@backstage/backend-defaults 0.17.7 → 0.17.8

package/dist/entrypoints/urlReader/lib/AwsCodeCommitUrlReader.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"AwsCodeCommitUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/AwsCodeCommitUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ReaderFactory, ReadTreeResponseFactory } from './types';\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeOptions,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport {\n  AwsCredentialsManager,\n  DefaultAwsCredentialsManager,\n} from '@backstage/integration-aws-node';\nimport {\n  AwsCodeCommitIntegration,\n  ScmIntegrations,\n} from '@backstage/integration';\nimport { toError, ForwardedError, NotModifiedError } from '@backstage/errors';\nimport { fromTemporaryCredentials } from '@aws-sdk/credential-providers';\nimport {\n  CodeCommitClient,\n  GetFileCommand,\n  GetFileCommandInput,\n  GetFileCommandOutput,\n  GetFolderCommand,\n} from '@aws-sdk/client-codecommit';\nimport { AwsCredentialIdentityProvider } from '@aws-sdk/types';\nimport { Readable } from 'node:stream';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { relative } from 'node:path/posix';\nimport { AbortController } from '@aws-sdk/abort-controller';\n\nexport function parseUrl(\n  url: string,\n  requireGitPath: boolean = false,\n): {\n  path: string;\n  repositoryName: string;\n  region: string;\n  commitSpecifier?: string;\n} {\n  const parsedUrl = new URL(url);\n\n  if (parsedUrl.pathname.includes('/files/edit/')) {\n    throw new Error(\n      'Please provide the view url to yaml file from CodeCommit, not the edit url',\n    );\n  }\n  if (requireGitPath && !parsedUrl.pathname.includes('/browse/')) {\n    throw new Error('Please provide full path to yaml file from CodeCommit');\n  }\n\n  const hostMatch = parsedUrl.host.match(\n    /^([^\\.]+)\\.console\\.aws\\.amazon\\.com$/,\n  );\n  if (!hostMatch) {\n    throw new Error(\n      `Invalid AWS CodeCommit URL (unexpected host format): ${url}`,\n    );\n  }\n  const [, region] = hostMatch;\n\n  const pathMatch = parsedUrl.pathname.match(\n    /^\\/codesuite\\/codecommit\\/repositories\\/([^\\/]+)\\/browse\\/((.*)\\/)?--\\/(.*)$/,\n  );\n\n  if (!pathMatch) {\n    if (!requireGitPath) {\n      const pathname = parsedUrl.pathname\n        .split('/--/')[0]\n        .replace('/codesuite/codecommit/repositories/', '');\n      const [repositoryName, commitSpecifier] = pathname.split('/browse');\n\n      return {\n        region,\n        repositoryName: repositoryName.replace(/^\\/|\\/$/g, ''),\n        path: '/',\n        commitSpecifier:\n          commitSpecifier === ''\n            ? undefined\n            : commitSpecifier?.replace(/^\\/|\\/$/g, ''),\n      };\n    }\n    throw new Error(\n      `Invalid AWS CodeCommit URL (unexpected path format): ${url}`,\n    );\n  }\n  const [, repositoryName, , commitSpecifier, path] = pathMatch;\n\n  return {\n    region,\n    repositoryName,\n    path,\n    // the commitSpecifier is passed to AWS SDK which does not allow empty strings so replace empty string with undefined\n    commitSpecifier: commitSpecifier === '' ? undefined : commitSpecifier,\n  };\n}\n\n/**\n * Implements a {@link @backstage/backend-plugin-api#UrlReaderService} for AWS CodeCommit.\n *\n * @public\n */\nexport class AwsCodeCommitUrlReader implements UrlReaderService {\n  static factory: ReaderFactory = ({ config, treeResponseFactory }) => {\n    const integrations = ScmIntegrations.fromConfig(config);\n    const credsManager = DefaultAwsCredentialsManager.fromConfig(config);\n\n    return integrations.awsCodeCommit.list().map(integration => {\n      const reader = new AwsCodeCommitUrlReader(credsManager, integration, {\n        treeResponseFactory,\n      });\n      const predicate = (url: URL) => {\n        return (\n          url.host.endsWith(integration.config.host) &&\n          url.pathname.startsWith('/codesuite/codecommit')\n        );\n      };\n\n      return { reader, predicate };\n    });\n  };\n\n  private readonly credsManager: AwsCredentialsManager;\n  private readonly integration: AwsCodeCommitIntegration;\n  private readonly deps: {\n    treeResponseFactory: ReadTreeResponseFactory;\n  };\n\n  constructor(\n    credsManager: AwsCredentialsManager,\n    integration: AwsCodeCommitIntegration,\n    deps: {\n      treeResponseFactory: ReadTreeResponseFactory;\n    },\n  ) {\n    this.credsManager = credsManager;\n    this.integration = integration;\n    this.deps = deps;\n  }\n\n  /**\n   * If accessKeyId and secretAccessKey are missing, the standard credentials provider chain will be used:\n   * https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.html\n   */\n  private static buildStaticCredentials(\n    accessKeyId: string,\n    secretAccessKey: string,\n  ): AwsCredentialIdentityProvider {\n    return async () => {\n      return {\n        accessKeyId,\n        secretAccessKey,\n      };\n    };\n  }\n\n  private static async buildCredentials(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration?: AwsCodeCommitIntegration,\n  ): Promise<AwsCredentialIdentityProvider> {\n    // Fall back to the default credential chain if neither account ID\n    // nor explicit credentials are provided\n    if (!integration) {\n      return (await credsManager.getCredentialProvider()).sdkCredentialProvider;\n    }\n\n    const accessKeyId = integration.config.accessKeyId;\n    const secretAccessKey = integration.config.secretAccessKey;\n    let explicitCredentials: AwsCredentialIdentityProvider;\n    if (accessKeyId && secretAccessKey) {\n      explicitCredentials = AwsCodeCommitUrlReader.buildStaticCredentials(\n        accessKeyId,\n        secretAccessKey,\n      );\n    } else {\n      explicitCredentials = (await credsManager.getCredentialProvider())\n        .sdkCredentialProvider;\n    }\n\n    const roleArn = integration.config.roleArn;\n    if (roleArn) {\n      return fromTemporaryCredentials({\n        masterCredentials: explicitCredentials,\n        params: {\n          RoleSessionName: 'backstage-aws-code-commit-url-reader',\n          RoleArn: roleArn,\n          ExternalId: integration.config.externalId,\n        },\n        clientConfig: { region },\n      });\n    }\n\n    return explicitCredentials;\n  }\n\n  private async buildCodeCommitClient(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration: AwsCodeCommitIntegration,\n  ): Promise<CodeCommitClient> {\n    const credentials = await AwsCodeCommitUrlReader.buildCredentials(\n      credsManager,\n      region,\n      integration,\n    );\n\n    const codeCommit = new CodeCommitClient({\n      customUserAgent: 'backstage-aws-codecommit-url-reader',\n      region: region,\n      credentials: credentials,\n    });\n    return codeCommit;\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    // etag and lastModifiedAfter are not supported by the CodeCommit API\n    try {\n      const { path, repositoryName, region, commitSpecifier } = parseUrl(\n        url,\n        true,\n      );\n      const codeCommitClient = await this.buildCodeCommitClient(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n      const abortController = new AbortController();\n\n      const input: GetFileCommandInput = {\n        repositoryName: repositoryName,\n        commitSpecifier: commitSpecifier,\n        filePath: path,\n      };\n\n      options?.signal?.addEventListener('abort', () => abortController.abort());\n      const getObjectCommand = new GetFileCommand(input);\n      const response: GetFileCommandOutput = await codeCommitClient.send(\n        getObjectCommand,\n        {\n          abortSignal: abortController.signal,\n        },\n      );\n\n      if (options?.etag && options.etag === response.commitId) {\n        throw new NotModifiedError();\n      }\n\n      return ReadUrlResponseFactory.fromReadable(\n        Readable.from([response?.fileContent]),\n        {\n          etag: response.commitId,\n        },\n      );\n    } catch (e) {\n      if (e.$metadata && e.$metadata.httpStatusCode === 304) {\n        throw new NotModifiedError();\n      }\n      if (e.name && e.name === 'NotModifiedError') {\n        throw new NotModifiedError();\n      }\n\n      throw new ForwardedError('Could not retrieve file from CodeCommit', e);\n    }\n  }\n\n  async readTreePath(\n    codeCommitClient: CodeCommitClient,\n    abortSignal: any,\n    path: string,\n    repositoryName: string,\n    commitSpecifier?: string,\n    etag?: string,\n  ): Promise<string[]> {\n    const getFolderCommand = new GetFolderCommand({\n      folderPath: path,\n      repositoryName: repositoryName,\n      commitSpecifier: commitSpecifier,\n    });\n    const response = await codeCommitClient.send(getFolderCommand, {\n      abortSignal: abortSignal,\n    });\n\n    if (etag && etag === response.commitId) {\n      throw new NotModifiedError();\n    }\n\n    const output: string[] = [];\n    if (response.files) {\n      response.files.forEach(file => {\n        if (file.absolutePath) {\n          output.push(file.absolutePath);\n        }\n      });\n    }\n    if (!response.subFolders) {\n      return output;\n    }\n\n    for (const subFolder of response.subFolders) {\n      if (subFolder.absolutePath) {\n        output.push(\n          ...(await this.readTreePath(\n            codeCommitClient,\n            abortSignal,\n            subFolder.absolutePath,\n            repositoryName,\n            commitSpecifier,\n            etag,\n          )),\n        );\n      }\n    }\n    return output;\n  }\n\n  async readTree(\n    url: string,\n    options?: UrlReaderServiceReadTreeOptions,\n  ): Promise<UrlReaderServiceReadTreeResponse> {\n    // url: https://eu-west-1.console.aws.amazon.com/codesuite/codecommit/repositories/test-stijn-delete-techdocs/browse?region=eu-west-1\n    try {\n      const { path, repositoryName, region, commitSpecifier } = parseUrl(url);\n      const codeCommitClient = await this.buildCodeCommitClient(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n\n      const abortController = new AbortController();\n      options?.signal?.addEventListener('abort', () => abortController.abort());\n\n      const allFiles: string[] = await this.readTreePath(\n        codeCommitClient,\n        abortController.signal,\n        path,\n        repositoryName,\n        commitSpecifier,\n        options?.etag,\n      );\n      const responses = [];\n\n      for (let i = 0; i < allFiles.length; i++) {\n        const getFileCommand = new GetFileCommand({\n          repositoryName: repositoryName,\n          filePath: String(allFiles[i]),\n          commitSpecifier: commitSpecifier,\n        });\n        const response = await codeCommitClient.send(getFileCommand);\n        const objectData = await Readable.from([response?.fileContent]);\n\n        responses.push({\n          data: objectData,\n          path: relative(\n            path.startsWith('/') ? path : `/${path}`,\n            allFiles[i].startsWith('/') ? allFiles[i] : `/${allFiles[i]}`,\n          ),\n        });\n      }\n\n      return await this.deps.treeResponseFactory.fromReadableArray(responses);\n    } catch (e) {\n      if (e.name && e.name === 'NotModifiedError') {\n        throw new NotModifiedError();\n      }\n      throw new ForwardedError(\n        'Could not retrieve file tree from CodeCommit',\n        e,\n      );\n    }\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { path } = parseUrl(url, true);\n\n    if (path.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      const error = toError(e);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    const secretAccessKey = this.integration.config.secretAccessKey;\n    return `awsCodeCommit{host=${this.integration.config.host},authed=${Boolean(\n      secretAccessKey,\n    )}}`;\n  }\n}\n"],"names":["repositoryName","commitSpecifier","ScmIntegrations","DefaultAwsCredentialsManager","fromTemporaryCredentials","CodeCommitClient","abortController","AbortController","GetFileCommand","NotModifiedError","ReadUrlResponseFactory","Readable","ForwardedError","GetFolderCommand","relative","toError"],"mappings":";;;;;;;;;;;;AAiDO,SAAS,QAAA,CACd,GAAA,EACA,cAAA,GAA0B,KAAA,EAM1B;AACA,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAE7B,EAAA,IAAI,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,cAAc,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,kBAAkB,CAAC,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,UAAU,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,SAAA,GAAY,UAAU,IAAA,CAAK,KAAA;AAAA,IAC/B;AAAA,GACF;AACA,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wDAAwD,GAAG,CAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,GAAG,MAAM,CAAA,GAAI,SAAA;AAEnB,EAAA,MAAM,SAAA,GAAY,UAAU,QAAA,CAAS,KAAA;AAAA,IACnC;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,QAAA,CACxB,KAAA,CAAM,MAAM,EAAE,CAAC,CAAA,CACf,OAAA,CAAQ,qCAAA,EAAuC,EAAE,CAAA;AACpD,MAAA,MAAM,CAACA,eAAAA,EAAgBC,gBAAe,CAAA,GAAI,QAAA,CAAS,MAAM,SAAS,CAAA;AAElE,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,cAAA,EAAgBD,eAAAA,CAAe,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAAA,QACrD,IAAA,EAAM,GAAA;AAAA,QACN,iBACEC,gBAAAA,KAAoB,EAAA,GAChB,SACAA,gBAAAA,EAAiB,OAAA,CAAQ,YAAY,EAAE;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wDAAwD,GAAG,CAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,GAAG,cAAA,IAAkB,eAAA,EAAiB,IAAI,CAAA,GAAI,SAAA;AAEpD,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,cAAA;AAAA,IACA,IAAA;AAAA;AAAA,IAEA,eAAA,EAAiB,eAAA,KAAoB,EAAA,GAAK,MAAA,GAAY;AAAA,GACxD;AACF;AAOO,MAAM,sBAAA,CAAmD;AAAA,EAC9D,OAAO,OAAA,GAAyB,CAAC,EAAE,MAAA,EAAQ,qBAAoB,KAAM;AACnE,IAAA,MAAM,YAAA,GAAeC,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AACtD,IAAA,MAAM,YAAA,GAAeC,+CAAA,CAA6B,UAAA,CAAW,MAAM,CAAA;AAEnE,IAAA,OAAO,YAAA,CAAa,aAAA,CAAc,IAAA,EAAK,CAAE,IAAI,CAAA,WAAA,KAAe;AAC1D,MAAA,MAAM,MAAA,GAAS,IAAI,sBAAA,CAAuB,YAAA,EAAc,WAAA,EAAa;AAAA,QACnE;AAAA,OACD,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KAAa;AAC9B,QAAA,OACE,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,IACzC,GAAA,CAAI,QAAA,CAAS,UAAA,CAAW,uBAAuB,CAAA;AAAA,MAEnD,CAAA;AAEA,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEiB,YAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EAIjB,WAAA,CACE,YAAA,EACA,WAAA,EACA,IAAA,EAGA;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAe,sBAAA,CACb,WAAA,EACA,eAAA,EAC+B;AAC/B,IAAA,OAAO,YAAY;AACjB,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEA,aAAqB,gBAAA,CACnB,YAAA,EACA,MAAA,EACA,WAAA,EACwC;AAGxC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAA,CAAQ,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAAG,qBAAA;AAAA,IACtD;AAEA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAA,CAAO,WAAA;AACvC,IAAA,MAAM,eAAA,GAAkB,YAAY,MAAA,CAAO,eAAA;AAC3C,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,MAAA,mBAAA,GAAsB,sBAAA,CAAuB,sBAAA;AAAA,QAC3C,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,mBAAA,GAAA,CAAuB,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAC7D,qBAAA;AAAA,IACL;AAEA,IAAA,MAAM,OAAA,GAAU,YAAY,MAAA,CAAO,OAAA;AACnC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAOC,4CAAA,CAAyB;AAAA,QAC9B,iBAAA,EAAmB,mBAAA;AAAA,QACnB,MAAA,EAAQ;AAAA,UACN,eAAA,EAAiB,sCAAA;AAAA,UACjB,OAAA,EAAS,OAAA;AAAA,UACT,UAAA,EAAY,YAAY,MAAA,CAAO;AAAA,SACjC;AAAA,QACA,YAAA,EAAc,EAAE,MAAA;AAAO,OACxB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,mBAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAA,CACZ,YAAA,EACA,MAAA,EACA,WAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,MAAM,sBAAA,CAAuB,gBAAA;AAAA,MAC/C,YAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,UAAA,GAAa,IAAIC,iCAAA,CAAiB;AAAA,MACtC,eAAA,EAAiB,qCAAA;AAAA,MACjB,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,UAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAE1C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,cAAA,EAAgB,MAAA,EAAQ,iBAAgB,GAAI,QAAA;AAAA,QACxD,GAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,gBAAA,GAAmB,MAAM,IAAA,CAAK,qBAAA;AAAA,QAClC,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,MAAMC,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAE5C,MAAA,MAAM,KAAA,GAA6B;AAAA,QACjC,cAAA;AAAA,QACA,eAAA;AAAA,QACA,QAAA,EAAU;AAAA,OACZ;AAEA,MAAA,OAAA,EAAS,QAAQ,gBAAA,CAAiB,OAAA,EAAS,MAAMD,iBAAA,CAAgB,OAAO,CAAA;AACxE,MAAA,MAAM,gBAAA,GAAmB,IAAIE,+BAAA,CAAe,KAAK,CAAA;AACjD,MAAA,MAAM,QAAA,GAAiC,MAAM,gBAAA,CAAiB,IAAA;AAAA,QAC5D,gBAAA;AAAA,QACA;AAAA,UACE,aAAaF,iBAAA,CAAgB;AAAA;AAC/B,OACF;AAEA,MAAA,IAAI,OAAA,EAAS,IAAA,IAAQ,OAAA,CAAQ,IAAA,KAAS,SAAS,QAAA,EAAU;AACvD,QAAA,MAAM,IAAIG,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,OAAOC,6CAAA,CAAuB,YAAA;AAAA,QAC5BC,oBAAA,CAAS,IAAA,CAAK,CAAC,QAAA,EAAU,WAAW,CAAC,CAAA;AAAA,QACrC;AAAA,UACE,MAAM,QAAA,CAAS;AAAA;AACjB,OACF;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,SAAA,IAAa,CAAA,CAAE,SAAA,CAAU,mBAAmB,GAAA,EAAK;AACrD,QAAA,MAAM,IAAIF,uBAAA,EAAiB;AAAA,MAC7B;AACA,MAAA,IAAI,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,kBAAA,EAAoB;AAC3C,QAAA,MAAM,IAAIA,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,IAAIG,qBAAA,CAAe,yCAAA,EAA2C,CAAC,CAAA;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,YAAA,CACJ,gBAAA,EACA,aACA,IAAA,EACA,cAAA,EACA,iBACA,IAAA,EACmB;AACnB,IAAA,MAAM,gBAAA,GAAmB,IAAIC,iCAAA,CAAiB;AAAA,MAC5C,UAAA,EAAY,IAAA;AAAA,MACZ,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB,IAAA,CAAK,gBAAA,EAAkB;AAAA,MAC7D;AAAA,KACD,CAAA;AAED,IAAA,IAAI,IAAA,IAAQ,IAAA,KAAS,QAAA,CAAS,QAAA,EAAU;AACtC,MAAA,MAAM,IAAIJ,uBAAA,EAAiB;AAAA,IAC7B;AAEA,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,QAAA,CAAS,KAAA,CAAM,QAAQ,CAAA,IAAA,KAAQ;AAC7B,QAAA,IAAI,KAAK,YAAA,EAAc;AACrB,UAAA,MAAA,CAAO,IAAA,CAAK,KAAK,YAAY,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAAA,IACH;AACA,IAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,SAAA,IAAa,SAAS,UAAA,EAAY;AAC3C,MAAA,IAAI,UAAU,YAAA,EAAc;AAC1B,QAAA,MAAA,CAAO,IAAA;AAAA,UACL,GAAI,MAAM,IAAA,CAAK,YAAA;AAAA,YACb,gBAAA;AAAA,YACA,WAAA;AAAA,YACA,SAAA,CAAU,YAAA;AAAA,YACV,cAAA;AAAA,YACA,eAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAA,CACJ,GAAA,EACA,OAAA,EAC2C;AAE3C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAQ,eAAA,EAAgB,GAAI,SAAS,GAAG,CAAA;AACtE,MAAA,MAAM,gBAAA,GAAmB,MAAM,IAAA,CAAK,qBAAA;AAAA,QAClC,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AAEA,MAAA,MAAMH,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAC5C,MAAA,OAAA,EAAS,QAAQ,gBAAA,CAAiB,OAAA,EAAS,MAAMD,iBAAA,CAAgB,OAAO,CAAA;AAExE,MAAA,MAAM,QAAA,GAAqB,MAAM,IAAA,CAAK,YAAA;AAAA,QACpC,gBAAA;AAAA,QACAA,iBAAA,CAAgB,MAAA;AAAA,QAChB,IAAA;AAAA,QACA,cAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AACA,MAAA,MAAM,YAAY,EAAC;AAEnB,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,QAAA,MAAM,cAAA,GAAiB,IAAIE,+BAAA,CAAe;AAAA,UACxC,cAAA;AAAA,UACA,QAAA,EAAU,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,UAC5B;AAAA,SACD,CAAA;AACD,QAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB,IAAA,CAAK,cAAc,CAAA;AAC3D,QAAA,MAAM,aAAa,MAAMG,oBAAA,CAAS,KAAK,CAAC,QAAA,EAAU,WAAW,CAAC,CAAA;AAE9D,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,IAAA,EAAM,UAAA;AAAA,UACN,IAAA,EAAMG,cAAA;AAAA,YACJ,KAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAAA,YACtC,QAAA,CAAS,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,GAAI,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,CAAA,EAAI,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA;AAC7D,SACD,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoB,kBAAkB,SAAS,CAAA;AAAA,IACxE,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,kBAAA,EAAoB;AAC3C,QAAA,MAAM,IAAIL,uBAAA,EAAiB;AAAA,MAC7B;AACA,MAAA,MAAM,IAAIG,qBAAA;AAAA,QACR,8CAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,QAAA,CAAS,KAAK,IAAI,CAAA;AAEnC,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAA,GAAQG,eAAQ,CAAC,CAAA;AACvB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,eAAA;AAChD,IAAA,OAAO,CAAA,mBAAA,EAAsB,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,QAAA,EAAW,OAAA;AAAA,MAClE;AAAA,KACD,CAAA,CAAA,CAAA;AAAA,EACH;AACF;;;;;"}
+{"version":3,"file":"AwsCodeCommitUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/AwsCodeCommitUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ReaderFactory, ReadTreeResponseFactory } from './types';\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeOptions,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport {\n  AwsCredentialsManager,\n  DefaultAwsCredentialsManager,\n} from '@backstage/integration-aws-node';\nimport {\n  AwsCodeCommitIntegration,\n  ScmIntegrations,\n} from '@backstage/integration';\nimport { toError, ForwardedError, NotModifiedError } from '@backstage/errors';\nimport { fromTemporaryCredentials } from '@aws-sdk/credential-providers';\nimport {\n  CodeCommitClient,\n  GetFileCommand,\n  GetFileCommandInput,\n  GetFileCommandOutput,\n  GetFolderCommand,\n} from '@aws-sdk/client-codecommit';\nimport { AwsCredentialIdentityProvider } from '@aws-sdk/types';\nimport { Readable } from 'node:stream';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { relative } from 'node:path/posix';\nimport { AbortController } from '@aws-sdk/abort-controller';\nimport { hasDotPathSegments } from './util';\n\nexport function parseUrl(\n  url: string,\n  requireGitPath: boolean = false,\n): {\n  path: string;\n  repositoryName: string;\n  region: string;\n  commitSpecifier?: string;\n} {\n  const parsedUrl = new URL(url);\n\n  if (parsedUrl.pathname.includes('/files/edit/')) {\n    throw new Error(\n      'Please provide the view url to yaml file from CodeCommit, not the edit url',\n    );\n  }\n  if (requireGitPath && !parsedUrl.pathname.includes('/browse/')) {\n    throw new Error('Please provide full path to yaml file from CodeCommit');\n  }\n\n  const hostMatch = parsedUrl.host.match(\n    /^([^\\.]+)\\.console\\.aws\\.amazon\\.com$/,\n  );\n  if (!hostMatch) {\n    throw new Error(\n      `Invalid AWS CodeCommit URL (unexpected host format): ${url}`,\n    );\n  }\n  const [, region] = hostMatch;\n\n  const pathMatch = parsedUrl.pathname.match(\n    /^\\/codesuite\\/codecommit\\/repositories\\/([^\\/]+)\\/browse\\/((.*)\\/)?--\\/(.*)$/,\n  );\n\n  if (!pathMatch) {\n    if (!requireGitPath) {\n      const pathname = parsedUrl.pathname\n        .split('/--/')[0]\n        .replace('/codesuite/codecommit/repositories/', '');\n      const [repositoryName, commitSpecifier] = pathname.split('/browse');\n\n      return {\n        region,\n        repositoryName: repositoryName.replace(/^\\/|\\/$/g, ''),\n        path: '/',\n        commitSpecifier:\n          commitSpecifier === ''\n            ? undefined\n            : commitSpecifier?.replace(/^\\/|\\/$/g, ''),\n      };\n    }\n    throw new Error(\n      `Invalid AWS CodeCommit URL (unexpected path format): ${url}`,\n    );\n  }\n  const [, repositoryName, , commitSpecifier, path] = pathMatch;\n\n  return {\n    region,\n    repositoryName,\n    path,\n    // the commitSpecifier is passed to AWS SDK which does not allow empty strings so replace empty string with undefined\n    commitSpecifier: commitSpecifier === '' ? undefined : commitSpecifier,\n  };\n}\n\n/**\n * Implements a {@link @backstage/backend-plugin-api#UrlReaderService} for AWS CodeCommit.\n *\n * @public\n */\nexport class AwsCodeCommitUrlReader implements UrlReaderService {\n  static factory: ReaderFactory = ({ config, treeResponseFactory }) => {\n    const integrations = ScmIntegrations.fromConfig(config);\n    const credsManager = DefaultAwsCredentialsManager.fromConfig(config);\n\n    return integrations.awsCodeCommit.list().map(integration => {\n      const reader = new AwsCodeCommitUrlReader(credsManager, integration, {\n        treeResponseFactory,\n      });\n      const predicate = (url: URL) => {\n        return (\n          url.host.endsWith(integration.config.host) &&\n          url.pathname.startsWith('/codesuite/codecommit')\n        );\n      };\n\n      return { reader, predicate };\n    });\n  };\n\n  private readonly credsManager: AwsCredentialsManager;\n  private readonly integration: AwsCodeCommitIntegration;\n  private readonly deps: {\n    treeResponseFactory: ReadTreeResponseFactory;\n  };\n\n  constructor(\n    credsManager: AwsCredentialsManager,\n    integration: AwsCodeCommitIntegration,\n    deps: {\n      treeResponseFactory: ReadTreeResponseFactory;\n    },\n  ) {\n    this.credsManager = credsManager;\n    this.integration = integration;\n    this.deps = deps;\n  }\n\n  /**\n   * If accessKeyId and secretAccessKey are missing, the standard credentials provider chain will be used:\n   * https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.html\n   */\n  private static buildStaticCredentials(\n    accessKeyId: string,\n    secretAccessKey: string,\n  ): AwsCredentialIdentityProvider {\n    return async () => {\n      return {\n        accessKeyId,\n        secretAccessKey,\n      };\n    };\n  }\n\n  private static async buildCredentials(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration?: AwsCodeCommitIntegration,\n  ): Promise<AwsCredentialIdentityProvider> {\n    // Fall back to the default credential chain if neither account ID\n    // nor explicit credentials are provided\n    if (!integration) {\n      return (await credsManager.getCredentialProvider()).sdkCredentialProvider;\n    }\n\n    const accessKeyId = integration.config.accessKeyId;\n    const secretAccessKey = integration.config.secretAccessKey;\n    let explicitCredentials: AwsCredentialIdentityProvider;\n    if (accessKeyId && secretAccessKey) {\n      explicitCredentials = AwsCodeCommitUrlReader.buildStaticCredentials(\n        accessKeyId,\n        secretAccessKey,\n      );\n    } else {\n      explicitCredentials = (await credsManager.getCredentialProvider())\n        .sdkCredentialProvider;\n    }\n\n    const roleArn = integration.config.roleArn;\n    if (roleArn) {\n      return fromTemporaryCredentials({\n        masterCredentials: explicitCredentials,\n        params: {\n          RoleSessionName: 'backstage-aws-code-commit-url-reader',\n          RoleArn: roleArn,\n          ExternalId: integration.config.externalId,\n        },\n        clientConfig: { region },\n      });\n    }\n\n    return explicitCredentials;\n  }\n\n  private async buildCodeCommitClient(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration: AwsCodeCommitIntegration,\n  ): Promise<CodeCommitClient> {\n    const credentials = await AwsCodeCommitUrlReader.buildCredentials(\n      credsManager,\n      region,\n      integration,\n    );\n\n    const codeCommit = new CodeCommitClient({\n      customUserAgent: 'backstage-aws-codecommit-url-reader',\n      region: region,\n      credentials: credentials,\n    });\n    return codeCommit;\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    // etag and lastModifiedAfter are not supported by the CodeCommit API\n    try {\n      const { path, repositoryName, region, commitSpecifier } = parseUrl(\n        url,\n        true,\n      );\n      const codeCommitClient = await this.buildCodeCommitClient(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n      const abortController = new AbortController();\n\n      const input: GetFileCommandInput = {\n        repositoryName: repositoryName,\n        commitSpecifier: commitSpecifier,\n        filePath: path,\n      };\n\n      options?.signal?.addEventListener('abort', () => abortController.abort());\n      const getObjectCommand = new GetFileCommand(input);\n      const response: GetFileCommandOutput = await codeCommitClient.send(\n        getObjectCommand,\n        {\n          abortSignal: abortController.signal,\n        },\n      );\n\n      if (options?.etag && options.etag === response.commitId) {\n        throw new NotModifiedError();\n      }\n\n      return ReadUrlResponseFactory.fromReadable(\n        Readable.from([response?.fileContent]),\n        {\n          etag: response.commitId,\n        },\n      );\n    } catch (e) {\n      if (e.$metadata && e.$metadata.httpStatusCode === 304) {\n        throw new NotModifiedError();\n      }\n      if (e.name && e.name === 'NotModifiedError') {\n        throw new NotModifiedError();\n      }\n\n      throw new ForwardedError('Could not retrieve file from CodeCommit', e);\n    }\n  }\n\n  async readTreePath(\n    codeCommitClient: CodeCommitClient,\n    abortSignal: any,\n    path: string,\n    repositoryName: string,\n    commitSpecifier?: string,\n    etag?: string,\n  ): Promise<string[]> {\n    const getFolderCommand = new GetFolderCommand({\n      folderPath: path,\n      repositoryName: repositoryName,\n      commitSpecifier: commitSpecifier,\n    });\n    const response = await codeCommitClient.send(getFolderCommand, {\n      abortSignal: abortSignal,\n    });\n\n    if (etag && etag === response.commitId) {\n      throw new NotModifiedError();\n    }\n\n    const output: string[] = [];\n    if (response.files) {\n      response.files.forEach(file => {\n        if (file.absolutePath) {\n          output.push(file.absolutePath);\n        }\n      });\n    }\n    if (!response.subFolders) {\n      return output;\n    }\n\n    for (const subFolder of response.subFolders) {\n      if (subFolder.absolutePath) {\n        output.push(\n          ...(await this.readTreePath(\n            codeCommitClient,\n            abortSignal,\n            subFolder.absolutePath,\n            repositoryName,\n            commitSpecifier,\n            etag,\n          )),\n        );\n      }\n    }\n    return output;\n  }\n\n  async readTree(\n    url: string,\n    options?: UrlReaderServiceReadTreeOptions,\n  ): Promise<UrlReaderServiceReadTreeResponse> {\n    // url: https://eu-west-1.console.aws.amazon.com/codesuite/codecommit/repositories/test-stijn-delete-techdocs/browse?region=eu-west-1\n    try {\n      const { path, repositoryName, region, commitSpecifier } = parseUrl(url);\n      const codeCommitClient = await this.buildCodeCommitClient(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n\n      const abortController = new AbortController();\n      options?.signal?.addEventListener('abort', () => abortController.abort());\n\n      const allFiles: string[] = await this.readTreePath(\n        codeCommitClient,\n        abortController.signal,\n        path,\n        repositoryName,\n        commitSpecifier,\n        options?.etag,\n      );\n      const responses = [];\n\n      for (let i = 0; i < allFiles.length; i++) {\n        if (hasDotPathSegments(String(allFiles[i]))) {\n          continue;\n        }\n        const getFileCommand = new GetFileCommand({\n          repositoryName: repositoryName,\n          filePath: String(allFiles[i]),\n          commitSpecifier: commitSpecifier,\n        });\n        const response = await codeCommitClient.send(getFileCommand);\n        const objectData = await Readable.from([response?.fileContent]);\n\n        responses.push({\n          data: objectData,\n          path: relative(\n            path.startsWith('/') ? path : `/${path}`,\n            allFiles[i].startsWith('/') ? allFiles[i] : `/${allFiles[i]}`,\n          ),\n        });\n      }\n\n      return await this.deps.treeResponseFactory.fromReadableArray(responses);\n    } catch (e) {\n      if (e.name && e.name === 'NotModifiedError') {\n        throw new NotModifiedError();\n      }\n      throw new ForwardedError(\n        'Could not retrieve file tree from CodeCommit',\n        e,\n      );\n    }\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { path } = parseUrl(url, true);\n\n    if (path.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      const error = toError(e);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    const secretAccessKey = this.integration.config.secretAccessKey;\n    return `awsCodeCommit{host=${this.integration.config.host},authed=${Boolean(\n      secretAccessKey,\n    )}}`;\n  }\n}\n"],"names":["repositoryName","commitSpecifier","ScmIntegrations","DefaultAwsCredentialsManager","fromTemporaryCredentials","CodeCommitClient","abortController","AbortController","GetFileCommand","NotModifiedError","ReadUrlResponseFactory","Readable","ForwardedError","GetFolderCommand","hasDotPathSegments","relative","toError"],"mappings":";;;;;;;;;;;;;AAkDO,SAAS,QAAA,CACd,GAAA,EACA,cAAA,GAA0B,KAAA,EAM1B;AACA,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAE7B,EAAA,IAAI,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,cAAc,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,kBAAkB,CAAC,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,UAAU,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,SAAA,GAAY,UAAU,IAAA,CAAK,KAAA;AAAA,IAC/B;AAAA,GACF;AACA,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wDAAwD,GAAG,CAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,GAAG,MAAM,CAAA,GAAI,SAAA;AAEnB,EAAA,MAAM,SAAA,GAAY,UAAU,QAAA,CAAS,KAAA;AAAA,IACnC;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,QAAA,CACxB,KAAA,CAAM,MAAM,EAAE,CAAC,CAAA,CACf,OAAA,CAAQ,qCAAA,EAAuC,EAAE,CAAA;AACpD,MAAA,MAAM,CAACA,eAAAA,EAAgBC,gBAAe,CAAA,GAAI,QAAA,CAAS,MAAM,SAAS,CAAA;AAElE,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,cAAA,EAAgBD,eAAAA,CAAe,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAAA,QACrD,IAAA,EAAM,GAAA;AAAA,QACN,iBACEC,gBAAAA,KAAoB,EAAA,GAChB,SACAA,gBAAAA,EAAiB,OAAA,CAAQ,YAAY,EAAE;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wDAAwD,GAAG,CAAA;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,GAAG,cAAA,IAAkB,eAAA,EAAiB,IAAI,CAAA,GAAI,SAAA;AAEpD,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,cAAA;AAAA,IACA,IAAA;AAAA;AAAA,IAEA,eAAA,EAAiB,eAAA,KAAoB,EAAA,GAAK,MAAA,GAAY;AAAA,GACxD;AACF;AAOO,MAAM,sBAAA,CAAmD;AAAA,EAC9D,OAAO,OAAA,GAAyB,CAAC,EAAE,MAAA,EAAQ,qBAAoB,KAAM;AACnE,IAAA,MAAM,YAAA,GAAeC,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AACtD,IAAA,MAAM,YAAA,GAAeC,+CAAA,CAA6B,UAAA,CAAW,MAAM,CAAA;AAEnE,IAAA,OAAO,YAAA,CAAa,aAAA,CAAc,IAAA,EAAK,CAAE,IAAI,CAAA,WAAA,KAAe;AAC1D,MAAA,MAAM,MAAA,GAAS,IAAI,sBAAA,CAAuB,YAAA,EAAc,WAAA,EAAa;AAAA,QACnE;AAAA,OACD,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KAAa;AAC9B,QAAA,OACE,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,IACzC,GAAA,CAAI,QAAA,CAAS,UAAA,CAAW,uBAAuB,CAAA;AAAA,MAEnD,CAAA;AAEA,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEiB,YAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EAIjB,WAAA,CACE,YAAA,EACA,WAAA,EACA,IAAA,EAGA;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAe,sBAAA,CACb,WAAA,EACA,eAAA,EAC+B;AAC/B,IAAA,OAAO,YAAY;AACjB,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEA,aAAqB,gBAAA,CACnB,YAAA,EACA,MAAA,EACA,WAAA,EACwC;AAGxC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAA,CAAQ,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAAG,qBAAA;AAAA,IACtD;AAEA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAA,CAAO,WAAA;AACvC,IAAA,MAAM,eAAA,GAAkB,YAAY,MAAA,CAAO,eAAA;AAC3C,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,MAAA,mBAAA,GAAsB,sBAAA,CAAuB,sBAAA;AAAA,QAC3C,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,mBAAA,GAAA,CAAuB,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAC7D,qBAAA;AAAA,IACL;AAEA,IAAA,MAAM,OAAA,GAAU,YAAY,MAAA,CAAO,OAAA;AACnC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAOC,4CAAA,CAAyB;AAAA,QAC9B,iBAAA,EAAmB,mBAAA;AAAA,QACnB,MAAA,EAAQ;AAAA,UACN,eAAA,EAAiB,sCAAA;AAAA,UACjB,OAAA,EAAS,OAAA;AAAA,UACT,UAAA,EAAY,YAAY,MAAA,CAAO;AAAA,SACjC;AAAA,QACA,YAAA,EAAc,EAAE,MAAA;AAAO,OACxB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,mBAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAA,CACZ,YAAA,EACA,MAAA,EACA,WAAA,EAC2B;AAC3B,IAAA,MAAM,WAAA,GAAc,MAAM,sBAAA,CAAuB,gBAAA;AAAA,MAC/C,YAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,UAAA,GAAa,IAAIC,iCAAA,CAAiB;AAAA,MACtC,eAAA,EAAiB,qCAAA;AAAA,MACjB,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,UAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAE1C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,cAAA,EAAgB,MAAA,EAAQ,iBAAgB,GAAI,QAAA;AAAA,QACxD,GAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,gBAAA,GAAmB,MAAM,IAAA,CAAK,qBAAA;AAAA,QAClC,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,MAAMC,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAE5C,MAAA,MAAM,KAAA,GAA6B;AAAA,QACjC,cAAA;AAAA,QACA,eAAA;AAAA,QACA,QAAA,EAAU;AAAA,OACZ;AAEA,MAAA,OAAA,EAAS,QAAQ,gBAAA,CAAiB,OAAA,EAAS,MAAMD,iBAAA,CAAgB,OAAO,CAAA;AACxE,MAAA,MAAM,gBAAA,GAAmB,IAAIE,+BAAA,CAAe,KAAK,CAAA;AACjD,MAAA,MAAM,QAAA,GAAiC,MAAM,gBAAA,CAAiB,IAAA;AAAA,QAC5D,gBAAA;AAAA,QACA;AAAA,UACE,aAAaF,iBAAA,CAAgB;AAAA;AAC/B,OACF;AAEA,MAAA,IAAI,OAAA,EAAS,IAAA,IAAQ,OAAA,CAAQ,IAAA,KAAS,SAAS,QAAA,EAAU;AACvD,QAAA,MAAM,IAAIG,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,OAAOC,6CAAA,CAAuB,YAAA;AAAA,QAC5BC,oBAAA,CAAS,IAAA,CAAK,CAAC,QAAA,EAAU,WAAW,CAAC,CAAA;AAAA,QACrC;AAAA,UACE,MAAM,QAAA,CAAS;AAAA;AACjB,OACF;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,SAAA,IAAa,CAAA,CAAE,SAAA,CAAU,mBAAmB,GAAA,EAAK;AACrD,QAAA,MAAM,IAAIF,uBAAA,EAAiB;AAAA,MAC7B;AACA,MAAA,IAAI,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,kBAAA,EAAoB;AAC3C,QAAA,MAAM,IAAIA,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,IAAIG,qBAAA,CAAe,yCAAA,EAA2C,CAAC,CAAA;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,YAAA,CACJ,gBAAA,EACA,aACA,IAAA,EACA,cAAA,EACA,iBACA,IAAA,EACmB;AACnB,IAAA,MAAM,gBAAA,GAAmB,IAAIC,iCAAA,CAAiB;AAAA,MAC5C,UAAA,EAAY,IAAA;AAAA,MACZ,cAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB,IAAA,CAAK,gBAAA,EAAkB;AAAA,MAC7D;AAAA,KACD,CAAA;AAED,IAAA,IAAI,IAAA,IAAQ,IAAA,KAAS,QAAA,CAAS,QAAA,EAAU;AACtC,MAAA,MAAM,IAAIJ,uBAAA,EAAiB;AAAA,IAC7B;AAEA,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,QAAA,CAAS,KAAA,CAAM,QAAQ,CAAA,IAAA,KAAQ;AAC7B,QAAA,IAAI,KAAK,YAAA,EAAc;AACrB,UAAA,MAAA,CAAO,IAAA,CAAK,KAAK,YAAY,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAAA,IACH;AACA,IAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAA,MAAW,SAAA,IAAa,SAAS,UAAA,EAAY;AAC3C,MAAA,IAAI,UAAU,YAAA,EAAc;AAC1B,QAAA,MAAA,CAAO,IAAA;AAAA,UACL,GAAI,MAAM,IAAA,CAAK,YAAA;AAAA,YACb,gBAAA;AAAA,YACA,WAAA;AAAA,YACA,SAAA,CAAU,YAAA;AAAA,YACV,cAAA;AAAA,YACA,eAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAA,CACJ,GAAA,EACA,OAAA,EAC2C;AAE3C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAQ,eAAA,EAAgB,GAAI,SAAS,GAAG,CAAA;AACtE,MAAA,MAAM,gBAAA,GAAmB,MAAM,IAAA,CAAK,qBAAA;AAAA,QAClC,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AAEA,MAAA,MAAMH,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAC5C,MAAA,OAAA,EAAS,QAAQ,gBAAA,CAAiB,OAAA,EAAS,MAAMD,iBAAA,CAAgB,OAAO,CAAA;AAExE,MAAA,MAAM,QAAA,GAAqB,MAAM,IAAA,CAAK,YAAA;AAAA,QACpC,gBAAA;AAAA,QACAA,iBAAA,CAAgB,MAAA;AAAA,QAChB,IAAA;AAAA,QACA,cAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA,EAAS;AAAA,OACX;AACA,MAAA,MAAM,YAAY,EAAC;AAEnB,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACxC,QAAA,IAAIQ,wBAAmB,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAC,CAAA,EAAG;AAC3C,UAAA;AAAA,QACF;AACA,QAAA,MAAM,cAAA,GAAiB,IAAIN,+BAAA,CAAe;AAAA,UACxC,cAAA;AAAA,UACA,QAAA,EAAU,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,UAC5B;AAAA,SACD,CAAA;AACD,QAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB,IAAA,CAAK,cAAc,CAAA;AAC3D,QAAA,MAAM,aAAa,MAAMG,oBAAA,CAAS,KAAK,CAAC,QAAA,EAAU,WAAW,CAAC,CAAA;AAE9D,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,IAAA,EAAM,UAAA;AAAA,UACN,IAAA,EAAMI,cAAA;AAAA,YACJ,KAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAAA,YACtC,QAAA,CAAS,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,GAAI,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,CAAA,EAAI,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA;AAC7D,SACD,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoB,kBAAkB,SAAS,CAAA;AAAA,IACxE,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,kBAAA,EAAoB;AAC3C,QAAA,MAAM,IAAIN,uBAAA,EAAiB;AAAA,MAC7B;AACA,MAAA,MAAM,IAAIG,qBAAA;AAAA,QACR,8CAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,QAAA,CAAS,KAAK,IAAI,CAAA;AAEnC,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAA,GAAQI,eAAQ,CAAC,CAAA;AACvB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,eAAA;AAChD,IAAA,OAAO,CAAA,mBAAA,EAAsB,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,QAAA,EAAW,OAAA;AAAA,MAClE;AAAA,KACD,CAAA,CAAA,CAAA;AAAA,EACH;AACF;;;;;"}

package/dist/entrypoints/urlReader/lib/AwsS3UrlReader.cjs.js

@@ -9,13 +9,17 @@ var abortController = require('@aws-sdk/abort-controller');
 var ReadUrlResponseFactory = require('./ReadUrlResponseFactory.cjs.js');
 var node_stream = require('node:stream');
 var posix = require('node:path/posix');
+var util = require('./util.cjs.js');
 
 const DEFAULT_REGION = "us-east-1";
 const STANDARD_AWS_HOST_RE = /^(?:(?<bucket>[a-z0-9.-]+)\.)?s3(?:[.-](?<region>[a-z0-9-]+))?\.amazonaws\.com(?:\.cn)?$/;
 const VPC_ENDPOINT_HOST_RE = /^(?<bucket>[a-z0-9.-]+)\.bucket\.(?<vpceId>vpce-[a-z0-9-]+)\.s3[.-](?<region>[a-z0-9-]+)\.vpce\.amazonaws\.com(?:\.cn)?$/;
 function parseUrl(url, config) {
+  if (!util.isUrlPathWithoutDotSegments(url)) {
+    throw new Error(`Invalid AWS S3 URL ${url}`);
+  }
   const parsedUrl = new URL(url);
-  const pathname = parsedUrl.pathname.substring(1);
+  const pathname = parsedUrl.pathname.substring(1).split("/").map(decodeURIComponent).join("/");
   const host = parsedUrl.host;
   if (isAmazonHost(config.host)) {
     return parseAmazonUrl(url, host, pathname, config);
@@ -247,6 +251,9 @@ class AwsS3UrlReader {
         continuationToken = output.NextContinuationToken;
       } while (continuationToken);
       for (let i = 0; i < allObjects.length; i++) {
+        if (util.hasDotPathSegments(String(allObjects[i]))) {
+          continue;
+        }
         const getObjectCommand = new clientS3.GetObjectCommand({
           Bucket: bucket,
           Key: String(allObjects[i])

package/dist/entrypoints/urlReader/lib/AwsS3UrlReader.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"AwsS3UrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/AwsS3UrlReader.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeOptions,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport { ReaderFactory, ReadTreeResponseFactory } from './types';\nimport {\n  AwsCredentialsManager,\n  DefaultAwsCredentialsManager,\n} from '@backstage/integration-aws-node';\nimport {\n  AwsS3Integration,\n  ScmIntegrations,\n  AwsS3IntegrationConfig,\n} from '@backstage/integration';\nimport { toError, ForwardedError, NotModifiedError } from '@backstage/errors';\nimport { fromTemporaryCredentials } from '@aws-sdk/credential-providers';\nimport { AwsCredentialIdentityProvider } from '@aws-sdk/types';\nimport {\n  S3Client,\n  ListObjectsV2Command,\n  ListObjectsV2CommandOutput,\n  GetObjectCommand,\n  GetObjectCommandInput,\n} from '@aws-sdk/client-s3';\nimport { AbortController } from '@aws-sdk/abort-controller';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { Readable } from 'node:stream';\nimport { relative } from 'node:path/posix';\n\nexport const DEFAULT_REGION = 'us-east-1';\n\n/**\n * Standard AWS S3 URLs:\n *   Path style:           https://s3.(region).amazonaws.com/(bucket)/(key)\n *   Path style (old):     https://s3-(region).amazonaws.com/(bucket)/(key)\n *   Virtual hosted style: https://(bucket).s3.(region).amazonaws.com/(key)\n *\n * AWS PrivateLink (VPC endpoint) S3 URLs:\n *   https://(bucket).bucket.(vpce-id).s3.(region).vpce.amazonaws.com/(key)\n *\n * Both forms may have an optional .cn suffix for China regions.\n *\n * See https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html\n * See https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html\n */\n\nconst STANDARD_AWS_HOST_RE =\n  /^(?:(?<bucket>[a-z0-9.-]+)\\.)?s3(?:[.-](?<region>[a-z0-9-]+))?\\.amazonaws\\.com(?:\\.cn)?$/;\n\nconst VPC_ENDPOINT_HOST_RE =\n  /^(?<bucket>[a-z0-9.-]+)\\.bucket\\.(?<vpceId>vpce-[a-z0-9-]+)\\.s3[.-](?<region>[a-z0-9-]+)\\.vpce\\.amazonaws\\.com(?:\\.cn)?$/;\n\nexport function parseUrl(\n  url: string,\n  config: AwsS3IntegrationConfig,\n): { path: string; bucket: string; region: string } {\n  const parsedUrl = new URL(url);\n  const pathname = parsedUrl.pathname.substring(1);\n  const host = parsedUrl.host;\n\n  if (isAmazonHost(config.host)) {\n    return parseAmazonUrl(url, host, pathname, config);\n  }\n\n  const usePathStyle =\n    config.s3ForcePathStyle || host.length === config.host.length;\n\n  if (usePathStyle) {\n    const slashIndex = pathname.indexOf('/');\n    if (slashIndex < 0) {\n      throw new Error(\n        `Invalid path-style AWS S3 URL ${url}, does not contain bucket in the path`,\n      );\n    }\n\n    return {\n      path: pathname.substring(slashIndex + 1),\n      bucket: pathname.substring(0, slashIndex),\n      region: DEFAULT_REGION,\n    };\n  }\n\n  return {\n    path: pathname,\n    bucket: host.substring(0, host.length - config.host.length - 1),\n    region: DEFAULT_REGION,\n  };\n}\n\nfunction isAmazonHost(host: string): boolean {\n  return (\n    host === 'amazonaws.com' ||\n    host === 'amazonaws.com.cn' ||\n    host.endsWith('.amazonaws.com') ||\n    host.endsWith('.amazonaws.com.cn')\n  );\n}\n\nfunction parseAmazonUrl(\n  url: string,\n  host: string,\n  pathname: string,\n  config: AwsS3IntegrationConfig,\n): { path: string; bucket: string; region: string } {\n  // Try VPC PrivateLink format first (more specific pattern)\n  const vpcMatch = host.match(VPC_ENDPOINT_HOST_RE);\n  if (vpcMatch?.groups) {\n    if (config.s3ForcePathStyle) {\n      throw new Error(\n        `Invalid AWS S3 URL ${url} - path style access is not supported for VPC endpoint URLs`,\n      );\n    }\n    return {\n      path: pathname,\n      bucket: vpcMatch.groups.bucket,\n      region: vpcMatch.groups.region,\n    };\n  }\n\n  // Try standard AWS S3 format\n  const stdMatch = host.match(STANDARD_AWS_HOST_RE);\n  if (!stdMatch?.groups) {\n    throw new Error(`Invalid AWS S3 URL ${url}`);\n  }\n\n  const { bucket: hostBucket, region: hostRegion } = stdMatch.groups;\n\n  if (config.s3ForcePathStyle || !hostBucket) {\n    const slashIndex = pathname.indexOf('/');\n    if (slashIndex < 0) {\n      throw new Error(\n        `Invalid path-style AWS S3 URL ${url}, does not contain bucket in the path`,\n      );\n    }\n    return {\n      path: pathname.substring(slashIndex + 1),\n      bucket: pathname.substring(0, slashIndex),\n      region: hostRegion ?? DEFAULT_REGION,\n    };\n  }\n\n  return {\n    path: pathname,\n    bucket: hostBucket,\n    region: hostRegion ?? DEFAULT_REGION,\n  };\n}\n\n/**\n * Implements a {@link @backstage/backend-plugin-api#UrlReaderService} for AWS S3 buckets.\n *\n * @public\n */\nexport class AwsS3UrlReader implements UrlReaderService {\n  static factory: ReaderFactory = ({ config, treeResponseFactory }) => {\n    const integrations = ScmIntegrations.fromConfig(config);\n    const credsManager = DefaultAwsCredentialsManager.fromConfig(config);\n\n    return integrations.awsS3.list().map(integration => {\n      const reader = new AwsS3UrlReader(credsManager, integration, {\n        treeResponseFactory,\n      });\n      const predicate = (url: URL) =>\n        url.host.endsWith(integration.config.host);\n      return { reader, predicate };\n    });\n  };\n\n  private readonly credsManager: AwsCredentialsManager;\n  private readonly integration: AwsS3Integration;\n  private readonly deps: {\n    treeResponseFactory: ReadTreeResponseFactory;\n  };\n\n  constructor(\n    credsManager: AwsCredentialsManager,\n    integration: AwsS3Integration,\n    deps: {\n      treeResponseFactory: ReadTreeResponseFactory;\n    },\n  ) {\n    this.credsManager = credsManager;\n    this.integration = integration;\n    this.deps = deps;\n  }\n\n  /**\n   * If accessKeyId and secretAccessKey are missing, the standard credentials provider chain will be used:\n   * https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.html\n   */\n  private static buildStaticCredentials(\n    accessKeyId: string,\n    secretAccessKey: string,\n  ): AwsCredentialIdentityProvider {\n    return async () => {\n      return {\n        accessKeyId,\n        secretAccessKey,\n      };\n    };\n  }\n\n  private static async buildCredentials(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration?: AwsS3Integration,\n  ): Promise<AwsCredentialIdentityProvider> {\n    // Fall back to the default credential chain if neither account ID\n    // nor explicit credentials are provided\n    if (!integration) {\n      return (await credsManager.getCredentialProvider()).sdkCredentialProvider;\n    }\n\n    const accessKeyId = integration.config.accessKeyId;\n    const secretAccessKey = integration.config.secretAccessKey;\n    let explicitCredentials: AwsCredentialIdentityProvider;\n    if (accessKeyId && secretAccessKey) {\n      explicitCredentials = AwsS3UrlReader.buildStaticCredentials(\n        accessKeyId,\n        secretAccessKey,\n      );\n    } else {\n      explicitCredentials = (await credsManager.getCredentialProvider())\n        .sdkCredentialProvider;\n    }\n\n    const roleArn = integration.config.roleArn;\n    if (roleArn) {\n      return fromTemporaryCredentials({\n        masterCredentials: explicitCredentials,\n        params: {\n          RoleSessionName: 'backstage-aws-s3-url-reader',\n          RoleArn: roleArn,\n          ExternalId: integration.config.externalId,\n        },\n        clientConfig: { region },\n      });\n    }\n\n    return explicitCredentials;\n  }\n\n  private async buildS3Client(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration: AwsS3Integration,\n  ): Promise<S3Client> {\n    const credentials = await AwsS3UrlReader.buildCredentials(\n      credsManager,\n      region,\n      integration,\n    );\n\n    const s3 = new S3Client({\n      customUserAgent: 'backstage-aws-s3-url-reader',\n      region: region,\n      credentials: credentials,\n      endpoint: integration.config.endpoint,\n      forcePathStyle: integration.config.s3ForcePathStyle,\n    });\n    return s3;\n  }\n\n  private async retrieveS3ObjectData(stream: Readable): Promise<Readable> {\n    return new Promise((resolve, reject) => {\n      try {\n        const chunks: any[] = [];\n        stream.on('data', chunk => chunks.push(chunk));\n        stream.on('error', (e: Error) =>\n          reject(new ForwardedError('Unable to read stream', e)),\n        );\n        stream.on('end', () => resolve(Readable.from(Buffer.concat(chunks))));\n      } catch (e) {\n        throw new ForwardedError('Unable to parse the response data', e);\n      }\n    });\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    const { etag, lastModifiedAfter } = options ?? {};\n\n    try {\n      const { path, bucket, region } = parseUrl(url, this.integration.config);\n      const s3Client = await this.buildS3Client(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n      const abortController = new AbortController();\n\n      const params: GetObjectCommandInput = {\n        Bucket: bucket,\n        Key: path,\n        ...(etag && { IfNoneMatch: etag }),\n        ...(lastModifiedAfter && {\n          IfModifiedSince: lastModifiedAfter,\n        }),\n      };\n\n      options?.signal?.addEventListener('abort', () => abortController.abort());\n      const getObjectCommand = new GetObjectCommand(params);\n      const response = await s3Client.send(getObjectCommand, {\n        abortSignal: abortController.signal,\n      });\n\n      const s3ObjectData = await this.retrieveS3ObjectData(\n        response.Body as Readable,\n      );\n\n      return ReadUrlResponseFactory.fromReadable(s3ObjectData, {\n        etag: response.ETag,\n        lastModifiedAt: response.LastModified,\n      });\n    } catch (e) {\n      if (e.$metadata && e.$metadata.httpStatusCode === 304) {\n        throw new NotModifiedError();\n      }\n\n      throw new ForwardedError('Could not retrieve file from S3', e);\n    }\n  }\n\n  async readTree(\n    url: string,\n    options?: UrlReaderServiceReadTreeOptions,\n  ): Promise<UrlReaderServiceReadTreeResponse> {\n    try {\n      const { path, bucket, region } = parseUrl(url, this.integration.config);\n      const s3Client = await this.buildS3Client(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n      const abortController = new AbortController();\n      const allObjects: String[] = [];\n      const responses = [];\n      let continuationToken: string | undefined;\n      let output: ListObjectsV2CommandOutput;\n      do {\n        const listObjectsV2Command = new ListObjectsV2Command({\n          Bucket: bucket,\n          ContinuationToken: continuationToken,\n          Prefix: path,\n        });\n        options?.signal?.addEventListener('abort', () =>\n          abortController.abort(),\n        );\n        output = await s3Client.send(listObjectsV2Command, {\n          abortSignal: abortController.signal,\n        });\n        if (output.Contents) {\n          output.Contents.forEach(contents => {\n            allObjects.push(contents.Key!);\n          });\n        }\n        continuationToken = output.NextContinuationToken;\n      } while (continuationToken);\n\n      for (let i = 0; i < allObjects.length; i++) {\n        const getObjectCommand = new GetObjectCommand({\n          Bucket: bucket,\n          Key: String(allObjects[i]),\n        });\n        const response = await s3Client.send(getObjectCommand);\n        const s3ObjectData = await this.retrieveS3ObjectData(\n          response.Body as Readable,\n        );\n\n        responses.push({\n          data: s3ObjectData,\n          path: relative(path, String(allObjects[i])),\n          lastModifiedAt: response?.LastModified ?? undefined,\n        });\n      }\n\n      return await this.deps.treeResponseFactory.fromReadableArray(responses);\n    } catch (e) {\n      throw new ForwardedError('Could not retrieve file tree from S3', e);\n    }\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { path } = parseUrl(url, this.integration.config);\n\n    if (path.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      const error = toError(e);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    const secretAccessKey = this.integration.config.secretAccessKey;\n    return `awsS3{host=${this.integration.config.host},authed=${Boolean(\n      secretAccessKey,\n    )}}`;\n  }\n}\n"],"names":["ScmIntegrations","DefaultAwsCredentialsManager","fromTemporaryCredentials","S3Client","ForwardedError","Readable","abortController","AbortController","GetObjectCommand","ReadUrlResponseFactory","NotModifiedError","ListObjectsV2Command","relative","toError"],"mappings":";;;;;;;;;;;;AAkDO,MAAM,cAAA,GAAiB;AAiB9B,MAAM,oBAAA,GACJ,0FAAA;AAEF,MAAM,oBAAA,GACJ,0HAAA;AAEK,SAAS,QAAA,CACd,KACA,MAAA,EACkD;AAClD,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,QAAA,CAAS,SAAA,CAAU,CAAC,CAAA;AAC/C,EAAA,MAAM,OAAO,SAAA,CAAU,IAAA;AAEvB,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,IAAI,CAAA,EAAG;AAC7B,IAAA,OAAO,cAAA,CAAe,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,MAAM,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,eACJ,MAAA,CAAO,gBAAA,IAAoB,IAAA,CAAK,MAAA,KAAW,OAAO,IAAA,CAAK,MAAA;AAEzD,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,CAAA,EAAG;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iCAAiC,GAAG,CAAA,qCAAA;AAAA,OACtC;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA,CAAS,SAAA,CAAU,UAAA,GAAa,CAAC,CAAA;AAAA,MACvC,MAAA,EAAQ,QAAA,CAAS,SAAA,CAAU,CAAA,EAAG,UAAU,CAAA;AAAA,MACxC,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAA,EAAQ,KAAK,SAAA,CAAU,CAAA,EAAG,KAAK,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,MAAA,GAAS,CAAC,CAAA;AAAA,IAC9D,MAAA,EAAQ;AAAA,GACV;AACF;AAEA,SAAS,aAAa,IAAA,EAAuB;AAC3C,EAAA,OACE,IAAA,KAAS,eAAA,IACT,IAAA,KAAS,kBAAA,IACT,IAAA,CAAK,SAAS,gBAAgB,CAAA,IAC9B,IAAA,CAAK,QAAA,CAAS,mBAAmB,CAAA;AAErC;AAEA,SAAS,cAAA,CACP,GAAA,EACA,IAAA,EACA,QAAA,EACA,MAAA,EACkD;AAElD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,oBAAoB,CAAA;AAChD,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,IAAI,OAAO,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,sBAAsB,GAAG,CAAA,2DAAA;AAAA,OAC3B;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,SAAS,MAAA,CAAO,MAAA;AAAA,MACxB,MAAA,EAAQ,SAAS,MAAA,CAAO;AAAA,KAC1B;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,oBAAoB,CAAA;AAChD,EAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,KAAe,QAAA,CAAS,MAAA;AAE5D,EAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,CAAC,UAAA,EAAY;AAC1C,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,CAAA,EAAG;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iCAAiC,GAAG,CAAA,qCAAA;AAAA,OACtC;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA,CAAS,SAAA,CAAU,UAAA,GAAa,CAAC,CAAA;AAAA,MACvC,MAAA,EAAQ,QAAA,CAAS,SAAA,CAAU,CAAA,EAAG,UAAU,CAAA;AAAA,MACxC,QAAQ,UAAA,IAAc;AAAA,KACxB;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAA,EAAQ,UAAA;AAAA,IACR,QAAQ,UAAA,IAAc;AAAA,GACxB;AACF;AAOO,MAAM,cAAA,CAA2C;AAAA,EACtD,OAAO,OAAA,GAAyB,CAAC,EAAE,MAAA,EAAQ,qBAAoB,KAAM;AACnE,IAAA,MAAM,YAAA,GAAeA,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AACtD,IAAA,MAAM,YAAA,GAAeC,+CAAA,CAA6B,UAAA,CAAW,MAAM,CAAA;AAEnE,IAAA,OAAO,YAAA,CAAa,KAAA,CAAM,IAAA,EAAK,CAAE,IAAI,CAAA,WAAA,KAAe;AAClD,MAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAAe,YAAA,EAAc,WAAA,EAAa;AAAA,QAC3D;AAAA,OACD,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KACjB,GAAA,CAAI,KAAK,QAAA,CAAS,WAAA,CAAY,OAAO,IAAI,CAAA;AAC3C,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEiB,YAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EAIjB,WAAA,CACE,YAAA,EACA,WAAA,EACA,IAAA,EAGA;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAe,sBAAA,CACb,WAAA,EACA,eAAA,EAC+B;AAC/B,IAAA,OAAO,YAAY;AACjB,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEA,aAAqB,gBAAA,CACnB,YAAA,EACA,MAAA,EACA,WAAA,EACwC;AAGxC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAA,CAAQ,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAAG,qBAAA;AAAA,IACtD;AAEA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAA,CAAO,WAAA;AACvC,IAAA,MAAM,eAAA,GAAkB,YAAY,MAAA,CAAO,eAAA;AAC3C,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,MAAA,mBAAA,GAAsB,cAAA,CAAe,sBAAA;AAAA,QACnC,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,mBAAA,GAAA,CAAuB,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAC7D,qBAAA;AAAA,IACL;AAEA,IAAA,MAAM,OAAA,GAAU,YAAY,MAAA,CAAO,OAAA;AACnC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAOC,4CAAA,CAAyB;AAAA,QAC9B,iBAAA,EAAmB,mBAAA;AAAA,QACnB,MAAA,EAAQ;AAAA,UACN,eAAA,EAAiB,6BAAA;AAAA,UACjB,OAAA,EAAS,OAAA;AAAA,UACT,UAAA,EAAY,YAAY,MAAA,CAAO;AAAA,SACjC;AAAA,QACA,YAAA,EAAc,EAAE,MAAA;AAAO,OACxB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,mBAAA;AAAA,EACT;AAAA,EAEA,MAAc,aAAA,CACZ,YAAA,EACA,MAAA,EACA,WAAA,EACmB;AACnB,IAAA,MAAM,WAAA,GAAc,MAAM,cAAA,CAAe,gBAAA;AAAA,MACvC,YAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,EAAA,GAAK,IAAIC,iBAAA,CAAS;AAAA,MACtB,eAAA,EAAiB,6BAAA;AAAA,MACjB,MAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA,EAAU,YAAY,MAAA,CAAO,QAAA;AAAA,MAC7B,cAAA,EAAgB,YAAY,MAAA,CAAO;AAAA,KACpC,CAAA;AACD,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,MAAA,EAAqC;AACtE,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAgB,EAAC;AACvB,QAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAA,KAAA,KAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AAC7C,QAAA,MAAA,CAAO,EAAA;AAAA,UAAG,OAAA;AAAA,UAAS,CAAC,CAAA,KAClB,MAAA,CAAO,IAAIC,qBAAA,CAAe,uBAAA,EAAyB,CAAC,CAAC;AAAA,SACvD;AACA,QAAA,MAAA,CAAO,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQC,oBAAA,CAAS,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAAA,MACtE,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,IAAID,qBAAA,CAAe,mCAAA,EAAqC,CAAC,CAAA;AAAA,MACjE;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,MAAM,EAAE,IAAA,EAAM,iBAAA,EAAkB,GAAI,WAAW,EAAC;AAEhD,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,MAAM,MAAA,EAAQ,MAAA,KAAW,QAAA,CAAS,GAAA,EAAK,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AACtE,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA;AAAA,QAC1B,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,MAAME,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAE5C,MAAA,MAAM,MAAA,GAAgC;AAAA,QACpC,MAAA,EAAQ,MAAA;AAAA,QACR,GAAA,EAAK,IAAA;AAAA,QACL,GAAI,IAAA,IAAQ,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAChC,GAAI,iBAAA,IAAqB;AAAA,UACvB,eAAA,EAAiB;AAAA;AACnB,OACF;AAEA,MAAA,OAAA,EAAS,QAAQ,gBAAA,CAAiB,OAAA,EAAS,MAAMD,iBAAA,CAAgB,OAAO,CAAA;AACxE,MAAA,MAAM,gBAAA,GAAmB,IAAIE,yBAAA,CAAiB,MAAM,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,CAAK,gBAAA,EAAkB;AAAA,QACrD,aAAaF,iBAAA,CAAgB;AAAA,OAC9B,CAAA;AAED,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,oBAAA;AAAA,QAC9B,QAAA,CAAS;AAAA,OACX;AAEA,MAAA,OAAOG,6CAAA,CAAuB,aAAa,YAAA,EAAc;AAAA,QACvD,MAAM,QAAA,CAAS,IAAA;AAAA,QACf,gBAAgB,QAAA,CAAS;AAAA,OAC1B,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,SAAA,IAAa,CAAA,CAAE,SAAA,CAAU,mBAAmB,GAAA,EAAK;AACrD,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,IAAIN,qBAAA,CAAe,iCAAA,EAAmC,CAAC,CAAA;AAAA,IAC/D;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,CACJ,GAAA,EACA,OAAA,EAC2C;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,MAAM,MAAA,EAAQ,MAAA,KAAW,QAAA,CAAS,GAAA,EAAK,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AACtE,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA;AAAA,QAC1B,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,MAAME,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAC5C,MAAA,MAAM,aAAuB,EAAC;AAC9B,MAAA,MAAM,YAAY,EAAC;AACnB,MAAA,IAAI,iBAAA;AACJ,MAAA,IAAI,MAAA;AACJ,MAAA,GAAG;AACD,QAAA,MAAM,oBAAA,GAAuB,IAAII,6BAAA,CAAqB;AAAA,UACpD,MAAA,EAAQ,MAAA;AAAA,UACR,iBAAA,EAAmB,iBAAA;AAAA,UACnB,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAA,EAAS,MAAA,EAAQ,gBAAA;AAAA,UAAiB,OAAA;AAAA,UAAS,MACzCL,kBAAgB,KAAA;AAAM,SACxB;AACA,QAAA,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,CAAK,oBAAA,EAAsB;AAAA,UACjD,aAAaA,iBAAA,CAAgB;AAAA,SAC9B,CAAA;AACD,QAAA,IAAI,OAAO,QAAA,EAAU;AACnB,UAAA,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,QAAA,KAAY;AAClC,YAAA,UAAA,CAAW,IAAA,CAAK,SAAS,GAAI,CAAA;AAAA,UAC/B,CAAC,CAAA;AAAA,QACH;AACA,QAAA,iBAAA,GAAoB,MAAA,CAAO,qBAAA;AAAA,MAC7B,CAAA,QAAS,iBAAA;AAET,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC1C,QAAA,MAAM,gBAAA,GAAmB,IAAIE,yBAAA,CAAiB;AAAA,UAC5C,MAAA,EAAQ,MAAA;AAAA,UACR,GAAA,EAAK,MAAA,CAAO,UAAA,CAAW,CAAC,CAAC;AAAA,SAC1B,CAAA;AACD,QAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,CAAK,gBAAgB,CAAA;AACrD,QAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,oBAAA;AAAA,UAC9B,QAAA,CAAS;AAAA,SACX;AAEA,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,IAAA,EAAM,YAAA;AAAA,UACN,MAAMI,cAAA,CAAS,IAAA,EAAM,OAAO,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAAA,UAC1C,cAAA,EAAgB,UAAU,YAAA,IAAgB,KAAA;AAAA,SAC3C,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoB,kBAAkB,SAAS,CAAA;AAAA,IACxE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAIR,qBAAA,CAAe,sCAAA,EAAwC,CAAC,CAAA;AAAA,IACpE;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,SAAS,GAAA,EAAK,IAAA,CAAK,YAAY,MAAM,CAAA;AAEtD,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAA,GAAQS,eAAQ,CAAC,CAAA;AACvB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,eAAA;AAChD,IAAA,OAAO,CAAA,WAAA,EAAc,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,QAAA,EAAW,OAAA;AAAA,MAC1D;AAAA,KACD,CAAA,CAAA,CAAA;AAAA,EACH;AACF;;;;;;"}
+{"version":3,"file":"AwsS3UrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/AwsS3UrlReader.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeOptions,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport { ReaderFactory, ReadTreeResponseFactory } from './types';\nimport {\n  AwsCredentialsManager,\n  DefaultAwsCredentialsManager,\n} from '@backstage/integration-aws-node';\nimport {\n  AwsS3Integration,\n  ScmIntegrations,\n  AwsS3IntegrationConfig,\n} from '@backstage/integration';\nimport { toError, ForwardedError, NotModifiedError } from '@backstage/errors';\nimport { fromTemporaryCredentials } from '@aws-sdk/credential-providers';\nimport { AwsCredentialIdentityProvider } from '@aws-sdk/types';\nimport {\n  S3Client,\n  ListObjectsV2Command,\n  ListObjectsV2CommandOutput,\n  GetObjectCommand,\n  GetObjectCommandInput,\n} from '@aws-sdk/client-s3';\nimport { AbortController } from '@aws-sdk/abort-controller';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { Readable } from 'node:stream';\nimport { relative } from 'node:path/posix';\nimport { hasDotPathSegments, isUrlPathWithoutDotSegments } from './util';\n\nexport const DEFAULT_REGION = 'us-east-1';\n\n/**\n * Standard AWS S3 URLs:\n *   Path style:           https://s3.(region).amazonaws.com/(bucket)/(key)\n *   Path style (old):     https://s3-(region).amazonaws.com/(bucket)/(key)\n *   Virtual hosted style: https://(bucket).s3.(region).amazonaws.com/(key)\n *\n * AWS PrivateLink (VPC endpoint) S3 URLs:\n *   https://(bucket).bucket.(vpce-id).s3.(region).vpce.amazonaws.com/(key)\n *\n * Both forms may have an optional .cn suffix for China regions.\n *\n * See https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html\n * See https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html\n */\n\nconst STANDARD_AWS_HOST_RE =\n  /^(?:(?<bucket>[a-z0-9.-]+)\\.)?s3(?:[.-](?<region>[a-z0-9-]+))?\\.amazonaws\\.com(?:\\.cn)?$/;\n\nconst VPC_ENDPOINT_HOST_RE =\n  /^(?<bucket>[a-z0-9.-]+)\\.bucket\\.(?<vpceId>vpce-[a-z0-9-]+)\\.s3[.-](?<region>[a-z0-9-]+)\\.vpce\\.amazonaws\\.com(?:\\.cn)?$/;\n\nexport function parseUrl(\n  url: string,\n  config: AwsS3IntegrationConfig,\n): { path: string; bucket: string; region: string } {\n  if (!isUrlPathWithoutDotSegments(url)) {\n    throw new Error(`Invalid AWS S3 URL ${url}`);\n  }\n\n  const parsedUrl = new URL(url);\n  const pathname = parsedUrl.pathname\n    .substring(1)\n    .split('/')\n    .map(decodeURIComponent)\n    .join('/');\n  const host = parsedUrl.host;\n\n  if (isAmazonHost(config.host)) {\n    return parseAmazonUrl(url, host, pathname, config);\n  }\n\n  const usePathStyle =\n    config.s3ForcePathStyle || host.length === config.host.length;\n\n  if (usePathStyle) {\n    const slashIndex = pathname.indexOf('/');\n    if (slashIndex < 0) {\n      throw new Error(\n        `Invalid path-style AWS S3 URL ${url}, does not contain bucket in the path`,\n      );\n    }\n\n    return {\n      path: pathname.substring(slashIndex + 1),\n      bucket: pathname.substring(0, slashIndex),\n      region: DEFAULT_REGION,\n    };\n  }\n\n  return {\n    path: pathname,\n    bucket: host.substring(0, host.length - config.host.length - 1),\n    region: DEFAULT_REGION,\n  };\n}\n\nfunction isAmazonHost(host: string): boolean {\n  return (\n    host === 'amazonaws.com' ||\n    host === 'amazonaws.com.cn' ||\n    host.endsWith('.amazonaws.com') ||\n    host.endsWith('.amazonaws.com.cn')\n  );\n}\n\nfunction parseAmazonUrl(\n  url: string,\n  host: string,\n  pathname: string,\n  config: AwsS3IntegrationConfig,\n): { path: string; bucket: string; region: string } {\n  // Try VPC PrivateLink format first (more specific pattern)\n  const vpcMatch = host.match(VPC_ENDPOINT_HOST_RE);\n  if (vpcMatch?.groups) {\n    if (config.s3ForcePathStyle) {\n      throw new Error(\n        `Invalid AWS S3 URL ${url} - path style access is not supported for VPC endpoint URLs`,\n      );\n    }\n    return {\n      path: pathname,\n      bucket: vpcMatch.groups.bucket,\n      region: vpcMatch.groups.region,\n    };\n  }\n\n  // Try standard AWS S3 format\n  const stdMatch = host.match(STANDARD_AWS_HOST_RE);\n  if (!stdMatch?.groups) {\n    throw new Error(`Invalid AWS S3 URL ${url}`);\n  }\n\n  const { bucket: hostBucket, region: hostRegion } = stdMatch.groups;\n\n  if (config.s3ForcePathStyle || !hostBucket) {\n    const slashIndex = pathname.indexOf('/');\n    if (slashIndex < 0) {\n      throw new Error(\n        `Invalid path-style AWS S3 URL ${url}, does not contain bucket in the path`,\n      );\n    }\n    return {\n      path: pathname.substring(slashIndex + 1),\n      bucket: pathname.substring(0, slashIndex),\n      region: hostRegion ?? DEFAULT_REGION,\n    };\n  }\n\n  return {\n    path: pathname,\n    bucket: hostBucket,\n    region: hostRegion ?? DEFAULT_REGION,\n  };\n}\n\n/**\n * Implements a {@link @backstage/backend-plugin-api#UrlReaderService} for AWS S3 buckets.\n *\n * @public\n */\nexport class AwsS3UrlReader implements UrlReaderService {\n  static factory: ReaderFactory = ({ config, treeResponseFactory }) => {\n    const integrations = ScmIntegrations.fromConfig(config);\n    const credsManager = DefaultAwsCredentialsManager.fromConfig(config);\n\n    return integrations.awsS3.list().map(integration => {\n      const reader = new AwsS3UrlReader(credsManager, integration, {\n        treeResponseFactory,\n      });\n      const predicate = (url: URL) =>\n        url.host.endsWith(integration.config.host);\n      return { reader, predicate };\n    });\n  };\n\n  private readonly credsManager: AwsCredentialsManager;\n  private readonly integration: AwsS3Integration;\n  private readonly deps: {\n    treeResponseFactory: ReadTreeResponseFactory;\n  };\n\n  constructor(\n    credsManager: AwsCredentialsManager,\n    integration: AwsS3Integration,\n    deps: {\n      treeResponseFactory: ReadTreeResponseFactory;\n    },\n  ) {\n    this.credsManager = credsManager;\n    this.integration = integration;\n    this.deps = deps;\n  }\n\n  /**\n   * If accessKeyId and secretAccessKey are missing, the standard credentials provider chain will be used:\n   * https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.html\n   */\n  private static buildStaticCredentials(\n    accessKeyId: string,\n    secretAccessKey: string,\n  ): AwsCredentialIdentityProvider {\n    return async () => {\n      return {\n        accessKeyId,\n        secretAccessKey,\n      };\n    };\n  }\n\n  private static async buildCredentials(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration?: AwsS3Integration,\n  ): Promise<AwsCredentialIdentityProvider> {\n    // Fall back to the default credential chain if neither account ID\n    // nor explicit credentials are provided\n    if (!integration) {\n      return (await credsManager.getCredentialProvider()).sdkCredentialProvider;\n    }\n\n    const accessKeyId = integration.config.accessKeyId;\n    const secretAccessKey = integration.config.secretAccessKey;\n    let explicitCredentials: AwsCredentialIdentityProvider;\n    if (accessKeyId && secretAccessKey) {\n      explicitCredentials = AwsS3UrlReader.buildStaticCredentials(\n        accessKeyId,\n        secretAccessKey,\n      );\n    } else {\n      explicitCredentials = (await credsManager.getCredentialProvider())\n        .sdkCredentialProvider;\n    }\n\n    const roleArn = integration.config.roleArn;\n    if (roleArn) {\n      return fromTemporaryCredentials({\n        masterCredentials: explicitCredentials,\n        params: {\n          RoleSessionName: 'backstage-aws-s3-url-reader',\n          RoleArn: roleArn,\n          ExternalId: integration.config.externalId,\n        },\n        clientConfig: { region },\n      });\n    }\n\n    return explicitCredentials;\n  }\n\n  private async buildS3Client(\n    credsManager: AwsCredentialsManager,\n    region: string,\n    integration: AwsS3Integration,\n  ): Promise<S3Client> {\n    const credentials = await AwsS3UrlReader.buildCredentials(\n      credsManager,\n      region,\n      integration,\n    );\n\n    const s3 = new S3Client({\n      customUserAgent: 'backstage-aws-s3-url-reader',\n      region: region,\n      credentials: credentials,\n      endpoint: integration.config.endpoint,\n      forcePathStyle: integration.config.s3ForcePathStyle,\n    });\n    return s3;\n  }\n\n  private async retrieveS3ObjectData(stream: Readable): Promise<Readable> {\n    return new Promise((resolve, reject) => {\n      try {\n        const chunks: any[] = [];\n        stream.on('data', chunk => chunks.push(chunk));\n        stream.on('error', (e: Error) =>\n          reject(new ForwardedError('Unable to read stream', e)),\n        );\n        stream.on('end', () => resolve(Readable.from(Buffer.concat(chunks))));\n      } catch (e) {\n        throw new ForwardedError('Unable to parse the response data', e);\n      }\n    });\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    const { etag, lastModifiedAfter } = options ?? {};\n\n    try {\n      const { path, bucket, region } = parseUrl(url, this.integration.config);\n      const s3Client = await this.buildS3Client(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n      const abortController = new AbortController();\n\n      const params: GetObjectCommandInput = {\n        Bucket: bucket,\n        Key: path,\n        ...(etag && { IfNoneMatch: etag }),\n        ...(lastModifiedAfter && {\n          IfModifiedSince: lastModifiedAfter,\n        }),\n      };\n\n      options?.signal?.addEventListener('abort', () => abortController.abort());\n      const getObjectCommand = new GetObjectCommand(params);\n      const response = await s3Client.send(getObjectCommand, {\n        abortSignal: abortController.signal,\n      });\n\n      const s3ObjectData = await this.retrieveS3ObjectData(\n        response.Body as Readable,\n      );\n\n      return ReadUrlResponseFactory.fromReadable(s3ObjectData, {\n        etag: response.ETag,\n        lastModifiedAt: response.LastModified,\n      });\n    } catch (e) {\n      if (e.$metadata && e.$metadata.httpStatusCode === 304) {\n        throw new NotModifiedError();\n      }\n\n      throw new ForwardedError('Could not retrieve file from S3', e);\n    }\n  }\n\n  async readTree(\n    url: string,\n    options?: UrlReaderServiceReadTreeOptions,\n  ): Promise<UrlReaderServiceReadTreeResponse> {\n    try {\n      const { path, bucket, region } = parseUrl(url, this.integration.config);\n      const s3Client = await this.buildS3Client(\n        this.credsManager,\n        region,\n        this.integration,\n      );\n      const abortController = new AbortController();\n      const allObjects: String[] = [];\n      const responses = [];\n      let continuationToken: string | undefined;\n      let output: ListObjectsV2CommandOutput;\n      do {\n        const listObjectsV2Command = new ListObjectsV2Command({\n          Bucket: bucket,\n          ContinuationToken: continuationToken,\n          Prefix: path,\n        });\n        options?.signal?.addEventListener('abort', () =>\n          abortController.abort(),\n        );\n        output = await s3Client.send(listObjectsV2Command, {\n          abortSignal: abortController.signal,\n        });\n        if (output.Contents) {\n          output.Contents.forEach(contents => {\n            allObjects.push(contents.Key!);\n          });\n        }\n        continuationToken = output.NextContinuationToken;\n      } while (continuationToken);\n\n      for (let i = 0; i < allObjects.length; i++) {\n        if (hasDotPathSegments(String(allObjects[i]))) {\n          continue;\n        }\n        const getObjectCommand = new GetObjectCommand({\n          Bucket: bucket,\n          Key: String(allObjects[i]),\n        });\n        const response = await s3Client.send(getObjectCommand);\n        const s3ObjectData = await this.retrieveS3ObjectData(\n          response.Body as Readable,\n        );\n\n        responses.push({\n          data: s3ObjectData,\n          path: relative(path, String(allObjects[i])),\n          lastModifiedAt: response?.LastModified ?? undefined,\n        });\n      }\n\n      return await this.deps.treeResponseFactory.fromReadableArray(responses);\n    } catch (e) {\n      throw new ForwardedError('Could not retrieve file tree from S3', e);\n    }\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { path } = parseUrl(url, this.integration.config);\n\n    if (path.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      const error = toError(e);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    const secretAccessKey = this.integration.config.secretAccessKey;\n    return `awsS3{host=${this.integration.config.host},authed=${Boolean(\n      secretAccessKey,\n    )}}`;\n  }\n}\n"],"names":["isUrlPathWithoutDotSegments","ScmIntegrations","DefaultAwsCredentialsManager","fromTemporaryCredentials","S3Client","ForwardedError","Readable","abortController","AbortController","GetObjectCommand","ReadUrlResponseFactory","NotModifiedError","ListObjectsV2Command","hasDotPathSegments","relative","toError"],"mappings":";;;;;;;;;;;;;AAmDO,MAAM,cAAA,GAAiB;AAiB9B,MAAM,oBAAA,GACJ,0FAAA;AAEF,MAAM,oBAAA,GACJ,0HAAA;AAEK,SAAS,QAAA,CACd,KACA,MAAA,EACkD;AAClD,EAAA,IAAI,CAACA,gCAAA,CAA4B,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,QAAA,CACxB,SAAA,CAAU,CAAC,CAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,kBAAkB,CAAA,CACtB,KAAK,GAAG,CAAA;AACX,EAAA,MAAM,OAAO,SAAA,CAAU,IAAA;AAEvB,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,IAAI,CAAA,EAAG;AAC7B,IAAA,OAAO,cAAA,CAAe,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,MAAM,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,eACJ,MAAA,CAAO,gBAAA,IAAoB,IAAA,CAAK,MAAA,KAAW,OAAO,IAAA,CAAK,MAAA;AAEzD,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,CAAA,EAAG;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iCAAiC,GAAG,CAAA,qCAAA;AAAA,OACtC;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA,CAAS,SAAA,CAAU,UAAA,GAAa,CAAC,CAAA;AAAA,MACvC,MAAA,EAAQ,QAAA,CAAS,SAAA,CAAU,CAAA,EAAG,UAAU,CAAA;AAAA,MACxC,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAA,EAAQ,KAAK,SAAA,CAAU,CAAA,EAAG,KAAK,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,MAAA,GAAS,CAAC,CAAA;AAAA,IAC9D,MAAA,EAAQ;AAAA,GACV;AACF;AAEA,SAAS,aAAa,IAAA,EAAuB;AAC3C,EAAA,OACE,IAAA,KAAS,eAAA,IACT,IAAA,KAAS,kBAAA,IACT,IAAA,CAAK,SAAS,gBAAgB,CAAA,IAC9B,IAAA,CAAK,QAAA,CAAS,mBAAmB,CAAA;AAErC;AAEA,SAAS,cAAA,CACP,GAAA,EACA,IAAA,EACA,QAAA,EACA,MAAA,EACkD;AAElD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,oBAAoB,CAAA;AAChD,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,IAAI,OAAO,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,sBAAsB,GAAG,CAAA,2DAAA;AAAA,OAC3B;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,SAAS,MAAA,CAAO,MAAA;AAAA,MACxB,MAAA,EAAQ,SAAS,MAAA,CAAO;AAAA,KAC1B;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,oBAAoB,CAAA;AAChD,EAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,KAAe,QAAA,CAAS,MAAA;AAE5D,EAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,CAAC,UAAA,EAAY;AAC1C,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,IAAI,aAAa,CAAA,EAAG;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,iCAAiC,GAAG,CAAA,qCAAA;AAAA,OACtC;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA,CAAS,SAAA,CAAU,UAAA,GAAa,CAAC,CAAA;AAAA,MACvC,MAAA,EAAQ,QAAA,CAAS,SAAA,CAAU,CAAA,EAAG,UAAU,CAAA;AAAA,MACxC,QAAQ,UAAA,IAAc;AAAA,KACxB;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAA,EAAQ,UAAA;AAAA,IACR,QAAQ,UAAA,IAAc;AAAA,GACxB;AACF;AAOO,MAAM,cAAA,CAA2C;AAAA,EACtD,OAAO,OAAA,GAAyB,CAAC,EAAE,MAAA,EAAQ,qBAAoB,KAAM;AACnE,IAAA,MAAM,YAAA,GAAeC,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AACtD,IAAA,MAAM,YAAA,GAAeC,+CAAA,CAA6B,UAAA,CAAW,MAAM,CAAA;AAEnE,IAAA,OAAO,YAAA,CAAa,KAAA,CAAM,IAAA,EAAK,CAAE,IAAI,CAAA,WAAA,KAAe;AAClD,MAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAAe,YAAA,EAAc,WAAA,EAAa;AAAA,QAC3D;AAAA,OACD,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KACjB,GAAA,CAAI,KAAK,QAAA,CAAS,WAAA,CAAY,OAAO,IAAI,CAAA;AAC3C,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEiB,YAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA;AAAA,EAIjB,WAAA,CACE,YAAA,EACA,WAAA,EACA,IAAA,EAGA;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAe,sBAAA,CACb,WAAA,EACA,eAAA,EAC+B;AAC/B,IAAA,OAAO,YAAY;AACjB,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEA,aAAqB,gBAAA,CACnB,YAAA,EACA,MAAA,EACA,WAAA,EACwC;AAGxC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAA,CAAQ,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAAG,qBAAA;AAAA,IACtD;AAEA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAA,CAAO,WAAA;AACvC,IAAA,MAAM,eAAA,GAAkB,YAAY,MAAA,CAAO,eAAA;AAC3C,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,MAAA,mBAAA,GAAsB,cAAA,CAAe,sBAAA;AAAA,QACnC,WAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,mBAAA,GAAA,CAAuB,MAAM,YAAA,CAAa,qBAAA,EAAsB,EAC7D,qBAAA;AAAA,IACL;AAEA,IAAA,MAAM,OAAA,GAAU,YAAY,MAAA,CAAO,OAAA;AACnC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAOC,4CAAA,CAAyB;AAAA,QAC9B,iBAAA,EAAmB,mBAAA;AAAA,QACnB,MAAA,EAAQ;AAAA,UACN,eAAA,EAAiB,6BAAA;AAAA,UACjB,OAAA,EAAS,OAAA;AAAA,UACT,UAAA,EAAY,YAAY,MAAA,CAAO;AAAA,SACjC;AAAA,QACA,YAAA,EAAc,EAAE,MAAA;AAAO,OACxB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,mBAAA;AAAA,EACT;AAAA,EAEA,MAAc,aAAA,CACZ,YAAA,EACA,MAAA,EACA,WAAA,EACmB;AACnB,IAAA,MAAM,WAAA,GAAc,MAAM,cAAA,CAAe,gBAAA;AAAA,MACvC,YAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,EAAA,GAAK,IAAIC,iBAAA,CAAS;AAAA,MACtB,eAAA,EAAiB,6BAAA;AAAA,MACjB,MAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA,EAAU,YAAY,MAAA,CAAO,QAAA;AAAA,MAC7B,cAAA,EAAgB,YAAY,MAAA,CAAO;AAAA,KACpC,CAAA;AACD,IAAA,OAAO,EAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,MAAA,EAAqC;AACtE,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI;AACF,QAAA,MAAM,SAAgB,EAAC;AACvB,QAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAA,KAAA,KAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AAC7C,QAAA,MAAA,CAAO,EAAA;AAAA,UAAG,OAAA;AAAA,UAAS,CAAC,CAAA,KAClB,MAAA,CAAO,IAAIC,qBAAA,CAAe,uBAAA,EAAyB,CAAC,CAAC;AAAA,SACvD;AACA,QAAA,MAAA,CAAO,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQC,oBAAA,CAAS,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAAA,MACtE,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,IAAID,qBAAA,CAAe,mCAAA,EAAqC,CAAC,CAAA;AAAA,MACjE;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,MAAM,EAAE,IAAA,EAAM,iBAAA,EAAkB,GAAI,WAAW,EAAC;AAEhD,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,MAAM,MAAA,EAAQ,MAAA,KAAW,QAAA,CAAS,GAAA,EAAK,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AACtE,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA;AAAA,QAC1B,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,MAAME,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAE5C,MAAA,MAAM,MAAA,GAAgC;AAAA,QACpC,MAAA,EAAQ,MAAA;AAAA,QACR,GAAA,EAAK,IAAA;AAAA,QACL,GAAI,IAAA,IAAQ,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAChC,GAAI,iBAAA,IAAqB;AAAA,UACvB,eAAA,EAAiB;AAAA;AACnB,OACF;AAEA,MAAA,OAAA,EAAS,QAAQ,gBAAA,CAAiB,OAAA,EAAS,MAAMD,iBAAA,CAAgB,OAAO,CAAA;AACxE,MAAA,MAAM,gBAAA,GAAmB,IAAIE,yBAAA,CAAiB,MAAM,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,CAAK,gBAAA,EAAkB;AAAA,QACrD,aAAaF,iBAAA,CAAgB;AAAA,OAC9B,CAAA;AAED,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,oBAAA;AAAA,QAC9B,QAAA,CAAS;AAAA,OACX;AAEA,MAAA,OAAOG,6CAAA,CAAuB,aAAa,YAAA,EAAc;AAAA,QACvD,MAAM,QAAA,CAAS,IAAA;AAAA,QACf,gBAAgB,QAAA,CAAS;AAAA,OAC1B,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,SAAA,IAAa,CAAA,CAAE,SAAA,CAAU,mBAAmB,GAAA,EAAK;AACrD,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,IAAIN,qBAAA,CAAe,iCAAA,EAAmC,CAAC,CAAA;AAAA,IAC/D;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,CACJ,GAAA,EACA,OAAA,EAC2C;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,MAAM,MAAA,EAAQ,MAAA,KAAW,QAAA,CAAS,GAAA,EAAK,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AACtE,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA;AAAA,QAC1B,IAAA,CAAK,YAAA;AAAA,QACL,MAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,MAAME,iBAAA,GAAkB,IAAIC,+BAAA,EAAgB;AAC5C,MAAA,MAAM,aAAuB,EAAC;AAC9B,MAAA,MAAM,YAAY,EAAC;AACnB,MAAA,IAAI,iBAAA;AACJ,MAAA,IAAI,MAAA;AACJ,MAAA,GAAG;AACD,QAAA,MAAM,oBAAA,GAAuB,IAAII,6BAAA,CAAqB;AAAA,UACpD,MAAA,EAAQ,MAAA;AAAA,UACR,iBAAA,EAAmB,iBAAA;AAAA,UACnB,MAAA,EAAQ;AAAA,SACT,CAAA;AACD,QAAA,OAAA,EAAS,MAAA,EAAQ,gBAAA;AAAA,UAAiB,OAAA;AAAA,UAAS,MACzCL,kBAAgB,KAAA;AAAM,SACxB;AACA,QAAA,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,CAAK,oBAAA,EAAsB;AAAA,UACjD,aAAaA,iBAAA,CAAgB;AAAA,SAC9B,CAAA;AACD,QAAA,IAAI,OAAO,QAAA,EAAU;AACnB,UAAA,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,QAAA,KAAY;AAClC,YAAA,UAAA,CAAW,IAAA,CAAK,SAAS,GAAI,CAAA;AAAA,UAC/B,CAAC,CAAA;AAAA,QACH;AACA,QAAA,iBAAA,GAAoB,MAAA,CAAO,qBAAA;AAAA,MAC7B,CAAA,QAAS,iBAAA;AAET,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC1C,QAAA,IAAIM,wBAAmB,MAAA,CAAO,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA,EAAG;AAC7C,UAAA;AAAA,QACF;AACA,QAAA,MAAM,gBAAA,GAAmB,IAAIJ,yBAAA,CAAiB;AAAA,UAC5C,MAAA,EAAQ,MAAA;AAAA,UACR,GAAA,EAAK,MAAA,CAAO,UAAA,CAAW,CAAC,CAAC;AAAA,SAC1B,CAAA;AACD,QAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,IAAA,CAAK,gBAAgB,CAAA;AACrD,QAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,oBAAA;AAAA,UAC9B,QAAA,CAAS;AAAA,SACX;AAEA,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,IAAA,EAAM,YAAA;AAAA,UACN,MAAMK,cAAA,CAAS,IAAA,EAAM,OAAO,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAAA,UAC1C,cAAA,EAAgB,UAAU,YAAA,IAAgB,KAAA;AAAA,SAC3C,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoB,kBAAkB,SAAS,CAAA;AAAA,IACxE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAIT,qBAAA,CAAe,sCAAA,EAAwC,CAAC,CAAA;AAAA,IACpE;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,SAAS,GAAA,EAAK,IAAA,CAAK,YAAY,MAAM,CAAA;AAEtD,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAA,GAAQU,eAAQ,CAAC,CAAA;AACvB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,eAAA;AAChD,IAAA,OAAO,CAAA,WAAA,EAAc,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,QAAA,EAAW,OAAA;AAAA,MAC1D;AAAA,KACD,CAAA,CAAA,CAAA;AAAA,EACH;AACF;;;;;;"}

package/dist/entrypoints/urlReader/lib/AzureBlobStorageUrlReader.cjs.js

@@ -5,11 +5,15 @@ var errors = require('@backstage/errors');
 var node_stream = require('node:stream');
 var posix = require('node:path/posix');
 var ReadUrlResponseFactory = require('./ReadUrlResponseFactory.cjs.js');
+var util = require('./util.cjs.js');
 var integration = require('@backstage/integration');
 
 function parseUrl(url) {
+  if (!util.isUrlPathWithoutDotSegments(url)) {
+    throw new Error(`Invalid Azure Blob Storage URL format: ${url}`);
+  }
   const parsedUrl = new URL(url);
-  const pathSegments = parsedUrl.pathname.split("/").filter(Boolean);
+  const pathSegments = parsedUrl.pathname.split("/").filter(Boolean).map(decodeURIComponent);
   if (pathSegments.length < 1) {
     throw new Error(`Invalid Azure Blob Storage URL format: ${url}`);
   }
@@ -118,6 +122,9 @@ class AzureBlobStorageUrlReader {
       const blobs = containerClient.listBlobsFlat({ prefix: path });
       const responses = [];
       for await (const blob of blobs) {
+        if (util.hasDotPathSegments(blob.name)) {
+          continue;
+        }
         const blobClient = containerClient.getBlobClient(blob.name);
         const downloadBlockBlobResponse = await blobClient.download(
           void 0,

package/dist/entrypoints/urlReader/lib/AzureBlobStorageUrlReader.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"AzureBlobStorageUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/AzureBlobStorageUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BlobDownloadOptions,\n  BlobServiceClient,\n  ContainerClient,\n  StorageSharedKeyCredential,\n} from '@azure/storage-blob';\nimport { ReaderFactory, ReadTreeResponseFactory } from './types';\nimport { toError, ForwardedError, NotModifiedError } from '@backstage/errors';\nimport { Readable } from 'node:stream';\nimport { relative } from 'node:path/posix';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport {\n  AzureBlobStorageIntegration,\n  AzureCredentialsManager,\n  DefaultAzureCredentialsManager,\n  ScmIntegrations,\n} from '@backstage/integration';\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeOptions,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\n\nexport function parseUrl(url: string): { path: string; container: string } {\n  const parsedUrl = new URL(url);\n  const pathSegments = parsedUrl.pathname.split('/').filter(Boolean);\n\n  if (pathSegments.length < 1) {\n    throw new Error(`Invalid Azure Blob Storage URL format: ${url}`);\n  }\n\n  // First segment is the container name, rest is the blob path\n  const container = pathSegments[0];\n  const path = pathSegments.slice(1).join('/');\n\n  return { path, container };\n}\n\n/**\n * Implements a {@link @backstage/backend-plugin-api#UrlReaderService} for Azure storage accounts urls.\n *\n * @public\n */\nexport class AzureBlobStorageUrlReader implements UrlReaderService {\n  static factory: ReaderFactory = ({ config, treeResponseFactory }) => {\n    const integrations = ScmIntegrations.fromConfig(config);\n\n    const credsManager =\n      DefaultAzureCredentialsManager.fromIntegrations(integrations);\n\n    return integrations.azureBlobStorage.list().map(integrationConfig => {\n      const reader = new AzureBlobStorageUrlReader(\n        credsManager,\n        integrationConfig,\n        {\n          treeResponseFactory,\n        },\n      );\n\n      const predicate = (url: URL) =>\n        url.host.endsWith(\n          `${integrationConfig.config.accountName}.${integrationConfig.config.host}`,\n        );\n      return { reader, predicate };\n    });\n  };\n\n  private readonly integration: AzureBlobStorageIntegration;\n  private readonly deps: {\n    treeResponseFactory: ReadTreeResponseFactory;\n    createContainerClient: (containerName: string) => Promise<ContainerClient>;\n  };\n\n  constructor(\n    credsManager: AzureCredentialsManager,\n    integration: AzureBlobStorageIntegration,\n    deps: {\n      treeResponseFactory: ReadTreeResponseFactory;\n      createContainerClient?: (\n        containerName: string,\n      ) => Promise<ContainerClient>;\n    },\n  ) {\n    this.integration = integration;\n    this.deps = {\n      ...deps,\n      createContainerClient:\n        deps.createContainerClient ??\n        this.#defaultCreateContainerClient.bind(this, credsManager),\n    };\n  }\n\n  async #defaultCreateContainerClient(\n    credsManager: AzureCredentialsManager,\n    containerName: string,\n  ): Promise<ContainerClient> {\n    const accountName = this.integration.config.accountName;\n    const accountKey = this.integration.config.accountKey;\n\n    if (accountKey && accountName) {\n      const creds = new StorageSharedKeyCredential(accountName, accountKey);\n      const blobServiceClient = new BlobServiceClient(\n        `https://${accountName}.${this.integration.config.host}`,\n        creds,\n      );\n      return blobServiceClient.getContainerClient(containerName);\n    }\n\n    const credential = await credsManager.getCredentials(accountName as string);\n\n    let blobServiceClientUrl: string;\n\n    if (this.integration.config.endpoint) {\n      if (this.integration.config.sasToken) {\n        blobServiceClientUrl = `${this.integration.config.endpoint}?${this.integration.config.sasToken}`;\n      } else {\n        blobServiceClientUrl = `${this.integration.config.endpoint}`;\n      }\n    } else {\n      blobServiceClientUrl = `https://${this.integration.config.accountName}.${this.integration.config.host}`;\n    }\n\n    const blobServiceClient = new BlobServiceClient(\n      blobServiceClientUrl,\n      credential,\n    );\n    return blobServiceClient.getContainerClient(containerName);\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    const { etag, lastModifiedAfter } = options ?? {};\n\n    try {\n      const { path, container } = parseUrl(url);\n\n      const containerClient = await this.deps.createContainerClient(container);\n      const blobClient = containerClient.getBlobClient(path);\n\n      const getBlobOptions: BlobDownloadOptions = {\n        abortSignal: options?.signal,\n        conditions: {\n          ...(etag && { ifNoneMatch: etag }),\n          ...(lastModifiedAfter && { ifModifiedSince: lastModifiedAfter }),\n        },\n      };\n\n      const downloadBlockBlobResponse = await blobClient.download(\n        0,\n        undefined,\n        getBlobOptions,\n      );\n\n      return ReadUrlResponseFactory.fromReadable(\n        downloadBlockBlobResponse.readableStreamBody as Readable,\n        {\n          etag: downloadBlockBlobResponse.etag,\n          lastModifiedAt: downloadBlockBlobResponse.lastModified,\n        },\n      );\n    } catch (e) {\n      if (e.statusCode === 304) {\n        throw new NotModifiedError();\n      }\n\n      throw new ForwardedError(\n        'Could not retrieve file from Azure Blob Storage',\n        e,\n      );\n    }\n  }\n\n  async readTree(\n    url: string,\n    options?: UrlReaderServiceReadTreeOptions,\n  ): Promise<UrlReaderServiceReadTreeResponse> {\n    try {\n      const { path, container } = parseUrl(url);\n\n      const containerClient = await this.deps.createContainerClient(container);\n      const blobs = containerClient.listBlobsFlat({ prefix: path });\n\n      const responses = [];\n\n      for await (const blob of blobs) {\n        const blobClient = containerClient.getBlobClient(blob.name);\n\n        const downloadBlockBlobResponse = await blobClient.download(\n          undefined,\n          undefined,\n          { abortSignal: options?.signal },\n        );\n\n        responses.push({\n          data: Readable.from(\n            downloadBlockBlobResponse.readableStreamBody as Readable,\n          ),\n          path: relative(path, blob.name),\n          lastModifiedAt: blob.properties.lastModified,\n        });\n      }\n\n      return this.deps.treeResponseFactory.fromReadableArray(responses);\n    } catch (e) {\n      throw new ForwardedError(\n        'Could not retrieve file tree from Azure Blob Storage',\n        e,\n      );\n    }\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { path } = parseUrl(url);\n\n    if (path.match(/[*?]/)) {\n      throw new Error(\n        'Glob search pattern not implemented for AzureBlobStorageUrlReader',\n      );\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      throw toError(e);\n    }\n  }\n\n  toString() {\n    const accountName = this.integration.config.accountName;\n    const accountKey = this.integration.config.accountKey;\n    return `azureBlobStorage{accountName=${accountName},authed=${Boolean(\n      accountKey,\n    )}}`;\n  }\n}\n"],"names":["ScmIntegrations","DefaultAzureCredentialsManager","StorageSharedKeyCredential","blobServiceClient","BlobServiceClient","ReadUrlResponseFactory","NotModifiedError","ForwardedError","Readable","relative","toError"],"mappings":";;;;;;;;;AA2CO,SAAS,SAAS,GAAA,EAAkD;AACzE,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,MAAM,eAAe,SAAA,CAAU,QAAA,CAAS,MAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAEjE,EAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,GAAG,CAAA,CAAE,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,SAAA,GAAY,aAAa,CAAC,CAAA;AAChC,EAAA,MAAM,OAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AAE3C,EAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAC3B;AAOO,MAAM,yBAAA,CAAsD;AAAA,EACjE,OAAO,OAAA,GAAyB,CAAC,EAAE,MAAA,EAAQ,qBAAoB,KAAM;AACnE,IAAA,MAAM,YAAA,GAAeA,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AAEtD,IAAA,MAAM,YAAA,GACJC,0CAAA,CAA+B,gBAAA,CAAiB,YAAY,CAAA;AAE9D,IAAA,OAAO,YAAA,CAAa,gBAAA,CAAiB,IAAA,EAAK,CAAE,IAAI,CAAA,iBAAA,KAAqB;AACnE,MAAA,MAAM,SAAS,IAAI,yBAAA;AAAA,QACjB,YAAA;AAAA,QACA,iBAAA;AAAA,QACA;AAAA,UACE;AAAA;AACF,OACF;AAEA,MAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KACjB,GAAA,CAAI,IAAA,CAAK,QAAA;AAAA,QACP,GAAG,iBAAA,CAAkB,MAAA,CAAO,WAAW,CAAA,CAAA,EAAI,iBAAA,CAAkB,OAAO,IAAI,CAAA;AAAA,OAC1E;AACF,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEiB,WAAA;AAAA,EACA,IAAA;AAAA,EAKjB,WAAA,CACE,YAAA,EACA,WAAA,EACA,IAAA,EAMA;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,GAAG,IAAA;AAAA,MACH,uBACE,IAAA,CAAK,qBAAA,IACL,KAAK,6BAAA,CAA8B,IAAA,CAAK,MAAM,YAAY;AAAA,KAC9D;AAAA,EACF;AAAA,EAEA,MAAM,6BAAA,CACJ,YAAA,EACA,aAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAA;AAC5C,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,UAAA;AAE3C,IAAA,IAAI,cAAc,WAAA,EAAa;AAC7B,MAAA,MAAM,KAAA,GAAQ,IAAIC,sCAAA,CAA2B,WAAA,EAAa,UAAU,CAAA;AACpE,MAAA,MAAMC,qBAAoB,IAAIC,6BAAA;AAAA,QAC5B,WAAW,WAAW,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA,QACtD;AAAA,OACF;AACA,MAAA,OAAOD,kBAAAA,CAAkB,mBAAmB,aAAa,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,YAAA,CAAa,cAAA,CAAe,WAAqB,CAAA;AAE1E,IAAA,IAAI,oBAAA;AAEJ,IAAA,IAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAA,EAAU;AACpC,MAAA,IAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAA,EAAU;AACpC,QAAA,oBAAA,GAAuB,CAAA,EAAG,KAAK,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,MAChG,CAAA,MAAO;AACL,QAAA,oBAAA,GAAuB,CAAA,EAAG,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,MAC5D;AAAA,IACF,CAAA,MAAO;AACL,MAAA,oBAAA,GAAuB,CAAA,QAAA,EAAW,KAAK,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,CAAA;AAAA,IACvG;AAEA,IAAA,MAAM,oBAAoB,IAAIC,6BAAA;AAAA,MAC5B,oBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,iBAAA,CAAkB,mBAAmB,aAAa,CAAA;AAAA,EAC3D;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,MAAM,EAAE,IAAA,EAAM,iBAAA,EAAkB,GAAI,WAAW,EAAC;AAEhD,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,SAAS,GAAG,CAAA;AAExC,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,IAAA,CAAK,sBAAsB,SAAS,CAAA;AACvE,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,aAAA,CAAc,IAAI,CAAA;AAErD,MAAA,MAAM,cAAA,GAAsC;AAAA,QAC1C,aAAa,OAAA,EAAS,MAAA;AAAA,QACtB,UAAA,EAAY;AAAA,UACV,GAAI,IAAA,IAAQ,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,UAChC,GAAI,iBAAA,IAAqB,EAAE,eAAA,EAAiB,iBAAA;AAAkB;AAChE,OACF;AAEA,MAAA,MAAM,yBAAA,GAA4B,MAAM,UAAA,CAAW,QAAA;AAAA,QACjD,CAAA;AAAA,QACA,KAAA,CAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,OAAOC,6CAAA,CAAuB,YAAA;AAAA,QAC5B,yBAAA,CAA0B,kBAAA;AAAA,QAC1B;AAAA,UACE,MAAM,yBAAA,CAA0B,IAAA;AAAA,UAChC,gBAAgB,yBAAA,CAA0B;AAAA;AAC5C,OACF;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,eAAe,GAAA,EAAK;AACxB,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,IAAIC,qBAAA;AAAA,QACR,iDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,CACJ,GAAA,EACA,OAAA,EAC2C;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,SAAS,GAAG,CAAA;AAExC,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,IAAA,CAAK,sBAAsB,SAAS,CAAA;AACvE,MAAA,MAAM,QAAQ,eAAA,CAAgB,aAAA,CAAc,EAAE,MAAA,EAAQ,MAAM,CAAA;AAE5D,MAAA,MAAM,YAAY,EAAC;AAEnB,MAAA,WAAA,MAAiB,QAAQ,KAAA,EAAO;AAC9B,QAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AAE1D,QAAA,MAAM,yBAAA,GAA4B,MAAM,UAAA,CAAW,QAAA;AAAA,UACjD,KAAA,CAAA;AAAA,UACA,KAAA,CAAA;AAAA,UACA,EAAE,WAAA,EAAa,OAAA,EAAS,MAAA;AAAO,SACjC;AAEA,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,MAAMC,oBAAA,CAAS,IAAA;AAAA,YACb,yBAAA,CAA0B;AAAA,WAC5B;AAAA,UACA,IAAA,EAAMC,cAAA,CAAS,IAAA,EAAM,IAAA,CAAK,IAAI,CAAA;AAAA,UAC9B,cAAA,EAAgB,KAAK,UAAA,CAAW;AAAA,SACjC,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoB,iBAAA,CAAkB,SAAS,CAAA;AAAA,IAClE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAIF,qBAAA;AAAA,QACR,sDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,QAAA,CAAS,GAAG,CAAA;AAE7B,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAMG,eAAQ,CAAC,CAAA;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAA;AAC5C,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,UAAA;AAC3C,IAAA,OAAO,CAAA,6BAAA,EAAgC,WAAW,CAAA,QAAA,EAAW,OAAA;AAAA,MAC3D;AAAA,KACD,CAAA,CAAA,CAAA;AAAA,EACH;AACF;;;;;"}
+{"version":3,"file":"AzureBlobStorageUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/AzureBlobStorageUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BlobDownloadOptions,\n  BlobServiceClient,\n  ContainerClient,\n  StorageSharedKeyCredential,\n} from '@azure/storage-blob';\nimport { ReaderFactory, ReadTreeResponseFactory } from './types';\nimport { toError, ForwardedError, NotModifiedError } from '@backstage/errors';\nimport { Readable } from 'node:stream';\nimport { relative } from 'node:path/posix';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { hasDotPathSegments, isUrlPathWithoutDotSegments } from './util';\nimport {\n  AzureBlobStorageIntegration,\n  AzureCredentialsManager,\n  DefaultAzureCredentialsManager,\n  ScmIntegrations,\n} from '@backstage/integration';\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeOptions,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\n\nexport function parseUrl(url: string): { path: string; container: string } {\n  if (!isUrlPathWithoutDotSegments(url)) {\n    throw new Error(`Invalid Azure Blob Storage URL format: ${url}`);\n  }\n\n  const parsedUrl = new URL(url);\n  const pathSegments = parsedUrl.pathname\n    .split('/')\n    .filter(Boolean)\n    .map(decodeURIComponent);\n\n  if (pathSegments.length < 1) {\n    throw new Error(`Invalid Azure Blob Storage URL format: ${url}`);\n  }\n\n  // First segment is the container name, rest is the blob path\n  const container = pathSegments[0];\n  const path = pathSegments.slice(1).join('/');\n\n  return { path, container };\n}\n\n/**\n * Implements a {@link @backstage/backend-plugin-api#UrlReaderService} for Azure storage accounts urls.\n *\n * @public\n */\nexport class AzureBlobStorageUrlReader implements UrlReaderService {\n  static factory: ReaderFactory = ({ config, treeResponseFactory }) => {\n    const integrations = ScmIntegrations.fromConfig(config);\n\n    const credsManager =\n      DefaultAzureCredentialsManager.fromIntegrations(integrations);\n\n    return integrations.azureBlobStorage.list().map(integrationConfig => {\n      const reader = new AzureBlobStorageUrlReader(\n        credsManager,\n        integrationConfig,\n        {\n          treeResponseFactory,\n        },\n      );\n\n      const predicate = (url: URL) =>\n        url.host.endsWith(\n          `${integrationConfig.config.accountName}.${integrationConfig.config.host}`,\n        );\n      return { reader, predicate };\n    });\n  };\n\n  private readonly integration: AzureBlobStorageIntegration;\n  private readonly deps: {\n    treeResponseFactory: ReadTreeResponseFactory;\n    createContainerClient: (containerName: string) => Promise<ContainerClient>;\n  };\n\n  constructor(\n    credsManager: AzureCredentialsManager,\n    integration: AzureBlobStorageIntegration,\n    deps: {\n      treeResponseFactory: ReadTreeResponseFactory;\n      createContainerClient?: (\n        containerName: string,\n      ) => Promise<ContainerClient>;\n    },\n  ) {\n    this.integration = integration;\n    this.deps = {\n      ...deps,\n      createContainerClient:\n        deps.createContainerClient ??\n        this.#defaultCreateContainerClient.bind(this, credsManager),\n    };\n  }\n\n  async #defaultCreateContainerClient(\n    credsManager: AzureCredentialsManager,\n    containerName: string,\n  ): Promise<ContainerClient> {\n    const accountName = this.integration.config.accountName;\n    const accountKey = this.integration.config.accountKey;\n\n    if (accountKey && accountName) {\n      const creds = new StorageSharedKeyCredential(accountName, accountKey);\n      const blobServiceClient = new BlobServiceClient(\n        `https://${accountName}.${this.integration.config.host}`,\n        creds,\n      );\n      return blobServiceClient.getContainerClient(containerName);\n    }\n\n    const credential = await credsManager.getCredentials(accountName as string);\n\n    let blobServiceClientUrl: string;\n\n    if (this.integration.config.endpoint) {\n      if (this.integration.config.sasToken) {\n        blobServiceClientUrl = `${this.integration.config.endpoint}?${this.integration.config.sasToken}`;\n      } else {\n        blobServiceClientUrl = `${this.integration.config.endpoint}`;\n      }\n    } else {\n      blobServiceClientUrl = `https://${this.integration.config.accountName}.${this.integration.config.host}`;\n    }\n\n    const blobServiceClient = new BlobServiceClient(\n      blobServiceClientUrl,\n      credential,\n    );\n    return blobServiceClient.getContainerClient(containerName);\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    const { etag, lastModifiedAfter } = options ?? {};\n\n    try {\n      const { path, container } = parseUrl(url);\n\n      const containerClient = await this.deps.createContainerClient(container);\n      const blobClient = containerClient.getBlobClient(path);\n\n      const getBlobOptions: BlobDownloadOptions = {\n        abortSignal: options?.signal,\n        conditions: {\n          ...(etag && { ifNoneMatch: etag }),\n          ...(lastModifiedAfter && { ifModifiedSince: lastModifiedAfter }),\n        },\n      };\n\n      const downloadBlockBlobResponse = await blobClient.download(\n        0,\n        undefined,\n        getBlobOptions,\n      );\n\n      return ReadUrlResponseFactory.fromReadable(\n        downloadBlockBlobResponse.readableStreamBody as Readable,\n        {\n          etag: downloadBlockBlobResponse.etag,\n          lastModifiedAt: downloadBlockBlobResponse.lastModified,\n        },\n      );\n    } catch (e) {\n      if (e.statusCode === 304) {\n        throw new NotModifiedError();\n      }\n\n      throw new ForwardedError(\n        'Could not retrieve file from Azure Blob Storage',\n        e,\n      );\n    }\n  }\n\n  async readTree(\n    url: string,\n    options?: UrlReaderServiceReadTreeOptions,\n  ): Promise<UrlReaderServiceReadTreeResponse> {\n    try {\n      const { path, container } = parseUrl(url);\n\n      const containerClient = await this.deps.createContainerClient(container);\n      const blobs = containerClient.listBlobsFlat({ prefix: path });\n\n      const responses = [];\n\n      for await (const blob of blobs) {\n        if (hasDotPathSegments(blob.name)) {\n          continue;\n        }\n        const blobClient = containerClient.getBlobClient(blob.name);\n\n        const downloadBlockBlobResponse = await blobClient.download(\n          undefined,\n          undefined,\n          { abortSignal: options?.signal },\n        );\n\n        responses.push({\n          data: Readable.from(\n            downloadBlockBlobResponse.readableStreamBody as Readable,\n          ),\n          path: relative(path, blob.name),\n          lastModifiedAt: blob.properties.lastModified,\n        });\n      }\n\n      return this.deps.treeResponseFactory.fromReadableArray(responses);\n    } catch (e) {\n      throw new ForwardedError(\n        'Could not retrieve file tree from Azure Blob Storage',\n        e,\n      );\n    }\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { path } = parseUrl(url);\n\n    if (path.match(/[*?]/)) {\n      throw new Error(\n        'Glob search pattern not implemented for AzureBlobStorageUrlReader',\n      );\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      throw toError(e);\n    }\n  }\n\n  toString() {\n    const accountName = this.integration.config.accountName;\n    const accountKey = this.integration.config.accountKey;\n    return `azureBlobStorage{accountName=${accountName},authed=${Boolean(\n      accountKey,\n    )}}`;\n  }\n}\n"],"names":["isUrlPathWithoutDotSegments","ScmIntegrations","DefaultAzureCredentialsManager","StorageSharedKeyCredential","blobServiceClient","BlobServiceClient","ReadUrlResponseFactory","NotModifiedError","ForwardedError","hasDotPathSegments","Readable","relative","toError"],"mappings":";;;;;;;;;;AA4CO,SAAS,SAAS,GAAA,EAAkD;AACzE,EAAA,IAAI,CAACA,gCAAA,CAA4B,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,GAAG,CAAA,CAAE,CAAA;AAAA,EACjE;AAEA,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,MAAM,YAAA,GAAe,SAAA,CAAU,QAAA,CAC5B,KAAA,CAAM,GAAG,EACT,MAAA,CAAO,OAAO,CAAA,CACd,GAAA,CAAI,kBAAkB,CAAA;AAEzB,EAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,GAAG,CAAA,CAAE,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,SAAA,GAAY,aAAa,CAAC,CAAA;AAChC,EAAA,MAAM,OAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AAE3C,EAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAC3B;AAOO,MAAM,yBAAA,CAAsD;AAAA,EACjE,OAAO,OAAA,GAAyB,CAAC,EAAE,MAAA,EAAQ,qBAAoB,KAAM;AACnE,IAAA,MAAM,YAAA,GAAeC,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AAEtD,IAAA,MAAM,YAAA,GACJC,0CAAA,CAA+B,gBAAA,CAAiB,YAAY,CAAA;AAE9D,IAAA,OAAO,YAAA,CAAa,gBAAA,CAAiB,IAAA,EAAK,CAAE,IAAI,CAAA,iBAAA,KAAqB;AACnE,MAAA,MAAM,SAAS,IAAI,yBAAA;AAAA,QACjB,YAAA;AAAA,QACA,iBAAA;AAAA,QACA;AAAA,UACE;AAAA;AACF,OACF;AAEA,MAAA,MAAM,SAAA,GAAY,CAAC,GAAA,KACjB,GAAA,CAAI,IAAA,CAAK,QAAA;AAAA,QACP,GAAG,iBAAA,CAAkB,MAAA,CAAO,WAAW,CAAA,CAAA,EAAI,iBAAA,CAAkB,OAAO,IAAI,CAAA;AAAA,OAC1E;AACF,MAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEiB,WAAA;AAAA,EACA,IAAA;AAAA,EAKjB,WAAA,CACE,YAAA,EACA,WAAA,EACA,IAAA,EAMA;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,GAAG,IAAA;AAAA,MACH,uBACE,IAAA,CAAK,qBAAA,IACL,KAAK,6BAAA,CAA8B,IAAA,CAAK,MAAM,YAAY;AAAA,KAC9D;AAAA,EACF;AAAA,EAEA,MAAM,6BAAA,CACJ,YAAA,EACA,aAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAA;AAC5C,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,UAAA;AAE3C,IAAA,IAAI,cAAc,WAAA,EAAa;AAC7B,MAAA,MAAM,KAAA,GAAQ,IAAIC,sCAAA,CAA2B,WAAA,EAAa,UAAU,CAAA;AACpE,MAAA,MAAMC,qBAAoB,IAAIC,6BAAA;AAAA,QAC5B,WAAW,WAAW,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA,QACtD;AAAA,OACF;AACA,MAAA,OAAOD,kBAAAA,CAAkB,mBAAmB,aAAa,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,YAAA,CAAa,cAAA,CAAe,WAAqB,CAAA;AAE1E,IAAA,IAAI,oBAAA;AAEJ,IAAA,IAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAA,EAAU;AACpC,MAAA,IAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAA,EAAU;AACpC,QAAA,oBAAA,GAAuB,CAAA,EAAG,KAAK,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,MAChG,CAAA,MAAO;AACL,QAAA,oBAAA,GAAuB,CAAA,EAAG,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,MAC5D;AAAA,IACF,CAAA,MAAO;AACL,MAAA,oBAAA,GAAuB,CAAA,QAAA,EAAW,KAAK,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,CAAA;AAAA,IACvG;AAEA,IAAA,MAAM,oBAAoB,IAAIC,6BAAA;AAAA,MAC5B,oBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,iBAAA,CAAkB,mBAAmB,aAAa,CAAA;AAAA,EAC3D;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,MAAM,EAAE,IAAA,EAAM,iBAAA,EAAkB,GAAI,WAAW,EAAC;AAEhD,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,SAAS,GAAG,CAAA;AAExC,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,IAAA,CAAK,sBAAsB,SAAS,CAAA;AACvE,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,aAAA,CAAc,IAAI,CAAA;AAErD,MAAA,MAAM,cAAA,GAAsC;AAAA,QAC1C,aAAa,OAAA,EAAS,MAAA;AAAA,QACtB,UAAA,EAAY;AAAA,UACV,GAAI,IAAA,IAAQ,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,UAChC,GAAI,iBAAA,IAAqB,EAAE,eAAA,EAAiB,iBAAA;AAAkB;AAChE,OACF;AAEA,MAAA,MAAM,yBAAA,GAA4B,MAAM,UAAA,CAAW,QAAA;AAAA,QACjD,CAAA;AAAA,QACA,KAAA,CAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,OAAOC,6CAAA,CAAuB,YAAA;AAAA,QAC5B,yBAAA,CAA0B,kBAAA;AAAA,QAC1B;AAAA,UACE,MAAM,yBAAA,CAA0B,IAAA;AAAA,UAChC,gBAAgB,yBAAA,CAA0B;AAAA;AAC5C,OACF;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,CAAE,eAAe,GAAA,EAAK;AACxB,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,IAAIC,qBAAA;AAAA,QACR,iDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,CACJ,GAAA,EACA,OAAA,EAC2C;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,SAAS,GAAG,CAAA;AAExC,MAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,IAAA,CAAK,sBAAsB,SAAS,CAAA;AACvE,MAAA,MAAM,QAAQ,eAAA,CAAgB,aAAA,CAAc,EAAE,MAAA,EAAQ,MAAM,CAAA;AAE5D,MAAA,MAAM,YAAY,EAAC;AAEnB,MAAA,WAAA,MAAiB,QAAQ,KAAA,EAAO;AAC9B,QAAA,IAAIC,uBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,UAAA;AAAA,QACF;AACA,QAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AAE1D,QAAA,MAAM,yBAAA,GAA4B,MAAM,UAAA,CAAW,QAAA;AAAA,UACjD,KAAA,CAAA;AAAA,UACA,KAAA,CAAA;AAAA,UACA,EAAE,WAAA,EAAa,OAAA,EAAS,MAAA;AAAO,SACjC;AAEA,QAAA,SAAA,CAAU,IAAA,CAAK;AAAA,UACb,MAAMC,oBAAA,CAAS,IAAA;AAAA,YACb,yBAAA,CAA0B;AAAA,WAC5B;AAAA,UACA,IAAA,EAAMC,cAAA,CAAS,IAAA,EAAM,IAAA,CAAK,IAAI,CAAA;AAAA,UAC9B,cAAA,EAAgB,KAAK,UAAA,CAAW;AAAA,SACjC,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoB,iBAAA,CAAkB,SAAS,CAAA;AAAA,IAClE,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAIH,qBAAA;AAAA,QACR,sDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,QAAA,CAAS,GAAG,CAAA;AAE7B,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAMI,eAAQ,CAAC,CAAA;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,WAAA;AAC5C,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,UAAA;AAC3C,IAAA,OAAO,CAAA,6BAAA,EAAgC,WAAW,CAAA,QAAA,EAAW,OAAA;AAAA,MAC3D;AAAA,KACD,CAAA,CAAA,CAAA;AAAA,EACH;AACF;;;;;"}

package/dist/entrypoints/urlReader/lib/FetchUrlReader.cjs.js

@@ -43,9 +43,10 @@ function predicateFromConfig(config) {
     const paths = allowConfig.getOptionalStringArray("paths");
     const checkPath = paths ? (url) => {
       const targetPath = platformPath__default.default.posix.normalize(url.pathname);
-      return paths.some(
-        (allowedPath) => targetPath.startsWith(allowedPath)
-      );
+      return paths.some((allowedPath) => {
+        const allowedPathPrefix = allowedPath.endsWith("/") ? allowedPath : `${allowedPath}/`;
+        return targetPath === allowedPath || targetPath.startsWith(allowedPathPrefix);
+      });
     } : (_url) => true;
     const host = allowConfig.getString("host");
     const [hostname, port] = host.split(":");
@@ -69,7 +70,9 @@ class FetchUrlReader {
    *   For example 'example.com' and '*.example.com' are valid values, 'prod.*.example.com' is not.
    *
    * `paths`:
-   *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.
+   *   An optional list of paths which are allowed. Each entry matches the exact path or paths
+   *   below it at a segment boundary. A trailing slash only matches that path with the slash and
+   *   paths below it. If the list is omitted all paths are allowed.
    */
   static factory = ({ config }) => {
     const predicate = predicateFromConfig(config);

package/dist/entrypoints/urlReader/lib/FetchUrlReader.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"FetchUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/FetchUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport { toError, NotFoundError, NotModifiedError } from '@backstage/errors';\nimport { ReaderFactory } from './types';\nimport path from 'node:path';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { Config } from '@backstage/config';\n\nconst REDIRECT_STATUS_CODES = [301, 302, 307, 308];\nconst MAX_REDIRECTS = 5;\n\nconst isInRange = (num: number, [start, end]: [number, number]) => {\n  return num >= start && num <= end;\n};\n\nconst parsePortRange = (port: string): [number, number] => {\n  const isRange = port.includes('-');\n  if (isRange) {\n    const range = port\n      .split('-')\n      .map(v => parseInt(v, 10))\n      .filter(Boolean) as [number, number];\n    if (range.length !== 2) throw new Error(`Port range is not valid: ${port}`);\n    const [start, end] = range;\n    if (start <= 0 || end <= 0 || start > end)\n      throw new Error(`Port range is not valid: [${start}, ${end}]`);\n    return range;\n  }\n  const parsedPort = parseInt(port, 10);\n  return [parsedPort, parsedPort];\n};\n\nconst parsePortPredicate = (port: string | undefined) => {\n  if (port) {\n    const range = parsePortRange(port);\n    return (url: URL) => {\n      if (url.port) return isInRange(parseInt(url.port, 10), range);\n\n      if (url.protocol === 'http:') return isInRange(80, range);\n      if (url.protocol === 'https:') return isInRange(443, range);\n      return false;\n    };\n  }\n  return (url: URL) => !url.port;\n};\n\nfunction predicateFromConfig(config: Config): (url: URL) => boolean {\n  const allow = config\n    .getOptionalConfigArray('backend.reading.allow')\n    ?.map(allowConfig => {\n      const paths = allowConfig.getOptionalStringArray('paths');\n      const checkPath = paths\n        ? (url: URL) => {\n            const targetPath = path.posix.normalize(url.pathname);\n            return paths.some(allowedPath =>\n              targetPath.startsWith(allowedPath),\n            );\n          }\n        : (_url: URL) => true;\n      const host = allowConfig.getString('host');\n      const [hostname, port] = host.split(':');\n\n      const checkPort = parsePortPredicate(port);\n\n      if (hostname.startsWith('*.')) {\n        const suffix = hostname.slice(1);\n        return (url: URL) =>\n          url.hostname.endsWith(suffix) && checkPath(url) && checkPort(url);\n      }\n\n      return (url: URL) =>\n        url.hostname === hostname && checkPath(url) && checkPort(url);\n    });\n\n  return allow?.length ? url => allow.some(p => p(url)) : () => false;\n}\n\n/**\n * A {@link @backstage/backend-plugin-api#UrlReaderService} that does a plain fetch of the URL.\n *\n * @public\n */\nexport class FetchUrlReader implements UrlReaderService {\n  /**\n   * The factory creates a single reader that will be used for reading any URL that's listed\n   * in configuration at `backend.reading.allow`. The allow list contains a list of objects describing\n   * targets to allow, containing the following fields:\n   *\n   * `host`:\n   *   Either full hostnames to match, or subdomain wildcard matchers with a leading '*'.\n   *   For example 'example.com' and '*.example.com' are valid values, 'prod.*.example.com' is not.\n   *\n   * `paths`:\n   *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.\n   */\n  static factory: ReaderFactory = ({ config }) => {\n    const predicate = predicateFromConfig(config);\n    const reader = new FetchUrlReader({ predicate });\n    return [{ reader, predicate }];\n  };\n\n  static fromConfig(config: Config): FetchUrlReader {\n    return new FetchUrlReader({ predicate: predicateFromConfig(config) });\n  }\n\n  readonly #predicate: (url: URL) => boolean;\n\n  private constructor(options: { predicate: (url: URL) => boolean }) {\n    this.#predicate = options.predicate;\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    let currentUrl = url;\n\n    for (\n      let redirectCount = 0;\n      redirectCount < MAX_REDIRECTS;\n      redirectCount += 1\n    ) {\n      // Validate URL against predicate if configured\n      const parsedUrl = new URL(currentUrl);\n      if (!this.#predicate(parsedUrl)) {\n        throw new Error(\n          `URL not allowed by backend.reading.allow configuration: ${currentUrl}`,\n        );\n      }\n\n      let response: Response;\n      try {\n        response = await fetch(currentUrl, {\n          headers: {\n            ...(options?.etag && { 'If-None-Match': options.etag }),\n            ...(options?.lastModifiedAfter && {\n              'If-Modified-Since': options.lastModifiedAfter.toUTCString(),\n            }),\n            ...(options?.token && { Authorization: `Bearer ${options.token}` }),\n          },\n          // Handle redirects manually to validate targets against the allowlist\n          redirect: 'manual',\n          // TODO(freben): The signal cast is there because pre-3.x versions of\n          // node-fetch have a very slightly deviating AbortSignal type signature.\n          // The difference does not affect us in practice however. The cast can\n          // be removed after we support ESM for CLI dependencies and migrate to\n          // version 3 of node-fetch.\n          // https://github.com/backstage/backstage/issues/8242\n          signal: options?.signal as any,\n        });\n      } catch (e) {\n        throw new Error(`Unable to read ${currentUrl}, ${e}`);\n      }\n\n      if (response.ok) {\n        return ReadUrlResponseFactory.fromResponse(response);\n      }\n\n      if (response.status === 304) {\n        throw new NotModifiedError();\n      }\n\n      const location = response.headers.get('location');\n      if (!REDIRECT_STATUS_CODES.includes(response.status) || !location) {\n        const message = `could not read ${currentUrl}, ${response.status} ${response.statusText}`;\n        if (response.status === 404) {\n          throw new NotFoundError(message);\n        }\n        throw new Error(message);\n      }\n\n      // Follow the redirect\n      currentUrl = new URL(location, currentUrl).toString();\n    }\n\n    throw new Error(\n      `Too many redirects (max ${MAX_REDIRECTS}) when reading ${url}`,\n    );\n  }\n\n  async readTree(): Promise<UrlReaderServiceReadTreeResponse> {\n    throw new Error('FetchUrlReader does not implement readTree');\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { pathname } = new URL(url);\n\n    if (pathname.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      const error = toError(e);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    return 'fetch{}';\n  }\n}\n"],"names":["path","ReadUrlResponseFactory","NotModifiedError","NotFoundError","toError"],"mappings":";;;;;;;;;;AA8BA,MAAM,qBAAA,GAAwB,CAAC,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AACjD,MAAM,aAAA,GAAgB,CAAA;AAEtB,MAAM,YAAY,CAAC,GAAA,EAAa,CAAC,KAAA,EAAO,GAAG,CAAA,KAAwB;AACjE,EAAA,OAAO,GAAA,IAAO,SAAS,GAAA,IAAO,GAAA;AAChC,CAAA;AAEA,MAAM,cAAA,GAAiB,CAAC,IAAA,KAAmC;AACzD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,KAAA,GAAQ,IAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,CAAA,KAAK,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA,CACxB,OAAO,OAAO,CAAA;AACjB,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAE,CAAA;AAC1E,IAAA,MAAM,CAAC,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AACrB,IAAA,IAAI,KAAA,IAAS,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,KAAA,GAAQ,GAAA;AACpC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,KAAK,CAAA,EAAA,EAAK,GAAG,CAAA,CAAA,CAAG,CAAA;AAC/D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,IAAA,EAAM,EAAE,CAAA;AACpC,EAAA,OAAO,CAAC,YAAY,UAAU,CAAA;AAChC,CAAA;AAEA,MAAM,kBAAA,GAAqB,CAAC,IAAA,KAA6B;AACvD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAI,CAAA;AACjC,IAAA,OAAO,CAAC,GAAA,KAAa;AACnB,MAAA,IAAI,GAAA,CAAI,MAAM,OAAO,SAAA,CAAU,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAG,KAAK,CAAA;AAE5D,MAAA,IAAI,IAAI,QAAA,KAAa,OAAA,EAAS,OAAO,SAAA,CAAU,IAAI,KAAK,CAAA;AACxD,MAAA,IAAI,IAAI,QAAA,KAAa,QAAA,EAAU,OAAO,SAAA,CAAU,KAAK,KAAK,CAAA;AAC1D,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAA,KAAa,CAAC,GAAA,CAAI,IAAA;AAC5B,CAAA;AAEA,SAAS,oBAAoB,MAAA,EAAuC;AAClE,EAAA,MAAM,QAAQ,MAAA,CACX,sBAAA,CAAuB,uBAAuB,CAAA,EAC7C,IAAI,CAAA,WAAA,KAAe;AACnB,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,sBAAA,CAAuB,OAAO,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,KAAA,GACd,CAAC,GAAA,KAAa;AACZ,MAAA,MAAM,UAAA,GAAaA,6BAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAI,QAAQ,CAAA;AACpD,MAAA,OAAO,KAAA,CAAM,IAAA;AAAA,QAAK,CAAA,WAAA,KAChB,UAAA,CAAW,UAAA,CAAW,WAAW;AAAA,OACnC;AAAA,IACF,CAAA,GACA,CAAC,IAAA,KAAc,IAAA;AACnB,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,SAAA,CAAU,MAAM,CAAA;AACzC,IAAA,MAAM,CAAC,QAAA,EAAU,IAAI,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAEvC,IAAA,MAAM,SAAA,GAAY,mBAAmB,IAAI,CAAA;AAEzC,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC7B,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA;AAC/B,MAAA,OAAO,CAAC,GAAA,KACN,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,CAAC,QACN,GAAA,CAAI,QAAA,KAAa,YAAY,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,EAChE,CAAC,CAAA;AAEH,EAAA,OAAO,KAAA,EAAO,MAAA,GAAS,CAAA,GAAA,KAAO,KAAA,CAAM,IAAA,CAAK,OAAK,CAAA,CAAE,GAAG,CAAC,CAAA,GAAI,MAAM,KAAA;AAChE;AAOO,MAAM,cAAA,CAA2C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAatD,OAAO,OAAA,GAAyB,CAAC,EAAE,QAAO,KAAM;AAC9C,IAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAAe,EAAE,WAAW,CAAA;AAC/C,IAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAAA,EAC/B,CAAA;AAAA,EAEA,OAAO,WAAW,MAAA,EAAgC;AAChD,IAAA,OAAO,IAAI,cAAA,CAAe,EAAE,WAAW,mBAAA,CAAoB,MAAM,GAAG,CAAA;AAAA,EACtE;AAAA,EAES,UAAA;AAAA,EAED,YAAY,OAAA,EAA+C;AACjE,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,SAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,IAAI,UAAA,GAAa,GAAA;AAEjB,IAAA,KAAA,IACM,aAAA,GAAgB,CAAA,EACpB,aAAA,GAAgB,aAAA,EAChB,iBAAiB,CAAA,EACjB;AAEA,MAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AACpC,MAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,2DAA2D,UAAU,CAAA;AAAA,SACvE;AAAA,MACF;AAEA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,MAAM,UAAA,EAAY;AAAA,UACjC,OAAA,EAAS;AAAA,YACP,GAAI,OAAA,EAAS,IAAA,IAAQ,EAAE,eAAA,EAAiB,QAAQ,IAAA,EAAK;AAAA,YACrD,GAAI,SAAS,iBAAA,IAAqB;AAAA,cAChC,mBAAA,EAAqB,OAAA,CAAQ,iBAAA,CAAkB,WAAA;AAAY,aAC7D;AAAA,YACA,GAAI,SAAS,KAAA,IAAS,EAAE,eAAe,CAAA,OAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,CAAA;AAAG,WACnE;AAAA;AAAA,UAEA,QAAA,EAAU,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOV,QAAQ,OAAA,EAAS;AAAA,SAClB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,UAAU,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,MACtD;AAEA,MAAA,IAAI,SAAS,EAAA,EAAI;AACf,QAAA,OAAOC,6CAAA,CAAuB,aAAa,QAAQ,CAAA;AAAA,MACrD;AAEA,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,qBAAA,CAAsB,QAAA,CAAS,SAAS,MAAM,CAAA,IAAK,CAAC,QAAA,EAAU;AACjE,QAAA,MAAM,OAAA,GAAU,kBAAkB,UAAU,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AACvF,QAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,UAAA,MAAM,IAAIC,qBAAc,OAAO,CAAA;AAAA,QACjC;AACA,QAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,MACzB;AAGA,MAAA,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,EAAE,QAAA,EAAS;AAAA,IACtD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,aAAa,CAAA,eAAA,EAAkB,GAAG,CAAA;AAAA,KAC/D;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAAsD;AAC1D,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,IAAI,IAAI,GAAG,CAAA;AAEhC,IAAA,IAAI,QAAA,CAAS,KAAA,CAAM,MAAM,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAA,GAAQC,eAAQ,CAAC,CAAA;AACvB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"FetchUrlReader.cjs.js","sources":["../../../../src/entrypoints/urlReader/lib/FetchUrlReader.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  UrlReaderService,\n  UrlReaderServiceReadTreeResponse,\n  UrlReaderServiceReadUrlOptions,\n  UrlReaderServiceReadUrlResponse,\n  UrlReaderServiceSearchOptions,\n  UrlReaderServiceSearchResponse,\n} from '@backstage/backend-plugin-api';\nimport { toError, NotFoundError, NotModifiedError } from '@backstage/errors';\nimport { ReaderFactory } from './types';\nimport path from 'node:path';\nimport { ReadUrlResponseFactory } from './ReadUrlResponseFactory';\nimport { Config } from '@backstage/config';\n\nconst REDIRECT_STATUS_CODES = [301, 302, 307, 308];\nconst MAX_REDIRECTS = 5;\n\nconst isInRange = (num: number, [start, end]: [number, number]) => {\n  return num >= start && num <= end;\n};\n\nconst parsePortRange = (port: string): [number, number] => {\n  const isRange = port.includes('-');\n  if (isRange) {\n    const range = port\n      .split('-')\n      .map(v => parseInt(v, 10))\n      .filter(Boolean) as [number, number];\n    if (range.length !== 2) throw new Error(`Port range is not valid: ${port}`);\n    const [start, end] = range;\n    if (start <= 0 || end <= 0 || start > end)\n      throw new Error(`Port range is not valid: [${start}, ${end}]`);\n    return range;\n  }\n  const parsedPort = parseInt(port, 10);\n  return [parsedPort, parsedPort];\n};\n\nconst parsePortPredicate = (port: string | undefined) => {\n  if (port) {\n    const range = parsePortRange(port);\n    return (url: URL) => {\n      if (url.port) return isInRange(parseInt(url.port, 10), range);\n\n      if (url.protocol === 'http:') return isInRange(80, range);\n      if (url.protocol === 'https:') return isInRange(443, range);\n      return false;\n    };\n  }\n  return (url: URL) => !url.port;\n};\n\nfunction predicateFromConfig(config: Config): (url: URL) => boolean {\n  const allow = config\n    .getOptionalConfigArray('backend.reading.allow')\n    ?.map(allowConfig => {\n      const paths = allowConfig.getOptionalStringArray('paths');\n      const checkPath = paths\n        ? (url: URL) => {\n            const targetPath = path.posix.normalize(url.pathname);\n            return paths.some(allowedPath => {\n              const allowedPathPrefix = allowedPath.endsWith('/')\n                ? allowedPath\n                : `${allowedPath}/`;\n              return (\n                targetPath === allowedPath ||\n                targetPath.startsWith(allowedPathPrefix)\n              );\n            });\n          }\n        : (_url: URL) => true;\n      const host = allowConfig.getString('host');\n      const [hostname, port] = host.split(':');\n\n      const checkPort = parsePortPredicate(port);\n\n      if (hostname.startsWith('*.')) {\n        const suffix = hostname.slice(1);\n        return (url: URL) =>\n          url.hostname.endsWith(suffix) && checkPath(url) && checkPort(url);\n      }\n\n      return (url: URL) =>\n        url.hostname === hostname && checkPath(url) && checkPort(url);\n    });\n\n  return allow?.length ? url => allow.some(p => p(url)) : () => false;\n}\n\n/**\n * A {@link @backstage/backend-plugin-api#UrlReaderService} that does a plain fetch of the URL.\n *\n * @public\n */\nexport class FetchUrlReader implements UrlReaderService {\n  /**\n   * The factory creates a single reader that will be used for reading any URL that's listed\n   * in configuration at `backend.reading.allow`. The allow list contains a list of objects describing\n   * targets to allow, containing the following fields:\n   *\n   * `host`:\n   *   Either full hostnames to match, or subdomain wildcard matchers with a leading '*'.\n   *   For example 'example.com' and '*.example.com' are valid values, 'prod.*.example.com' is not.\n   *\n   * `paths`:\n   *   An optional list of paths which are allowed. Each entry matches the exact path or paths\n   *   below it at a segment boundary. A trailing slash only matches that path with the slash and\n   *   paths below it. If the list is omitted all paths are allowed.\n   */\n  static factory: ReaderFactory = ({ config }) => {\n    const predicate = predicateFromConfig(config);\n    const reader = new FetchUrlReader({ predicate });\n    return [{ reader, predicate }];\n  };\n\n  static fromConfig(config: Config): FetchUrlReader {\n    return new FetchUrlReader({ predicate: predicateFromConfig(config) });\n  }\n\n  readonly #predicate: (url: URL) => boolean;\n\n  private constructor(options: { predicate: (url: URL) => boolean }) {\n    this.#predicate = options.predicate;\n  }\n\n  async read(url: string): Promise<Buffer> {\n    const response = await this.readUrl(url);\n    return response.buffer();\n  }\n\n  async readUrl(\n    url: string,\n    options?: UrlReaderServiceReadUrlOptions,\n  ): Promise<UrlReaderServiceReadUrlResponse> {\n    let currentUrl = url;\n\n    for (\n      let redirectCount = 0;\n      redirectCount < MAX_REDIRECTS;\n      redirectCount += 1\n    ) {\n      // Validate URL against predicate if configured\n      const parsedUrl = new URL(currentUrl);\n      if (!this.#predicate(parsedUrl)) {\n        throw new Error(\n          `URL not allowed by backend.reading.allow configuration: ${currentUrl}`,\n        );\n      }\n\n      let response: Response;\n      try {\n        response = await fetch(currentUrl, {\n          headers: {\n            ...(options?.etag && { 'If-None-Match': options.etag }),\n            ...(options?.lastModifiedAfter && {\n              'If-Modified-Since': options.lastModifiedAfter.toUTCString(),\n            }),\n            ...(options?.token && { Authorization: `Bearer ${options.token}` }),\n          },\n          // Handle redirects manually to validate targets against the allowlist\n          redirect: 'manual',\n          // TODO(freben): The signal cast is there because pre-3.x versions of\n          // node-fetch have a very slightly deviating AbortSignal type signature.\n          // The difference does not affect us in practice however. The cast can\n          // be removed after we support ESM for CLI dependencies and migrate to\n          // version 3 of node-fetch.\n          // https://github.com/backstage/backstage/issues/8242\n          signal: options?.signal as any,\n        });\n      } catch (e) {\n        throw new Error(`Unable to read ${currentUrl}, ${e}`);\n      }\n\n      if (response.ok) {\n        return ReadUrlResponseFactory.fromResponse(response);\n      }\n\n      if (response.status === 304) {\n        throw new NotModifiedError();\n      }\n\n      const location = response.headers.get('location');\n      if (!REDIRECT_STATUS_CODES.includes(response.status) || !location) {\n        const message = `could not read ${currentUrl}, ${response.status} ${response.statusText}`;\n        if (response.status === 404) {\n          throw new NotFoundError(message);\n        }\n        throw new Error(message);\n      }\n\n      // Follow the redirect\n      currentUrl = new URL(location, currentUrl).toString();\n    }\n\n    throw new Error(\n      `Too many redirects (max ${MAX_REDIRECTS}) when reading ${url}`,\n    );\n  }\n\n  async readTree(): Promise<UrlReaderServiceReadTreeResponse> {\n    throw new Error('FetchUrlReader does not implement readTree');\n  }\n\n  async search(\n    url: string,\n    options?: UrlReaderServiceSearchOptions,\n  ): Promise<UrlReaderServiceSearchResponse> {\n    const { pathname } = new URL(url);\n\n    if (pathname.match(/[*?]/)) {\n      throw new Error('Unsupported search pattern URL');\n    }\n\n    try {\n      const data = await this.readUrl(url, options);\n\n      return {\n        files: [\n          {\n            url: url,\n            content: data.buffer,\n            lastModifiedAt: data.lastModifiedAt,\n          },\n        ],\n        etag: data.etag ?? '',\n      };\n    } catch (e) {\n      const error = toError(e);\n      if (error.name === 'NotFoundError') {\n        return {\n          files: [],\n          etag: '',\n        };\n      }\n      throw error;\n    }\n  }\n\n  toString() {\n    return 'fetch{}';\n  }\n}\n"],"names":["path","ReadUrlResponseFactory","NotModifiedError","NotFoundError","toError"],"mappings":";;;;;;;;;;AA8BA,MAAM,qBAAA,GAAwB,CAAC,GAAA,EAAK,GAAA,EAAK,KAAK,GAAG,CAAA;AACjD,MAAM,aAAA,GAAgB,CAAA;AAEtB,MAAM,YAAY,CAAC,GAAA,EAAa,CAAC,KAAA,EAAO,GAAG,CAAA,KAAwB;AACjE,EAAA,OAAO,GAAA,IAAO,SAAS,GAAA,IAAO,GAAA;AAChC,CAAA;AAEA,MAAM,cAAA,GAAiB,CAAC,IAAA,KAAmC;AACzD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,KAAA,GAAQ,IAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,CAAA,KAAK,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA,CACxB,OAAO,OAAO,CAAA;AACjB,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAE,CAAA;AAC1E,IAAA,MAAM,CAAC,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AACrB,IAAA,IAAI,KAAA,IAAS,CAAA,IAAK,GAAA,IAAO,CAAA,IAAK,KAAA,GAAQ,GAAA;AACpC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,KAAK,CAAA,EAAA,EAAK,GAAG,CAAA,CAAA,CAAG,CAAA;AAC/D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,IAAA,EAAM,EAAE,CAAA;AACpC,EAAA,OAAO,CAAC,YAAY,UAAU,CAAA;AAChC,CAAA;AAEA,MAAM,kBAAA,GAAqB,CAAC,IAAA,KAA6B;AACvD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,KAAA,GAAQ,eAAe,IAAI,CAAA;AACjC,IAAA,OAAO,CAAC,GAAA,KAAa;AACnB,MAAA,IAAI,GAAA,CAAI,MAAM,OAAO,SAAA,CAAU,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA,EAAG,KAAK,CAAA;AAE5D,MAAA,IAAI,IAAI,QAAA,KAAa,OAAA,EAAS,OAAO,SAAA,CAAU,IAAI,KAAK,CAAA;AACxD,MAAA,IAAI,IAAI,QAAA,KAAa,QAAA,EAAU,OAAO,SAAA,CAAU,KAAK,KAAK,CAAA;AAC1D,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAA,KAAa,CAAC,GAAA,CAAI,IAAA;AAC5B,CAAA;AAEA,SAAS,oBAAoB,MAAA,EAAuC;AAClE,EAAA,MAAM,QAAQ,MAAA,CACX,sBAAA,CAAuB,uBAAuB,CAAA,EAC7C,IAAI,CAAA,WAAA,KAAe;AACnB,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,sBAAA,CAAuB,OAAO,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,KAAA,GACd,CAAC,GAAA,KAAa;AACZ,MAAA,MAAM,UAAA,GAAaA,6BAAA,CAAK,KAAA,CAAM,SAAA,CAAU,IAAI,QAAQ,CAAA;AACpD,MAAA,OAAO,KAAA,CAAM,KAAK,CAAA,WAAA,KAAe;AAC/B,QAAA,MAAM,oBAAoB,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,GAC9C,WAAA,GACA,GAAG,WAAW,CAAA,CAAA,CAAA;AAClB,QAAA,OACE,UAAA,KAAe,WAAA,IACf,UAAA,CAAW,UAAA,CAAW,iBAAiB,CAAA;AAAA,MAE3C,CAAC,CAAA;AAAA,IACH,CAAA,GACA,CAAC,IAAA,KAAc,IAAA;AACnB,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,SAAA,CAAU,MAAM,CAAA;AACzC,IAAA,MAAM,CAAC,QAAA,EAAU,IAAI,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAEvC,IAAA,MAAM,SAAA,GAAY,mBAAmB,IAAI,CAAA;AAEzC,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC7B,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA;AAC/B,MAAA,OAAO,CAAC,GAAA,KACN,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,CAAC,QACN,GAAA,CAAI,QAAA,KAAa,YAAY,SAAA,CAAU,GAAG,CAAA,IAAK,SAAA,CAAU,GAAG,CAAA;AAAA,EAChE,CAAC,CAAA;AAEH,EAAA,OAAO,KAAA,EAAO,MAAA,GAAS,CAAA,GAAA,KAAO,KAAA,CAAM,IAAA,CAAK,OAAK,CAAA,CAAE,GAAG,CAAC,CAAA,GAAI,MAAM,KAAA;AAChE;AAOO,MAAM,cAAA,CAA2C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAetD,OAAO,OAAA,GAAyB,CAAC,EAAE,QAAO,KAAM;AAC9C,IAAA,MAAM,SAAA,GAAY,oBAAoB,MAAM,CAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAAe,EAAE,WAAW,CAAA;AAC/C,IAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAAA,EAC/B,CAAA;AAAA,EAEA,OAAO,WAAW,MAAA,EAAgC;AAChD,IAAA,OAAO,IAAI,cAAA,CAAe,EAAE,WAAW,mBAAA,CAAoB,MAAM,GAAG,CAAA;AAAA,EACtE;AAAA,EAES,UAAA;AAAA,EAED,YAAY,OAAA,EAA+C;AACjE,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,SAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACvC,IAAA,OAAO,SAAS,MAAA,EAAO;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,CACJ,GAAA,EACA,OAAA,EAC0C;AAC1C,IAAA,IAAI,UAAA,GAAa,GAAA;AAEjB,IAAA,KAAA,IACM,aAAA,GAAgB,CAAA,EACpB,aAAA,GAAgB,aAAA,EAChB,iBAAiB,CAAA,EACjB;AAEA,MAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AACpC,MAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,2DAA2D,UAAU,CAAA;AAAA,SACvE;AAAA,MACF;AAEA,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,MAAM,UAAA,EAAY;AAAA,UACjC,OAAA,EAAS;AAAA,YACP,GAAI,OAAA,EAAS,IAAA,IAAQ,EAAE,eAAA,EAAiB,QAAQ,IAAA,EAAK;AAAA,YACrD,GAAI,SAAS,iBAAA,IAAqB;AAAA,cAChC,mBAAA,EAAqB,OAAA,CAAQ,iBAAA,CAAkB,WAAA;AAAY,aAC7D;AAAA,YACA,GAAI,SAAS,KAAA,IAAS,EAAE,eAAe,CAAA,OAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,CAAA;AAAG,WACnE;AAAA;AAAA,UAEA,QAAA,EAAU,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOV,QAAQ,OAAA,EAAS;AAAA,SAClB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,UAAU,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AAAA,MACtD;AAEA,MAAA,IAAI,SAAS,EAAA,EAAI;AACf,QAAA,OAAOC,6CAAA,CAAuB,aAAa,QAAQ,CAAA;AAAA,MACrD;AAEA,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,QAAA,MAAM,IAAIC,uBAAA,EAAiB;AAAA,MAC7B;AAEA,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,qBAAA,CAAsB,QAAA,CAAS,SAAS,MAAM,CAAA,IAAK,CAAC,QAAA,EAAU;AACjE,QAAA,MAAM,OAAA,GAAU,kBAAkB,UAAU,CAAA,EAAA,EAAK,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AACvF,QAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,UAAA,MAAM,IAAIC,qBAAc,OAAO,CAAA;AAAA,QACjC;AACA,QAAA,MAAM,IAAI,MAAM,OAAO,CAAA;AAAA,MACzB;AAGA,MAAA,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,EAAE,QAAA,EAAS;AAAA,IACtD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wBAAA,EAA2B,aAAa,CAAA,eAAA,EAAkB,GAAG,CAAA;AAAA,KAC/D;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAAsD;AAC1D,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAA,CACJ,GAAA,EACA,OAAA,EACyC;AACzC,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,IAAI,IAAI,GAAG,CAAA;AAEhC,IAAA,IAAI,QAAA,CAAS,KAAA,CAAM,MAAM,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,OAAO,CAAA;AAE5C,MAAA,OAAO;AAAA,QACL,KAAA,EAAO;AAAA,UACL;AAAA,YACE,GAAA;AAAA,YACA,SAAS,IAAA,CAAK,MAAA;AAAA,YACd,gBAAgB,IAAA,CAAK;AAAA;AACvB,SACF;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,IAAQ;AAAA,OACrB;AAAA,IACF,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,KAAA,GAAQC,eAAQ,CAAC,CAAA;AACvB,MAAA,IAAI,KAAA,CAAM,SAAS,eAAA,EAAiB;AAClC,QAAA,OAAO;AAAA,UACL,OAAO,EAAC;AAAA,UACR,IAAA,EAAM;AAAA,SACR;AAAA,MACF;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,OAAO,SAAA;AAAA,EACT;AACF;;;;"}

package/dist/entrypoints/urlReader/lib/GitlabUrlReader.cjs.js

@@ -72,14 +72,9 @@ class GitlabUrlReader {
   async readTree(url, options) {
     const { etag, signal, token } = options ?? {};
     const { ref, full_name, filepath } = parseGitUrl__default.default(url);
-    let repoFullName = full_name;
-    const relativePath = integration.getGitLabIntegrationRelativePath(
-      this.integration.config
+    const repoFullName = this.validateAndStripGitLabRelativePath(
+      `/${full_name}`
     );
-    if (relativePath) {
-      const rectifiedRelativePath = `${lodash.trimStart(relativePath, "/")}/`;
-      repoFullName = full_name.replace(rectifiedRelativePath, "");
-    }
     const projectGitlabResponse = await this.integration.fetch(
       new URL(
         `${this.integration.config.apiBaseUrl}/projects/${encodeURIComponent(
@@ -236,6 +231,7 @@ class GitlabUrlReader {
   }
   async getGitlabFetchUrl(target, token) {
     const targetUrl = new URL(target);
+    this.validateAndStripGitLabRelativePath(targetUrl.pathname);
     if (targetUrl.pathname.includes("/-/jobs/artifacts/")) {
       return this.getGitlabArtifactFetchUrl(targetUrl).then(
         (value) => value.toString()
@@ -256,11 +252,7 @@ class GitlabUrlReader {
       const relativePath = integration.getGitLabIntegrationRelativePath(
         this.integration.config
       );
-      let projectPath = namespaceAndProject;
-      if (relativePath) {
-        projectPath = lodash.trimStart(projectPath, relativePath);
-      }
-      projectPath = projectPath.replace(/^\//, "");
+      const projectPath = this.validateAndStripGitLabRelativePath(namespaceAndProject);
       const newUrl = new URL(target);
       newUrl.pathname = `${relativePath}/api/v4/projects/${encodeURIComponent(
         projectPath
@@ -272,6 +264,21 @@ class GitlabUrlReader {
       );
     }
   }
+  validateAndStripGitLabRelativePath(pathname) {
+    const relativePath = integration.getGitLabIntegrationRelativePath(
+      this.integration.config
+    );
+    if (!relativePath) {
+      return pathname.replace(/^\//, "");
+    }
+    const relativePathPrefix = `${relativePath}/`;
+    if (!pathname.startsWith(relativePathPrefix)) {
+      throw new Error(
+        `Failed to read GitLab URL from ${pathname}. Url path must start with ${relativePathPrefix}.`
+      );
+    }
+    return pathname.slice(relativePathPrefix.length);
+  }
 }
 
 exports.GitlabUrlReader = GitlabUrlReader;