@backstage/backend-defaults 0.5.1-next.0 → 0.5.1-next.2

package/dist/entrypoints/auth/authServiceFactory.cjs.js

@@ -0,0 +1,57 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var DefaultAuthService = require('./DefaultAuthService.cjs.js');
+var ExternalTokenHandler = require('./external/ExternalTokenHandler.cjs.js');
+var PluginTokenHandler = require('./plugin/PluginTokenHandler.cjs.js');
+var createPluginKeySource = require('./plugin/keys/createPluginKeySource.cjs.js');
+var UserTokenHandler = require('./user/UserTokenHandler.cjs.js');
+
+const authServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.auth,
+  deps: {
+    config: backendPluginApi.coreServices.rootConfig,
+    logger: backendPluginApi.coreServices.rootLogger,
+    discovery: backendPluginApi.coreServices.discovery,
+    plugin: backendPluginApi.coreServices.pluginMetadata,
+    database: backendPluginApi.coreServices.database
+  },
+  async factory({ config, discovery, plugin, logger, database }) {
+    const disableDefaultAuthPolicy = config.getOptionalBoolean(
+      "backend.auth.dangerouslyDisableDefaultAuthPolicy"
+    ) ?? false;
+    const keyDuration = { hours: 1 };
+    const keySource = await createPluginKeySource.createPluginKeySource({
+      config,
+      database,
+      logger,
+      keyDuration
+    });
+    const userTokens = UserTokenHandler.UserTokenHandler.create({
+      discovery
+    });
+    const pluginTokens = PluginTokenHandler.PluginTokenHandler.create({
+      ownPluginId: plugin.getId(),
+      logger,
+      keySource,
+      keyDuration,
+      discovery
+    });
+    const externalTokens = ExternalTokenHandler.ExternalTokenHandler.create({
+      ownPluginId: plugin.getId(),
+      config,
+      logger
+    });
+    return new DefaultAuthService.DefaultAuthService(
+      userTokens,
+      pluginTokens,
+      externalTokens,
+      plugin.getId(),
+      disableDefaultAuthPolicy,
+      keySource
+    );
+  }
+});
+
+exports.authServiceFactory = authServiceFactory;
+//# sourceMappingURL=authServiceFactory.cjs.js.map

package/dist/entrypoints/auth/authServiceFactory.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authServiceFactory.cjs.js","sources":["../../../src/entrypoints/auth/authServiceFactory.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createServiceFactory,\n} from '@backstage/backend-plugin-api';\nimport { DefaultAuthService } from './DefaultAuthService';\nimport { ExternalTokenHandler } from './external/ExternalTokenHandler';\nimport { PluginTokenHandler } from './plugin/PluginTokenHandler';\nimport { createPluginKeySource } from './plugin/keys/createPluginKeySource';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/**\n * Handles token authentication and credentials management.\n *\n * See {@link @backstage/code-plugin-api#AuthService}\n * and {@link https://backstage.io/docs/backend-system/core-services/auth | the service docs}\n * for more information.\n *\n * @public\n */\nexport const authServiceFactory = createServiceFactory({\n  service: coreServices.auth,\n  deps: {\n    config: coreServices.rootConfig,\n    logger: coreServices.rootLogger,\n    discovery: coreServices.discovery,\n    plugin: coreServices.pluginMetadata,\n    database: coreServices.database,\n  },\n  async factory({ config, discovery, plugin, logger, database }) {\n    const disableDefaultAuthPolicy =\n      config.getOptionalBoolean(\n        'backend.auth.dangerouslyDisableDefaultAuthPolicy',\n      ) ?? false;\n\n    const keyDuration = { hours: 1 };\n\n    const keySource = await createPluginKeySource({\n      config,\n      database,\n      logger,\n      keyDuration,\n    });\n\n    const userTokens = UserTokenHandler.create({\n      discovery,\n    });\n\n    const pluginTokens = PluginTokenHandler.create({\n      ownPluginId: plugin.getId(),\n      logger,\n      keySource,\n      keyDuration,\n      discovery,\n    });\n\n    const externalTokens = ExternalTokenHandler.create({\n      ownPluginId: plugin.getId(),\n      config,\n      logger,\n    });\n\n    return new DefaultAuthService(\n      userTokens,\n      pluginTokens,\n      externalTokens,\n      plugin.getId(),\n      disableDefaultAuthPolicy,\n      keySource,\n    );\n  },\n});\n"],"names":["createServiceFactory","coreServices","createPluginKeySource","UserTokenHandler","PluginTokenHandler","ExternalTokenHandler","DefaultAuthService"],"mappings":";;;;;;;;;AAmCO,MAAM,qBAAqBA,qCAAqB,CAAA;AAAA,EACrD,SAASC,6BAAa,CAAA,IAAA;AAAA,EACtB,IAAM,EAAA;AAAA,IACJ,QAAQA,6BAAa,CAAA,UAAA;AAAA,IACrB,QAAQA,6BAAa,CAAA,UAAA;AAAA,IACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,IACxB,QAAQA,6BAAa,CAAA,cAAA;AAAA,IACrB,UAAUA,6BAAa,CAAA,QAAA;AAAA,GACzB;AAAA,EACA,MAAM,QAAQ,EAAE,MAAA,EAAQ,WAAW,MAAQ,EAAA,MAAA,EAAQ,UAAY,EAAA;AAC7D,IAAA,MAAM,2BACJ,MAAO,CAAA,kBAAA;AAAA,MACL,kDAAA;AAAA,KACG,IAAA,KAAA,CAAA;AAEP,IAAM,MAAA,WAAA,GAAc,EAAE,KAAA,EAAO,CAAE,EAAA,CAAA;AAE/B,IAAM,MAAA,SAAA,GAAY,MAAMC,2CAAsB,CAAA;AAAA,MAC5C,MAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,KACD,CAAA,CAAA;AAED,IAAM,MAAA,UAAA,GAAaC,kCAAiB,MAAO,CAAA;AAAA,MACzC,SAAA;AAAA,KACD,CAAA,CAAA;AAED,IAAM,MAAA,YAAA,GAAeC,sCAAmB,MAAO,CAAA;AAAA,MAC7C,WAAA,EAAa,OAAO,KAAM,EAAA;AAAA,MAC1B,MAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA;AAAA,MACA,SAAA;AAAA,KACD,CAAA,CAAA;AAED,IAAM,MAAA,cAAA,GAAiBC,0CAAqB,MAAO,CAAA;AAAA,MACjD,WAAA,EAAa,OAAO,KAAM,EAAA;AAAA,MAC1B,MAAA;AAAA,MACA,MAAA;AAAA,KACD,CAAA,CAAA;AAED,IAAA,OAAO,IAAIC,qCAAA;AAAA,MACT,UAAA;AAAA,MACA,YAAA;AAAA,MACA,cAAA;AAAA,MACA,OAAO,KAAM,EAAA;AAAA,MACb,wBAAA;AAAA,MACA,SAAA;AAAA,KACF,CAAA;AAAA,GACF;AACF,CAAC;;;;"}

package/dist/entrypoints/auth/external/ExternalTokenHandler.cjs.js

@@ -0,0 +1,78 @@
+'use strict';
+
+var errors = require('@backstage/errors');
+var legacy = require('./legacy.cjs.js');
+var _static = require('./static.cjs.js');
+var jwks = require('./jwks.cjs.js');
+
+const NEW_CONFIG_KEY = "backend.auth.externalAccess";
+const OLD_CONFIG_KEY = "backend.auth.keys";
+let loggedDeprecationWarning = false;
+class ExternalTokenHandler {
+  constructor(ownPluginId, handlers) {
+    this.ownPluginId = ownPluginId;
+    this.handlers = handlers;
+  }
+  static create(options) {
+    const { ownPluginId, config, logger } = options;
+    const staticHandler = new _static.StaticTokenHandler();
+    const legacyHandler = new legacy.LegacyTokenHandler();
+    const jwksHandler = new jwks.JWKSHandler();
+    const handlers = {
+      static: staticHandler,
+      legacy: legacyHandler,
+      jwks: jwksHandler
+    };
+    const handlerConfigs = config.getOptionalConfigArray(NEW_CONFIG_KEY) ?? [];
+    for (const handlerConfig of handlerConfigs) {
+      const type = handlerConfig.getString("type");
+      const handler = handlers[type];
+      if (!handler) {
+        const valid = Object.keys(handlers).map((k) => `'${k}'`).join(", ");
+        throw new Error(
+          `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`
+        );
+      }
+      handler.add(handlerConfig);
+    }
+    const legacyConfigs = config.getOptionalConfigArray(OLD_CONFIG_KEY) ?? [];
+    if (legacyConfigs.length && !loggedDeprecationWarning) {
+      loggedDeprecationWarning = true;
+      logger.warn(
+        `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`
+      );
+    }
+    for (const handlerConfig of legacyConfigs) {
+      legacyHandler.addOld(handlerConfig);
+    }
+    return new ExternalTokenHandler(ownPluginId, Object.values(handlers));
+  }
+  async verifyToken(token) {
+    for (const handler of this.handlers) {
+      const result = await handler.verifyToken(token);
+      if (result) {
+        const { allAccessRestrictions, ...rest } = result;
+        if (allAccessRestrictions) {
+          const accessRestrictions = allAccessRestrictions.get(
+            this.ownPluginId
+          );
+          if (!accessRestrictions) {
+            const valid = [...allAccessRestrictions.keys()].map((k) => `'${k}'`).join(", ");
+            throw new errors.NotAllowedError(
+              `This token's access is restricted to plugin(s) ${valid}`
+            );
+          }
+          return {
+            ...rest,
+            accessRestrictions
+          };
+        }
+        return rest;
+      }
+    }
+    return void 0;
+  }
+}
+
+exports.ExternalTokenHandler = ExternalTokenHandler;
+//# sourceMappingURL=ExternalTokenHandler.cjs.js.map

package/dist/entrypoints/auth/external/ExternalTokenHandler.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/external/ExternalTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BackstagePrincipalAccessRestrictions,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { NotAllowedError } from '@backstage/errors';\nimport { LegacyTokenHandler } from './legacy';\nimport { StaticTokenHandler } from './static';\nimport { JWKSHandler } from './jwks';\nimport { TokenHandler } from './types';\n\nconst NEW_CONFIG_KEY = 'backend.auth.externalAccess';\nconst OLD_CONFIG_KEY = 'backend.auth.keys';\nlet loggedDeprecationWarning = false;\n\n/**\n * Handles all types of external caller token types (i.e. not Backstage user\n * tokens, nor Backstage backend plugin tokens).\n *\n * @internal\n */\nexport class ExternalTokenHandler {\n  static create(options: {\n    ownPluginId: string;\n    config: RootConfigService;\n    logger: LoggerService;\n  }): ExternalTokenHandler {\n    const { ownPluginId, config, logger } = options;\n\n    const staticHandler = new StaticTokenHandler();\n    const legacyHandler = new LegacyTokenHandler();\n    const jwksHandler = new JWKSHandler();\n    const handlers: Record<string, TokenHandler> = {\n      static: staticHandler,\n      legacy: legacyHandler,\n      jwks: jwksHandler,\n    };\n\n    // Load the new-style handlers\n    const handlerConfigs = config.getOptionalConfigArray(NEW_CONFIG_KEY) ?? [];\n    for (const handlerConfig of handlerConfigs) {\n      const type = handlerConfig.getString('type');\n      const handler = handlers[type];\n      if (!handler) {\n        const valid = Object.keys(handlers)\n          .map(k => `'${k}'`)\n          .join(', ');\n        throw new Error(\n          `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`,\n        );\n      }\n      handler.add(handlerConfig);\n    }\n\n    // Load the old keys too\n    const legacyConfigs = config.getOptionalConfigArray(OLD_CONFIG_KEY) ?? [];\n    if (legacyConfigs.length && !loggedDeprecationWarning) {\n      loggedDeprecationWarning = true;\n      logger.warn(\n        `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`,\n      );\n    }\n    for (const handlerConfig of legacyConfigs) {\n      legacyHandler.addOld(handlerConfig);\n    }\n\n    return new ExternalTokenHandler(ownPluginId, Object.values(handlers));\n  }\n\n  constructor(\n    private readonly ownPluginId: string,\n    private readonly handlers: TokenHandler[],\n  ) {}\n\n  async verifyToken(token: string): Promise<\n    | {\n        subject: string;\n        accessRestrictions?: BackstagePrincipalAccessRestrictions;\n      }\n    | undefined\n  > {\n    for (const handler of this.handlers) {\n      const result = await handler.verifyToken(token);\n      if (result) {\n        const { allAccessRestrictions, ...rest } = result;\n        if (allAccessRestrictions) {\n          const accessRestrictions = allAccessRestrictions.get(\n            this.ownPluginId,\n          );\n          if (!accessRestrictions) {\n            const valid = [...allAccessRestrictions.keys()]\n              .map(k => `'${k}'`)\n              .join(', ');\n            throw new NotAllowedError(\n              `This token's access is restricted to plugin(s) ${valid}`,\n            );\n          }\n\n          return {\n            ...rest,\n            accessRestrictions,\n          };\n        }\n\n        return rest;\n      }\n    }\n\n    return undefined;\n  }\n}\n"],"names":["StaticTokenHandler","LegacyTokenHandler","JWKSHandler","NotAllowedError"],"mappings":";;;;;;;AA2BA,MAAM,cAAiB,GAAA,6BAAA,CAAA;AACvB,MAAM,cAAiB,GAAA,mBAAA,CAAA;AACvB,IAAI,wBAA2B,GAAA,KAAA,CAAA;AAQxB,MAAM,oBAAqB,CAAA;AAAA,EAgDhC,WAAA,CACmB,aACA,QACjB,EAAA;AAFiB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA,CAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA,CAAA;AAAA,GAChB;AAAA,EAlDH,OAAO,OAAO,OAIW,EAAA;AACvB,IAAA,MAAM,EAAE,WAAA,EAAa,MAAQ,EAAA,MAAA,EAAW,GAAA,OAAA,CAAA;AAExC,IAAM,MAAA,aAAA,GAAgB,IAAIA,0BAAmB,EAAA,CAAA;AAC7C,IAAM,MAAA,aAAA,GAAgB,IAAIC,yBAAmB,EAAA,CAAA;AAC7C,IAAM,MAAA,WAAA,GAAc,IAAIC,gBAAY,EAAA,CAAA;AACpC,IAAA,MAAM,QAAyC,GAAA;AAAA,MAC7C,MAAQ,EAAA,aAAA;AAAA,MACR,MAAQ,EAAA,aAAA;AAAA,MACR,IAAM,EAAA,WAAA;AAAA,KACR,CAAA;AAGA,IAAA,MAAM,cAAiB,GAAA,MAAA,CAAO,sBAAuB,CAAA,cAAc,KAAK,EAAC,CAAA;AACzE,IAAA,KAAA,MAAW,iBAAiB,cAAgB,EAAA;AAC1C,MAAM,MAAA,IAAA,GAAO,aAAc,CAAA,SAAA,CAAU,MAAM,CAAA,CAAA;AAC3C,MAAM,MAAA,OAAA,GAAU,SAAS,IAAI,CAAA,CAAA;AAC7B,MAAA,IAAI,CAAC,OAAS,EAAA;AACZ,QAAA,MAAM,KAAQ,GAAA,MAAA,CAAO,IAAK,CAAA,QAAQ,CAC/B,CAAA,GAAA,CAAI,CAAK,CAAA,KAAA,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CACjB,CAAA,IAAA,CAAK,IAAI,CAAA,CAAA;AACZ,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAiB,cAAA,EAAA,IAAI,CAAQ,KAAA,EAAA,cAAc,qBAAqB,KAAK,CAAA,CAAA;AAAA,SACvE,CAAA;AAAA,OACF;AACA,MAAA,OAAA,CAAQ,IAAI,aAAa,CAAA,CAAA;AAAA,KAC3B;AAGA,IAAA,MAAM,aAAgB,GAAA,MAAA,CAAO,sBAAuB,CAAA,cAAc,KAAK,EAAC,CAAA;AACxE,IAAI,IAAA,aAAA,CAAc,MAAU,IAAA,CAAC,wBAA0B,EAAA;AACrD,MAA2B,wBAAA,GAAA,IAAA,CAAA;AAC3B,MAAO,MAAA,CAAA,IAAA;AAAA,QACL,CAAA,yBAAA,EAA4B,cAAc,CAAA,6BAAA,EAAgC,cAAc,CAAA,4DAAA,CAAA;AAAA,OAC1F,CAAA;AAAA,KACF;AACA,IAAA,KAAA,MAAW,iBAAiB,aAAe,EAAA;AACzC,MAAA,aAAA,CAAc,OAAO,aAAa,CAAA,CAAA;AAAA,KACpC;AAEA,IAAA,OAAO,IAAI,oBAAqB,CAAA,WAAA,EAAa,MAAO,CAAA,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA;AAAA,GACtE;AAAA,EAOA,MAAM,YAAY,KAMhB,EAAA;AACA,IAAW,KAAA,MAAA,OAAA,IAAW,KAAK,QAAU,EAAA;AACnC,MAAA,MAAM,MAAS,GAAA,MAAM,OAAQ,CAAA,WAAA,CAAY,KAAK,CAAA,CAAA;AAC9C,MAAA,IAAI,MAAQ,EAAA;AACV,QAAA,MAAM,EAAE,qBAAA,EAAuB,GAAG,IAAA,EAAS,GAAA,MAAA,CAAA;AAC3C,QAAA,IAAI,qBAAuB,EAAA;AACzB,UAAA,MAAM,qBAAqB,qBAAsB,CAAA,GAAA;AAAA,YAC/C,IAAK,CAAA,WAAA;AAAA,WACP,CAAA;AACA,UAAA,IAAI,CAAC,kBAAoB,EAAA;AACvB,YAAA,MAAM,KAAQ,GAAA,CAAC,GAAG,qBAAA,CAAsB,MAAM,CAAA,CAC3C,GAAI,CAAA,CAAA,CAAA,KAAK,CAAI,CAAA,EAAA,CAAC,CAAG,CAAA,CAAA,CAAA,CACjB,KAAK,IAAI,CAAA,CAAA;AACZ,YAAA,MAAM,IAAIC,sBAAA;AAAA,cACR,kDAAkD,KAAK,CAAA,CAAA;AAAA,aACzD,CAAA;AAAA,WACF;AAEA,UAAO,OAAA;AAAA,YACL,GAAG,IAAA;AAAA,YACH,kBAAA;AAAA,WACF,CAAA;AAAA,SACF;AAEA,QAAO,OAAA,IAAA,CAAA;AAAA,OACT;AAAA,KACF;AAEA,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AACF;;;;"}

package/dist/entrypoints/auth/external/helpers.cjs.js

@@ -0,0 +1,92 @@
+'use strict';
+
+function readAccessRestrictionsFromConfig(externalAccessEntryConfig) {
+  const configs = externalAccessEntryConfig.getOptionalConfigArray("accessRestrictions") ?? [];
+  const result = /* @__PURE__ */ new Map();
+  for (const config of configs) {
+    const validKeys = ["plugin", "permission", "permissionAttribute"];
+    for (const key of config.keys()) {
+      if (!validKeys.includes(key)) {
+        const valid = validKeys.map((k) => `'${k}'`).join(", ");
+        throw new Error(
+          `Invalid key '${key}' in 'accessRestrictions' config, expected one of ${valid}`
+        );
+      }
+    }
+    const pluginId = config.getString("plugin");
+    const permissionNames = readPermissionNames(config);
+    const permissionAttributes = readPermissionAttributes(config);
+    if (result.has(pluginId)) {
+      throw new Error(
+        `Attempted to declare 'accessRestrictions' twice for plugin '${pluginId}', which is not permitted`
+      );
+    }
+    result.set(pluginId, {
+      ...permissionNames ? { permissionNames } : {},
+      ...permissionAttributes ? { permissionAttributes } : {}
+    });
+  }
+  return result.size ? result : void 0;
+}
+function readStringOrStringArrayFromConfig(root, key, validValues) {
+  if (!root.has(key)) {
+    return void 0;
+  }
+  const rawValues = Array.isArray(root.get(key)) ? root.getStringArray(key) : [root.getString(key)];
+  const values = [
+    ...new Set(
+      rawValues.map((v) => v.split(/[ ,]/)).flat().filter(Boolean)
+    )
+  ];
+  if (!values.length) {
+    return void 0;
+  }
+  if (validValues?.length) {
+    for (const value of values) {
+      if (!validValues.includes(value)) {
+        const valid = validValues.map((k) => `'${k}'`).join(", ");
+        throw new Error(
+          `Invalid value '${value}' at '${key}' in 'permissionAttributes' config, valid values are ${valid}`
+        );
+      }
+    }
+  }
+  return values;
+}
+function readPermissionNames(externalAccessEntryConfig) {
+  return readStringOrStringArrayFromConfig(
+    externalAccessEntryConfig,
+    "permission"
+  );
+}
+function readPermissionAttributes(externalAccessEntryConfig) {
+  const config = externalAccessEntryConfig.getOptionalConfig(
+    "permissionAttribute"
+  );
+  if (!config) {
+    return void 0;
+  }
+  const validKeys = ["action"];
+  for (const key of config.keys()) {
+    if (!validKeys.includes(key)) {
+      const valid = validKeys.map((k) => `'${k}'`).join(", ");
+      throw new Error(
+        `Invalid key '${key}' in 'permissionAttribute' config, expected ${valid}`
+      );
+    }
+  }
+  const action = readStringOrStringArrayFromConfig(config, "action", [
+    "create",
+    "read",
+    "update",
+    "delete"
+  ]);
+  const result = {
+    ...action ? { action } : {}
+  };
+  return Object.keys(result).length ? result : void 0;
+}
+
+exports.readAccessRestrictionsFromConfig = readAccessRestrictionsFromConfig;
+exports.readStringOrStringArrayFromConfig = readStringOrStringArrayFromConfig;
+//# sourceMappingURL=helpers.cjs.js.map

package/dist/entrypoints/auth/external/helpers.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.cjs.js","sources":["../../../../src/entrypoints/auth/external/helpers.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { AccessRestriptionsMap } from './types';\n\n/**\n * Parses and returns the `accessRestrictions` configuration from an\n * `externalAccess` entry, or undefined if there wasn't one.\n *\n * @internal\n */\nexport function readAccessRestrictionsFromConfig(\n  externalAccessEntryConfig: Config,\n): AccessRestriptionsMap | undefined {\n  const configs =\n    externalAccessEntryConfig.getOptionalConfigArray('accessRestrictions') ??\n    [];\n\n  const result: AccessRestriptionsMap = new Map();\n  for (const config of configs) {\n    const validKeys = ['plugin', 'permission', 'permissionAttribute'];\n    for (const key of config.keys()) {\n      if (!validKeys.includes(key)) {\n        const valid = validKeys.map(k => `'${k}'`).join(', ');\n        throw new Error(\n          `Invalid key '${key}' in 'accessRestrictions' config, expected one of ${valid}`,\n        );\n      }\n    }\n\n    const pluginId = config.getString('plugin');\n    const permissionNames = readPermissionNames(config);\n    const permissionAttributes = readPermissionAttributes(config);\n\n    if (result.has(pluginId)) {\n      throw new Error(\n        `Attempted to declare 'accessRestrictions' twice for plugin '${pluginId}', which is not permitted`,\n      );\n    }\n\n    result.set(pluginId, {\n      ...(permissionNames ? { permissionNames } : {}),\n      ...(permissionAttributes ? { permissionAttributes } : {}),\n    });\n  }\n\n  return result.size ? result : undefined;\n}\n\n/**\n * Reads a config value as a string or an array of strings, and deduplicates and\n * splits by comma/space into a string array. Can also validate against a known\n * set of values. Returns undefined if the key didn't exist or if the array\n * would have ended up being empty.\n *\n * @internal\n */\nexport function readStringOrStringArrayFromConfig<T extends string>(\n  root: Config,\n  key: string,\n  validValues?: readonly T[],\n): T[] | undefined {\n  if (!root.has(key)) {\n    return undefined;\n  }\n\n  const rawValues = Array.isArray(root.get(key))\n    ? root.getStringArray(key)\n    : [root.getString(key)];\n\n  const values = [\n    ...new Set(\n      rawValues\n        .map(v => v.split(/[ ,]/))\n        .flat()\n        .filter(Boolean),\n    ),\n  ];\n\n  if (!values.length) {\n    return undefined;\n  }\n\n  if (validValues?.length) {\n    for (const value of values) {\n      if (!validValues.includes(value as T)) {\n        const valid = validValues.map(k => `'${k}'`).join(', ');\n        throw new Error(\n          `Invalid value '${value}' at '${key}' in 'permissionAttributes' config, valid values are ${valid}`,\n        );\n      }\n    }\n  }\n\n  return values as T[];\n}\n\nfunction readPermissionNames(externalAccessEntryConfig: Config) {\n  return readStringOrStringArrayFromConfig(\n    externalAccessEntryConfig,\n    'permission',\n  );\n}\n\nfunction readPermissionAttributes(externalAccessEntryConfig: Config) {\n  const config = externalAccessEntryConfig.getOptionalConfig(\n    'permissionAttribute',\n  );\n  if (!config) {\n    return undefined;\n  }\n\n  const validKeys = ['action'];\n  for (const key of config.keys()) {\n    if (!validKeys.includes(key)) {\n      const valid = validKeys.map(k => `'${k}'`).join(', ');\n      throw new Error(\n        `Invalid key '${key}' in 'permissionAttribute' config, expected ${valid}`,\n      );\n    }\n  }\n\n  const action = readStringOrStringArrayFromConfig(config, 'action', [\n    'create',\n    'read',\n    'update',\n    'delete',\n  ]);\n\n  const result = {\n    ...(action ? { action } : {}),\n  };\n\n  return Object.keys(result).length ? result : undefined;\n}\n"],"names":[],"mappings":";;AAyBO,SAAS,iCACd,yBACmC,EAAA;AACnC,EAAA,MAAM,OACJ,GAAA,yBAAA,CAA0B,sBAAuB,CAAA,oBAAoB,KACrE,EAAC,CAAA;AAEH,EAAM,MAAA,MAAA,uBAAoC,GAAI,EAAA,CAAA;AAC9C,EAAA,KAAA,MAAW,UAAU,OAAS,EAAA;AAC5B,IAAA,MAAM,SAAY,GAAA,CAAC,QAAU,EAAA,YAAA,EAAc,qBAAqB,CAAA,CAAA;AAChE,IAAW,KAAA,MAAA,GAAA,IAAO,MAAO,CAAA,IAAA,EAAQ,EAAA;AAC/B,MAAA,IAAI,CAAC,SAAA,CAAU,QAAS,CAAA,GAAG,CAAG,EAAA;AAC5B,QAAM,MAAA,KAAA,GAAQ,UAAU,GAAI,CAAA,CAAA,CAAA,KAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAE,CAAA,IAAA,CAAK,IAAI,CAAA,CAAA;AACpD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,aAAA,EAAgB,GAAG,CAAA,kDAAA,EAAqD,KAAK,CAAA,CAAA;AAAA,SAC/E,CAAA;AAAA,OACF;AAAA,KACF;AAEA,IAAM,MAAA,QAAA,GAAW,MAAO,CAAA,SAAA,CAAU,QAAQ,CAAA,CAAA;AAC1C,IAAM,MAAA,eAAA,GAAkB,oBAAoB,MAAM,CAAA,CAAA;AAClD,IAAM,MAAA,oBAAA,GAAuB,yBAAyB,MAAM,CAAA,CAAA;AAE5D,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,QAAQ,CAAG,EAAA;AACxB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,+DAA+D,QAAQ,CAAA,yBAAA,CAAA;AAAA,OACzE,CAAA;AAAA,KACF;AAEA,IAAA,MAAA,CAAO,IAAI,QAAU,EAAA;AAAA,MACnB,GAAI,eAAA,GAAkB,EAAE,eAAA,KAAoB,EAAC;AAAA,MAC7C,GAAI,oBAAA,GAAuB,EAAE,oBAAA,KAAyB,EAAC;AAAA,KACxD,CAAA,CAAA;AAAA,GACH;AAEA,EAAO,OAAA,MAAA,CAAO,OAAO,MAAS,GAAA,KAAA,CAAA,CAAA;AAChC,CAAA;AAUgB,SAAA,iCAAA,CACd,IACA,EAAA,GAAA,EACA,WACiB,EAAA;AACjB,EAAA,IAAI,CAAC,IAAA,CAAK,GAAI,CAAA,GAAG,CAAG,EAAA;AAClB,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AAEA,EAAA,MAAM,YAAY,KAAM,CAAA,OAAA,CAAQ,IAAK,CAAA,GAAA,CAAI,GAAG,CAAC,CAAA,GACzC,IAAK,CAAA,cAAA,CAAe,GAAG,CACvB,GAAA,CAAC,IAAK,CAAA,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA;AAExB,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,GAAG,IAAI,GAAA;AAAA,MACL,SAAA,CACG,GAAI,CAAA,CAAA,CAAA,KAAK,CAAE,CAAA,KAAA,CAAM,MAAM,CAAC,CACxB,CAAA,IAAA,EACA,CAAA,MAAA,CAAO,OAAO,CAAA;AAAA,KACnB;AAAA,GACF,CAAA;AAEA,EAAI,IAAA,CAAC,OAAO,MAAQ,EAAA;AAClB,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AAEA,EAAA,IAAI,aAAa,MAAQ,EAAA;AACvB,IAAA,KAAA,MAAW,SAAS,MAAQ,EAAA;AAC1B,MAAA,IAAI,CAAC,WAAA,CAAY,QAAS,CAAA,KAAU,CAAG,EAAA;AACrC,QAAM,MAAA,KAAA,GAAQ,YAAY,GAAI,CAAA,CAAA,CAAA,KAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAE,CAAA,IAAA,CAAK,IAAI,CAAA,CAAA;AACtD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAkB,eAAA,EAAA,KAAK,CAAS,MAAA,EAAA,GAAG,wDAAwD,KAAK,CAAA,CAAA;AAAA,SAClG,CAAA;AAAA,OACF;AAAA,KACF;AAAA,GACF;AAEA,EAAO,OAAA,MAAA,CAAA;AACT,CAAA;AAEA,SAAS,oBAAoB,yBAAmC,EAAA;AAC9D,EAAO,OAAA,iCAAA;AAAA,IACL,yBAAA;AAAA,IACA,YAAA;AAAA,GACF,CAAA;AACF,CAAA;AAEA,SAAS,yBAAyB,yBAAmC,EAAA;AACnE,EAAA,MAAM,SAAS,yBAA0B,CAAA,iBAAA;AAAA,IACvC,qBAAA;AAAA,GACF,CAAA;AACA,EAAA,IAAI,CAAC,MAAQ,EAAA;AACX,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AAEA,EAAM,MAAA,SAAA,GAAY,CAAC,QAAQ,CAAA,CAAA;AAC3B,EAAW,KAAA,MAAA,GAAA,IAAO,MAAO,CAAA,IAAA,EAAQ,EAAA;AAC/B,IAAA,IAAI,CAAC,SAAA,CAAU,QAAS,CAAA,GAAG,CAAG,EAAA;AAC5B,MAAM,MAAA,KAAA,GAAQ,UAAU,GAAI,CAAA,CAAA,CAAA,KAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAE,CAAA,IAAA,CAAK,IAAI,CAAA,CAAA;AACpD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,aAAA,EAAgB,GAAG,CAAA,4CAAA,EAA+C,KAAK,CAAA,CAAA;AAAA,OACzE,CAAA;AAAA,KACF;AAAA,GACF;AAEA,EAAM,MAAA,MAAA,GAAS,iCAAkC,CAAA,MAAA,EAAQ,QAAU,EAAA;AAAA,IACjE,QAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,GAC7B,CAAA;AAEA,EAAA,OAAO,MAAO,CAAA,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAS,GAAA,KAAA,CAAA,CAAA;AAC/C;;;;;"}

package/dist/entrypoints/auth/external/jwks.cjs.js

@@ -0,0 +1,63 @@
+'use strict';
+
+var jose = require('jose');
+var helpers = require('./helpers.cjs.js');
+
+class JWKSHandler {
+  #entries = [];
+  add(config) {
+    if (!config.getString("options.url").match(/^\S+$/)) {
+      throw new Error(
+        "Illegal JWKS URL, must be a set of non-space characters"
+      );
+    }
+    const algorithms = helpers.readStringOrStringArrayFromConfig(
+      config,
+      "options.algorithm"
+    );
+    const issuers = helpers.readStringOrStringArrayFromConfig(config, "options.issuer");
+    const audiences = helpers.readStringOrStringArrayFromConfig(
+      config,
+      "options.audience"
+    );
+    const subjectPrefix = config.getOptionalString("options.subjectPrefix");
+    const url = new URL(config.getString("options.url"));
+    const jwks = jose.createRemoteJWKSet(url);
+    const allAccessRestrictions = helpers.readAccessRestrictionsFromConfig(config);
+    this.#entries.push({
+      algorithms,
+      audiences,
+      issuers,
+      jwks,
+      subjectPrefix,
+      url,
+      allAccessRestrictions
+    });
+  }
+  async verifyToken(token) {
+    for (const entry of this.#entries) {
+      try {
+        const {
+          payload: { sub }
+        } = await jose.jwtVerify(token, entry.jwks, {
+          algorithms: entry.algorithms,
+          issuer: entry.issuers,
+          audience: entry.audiences
+        });
+        if (sub) {
+          const prefix = entry.subjectPrefix ? `external:${entry.subjectPrefix}:` : "external:";
+          return {
+            subject: `${prefix}${sub}`,
+            allAccessRestrictions: entry.allAccessRestrictions
+          };
+        }
+      } catch {
+        continue;
+      }
+    }
+    return void 0;
+  }
+}
+
+exports.JWKSHandler = JWKSHandler;
+//# sourceMappingURL=jwks.cjs.js.map

package/dist/entrypoints/auth/external/jwks.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.cjs.js","sources":["../../../../src/entrypoints/auth/external/jwks.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { jwtVerify, createRemoteJWKSet, JWTVerifyGetKey } from 'jose';\nimport { Config } from '@backstage/config';\nimport {\n  readAccessRestrictionsFromConfig,\n  readStringOrStringArrayFromConfig,\n} from './helpers';\nimport { AccessRestriptionsMap, TokenHandler } from './types';\n\n/**\n * Handles `type: jwks` access.\n *\n * @internal\n */\nexport class JWKSHandler implements TokenHandler {\n  #entries: Array<{\n    algorithms?: string[];\n    audiences?: string[];\n    issuers?: string[];\n    subjectPrefix?: string;\n    url: URL;\n    jwks: JWTVerifyGetKey;\n    allAccessRestrictions?: AccessRestriptionsMap;\n  }> = [];\n\n  add(config: Config) {\n    if (!config.getString('options.url').match(/^\\S+$/)) {\n      throw new Error(\n        'Illegal JWKS URL, must be a set of non-space characters',\n      );\n    }\n\n    const algorithms = readStringOrStringArrayFromConfig(\n      config,\n      'options.algorithm',\n    );\n    const issuers = readStringOrStringArrayFromConfig(config, 'options.issuer');\n    const audiences = readStringOrStringArrayFromConfig(\n      config,\n      'options.audience',\n    );\n    const subjectPrefix = config.getOptionalString('options.subjectPrefix');\n    const url = new URL(config.getString('options.url'));\n    const jwks = createRemoteJWKSet(url);\n    const allAccessRestrictions = readAccessRestrictionsFromConfig(config);\n\n    this.#entries.push({\n      algorithms,\n      audiences,\n      issuers,\n      jwks,\n      subjectPrefix,\n      url,\n      allAccessRestrictions,\n    });\n  }\n\n  async verifyToken(token: string) {\n    for (const entry of this.#entries) {\n      try {\n        const {\n          payload: { sub },\n        } = await jwtVerify(token, entry.jwks, {\n          algorithms: entry.algorithms,\n          issuer: entry.issuers,\n          audience: entry.audiences,\n        });\n\n        if (sub) {\n          const prefix = entry.subjectPrefix\n            ? `external:${entry.subjectPrefix}:`\n            : 'external:';\n          return {\n            subject: `${prefix}${sub}`,\n            allAccessRestrictions: entry.allAccessRestrictions,\n          };\n        }\n      } catch {\n        continue;\n      }\n    }\n    return undefined;\n  }\n}\n"],"names":["readStringOrStringArrayFromConfig","createRemoteJWKSet","readAccessRestrictionsFromConfig","jwtVerify"],"mappings":";;;;;AA6BO,MAAM,WAAoC,CAAA;AAAA,EAC/C,WAQK,EAAC,CAAA;AAAA,EAEN,IAAI,MAAgB,EAAA;AAClB,IAAA,IAAI,CAAC,MAAO,CAAA,SAAA,CAAU,aAAa,CAAE,CAAA,KAAA,CAAM,OAAO,CAAG,EAAA;AACnD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,yDAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,UAAa,GAAAA,yCAAA;AAAA,MACjB,MAAA;AAAA,MACA,mBAAA;AAAA,KACF,CAAA;AACA,IAAM,MAAA,OAAA,GAAUA,yCAAkC,CAAA,MAAA,EAAQ,gBAAgB,CAAA,CAAA;AAC1E,IAAA,MAAM,SAAY,GAAAA,yCAAA;AAAA,MAChB,MAAA;AAAA,MACA,kBAAA;AAAA,KACF,CAAA;AACA,IAAM,MAAA,aAAA,GAAgB,MAAO,CAAA,iBAAA,CAAkB,uBAAuB,CAAA,CAAA;AACtE,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,MAAO,CAAA,SAAA,CAAU,aAAa,CAAC,CAAA,CAAA;AACnD,IAAM,MAAA,IAAA,GAAOC,wBAAmB,GAAG,CAAA,CAAA;AACnC,IAAM,MAAA,qBAAA,GAAwBC,yCAAiC,MAAM,CAAA,CAAA;AAErE,IAAA,IAAA,CAAK,SAAS,IAAK,CAAA;AAAA,MACjB,UAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,aAAA;AAAA,MACA,GAAA;AAAA,MACA,qBAAA;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAY,KAAe,EAAA;AAC/B,IAAW,KAAA,MAAA,KAAA,IAAS,KAAK,QAAU,EAAA;AACjC,MAAI,IAAA;AACF,QAAM,MAAA;AAAA,UACJ,OAAA,EAAS,EAAE,GAAI,EAAA;AAAA,SACb,GAAA,MAAMC,cAAU,CAAA,KAAA,EAAO,MAAM,IAAM,EAAA;AAAA,UACrC,YAAY,KAAM,CAAA,UAAA;AAAA,UAClB,QAAQ,KAAM,CAAA,OAAA;AAAA,UACd,UAAU,KAAM,CAAA,SAAA;AAAA,SACjB,CAAA,CAAA;AAED,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,MAAM,SAAS,KAAM,CAAA,aAAA,GACjB,CAAY,SAAA,EAAA,KAAA,CAAM,aAAa,CAC/B,CAAA,CAAA,GAAA,WAAA,CAAA;AACJ,UAAO,OAAA;AAAA,YACL,OAAS,EAAA,CAAA,EAAG,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA;AAAA,YACxB,uBAAuB,KAAM,CAAA,qBAAA;AAAA,WAC/B,CAAA;AAAA,SACF;AAAA,OACM,CAAA,MAAA;AACN,QAAA,SAAA;AAAA,OACF;AAAA,KACF;AACA,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AACF;;;;"}

package/dist/entrypoints/auth/external/legacy.cjs.js

@@ -0,0 +1,73 @@
+'use strict';
+
+var jose = require('jose');
+var helpers = require('./helpers.cjs.js');
+
+class LegacyTokenHandler {
+  #entries = new Array();
+  add(config) {
+    const allAccessRestrictions = helpers.readAccessRestrictionsFromConfig(config);
+    this.#doAdd(
+      config.getString("options.secret"),
+      config.getString("options.subject"),
+      allAccessRestrictions
+    );
+  }
+  // used only for the old backend.auth.keys array
+  addOld(config) {
+    this.#doAdd(config.getString("secret"), "external:backstage-plugin");
+  }
+  #doAdd(secret, subject, allAccessRestrictions) {
+    if (!secret.match(/^\S+$/)) {
+      throw new Error("Illegal secret, must be a valid base64 string");
+    } else if (!subject.match(/^\S+$/)) {
+      throw new Error("Illegal subject, must be a set of non-space characters");
+    }
+    let key;
+    try {
+      key = jose.base64url.decode(secret);
+    } catch {
+      throw new Error("Illegal secret, must be a valid base64 string");
+    }
+    if (this.#entries.some((e) => e.key === key)) {
+      throw new Error(
+        "Legacy externalAccess token was declared more than once"
+      );
+    }
+    this.#entries.push({
+      key,
+      result: {
+        subject,
+        allAccessRestrictions
+      }
+    });
+  }
+  async verifyToken(token) {
+    try {
+      const { alg } = jose.decodeProtectedHeader(token);
+      if (alg !== "HS256") {
+        return void 0;
+      }
+      const { sub, aud } = jose.decodeJwt(token);
+      if (sub !== "backstage-server" || aud) {
+        return void 0;
+      }
+    } catch (e) {
+      return void 0;
+    }
+    for (const { key, result } of this.#entries) {
+      try {
+        await jose.jwtVerify(token, key);
+        return result;
+      } catch (e) {
+        if (e.code !== "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
+          throw e;
+        }
+      }
+    }
+    return void 0;
+  }
+}
+
+exports.LegacyTokenHandler = LegacyTokenHandler;
+//# sourceMappingURL=legacy.cjs.js.map

package/dist/entrypoints/auth/external/legacy.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.cjs.js","sources":["../../../../src/entrypoints/auth/external/legacy.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { base64url, decodeJwt, decodeProtectedHeader, jwtVerify } from 'jose';\nimport { readAccessRestrictionsFromConfig } from './helpers';\nimport { AccessRestriptionsMap, TokenHandler } from './types';\n\n/**\n * Handles `type: legacy` access.\n *\n * @internal\n */\nexport class LegacyTokenHandler implements TokenHandler {\n  #entries = new Array<{\n    key: Uint8Array;\n    result: {\n      subject: string;\n      allAccessRestrictions?: AccessRestriptionsMap;\n    };\n  }>();\n\n  add(config: Config) {\n    const allAccessRestrictions = readAccessRestrictionsFromConfig(config);\n    this.#doAdd(\n      config.getString('options.secret'),\n      config.getString('options.subject'),\n      allAccessRestrictions,\n    );\n  }\n\n  // used only for the old backend.auth.keys array\n  addOld(config: Config) {\n    // This choice of subject is for compatibility reasons\n    this.#doAdd(config.getString('secret'), 'external:backstage-plugin');\n  }\n\n  #doAdd(\n    secret: string,\n    subject: string,\n    allAccessRestrictions?: AccessRestriptionsMap,\n  ) {\n    if (!secret.match(/^\\S+$/)) {\n      throw new Error('Illegal secret, must be a valid base64 string');\n    } else if (!subject.match(/^\\S+$/)) {\n      throw new Error('Illegal subject, must be a set of non-space characters');\n    }\n\n    let key: Uint8Array;\n    try {\n      key = base64url.decode(secret);\n    } catch {\n      throw new Error('Illegal secret, must be a valid base64 string');\n    }\n\n    if (this.#entries.some(e => e.key === key)) {\n      throw new Error(\n        'Legacy externalAccess token was declared more than once',\n      );\n    }\n\n    this.#entries.push({\n      key,\n      result: {\n        subject,\n        allAccessRestrictions,\n      },\n    });\n  }\n\n  async verifyToken(token: string) {\n    // First do a duck typing check to see if it remotely looks like a legacy token\n    try {\n      // We do a fair amount of checking upfront here. Since we aren't certain\n      // that it's even the right type of key that we're looking at, we can't\n      // defer eg the alg check to jwtVerify, because it won't be possible to\n      // discern different reasons for key verification failures from each other\n      // easily\n      const { alg } = decodeProtectedHeader(token);\n      if (alg !== 'HS256') {\n        return undefined;\n      }\n      const { sub, aud } = decodeJwt(token);\n      if (sub !== 'backstage-server' || aud) {\n        return undefined;\n      }\n    } catch (e) {\n      // Doesn't look like a jwt at all\n      return undefined;\n    }\n\n    for (const { key, result } of this.#entries) {\n      try {\n        await jwtVerify(token, key);\n        return result;\n      } catch (e) {\n        if (e.code !== 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED') {\n          throw e;\n        }\n        // Otherwise continue to try the next key\n      }\n    }\n\n    // None of the signing keys matched\n    return undefined;\n  }\n}\n"],"names":["readAccessRestrictionsFromConfig","base64url","decodeProtectedHeader","decodeJwt","jwtVerify"],"mappings":";;;;;AA0BO,MAAM,kBAA2C,CAAA;AAAA,EACtD,QAAA,GAAW,IAAI,KAMZ,EAAA,CAAA;AAAA,EAEH,IAAI,MAAgB,EAAA;AAClB,IAAM,MAAA,qBAAA,GAAwBA,yCAAiC,MAAM,CAAA,CAAA;AACrE,IAAK,IAAA,CAAA,MAAA;AAAA,MACH,MAAA,CAAO,UAAU,gBAAgB,CAAA;AAAA,MACjC,MAAA,CAAO,UAAU,iBAAiB,CAAA;AAAA,MAClC,qBAAA;AAAA,KACF,CAAA;AAAA,GACF;AAAA;AAAA,EAGA,OAAO,MAAgB,EAAA;AAErB,IAAA,IAAA,CAAK,MAAO,CAAA,MAAA,CAAO,SAAU,CAAA,QAAQ,GAAG,2BAA2B,CAAA,CAAA;AAAA,GACrE;AAAA,EAEA,MAAA,CACE,MACA,EAAA,OAAA,EACA,qBACA,EAAA;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,KAAM,CAAA,OAAO,CAAG,EAAA;AAC1B,MAAM,MAAA,IAAI,MAAM,+CAA+C,CAAA,CAAA;AAAA,KACtD,MAAA,IAAA,CAAC,OAAQ,CAAA,KAAA,CAAM,OAAO,CAAG,EAAA;AAClC,MAAM,MAAA,IAAI,MAAM,wDAAwD,CAAA,CAAA;AAAA,KAC1E;AAEA,IAAI,IAAA,GAAA,CAAA;AACJ,IAAI,IAAA;AACF,MAAM,GAAA,GAAAC,cAAA,CAAU,OAAO,MAAM,CAAA,CAAA;AAAA,KACvB,CAAA,MAAA;AACN,MAAM,MAAA,IAAI,MAAM,+CAA+C,CAAA,CAAA;AAAA,KACjE;AAEA,IAAA,IAAI,KAAK,QAAS,CAAA,IAAA,CAAK,OAAK,CAAE,CAAA,GAAA,KAAQ,GAAG,CAAG,EAAA;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,yDAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,IAAA,CAAK,SAAS,IAAK,CAAA;AAAA,MACjB,GAAA;AAAA,MACA,MAAQ,EAAA;AAAA,QACN,OAAA;AAAA,QACA,qBAAA;AAAA,OACF;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAY,KAAe,EAAA;AAE/B,IAAI,IAAA;AAMF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA,CAAA;AAC3C,MAAA,IAAI,QAAQ,OAAS,EAAA;AACnB,QAAO,OAAA,KAAA,CAAA,CAAA;AAAA,OACT;AACA,MAAA,MAAM,EAAE,GAAA,EAAK,GAAI,EAAA,GAAIC,eAAU,KAAK,CAAA,CAAA;AACpC,MAAI,IAAA,GAAA,KAAQ,sBAAsB,GAAK,EAAA;AACrC,QAAO,OAAA,KAAA,CAAA,CAAA;AAAA,OACT;AAAA,aACO,CAAG,EAAA;AAEV,MAAO,OAAA,KAAA,CAAA,CAAA;AAAA,KACT;AAEA,IAAA,KAAA,MAAW,EAAE,GAAA,EAAK,MAAO,EAAA,IAAK,KAAK,QAAU,EAAA;AAC3C,MAAI,IAAA;AACF,QAAM,MAAAC,cAAA,CAAU,OAAO,GAAG,CAAA,CAAA;AAC1B,QAAO,OAAA,MAAA,CAAA;AAAA,eACA,CAAG,EAAA;AACV,QAAI,IAAA,CAAA,CAAE,SAAS,uCAAyC,EAAA;AACtD,UAAM,MAAA,CAAA,CAAA;AAAA,SACR;AAAA,OAEF;AAAA,KACF;AAGA,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AACF;;;;"}

package/dist/entrypoints/auth/external/static.cjs.js

@@ -0,0 +1,33 @@
+'use strict';
+
+var helpers = require('./helpers.cjs.js');
+
+const MIN_TOKEN_LENGTH = 8;
+class StaticTokenHandler {
+  #entries = /* @__PURE__ */ new Map();
+  add(config) {
+    const token = config.getString("options.token");
+    const subject = config.getString("options.subject");
+    const allAccessRestrictions = helpers.readAccessRestrictionsFromConfig(config);
+    if (!token.match(/^\S+$/)) {
+      throw new Error("Illegal token, must be a set of non-space characters");
+    } else if (token.length < MIN_TOKEN_LENGTH) {
+      throw new Error(
+        `Illegal token, must be at least ${MIN_TOKEN_LENGTH} characters length`
+      );
+    } else if (!subject.match(/^\S+$/)) {
+      throw new Error("Illegal subject, must be a set of non-space characters");
+    } else if (this.#entries.has(token)) {
+      throw new Error(
+        "Static externalAccess token was declared more than once"
+      );
+    }
+    this.#entries.set(token, { subject, allAccessRestrictions });
+  }
+  async verifyToken(token) {
+    return this.#entries.get(token);
+  }
+}
+
+exports.StaticTokenHandler = StaticTokenHandler;
+//# sourceMappingURL=static.cjs.js.map

package/dist/entrypoints/auth/external/static.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.cjs.js","sources":["../../../../src/entrypoints/auth/external/static.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { readAccessRestrictionsFromConfig } from './helpers';\nimport { AccessRestriptionsMap, TokenHandler } from './types';\n\nconst MIN_TOKEN_LENGTH = 8;\n\n/**\n * Handles `type: static` access.\n *\n * @internal\n */\nexport class StaticTokenHandler implements TokenHandler {\n  #entries = new Map<\n    string,\n    {\n      subject: string;\n      allAccessRestrictions?: AccessRestriptionsMap;\n    }\n  >();\n\n  add(config: Config) {\n    const token = config.getString('options.token');\n    const subject = config.getString('options.subject');\n    const allAccessRestrictions = readAccessRestrictionsFromConfig(config);\n\n    if (!token.match(/^\\S+$/)) {\n      throw new Error('Illegal token, must be a set of non-space characters');\n    } else if (token.length < MIN_TOKEN_LENGTH) {\n      throw new Error(\n        `Illegal token, must be at least ${MIN_TOKEN_LENGTH} characters length`,\n      );\n    } else if (!subject.match(/^\\S+$/)) {\n      throw new Error('Illegal subject, must be a set of non-space characters');\n    } else if (this.#entries.has(token)) {\n      throw new Error(\n        'Static externalAccess token was declared more than once',\n      );\n    }\n\n    this.#entries.set(token, { subject, allAccessRestrictions });\n  }\n\n  async verifyToken(token: string) {\n    return this.#entries.get(token);\n  }\n}\n"],"names":["readAccessRestrictionsFromConfig"],"mappings":";;;;AAoBA,MAAM,gBAAmB,GAAA,CAAA,CAAA;AAOlB,MAAM,kBAA2C,CAAA;AAAA,EACtD,QAAA,uBAAe,GAMb,EAAA,CAAA;AAAA,EAEF,IAAI,MAAgB,EAAA;AAClB,IAAM,MAAA,KAAA,GAAQ,MAAO,CAAA,SAAA,CAAU,eAAe,CAAA,CAAA;AAC9C,IAAM,MAAA,OAAA,GAAU,MAAO,CAAA,SAAA,CAAU,iBAAiB,CAAA,CAAA;AAClD,IAAM,MAAA,qBAAA,GAAwBA,yCAAiC,MAAM,CAAA,CAAA;AAErE,IAAA,IAAI,CAAC,KAAA,CAAM,KAAM,CAAA,OAAO,CAAG,EAAA;AACzB,MAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA,CAAA;AAAA,KACxE,MAAA,IAAW,KAAM,CAAA,MAAA,GAAS,gBAAkB,EAAA;AAC1C,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,mCAAmC,gBAAgB,CAAA,kBAAA,CAAA;AAAA,OACrD,CAAA;AAAA,KACS,MAAA,IAAA,CAAC,OAAQ,CAAA,KAAA,CAAM,OAAO,CAAG,EAAA;AAClC,MAAM,MAAA,IAAI,MAAM,wDAAwD,CAAA,CAAA;AAAA,KAC/D,MAAA,IAAA,IAAA,CAAK,QAAS,CAAA,GAAA,CAAI,KAAK,CAAG,EAAA;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,yDAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,IAAA,CAAK,SAAS,GAAI,CAAA,KAAA,EAAO,EAAE,OAAA,EAAS,uBAAuB,CAAA,CAAA;AAAA,GAC7D;AAAA,EAEA,MAAM,YAAY,KAAe,EAAA;AAC/B,IAAO,OAAA,IAAA,CAAK,QAAS,CAAA,GAAA,CAAI,KAAK,CAAA,CAAA;AAAA,GAChC;AACF;;;;"}

package/dist/{cjs/helpers-D2f1CG0o.cjs.js → entrypoints/auth/helpers.cjs.js}

@@ -50,4 +50,4 @@ exports.createCredentialsWithNonePrincipal = createCredentialsWithNonePrincipal;
 exports.createCredentialsWithServicePrincipal = createCredentialsWithServicePrincipal;
 exports.createCredentialsWithUserPrincipal = createCredentialsWithUserPrincipal;
 exports.toInternalBackstageCredentials = toInternalBackstageCredentials;
-//# sourceMappingURL=helpers-D2f1CG0o.cjs.js.map
+//# sourceMappingURL=helpers.cjs.js.map

package/dist/entrypoints/auth/helpers.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.cjs.js","sources":["../../../src/entrypoints/auth/helpers.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalAccessRestrictions,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { InternalBackstageCredentials } from './types';\n\nexport function createCredentialsWithServicePrincipal(\n  sub: string,\n  token?: string,\n  accessRestrictions?: BackstagePrincipalAccessRestrictions,\n): InternalBackstageCredentials<BackstageServicePrincipal> {\n  return {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    token,\n    principal: {\n      type: 'service',\n      subject: sub,\n      accessRestrictions,\n    },\n  };\n}\n\nexport function createCredentialsWithUserPrincipal(\n  sub: string,\n  token: string,\n  expiresAt?: Date,\n): InternalBackstageCredentials<BackstageUserPrincipal> {\n  return {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    token,\n    expiresAt,\n    principal: {\n      type: 'user',\n      userEntityRef: sub,\n    },\n  };\n}\n\nexport function createCredentialsWithNonePrincipal(): InternalBackstageCredentials<BackstageNonePrincipal> {\n  return {\n    $$type: '@backstage/BackstageCredentials',\n    version: 'v1',\n    principal: {\n      type: 'none',\n    },\n  };\n}\n\nexport function toInternalBackstageCredentials(\n  credentials: BackstageCredentials,\n): InternalBackstageCredentials<\n  BackstageUserPrincipal | BackstageServicePrincipal | BackstageNonePrincipal\n> {\n  if (credentials.$$type !== '@backstage/BackstageCredentials') {\n    throw new Error('Invalid credential type');\n  }\n\n  const internalCredentials = credentials as InternalBackstageCredentials<\n    BackstageUserPrincipal | BackstageServicePrincipal | BackstageNonePrincipal\n  >;\n\n  if (internalCredentials.version !== 'v1') {\n    throw new Error(\n      `Invalid credential version ${internalCredentials.version}`,\n    );\n  }\n\n  return internalCredentials;\n}\n"],"names":[],"mappings":";;AAyBgB,SAAA,qCAAA,CACd,GACA,EAAA,KAAA,EACA,kBACyD,EAAA;AACzD,EAAO,OAAA;AAAA,IACL,MAAQ,EAAA,iCAAA;AAAA,IACR,OAAS,EAAA,IAAA;AAAA,IACT,KAAA;AAAA,IACA,SAAW,EAAA;AAAA,MACT,IAAM,EAAA,SAAA;AAAA,MACN,OAAS,EAAA,GAAA;AAAA,MACT,kBAAA;AAAA,KACF;AAAA,GACF,CAAA;AACF,CAAA;AAEgB,SAAA,kCAAA,CACd,GACA,EAAA,KAAA,EACA,SACsD,EAAA;AACtD,EAAO,OAAA;AAAA,IACL,MAAQ,EAAA,iCAAA;AAAA,IACR,OAAS,EAAA,IAAA;AAAA,IACT,KAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAW,EAAA;AAAA,MACT,IAAM,EAAA,MAAA;AAAA,MACN,aAAe,EAAA,GAAA;AAAA,KACjB;AAAA,GACF,CAAA;AACF,CAAA;AAEO,SAAS,kCAA2F,GAAA;AACzG,EAAO,OAAA;AAAA,IACL,MAAQ,EAAA,iCAAA;AAAA,IACR,OAAS,EAAA,IAAA;AAAA,IACT,SAAW,EAAA;AAAA,MACT,IAAM,EAAA,MAAA;AAAA,KACR;AAAA,GACF,CAAA;AACF,CAAA;AAEO,SAAS,+BACd,WAGA,EAAA;AACA,EAAI,IAAA,WAAA,CAAY,WAAW,iCAAmC,EAAA;AAC5D,IAAM,MAAA,IAAI,MAAM,yBAAyB,CAAA,CAAA;AAAA,GAC3C;AAEA,EAAA,MAAM,mBAAsB,GAAA,WAAA,CAAA;AAI5B,EAAI,IAAA,mBAAA,CAAoB,YAAY,IAAM,EAAA;AACxC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,oBAAoB,OAAO,CAAA,CAAA;AAAA,KAC3D,CAAA;AAAA,GACF;AAEA,EAAO,OAAA,mBAAA,CAAA;AACT;;;;;;;"}

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js

@@ -0,0 +1,147 @@
+'use strict';
+
+var jose = require('jose');
+var errors = require('@backstage/errors');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var JwksClient = require('../JwksClient.cjs.js');
+var types = require('@backstage/types');
+
+const SECONDS_IN_MS = 1e3;
+const ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;
+class PluginTokenHandler {
+  constructor(logger, ownPluginId, keySource, algorithm, keyDurationSeconds, discovery) {
+    this.logger = logger;
+    this.ownPluginId = ownPluginId;
+    this.keySource = keySource;
+    this.algorithm = algorithm;
+    this.keyDurationSeconds = keyDurationSeconds;
+    this.discovery = discovery;
+  }
+  jwksMap = /* @__PURE__ */ new Map();
+  // Tracking state for isTargetPluginSupported
+  supportedTargetPlugins = /* @__PURE__ */ new Set();
+  targetPluginInflightChecks = /* @__PURE__ */ new Map();
+  static create(options) {
+    return new PluginTokenHandler(
+      options.logger,
+      options.ownPluginId,
+      options.keySource,
+      options.algorithm ?? "ES256",
+      Math.round(types.durationToMilliseconds(options.keyDuration) / 1e3),
+      options.discovery
+    );
+  }
+  async verifyToken(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      if (typ !== pluginAuthNode.tokenTypes.plugin.typParam) {
+        return void 0;
+      }
+    } catch {
+      return void 0;
+    }
+    const pluginId = String(jose.decodeJwt(token).sub);
+    if (!pluginId) {
+      throw new errors.AuthenticationError("Invalid plugin token: missing subject");
+    }
+    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {
+      throw new errors.AuthenticationError(
+        "Invalid plugin token: forbidden subject format"
+      );
+    }
+    const jwksClient = await this.getJwksClient(pluginId);
+    await jwksClient.refreshKeyStore(token);
+    const { payload } = await jose.jwtVerify(
+      token,
+      jwksClient.getKey,
+      {
+        typ: pluginAuthNode.tokenTypes.plugin.typParam,
+        audience: this.ownPluginId,
+        requiredClaims: ["iat", "exp", "sub", "aud"]
+      }
+    ).catch((e) => {
+      throw new errors.AuthenticationError("Invalid plugin token", e);
+    });
+    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };
+  }
+  async issueToken(options) {
+    const { pluginId, targetPluginId, onBehalfOf } = options;
+    const key = await this.keySource.getPrivateSigningKey();
+    const sub = pluginId;
+    const aud = targetPluginId;
+    const iat = Math.floor(Date.now() / SECONDS_IN_MS);
+    const ourExp = iat + this.keyDurationSeconds;
+    const exp = onBehalfOf ? Math.min(
+      ourExp,
+      Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS)
+    ) : ourExp;
+    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };
+    const token = await new jose.SignJWT(claims).setProtectedHeader({
+      typ: pluginAuthNode.tokenTypes.plugin.typParam,
+      alg: this.algorithm,
+      kid: key.kid
+    }).setAudience(aud).setSubject(sub).setIssuedAt(iat).setExpirationTime(exp).sign(await jose.importJWK(key));
+    return { token };
+  }
+  async isTargetPluginSupported(targetPluginId) {
+    if (this.supportedTargetPlugins.has(targetPluginId)) {
+      return true;
+    }
+    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);
+    if (inFlight) {
+      return inFlight;
+    }
+    const doCheck = async () => {
+      try {
+        const res = await fetch(
+          `${await this.discovery.getBaseUrl(
+            targetPluginId
+          )}/.backstage/auth/v1/jwks.json`
+        );
+        if (res.status === 404) {
+          return false;
+        }
+        if (!res.ok) {
+          throw new Error(`Failed to fetch jwks.json, ${res.status}`);
+        }
+        const data = await res.json();
+        if (!data.keys) {
+          throw new Error(`Invalid jwks.json response, missing keys`);
+        }
+        this.supportedTargetPlugins.add(targetPluginId);
+        return true;
+      } catch (error) {
+        this.logger.error("Unexpected failure for target JWKS check", error);
+        return false;
+      } finally {
+        this.targetPluginInflightChecks.delete(targetPluginId);
+      }
+    };
+    const check = doCheck();
+    this.targetPluginInflightChecks.set(targetPluginId, check);
+    return check;
+  }
+  async getJwksClient(pluginId) {
+    const client = this.jwksMap.get(pluginId);
+    if (client) {
+      return client;
+    }
+    if (!await this.isTargetPluginSupported(pluginId)) {
+      throw new errors.AuthenticationError(
+        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. The target plugin needs to be migrated to be installed in an app using the new backend system.`
+      );
+    }
+    const newClient = new JwksClient.JwksClient(async () => {
+      return new URL(
+        `${await this.discovery.getBaseUrl(
+          pluginId
+        )}/.backstage/auth/v1/jwks.json`
+      );
+    });
+    this.jwksMap.set(pluginId, newClient);
+    return newClient;
+  }
+}
+
+exports.PluginTokenHandler = PluginTokenHandler;
+//# sourceMappingURL=PluginTokenHandler.cjs.js.map