@backstage/backend-defaults 0.16.1-next.2 → 0.16.1

package/CHANGELOG.md

@@ -1,61 +1,10 @@
 # @backstage/backend-defaults
 
-## 0.16.1-next.2
+## 0.16.1
 
 ### Patch Changes
 
-- 482ceed: Migrated from `assertError` to `toError` for error handling.
-- 308c672: `HostDiscovery` now logs a warning when `backend.baseUrl` is set to a localhost address while `NODE_ENV` is `production`, and when `backend.baseUrl` is not a valid URL.
-- 85c5a46: DefaultActionsRegistryService: add json middleware to /.backstage/actions/ routes only
-- f14df56: Added experimental support for using `embedded-postgres` as the database for local development. Set `backend.database.client` to `embedded-postgres` in your app config to enable this. The `embedded-postgres` package must be installed as an explicit dependency in your project.
-- Updated dependencies
-  - @backstage/errors@1.3.0-next.0
-  - @backstage/plugin-auth-node@0.7.0-next.2
-  - @backstage/backend-app-api@1.6.1-next.2
-  - @backstage/cli-node@0.3.1-next.1
-  - @backstage/config-loader@1.10.10-next.1
-  - @backstage/integration@2.0.1-next.0
-  - @backstage/backend-plugin-api@1.9.0-next.2
-  - @backstage/config@1.3.7-next.0
-  - @backstage/integration-aws-node@0.1.21-next.0
-  - @backstage/plugin-events-node@0.4.21-next.2
-  - @backstage/plugin-permission-common@0.9.8-next.0
-  - @backstage/plugin-permission-node@0.10.12-next.2
-
-## 0.16.1-next.1
-
-### Patch Changes
-
-- 4559806: Added support for typed `examples` on actions registered via the actions registry. Action authors can now provide examples with compile-time-checked `input` and `output` values that match their schema definitions.
-- 5cd814f: Refactored auditor severity log level mappings to use `zod/v4` with schema-driven defaults and type inference.
-- 6e2aaab: Fixed `AwsS3UrlReader` failing to read files from S3 buckets configured with custom endpoint hosts. When an integration was configured with a specific endpoint like `https://bucket-1.s3.eu-central-1.amazonaws.com`, the URL parser incorrectly fell through to the non-AWS code path, always defaulting the region to `us-east-1` instead of extracting it from the hostname.
-- Updated dependencies
-  - @backstage/backend-plugin-api@1.9.0-next.1
-  - @backstage/plugin-auth-node@0.7.0-next.1
-  - @backstage/backend-app-api@1.6.1-next.1
-  - @backstage/plugin-events-node@0.4.21-next.1
-  - @backstage/plugin-permission-node@0.10.12-next.1
-
-## 0.16.1-next.0
-
-### Patch Changes
-
-- 79453c0: Updated dependency `wait-for-expect` to `^4.0.0`.
-- Updated dependencies
-  - @backstage/backend-plugin-api@1.8.1-next.0
-  - @backstage/cli-node@0.3.1-next.0
-  - @backstage/config-loader@1.10.10-next.0
-  - @backstage/backend-app-api@1.6.1-next.0
-  - @backstage/plugin-auth-node@0.6.15-next.0
-  - @backstage/plugin-permission-node@0.10.12-next.0
-  - @backstage/plugin-events-node@0.4.21-next.0
-  - @backstage/backend-dev-utils@0.1.7
-  - @backstage/config@1.3.6
-  - @backstage/errors@1.2.7
-  - @backstage/integration@2.0.0
-  - @backstage/integration-aws-node@0.1.20
-  - @backstage/types@1.2.2
-  - @backstage/plugin-permission-common@0.9.7
+- 4034624: Improved service credential handling during plugin-to-plugin delegation.
 
 ## 0.16.0
 

package/config.d.ts

@@ -585,7 +585,7 @@ export interface Config {
     /** Database connection configuration, select base database type using the `client` field */
     database: {
       /** Default database client to use */
-      client: 'better-sqlite3' | 'sqlite3' | 'pg' | 'embedded-postgres';
+      client: 'better-sqlite3' | 'sqlite3' | 'pg';
       /**
        * Base database connection string, or object with individual connection properties
        * @visibility secret

package/dist/alpha/entrypoints/actionsRegistry/DefaultActionsRegistryService.cjs.js

@@ -47,7 +47,7 @@ class DefaultActionsRegistryService {
   }
   createRouter() {
     const router = Router__default.default();
-    router.use("/.backstage/actions/", express.json());
+    router.use(express.json());
     router.get("/.backstage/actions/v1/actions", async (req, res) => {
       const credentials = await this.httpAuth.credentials(req);
       const entries = Array.from(this.actions.entries());
@@ -69,7 +69,6 @@ class DefaultActionsRegistryService {
             idempotent: action.attributes?.idempotent ?? false,
             readOnly: action.attributes?.readOnly ?? false
           },
-          examples: action.examples,
           schema: {
             input: action.schema?.input ? zodToJsonSchema__default.default(action.schema.input(v3.z)) : zodToJsonSchema__default.default(v3.z.object({})),
             output: action.schema?.output ? zodToJsonSchema__default.default(action.schema.output(v3.z)) : zodToJsonSchema__default.default(v3.z.object({}))

package/dist/alpha/entrypoints/actionsRegistry/DefaultActionsRegistryService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultActionsRegistryService.cjs.js","sources":["../../../../src/alpha/entrypoints/actionsRegistry/DefaultActionsRegistryService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  HttpAuthService,\n  LoggerService,\n  PermissionsRegistryService,\n  PermissionsService,\n  PluginMetadataService,\n} from '@backstage/backend-plugin-api';\nimport PromiseRouter from 'express-promise-router';\nimport { Router, json } from 'express';\nimport { z, AnyZodObject } from 'zod/v3';\nimport zodToJsonSchema from 'zod-to-json-schema';\nimport {\n  ActionsRegistryActionOptions,\n  ActionsRegistryService,\n} from '@backstage/backend-plugin-api/alpha';\nimport { InputError, NotAllowedError, NotFoundError } from '@backstage/errors';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\n\ntype ActionEntry = [string, ActionsRegistryActionOptions<any, any>];\n\nexport class DefaultActionsRegistryService implements ActionsRegistryService {\n  private actions: Map<string, ActionsRegistryActionOptions<any, any>> =\n    new Map();\n\n  private readonly logger: LoggerService;\n  private readonly httpAuth: HttpAuthService;\n  private readonly auth: AuthService;\n  private readonly metadata: PluginMetadataService;\n  private readonly permissions: PermissionsService;\n  private readonly permissionsRegistry: PermissionsRegistryService;\n\n  private constructor(\n    logger: LoggerService,\n    httpAuth: HttpAuthService,\n    auth: AuthService,\n    metadata: PluginMetadataService,\n    permissions: PermissionsService,\n    permissionsRegistry: PermissionsRegistryService,\n  ) {\n    this.logger = logger;\n    this.httpAuth = httpAuth;\n    this.auth = auth;\n    this.metadata = metadata;\n    this.permissions = permissions;\n    this.permissionsRegistry = permissionsRegistry;\n  }\n\n  static create({\n    httpAuth,\n    logger,\n    auth,\n    metadata,\n    permissions,\n    permissionsRegistry,\n  }: {\n    httpAuth: HttpAuthService;\n    logger: LoggerService;\n    auth: AuthService;\n    metadata: PluginMetadataService;\n    permissions: PermissionsService;\n    permissionsRegistry: PermissionsRegistryService;\n  }): DefaultActionsRegistryService {\n    return new DefaultActionsRegistryService(\n      logger,\n      httpAuth,\n      auth,\n      metadata,\n      permissions,\n      permissionsRegistry,\n    );\n  }\n\n  createRouter(): Router {\n    const router = PromiseRouter();\n    router.use('/.backstage/actions/', json());\n\n    router.get('/.backstage/actions/v1/actions', async (req, res) => {\n      const credentials = await this.httpAuth.credentials(req);\n      const entries = Array.from(this.actions.entries());\n\n      const allowedActions = await this.filterByPermissions(\n        entries,\n        credentials,\n      );\n\n      return res.json({\n        actions: allowedActions.map(([id, action]) => ({\n          id,\n          name: action.name,\n          title: action.title,\n          description: action.description,\n          pluginId: this.metadata.getId(),\n          attributes: {\n            // Inspired by the @modelcontextprotocol/sdk defaults for the hints.\n            // https://github.com/modelcontextprotocol/typescript-sdk/blob/dd69efa1de8646bb6b195ff8d5f52e13739f4550/src/types.ts#L777-L812\n            destructive: action.attributes?.destructive ?? true,\n            idempotent: action.attributes?.idempotent ?? false,\n            readOnly: action.attributes?.readOnly ?? false,\n          },\n          examples: action.examples,\n          schema: {\n            input: action.schema?.input\n              ? zodToJsonSchema(action.schema.input(z))\n              : zodToJsonSchema(z.object({})),\n            output: action.schema?.output\n              ? zodToJsonSchema(action.schema.output(z))\n              : zodToJsonSchema(z.object({})),\n          },\n        })),\n      });\n    });\n\n    router.post(\n      '/.backstage/actions/v1/actions/:actionId/invoke',\n      async (req, res) => {\n        const credentials = await this.httpAuth.credentials(req);\n        if (this.auth.isPrincipal(credentials, 'none')) {\n          throw new NotAllowedError(\n            `Actions must be invoked by an authenticated principal, not an anonymous request`,\n          );\n        }\n\n        const action = this.actions.get(req.params.actionId);\n\n        if (!action) {\n          throw new NotFoundError(`Action \"${req.params.actionId}\" not found`);\n        }\n\n        if (action.visibilityPermission) {\n          const [decision] = await this.permissions.authorize(\n            [{ permission: action.visibilityPermission }],\n            { credentials },\n          );\n          if (decision.result !== AuthorizeResult.ALLOW) {\n            throw new NotFoundError(\n              `Action \"${req.params.actionId}\" not found`,\n            );\n          }\n        }\n\n        const input = action.schema?.input\n          ? action.schema.input(z).safeParse(req.body)\n          : ({ success: true, data: undefined } as const);\n\n        if (!input.success) {\n          throw new InputError(\n            `Invalid input to action \"${req.params.actionId}\"`,\n            input.error,\n          );\n        }\n\n        const result = await action.action({\n          input: input.data,\n          credentials,\n          logger: this.logger,\n        });\n\n        const output = action.schema?.output\n          ? action.schema.output(z).safeParse(result?.output)\n          : ({ success: true, data: result?.output } as const);\n\n        if (!output.success) {\n          throw new InputError(\n            `Invalid output from action \"${req.params.actionId}\"`,\n            output.error,\n          );\n        }\n\n        res.json({ output: output.data });\n      },\n    );\n    return router;\n  }\n\n  register<\n    TInputSchema extends AnyZodObject,\n    TOutputSchema extends AnyZodObject,\n  >(options: ActionsRegistryActionOptions<TInputSchema, TOutputSchema>): void {\n    const id = `${this.metadata.getId()}:${options.name}`;\n\n    if (this.actions.has(id)) {\n      throw new Error(`Action with id \"${id}\" is already registered`);\n    }\n\n    if (options.visibilityPermission) {\n      this.permissionsRegistry.addPermissions([options.visibilityPermission]);\n    }\n\n    this.actions.set(id, options);\n  }\n\n  private async filterByPermissions(\n    entries: ActionEntry[],\n    credentials: BackstageCredentials,\n  ): Promise<ActionEntry[]> {\n    const permissionedEntries = entries.filter(\n      ([_, action]) => action.visibilityPermission,\n    );\n\n    if (permissionedEntries.length === 0) {\n      return entries;\n    }\n\n    const decisions = await this.permissions.authorize(\n      permissionedEntries.map(([_, action]) => ({\n        permission: action.visibilityPermission!,\n      })),\n      { credentials },\n    );\n\n    const deniedIds = new Set(\n      permissionedEntries\n        .filter((_, index) => decisions[index].result !== AuthorizeResult.ALLOW)\n        .map(([id]) => id),\n    );\n\n    return entries.filter(([id]) => !deniedIds.has(id));\n  }\n}\n"],"names":["PromiseRouter","json","zodToJsonSchema","z","NotAllowedError","NotFoundError","AuthorizeResult","InputError"],"mappings":";;;;;;;;;;;;;;AAsCO,MAAM,6BAAA,CAAgE;AAAA,EACnE,OAAA,uBACF,GAAA,EAAI;AAAA,EAEO,MAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,mBAAA;AAAA,EAET,YACN,MAAA,EACA,QAAA,EACA,IAAA,EACA,QAAA,EACA,aACA,mBAAA,EACA;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,mBAAA,GAAsB,mBAAA;AAAA,EAC7B;AAAA,EAEA,OAAO,MAAA,CAAO;AAAA,IACZ,QAAA;AAAA,IACA,MAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,EAOkC;AAChC,IAAA,OAAO,IAAI,6BAAA;AAAA,MACT,MAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA,QAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,YAAA,GAAuB;AACrB,IAAA,MAAM,SAASA,uBAAA,EAAc;AAC7B,IAAA,MAAA,CAAO,GAAA,CAAI,sBAAA,EAAwBC,YAAA,EAAM,CAAA;AAEzC,IAAA,MAAA,CAAO,GAAA,CAAI,gCAAA,EAAkC,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC/D,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AACvD,MAAA,MAAM,UAAU,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA;AAEjD,MAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA;AAAA,QAChC,OAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,OAAO,IAAI,IAAA,CAAK;AAAA,QACd,SAAS,cAAA,CAAe,GAAA,CAAI,CAAC,CAAC,EAAA,EAAI,MAAM,CAAA,MAAO;AAAA,UAC7C,EAAA;AAAA,UACA,MAAM,MAAA,CAAO,IAAA;AAAA,UACb,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,QAAA,EAAU,IAAA,CAAK,QAAA,CAAS,KAAA,EAAM;AAAA,UAC9B,UAAA,EAAY;AAAA;AAAA;AAAA,YAGV,WAAA,EAAa,MAAA,CAAO,UAAA,EAAY,WAAA,IAAe,IAAA;AAAA,YAC/C,UAAA,EAAY,MAAA,CAAO,UAAA,EAAY,UAAA,IAAc,KAAA;AAAA,YAC7C,QAAA,EAAU,MAAA,CAAO,UAAA,EAAY,QAAA,IAAY;AAAA,WAC3C;AAAA,UACA,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,MAAA,EAAQ;AAAA,YACN,OAAO,MAAA,CAAO,MAAA,EAAQ,KAAA,GAClBC,gCAAA,CAAgB,OAAO,MAAA,CAAO,KAAA,CAAMC,IAAC,CAAC,IACtCD,gCAAA,CAAgBC,IAAA,CAAE,MAAA,CAAO,EAAE,CAAC,CAAA;AAAA,YAChC,QAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,GACnBD,gCAAA,CAAgB,OAAO,MAAA,CAAO,MAAA,CAAOC,IAAC,CAAC,IACvCD,gCAAA,CAAgBC,IAAA,CAAE,MAAA,CAAO,EAAE,CAAC;AAAA;AAClC,SACF,CAAE;AAAA,OACH,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,iDAAA;AAAA,MACA,OAAO,KAAK,GAAA,KAAQ;AAClB,QAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AACvD,QAAA,IAAI,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC9C,UAAA,MAAM,IAAIC,sBAAA;AAAA,YACR,CAAA,+EAAA;AAAA,WACF;AAAA,QACF;AAEA,QAAA,MAAM,SAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,CAAI,OAAO,QAAQ,CAAA;AAEnD,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAIC,oBAAA,CAAc,CAAA,QAAA,EAAW,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,WAAA,CAAa,CAAA;AAAA,QACrE;AAEA,QAAA,IAAI,OAAO,oBAAA,EAAsB;AAC/B,UAAA,MAAM,CAAC,QAAQ,CAAA,GAAI,MAAM,KAAK,WAAA,CAAY,SAAA;AAAA,YACxC,CAAC,EAAE,UAAA,EAAY,MAAA,CAAO,sBAAsB,CAAA;AAAA,YAC5C,EAAE,WAAA;AAAY,WAChB;AACA,UAAA,IAAI,QAAA,CAAS,MAAA,KAAWC,sCAAA,CAAgB,KAAA,EAAO;AAC7C,YAAA,MAAM,IAAID,oBAAA;AAAA,cACR,CAAA,QAAA,EAAW,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,WAAA;AAAA,aAChC;AAAA,UACF;AAAA,QACF;AAEA,QAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,GACzB,MAAA,CAAO,OAAO,KAAA,CAAMF,IAAC,CAAA,CAAE,SAAA,CAAU,IAAI,IAAI,CAAA,GACxC,EAAE,OAAA,EAAS,IAAA,EAAM,MAAM,MAAA,EAAU;AAEtC,QAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,UAAA,MAAM,IAAII,iBAAA;AAAA,YACR,CAAA,yBAAA,EAA4B,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA;AAAA,YAC/C,KAAA,CAAM;AAAA,WACR;AAAA,QACF;AAEA,QAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,UACjC,OAAO,KAAA,CAAM,IAAA;AAAA,UACb,WAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAED,QAAA,MAAM,SAAS,MAAA,CAAO,MAAA,EAAQ,SAC1B,MAAA,CAAO,MAAA,CAAO,OAAOJ,IAAC,CAAA,CAAE,SAAA,CAAU,MAAA,EAAQ,MAAM,CAAA,GAC/C,EAAE,SAAS,IAAA,EAAM,IAAA,EAAM,QAAQ,MAAA,EAAO;AAE3C,QAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,UAAA,MAAM,IAAII,iBAAA;AAAA,YACR,CAAA,4BAAA,EAA+B,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA;AAAA,YAClD,MAAA,CAAO;AAAA,WACT;AAAA,QACF;AAEA,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAM,CAAA;AAAA,MAClC;AAAA,KACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,SAGE,OAAA,EAA0E;AAC1E,IAAA,MAAM,EAAA,GAAK,GAAG,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,CAAA,EAAI,QAAQ,IAAI,CAAA,CAAA;AAEnD,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,EAAE,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,EAAE,CAAA,uBAAA,CAAyB,CAAA;AAAA,IAChE;AAEA,IAAA,IAAI,QAAQ,oBAAA,EAAsB;AAChC,MAAA,IAAA,CAAK,mBAAA,CAAoB,cAAA,CAAe,CAAC,OAAA,CAAQ,oBAAoB,CAAC,CAAA;AAAA,IACxE;AAEA,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,EAAA,EAAI,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAc,mBAAA,CACZ,OAAA,EACA,WAAA,EACwB;AACxB,IAAA,MAAM,sBAAsB,OAAA,CAAQ,MAAA;AAAA,MAClC,CAAC,CAAC,CAAA,EAAG,MAAM,MAAM,MAAA,CAAO;AAAA,KAC1B;AAEA,IAAA,IAAI,mBAAA,CAAoB,WAAW,CAAA,EAAG;AACpC,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,WAAA,CAAY,SAAA;AAAA,MACvC,oBAAoB,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,MAAM,CAAA,MAAO;AAAA,QACxC,YAAY,MAAA,CAAO;AAAA,OACrB,CAAE,CAAA;AAAA,MACF,EAAE,WAAA;AAAY,KAChB;AAEA,IAAA,MAAM,YAAY,IAAI,GAAA;AAAA,MACpB,oBACG,MAAA,CAAO,CAAC,CAAA,EAAG,KAAA,KAAU,UAAU,KAAK,CAAA,CAAE,MAAA,KAAWD,sCAAA,CAAgB,KAAK,CAAA,CACtE,GAAA,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AAAA,KACrB;AAEA,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAC,EAAE,MAAM,CAAC,SAAA,CAAU,GAAA,CAAI,EAAE,CAAC,CAAA;AAAA,EACpD;AACF;;;;"}
+{"version":3,"file":"DefaultActionsRegistryService.cjs.js","sources":["../../../../src/alpha/entrypoints/actionsRegistry/DefaultActionsRegistryService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  HttpAuthService,\n  LoggerService,\n  PermissionsRegistryService,\n  PermissionsService,\n  PluginMetadataService,\n} from '@backstage/backend-plugin-api';\nimport PromiseRouter from 'express-promise-router';\nimport { Router, json } from 'express';\nimport { z, AnyZodObject } from 'zod/v3';\nimport zodToJsonSchema from 'zod-to-json-schema';\nimport {\n  ActionsRegistryActionOptions,\n  ActionsRegistryService,\n} from '@backstage/backend-plugin-api/alpha';\nimport { InputError, NotAllowedError, NotFoundError } from '@backstage/errors';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\n\ntype ActionEntry = [string, ActionsRegistryActionOptions<any, any>];\n\nexport class DefaultActionsRegistryService implements ActionsRegistryService {\n  private actions: Map<string, ActionsRegistryActionOptions<any, any>> =\n    new Map();\n\n  private readonly logger: LoggerService;\n  private readonly httpAuth: HttpAuthService;\n  private readonly auth: AuthService;\n  private readonly metadata: PluginMetadataService;\n  private readonly permissions: PermissionsService;\n  private readonly permissionsRegistry: PermissionsRegistryService;\n\n  private constructor(\n    logger: LoggerService,\n    httpAuth: HttpAuthService,\n    auth: AuthService,\n    metadata: PluginMetadataService,\n    permissions: PermissionsService,\n    permissionsRegistry: PermissionsRegistryService,\n  ) {\n    this.logger = logger;\n    this.httpAuth = httpAuth;\n    this.auth = auth;\n    this.metadata = metadata;\n    this.permissions = permissions;\n    this.permissionsRegistry = permissionsRegistry;\n  }\n\n  static create({\n    httpAuth,\n    logger,\n    auth,\n    metadata,\n    permissions,\n    permissionsRegistry,\n  }: {\n    httpAuth: HttpAuthService;\n    logger: LoggerService;\n    auth: AuthService;\n    metadata: PluginMetadataService;\n    permissions: PermissionsService;\n    permissionsRegistry: PermissionsRegistryService;\n  }): DefaultActionsRegistryService {\n    return new DefaultActionsRegistryService(\n      logger,\n      httpAuth,\n      auth,\n      metadata,\n      permissions,\n      permissionsRegistry,\n    );\n  }\n\n  createRouter(): Router {\n    const router = PromiseRouter();\n    router.use(json());\n\n    router.get('/.backstage/actions/v1/actions', async (req, res) => {\n      const credentials = await this.httpAuth.credentials(req);\n      const entries = Array.from(this.actions.entries());\n\n      const allowedActions = await this.filterByPermissions(\n        entries,\n        credentials,\n      );\n\n      return res.json({\n        actions: allowedActions.map(([id, action]) => ({\n          id,\n          name: action.name,\n          title: action.title,\n          description: action.description,\n          pluginId: this.metadata.getId(),\n          attributes: {\n            // Inspired by the @modelcontextprotocol/sdk defaults for the hints.\n            // https://github.com/modelcontextprotocol/typescript-sdk/blob/dd69efa1de8646bb6b195ff8d5f52e13739f4550/src/types.ts#L777-L812\n            destructive: action.attributes?.destructive ?? true,\n            idempotent: action.attributes?.idempotent ?? false,\n            readOnly: action.attributes?.readOnly ?? false,\n          },\n          schema: {\n            input: action.schema?.input\n              ? zodToJsonSchema(action.schema.input(z))\n              : zodToJsonSchema(z.object({})),\n            output: action.schema?.output\n              ? zodToJsonSchema(action.schema.output(z))\n              : zodToJsonSchema(z.object({})),\n          },\n        })),\n      });\n    });\n\n    router.post(\n      '/.backstage/actions/v1/actions/:actionId/invoke',\n      async (req, res) => {\n        const credentials = await this.httpAuth.credentials(req);\n        if (this.auth.isPrincipal(credentials, 'none')) {\n          throw new NotAllowedError(\n            `Actions must be invoked by an authenticated principal, not an anonymous request`,\n          );\n        }\n\n        const action = this.actions.get(req.params.actionId);\n\n        if (!action) {\n          throw new NotFoundError(`Action \"${req.params.actionId}\" not found`);\n        }\n\n        if (action.visibilityPermission) {\n          const [decision] = await this.permissions.authorize(\n            [{ permission: action.visibilityPermission }],\n            { credentials },\n          );\n          if (decision.result !== AuthorizeResult.ALLOW) {\n            throw new NotFoundError(\n              `Action \"${req.params.actionId}\" not found`,\n            );\n          }\n        }\n\n        const input = action.schema?.input\n          ? action.schema.input(z).safeParse(req.body)\n          : ({ success: true, data: undefined } as const);\n\n        if (!input.success) {\n          throw new InputError(\n            `Invalid input to action \"${req.params.actionId}\"`,\n            input.error,\n          );\n        }\n\n        const result = await action.action({\n          input: input.data,\n          credentials,\n          logger: this.logger,\n        });\n\n        const output = action.schema?.output\n          ? action.schema.output(z).safeParse(result?.output)\n          : ({ success: true, data: result?.output } as const);\n\n        if (!output.success) {\n          throw new InputError(\n            `Invalid output from action \"${req.params.actionId}\"`,\n            output.error,\n          );\n        }\n\n        res.json({ output: output.data });\n      },\n    );\n    return router;\n  }\n\n  register<\n    TInputSchema extends AnyZodObject,\n    TOutputSchema extends AnyZodObject,\n  >(options: ActionsRegistryActionOptions<TInputSchema, TOutputSchema>): void {\n    const id = `${this.metadata.getId()}:${options.name}`;\n\n    if (this.actions.has(id)) {\n      throw new Error(`Action with id \"${id}\" is already registered`);\n    }\n\n    if (options.visibilityPermission) {\n      this.permissionsRegistry.addPermissions([options.visibilityPermission]);\n    }\n\n    this.actions.set(id, options);\n  }\n\n  private async filterByPermissions(\n    entries: ActionEntry[],\n    credentials: BackstageCredentials,\n  ): Promise<ActionEntry[]> {\n    const permissionedEntries = entries.filter(\n      ([_, action]) => action.visibilityPermission,\n    );\n\n    if (permissionedEntries.length === 0) {\n      return entries;\n    }\n\n    const decisions = await this.permissions.authorize(\n      permissionedEntries.map(([_, action]) => ({\n        permission: action.visibilityPermission!,\n      })),\n      { credentials },\n    );\n\n    const deniedIds = new Set(\n      permissionedEntries\n        .filter((_, index) => decisions[index].result !== AuthorizeResult.ALLOW)\n        .map(([id]) => id),\n    );\n\n    return entries.filter(([id]) => !deniedIds.has(id));\n  }\n}\n"],"names":["PromiseRouter","json","zodToJsonSchema","z","NotAllowedError","NotFoundError","AuthorizeResult","InputError"],"mappings":";;;;;;;;;;;;;;AAsCO,MAAM,6BAAA,CAAgE;AAAA,EACnE,OAAA,uBACF,GAAA,EAAI;AAAA,EAEO,MAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,mBAAA;AAAA,EAET,YACN,MAAA,EACA,QAAA,EACA,IAAA,EACA,QAAA,EACA,aACA,mBAAA,EACA;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,mBAAA,GAAsB,mBAAA;AAAA,EAC7B;AAAA,EAEA,OAAO,MAAA,CAAO;AAAA,IACZ,QAAA;AAAA,IACA,MAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,EAOkC;AAChC,IAAA,OAAO,IAAI,6BAAA;AAAA,MACT,MAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA;AAAA,MACA,QAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,YAAA,GAAuB;AACrB,IAAA,MAAM,SAASA,uBAAA,EAAc;AAC7B,IAAA,MAAA,CAAO,GAAA,CAAIC,cAAM,CAAA;AAEjB,IAAA,MAAA,CAAO,GAAA,CAAI,gCAAA,EAAkC,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC/D,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AACvD,MAAA,MAAM,UAAU,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA;AAEjD,MAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA;AAAA,QAChC,OAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,OAAO,IAAI,IAAA,CAAK;AAAA,QACd,SAAS,cAAA,CAAe,GAAA,CAAI,CAAC,CAAC,EAAA,EAAI,MAAM,CAAA,MAAO;AAAA,UAC7C,EAAA;AAAA,UACA,MAAM,MAAA,CAAO,IAAA;AAAA,UACb,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,QAAA,EAAU,IAAA,CAAK,QAAA,CAAS,KAAA,EAAM;AAAA,UAC9B,UAAA,EAAY;AAAA;AAAA;AAAA,YAGV,WAAA,EAAa,MAAA,CAAO,UAAA,EAAY,WAAA,IAAe,IAAA;AAAA,YAC/C,UAAA,EAAY,MAAA,CAAO,UAAA,EAAY,UAAA,IAAc,KAAA;AAAA,YAC7C,QAAA,EAAU,MAAA,CAAO,UAAA,EAAY,QAAA,IAAY;AAAA,WAC3C;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,OAAO,MAAA,CAAO,MAAA,EAAQ,KAAA,GAClBC,gCAAA,CAAgB,OAAO,MAAA,CAAO,KAAA,CAAMC,IAAC,CAAC,IACtCD,gCAAA,CAAgBC,IAAA,CAAE,MAAA,CAAO,EAAE,CAAC,CAAA;AAAA,YAChC,QAAQ,MAAA,CAAO,MAAA,EAAQ,MAAA,GACnBD,gCAAA,CAAgB,OAAO,MAAA,CAAO,MAAA,CAAOC,IAAC,CAAC,IACvCD,gCAAA,CAAgBC,IAAA,CAAE,MAAA,CAAO,EAAE,CAAC;AAAA;AAClC,SACF,CAAE;AAAA,OACH,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,iDAAA;AAAA,MACA,OAAO,KAAK,GAAA,KAAQ;AAClB,QAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AACvD,QAAA,IAAI,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC9C,UAAA,MAAM,IAAIC,sBAAA;AAAA,YACR,CAAA,+EAAA;AAAA,WACF;AAAA,QACF;AAEA,QAAA,MAAM,SAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,CAAI,OAAO,QAAQ,CAAA;AAEnD,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAIC,oBAAA,CAAc,CAAA,QAAA,EAAW,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,WAAA,CAAa,CAAA;AAAA,QACrE;AAEA,QAAA,IAAI,OAAO,oBAAA,EAAsB;AAC/B,UAAA,MAAM,CAAC,QAAQ,CAAA,GAAI,MAAM,KAAK,WAAA,CAAY,SAAA;AAAA,YACxC,CAAC,EAAE,UAAA,EAAY,MAAA,CAAO,sBAAsB,CAAA;AAAA,YAC5C,EAAE,WAAA;AAAY,WAChB;AACA,UAAA,IAAI,QAAA,CAAS,MAAA,KAAWC,sCAAA,CAAgB,KAAA,EAAO;AAC7C,YAAA,MAAM,IAAID,oBAAA;AAAA,cACR,CAAA,QAAA,EAAW,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,WAAA;AAAA,aAChC;AAAA,UACF;AAAA,QACF;AAEA,QAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,GACzB,MAAA,CAAO,OAAO,KAAA,CAAMF,IAAC,CAAA,CAAE,SAAA,CAAU,IAAI,IAAI,CAAA,GACxC,EAAE,OAAA,EAAS,IAAA,EAAM,MAAM,MAAA,EAAU;AAEtC,QAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,UAAA,MAAM,IAAII,iBAAA;AAAA,YACR,CAAA,yBAAA,EAA4B,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA;AAAA,YAC/C,KAAA,CAAM;AAAA,WACR;AAAA,QACF;AAEA,QAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,UACjC,OAAO,KAAA,CAAM,IAAA;AAAA,UACb,WAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAED,QAAA,MAAM,SAAS,MAAA,CAAO,MAAA,EAAQ,SAC1B,MAAA,CAAO,MAAA,CAAO,OAAOJ,IAAC,CAAA,CAAE,SAAA,CAAU,MAAA,EAAQ,MAAM,CAAA,GAC/C,EAAE,SAAS,IAAA,EAAM,IAAA,EAAM,QAAQ,MAAA,EAAO;AAE3C,QAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,UAAA,MAAM,IAAII,iBAAA;AAAA,YACR,CAAA,4BAAA,EAA+B,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA;AAAA,YAClD,MAAA,CAAO;AAAA,WACT;AAAA,QACF;AAEA,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAM,CAAA;AAAA,MAClC;AAAA,KACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,SAGE,OAAA,EAA0E;AAC1E,IAAA,MAAM,EAAA,GAAK,GAAG,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,CAAA,EAAI,QAAQ,IAAI,CAAA,CAAA;AAEnD,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,EAAE,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,EAAE,CAAA,uBAAA,CAAyB,CAAA;AAAA,IAChE;AAEA,IAAA,IAAI,QAAQ,oBAAA,EAAsB;AAChC,MAAA,IAAA,CAAK,mBAAA,CAAoB,cAAA,CAAe,CAAC,OAAA,CAAQ,oBAAoB,CAAC,CAAA;AAAA,IACxE;AAEA,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,EAAA,EAAI,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAc,mBAAA,CACZ,OAAA,EACA,WAAA,EACwB;AACxB,IAAA,MAAM,sBAAsB,OAAA,CAAQ,MAAA;AAAA,MAClC,CAAC,CAAC,CAAA,EAAG,MAAM,MAAM,MAAA,CAAO;AAAA,KAC1B;AAEA,IAAA,IAAI,mBAAA,CAAoB,WAAW,CAAA,EAAG;AACpC,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,WAAA,CAAY,SAAA;AAAA,MACvC,oBAAoB,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,MAAM,CAAA,MAAO;AAAA,QACxC,YAAY,MAAA,CAAO;AAAA,OACrB,CAAE,CAAA;AAAA,MACF,EAAE,WAAA;AAAY,KAChB;AAEA,IAAA,MAAM,YAAY,IAAI,GAAA;AAAA,MACpB,oBACG,MAAA,CAAO,CAAC,CAAA,EAAG,KAAA,KAAU,UAAU,KAAK,CAAA,CAAE,MAAA,KAAWD,sCAAA,CAAgB,KAAK,CAAA,CACtE,GAAA,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE;AAAA,KACrB;AAEA,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAC,EAAE,MAAM,CAAC,SAAA,CAAU,GAAA,CAAI,EAAE,CAAC,CAAA;AAAA,EACpD;AACF;;;;"}

package/dist/entrypoints/auditor/types.cjs.js

@@ -0,0 +1,13 @@
+'use strict';
+
+var v3 = require('zod/v3');
+
+const severityLogLevelMappingsSchema = v3.z.record(
+  v3.z.enum(["low", "medium", "high", "critical"]),
+  v3.z.enum(["debug", "info", "warn", "error"])
+);
+const CONFIG_ROOT_KEY = "backend.auditor";
+
+exports.CONFIG_ROOT_KEY = CONFIG_ROOT_KEY;
+exports.severityLogLevelMappingsSchema = severityLogLevelMappingsSchema;
+//# sourceMappingURL=types.cjs.js.map

package/dist/entrypoints/auditor/types.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.cjs.js","sources":["../../../src/entrypoints/auditor/types.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { z } from 'zod/v3';\n\n/** @internal */\nexport const severityLogLevelMappingsSchema = z.record(\n  z.enum(['low', 'medium', 'high', 'critical']),\n  z.enum(['debug', 'info', 'warn', 'error']),\n);\n\n/** @internal */\nexport const CONFIG_ROOT_KEY = 'backend.auditor';\n"],"names":["z"],"mappings":";;;;AAmBO,MAAM,iCAAiCA,IAAA,CAAE,MAAA;AAAA,EAC9CA,KAAE,IAAA,CAAK,CAAC,OAAO,QAAA,EAAU,MAAA,EAAQ,UAAU,CAAC,CAAA;AAAA,EAC5CA,KAAE,IAAA,CAAK,CAAC,SAAS,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC;AAC3C;AAGO,MAAM,eAAA,GAAkB;;;;;"}

package/dist/entrypoints/auditor/utils.cjs.js

@@ -1,38 +1,30 @@
 'use strict';
 
 var errors = require('@backstage/errors');
-var v4 = require('zod/v4');
+var types = require('./types.cjs.js');
 
-const CONFIG_ROOT_KEY = "backend.auditor";
-const logLevel = v4.z.enum(["debug", "info", "warn", "error"]);
-const severityLogLevelMappingsSchema = v4.z.object({
-  low: logLevel.default("debug"),
-  medium: logLevel.default("info"),
-  high: logLevel.default("info"),
-  critical: logLevel.default("info")
-});
 function getSeverityLogLevelMappings(config) {
-  const auditorConfig = config.getOptionalConfig(CONFIG_ROOT_KEY);
-  const input = {
-    low: auditorConfig?.getOptionalString("severityLogLevelMappings.low"),
-    medium: auditorConfig?.getOptionalString("severityLogLevelMappings.medium"),
-    high: auditorConfig?.getOptionalString("severityLogLevelMappings.high"),
-    critical: auditorConfig?.getOptionalString(
-      "severityLogLevelMappings.critical"
-    )
+  const auditorConfig = config.getOptionalConfig(types.CONFIG_ROOT_KEY);
+  const severityLogLevelMappings = {
+    low: auditorConfig?.getOptionalString("severityLogLevelMappings.low") ?? "debug",
+    medium: auditorConfig?.getOptionalString("severityLogLevelMappings.medium") ?? "info",
+    high: auditorConfig?.getOptionalString("severityLogLevelMappings.high") ?? "info",
+    critical: auditorConfig?.getOptionalString("severityLogLevelMappings.critical") ?? "info"
   };
-  const parsed = severityLogLevelMappingsSchema.safeParse(input);
-  if (!parsed.success) {
-    const issue = parsed.error.issues[0];
-    const key = issue.path[0];
-    const receivedValue = input[key];
+  const res = types.severityLogLevelMappingsSchema.safeParse(
+    severityLogLevelMappings
+  );
+  if (!res.success) {
+    const key = res.error.issues.at(0)?.path.at(0);
+    const value = res.error.issues.at(0).received;
+    const validKeys = res.error.issues.at(0).options;
     throw new errors.InputError(
-      `The configuration value for '${CONFIG_ROOT_KEY}.severityLogLevelMappings.${key}' was given an invalid value: '${receivedValue}'. Expected one of the following valid values: '${logLevel.options.join(
+      `The configuration value for 'backend.auditor.severityLogLevelMappings.${key}' was given an invalid value: '${value}'. Expected one of the following valid values: '${validKeys.join(
         ", "
       )}'.`
     );
   }
-  return parsed.data;
+  return severityLogLevelMappings;
 }
 
 exports.getSeverityLogLevelMappings = getSeverityLogLevelMappings;

package/dist/entrypoints/auditor/utils.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.cjs.js","sources":["../../../src/entrypoints/auditor/utils.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { z } from 'zod/v4';\n\nconst CONFIG_ROOT_KEY = 'backend.auditor';\n\nconst logLevel = z.enum(['debug', 'info', 'warn', 'error']);\n\nconst severityLogLevelMappingsSchema = z.object({\n  low: logLevel.default('debug'),\n  medium: logLevel.default('info'),\n  high: logLevel.default('info'),\n  critical: logLevel.default('info'),\n});\n\ntype SeverityLogLevelMappings = z.infer<typeof severityLogLevelMappingsSchema>;\n\n/**\n * Gets the `backend.auditor.severityLogLevelMappings` configuration.\n *\n * @param config - The root Backstage {@link @backstage/config#Config} object.\n * @returns The validated severity-to-log-level mappings.\n * @throws error - {@link @backstage/errors#InputError} if the mapping configuration is invalid.\n */\nexport function getSeverityLogLevelMappings(\n  config: Config,\n): SeverityLogLevelMappings {\n  const auditorConfig = config.getOptionalConfig(CONFIG_ROOT_KEY);\n\n  const input = {\n    low: auditorConfig?.getOptionalString('severityLogLevelMappings.low'),\n    medium: auditorConfig?.getOptionalString('severityLogLevelMappings.medium'),\n    high: auditorConfig?.getOptionalString('severityLogLevelMappings.high'),\n    critical: auditorConfig?.getOptionalString(\n      'severityLogLevelMappings.critical',\n    ),\n  };\n\n  const parsed = severityLogLevelMappingsSchema.safeParse(input);\n\n  if (!parsed.success) {\n    const issue = parsed.error.issues[0];\n    const key = issue.path[0] as keyof typeof input;\n    const receivedValue = input[key];\n    throw new InputError(\n      `The configuration value for '${CONFIG_ROOT_KEY}.severityLogLevelMappings.${key}' was given an invalid value: '${receivedValue}'. Expected one of the following valid values: '${logLevel.options.join(\n        ', ',\n      )}'.`,\n    );\n  }\n\n  return parsed.data;\n}\n"],"names":["z","InputError"],"mappings":";;;;;AAoBA,MAAM,eAAA,GAAkB,iBAAA;AAExB,MAAM,QAAA,GAAWA,KAAE,IAAA,CAAK,CAAC,SAAS,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAA;AAE1D,MAAM,8BAAA,GAAiCA,KAAE,MAAA,CAAO;AAAA,EAC9C,GAAA,EAAK,QAAA,CAAS,OAAA,CAAQ,OAAO,CAAA;AAAA,EAC7B,MAAA,EAAQ,QAAA,CAAS,OAAA,CAAQ,MAAM,CAAA;AAAA,EAC/B,IAAA,EAAM,QAAA,CAAS,OAAA,CAAQ,MAAM,CAAA;AAAA,EAC7B,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,MAAM;AACnC,CAAC,CAAA;AAWM,SAAS,4BACd,MAAA,EAC0B;AAC1B,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,iBAAA,CAAkB,eAAe,CAAA;AAE9D,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,GAAA,EAAK,aAAA,EAAe,iBAAA,CAAkB,8BAA8B,CAAA;AAAA,IACpE,MAAA,EAAQ,aAAA,EAAe,iBAAA,CAAkB,iCAAiC,CAAA;AAAA,IAC1E,IAAA,EAAM,aAAA,EAAe,iBAAA,CAAkB,+BAA+B,CAAA;AAAA,IACtE,UAAU,aAAA,EAAe,iBAAA;AAAA,MACvB;AAAA;AACF,GACF;AAEA,EAAA,MAAM,MAAA,GAAS,8BAAA,CAA+B,SAAA,CAAU,KAAK,CAAA;AAE7D,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AACnC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA;AACxB,IAAA,MAAM,aAAA,GAAgB,MAAM,GAAG,CAAA;AAC/B,IAAA,MAAM,IAAIC,iBAAA;AAAA,MACR,CAAA,6BAAA,EAAgC,eAAe,CAAA,0BAAA,EAA6B,GAAG,kCAAkC,aAAa,CAAA,gDAAA,EAAmD,SAAS,OAAA,CAAQ,IAAA;AAAA,QAChM;AAAA,OACD,CAAA,EAAA;AAAA,KACH;AAAA,EACF;AAEA,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;;;;"}
+{"version":3,"file":"utils.cjs.js","sources":["../../../src/entrypoints/auditor/utils.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { Config } from '@backstage/config';\nimport { InputError } from '@backstage/errors';\nimport { z } from 'zod/v3';\nimport { CONFIG_ROOT_KEY, severityLogLevelMappingsSchema } from './types';\n\n/**\n * Gets the `backend.auditor.severityLogLevelMappings` configuration.\n *\n * @param config - The root Backstage {@link @backstage/config#Config} object.\n * @returns The validated severity-to-log-level mappings.\n * @throws error - {@link @backstage/errors#InputError} if the mapping configuration is invalid.\n */\nexport function getSeverityLogLevelMappings(config: Config) {\n  const auditorConfig = config.getOptionalConfig(CONFIG_ROOT_KEY);\n\n  const severityLogLevelMappings = {\n    low:\n      auditorConfig?.getOptionalString('severityLogLevelMappings.low') ??\n      'debug',\n    medium:\n      auditorConfig?.getOptionalString('severityLogLevelMappings.medium') ??\n      'info',\n    high:\n      auditorConfig?.getOptionalString('severityLogLevelMappings.high') ??\n      'info',\n    critical:\n      auditorConfig?.getOptionalString('severityLogLevelMappings.critical') ??\n      'info',\n  } as Required<z.infer<typeof severityLogLevelMappingsSchema>>;\n\n  const res = severityLogLevelMappingsSchema.safeParse(\n    severityLogLevelMappings,\n  );\n  if (!res.success) {\n    const key = res.error.issues.at(0)?.path.at(0) as string;\n    const value = (\n      res.error.issues.at(0) as unknown as Record<PropertyKey, unknown>\n    ).received as string;\n    const validKeys = (\n      res.error.issues.at(0) as unknown as Record<PropertyKey, unknown>\n    ).options as string[];\n    throw new InputError(\n      `The configuration value for 'backend.auditor.severityLogLevelMappings.${key}' was given an invalid value: '${value}'. Expected one of the following valid values: '${validKeys.join(\n        ', ',\n      )}'.`,\n    );\n  }\n\n  return severityLogLevelMappings;\n}\n"],"names":["CONFIG_ROOT_KEY","severityLogLevelMappingsSchema","InputError"],"mappings":";;;;;AA4BO,SAAS,4BAA4B,MAAA,EAAgB;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,iBAAA,CAAkBA,qBAAe,CAAA;AAE9D,EAAA,MAAM,wBAAA,GAA2B;AAAA,IAC/B,GAAA,EACE,aAAA,EAAe,iBAAA,CAAkB,8BAA8B,CAAA,IAC/D,OAAA;AAAA,IACF,MAAA,EACE,aAAA,EAAe,iBAAA,CAAkB,iCAAiC,CAAA,IAClE,MAAA;AAAA,IACF,IAAA,EACE,aAAA,EAAe,iBAAA,CAAkB,+BAA+B,CAAA,IAChE,MAAA;AAAA,IACF,QAAA,EACE,aAAA,EAAe,iBAAA,CAAkB,mCAAmC,CAAA,IACpE;AAAA,GACJ;AAEA,EAAA,MAAM,MAAMC,oCAAA,CAA+B,SAAA;AAAA,IACzC;AAAA,GACF;AACA,EAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,IAAA,MAAM,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA,EAAG,IAAA,CAAK,EAAA,CAAG,CAAC,CAAA;AAC7C,IAAA,MAAM,QACJ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,EAAA,CAAG,CAAC,CAAA,CACrB,QAAA;AACF,IAAA,MAAM,YACJ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,EAAA,CAAG,CAAC,CAAA,CACrB,OAAA;AACF,IAAA,MAAM,IAAIC,iBAAA;AAAA,MACR,CAAA,sEAAA,EAAyE,GAAG,CAAA,+BAAA,EAAkC,KAAK,mDAAmD,SAAA,CAAU,IAAA;AAAA,QAC9K;AAAA,OACD,CAAA,EAAA;AAAA,KACH;AAAA,EACF;AAEA,EAAA,OAAO,wBAAA;AACT;;;;"}

package/dist/entrypoints/auth/DefaultAuthService.cjs.js

@@ -56,7 +56,8 @@ class DefaultAuthService {
       return helpers.createCredentialsWithServicePrincipal(
         externalResult.subject,
         void 0,
-        externalResult.accessRestrictions
+        externalResult.accessRestrictions,
+        externalResult.allAccessRestrictions
       );
     }
     throw new errors.AuthenticationError("Illegal token");
@@ -86,11 +87,26 @@ class DefaultAuthService {
     }
     switch (type) {
       // TODO: Check whether the principal is ourselves
-      case "service":
+      case "service": {
+        const servicePrincipal = internalForward.principal;
+        if (servicePrincipal.accessRestrictions) {
+          const targetRestrictions = internalForward.allAccessRestrictions?.get(targetPluginId);
+          if (!targetRestrictions) {
+            throw new errors.NotAllowedError(
+              `Access to target plugin '${targetPluginId}' is not included in token's access restrictions`
+            );
+          }
+          if (targetRestrictions.permissionNames?.length || targetRestrictions.permissionAttributes) {
+            throw new errors.NotAllowedError(
+              `Access to target plugin '${targetPluginId}' is restricted and cannot be delegated`
+            );
+          }
+        }
         return this.pluginTokenHandler.issueToken({
           pluginId: this.pluginId,
           targetPluginId
         });
+      }
       case "user": {
         const { token } = internalForward;
         if (!token) {

package/dist/entrypoints/auth/DefaultAuthService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultAuthService.cjs.js","sources":["../../../src/entrypoints/auth/DefaultAuthService.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalTypes,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { JsonObject } from '@backstage/types';\nimport { decodeJwt } from 'jose';\nimport { ExternalAuthTokenHandler } from './external/ExternalAuthTokenHandler';\nimport {\n  createCredentialsWithNonePrincipal,\n  createCredentialsWithServicePrincipal,\n  createCredentialsWithUserPrincipal,\n  toInternalBackstageCredentials,\n} from './helpers';\nimport { PluginTokenHandler } from './plugin/PluginTokenHandler';\nimport { PluginKeySource } from './plugin/keys/types';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/** @internal */\nexport class DefaultAuthService implements AuthService {\n  private readonly userTokenHandler: UserTokenHandler;\n  private readonly pluginTokenHandler: PluginTokenHandler;\n  private readonly externalTokenHandler: ExternalAuthTokenHandler;\n  private readonly pluginId: string;\n  private readonly disableDefaultAuthPolicy: boolean;\n  private readonly pluginKeySource: PluginKeySource;\n\n  constructor(\n    userTokenHandler: UserTokenHandler,\n    pluginTokenHandler: PluginTokenHandler,\n    externalTokenHandler: ExternalAuthTokenHandler,\n    pluginId: string,\n    disableDefaultAuthPolicy: boolean,\n    pluginKeySource: PluginKeySource,\n  ) {\n    this.userTokenHandler = userTokenHandler;\n    this.pluginTokenHandler = pluginTokenHandler;\n    this.externalTokenHandler = externalTokenHandler;\n    this.pluginId = pluginId;\n    this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;\n    this.pluginKeySource = pluginKeySource;\n  }\n\n  async authenticate(\n    token: string,\n    options?: {\n      allowLimitedAccess?: boolean;\n    },\n  ): Promise<BackstageCredentials> {\n    const pluginResult = await this.pluginTokenHandler.verifyToken(token);\n    if (pluginResult) {\n      if (pluginResult.limitedUserToken) {\n        const userResult = await this.userTokenHandler.verifyToken(\n          pluginResult.limitedUserToken,\n        );\n        if (!userResult) {\n          throw new AuthenticationError(\n            'Invalid user token in plugin token obo claim',\n          );\n        }\n        return createCredentialsWithUserPrincipal(\n          userResult.userEntityRef,\n          pluginResult.limitedUserToken,\n          this.#getJwtExpiration(pluginResult.limitedUserToken),\n          pluginResult.subject,\n        );\n      }\n      return createCredentialsWithServicePrincipal(pluginResult.subject);\n    }\n\n    const userResult = await this.userTokenHandler.verifyToken(token);\n    if (userResult) {\n      if (\n        !options?.allowLimitedAccess &&\n        this.userTokenHandler.isLimitedUserToken(token)\n      ) {\n        throw new AuthenticationError('Illegal limited user token');\n      }\n\n      return createCredentialsWithUserPrincipal(\n        userResult.userEntityRef,\n        token,\n        this.#getJwtExpiration(token),\n      );\n    }\n\n    const externalResult = await this.externalTokenHandler.verifyToken(token);\n    if (externalResult) {\n      return createCredentialsWithServicePrincipal(\n        externalResult.subject,\n        undefined,\n        externalResult.accessRestrictions,\n      );\n    }\n\n    throw new AuthenticationError('Illegal token');\n  }\n\n  isPrincipal<TType extends keyof BackstagePrincipalTypes>(\n    credentials: BackstageCredentials,\n    type: TType,\n  ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]> {\n    const principal = credentials.principal as\n      | BackstageUserPrincipal\n      | BackstageServicePrincipal;\n\n    if (type === 'unknown') {\n      return true;\n    }\n\n    if (principal.type !== type) {\n      return false;\n    }\n\n    return true;\n  }\n\n  async getNoneCredentials(): Promise<\n    BackstageCredentials<BackstageNonePrincipal>\n  > {\n    return createCredentialsWithNonePrincipal();\n  }\n\n  async getOwnServiceCredentials(): Promise<\n    BackstageCredentials<BackstageServicePrincipal>\n  > {\n    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);\n  }\n\n  async getPluginRequestToken(options: {\n    onBehalfOf: BackstageCredentials;\n    targetPluginId: string;\n  }): Promise<{ token: string }> {\n    const { targetPluginId } = options;\n    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);\n    const { type } = internalForward.principal;\n\n    // Since disabling the default policy means we'll be allowing\n    // unauthenticated requests through, we might have unauthenticated\n    // credentials from service calls that reach this point. If that's the case,\n    // we'll want to keep \"forwarding\" the unauthenticated credentials, which we\n    // do by returning an empty token.\n    if (type === 'none' && this.disableDefaultAuthPolicy) {\n      return { token: '' };\n    }\n\n    // check whether a plugin support the new auth system\n    // by checking the public keys endpoint existence.\n    switch (type) {\n      // TODO: Check whether the principal is ourselves\n      case 'service':\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n        });\n      case 'user': {\n        const { token } = internalForward;\n        if (!token) {\n          throw new Error('User credentials is unexpectedly missing token');\n        }\n        const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(\n          token,\n        );\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n          onBehalfOf: {\n            limitedUserToken: onBehalfOf.token,\n            expiresAt: onBehalfOf.expiresAt,\n          },\n        });\n      }\n      default:\n        throw new AuthenticationError(\n          `Refused to issue service token for credential type '${type}'`,\n        );\n    }\n  }\n\n  async getLimitedUserToken(\n    credentials: BackstageCredentials<BackstageUserPrincipal>,\n  ): Promise<{ token: string; expiresAt: Date }> {\n    const { token: backstageToken } =\n      toInternalBackstageCredentials(credentials);\n    if (!backstageToken) {\n      throw new AuthenticationError(\n        'User credentials is unexpectedly missing token',\n      );\n    }\n\n    return this.userTokenHandler.createLimitedUserToken(backstageToken);\n  }\n\n  async listPublicServiceKeys(): Promise<{ keys: JsonObject[] }> {\n    const { keys } = await this.pluginKeySource.listKeys();\n    return { keys: keys.map(({ key }) => key) };\n  }\n\n  #getJwtExpiration(token: string) {\n    const { exp } = decodeJwt(token);\n    if (!exp) {\n      throw new AuthenticationError('User token is missing expiration');\n    }\n    return new Date(exp * 1000);\n  }\n}\n"],"names":["userResult","AuthenticationError","createCredentialsWithUserPrincipal","createCredentialsWithServicePrincipal","createCredentialsWithNonePrincipal","toInternalBackstageCredentials","decodeJwt"],"mappings":";;;;;;AAuCO,MAAM,kBAAA,CAA0C;AAAA,EACpC,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,oBAAA;AAAA,EACA,QAAA;AAAA,EACA,wBAAA;AAAA,EACA,eAAA;AAAA,EAEjB,YACE,gBAAA,EACA,kBAAA,EACA,oBAAA,EACA,QAAA,EACA,0BACA,eAAA,EACA;AACA,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AACxB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAC1B,IAAA,IAAA,CAAK,oBAAA,GAAuB,oBAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,wBAAA,GAA2B,wBAAA;AAChC,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,EACA,OAAA,EAG+B;AAC/B,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,kBAAA,CAAmB,YAAY,KAAK,CAAA;AACpE,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,IAAI,aAAa,gBAAA,EAAkB;AACjC,QAAA,MAAMA,WAAAA,GAAa,MAAM,IAAA,CAAK,gBAAA,CAAiB,WAAA;AAAA,UAC7C,YAAA,CAAa;AAAA,SACf;AACA,QAAA,IAAI,CAACA,WAAAA,EAAY;AACf,UAAA,MAAM,IAAIC,0BAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AACA,QAAA,OAAOC,0CAAA;AAAA,UACLF,WAAAA,CAAW,aAAA;AAAA,UACX,YAAA,CAAa,gBAAA;AAAA,UACb,IAAA,CAAK,iBAAA,CAAkB,YAAA,CAAa,gBAAgB,CAAA;AAAA,UACpD,YAAA,CAAa;AAAA,SACf;AAAA,MACF;AACA,MAAA,OAAOG,6CAAA,CAAsC,aAAa,OAAO,CAAA;AAAA,IACnE;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAA,CAAiB,YAAY,KAAK,CAAA;AAChE,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IACE,CAAC,OAAA,EAAS,kBAAA,IACV,KAAK,gBAAA,CAAiB,kBAAA,CAAmB,KAAK,CAAA,EAC9C;AACA,QAAA,MAAM,IAAIF,2BAAoB,4BAA4B,CAAA;AAAA,MAC5D;AAEA,MAAA,OAAOC,0CAAA;AAAA,QACL,UAAA,CAAW,aAAA;AAAA,QACX,KAAA;AAAA,QACA,IAAA,CAAK,kBAAkB,KAAK;AAAA,OAC9B;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,oBAAA,CAAqB,YAAY,KAAK,CAAA;AACxE,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAOC,6CAAA;AAAA,QACL,cAAA,CAAe,OAAA;AAAA,QACf,MAAA;AAAA,QACA,cAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,MAAM,IAAIF,2BAAoB,eAAe,CAAA;AAAA,EAC/C;AAAA,EAEA,WAAA,CACE,aACA,IAAA,EACqE;AACrE,IAAA,MAAM,YAAY,WAAA,CAAY,SAAA;AAI9B,IAAA,IAAI,SAAS,SAAA,EAAW;AACtB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,SAAA,CAAU,SAAS,IAAA,EAAM;AAC3B,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,kBAAA,GAEJ;AACA,IAAA,OAAOG,0CAAA,EAAmC;AAAA,EAC5C;AAAA,EAEA,MAAM,wBAAA,GAEJ;AACA,IAAA,OAAOD,6CAAA,CAAsC,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,EACxE;AAAA,EAEA,MAAM,sBAAsB,OAAA,EAGG;AAC7B,IAAA,MAAM,EAAE,gBAAe,GAAI,OAAA;AAC3B,IAAA,MAAM,eAAA,GAAkBE,sCAAA,CAA+B,OAAA,CAAQ,UAAU,CAAA;AACzE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,eAAA,CAAgB,SAAA;AAOjC,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,wBAAA,EAA0B;AACpD,MAAA,OAAO,EAAE,OAAO,EAAA,EAAG;AAAA,IACrB;AAIA,IAAA,QAAQ,IAAA;AAAM;AAAA,MAEZ,KAAK,SAAA;AACH,QAAA,OAAO,IAAA,CAAK,mBAAmB,UAAA,CAAW;AAAA,UACxC,UAAU,IAAA,CAAK,QAAA;AAAA,UACf;AAAA,SACD,CAAA;AAAA,MACH,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,EAAE,OAAM,GAAI,eAAA;AAClB,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,QAClE;AACA,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAA,CAAiB,sBAAA;AAAA,UAC7C;AAAA,SACF;AACA,QAAA,OAAO,IAAA,CAAK,mBAAmB,UAAA,CAAW;AAAA,UACxC,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,cAAA;AAAA,UACA,UAAA,EAAY;AAAA,YACV,kBAAkB,UAAA,CAAW,KAAA;AAAA,YAC7B,WAAW,UAAA,CAAW;AAAA;AACxB,SACD,CAAA;AAAA,MACH;AAAA,MACA;AACE,QAAA,MAAM,IAAIJ,0BAAA;AAAA,UACR,uDAAuD,IAAI,CAAA,CAAA;AAAA,SAC7D;AAAA;AACJ,EACF;AAAA,EAEA,MAAM,oBACJ,WAAA,EAC6C;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAO,cAAA,EAAe,GAC5BI,uCAA+B,WAAW,CAAA;AAC5C,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,sBAAA,CAAuB,cAAc,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,qBAAA,GAAyD;AAC7D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,gBAAgB,QAAA,EAAS;AACrD,IAAA,OAAO,EAAE,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,EAAE,GAAA,EAAI,KAAM,GAAG,CAAA,EAAE;AAAA,EAC5C;AAAA,EAEA,kBAAkB,KAAA,EAAe;AAC/B,IAAA,MAAM,EAAE,GAAA,EAAI,GAAIK,cAAA,CAAU,KAAK,CAAA;AAC/B,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAIL,2BAAoB,kCAAkC,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,IAAI,IAAA,CAAK,GAAA,GAAM,GAAI,CAAA;AAAA,EAC5B;AACF;;;;"}
+{"version":3,"file":"DefaultAuthService.cjs.js","sources":["../../../src/entrypoints/auth/DefaultAuthService.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalTypes,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError, NotAllowedError } from '@backstage/errors';\nimport { JsonObject } from '@backstage/types';\nimport { decodeJwt } from 'jose';\nimport { ExternalAuthTokenHandler } from './external/ExternalAuthTokenHandler';\nimport {\n  createCredentialsWithNonePrincipal,\n  createCredentialsWithServicePrincipal,\n  createCredentialsWithUserPrincipal,\n  toInternalBackstageCredentials,\n} from './helpers';\nimport { PluginTokenHandler } from './plugin/PluginTokenHandler';\nimport { PluginKeySource } from './plugin/keys/types';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/** @internal */\nexport class DefaultAuthService implements AuthService {\n  private readonly userTokenHandler: UserTokenHandler;\n  private readonly pluginTokenHandler: PluginTokenHandler;\n  private readonly externalTokenHandler: ExternalAuthTokenHandler;\n  private readonly pluginId: string;\n  private readonly disableDefaultAuthPolicy: boolean;\n  private readonly pluginKeySource: PluginKeySource;\n\n  constructor(\n    userTokenHandler: UserTokenHandler,\n    pluginTokenHandler: PluginTokenHandler,\n    externalTokenHandler: ExternalAuthTokenHandler,\n    pluginId: string,\n    disableDefaultAuthPolicy: boolean,\n    pluginKeySource: PluginKeySource,\n  ) {\n    this.userTokenHandler = userTokenHandler;\n    this.pluginTokenHandler = pluginTokenHandler;\n    this.externalTokenHandler = externalTokenHandler;\n    this.pluginId = pluginId;\n    this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;\n    this.pluginKeySource = pluginKeySource;\n  }\n\n  async authenticate(\n    token: string,\n    options?: {\n      allowLimitedAccess?: boolean;\n    },\n  ): Promise<BackstageCredentials> {\n    const pluginResult = await this.pluginTokenHandler.verifyToken(token);\n    if (pluginResult) {\n      if (pluginResult.limitedUserToken) {\n        const userResult = await this.userTokenHandler.verifyToken(\n          pluginResult.limitedUserToken,\n        );\n        if (!userResult) {\n          throw new AuthenticationError(\n            'Invalid user token in plugin token obo claim',\n          );\n        }\n        return createCredentialsWithUserPrincipal(\n          userResult.userEntityRef,\n          pluginResult.limitedUserToken,\n          this.#getJwtExpiration(pluginResult.limitedUserToken),\n          pluginResult.subject,\n        );\n      }\n      return createCredentialsWithServicePrincipal(pluginResult.subject);\n    }\n\n    const userResult = await this.userTokenHandler.verifyToken(token);\n    if (userResult) {\n      if (\n        !options?.allowLimitedAccess &&\n        this.userTokenHandler.isLimitedUserToken(token)\n      ) {\n        throw new AuthenticationError('Illegal limited user token');\n      }\n\n      return createCredentialsWithUserPrincipal(\n        userResult.userEntityRef,\n        token,\n        this.#getJwtExpiration(token),\n      );\n    }\n\n    const externalResult = await this.externalTokenHandler.verifyToken(token);\n    if (externalResult) {\n      return createCredentialsWithServicePrincipal(\n        externalResult.subject,\n        undefined,\n        externalResult.accessRestrictions,\n        externalResult.allAccessRestrictions,\n      );\n    }\n\n    throw new AuthenticationError('Illegal token');\n  }\n\n  isPrincipal<TType extends keyof BackstagePrincipalTypes>(\n    credentials: BackstageCredentials,\n    type: TType,\n  ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]> {\n    const principal = credentials.principal as\n      | BackstageUserPrincipal\n      | BackstageServicePrincipal;\n\n    if (type === 'unknown') {\n      return true;\n    }\n\n    if (principal.type !== type) {\n      return false;\n    }\n\n    return true;\n  }\n\n  async getNoneCredentials(): Promise<\n    BackstageCredentials<BackstageNonePrincipal>\n  > {\n    return createCredentialsWithNonePrincipal();\n  }\n\n  async getOwnServiceCredentials(): Promise<\n    BackstageCredentials<BackstageServicePrincipal>\n  > {\n    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);\n  }\n\n  async getPluginRequestToken(options: {\n    onBehalfOf: BackstageCredentials;\n    targetPluginId: string;\n  }): Promise<{ token: string }> {\n    const { targetPluginId } = options;\n    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);\n    const { type } = internalForward.principal;\n\n    // Since disabling the default policy means we'll be allowing\n    // unauthenticated requests through, we might have unauthenticated\n    // credentials from service calls that reach this point. If that's the case,\n    // we'll want to keep \"forwarding\" the unauthenticated credentials, which we\n    // do by returning an empty token.\n    if (type === 'none' && this.disableDefaultAuthPolicy) {\n      return { token: '' };\n    }\n\n    // check whether a plugin support the new auth system\n    // by checking the public keys endpoint existence.\n    switch (type) {\n      // TODO: Check whether the principal is ourselves\n      case 'service': {\n        const servicePrincipal =\n          internalForward.principal as BackstageServicePrincipal;\n        if (servicePrincipal.accessRestrictions) {\n          const targetRestrictions =\n            internalForward.allAccessRestrictions?.get(targetPluginId);\n          if (!targetRestrictions) {\n            throw new NotAllowedError(\n              `Access to target plugin '${targetPluginId}' is not included in token's access restrictions`,\n            );\n          }\n          if (\n            targetRestrictions.permissionNames?.length ||\n            targetRestrictions.permissionAttributes\n          ) {\n            throw new NotAllowedError(\n              `Access to target plugin '${targetPluginId}' is restricted and cannot be delegated`,\n            );\n          }\n        }\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n        });\n      }\n      case 'user': {\n        const { token } = internalForward;\n        if (!token) {\n          throw new Error('User credentials is unexpectedly missing token');\n        }\n        const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(\n          token,\n        );\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n          onBehalfOf: {\n            limitedUserToken: onBehalfOf.token,\n            expiresAt: onBehalfOf.expiresAt,\n          },\n        });\n      }\n      default:\n        throw new AuthenticationError(\n          `Refused to issue service token for credential type '${type}'`,\n        );\n    }\n  }\n\n  async getLimitedUserToken(\n    credentials: BackstageCredentials<BackstageUserPrincipal>,\n  ): Promise<{ token: string; expiresAt: Date }> {\n    const { token: backstageToken } =\n      toInternalBackstageCredentials(credentials);\n    if (!backstageToken) {\n      throw new AuthenticationError(\n        'User credentials is unexpectedly missing token',\n      );\n    }\n\n    return this.userTokenHandler.createLimitedUserToken(backstageToken);\n  }\n\n  async listPublicServiceKeys(): Promise<{ keys: JsonObject[] }> {\n    const { keys } = await this.pluginKeySource.listKeys();\n    return { keys: keys.map(({ key }) => key) };\n  }\n\n  #getJwtExpiration(token: string) {\n    const { exp } = decodeJwt(token);\n    if (!exp) {\n      throw new AuthenticationError('User token is missing expiration');\n    }\n    return new Date(exp * 1000);\n  }\n}\n"],"names":["userResult","AuthenticationError","createCredentialsWithUserPrincipal","createCredentialsWithServicePrincipal","createCredentialsWithNonePrincipal","toInternalBackstageCredentials","NotAllowedError","decodeJwt"],"mappings":";;;;;;AAuCO,MAAM,kBAAA,CAA0C;AAAA,EACpC,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,oBAAA;AAAA,EACA,QAAA;AAAA,EACA,wBAAA;AAAA,EACA,eAAA;AAAA,EAEjB,YACE,gBAAA,EACA,kBAAA,EACA,oBAAA,EACA,QAAA,EACA,0BACA,eAAA,EACA;AACA,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AACxB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAC1B,IAAA,IAAA,CAAK,oBAAA,GAAuB,oBAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,wBAAA,GAA2B,wBAAA;AAChC,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,EACA,OAAA,EAG+B;AAC/B,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,kBAAA,CAAmB,YAAY,KAAK,CAAA;AACpE,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,IAAI,aAAa,gBAAA,EAAkB;AACjC,QAAA,MAAMA,WAAAA,GAAa,MAAM,IAAA,CAAK,gBAAA,CAAiB,WAAA;AAAA,UAC7C,YAAA,CAAa;AAAA,SACf;AACA,QAAA,IAAI,CAACA,WAAAA,EAAY;AACf,UAAA,MAAM,IAAIC,0BAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AACA,QAAA,OAAOC,0CAAA;AAAA,UACLF,WAAAA,CAAW,aAAA;AAAA,UACX,YAAA,CAAa,gBAAA;AAAA,UACb,IAAA,CAAK,iBAAA,CAAkB,YAAA,CAAa,gBAAgB,CAAA;AAAA,UACpD,YAAA,CAAa;AAAA,SACf;AAAA,MACF;AACA,MAAA,OAAOG,6CAAA,CAAsC,aAAa,OAAO,CAAA;AAAA,IACnE;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAA,CAAiB,YAAY,KAAK,CAAA;AAChE,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IACE,CAAC,OAAA,EAAS,kBAAA,IACV,KAAK,gBAAA,CAAiB,kBAAA,CAAmB,KAAK,CAAA,EAC9C;AACA,QAAA,MAAM,IAAIF,2BAAoB,4BAA4B,CAAA;AAAA,MAC5D;AAEA,MAAA,OAAOC,0CAAA;AAAA,QACL,UAAA,CAAW,aAAA;AAAA,QACX,KAAA;AAAA,QACA,IAAA,CAAK,kBAAkB,KAAK;AAAA,OAC9B;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,oBAAA,CAAqB,YAAY,KAAK,CAAA;AACxE,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAOC,6CAAA;AAAA,QACL,cAAA,CAAe,OAAA;AAAA,QACf,MAAA;AAAA,QACA,cAAA,CAAe,kBAAA;AAAA,QACf,cAAA,CAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,MAAM,IAAIF,2BAAoB,eAAe,CAAA;AAAA,EAC/C;AAAA,EAEA,WAAA,CACE,aACA,IAAA,EACqE;AACrE,IAAA,MAAM,YAAY,WAAA,CAAY,SAAA;AAI9B,IAAA,IAAI,SAAS,SAAA,EAAW;AACtB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,SAAA,CAAU,SAAS,IAAA,EAAM;AAC3B,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,kBAAA,GAEJ;AACA,IAAA,OAAOG,0CAAA,EAAmC;AAAA,EAC5C;AAAA,EAEA,MAAM,wBAAA,GAEJ;AACA,IAAA,OAAOD,6CAAA,CAAsC,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,EACxE;AAAA,EAEA,MAAM,sBAAsB,OAAA,EAGG;AAC7B,IAAA,MAAM,EAAE,gBAAe,GAAI,OAAA;AAC3B,IAAA,MAAM,eAAA,GAAkBE,sCAAA,CAA+B,OAAA,CAAQ,UAAU,CAAA;AACzE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,eAAA,CAAgB,SAAA;AAOjC,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,wBAAA,EAA0B;AACpD,MAAA,OAAO,EAAE,OAAO,EAAA,EAAG;AAAA,IACrB;AAIA,IAAA,QAAQ,IAAA;AAAM;AAAA,MAEZ,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,mBACJ,eAAA,CAAgB,SAAA;AAClB,QAAA,IAAI,iBAAiB,kBAAA,EAAoB;AACvC,UAAA,MAAM,kBAAA,GACJ,eAAA,CAAgB,qBAAA,EAAuB,GAAA,CAAI,cAAc,CAAA;AAC3D,UAAA,IAAI,CAAC,kBAAA,EAAoB;AACvB,YAAA,MAAM,IAAIC,sBAAA;AAAA,cACR,4BAA4B,cAAc,CAAA,gDAAA;AAAA,aAC5C;AAAA,UACF;AACA,UAAA,IACE,kBAAA,CAAmB,eAAA,EAAiB,MAAA,IACpC,kBAAA,CAAmB,oBAAA,EACnB;AACA,YAAA,MAAM,IAAIA,sBAAA;AAAA,cACR,4BAA4B,cAAc,CAAA,uCAAA;AAAA,aAC5C;AAAA,UACF;AAAA,QACF;AACA,QAAA,OAAO,IAAA,CAAK,mBAAmB,UAAA,CAAW;AAAA,UACxC,UAAU,IAAA,CAAK,QAAA;AAAA,UACf;AAAA,SACD,CAAA;AAAA,MACH;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,EAAE,OAAM,GAAI,eAAA;AAClB,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,QAClE;AACA,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAA,CAAiB,sBAAA;AAAA,UAC7C;AAAA,SACF;AACA,QAAA,OAAO,IAAA,CAAK,mBAAmB,UAAA,CAAW;AAAA,UACxC,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,cAAA;AAAA,UACA,UAAA,EAAY;AAAA,YACV,kBAAkB,UAAA,CAAW,KAAA;AAAA,YAC7B,WAAW,UAAA,CAAW;AAAA;AACxB,SACD,CAAA;AAAA,MACH;AAAA,MACA;AACE,QAAA,MAAM,IAAIL,0BAAA;AAAA,UACR,uDAAuD,IAAI,CAAA,CAAA;AAAA,SAC7D;AAAA;AACJ,EACF;AAAA,EAEA,MAAM,oBACJ,WAAA,EAC6C;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAO,cAAA,EAAe,GAC5BI,uCAA+B,WAAW,CAAA;AAC5C,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,sBAAA,CAAuB,cAAc,CAAA;AAAA,EACpE;AAAA,EAEA,MAAM,qBAAA,GAAyD;AAC7D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,gBAAgB,QAAA,EAAS;AACrD,IAAA,OAAO,EAAE,MAAM,IAAA,CAAK,GAAA,CAAI,CAAC,EAAE,GAAA,EAAI,KAAM,GAAG,CAAA,EAAE;AAAA,EAC5C;AAAA,EAEA,kBAAkB,KAAA,EAAe;AAC/B,IAAA,MAAM,EAAE,GAAA,EAAI,GAAIM,cAAA,CAAU,KAAK,CAAA;AAC/B,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAIN,2BAAoB,kCAAkC,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,IAAI,IAAA,CAAK,GAAA,GAAM,GAAI,CAAA;AAAA,EAC5B;AACF;;;;"}

package/dist/entrypoints/auth/external/ExternalAuthTokenHandler.cjs.js

@@ -100,7 +100,8 @@ class ExternalAuthTokenHandler {
           }
           return {
             ...result,
-            accessRestrictions
+            accessRestrictions,
+            allAccessRestrictions
           };
         }
         return result;

package/dist/entrypoints/auth/external/ExternalAuthTokenHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"ExternalAuthTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/external/ExternalAuthTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BackstagePrincipalAccessRestrictions,\n  createServiceRef,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { NotAllowedError } from '@backstage/errors';\nimport { legacyTokenHandler } from './legacy';\nimport { staticTokenHandler } from './static';\nimport { jwksTokenHandler } from './jwks';\nimport { AccessRestrictionsMap, ExternalTokenHandler } from './types';\nimport { readAccessRestrictionsFromConfig } from './helpers';\n\nconst NEW_CONFIG_KEY = 'backend.auth.externalAccess';\nconst OLD_CONFIG_KEY = 'backend.auth.keys';\nlet loggedDeprecationWarning = false;\n\n/**\n * @public\n * This service is used to add custom handlers for external token.\n */\nexport const externalTokenHandlersServiceRef = createServiceRef<\n  ExternalTokenHandler<unknown>\n>({\n  id: 'core.auth.externalTokenHandlers',\n  multiton: true,\n});\n\nconst defaultHandlers: Record<string, ExternalTokenHandler<unknown>> = {\n  static: staticTokenHandler,\n  legacy: legacyTokenHandler,\n  jwks: jwksTokenHandler,\n};\n\ntype ContextMapEntry<T> = {\n  context: T;\n  handler: ExternalTokenHandler<T>;\n  allAccessRestrictions?: AccessRestrictionsMap;\n};\n\n/**\n * Handles all types of external caller token types (i.e. not Backstage user\n * tokens, nor Backstage backend plugin tokens).\n *\n * @internal\n */\nexport class ExternalAuthTokenHandler {\n  static create(options: {\n    ownPluginId: string;\n    config: RootConfigService;\n    logger: LoggerService;\n    externalTokenHandlers?: ExternalTokenHandler<unknown>[];\n  }): ExternalAuthTokenHandler {\n    const {\n      ownPluginId,\n      config,\n      externalTokenHandlers: customHandlers = [],\n      logger,\n    } = options;\n\n    const handlersTypes = customHandlers.reduce<\n      Record<string, ExternalTokenHandler<unknown>>\n    >(\n      (acc, handler) => {\n        if (acc[handler.type]) {\n          throw new Error(\n            `Duplicate external token handler type '${handler.type}', each handler must have a unique type`,\n          );\n        }\n        acc[handler.type] = handler;\n        return acc;\n      },\n      { ...defaultHandlers },\n    );\n\n    const handlerConfigs = config.getOptionalConfigArray(NEW_CONFIG_KEY) ?? [];\n    const contexts: ContextMapEntry<unknown>[] = handlerConfigs.map(\n      handlerConfig => {\n        const type = handlerConfig.getString('type');\n\n        const handler = handlersTypes[type];\n        if (!handler) {\n          const valid = Object.keys(handlersTypes)\n            .map(h => `'${h}'`)\n            .join(', ');\n          throw new Error(\n            `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`,\n          );\n        }\n        return {\n          context: handler.initialize({\n            options: handlerConfig.getConfig('options'),\n          }),\n          handler,\n          allAccessRestrictions: handlerConfig\n            ? readAccessRestrictionsFromConfig(handlerConfig)\n            : undefined,\n        };\n      },\n    );\n\n    // Load the old keys too\n    const legacyConfigs = config.getOptionalConfigArray(OLD_CONFIG_KEY) ?? [];\n\n    if (legacyConfigs.length && !loggedDeprecationWarning) {\n      loggedDeprecationWarning = true;\n\n      logger.warn(\n        `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`,\n      );\n    }\n\n    for (const legacyConfig of legacyConfigs) {\n      contexts.push({\n        context: legacyTokenHandler.initialize({\n          legacy: true,\n          options: legacyConfig,\n        }),\n        handler: legacyTokenHandler,\n        allAccessRestrictions: readAccessRestrictionsFromConfig(legacyConfig),\n      });\n    }\n\n    return new ExternalAuthTokenHandler(ownPluginId, contexts);\n  }\n\n  private readonly ownPluginId: string;\n  private readonly contexts: {\n    context: unknown;\n    handler: ExternalTokenHandler<unknown>;\n    allAccessRestrictions?: AccessRestrictionsMap;\n  }[];\n\n  constructor(\n    ownPluginId: string,\n    contexts: {\n      context: unknown;\n      handler: ExternalTokenHandler<unknown>;\n      allAccessRestrictions?: AccessRestrictionsMap;\n    }[],\n  ) {\n    this.ownPluginId = ownPluginId;\n    this.contexts = contexts;\n  }\n\n  async verifyToken(token: string): Promise<\n    | {\n        subject: string;\n        accessRestrictions?: BackstagePrincipalAccessRestrictions;\n      }\n    | undefined\n  > {\n    for (const { handler, allAccessRestrictions, context } of this.contexts) {\n      const result = await handler.verifyToken(token, context);\n      if (result) {\n        if (allAccessRestrictions) {\n          const accessRestrictions = allAccessRestrictions.get(\n            this.ownPluginId,\n          );\n          if (!accessRestrictions) {\n            const valid = [...allAccessRestrictions.keys()]\n              .map(k => `'${k}'`)\n              .join(', ');\n            throw new NotAllowedError(\n              `This token's access is restricted to plugin(s) ${valid}`,\n            );\n          }\n\n          return {\n            ...result,\n            accessRestrictions,\n          };\n        }\n\n        return result;\n      }\n    }\n\n    return undefined;\n  }\n}\n"],"names":["createServiceRef","staticTokenHandler","legacyTokenHandler","jwksTokenHandler","readAccessRestrictionsFromConfig","NotAllowedError"],"mappings":";;;;;;;;;AA6BA,MAAM,cAAA,GAAiB,6BAAA;AACvB,MAAM,cAAA,GAAiB,mBAAA;AACvB,IAAI,wBAAA,GAA2B,KAAA;AAMxB,MAAM,kCAAkCA,iCAAA,CAE7C;AAAA,EACA,EAAA,EAAI,iCAAA;AAAA,EACJ,QAAA,EAAU;AACZ,CAAC;AAED,MAAM,eAAA,GAAiE;AAAA,EACrE,MAAA,EAAQC,0BAAA;AAAA,EACR,MAAA,EAAQC,yBAAA;AAAA,EACR,IAAA,EAAMC;AACR,CAAA;AAcO,MAAM,wBAAA,CAAyB;AAAA,EACpC,OAAO,OAAO,OAAA,EAKe;AAC3B,IAAA,MAAM;AAAA,MACJ,WAAA;AAAA,MACA,MAAA;AAAA,MACA,qBAAA,EAAuB,iBAAiB,EAAC;AAAA,MACzC;AAAA,KACF,GAAI,OAAA;AAEJ,IAAA,MAAM,gBAAgB,cAAA,CAAe,MAAA;AAAA,MAGnC,CAAC,KAAK,OAAA,KAAY;AAChB,QAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,uCAAA,EAA0C,QAAQ,IAAI,CAAA,uCAAA;AAAA,WACxD;AAAA,QACF;AACA,QAAA,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAA;AACpB,QAAA,OAAO,GAAA;AAAA,MACT,CAAA;AAAA,MACA,EAAE,GAAG,eAAA;AAAgB,KACvB;AAEA,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,sBAAA,CAAuB,cAAc,KAAK,EAAC;AACzE,IAAA,MAAM,WAAuC,cAAA,CAAe,GAAA;AAAA,MAC1D,CAAA,aAAA,KAAiB;AACf,QAAA,MAAM,IAAA,GAAO,aAAA,CAAc,SAAA,CAAU,MAAM,CAAA;AAE3C,QAAA,MAAM,OAAA,GAAU,cAAc,IAAI,CAAA;AAClC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CACpC,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CACjB,IAAA,CAAK,IAAI,CAAA;AACZ,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,cAAA,EAAiB,IAAI,CAAA,KAAA,EAAQ,cAAc,qBAAqB,KAAK,CAAA;AAAA,WACvE;AAAA,QACF;AACA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,QAAQ,UAAA,CAAW;AAAA,YAC1B,OAAA,EAAS,aAAA,CAAc,SAAA,CAAU,SAAS;AAAA,WAC3C,CAAA;AAAA,UACD,OAAA;AAAA,UACA,qBAAA,EAAuB,aAAA,GACnBC,wCAAA,CAAiC,aAAa,CAAA,GAC9C;AAAA,SACN;AAAA,MACF;AAAA,KACF;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,sBAAA,CAAuB,cAAc,KAAK,EAAC;AAExE,IAAA,IAAI,aAAA,CAAc,MAAA,IAAU,CAAC,wBAAA,EAA0B;AACrD,MAAA,wBAAA,GAA2B,IAAA;AAE3B,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,CAAA,yBAAA,EAA4B,cAAc,CAAA,6BAAA,EAAgC,cAAc,CAAA,4DAAA;AAAA,OAC1F;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,gBAAgB,aAAA,EAAe;AACxC,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,OAAA,EAASF,0BAAmB,UAAA,CAAW;AAAA,UACrC,MAAA,EAAQ,IAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,QACD,OAAA,EAASA,yBAAA;AAAA,QACT,qBAAA,EAAuBE,yCAAiC,YAAY;AAAA,OACrE,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,IAAI,wBAAA,CAAyB,WAAA,EAAa,QAAQ,CAAA;AAAA,EAC3D;AAAA,EAEiB,WAAA;AAAA,EACA,QAAA;AAAA,EAMjB,WAAA,CACE,aACA,QAAA,EAKA;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,YAAY,KAAA,EAMhB;AACA,IAAA,KAAA,MAAW,EAAE,OAAA,EAAS,qBAAA,EAAuB,OAAA,EAAQ,IAAK,KAAK,QAAA,EAAU;AACvE,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,CAAY,OAAO,OAAO,CAAA;AACvD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,qBAAA,EAAuB;AACzB,UAAA,MAAM,qBAAqB,qBAAA,CAAsB,GAAA;AAAA,YAC/C,IAAA,CAAK;AAAA,WACP;AACA,UAAA,IAAI,CAAC,kBAAA,EAAoB;AACvB,YAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,qBAAA,CAAsB,MAAM,CAAA,CAC3C,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CACjB,KAAK,IAAI,CAAA;AACZ,YAAA,MAAM,IAAIC,sBAAA;AAAA,cACR,kDAAkD,KAAK,CAAA;AAAA,aACzD;AAAA,UACF;AAEA,UAAA,OAAO;AAAA,YACL,GAAG,MAAA;AAAA,YACH;AAAA,WACF;AAAA,QACF;AAEA,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;;;"}
+{"version":3,"file":"ExternalAuthTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/external/ExternalAuthTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BackstagePrincipalAccessRestrictions,\n  createServiceRef,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { NotAllowedError } from '@backstage/errors';\nimport { legacyTokenHandler } from './legacy';\nimport { staticTokenHandler } from './static';\nimport { jwksTokenHandler } from './jwks';\nimport { AccessRestrictionsMap, ExternalTokenHandler } from './types';\nimport { readAccessRestrictionsFromConfig } from './helpers';\n\nconst NEW_CONFIG_KEY = 'backend.auth.externalAccess';\nconst OLD_CONFIG_KEY = 'backend.auth.keys';\nlet loggedDeprecationWarning = false;\n\n/**\n * @public\n * This service is used to add custom handlers for external token.\n */\nexport const externalTokenHandlersServiceRef = createServiceRef<\n  ExternalTokenHandler<unknown>\n>({\n  id: 'core.auth.externalTokenHandlers',\n  multiton: true,\n});\n\nconst defaultHandlers: Record<string, ExternalTokenHandler<unknown>> = {\n  static: staticTokenHandler,\n  legacy: legacyTokenHandler,\n  jwks: jwksTokenHandler,\n};\n\ntype ContextMapEntry<T> = {\n  context: T;\n  handler: ExternalTokenHandler<T>;\n  allAccessRestrictions?: AccessRestrictionsMap;\n};\n\n/**\n * Handles all types of external caller token types (i.e. not Backstage user\n * tokens, nor Backstage backend plugin tokens).\n *\n * @internal\n */\nexport class ExternalAuthTokenHandler {\n  static create(options: {\n    ownPluginId: string;\n    config: RootConfigService;\n    logger: LoggerService;\n    externalTokenHandlers?: ExternalTokenHandler<unknown>[];\n  }): ExternalAuthTokenHandler {\n    const {\n      ownPluginId,\n      config,\n      externalTokenHandlers: customHandlers = [],\n      logger,\n    } = options;\n\n    const handlersTypes = customHandlers.reduce<\n      Record<string, ExternalTokenHandler<unknown>>\n    >(\n      (acc, handler) => {\n        if (acc[handler.type]) {\n          throw new Error(\n            `Duplicate external token handler type '${handler.type}', each handler must have a unique type`,\n          );\n        }\n        acc[handler.type] = handler;\n        return acc;\n      },\n      { ...defaultHandlers },\n    );\n\n    const handlerConfigs = config.getOptionalConfigArray(NEW_CONFIG_KEY) ?? [];\n    const contexts: ContextMapEntry<unknown>[] = handlerConfigs.map(\n      handlerConfig => {\n        const type = handlerConfig.getString('type');\n\n        const handler = handlersTypes[type];\n        if (!handler) {\n          const valid = Object.keys(handlersTypes)\n            .map(h => `'${h}'`)\n            .join(', ');\n          throw new Error(\n            `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`,\n          );\n        }\n        return {\n          context: handler.initialize({\n            options: handlerConfig.getConfig('options'),\n          }),\n          handler,\n          allAccessRestrictions: handlerConfig\n            ? readAccessRestrictionsFromConfig(handlerConfig)\n            : undefined,\n        };\n      },\n    );\n\n    // Load the old keys too\n    const legacyConfigs = config.getOptionalConfigArray(OLD_CONFIG_KEY) ?? [];\n\n    if (legacyConfigs.length && !loggedDeprecationWarning) {\n      loggedDeprecationWarning = true;\n\n      logger.warn(\n        `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`,\n      );\n    }\n\n    for (const legacyConfig of legacyConfigs) {\n      contexts.push({\n        context: legacyTokenHandler.initialize({\n          legacy: true,\n          options: legacyConfig,\n        }),\n        handler: legacyTokenHandler,\n        allAccessRestrictions: readAccessRestrictionsFromConfig(legacyConfig),\n      });\n    }\n\n    return new ExternalAuthTokenHandler(ownPluginId, contexts);\n  }\n\n  private readonly ownPluginId: string;\n  private readonly contexts: {\n    context: unknown;\n    handler: ExternalTokenHandler<unknown>;\n    allAccessRestrictions?: AccessRestrictionsMap;\n  }[];\n\n  constructor(\n    ownPluginId: string,\n    contexts: {\n      context: unknown;\n      handler: ExternalTokenHandler<unknown>;\n      allAccessRestrictions?: AccessRestrictionsMap;\n    }[],\n  ) {\n    this.ownPluginId = ownPluginId;\n    this.contexts = contexts;\n  }\n\n  async verifyToken(token: string): Promise<\n    | {\n        subject: string;\n        accessRestrictions?: BackstagePrincipalAccessRestrictions;\n        allAccessRestrictions?: AccessRestrictionsMap;\n      }\n    | undefined\n  > {\n    for (const { handler, allAccessRestrictions, context } of this.contexts) {\n      const result = await handler.verifyToken(token, context);\n      if (result) {\n        if (allAccessRestrictions) {\n          const accessRestrictions = allAccessRestrictions.get(\n            this.ownPluginId,\n          );\n          if (!accessRestrictions) {\n            const valid = [...allAccessRestrictions.keys()]\n              .map(k => `'${k}'`)\n              .join(', ');\n            throw new NotAllowedError(\n              `This token's access is restricted to plugin(s) ${valid}`,\n            );\n          }\n\n          return {\n            ...result,\n            accessRestrictions,\n            allAccessRestrictions,\n          };\n        }\n\n        return result;\n      }\n    }\n\n    return undefined;\n  }\n}\n"],"names":["createServiceRef","staticTokenHandler","legacyTokenHandler","jwksTokenHandler","readAccessRestrictionsFromConfig","NotAllowedError"],"mappings":";;;;;;;;;AA6BA,MAAM,cAAA,GAAiB,6BAAA;AACvB,MAAM,cAAA,GAAiB,mBAAA;AACvB,IAAI,wBAAA,GAA2B,KAAA;AAMxB,MAAM,kCAAkCA,iCAAA,CAE7C;AAAA,EACA,EAAA,EAAI,iCAAA;AAAA,EACJ,QAAA,EAAU;AACZ,CAAC;AAED,MAAM,eAAA,GAAiE;AAAA,EACrE,MAAA,EAAQC,0BAAA;AAAA,EACR,MAAA,EAAQC,yBAAA;AAAA,EACR,IAAA,EAAMC;AACR,CAAA;AAcO,MAAM,wBAAA,CAAyB;AAAA,EACpC,OAAO,OAAO,OAAA,EAKe;AAC3B,IAAA,MAAM;AAAA,MACJ,WAAA;AAAA,MACA,MAAA;AAAA,MACA,qBAAA,EAAuB,iBAAiB,EAAC;AAAA,MACzC;AAAA,KACF,GAAI,OAAA;AAEJ,IAAA,MAAM,gBAAgB,cAAA,CAAe,MAAA;AAAA,MAGnC,CAAC,KAAK,OAAA,KAAY;AAChB,QAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,uCAAA,EAA0C,QAAQ,IAAI,CAAA,uCAAA;AAAA,WACxD;AAAA,QACF;AACA,QAAA,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAA;AACpB,QAAA,OAAO,GAAA;AAAA,MACT,CAAA;AAAA,MACA,EAAE,GAAG,eAAA;AAAgB,KACvB;AAEA,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,sBAAA,CAAuB,cAAc,KAAK,EAAC;AACzE,IAAA,MAAM,WAAuC,cAAA,CAAe,GAAA;AAAA,MAC1D,CAAA,aAAA,KAAiB;AACf,QAAA,MAAM,IAAA,GAAO,aAAA,CAAc,SAAA,CAAU,MAAM,CAAA;AAE3C,QAAA,MAAM,OAAA,GAAU,cAAc,IAAI,CAAA;AAClC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CACpC,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CACjB,IAAA,CAAK,IAAI,CAAA;AACZ,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,cAAA,EAAiB,IAAI,CAAA,KAAA,EAAQ,cAAc,qBAAqB,KAAK,CAAA;AAAA,WACvE;AAAA,QACF;AACA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,QAAQ,UAAA,CAAW;AAAA,YAC1B,OAAA,EAAS,aAAA,CAAc,SAAA,CAAU,SAAS;AAAA,WAC3C,CAAA;AAAA,UACD,OAAA;AAAA,UACA,qBAAA,EAAuB,aAAA,GACnBC,wCAAA,CAAiC,aAAa,CAAA,GAC9C;AAAA,SACN;AAAA,MACF;AAAA,KACF;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,sBAAA,CAAuB,cAAc,KAAK,EAAC;AAExE,IAAA,IAAI,aAAA,CAAc,MAAA,IAAU,CAAC,wBAAA,EAA0B;AACrD,MAAA,wBAAA,GAA2B,IAAA;AAE3B,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,CAAA,yBAAA,EAA4B,cAAc,CAAA,6BAAA,EAAgC,cAAc,CAAA,4DAAA;AAAA,OAC1F;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,gBAAgB,aAAA,EAAe;AACxC,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,OAAA,EAASF,0BAAmB,UAAA,CAAW;AAAA,UACrC,MAAA,EAAQ,IAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,QACD,OAAA,EAASA,yBAAA;AAAA,QACT,qBAAA,EAAuBE,yCAAiC,YAAY;AAAA,OACrE,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,IAAI,wBAAA,CAAyB,WAAA,EAAa,QAAQ,CAAA;AAAA,EAC3D;AAAA,EAEiB,WAAA;AAAA,EACA,QAAA;AAAA,EAMjB,WAAA,CACE,aACA,QAAA,EAKA;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,MAAM,YAAY,KAAA,EAOhB;AACA,IAAA,KAAA,MAAW,EAAE,OAAA,EAAS,qBAAA,EAAuB,OAAA,EAAQ,IAAK,KAAK,QAAA,EAAU;AACvE,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,CAAY,OAAO,OAAO,CAAA;AACvD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,qBAAA,EAAuB;AACzB,UAAA,MAAM,qBAAqB,qBAAA,CAAsB,GAAA;AAAA,YAC/C,IAAA,CAAK;AAAA,WACP;AACA,UAAA,IAAI,CAAC,kBAAA,EAAoB;AACvB,YAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,qBAAA,CAAsB,MAAM,CAAA,CAC3C,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CACjB,KAAK,IAAI,CAAA;AACZ,YAAA,MAAM,IAAIC,sBAAA;AAAA,cACR,kDAAkD,KAAK,CAAA;AAAA,aACzD;AAAA,UACF;AAEA,UAAA,OAAO;AAAA,YACL,GAAG,MAAA;AAAA,YACH,kBAAA;AAAA,YACA;AAAA,WACF;AAAA,QACF;AAEA,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;;;"}

package/dist/entrypoints/auth/helpers.cjs.js

@@ -2,7 +2,7 @@
 
 var node_crypto = require('node:crypto');
 
-function createCredentialsWithServicePrincipal(sub, token, accessRestrictions) {
+function createCredentialsWithServicePrincipal(sub, token, accessRestrictions, allAccessRestrictions) {
   const principal = createServicePrincipal(sub, accessRestrictions);
   const result = {
     $$type: "@backstage/BackstageCredentials",
@@ -16,6 +16,12 @@ function createCredentialsWithServicePrincipal(sub, token, accessRestrictions) {
       writable: true,
       value: token
     },
+    allAccessRestrictions: {
+      enumerable: false,
+      configurable: true,
+      writable: true,
+      value: allAccessRestrictions
+    },
     toString: {
       enumerable: false,
       configurable: true,

package/dist/entrypoints/auth/helpers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.cjs.js","sources":["../../../src/entrypoints/auth/helpers.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalAccessRestrictions,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { InternalBackstageCredentials } from './types';\nimport { createHash } from 'node:crypto';\n\nexport function createCredentialsWithServicePrincipal(\n  sub: string,\n  token?: string,\n  accessRestrictions?: BackstagePrincipalAccessRestrictions,\n): InternalBackstageCredentials<BackstageServicePrincipal> {\n  const principal = createServicePrincipal(sub, accessRestrictions);\n  const result = {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    principal,\n  } as const;\n  Object.defineProperties(result, {\n    token: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: token,\n    },\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => `backstageCredentials{${principal}}`,\n    },\n  });\n  return result;\n}\n\nexport function createCredentialsWithUserPrincipal(\n  sub: string,\n  token: string,\n  expiresAt?: Date,\n  actor?: string,\n): InternalBackstageCredentials<BackstageUserPrincipal> {\n  const principal = createUserPrincipal(\n    sub,\n    actor ? createServicePrincipal(actor) : undefined,\n  );\n  const result = {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    expiresAt,\n    principal,\n  } as const;\n  Object.defineProperties(result, {\n    token: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: token,\n    },\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => `backstageCredentials{${principal}}`,\n    },\n  });\n  return result;\n}\n\nexport function createCredentialsWithNonePrincipal(): InternalBackstageCredentials<BackstageNonePrincipal> {\n  const principal = createNonePrincipal();\n  const result = {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    principal,\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => `backstageCredentials{${principal}}`,\n    },\n  });\n  return result;\n}\n\nexport function toInternalBackstageCredentials(\n  credentials: BackstageCredentials,\n): InternalBackstageCredentials<\n  BackstageUserPrincipal | BackstageServicePrincipal | BackstageNonePrincipal\n> {\n  if (credentials.$$type !== '@backstage/BackstageCredentials') {\n    throw new Error('Invalid credential type');\n  }\n\n  const internalCredentials = credentials as InternalBackstageCredentials<\n    BackstageUserPrincipal | BackstageServicePrincipal | BackstageNonePrincipal\n  >;\n\n  if (internalCredentials.version !== 'v1') {\n    throw new Error(\n      `Invalid credential version ${internalCredentials.version}`,\n    );\n  }\n\n  return internalCredentials;\n}\n\nfunction createServicePrincipal(\n  sub: string,\n  accessRestrictions?: BackstagePrincipalAccessRestrictions,\n): BackstageServicePrincipal {\n  const result = {\n    type: 'service',\n    subject: sub,\n    accessRestrictions,\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => {\n        let parts = sub;\n        if (accessRestrictions) {\n          const hash = createHash('sha256')\n            .update(JSON.stringify(accessRestrictions))\n            .digest('base64')\n            .replace(/=+$/, '');\n          parts += `,accessRestrictions=${hash}`;\n        }\n        return `servicePrincipal{${parts}}`;\n      },\n    },\n  });\n  return result;\n}\n\nfunction createUserPrincipal(\n  userEntityRef: string,\n  actor?: BackstageServicePrincipal,\n): BackstageUserPrincipal {\n  const result = {\n    type: 'user',\n    userEntityRef,\n    actor,\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => {\n        let parts = userEntityRef;\n        if (actor) {\n          parts += `,actor={${actor}}`;\n        }\n        return `userPrincipal{${parts}}`;\n      },\n    },\n  });\n  return result;\n}\n\nfunction createNonePrincipal(): BackstageNonePrincipal {\n  const result = {\n    type: 'none',\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => 'nonePrincipal',\n    },\n  });\n  return result;\n}\n"],"names":["createHash"],"mappings":";;;;AA0BO,SAAS,qCAAA,CACd,GAAA,EACA,KAAA,EACA,kBAAA,EACyD;AACzD,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,GAAA,EAAK,kBAAkB,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,MAAA,EAAQ,iCAAA;AAAA,IACR,OAAA,EAAS,IAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,KAAA,EAAO;AAAA,MACL,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACT;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,MAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA;AAAA;AAChD,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,kCAAA,CACd,GAAA,EACA,KAAA,EACA,SAAA,EACA,KAAA,EACsD;AACtD,EAAA,MAAM,SAAA,GAAY,mBAAA;AAAA,IAChB,GAAA;AAAA,IACA,KAAA,GAAQ,sBAAA,CAAuB,KAAK,CAAA,GAAI;AAAA,GAC1C;AACA,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,MAAA,EAAQ,iCAAA;AAAA,IACR,OAAA,EAAS,IAAA;AAAA,IACT,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,KAAA,EAAO;AAAA,MACL,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACT;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,MAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA;AAAA;AAChD,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,kCAAA,GAA2F;AACzG,EAAA,MAAM,YAAY,mBAAA,EAAoB;AACtC,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,MAAA,EAAQ,iCAAA;AAAA,IACR,OAAA,EAAS,IAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,MAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA;AAAA;AAChD,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,+BACd,WAAA,EAGA;AACA,EAAA,IAAI,WAAA,CAAY,WAAW,iCAAA,EAAmC;AAC5D,IAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,mBAAA,GAAsB,WAAA;AAI5B,EAAA,IAAI,mBAAA,CAAoB,YAAY,IAAA,EAAM;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,oBAAoB,OAAO,CAAA;AAAA,KAC3D;AAAA,EACF;AAEA,EAAA,OAAO,mBAAA;AACT;AAEA,SAAS,sBAAA,CACP,KACA,kBAAA,EAC2B;AAC3B,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAA,EAAM,SAAA;AAAA,IACN,OAAA,EAAS,GAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,OAAO,MAAM;AACX,QAAA,IAAI,KAAA,GAAQ,GAAA;AACZ,QAAA,IAAI,kBAAA,EAAoB;AACtB,UAAA,MAAM,IAAA,GAAOA,sBAAA,CAAW,QAAQ,CAAA,CAC7B,OAAO,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAC,EACzC,MAAA,CAAO,QAAQ,CAAA,CACf,OAAA,CAAQ,OAAO,EAAE,CAAA;AACpB,UAAA,KAAA,IAAS,uBAAuB,IAAI,CAAA,CAAA;AAAA,QACtC;AACA,QAAA,OAAO,oBAAoB,KAAK,CAAA,CAAA,CAAA;AAAA,MAClC;AAAA;AACF,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,mBAAA,CACP,eACA,KAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAA,EAAM,MAAA;AAAA,IACN,aAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,OAAO,MAAM;AACX,QAAA,IAAI,KAAA,GAAQ,aAAA;AACZ,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,KAAA,IAAS,WAAW,KAAK,CAAA,CAAA,CAAA;AAAA,QAC3B;AACA,QAAA,OAAO,iBAAiB,KAAK,CAAA,CAAA,CAAA;AAAA,MAC/B;AAAA;AACF,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,mBAAA,GAA8C;AACrD,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAA,EAAM;AAAA,GACR;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,OAAO,MAAM;AAAA;AACf,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;;;;;;;"}
+{"version":3,"file":"helpers.cjs.js","sources":["../../../src/entrypoints/auth/helpers.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalAccessRestrictions,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { InternalBackstageCredentials } from './types';\nimport { AccessRestrictionsMap } from './external/types';\nimport { createHash } from 'node:crypto';\n\nexport function createCredentialsWithServicePrincipal(\n  sub: string,\n  token?: string,\n  accessRestrictions?: BackstagePrincipalAccessRestrictions,\n  allAccessRestrictions?: AccessRestrictionsMap,\n): InternalBackstageCredentials<BackstageServicePrincipal> {\n  const principal = createServicePrincipal(sub, accessRestrictions);\n  const result = {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    principal,\n  } as const;\n  Object.defineProperties(result, {\n    token: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: token,\n    },\n    allAccessRestrictions: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: allAccessRestrictions,\n    },\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => `backstageCredentials{${principal}}`,\n    },\n  });\n  return result;\n}\n\nexport function createCredentialsWithUserPrincipal(\n  sub: string,\n  token: string,\n  expiresAt?: Date,\n  actor?: string,\n): InternalBackstageCredentials<BackstageUserPrincipal> {\n  const principal = createUserPrincipal(\n    sub,\n    actor ? createServicePrincipal(actor) : undefined,\n  );\n  const result = {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    expiresAt,\n    principal,\n  } as const;\n  Object.defineProperties(result, {\n    token: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: token,\n    },\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => `backstageCredentials{${principal}}`,\n    },\n  });\n  return result;\n}\n\nexport function createCredentialsWithNonePrincipal(): InternalBackstageCredentials<BackstageNonePrincipal> {\n  const principal = createNonePrincipal();\n  const result = {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    principal,\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => `backstageCredentials{${principal}}`,\n    },\n  });\n  return result;\n}\n\nexport function toInternalBackstageCredentials(\n  credentials: BackstageCredentials,\n): InternalBackstageCredentials<\n  BackstageUserPrincipal | BackstageServicePrincipal | BackstageNonePrincipal\n> {\n  if (credentials.$$type !== '@backstage/BackstageCredentials') {\n    throw new Error('Invalid credential type');\n  }\n\n  const internalCredentials = credentials as InternalBackstageCredentials<\n    BackstageUserPrincipal | BackstageServicePrincipal | BackstageNonePrincipal\n  >;\n\n  if (internalCredentials.version !== 'v1') {\n    throw new Error(\n      `Invalid credential version ${internalCredentials.version}`,\n    );\n  }\n\n  return internalCredentials;\n}\n\nfunction createServicePrincipal(\n  sub: string,\n  accessRestrictions?: BackstagePrincipalAccessRestrictions,\n): BackstageServicePrincipal {\n  const result = {\n    type: 'service',\n    subject: sub,\n    accessRestrictions,\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => {\n        let parts = sub;\n        if (accessRestrictions) {\n          const hash = createHash('sha256')\n            .update(JSON.stringify(accessRestrictions))\n            .digest('base64')\n            .replace(/=+$/, '');\n          parts += `,accessRestrictions=${hash}`;\n        }\n        return `servicePrincipal{${parts}}`;\n      },\n    },\n  });\n  return result;\n}\n\nfunction createUserPrincipal(\n  userEntityRef: string,\n  actor?: BackstageServicePrincipal,\n): BackstageUserPrincipal {\n  const result = {\n    type: 'user',\n    userEntityRef,\n    actor,\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => {\n        let parts = userEntityRef;\n        if (actor) {\n          parts += `,actor={${actor}}`;\n        }\n        return `userPrincipal{${parts}}`;\n      },\n    },\n  });\n  return result;\n}\n\nfunction createNonePrincipal(): BackstageNonePrincipal {\n  const result = {\n    type: 'none',\n  } as const;\n  Object.defineProperties(result, {\n    toString: {\n      enumerable: false,\n      configurable: true,\n      writable: true,\n      value: () => 'nonePrincipal',\n    },\n  });\n  return result;\n}\n"],"names":["createHash"],"mappings":";;;;AA2BO,SAAS,qCAAA,CACd,GAAA,EACA,KAAA,EACA,kBAAA,EACA,qBAAA,EACyD;AACzD,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,GAAA,EAAK,kBAAkB,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,MAAA,EAAQ,iCAAA;AAAA,IACR,OAAA,EAAS,IAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,KAAA,EAAO;AAAA,MACL,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACT;AAAA,IACA,qBAAA,EAAuB;AAAA,MACrB,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACT;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,MAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA;AAAA;AAChD,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,kCAAA,CACd,GAAA,EACA,KAAA,EACA,SAAA,EACA,KAAA,EACsD;AACtD,EAAA,MAAM,SAAA,GAAY,mBAAA;AAAA,IAChB,GAAA;AAAA,IACA,KAAA,GAAQ,sBAAA,CAAuB,KAAK,CAAA,GAAI;AAAA,GAC1C;AACA,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,MAAA,EAAQ,iCAAA;AAAA,IACR,OAAA,EAAS,IAAA;AAAA,IACT,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,KAAA,EAAO;AAAA,MACL,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACT;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,MAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA;AAAA;AAChD,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,kCAAA,GAA2F;AACzG,EAAA,MAAM,YAAY,mBAAA,EAAoB;AACtC,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,MAAA,EAAQ,iCAAA;AAAA,IACR,OAAA,EAAS,IAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO,MAAM,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAA;AAAA;AAChD,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,+BACd,WAAA,EAGA;AACA,EAAA,IAAI,WAAA,CAAY,WAAW,iCAAA,EAAmC;AAC5D,IAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,mBAAA,GAAsB,WAAA;AAI5B,EAAA,IAAI,mBAAA,CAAoB,YAAY,IAAA,EAAM;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,oBAAoB,OAAO,CAAA;AAAA,KAC3D;AAAA,EACF;AAEA,EAAA,OAAO,mBAAA;AACT;AAEA,SAAS,sBAAA,CACP,KACA,kBAAA,EAC2B;AAC3B,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAA,EAAM,SAAA;AAAA,IACN,OAAA,EAAS,GAAA;AAAA,IACT;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,OAAO,MAAM;AACX,QAAA,IAAI,KAAA,GAAQ,GAAA;AACZ,QAAA,IAAI,kBAAA,EAAoB;AACtB,UAAA,MAAM,IAAA,GAAOA,sBAAA,CAAW,QAAQ,CAAA,CAC7B,OAAO,IAAA,CAAK,SAAA,CAAU,kBAAkB,CAAC,EACzC,MAAA,CAAO,QAAQ,CAAA,CACf,OAAA,CAAQ,OAAO,EAAE,CAAA;AACpB,UAAA,KAAA,IAAS,uBAAuB,IAAI,CAAA,CAAA;AAAA,QACtC;AACA,QAAA,OAAO,oBAAoB,KAAK,CAAA,CAAA,CAAA;AAAA,MAClC;AAAA;AACF,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,mBAAA,CACP,eACA,KAAA,EACwB;AACxB,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAA,EAAM,MAAA;AAAA,IACN,aAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,OAAO,MAAM;AACX,QAAA,IAAI,KAAA,GAAQ,aAAA;AACZ,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,KAAA,IAAS,WAAW,KAAK,CAAA,CAAA,CAAA;AAAA,QAC3B;AACA,QAAA,OAAO,iBAAiB,KAAK,CAAA,CAAA,CAAA;AAAA,MAC/B;AAAA;AACF,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,mBAAA,GAA8C;AACrD,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAA,EAAM;AAAA,GACR;AACA,EAAA,MAAA,CAAO,iBAAiB,MAAA,EAAQ;AAAA,IAC9B,QAAA,EAAU;AAAA,MACR,UAAA,EAAY,KAAA;AAAA,MACZ,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,OAAO,MAAM;AAAA;AACf,GACD,CAAA;AACD,EAAA,OAAO,MAAA;AACT;;;;;;;"}

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js

@@ -118,10 +118,8 @@ class DefaultPluginTokenHandler {
         this.supportedTargetPlugins.add(targetPluginId);
         return true;
       } catch (error) {
-        this.logger.error(
-          "Unexpected failure for target JWKS check",
-          errors.toError(error)
-        );
+        errors.assertError(error);
+        this.logger.error("Unexpected failure for target JWKS check", error);
         return false;
       } finally {
         this.targetPluginInflightChecks.delete(targetPluginId);

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { AuthenticationError, toError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\n/**\n * @public\n * Issues and verifies {@link https://backstage.io/docs/auth/service-to-service-auth | service-to-service tokens}.\n */\nexport interface PluginTokenHandler {\n  verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined>;\n  issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }>;\n}\n\nexport class DefaultPluginTokenHandler implements PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new DefaultPluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private readonly logger: LoggerService;\n  private readonly ownPluginId: string;\n  private readonly keySource: PluginKeySource;\n  private readonly algorithm: string;\n  private readonly keyDurationSeconds: number;\n  private readonly discovery: DiscoveryService;\n\n  private constructor(\n    logger: LoggerService,\n    ownPluginId: string,\n    keySource: PluginKeySource,\n    algorithm: string,\n    keyDurationSeconds: number,\n    discovery: DiscoveryService,\n  ) {\n    this.logger = logger;\n    this.ownPluginId = ownPluginId;\n    this.keySource = keySource;\n    this.algorithm = algorithm;\n    this.keyDurationSeconds = keyDurationSeconds;\n    this.discovery = discovery;\n  }\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      this.logger.warn('Failed to verify incoming plugin token', e);\n      throw new AuthenticationError('Failed plugin token verification');\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.limitedUserToken };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        this.logger.error(\n          'Unexpected failure for target JWKS check',\n          toError(error),\n        );\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","toError","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAA,GAAgB,GAAA;AAEtB,MAAM,yBAAA,GAA4B,gBAAA;AAkC3B,MAAM,yBAAA,CAAwD;AAAA,EAC3D,OAAA,uBAAc,GAAA,EAAwB;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAA,EAAY;AAAA,EACzC,0BAAA,uBAAiC,GAAA,EAA8B;AAAA,EAEvE,OAAO,OAAO,OAAA,EAAkB;AAC9B,IAAA,OAAO,IAAI,yBAAA;AAAA,MACT,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,SAAA;AAAA,MACR,QAAQ,SAAA,IAAa,OAAA;AAAA,MACrB,KAAK,KAAA,CAAMA,4BAAA,CAAuB,OAAA,CAAQ,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEiB,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,SAAA;AAAA,EAET,YACN,MAAA,EACA,WAAA,EACA,SAAA,EACA,SAAA,EACA,oBACA,SAAA,EACA;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,MAAM,YACJ,KAAA,EACqE;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAA,IAAI,GAAA,KAAQC,yBAAA,CAAW,MAAA,CAAO,QAAA,EAAU;AACtC,QAAA,OAAO,KAAA,CAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAOC,cAAA,CAAU,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAA,MAAM,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAA,CAAW,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAA,CAAO,QAAA;AAAA,QACvB,UAAU,IAAA,CAAK,WAAA;AAAA,QACf,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAA,CAAA,KAAK;AACX,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,wCAAA,EAA0C,CAAC,CAAA;AAC5D,MAAA,MAAM,IAAIE,2BAAoB,kCAAkC,CAAA;AAAA,IAClE,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,SAAS,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,gBAAA,EAAkB,QAAQ,GAAA,EAAI;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,OAAA,EAIc;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAA,EAAgB,UAAA,EAAW,GAAI,OAAA;AACjD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,oBAAA,EAAqB;AAEtD,IAAA,MAAM,GAAA,GAAM,QAAA;AACZ,IAAA,MAAM,GAAA,GAAM,cAAA;AACZ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,kBAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,aACR,IAAA,CAAK,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAA,KAAY,aAAa;AAAA,KAC3D,GACA,MAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,YAAY,gBAAA,EAAiB;AACvE,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAA,CAAQ,MAAM,EACnC,kBAAA,CAAmB;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAA,CAAO,QAAA;AAAA,MACvB,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,KAAK,GAAA,CAAI;AAAA,KACV,CAAA,CACA,WAAA,CAAY,GAAG,CAAA,CACf,UAAA,CAAW,GAAG,CAAA,CACd,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAA,EAAM;AAAA,EACjB;AAAA,EAEA,MAAc,wBACZ,cAAA,EACkB;AAClB,IAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,GAAA,CAAI,cAAc,CAAA,EAAG;AACnD,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,UAAA,OAAO,KAAA;AAAA,QACT;AAEA,QAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,QAC5D;AAEA,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,UAAA,MAAM,IAAI,MAAM,CAAA,wCAAA,CAA0C,CAAA;AAAA,QAC5D;AAEA,QAAA,IAAA,CAAK,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,UACV,0CAAA;AAAA,UACAC,eAAQ,KAAK;AAAA,SACf;AACA,QAAA,OAAO,KAAA;AAAA,MACT,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,IAAA,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAAA,EAAkB;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,MAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,uBAAA,CAAwB,QAAQ,CAAA,EAAI;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,SAAS,CAAA;AACpC,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { assertError, AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\n/**\n * @public\n * Issues and verifies {@link https://backstage.io/docs/auth/service-to-service-auth | service-to-service tokens}.\n */\nexport interface PluginTokenHandler {\n  verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined>;\n  issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }>;\n}\n\nexport class DefaultPluginTokenHandler implements PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new DefaultPluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private readonly logger: LoggerService;\n  private readonly ownPluginId: string;\n  private readonly keySource: PluginKeySource;\n  private readonly algorithm: string;\n  private readonly keyDurationSeconds: number;\n  private readonly discovery: DiscoveryService;\n\n  private constructor(\n    logger: LoggerService,\n    ownPluginId: string,\n    keySource: PluginKeySource,\n    algorithm: string,\n    keyDurationSeconds: number,\n    discovery: DiscoveryService,\n  ) {\n    this.logger = logger;\n    this.ownPluginId = ownPluginId;\n    this.keySource = keySource;\n    this.algorithm = algorithm;\n    this.keyDurationSeconds = keyDurationSeconds;\n    this.discovery = discovery;\n  }\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      this.logger.warn('Failed to verify incoming plugin token', e);\n      throw new AuthenticationError('Failed plugin token verification');\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.limitedUserToken };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        assertError(error);\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","assertError","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAA,GAAgB,GAAA;AAEtB,MAAM,yBAAA,GAA4B,gBAAA;AAkC3B,MAAM,yBAAA,CAAwD;AAAA,EAC3D,OAAA,uBAAc,GAAA,EAAwB;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAA,EAAY;AAAA,EACzC,0BAAA,uBAAiC,GAAA,EAA8B;AAAA,EAEvE,OAAO,OAAO,OAAA,EAAkB;AAC9B,IAAA,OAAO,IAAI,yBAAA;AAAA,MACT,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,SAAA;AAAA,MACR,QAAQ,SAAA,IAAa,OAAA;AAAA,MACrB,KAAK,KAAA,CAAMA,4BAAA,CAAuB,OAAA,CAAQ,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEiB,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,SAAA;AAAA,EAET,YACN,MAAA,EACA,WAAA,EACA,SAAA,EACA,SAAA,EACA,oBACA,SAAA,EACA;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA,EAEA,MAAM,YACJ,KAAA,EACqE;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAA,IAAI,GAAA,KAAQC,yBAAA,CAAW,MAAA,CAAO,QAAA,EAAU;AACtC,QAAA,OAAO,KAAA,CAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAOC,cAAA,CAAU,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAA,MAAM,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAA,CAAW,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAA,CAAO,QAAA;AAAA,QACvB,UAAU,IAAA,CAAK,WAAA;AAAA,QACf,cAAA,EAAgB,CAAC,KAAA,EAAO,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAA,CAAA,KAAK;AACX,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,wCAAA,EAA0C,CAAC,CAAA;AAC5D,MAAA,MAAM,IAAIE,2BAAoB,kCAAkC,CAAA;AAAA,IAClE,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,SAAS,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,gBAAA,EAAkB,QAAQ,GAAA,EAAI;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,OAAA,EAIc;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAA,EAAgB,UAAA,EAAW,GAAI,OAAA;AACjD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,oBAAA,EAAqB;AAEtD,IAAA,MAAM,GAAA,GAAM,QAAA;AACZ,IAAA,MAAM,GAAA,GAAM,cAAA;AACZ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,kBAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,aACR,IAAA,CAAK,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAA,KAAY,aAAa;AAAA,KAC3D,GACA,MAAA;AAEJ,IAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,YAAY,gBAAA,EAAiB;AACvE,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAA,CAAQ,MAAM,EACnC,kBAAA,CAAmB;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAA,CAAO,QAAA;AAAA,MACvB,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,KAAK,GAAA,CAAI;AAAA,KACV,CAAA,CACA,WAAA,CAAY,GAAG,CAAA,CACf,UAAA,CAAW,GAAG,CAAA,CACd,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAA,EAAM;AAAA,EACjB;AAAA,EAEA,MAAc,wBACZ,cAAA,EACkB;AAClB,IAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,GAAA,CAAI,cAAc,CAAA,EAAG;AACnD,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,UAAA,OAAO,KAAA;AAAA,QACT;AAEA,QAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,QAC5D;AAEA,QAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,UAAA,MAAM,IAAI,MAAM,CAAA,wCAAA,CAA0C,CAAA;AAAA,QAC5D;AAEA,QAAA,IAAA,CAAK,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAAC,kBAAA,CAAY,KAAK,CAAA;AACjB,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAA,OAAO,KAAA;AAAA,MACT,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,IAAA,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAAA,EAAkB;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAO,MAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,uBAAA,CAAwB,QAAQ,CAAA,EAAI;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,SAAS,CAAA;AACpC,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}

package/dist/entrypoints/discovery/HostDiscovery.cjs.js

@@ -16,20 +16,6 @@ class HostDiscovery {
     throw new Error("Not initialized");
   };
   static fromConfig(config, options) {
-    const baseUrl = config.getString("backend.baseUrl");
-    try {
-      const { hostname } = new URL(baseUrl);
-      const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "::";
-      if (isLocalhost && process.env.NODE_ENV === "production") {
-        options?.logger?.warn(
-          `backend.baseUrl is set to a localhost URL and NODE_ENV is '${process.env.NODE_ENV}'. This is likely a misconfiguration \u2014 localhost URLs are not reachable by other services in a deployed environment. Prefer setting it to a routable URL that can be resolved and reached both by your app and by other plugin deployments / services.`
-        );
-      }
-    } catch {
-      options?.logger?.warn(
-        `backend.baseUrl config value '${baseUrl}' does not appear to be a valid URL.`
-      );
-    }
     const discovery = new HostDiscovery(new SrvResolvers.SrvResolvers());
     discovery.#updateResolvers(config, options?.defaultEndpoints);
     config.subscribe?.(() => {