC9B,EAAC;AAAA,MACD,IAAA,CAAK,qBAAqB,QAAQ;AAAA,KACpC;AAEA,IAAA,MAAM,MAAA,GAAS,yBAAA;AAAA,MACb,YAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,gBAAgB,QAAA,EAAsC;AAC5D,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,mBAAA,CAAoB,QAAQ,CAAA;AACpD,IAAA,MAAM,eAAgB,UAAA,EAAsC,QAAA;AAC5D,IAAA,OAAO,YAAA,IAAgB,CAAA,EAAG,IAAA,CAAK,MAAM,GAAG,QAAQ,CAAA,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,cAAc,QAAA,EAGpB;AACA,IAAA,MAAM,YAAA,GAAe,KAAK,MAAA,CAAO,iBAAA;AAAA,MAC/B,CAAA,EAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,OAAA;AAAA,KACzB;AAEA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACjD,IAAA,MAAM,SAAS,YAAA,IAAgB,UAAA;AAC/B,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,YAAY,MAAA,KAAW;AAAA,KACzB;AAAA,EACF;AAAA,EAEQ,cAAc,QAAA,EAAsC;AAC1D,IAAA,OACE,IAAA,CAAK,MAAA,CAAO,iBAAA,CAAkB,CAAA,EAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,KAAA,CAAO,CAAA,IAC5D,IAAA,CAAK,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAExC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,wBAAwB,QAAA,EAA0C;AACxE,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,MAAA,CACvB,iBAAA,CAAkB,CAAA,EAAG,WAAW,QAAQ,CAAC,CAAA,WAAA,CAAa,CAAA,EACrD,GAAA,EAAgB;AAEpB,IAAA,MAAM,aAAa,IAAA,CAAK,MAAA,CACrB,iBAAA,CAAkB,YAAY,GAC7B,GAAA,EAAgB;AAEpB,IAAA,OAAOI,YAAA,CAAM,YAAY,YAAY,CAAA;AAAA,EACvC;AAAA,EAEQ,sBAAsB,QAAA,EAA2B;AACvD,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,kBAAA,CAAmB,cAAc,CAAA,IAAK,IAAA;AACrE,IAAA,OACE,IAAA,CAAK,OAAO,kBAAA,CAAmB,CAAA,EAAG,WAAW,QAAQ,CAAC,eAAe,CAAA,IACrE,UAAA;AAAA,EAEJ;AAAA,EAEQ,2BAAA,GAAsC;AAC5C,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,iBAAA,CAAkB,oBAAoB,CAAA,IAAK,UAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,oBAAoB,QAAA,EAA+C;AACzE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,IAAA,CAAK,cAAc,QAAQ,CAAA;AAElD,IAAA,IAAI,iBAAiB,mBAAA,CAAoB,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,YAAY,CAAC,CAAA;AAKtE,IAAA,IAAI,IAAA,CAAK,2BAAA,EAA4B,KAAM,QAAA,EAAU;AACnD,MAAA,cAAA,GAAiBC,WAAA,CAAK,gBAAgB,UAAU,CAAA;AAAA,IAClD;AAGA,IAAA,MAAM,UAAA,GAAa,mBAAA;AAAA,MACjB,KAAK,MAAA,CAAO,WAAA,CAAY,GAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,WAAA,CAAa;AAAA,KAC9D;AAEA,IAAA,OAAO;AAAA;AAAA,MAEL,GAAI,UAAA,GAAa,EAAC,GAAI,cAAA;AAAA,MACtB,GAAG;AAAA,KACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,mBAAmB,QAAA,EAA+B;AACxD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,IAAA,CAAK,cAAc,QAAQ,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAExC,IAAA,OAAO;AAAA,MACL,GAAG,IAAA,CAAK,uBAAA,CAAwB,QAAQ,CAAA;AAAA,MACxC,MAAA;AAAA,MACA,UAAA,EAAY,IAAA,CAAK,mBAAA,CAAoB,QAAQ,CAAA;AAAA,MAC7C,GAAI,IAAA,IAAQ,EAAE,IAAA;AAAK,KACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,qBAAqB,QAAA,EAA+B;AAC1D,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,eAAA,CAAgB,QAAQ,CAAA;AAClD,IAAA,OAAO,YAAA,GAAeC,2BAAA,CAAoB,YAAY,CAAA,GAAI,EAAC;AAAA,EAC7D;AACF;;;;;;;;;"}
+{"version":3,"file":"mysql.cjs.js","sources":["../../../../src/entrypoints/database/connectors/mysql.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { LifecycleService, LoggerService } from '@backstage/backend-plugin-api';\nimport { Config, ConfigReader } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { JsonObject } from '@backstage/types';\nimport knexFactory, { Knex } from 'knex';\nimport { merge, omit } from 'lodash';\nimport limiterFactory from 'p-limit';\nimport yn from 'yn';\nimport { Connector } from '../types';\nimport defaultNameOverride from './defaultNameOverride';\nimport { mergeDatabaseConfig } from './mergeDatabaseConfig';\n\n// Limits the number of concurrent DDL operations to 1\nconst ddlLimiter = limiterFactory(1);\n\n/**\n * Creates a knex mysql database connection\n *\n * @param dbConfig - The database config\n * @param overrides - Additional options to merge with the config\n */\nexport function createMysqlDatabaseClient(\n  dbConfig: Config,\n  overrides?: Knex.Config,\n) {\n  const knexConfig = buildMysqlDatabaseConfig(dbConfig, overrides);\n  const database = knexFactory(knexConfig);\n  return database;\n}\n\n/**\n * Builds a knex mysql database connection\n *\n * @param dbConfig - The database config\n * @param overrides - Additional options to merge with the config\n */\nexport function buildMysqlDatabaseConfig(\n  dbConfig: Config,\n  overrides?: Knex.Config,\n) {\n  return mergeDatabaseConfig(\n    dbConfig.get(),\n    {\n      connection: getMysqlConnectionConfig(dbConfig, !!overrides),\n      useNullAsDefault: true,\n    },\n    overrides,\n  );\n}\n\n/**\n * Gets the mysql connection config\n *\n * @param dbConfig - The database config\n * @param parseConnectionString - Flag to explicitly control connection string parsing\n */\nexport function getMysqlConnectionConfig(\n  dbConfig: Config,\n  parseConnectionString?: boolean,\n): Knex.MySqlConnectionConfig | string {\n  const connection = dbConfig.get('connection') as any;\n  const isConnectionString =\n    typeof connection === 'string' || connection instanceof String;\n  const autoParse = typeof parseConnectionString !== 'boolean';\n\n  const shouldParseConnectionString = autoParse\n    ? isConnectionString\n    : parseConnectionString && isConnectionString;\n\n  return shouldParseConnectionString\n    ? parseMysqlConnectionString(connection as string)\n    : connection;\n}\n\n/**\n * Parses a mysql connection string.\n *\n * e.g. mysql://examplename:somepassword@examplehost:3306/dbname\n * @param connectionString - The mysql connection string\n */\nexport function parseMysqlConnectionString(\n  connectionString: string,\n): Knex.MySqlConnectionConfig {\n  try {\n    const {\n      protocol,\n      username,\n      password,\n      port,\n      hostname,\n      pathname,\n      searchParams,\n    } = new URL(connectionString);\n\n    if (protocol !== 'mysql:') {\n      throw new Error(`Unknown protocol ${protocol}`);\n    } else if (!username || !password) {\n      throw new Error(`Missing username/password`);\n    } else if (!pathname.match(/^\\/[^/]+$/)) {\n      throw new Error(`Expected single path segment`);\n    }\n\n    const result: Knex.MySqlConnectionConfig = {\n      user: username,\n      password,\n      host: hostname,\n      port: Number(port || 3306),\n      database: decodeURIComponent(pathname.substring(1)),\n    };\n\n    const ssl = searchParams.get('ssl');\n    if (ssl) {\n      result.ssl = ssl;\n    }\n\n    const debug = searchParams.get('debug');\n    if (debug) {\n      result.debug = yn(debug);\n    }\n\n    return result;\n  } catch (e) {\n    throw new InputError(\n      `Error while parsing MySQL connection string, ${e}`,\n      e,\n    );\n  }\n}\n\n/**\n * Creates the missing mysql database if it does not exist\n *\n * @param dbConfig - The database config\n * @param databases - The names of the databases to create\n */\nexport async function ensureMysqlDatabaseExists(\n  dbConfig: Config,\n  ...databases: Array<string>\n) {\n  const admin = createMysqlDatabaseClient(dbConfig, {\n    connection: {\n      database: null as unknown as string,\n    },\n    pool: {\n      min: 0,\n      acquireTimeoutMillis: 10000,\n    },\n  });\n\n  try {\n    const ensureDatabase = async (database: string) => {\n      await admin.raw(`CREATE DATABASE IF NOT EXISTS ??`, [database]);\n    };\n    await Promise.all(\n      databases.map(async database => {\n        // For initial setup we use a smaller timeout but several retries. Given that this\n        // is a separate connection pool we should never really run into issues with connection\n        // acquisition timeouts, but we do anyway. This might be a bug in knex or some other dependency.\n        let lastErr: Error | undefined = undefined;\n        for (let i = 0; i < 3; i++) {\n          try {\n            return await ddlLimiter(() => ensureDatabase(database));\n          } catch (err) {\n            lastErr = err;\n          }\n          await new Promise(resolve => setTimeout(resolve, 100));\n        }\n        throw lastErr;\n      }),\n    );\n  } finally {\n    await admin.destroy();\n  }\n}\n\n/**\n * Drops the given mysql databases.\n *\n * @param dbConfig - The database config\n * @param databases - The names of the databases to create\n */\nexport async function dropMysqlDatabase(\n  dbConfig: Config,\n  ...databases: Array<string>\n) {\n  const admin = createMysqlDatabaseClient(dbConfig, {\n    connection: {\n      database: null as unknown as string,\n    },\n    pool: {\n      min: 0,\n      acquireTimeoutMillis: 10000,\n    },\n  });\n\n  try {\n    const dropDatabase = async (database: string) => {\n      await admin.raw(`DROP DATABASE ??`, [database]);\n    };\n    await Promise.all(\n      databases.map(async database => {\n        return await ddlLimiter(() => dropDatabase(database));\n      }),\n    );\n  } finally {\n    await admin.destroy();\n  }\n}\n\n/**\n * Provides a config lookup path for a plugin's config block.\n */\nfunction pluginPath(pluginId: string): string {\n  return `plugin.${pluginId}`;\n}\n\nfunction normalizeConnection(\n  connection: Knex.StaticConnectionConfig | JsonObject | string | undefined,\n): Partial<Knex.StaticConnectionConfig> {\n  if (typeof connection === 'undefined' || connection === null) {\n    return {};\n  }\n\n  return typeof connection === 'string' || connection instanceof String\n    ? parseMysqlConnectionString(connection as string)\n    : connection;\n}\n\nexport class MysqlConnector implements Connector {\n  private readonly config: Config;\n  private readonly prefix: string;\n\n  constructor(config: Config, prefix: string) {\n    this.config = config;\n    this.prefix = prefix;\n  }\n\n  async getClient(\n    pluginId: string,\n    _deps: {\n      logger: LoggerService;\n      lifecycle: LifecycleService;\n    },\n  ): Promise<Knex> {\n    const pluginConfig = new ConfigReader(\n      this.getConfigForPlugin(pluginId) as JsonObject,\n    );\n\n    const databaseName = this.getDatabaseName(pluginId);\n    if (databaseName && this.getEnsureExistsConfig(pluginId)) {\n      try {\n        await ensureMysqlDatabaseExists(pluginConfig, databaseName);\n      } catch (error) {\n        throw new Error(\n          `Failed to connect to the database to make sure that '${databaseName}' exists, ${error}`,\n        );\n      }\n    }\n\n    const pluginDivisionMode = this.getPluginDivisionModeConfig();\n    if (pluginDivisionMode !== 'database') {\n      throw new Error(\n        `The MySQL driver does not support plugin division mode '${pluginDivisionMode}'`,\n      );\n    }\n\n    const databaseClientOverrides = mergeDatabaseConfig(\n      {},\n      this.getDatabaseOverrides(pluginId),\n    );\n\n    const client = createMysqlDatabaseClient(\n      pluginConfig,\n      databaseClientOverrides,\n    );\n\n    return client;\n  }\n\n  /**\n   * Provides the canonical database name for a given plugin.\n   *\n   * This method provides the effective database name which is determined using\n   * global and plugin specific database config. If no explicit database name,\n   * this method will provide a generated name which is the pluginId prefixed\n   * with 'backstage_plugin_'.\n   *\n   * @param pluginId - Lookup the database name for given plugin\n   * @returns String representing the plugin's database name\n   */\n  private getDatabaseName(pluginId: string): string | undefined {\n    const connection = this.getConnectionConfig(pluginId);\n    const databaseName = (connection as Knex.ConnectionConfig)?.database;\n    return databaseName ?? `${this.prefix}${pluginId}`;\n  }\n\n  /**\n   * Provides the client type which should be used for a given plugin.\n   *\n   * The client type is determined by plugin specific config if present.\n   * Otherwise the base client is used as the fallback.\n   *\n   * @param pluginId - Plugin to get the client type for\n   * @returns Object with client type returned as `client` and boolean\n   *          representing whether or not the client was overridden as\n   *          `overridden`\n   */\n  private getClientType(pluginId: string): {\n    client: string;\n    overridden: boolean;\n  } {\n    const pluginClient = this.config.getOptionalString(\n      `${pluginPath(pluginId)}.client`,\n    );\n\n    const baseClient = this.config.getString('client');\n    const client = pluginClient ?? baseClient;\n    return {\n      client,\n      overridden: client !== baseClient,\n    };\n  }\n\n  private getRoleConfig(pluginId: string): string | undefined {\n    return (\n      this.config.getOptionalString(`${pluginPath(pluginId)}.role`) ??\n      this.config.getOptionalString('role')\n    );\n  }\n\n  /**\n   * Provides the knexConfig which should be used for a given plugin.\n   *\n   * @param pluginId - Plugin to get the knexConfig for\n   * @returns The merged knexConfig value or undefined if it isn't specified\n   */\n  private getAdditionalKnexConfig(pluginId: string): JsonObject | undefined {\n    const pluginConfig = this.config\n      .getOptionalConfig(`${pluginPath(pluginId)}.knexConfig`)\n      ?.get<JsonObject>();\n\n    const baseConfig = this.config\n      .getOptionalConfig('knexConfig')\n      ?.get<JsonObject>();\n\n    return merge(baseConfig, pluginConfig);\n  }\n\n  private getEnsureExistsConfig(pluginId: string): boolean {\n    const baseConfig = this.config.getOptionalBoolean('ensureExists') ?? true;\n    return (\n      this.config.getOptionalBoolean(`${pluginPath(pluginId)}.ensureExists`) ??\n      baseConfig\n    );\n  }\n\n  private getPluginDivisionModeConfig(): string {\n    return this.config.getOptionalString('pluginDivisionMode') ?? 'database';\n  }\n\n  /**\n   * Provides a Knex connection plugin config by combining base and plugin\n   * config.\n   *\n   * This method provides a baseConfig for a plugin database connector. If the\n   * client type has not been overridden, the global connection config will be\n   * included with plugin specific config as the base. Values from the plugin\n   * connection take precedence over the base. Base database name is omitted\n   * unless `pluginDivisionMode` is set to `schema`.\n   */\n  private getConnectionConfig(pluginId: string): Knex.StaticConnectionConfig {\n    const { overridden } = this.getClientType(pluginId);\n\n    let baseConnection = normalizeConnection(this.config.get('connection'));\n\n    // Databases cannot be shared unless the `pluginDivisionMode` is set to `schema`. The\n    // `database` property from the base connection is omitted unless `pluginDivisionMode`\n    // is set to `schema`.\n    if (this.getPluginDivisionModeConfig() !== 'schema') {\n      baseConnection = omit(baseConnection, 'database');\n    }\n\n    // get and normalize optional plugin specific database connection\n    const connection = normalizeConnection(\n      this.config.getOptional(`${pluginPath(pluginId)}.connection`),\n    );\n\n    return {\n      // include base connection if client type has not been overridden\n      ...(overridden ? {} : baseConnection),\n      ...connection,\n    } as Knex.StaticConnectionConfig;\n  }\n\n  /**\n   * Provides a Knex database config for a given plugin.\n   *\n   * This method provides a Knex configuration object along with the plugin's\n   * client type.\n   *\n   * @param pluginId - The plugin that the database config should correspond with\n   */\n  private getConfigForPlugin(pluginId: string): Knex.Config {\n    const { client } = this.getClientType(pluginId);\n    const role = this.getRoleConfig(pluginId);\n\n    return {\n      ...this.getAdditionalKnexConfig(pluginId),\n      client,\n      connection: this.getConnectionConfig(pluginId),\n      ...(role && { role }),\n    };\n  }\n\n  /**\n   * Provides a partial `Knex.Config`• database name override for a given plugin.\n   *\n   * @param pluginId - Target plugin to get database name override\n   * @returns Partial `Knex.Config` with database name override\n   */\n  private getDatabaseOverrides(pluginId: string): Knex.Config {\n    const databaseName = this.getDatabaseName(pluginId);\n    return databaseName ? defaultNameOverride(databaseName) : {};\n  }\n}\n"],"names":["limiterFactory","knexFactory","mergeDatabaseConfig","yn","InputError","ConfigReader","merge","omit","defaultNameOverride"],"mappings":";;;;;;;;;;;;;;;;;AA6BA,MAAM,UAAA,GAAaA,gCAAe,CAAC,CAAA;AAQ5B,SAAS,yBAAA,CACd,UACA,SAAA,EACA;AACA,EAAA,MAAM,UAAA,GAAa,wBAAA,CAAyB,QAAA,EAAU,SAAS,CAAA;AAC/D,EAAA,MAAM,QAAA,GAAWC,6BAAY,UAAU,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;AAQO,SAAS,wBAAA,CACd,UACA,SAAA,EACA;AACA,EAAA,OAAOC,uCAAA;AAAA,IACL,SAAS,GAAA,EAAI;AAAA,IACb;AAAA,MACE,UAAA,EAAY,wBAAA,CAAyB,QAAA,EAAU,CAAC,CAAC,SAAS,CAAA;AAAA,MAC1D,gBAAA,EAAkB;AAAA,KACpB;AAAA,IACA;AAAA,GACF;AACF;AAQO,SAAS,wBAAA,CACd,UACA,qBAAA,EACqC;AACrC,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,GAAA,CAAI,YAAY,CAAA;AAC5C,EAAA,MAAM,kBAAA,GACJ,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,YAAsB,MAAA;AAC1D,EAAA,MAAM,SAAA,GAAY,OAAO,qBAAA,KAA0B,SAAA;AAEnD,EAAA,MAAM,2BAAA,GAA8B,SAAA,GAChC,kBAAA,GACA,qBAAA,IAAyB,kBAAA;AAE7B,EAAA,OAAO,2BAAA,GACH,0BAAA,CAA2B,UAAoB,CAAA,GAC/C,UAAA;AACN;AAQO,SAAS,2BACd,gBAAA,EAC4B;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM;AAAA,MACJ,QAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAI,GAAA,CAAI,gBAAgB,CAAA;AAE5B,IAAA,IAAI,aAAa,QAAA,EAAU;AACzB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,QAAQ,CAAA,CAAE,CAAA;AAAA,IAChD,CAAA,MAAA,IAAW,CAAC,QAAA,IAAY,CAAC,QAAA,EAAU;AACjC,MAAA,MAAM,IAAI,MAAM,CAAA,yBAAA,CAA2B,CAAA;AAAA,IAC7C,CAAA,MAAA,IAAW,CAAC,QAAA,CAAS,KAAA,CAAM,WAAW,CAAA,EAAG;AACvC,MAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,CAA8B,CAAA;AAAA,IAChD;AAEA,IAAA,MAAM,MAAA,GAAqC;AAAA,MACzC,IAAA,EAAM,QAAA;AAAA,MACN,QAAA;AAAA,MACA,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,IAAI,CAAA;AAAA,MACzB,QAAA,EAAU,kBAAA,CAAmB,QAAA,CAAS,SAAA,CAAU,CAAC,CAAC;AAAA,KACpD;AAEA,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,MAAA,CAAO,GAAA,GAAM,GAAA;AAAA,IACf;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAA,CAAO,KAAA,GAAQC,oBAAG,KAAK,CAAA;AAAA,IACzB;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAIC,iBAAA;AAAA,MACR,gDAAgD,CAAC,CAAA,CAAA;AAAA,MACjD;AAAA,KACF;AAAA,EACF;AACF;AAQA,eAAsB,yBAAA,CACpB,aACG,SAAA,EACH;AACA,EAAA,MAAM,KAAA,GAAQ,0BAA0B,QAAA,EAAU;AAAA,IAChD,UAAA,EAAY;AAAA,MACV,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,GAAA,EAAK,CAAA;AAAA,MACL,oBAAA,EAAsB;AAAA;AACxB,GACD,CAAA;AAED,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,GAAiB,OAAO,QAAA,KAAqB;AACjD,MAAA,MAAM,KAAA,CAAM,GAAA,CAAI,CAAA,gCAAA,CAAA,EAAoC,CAAC,QAAQ,CAAC,CAAA;AAAA,IAChE,CAAA;AACA,IAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,MACZ,SAAA,CAAU,GAAA,CAAI,OAAM,QAAA,KAAY;AAI9B,QAAA,IAAI,OAAA,GAA6B,KAAA,CAAA;AACjC,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,UAAA,IAAI;AACF,YAAA,OAAO,MAAM,UAAA,CAAW,MAAM,cAAA,CAAe,QAAQ,CAAC,CAAA;AAAA,UACxD,SAAS,GAAA,EAAK;AACZ,YAAA,OAAA,GAAU,GAAA;AAAA,UACZ;AACA,UAAA,MAAM,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,GAAG,CAAC,CAAA;AAAA,QACvD;AACA,QAAA,MAAM,OAAA;AAAA,MACR,CAAC;AAAA,KACH;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,MAAM,OAAA,EAAQ;AAAA,EACtB;AACF;AAuCA,SAAS,WAAW,QAAA,EAA0B;AAC5C,EAAA,OAAO,UAAU,QAAQ,CAAA,CAAA;AAC3B;AAEA,SAAS,oBACP,UAAA,EACsC;AACtC,EAAA,IAAI,OAAO,UAAA,KAAe,WAAA,IAAe,UAAA,KAAe,IAAA,EAAM;AAC5D,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,sBAAsB,MAAA,GAC3D,0BAAA,CAA2B,UAAoB,CAAA,GAC/C,UAAA;AACN;AAEO,MAAM,cAAA,CAAoC;AAAA,EAC9B,MAAA;AAAA,EACA,MAAA;AAAA,EAEjB,WAAA,CAAY,QAAgB,MAAA,EAAgB;AAC1C,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,MAAM,SAAA,CACJ,QAAA,EACA,KAAA,EAIe;AACf,IAAA,MAAM,eAAe,IAAIC,mBAAA;AAAA,MACvB,IAAA,CAAK,mBAAmB,QAAQ;AAAA,KAClC;AAEA,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,eAAA,CAAgB,QAAQ,CAAA;AAClD,IAAA,IAAI,YAAA,IAAgB,IAAA,CAAK,qBAAA,CAAsB,QAAQ,CAAA,EAAG;AACxD,MAAA,IAAI;AACF,QAAA,MAAM,yBAAA,CAA0B,cAAc,YAAY,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,qDAAA,EAAwD,YAAY,CAAA,UAAA,EAAa,KAAK,CAAA;AAAA,SACxF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,kBAAA,GAAqB,KAAK,2BAAA,EAA4B;AAC5D,IAAA,IAAI,uBAAuB,UAAA,EAAY;AACrC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,2DAA2D,kBAAkB,CAAA,CAAA;AAAA,OAC/E;AAAA,IACF;AAEA,IAAA,MAAM,uBAAA,GAA0BH,uCAAA;AAAA,MAC9B,EAAC;AAAA,MACD,IAAA,CAAK,qBAAqB,QAAQ;AAAA,KACpC;AAEA,IAAA,MAAM,MAAA,GAAS,yBAAA;AAAA,MACb,YAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,gBAAgB,QAAA,EAAsC;AAC5D,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,mBAAA,CAAoB,QAAQ,CAAA;AACpD,IAAA,MAAM,eAAgB,UAAA,EAAsC,QAAA;AAC5D,IAAA,OAAO,YAAA,IAAgB,CAAA,EAAG,IAAA,CAAK,MAAM,GAAG,QAAQ,CAAA,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,cAAc,QAAA,EAGpB;AACA,IAAA,MAAM,YAAA,GAAe,KAAK,MAAA,CAAO,iBAAA;AAAA,MAC/B,CAAA,EAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,OAAA;AAAA,KACzB;AAEA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACjD,IAAA,MAAM,SAAS,YAAA,IAAgB,UAAA;AAC/B,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,YAAY,MAAA,KAAW;AAAA,KACzB;AAAA,EACF;AAAA,EAEQ,cAAc,QAAA,EAAsC;AAC1D,IAAA,OACE,IAAA,CAAK,MAAA,CAAO,iBAAA,CAAkB,CAAA,EAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,KAAA,CAAO,CAAA,IAC5D,IAAA,CAAK,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAExC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,wBAAwB,QAAA,EAA0C;AACxE,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,MAAA,CACvB,iBAAA,CAAkB,CAAA,EAAG,WAAW,QAAQ,CAAC,CAAA,WAAA,CAAa,CAAA,EACrD,GAAA,EAAgB;AAEpB,IAAA,MAAM,aAAa,IAAA,CAAK,MAAA,CACrB,iBAAA,CAAkB,YAAY,GAC7B,GAAA,EAAgB;AAEpB,IAAA,OAAOI,YAAA,CAAM,YAAY,YAAY,CAAA;AAAA,EACvC;AAAA,EAEQ,sBAAsB,QAAA,EAA2B;AACvD,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,kBAAA,CAAmB,cAAc,CAAA,IAAK,IAAA;AACrE,IAAA,OACE,IAAA,CAAK,OAAO,kBAAA,CAAmB,CAAA,EAAG,WAAW,QAAQ,CAAC,eAAe,CAAA,IACrE,UAAA;AAAA,EAEJ;AAAA,EAEQ,2BAAA,GAAsC;AAC5C,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,iBAAA,CAAkB,oBAAoB,CAAA,IAAK,UAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,oBAAoB,QAAA,EAA+C;AACzE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,IAAA,CAAK,cAAc,QAAQ,CAAA;AAElD,IAAA,IAAI,iBAAiB,mBAAA,CAAoB,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,YAAY,CAAC,CAAA;AAKtE,IAAA,IAAI,IAAA,CAAK,2BAAA,EAA4B,KAAM,QAAA,EAAU;AACnD,MAAA,cAAA,GAAiBC,WAAA,CAAK,gBAAgB,UAAU,CAAA;AAAA,IAClD;AAGA,IAAA,MAAM,UAAA,GAAa,mBAAA;AAAA,MACjB,KAAK,MAAA,CAAO,WAAA,CAAY,GAAG,UAAA,CAAW,QAAQ,CAAC,CAAA,WAAA,CAAa;AAAA,KAC9D;AAEA,IAAA,OAAO;AAAA;AAAA,MAEL,GAAI,UAAA,GAAa,EAAC,GAAI,cAAA;AAAA,MACtB,GAAG;AAAA,KACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,mBAAmB,QAAA,EAA+B;AACxD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,IAAA,CAAK,cAAc,QAAQ,CAAA;AAC9C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAExC,IAAA,OAAO;AAAA,MACL,GAAG,IAAA,CAAK,uBAAA,CAAwB,QAAQ,CAAA;AAAA,MACxC,MAAA;AAAA,MACA,UAAA,EAAY,IAAA,CAAK,mBAAA,CAAoB,QAAQ,CAAA;AAAA,MAC7C,GAAI,IAAA,IAAQ,EAAE,IAAA;AAAK,KACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,qBAAqB,QAAA,EAA+B;AAC1D,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,eAAA,CAAgB,QAAQ,CAAA;AAClD,IAAA,OAAO,YAAA,GAAeC,2BAAA,CAAoB,YAAY,CAAA,GAAI,EAAC;AAAA,EAC7D;AACF;;;;;;;;;"}

package/dist/entrypoints/database/connectors/postgres.cjs.js

@@ -161,6 +161,8 @@ function normalizeConnection(connection) {
   return typeof connection === "string" || connection instanceof String ? parsePgConnectionString(connection) : connection;
 }
 class PgConnector {
+  config;
+  prefix;
   constructor(config, prefix) {
     this.config = config;
     this.prefix = prefix;