@backstage/backend-defaults 0.5.1-next.0 → 0.5.1-next.2

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\nexport class PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new PluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private constructor(\n    private readonly logger: LoggerService,\n    private readonly ownPluginId: string,\n    private readonly keySource: PluginKeySource,\n    private readonly algorithm: string,\n    private readonly keyDurationSeconds: number,\n    private readonly discovery: DiscoveryService,\n  ) {}\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      throw new AuthenticationError('Invalid plugin token', e);\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { token: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAgB,GAAA,GAAA,CAAA;AAEtB,MAAM,yBAA4B,GAAA,gBAAA,CAAA;AAmB3B,MAAM,kBAAmB,CAAA;AAAA,EAkBtB,YACW,MACA,EAAA,WAAA,EACA,SACA,EAAA,SAAA,EACA,oBACA,SACjB,EAAA;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA,CAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA,CAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA,CAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA,CAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA,CAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA,CAAA;AAAA,GAChB;AAAA,EAxBK,OAAA,uBAAc,GAAwB,EAAA,CAAA;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAY,EAAA,CAAA;AAAA,EACzC,0BAAA,uBAAiC,GAA8B,EAAA,CAAA;AAAA,EAEvE,OAAO,OAAO,OAAkB,EAAA;AAC9B,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,OAAQ,CAAA,MAAA;AAAA,MACR,OAAQ,CAAA,WAAA;AAAA,MACR,OAAQ,CAAA,SAAA;AAAA,MACR,QAAQ,SAAa,IAAA,OAAA;AAAA,MACrB,KAAK,KAAM,CAAAA,4BAAA,CAAuB,OAAQ,CAAA,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAQ,CAAA,SAAA;AAAA,KACV,CAAA;AAAA,GACF;AAAA,EAWA,MAAM,YACJ,KACqE,EAAA;AACrE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA,CAAA;AAC3C,MAAI,IAAA,GAAA,KAAQC,yBAAW,CAAA,MAAA,CAAO,QAAU,EAAA;AACtC,QAAO,OAAA,KAAA,CAAA,CAAA;AAAA,OACT;AAAA,KACM,CAAA,MAAA;AACN,MAAO,OAAA,KAAA,CAAA,CAAA;AAAA,KACT;AAEA,IAAA,MAAM,QAAW,GAAA,MAAA,CAAOC,cAAU,CAAA,KAAK,EAAE,GAAG,CAAA,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAM,MAAA,IAAIC,2BAAoB,uCAAuC,CAAA,CAAA;AAAA,KACvE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAK,CAAA,QAAQ,CAAG,EAAA;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR,gDAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,aAAA,CAAc,QAAQ,CAAA,CAAA;AACpD,IAAM,MAAA,UAAA,CAAW,gBAAgB,KAAK,CAAA,CAAA;AAEtC,IAAM,MAAA,EAAE,OAAQ,EAAA,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAW,CAAA,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAO,CAAA,QAAA;AAAA,QACvB,UAAU,IAAK,CAAA,WAAA;AAAA,QACf,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,OAAO,KAAK,CAAA;AAAA,OAC7C;AAAA,KACF,CAAE,MAAM,CAAK,CAAA,KAAA;AACX,MAAM,MAAA,IAAIE,0BAAoB,CAAA,sBAAA,EAAwB,CAAC,CAAA,CAAA;AAAA,KACxD,CAAA,CAAA;AAED,IAAO,OAAA,EAAE,SAAS,CAAU,OAAA,EAAA,OAAA,CAAQ,GAAG,CAAI,CAAA,EAAA,gBAAA,EAAkB,QAAQ,GAAI,EAAA,CAAA;AAAA,GAC3E;AAAA,EAEA,MAAM,WAAW,OAIc,EAAA;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAgB,EAAA,UAAA,EAAe,GAAA,OAAA,CAAA;AACjD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,oBAAqB,EAAA,CAAA;AAEtD,IAAA,MAAM,GAAM,GAAA,QAAA,CAAA;AACZ,IAAA,MAAM,GAAM,GAAA,cAAA,CAAA;AACZ,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,aAAa,CAAA,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAK,CAAA,kBAAA,CAAA;AAC1B,IAAM,MAAA,GAAA,GAAM,aACR,IAAK,CAAA,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAM,CAAA,UAAA,CAAW,SAAU,CAAA,OAAA,KAAY,aAAa,CAAA;AAAA,KAE3D,GAAA,MAAA,CAAA;AAEJ,IAAM,MAAA,MAAA,GAAS,EAAE,GAAK,EAAA,GAAA,EAAK,KAAK,GAAK,EAAA,GAAA,EAAK,YAAY,KAAM,EAAA,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAQ,CAAA,MAAM,EACnC,kBAAmB,CAAA;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAO,CAAA,QAAA;AAAA,MACvB,KAAK,IAAK,CAAA,SAAA;AAAA,MACV,KAAK,GAAI,CAAA,GAAA;AAAA,KACV,CACA,CAAA,WAAA,CAAY,GAAG,CACf,CAAA,UAAA,CAAW,GAAG,CACd,CAAA,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAM,EAAA,CAAA;AAAA,GACjB;AAAA,EAEA,MAAc,wBACZ,cACkB,EAAA;AAClB,IAAA,IAAI,IAAK,CAAA,sBAAA,CAAuB,GAAI,CAAA,cAAc,CAAG,EAAA;AACnD,MAAO,OAAA,IAAA,CAAA;AAAA,KACT;AACA,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,0BAA2B,CAAA,GAAA,CAAI,cAAc,CAAA,CAAA;AACnE,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA,CAAA;AAAA,KACT;AAEA,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAI,IAAA;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,YACtB,cAAA;AAAA,WACD,CAAA,6BAAA,CAAA;AAAA,SACH,CAAA;AACA,QAAI,IAAA,GAAA,CAAI,WAAW,GAAK,EAAA;AACtB,UAAO,OAAA,KAAA,CAAA;AAAA,SACT;AAEA,QAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAA8B,2BAAA,EAAA,GAAA,CAAI,MAAM,CAAE,CAAA,CAAA,CAAA;AAAA,SAC5D;AAEA,QAAM,MAAA,IAAA,GAAO,MAAM,GAAA,CAAI,IAAK,EAAA,CAAA;AAC5B,QAAI,IAAA,CAAC,KAAK,IAAM,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,CAA0C,wCAAA,CAAA,CAAA,CAAA;AAAA,SAC5D;AAEA,QAAK,IAAA,CAAA,sBAAA,CAAuB,IAAI,cAAc,CAAA,CAAA;AAC9C,QAAO,OAAA,IAAA,CAAA;AAAA,eACA,KAAO,EAAA;AACd,QAAK,IAAA,CAAA,MAAA,CAAO,KAAM,CAAA,0CAAA,EAA4C,KAAK,CAAA,CAAA;AACnE,QAAO,OAAA,KAAA,CAAA;AAAA,OACP,SAAA;AACA,QAAK,IAAA,CAAA,0BAAA,CAA2B,OAAO,cAAc,CAAA,CAAA;AAAA,OACvD;AAAA,KACF,CAAA;AAEA,IAAA,MAAM,QAAQ,OAAQ,EAAA,CAAA;AACtB,IAAK,IAAA,CAAA,0BAAA,CAA2B,GAAI,CAAA,cAAA,EAAgB,KAAK,CAAA,CAAA;AACzD,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AAAA,EAEA,MAAc,cAAc,QAAkB,EAAA;AAC5C,IAAA,MAAM,MAAS,GAAA,IAAA,CAAK,OAAQ,CAAA,GAAA,CAAI,QAAQ,CAAA,CAAA;AACxC,IAAA,IAAI,MAAQ,EAAA;AACV,MAAO,OAAA,MAAA,CAAA;AAAA,KACT;AAGA,IAAA,IAAI,CAAE,MAAM,IAAK,CAAA,uBAAA,CAAwB,QAAQ,CAAI,EAAA;AACnD,MAAA,MAAM,IAAIH,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA,CAAA;AAAA,OAEvD,CAAA;AAAA,KACF;AAEA,IAAM,MAAA,SAAA,GAAY,IAAII,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,UACtB,QAAA;AAAA,SACD,CAAA,6BAAA,CAAA;AAAA,OACH,CAAA;AAAA,KACD,CAAA,CAAA;AAED,IAAK,IAAA,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,EAAU,SAAS,CAAA,CAAA;AACpC,IAAO,OAAA,SAAA,CAAA;AAAA,GACT;AACF;;;;"}

package/dist/entrypoints/auth/plugin/keys/DatabaseKeyStore.cjs.js

@@ -0,0 +1,73 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var luxon = require('luxon');
+
+const MIGRATIONS_TABLE = "backstage_backend_public_keys__knex_migrations";
+const TABLE = "backstage_backend_public_keys__keys";
+function applyDatabaseMigrations(knex) {
+  const migrationsDir = backendPluginApi.resolvePackagePath(
+    "@backstage/backend-defaults",
+    "migrations/auth"
+  );
+  return knex.migrate.latest({
+    directory: migrationsDir,
+    tableName: MIGRATIONS_TABLE
+  });
+}
+class DatabaseKeyStore {
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
+  }
+  static async create(options) {
+    const { database, logger } = options;
+    const client = await database.getClient();
+    if (!database.migrations?.skip) {
+      await applyDatabaseMigrations(client);
+    }
+    return new DatabaseKeyStore(client, logger);
+  }
+  async addKey(options) {
+    await this.client(TABLE).insert({
+      id: options.key.kid,
+      key: JSON.stringify(options.key),
+      expires_at: options.expiresAt.toISOString()
+    });
+  }
+  async listKeys() {
+    const rows = await this.client(TABLE).select();
+    const keys = rows.map((row) => ({
+      id: row.id,
+      key: JSON.parse(row.key),
+      expiresAt: new Date(row.expires_at)
+    }));
+    const validKeys = [];
+    const expiredKeys = [];
+    for (const key of keys) {
+      if (luxon.DateTime.fromJSDate(key.expiresAt) < luxon.DateTime.local()) {
+        expiredKeys.push(key);
+      } else {
+        validKeys.push(key);
+      }
+    }
+    if (expiredKeys.length > 0) {
+      const kids = expiredKeys.map(({ key }) => key.kid);
+      this.logger.info(
+        `Removing expired plugin service keys, '${kids.join("', '")}'`
+      );
+      this.client(TABLE).delete().whereIn("id", kids).catch((error) => {
+        this.logger.error(
+          "Failed to remove expired plugin service keys",
+          error
+        );
+      });
+    }
+    return { keys: validKeys };
+  }
+}
+
+exports.DatabaseKeyStore = DatabaseKeyStore;
+exports.TABLE = TABLE;
+exports.applyDatabaseMigrations = applyDatabaseMigrations;
+//# sourceMappingURL=DatabaseKeyStore.cjs.js.map

package/dist/entrypoints/auth/plugin/keys/DatabaseKeyStore.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatabaseKeyStore.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/DatabaseKeyStore.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LoggerService,\n  resolvePackagePath,\n} from '@backstage/backend-plugin-api';\nimport { JsonObject } from '@backstage/types';\nimport { Knex } from 'knex';\nimport { DateTime } from 'luxon';\nimport { KeyStore } from './types';\n\nconst MIGRATIONS_TABLE = 'backstage_backend_public_keys__knex_migrations';\n\n/** @internal */\nexport const TABLE = 'backstage_backend_public_keys__keys';\n\ntype Row = {\n  id: string;\n  key: string;\n  expires_at: string;\n};\n\nexport function applyDatabaseMigrations(knex: Knex): Promise<void> {\n  const migrationsDir = resolvePackagePath(\n    '@backstage/backend-defaults',\n    'migrations/auth',\n  );\n\n  return knex.migrate.latest({\n    directory: migrationsDir,\n    tableName: MIGRATIONS_TABLE,\n  });\n}\n\n/** @internal */\nexport class DatabaseKeyStore implements KeyStore {\n  static async create(options: {\n    database: DatabaseService;\n    logger: LoggerService;\n  }) {\n    const { database, logger } = options;\n\n    const client = await database.getClient();\n    if (!database.migrations?.skip) {\n      await applyDatabaseMigrations(client);\n    }\n    return new DatabaseKeyStore(client, logger);\n  }\n\n  private constructor(\n    private readonly client: Knex,\n    private readonly logger: LoggerService,\n  ) {}\n\n  async addKey(options: {\n    id: string;\n    key: JsonObject & { kid: string };\n    expiresAt: Date;\n  }) {\n    await this.client<Row>(TABLE).insert({\n      id: options.key.kid,\n      key: JSON.stringify(options.key),\n      expires_at: options.expiresAt.toISOString(),\n    });\n  }\n\n  async listKeys() {\n    const rows = await this.client<Row>(TABLE).select();\n    const keys = rows.map(row => ({\n      id: row.id,\n      key: JSON.parse(row.key),\n      expiresAt: new Date(row.expires_at),\n    }));\n\n    const validKeys = [];\n    const expiredKeys = [];\n\n    for (const key of keys) {\n      if (DateTime.fromJSDate(key.expiresAt) < DateTime.local()) {\n        expiredKeys.push(key);\n      } else {\n        validKeys.push(key);\n      }\n    }\n\n    // Lazily prune expired keys. This may cause duplicate removals if we have concurrent callers, but w/e\n    if (expiredKeys.length > 0) {\n      const kids = expiredKeys.map(({ key }) => key.kid);\n\n      this.logger.info(\n        `Removing expired plugin service keys, '${kids.join(\"', '\")}'`,\n      );\n\n      // We don't await this, just let it run in the background\n      this.client<Row>(TABLE)\n        .delete()\n        .whereIn('id', kids)\n        .catch(error => {\n          this.logger.error(\n            'Failed to remove expired plugin service keys',\n            error,\n          );\n        });\n    }\n\n    return { keys: validKeys };\n  }\n}\n"],"names":["resolvePackagePath","DateTime"],"mappings":";;;;;AA0BA,MAAM,gBAAmB,GAAA,gDAAA,CAAA;AAGlB,MAAM,KAAQ,GAAA,sCAAA;AAQd,SAAS,wBAAwB,IAA2B,EAAA;AACjE,EAAA,MAAM,aAAgB,GAAAA,mCAAA;AAAA,IACpB,6BAAA;AAAA,IACA,iBAAA;AAAA,GACF,CAAA;AAEA,EAAO,OAAA,IAAA,CAAK,QAAQ,MAAO,CAAA;AAAA,IACzB,SAAW,EAAA,aAAA;AAAA,IACX,SAAW,EAAA,gBAAA;AAAA,GACZ,CAAA,CAAA;AACH,CAAA;AAGO,MAAM,gBAAqC,CAAA;AAAA,EAcxC,WAAA,CACW,QACA,MACjB,EAAA;AAFiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA,CAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA,CAAA;AAAA,GAChB;AAAA,EAhBH,aAAa,OAAO,OAGjB,EAAA;AACD,IAAM,MAAA,EAAE,QAAU,EAAA,MAAA,EAAW,GAAA,OAAA,CAAA;AAE7B,IAAM,MAAA,MAAA,GAAS,MAAM,QAAA,CAAS,SAAU,EAAA,CAAA;AACxC,IAAI,IAAA,CAAC,QAAS,CAAA,UAAA,EAAY,IAAM,EAAA;AAC9B,MAAA,MAAM,wBAAwB,MAAM,CAAA,CAAA;AAAA,KACtC;AACA,IAAO,OAAA,IAAI,gBAAiB,CAAA,MAAA,EAAQ,MAAM,CAAA,CAAA;AAAA,GAC5C;AAAA,EAOA,MAAM,OAAO,OAIV,EAAA;AACD,IAAA,MAAM,IAAK,CAAA,MAAA,CAAY,KAAK,CAAA,CAAE,MAAO,CAAA;AAAA,MACnC,EAAA,EAAI,QAAQ,GAAI,CAAA,GAAA;AAAA,MAChB,GAAK,EAAA,IAAA,CAAK,SAAU,CAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC/B,UAAA,EAAY,OAAQ,CAAA,SAAA,CAAU,WAAY,EAAA;AAAA,KAC3C,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,QAAW,GAAA;AACf,IAAA,MAAM,OAAO,MAAM,IAAA,CAAK,MAAY,CAAA,KAAK,EAAE,MAAO,EAAA,CAAA;AAClD,IAAM,MAAA,IAAA,GAAO,IAAK,CAAA,GAAA,CAAI,CAAQ,GAAA,MAAA;AAAA,MAC5B,IAAI,GAAI,CAAA,EAAA;AAAA,MACR,GAAK,EAAA,IAAA,CAAK,KAAM,CAAA,GAAA,CAAI,GAAG,CAAA;AAAA,MACvB,SAAW,EAAA,IAAI,IAAK,CAAA,GAAA,CAAI,UAAU,CAAA;AAAA,KAClC,CAAA,CAAA,CAAA;AAEF,IAAA,MAAM,YAAY,EAAC,CAAA;AACnB,IAAA,MAAM,cAAc,EAAC,CAAA;AAErB,IAAA,KAAA,MAAW,OAAO,IAAM,EAAA;AACtB,MAAA,IAAIC,eAAS,UAAW,CAAA,GAAA,CAAI,SAAS,CAAI,GAAAA,cAAA,CAAS,OAAS,EAAA;AACzD,QAAA,WAAA,CAAY,KAAK,GAAG,CAAA,CAAA;AAAA,OACf,MAAA;AACL,QAAA,SAAA,CAAU,KAAK,GAAG,CAAA,CAAA;AAAA,OACpB;AAAA,KACF;AAGA,IAAI,IAAA,WAAA,CAAY,SAAS,CAAG,EAAA;AAC1B,MAAM,MAAA,IAAA,GAAO,YAAY,GAAI,CAAA,CAAC,EAAE,GAAI,EAAA,KAAM,IAAI,GAAG,CAAA,CAAA;AAEjD,MAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,QACV,CAA0C,uCAAA,EAAA,IAAA,CAAK,IAAK,CAAA,MAAM,CAAC,CAAA,CAAA,CAAA;AAAA,OAC7D,CAAA;AAGA,MAAK,IAAA,CAAA,MAAA,CAAY,KAAK,CAAA,CACnB,MAAO,EAAA,CACP,QAAQ,IAAM,EAAA,IAAI,CAClB,CAAA,KAAA,CAAM,CAAS,KAAA,KAAA;AACd,QAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,UACV,8CAAA;AAAA,UACA,KAAA;AAAA,SACF,CAAA;AAAA,OACD,CAAA,CAAA;AAAA,KACL;AAEA,IAAO,OAAA,EAAE,MAAM,SAAU,EAAA,CAAA;AAAA,GAC3B;AACF;;;;;;"}

package/dist/entrypoints/auth/plugin/keys/DatabasePluginKeySource.cjs.js

@@ -0,0 +1,75 @@
+'use strict';
+
+var types = require('@backstage/types');
+var jose = require('jose');
+var uuid = require('uuid');
+var DatabaseKeyStore = require('./DatabaseKeyStore.cjs.js');
+
+const SECONDS_IN_MS = 1e3;
+const KEY_EXPIRATION_MARGIN_FACTOR = 3;
+class DatabasePluginKeySource {
+  constructor(keyStore, logger, keyDurationSeconds, algorithm) {
+    this.keyStore = keyStore;
+    this.logger = logger;
+    this.keyDurationSeconds = keyDurationSeconds;
+    this.algorithm = algorithm;
+  }
+  privateKeyPromise;
+  keyExpiry;
+  static async create(options) {
+    const keyStore = await DatabaseKeyStore.DatabaseKeyStore.create({
+      database: options.database,
+      logger: options.logger
+    });
+    return new DatabasePluginKeySource(
+      keyStore,
+      options.logger,
+      Math.round(types.durationToMilliseconds(options.keyDuration) / 1e3),
+      options.algorithm ?? "ES256"
+    );
+  }
+  async getPrivateSigningKey() {
+    if (this.privateKeyPromise) {
+      if (this.keyExpiry && this.keyExpiry.getTime() > Date.now()) {
+        return this.privateKeyPromise;
+      }
+      this.logger.info(`Signing key has expired, generating new key`);
+      delete this.privateKeyPromise;
+    }
+    this.keyExpiry = new Date(
+      Date.now() + this.keyDurationSeconds * SECONDS_IN_MS
+    );
+    const promise = (async () => {
+      const kid = uuid.v4();
+      const key = await jose.generateKeyPair(this.algorithm);
+      const publicKey = await jose.exportJWK(key.publicKey);
+      const privateKey = await jose.exportJWK(key.privateKey);
+      publicKey.kid = privateKey.kid = kid;
+      publicKey.alg = privateKey.alg = this.algorithm;
+      this.logger.info(`Created new signing key ${kid}`);
+      await this.keyStore.addKey({
+        id: kid,
+        key: publicKey,
+        expiresAt: new Date(
+          Date.now() + this.keyDurationSeconds * SECONDS_IN_MS * KEY_EXPIRATION_MARGIN_FACTOR
+        )
+      });
+      return privateKey;
+    })();
+    this.privateKeyPromise = promise;
+    try {
+      await promise;
+    } catch (error) {
+      this.logger.error(`Failed to generate new signing key, ${error}`);
+      delete this.keyExpiry;
+      delete this.privateKeyPromise;
+    }
+    return promise;
+  }
+  listKeys() {
+    return this.keyStore.listKeys();
+  }
+}
+
+exports.DatabasePluginKeySource = DatabasePluginKeySource;
+//# sourceMappingURL=DatabasePluginKeySource.cjs.js.map

package/dist/entrypoints/auth/plugin/keys/DatabasePluginKeySource.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatabasePluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/DatabasePluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DatabaseService, LoggerService } from '@backstage/backend-plugin-api';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { JWK, exportJWK, generateKeyPair } from 'jose';\nimport { v4 as uuid } from 'uuid';\nimport { DatabaseKeyStore } from './DatabaseKeyStore';\nimport { InternalKey, KeyPayload, KeyStore } from './types';\nimport { PluginKeySource } from './types';\n\nconst SECONDS_IN_MS = 1000;\n\n/**\n * The margin for how many times longer we make the public key available\n * compared to how long we use the private key to sign new tokens.\n */\nconst KEY_EXPIRATION_MARGIN_FACTOR = 3;\n\nexport class DatabasePluginKeySource implements PluginKeySource {\n  private privateKeyPromise?: Promise<JWK>;\n  private keyExpiry?: Date;\n\n  constructor(\n    private readonly keyStore: KeyStore,\n    private readonly logger: LoggerService,\n    private readonly keyDurationSeconds: number,\n    private readonly algorithm: string,\n  ) {}\n\n  public static async create(options: {\n    logger: LoggerService;\n    database: DatabaseService;\n    keyDuration: HumanDuration;\n    algorithm?: string;\n  }): Promise<PluginKeySource> {\n    const keyStore = await DatabaseKeyStore.create({\n      database: options.database,\n      logger: options.logger,\n    });\n\n    return new DatabasePluginKeySource(\n      keyStore,\n      options.logger,\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.algorithm ?? 'ES256',\n    );\n  }\n\n  async getPrivateSigningKey(): Promise<JWK> {\n    // Make sure that we only generate one key at a time\n    if (this.privateKeyPromise) {\n      if (this.keyExpiry && this.keyExpiry.getTime() > Date.now()) {\n        return this.privateKeyPromise;\n      }\n      this.logger.info(`Signing key has expired, generating new key`);\n      delete this.privateKeyPromise;\n    }\n\n    this.keyExpiry = new Date(\n      Date.now() + this.keyDurationSeconds * SECONDS_IN_MS,\n    );\n\n    const promise = (async () => {\n      // This generates a new signing key to be used to sign tokens until the next key rotation\n      const kid = uuid();\n      const key = await generateKeyPair(this.algorithm);\n      const publicKey = await exportJWK(key.publicKey);\n      const privateKey = await exportJWK(key.privateKey);\n      publicKey.kid = privateKey.kid = kid;\n      publicKey.alg = privateKey.alg = this.algorithm;\n\n      // We're not allowed to use the key until it has been successfully stored\n      // TODO: some token verification implementations aggressively cache the list of keys, and\n      //       don't attempt to fetch new ones even if they encounter an unknown kid. Therefore we\n      //       may want to keep using the existing key for some period of time until we switch to\n      //       the new one. This also needs to be implemented cross-service though, meaning new services\n      //       that boot up need to be able to grab an existing key to use for signing.\n      this.logger.info(`Created new signing key ${kid}`);\n\n      await this.keyStore.addKey({\n        id: kid,\n        key: publicKey as InternalKey,\n        expiresAt: new Date(\n          Date.now() +\n            this.keyDurationSeconds *\n              SECONDS_IN_MS *\n              KEY_EXPIRATION_MARGIN_FACTOR,\n        ),\n      });\n\n      // At this point we are allowed to start using the new key\n      return privateKey;\n    })();\n\n    this.privateKeyPromise = promise;\n\n    try {\n      // If we fail to generate a new key, we need to clear the state so that\n      // the next caller will try to generate another key.\n      await promise;\n    } catch (error) {\n      this.logger.error(`Failed to generate new signing key, ${error}`);\n      delete this.keyExpiry;\n      delete this.privateKeyPromise;\n    }\n\n    return promise;\n  }\n\n  listKeys(): Promise<{ keys: KeyPayload[] }> {\n    return this.keyStore.listKeys();\n  }\n}\n"],"names":["DatabaseKeyStore","durationToMilliseconds","uuid","generateKeyPair","exportJWK"],"mappings":";;;;;;;AAwBA,MAAM,aAAgB,GAAA,GAAA,CAAA;AAMtB,MAAM,4BAA+B,GAAA,CAAA,CAAA;AAE9B,MAAM,uBAAmD,CAAA;AAAA,EAI9D,WACmB,CAAA,QAAA,EACA,MACA,EAAA,kBAAA,EACA,SACjB,EAAA;AAJiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA,CAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA,CAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA,CAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA,CAAA;AAAA,GAChB;AAAA,EARK,iBAAA,CAAA;AAAA,EACA,SAAA,CAAA;AAAA,EASR,aAAoB,OAAO,OAKE,EAAA;AAC3B,IAAM,MAAA,QAAA,GAAW,MAAMA,iCAAA,CAAiB,MAAO,CAAA;AAAA,MAC7C,UAAU,OAAQ,CAAA,QAAA;AAAA,MAClB,QAAQ,OAAQ,CAAA,MAAA;AAAA,KACjB,CAAA,CAAA;AAED,IAAA,OAAO,IAAI,uBAAA;AAAA,MACT,QAAA;AAAA,MACA,OAAQ,CAAA,MAAA;AAAA,MACR,KAAK,KAAM,CAAAC,4BAAA,CAAuB,OAAQ,CAAA,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,QAAQ,SAAa,IAAA,OAAA;AAAA,KACvB,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,oBAAqC,GAAA;AAEzC,IAAA,IAAI,KAAK,iBAAmB,EAAA;AAC1B,MAAI,IAAA,IAAA,CAAK,aAAa,IAAK,CAAA,SAAA,CAAU,SAAY,GAAA,IAAA,CAAK,KAAO,EAAA;AAC3D,QAAA,OAAO,IAAK,CAAA,iBAAA,CAAA;AAAA,OACd;AACA,MAAK,IAAA,CAAA,MAAA,CAAO,KAAK,CAA6C,2CAAA,CAAA,CAAA,CAAA;AAC9D,MAAA,OAAO,IAAK,CAAA,iBAAA,CAAA;AAAA,KACd;AAEA,IAAA,IAAA,CAAK,YAAY,IAAI,IAAA;AAAA,MACnB,IAAK,CAAA,GAAA,EAAQ,GAAA,IAAA,CAAK,kBAAqB,GAAA,aAAA;AAAA,KACzC,CAAA;AAEA,IAAA,MAAM,WAAW,YAAY;AAE3B,MAAA,MAAM,MAAMC,OAAK,EAAA,CAAA;AACjB,MAAA,MAAM,GAAM,GAAA,MAAMC,oBAAgB,CAAA,IAAA,CAAK,SAAS,CAAA,CAAA;AAChD,MAAA,MAAM,SAAY,GAAA,MAAMC,cAAU,CAAA,GAAA,CAAI,SAAS,CAAA,CAAA;AAC/C,MAAA,MAAM,UAAa,GAAA,MAAMA,cAAU,CAAA,GAAA,CAAI,UAAU,CAAA,CAAA;AACjD,MAAU,SAAA,CAAA,GAAA,GAAM,WAAW,GAAM,GAAA,GAAA,CAAA;AACjC,MAAU,SAAA,CAAA,GAAA,GAAM,UAAW,CAAA,GAAA,GAAM,IAAK,CAAA,SAAA,CAAA;AAQtC,MAAA,IAAA,CAAK,MAAO,CAAA,IAAA,CAAK,CAA2B,wBAAA,EAAA,GAAG,CAAE,CAAA,CAAA,CAAA;AAEjD,MAAM,MAAA,IAAA,CAAK,SAAS,MAAO,CAAA;AAAA,QACzB,EAAI,EAAA,GAAA;AAAA,QACJ,GAAK,EAAA,SAAA;AAAA,QACL,WAAW,IAAI,IAAA;AAAA,UACb,IAAK,CAAA,GAAA,EACH,GAAA,IAAA,CAAK,qBACH,aACA,GAAA,4BAAA;AAAA,SACN;AAAA,OACD,CAAA,CAAA;AAGD,MAAO,OAAA,UAAA,CAAA;AAAA,KACN,GAAA,CAAA;AAEH,IAAA,IAAA,CAAK,iBAAoB,GAAA,OAAA,CAAA;AAEzB,IAAI,IAAA;AAGF,MAAM,MAAA,OAAA,CAAA;AAAA,aACC,KAAO,EAAA;AACd,MAAA,IAAA,CAAK,MAAO,CAAA,KAAA,CAAM,CAAuC,oCAAA,EAAA,KAAK,CAAE,CAAA,CAAA,CAAA;AAChE,MAAA,OAAO,IAAK,CAAA,SAAA,CAAA;AACZ,MAAA,OAAO,IAAK,CAAA,iBAAA,CAAA;AAAA,KACd;AAEA,IAAO,OAAA,OAAA,CAAA;AAAA,GACT;AAAA,EAEA,QAA4C,GAAA;AAC1C,IAAO,OAAA,IAAA,CAAK,SAAS,QAAS,EAAA,CAAA;AAAA,GAChC;AACF;;;;"}

package/dist/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.cjs.js

@@ -0,0 +1,91 @@
+'use strict';
+
+var types = require('@backstage/types');
+var fs = require('fs');
+var jose = require('jose');
+
+const DEFAULT_ALGORITHM = "ES256";
+const SECONDS_IN_MS = 1e3;
+class StaticConfigPluginKeySource {
+  constructor(keyPairs, keyDurationSeconds) {
+    this.keyPairs = keyPairs;
+    this.keyDurationSeconds = keyDurationSeconds;
+  }
+  static async create(options) {
+    const keyConfigs = options.sourceConfig.getConfigArray("static.keys").map((c) => {
+      const staticKeyConfig = {
+        publicKeyFile: c.getString("publicKeyFile"),
+        privateKeyFile: c.getOptionalString("privateKeyFile"),
+        keyId: c.getString("keyId"),
+        algorithm: c.getOptionalString("algorithm") ?? DEFAULT_ALGORITHM
+      };
+      return staticKeyConfig;
+    });
+    const keyPairs = await Promise.all(
+      keyConfigs.map(async (k) => await this.loadKeyPair(k))
+    );
+    if (keyPairs.length < 1) {
+      throw new Error(
+        "At least one key pair must be provided in static.keys, when the static key store type is used"
+      );
+    } else if (!keyPairs[0].privateKey) {
+      throw new Error(
+        "Private key for signing must be provided in the first key pair in static.keys, when the static key store type is used"
+      );
+    }
+    return new StaticConfigPluginKeySource(
+      keyPairs,
+      types.durationToMilliseconds(options.keyDuration) / SECONDS_IN_MS
+    );
+  }
+  async getPrivateSigningKey() {
+    return this.keyPairs[0].privateKey;
+  }
+  async listKeys() {
+    const keys = this.keyPairs.map((k) => this.keyPairToStoredKey(k));
+    return { keys };
+  }
+  static async loadKeyPair(options) {
+    const algorithm = options.algorithm;
+    const keyId = options.keyId;
+    const publicKey = await this.loadPublicKeyFromFile(
+      options.publicKeyFile,
+      keyId,
+      algorithm
+    );
+    const privateKey = options.privateKeyFile ? await this.loadPrivateKeyFromFile(
+      options.privateKeyFile,
+      keyId,
+      algorithm
+    ) : void 0;
+    return { publicKey, privateKey, keyId };
+  }
+  static async loadPublicKeyFromFile(path, keyId, algorithm) {
+    return this.loadKeyFromFile(path, keyId, algorithm, jose.importSPKI);
+  }
+  static async loadPrivateKeyFromFile(path, keyId, algorithm) {
+    return this.loadKeyFromFile(path, keyId, algorithm, jose.importPKCS8);
+  }
+  static async loadKeyFromFile(path, keyId, algorithm, importer) {
+    const content = await fs.promises.readFile(path, { encoding: "utf8", flag: "r" });
+    const key = await importer(content, algorithm);
+    const jwk = await jose.exportJWK(key);
+    jwk.kid = keyId;
+    jwk.alg = algorithm;
+    return jwk;
+  }
+  keyPairToStoredKey(keyPair) {
+    const publicKey = {
+      ...keyPair.publicKey,
+      kid: keyPair.keyId
+    };
+    return {
+      key: publicKey,
+      id: keyPair.keyId,
+      expiresAt: new Date(Date.now() + this.keyDurationSeconds * SECONDS_IN_MS)
+    };
+  }
+}
+
+exports.StaticConfigPluginKeySource = StaticConfigPluginKeySource;
+//# sourceMappingURL=StaticConfigPluginKeySource.cjs.js.map

package/dist/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaticConfigPluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/StaticConfigPluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { promises as fs } from 'fs';\nimport { JWK, exportJWK, importPKCS8, importSPKI } from 'jose';\nimport { KeyLike } from 'jose/dist/types/types';\nimport { KeyPayload } from './types';\nimport { PluginKeySource } from './types';\n\nexport type KeyPair = {\n  publicKey: JWK;\n  privateKey?: JWK;\n  keyId: string;\n};\n\nexport type StaticKeyConfig = {\n  publicKeyFile: string;\n  privateKeyFile?: string;\n  keyId: string;\n  algorithm: string;\n};\n\nconst DEFAULT_ALGORITHM = 'ES256';\n\nconst SECONDS_IN_MS = 1000;\n\n/**\n * Key source that loads predefined public/private key pairs from disk.\n *\n * The private key should be represented using the PKCS#8 format,\n * while the public key should be in the SPKI format.\n *\n * @remarks\n *\n * You can generate a public and private key pair, using\n * openssl:\n *\n * Generate a private key using the ES256 algorithm\n * ```sh\n * openssl ecparam -name prime256v1 -genkey -out private.ec.key\n * ```\n * Convert it to PKCS#8 format\n * ```sh\n * openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private.ec.key -out private.key\n * ```\n * Extract the public key\n * ```sh\n * openssl ec -inform PEM -outform PEM -pubout -in private.key -out public.key\n * ```\n *\n * Provide the paths to private.key and public.key as the respective\n * private and public key paths in the `create` method.\n */\nexport class StaticConfigPluginKeySource implements PluginKeySource {\n  private constructor(\n    private readonly keyPairs: KeyPair[],\n    private readonly keyDurationSeconds: number,\n  ) {}\n\n  public static async create(options: {\n    sourceConfig: Config;\n    keyDuration: HumanDuration;\n  }): Promise<PluginKeySource> {\n    const keyConfigs = options.sourceConfig\n      .getConfigArray('static.keys')\n      .map(c => {\n        const staticKeyConfig: StaticKeyConfig = {\n          publicKeyFile: c.getString('publicKeyFile'),\n          privateKeyFile: c.getOptionalString('privateKeyFile'),\n          keyId: c.getString('keyId'),\n          algorithm: c.getOptionalString('algorithm') ?? DEFAULT_ALGORITHM,\n        };\n\n        return staticKeyConfig;\n      });\n\n    const keyPairs = await Promise.all(\n      keyConfigs.map(async k => await this.loadKeyPair(k)),\n    );\n\n    if (keyPairs.length < 1) {\n      throw new Error(\n        'At least one key pair must be provided in static.keys, when the static key store type is used',\n      );\n    } else if (!keyPairs[0].privateKey) {\n      throw new Error(\n        'Private key for signing must be provided in the first key pair in static.keys, when the static key store type is used',\n      );\n    }\n\n    return new StaticConfigPluginKeySource(\n      keyPairs,\n      durationToMilliseconds(options.keyDuration) / SECONDS_IN_MS,\n    );\n  }\n\n  async getPrivateSigningKey(): Promise<JWK> {\n    return this.keyPairs[0].privateKey!;\n  }\n\n  async listKeys(): Promise<{ keys: KeyPayload[] }> {\n    const keys = this.keyPairs.map(k => this.keyPairToStoredKey(k));\n    return { keys };\n  }\n\n  private static async loadKeyPair(options: StaticKeyConfig): Promise<KeyPair> {\n    const algorithm = options.algorithm;\n    const keyId = options.keyId;\n    const publicKey = await this.loadPublicKeyFromFile(\n      options.publicKeyFile,\n      keyId,\n      algorithm,\n    );\n    const privateKey = options.privateKeyFile\n      ? await this.loadPrivateKeyFromFile(\n          options.privateKeyFile,\n          keyId,\n          algorithm,\n        )\n      : undefined;\n\n    return { publicKey, privateKey, keyId };\n  }\n\n  private static async loadPublicKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n  ): Promise<JWK> {\n    return this.loadKeyFromFile(path, keyId, algorithm, importSPKI);\n  }\n\n  private static async loadPrivateKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n  ): Promise<JWK> {\n    return this.loadKeyFromFile(path, keyId, algorithm, importPKCS8);\n  }\n\n  private static async loadKeyFromFile(\n    path: string,\n    keyId: string,\n    algorithm: string,\n    importer: (content: string, algorithm: string) => Promise<KeyLike>,\n  ): Promise<JWK> {\n    const content = await fs.readFile(path, { encoding: 'utf8', flag: 'r' });\n    const key = await importer(content, algorithm);\n    const jwk = await exportJWK(key);\n    jwk.kid = keyId;\n    jwk.alg = algorithm;\n\n    return jwk;\n  }\n\n  private keyPairToStoredKey(keyPair: KeyPair): KeyPayload {\n    const publicKey = {\n      ...keyPair.publicKey,\n      kid: keyPair.keyId,\n    };\n\n    return {\n      key: publicKey,\n      id: keyPair.keyId,\n      expiresAt: new Date(Date.now() + this.keyDurationSeconds * SECONDS_IN_MS),\n    };\n  }\n}\n"],"names":["durationToMilliseconds","importSPKI","importPKCS8","fs","exportJWK"],"mappings":";;;;;;AAqCA,MAAM,iBAAoB,GAAA,OAAA,CAAA;AAE1B,MAAM,aAAgB,GAAA,GAAA,CAAA;AA6Bf,MAAM,2BAAuD,CAAA;AAAA,EAC1D,WAAA,CACW,UACA,kBACjB,EAAA;AAFiB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA,CAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA,CAAA;AAAA,GAChB;AAAA,EAEH,aAAoB,OAAO,OAGE,EAAA;AAC3B,IAAA,MAAM,aAAa,OAAQ,CAAA,YAAA,CACxB,eAAe,aAAa,CAAA,CAC5B,IAAI,CAAK,CAAA,KAAA;AACR,MAAA,MAAM,eAAmC,GAAA;AAAA,QACvC,aAAA,EAAe,CAAE,CAAA,SAAA,CAAU,eAAe,CAAA;AAAA,QAC1C,cAAA,EAAgB,CAAE,CAAA,iBAAA,CAAkB,gBAAgB,CAAA;AAAA,QACpD,KAAA,EAAO,CAAE,CAAA,SAAA,CAAU,OAAO,CAAA;AAAA,QAC1B,SAAW,EAAA,CAAA,CAAE,iBAAkB,CAAA,WAAW,CAAK,IAAA,iBAAA;AAAA,OACjD,CAAA;AAEA,MAAO,OAAA,eAAA,CAAA;AAAA,KACR,CAAA,CAAA;AAEH,IAAM,MAAA,QAAA,GAAW,MAAM,OAAQ,CAAA,GAAA;AAAA,MAC7B,UAAA,CAAW,IAAI,OAAM,CAAA,KAAK,MAAM,IAAK,CAAA,WAAA,CAAY,CAAC,CAAC,CAAA;AAAA,KACrD,CAAA;AAEA,IAAI,IAAA,QAAA,CAAS,SAAS,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,+FAAA;AAAA,OACF,CAAA;AAAA,KACS,MAAA,IAAA,CAAC,QAAS,CAAA,CAAC,EAAE,UAAY,EAAA;AAClC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,uHAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,OAAO,IAAI,2BAAA;AAAA,MACT,QAAA;AAAA,MACAA,4BAAA,CAAuB,OAAQ,CAAA,WAAW,CAAI,GAAA,aAAA;AAAA,KAChD,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,oBAAqC,GAAA;AACzC,IAAO,OAAA,IAAA,CAAK,QAAS,CAAA,CAAC,CAAE,CAAA,UAAA,CAAA;AAAA,GAC1B;AAAA,EAEA,MAAM,QAA4C,GAAA;AAChD,IAAM,MAAA,IAAA,GAAO,KAAK,QAAS,CAAA,GAAA,CAAI,OAAK,IAAK,CAAA,kBAAA,CAAmB,CAAC,CAAC,CAAA,CAAA;AAC9D,IAAA,OAAO,EAAE,IAAK,EAAA,CAAA;AAAA,GAChB;AAAA,EAEA,aAAqB,YAAY,OAA4C,EAAA;AAC3E,IAAA,MAAM,YAAY,OAAQ,CAAA,SAAA,CAAA;AAC1B,IAAA,MAAM,QAAQ,OAAQ,CAAA,KAAA,CAAA;AACtB,IAAM,MAAA,SAAA,GAAY,MAAM,IAAK,CAAA,qBAAA;AAAA,MAC3B,OAAQ,CAAA,aAAA;AAAA,MACR,KAAA;AAAA,MACA,SAAA;AAAA,KACF,CAAA;AACA,IAAA,MAAM,UAAa,GAAA,OAAA,CAAQ,cACvB,GAAA,MAAM,IAAK,CAAA,sBAAA;AAAA,MACT,OAAQ,CAAA,cAAA;AAAA,MACR,KAAA;AAAA,MACA,SAAA;AAAA,KAEF,GAAA,KAAA,CAAA,CAAA;AAEJ,IAAO,OAAA,EAAE,SAAW,EAAA,UAAA,EAAY,KAAM,EAAA,CAAA;AAAA,GACxC;AAAA,EAEA,aAAqB,qBAAA,CACnB,IACA,EAAA,KAAA,EACA,SACc,EAAA;AACd,IAAA,OAAO,IAAK,CAAA,eAAA,CAAgB,IAAM,EAAA,KAAA,EAAO,WAAWC,eAAU,CAAA,CAAA;AAAA,GAChE;AAAA,EAEA,aAAqB,sBAAA,CACnB,IACA,EAAA,KAAA,EACA,SACc,EAAA;AACd,IAAA,OAAO,IAAK,CAAA,eAAA,CAAgB,IAAM,EAAA,KAAA,EAAO,WAAWC,gBAAW,CAAA,CAAA;AAAA,GACjE;AAAA,EAEA,aAAqB,eAAA,CACnB,IACA,EAAA,KAAA,EACA,WACA,QACc,EAAA;AACd,IAAM,MAAA,OAAA,GAAU,MAAMC,WAAA,CAAG,QAAS,CAAA,IAAA,EAAM,EAAE,QAAU,EAAA,MAAA,EAAQ,IAAM,EAAA,GAAA,EAAK,CAAA,CAAA;AACvE,IAAA,MAAM,GAAM,GAAA,MAAM,QAAS,CAAA,OAAA,EAAS,SAAS,CAAA,CAAA;AAC7C,IAAM,MAAA,GAAA,GAAM,MAAMC,cAAA,CAAU,GAAG,CAAA,CAAA;AAC/B,IAAA,GAAA,CAAI,GAAM,GAAA,KAAA,CAAA;AACV,IAAA,GAAA,CAAI,GAAM,GAAA,SAAA,CAAA;AAEV,IAAO,OAAA,GAAA,CAAA;AAAA,GACT;AAAA,EAEQ,mBAAmB,OAA8B,EAAA;AACvD,IAAA,MAAM,SAAY,GAAA;AAAA,MAChB,GAAG,OAAQ,CAAA,SAAA;AAAA,MACX,KAAK,OAAQ,CAAA,KAAA;AAAA,KACf,CAAA;AAEA,IAAO,OAAA;AAAA,MACL,GAAK,EAAA,SAAA;AAAA,MACL,IAAI,OAAQ,CAAA,KAAA;AAAA,MACZ,SAAA,EAAW,IAAI,IAAK,CAAA,IAAA,CAAK,KAAQ,GAAA,IAAA,CAAK,qBAAqB,aAAa,CAAA;AAAA,KAC1E,CAAA;AAAA,GACF;AACF;;;;"}

package/dist/entrypoints/auth/plugin/keys/createPluginKeySource.cjs.js

@@ -0,0 +1,29 @@
+'use strict';
+
+var DatabasePluginKeySource = require('./DatabasePluginKeySource.cjs.js');
+var StaticConfigPluginKeySource = require('./StaticConfigPluginKeySource.cjs.js');
+
+const CONFIG_ROOT_KEY = "backend.auth.pluginKeyStore";
+async function createPluginKeySource(options) {
+  const keyStoreConfig = options.config.getOptionalConfig(CONFIG_ROOT_KEY);
+  const type = keyStoreConfig?.getOptionalString("type") ?? "database";
+  if (!keyStoreConfig || type === "database") {
+    return DatabasePluginKeySource.DatabasePluginKeySource.create({
+      database: options.database,
+      logger: options.logger,
+      keyDuration: options.keyDuration,
+      algorithm: options.algorithm
+    });
+  } else if (type === "static") {
+    return StaticConfigPluginKeySource.StaticConfigPluginKeySource.create({
+      sourceConfig: keyStoreConfig,
+      keyDuration: options.keyDuration
+    });
+  }
+  throw new Error(
+    `Unsupported config value ${CONFIG_ROOT_KEY}.type '${type}'; expected one of 'database', 'static'`
+  );
+}
+
+exports.createPluginKeySource = createPluginKeySource;
+//# sourceMappingURL=createPluginKeySource.cjs.js.map

package/dist/entrypoints/auth/plugin/keys/createPluginKeySource.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createPluginKeySource.cjs.js","sources":["../../../../../src/entrypoints/auth/plugin/keys/createPluginKeySource.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { HumanDuration } from '@backstage/types';\nimport { DatabasePluginKeySource } from './DatabasePluginKeySource';\nimport { StaticConfigPluginKeySource } from './StaticConfigPluginKeySource';\nimport { PluginKeySource } from './types';\n\nconst CONFIG_ROOT_KEY = 'backend.auth.pluginKeyStore';\n\nexport async function createPluginKeySource(options: {\n  config: RootConfigService;\n  database: DatabaseService;\n  logger: LoggerService;\n  keyDuration: HumanDuration;\n  algorithm?: string;\n}): Promise<PluginKeySource> {\n  const keyStoreConfig = options.config.getOptionalConfig(CONFIG_ROOT_KEY);\n  const type = keyStoreConfig?.getOptionalString('type') ?? 'database';\n\n  if (!keyStoreConfig || type === 'database') {\n    return DatabasePluginKeySource.create({\n      database: options.database,\n      logger: options.logger,\n      keyDuration: options.keyDuration,\n      algorithm: options.algorithm,\n    });\n  } else if (type === 'static') {\n    return StaticConfigPluginKeySource.create({\n      sourceConfig: keyStoreConfig,\n      keyDuration: options.keyDuration,\n    });\n  }\n\n  throw new Error(\n    `Unsupported config value ${CONFIG_ROOT_KEY}.type '${type}'; expected one of 'database', 'static'`,\n  );\n}\n"],"names":["DatabasePluginKeySource","StaticConfigPluginKeySource"],"mappings":";;;;;AA0BA,MAAM,eAAkB,GAAA,6BAAA,CAAA;AAExB,eAAsB,sBAAsB,OAMf,EAAA;AAC3B,EAAA,MAAM,cAAiB,GAAA,OAAA,CAAQ,MAAO,CAAA,iBAAA,CAAkB,eAAe,CAAA,CAAA;AACvE,EAAA,MAAM,IAAO,GAAA,cAAA,EAAgB,iBAAkB,CAAA,MAAM,CAAK,IAAA,UAAA,CAAA;AAE1D,EAAI,IAAA,CAAC,cAAkB,IAAA,IAAA,KAAS,UAAY,EAAA;AAC1C,IAAA,OAAOA,gDAAwB,MAAO,CAAA;AAAA,MACpC,UAAU,OAAQ,CAAA,QAAA;AAAA,MAClB,QAAQ,OAAQ,CAAA,MAAA;AAAA,MAChB,aAAa,OAAQ,CAAA,WAAA;AAAA,MACrB,WAAW,OAAQ,CAAA,SAAA;AAAA,KACpB,CAAA,CAAA;AAAA,GACH,MAAA,IAAW,SAAS,QAAU,EAAA;AAC5B,IAAA,OAAOC,wDAA4B,MAAO,CAAA;AAAA,MACxC,YAAc,EAAA,cAAA;AAAA,MACd,aAAa,OAAQ,CAAA,WAAA;AAAA,KACtB,CAAA,CAAA;AAAA,GACH;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA,yBAAA,EAA4B,eAAe,CAAA,OAAA,EAAU,IAAI,CAAA,uCAAA,CAAA;AAAA,GAC3D,CAAA;AACF;;;;"}

package/dist/entrypoints/auth/user/UserTokenHandler.cjs.js

@@ -0,0 +1,110 @@
+'use strict';
+
+var errors = require('@backstage/errors');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var jose = require('jose');
+var JwksClient = require('../JwksClient.cjs.js');
+
+class UserTokenHandler {
+  constructor(jwksClient) {
+    this.jwksClient = jwksClient;
+  }
+  static create(options) {
+    const jwksClient = new JwksClient.JwksClient(async () => {
+      const url = await options.discovery.getBaseUrl("auth");
+      return new URL(`${url}/.well-known/jwks.json`);
+    });
+    return new UserTokenHandler(jwksClient);
+  }
+  async verifyToken(token) {
+    const verifyOpts = this.#getTokenVerificationOptions(token);
+    if (!verifyOpts) {
+      return void 0;
+    }
+    await this.jwksClient.refreshKeyStore(token);
+    const { payload } = await jose.jwtVerify(
+      token,
+      this.jwksClient.getKey,
+      verifyOpts
+    ).catch((e) => {
+      throw new errors.AuthenticationError("Invalid token", e);
+    });
+    const userEntityRef = payload.sub;
+    if (!userEntityRef) {
+      throw new errors.AuthenticationError("No user sub found in token");
+    }
+    return { userEntityRef };
+  }
+  #getTokenVerificationOptions(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      if (typ === pluginAuthNode.tokenTypes.user.typParam) {
+        return {
+          requiredClaims: ["iat", "exp", "sub"],
+          typ: pluginAuthNode.tokenTypes.user.typParam
+        };
+      }
+      if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+        return {
+          requiredClaims: ["iat", "exp", "sub"],
+          typ: pluginAuthNode.tokenTypes.limitedUser.typParam
+        };
+      }
+      const { aud } = jose.decodeJwt(token);
+      if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
+        return {
+          audience: pluginAuthNode.tokenTypes.user.audClaim
+        };
+      }
+    } catch {
+    }
+    return void 0;
+  }
+  createLimitedUserToken(backstageToken) {
+    const [headerRaw, payloadRaw] = backstageToken.split(".");
+    const header = JSON.parse(
+      new TextDecoder().decode(jose.base64url.decode(headerRaw))
+    );
+    const payload = JSON.parse(
+      new TextDecoder().decode(jose.base64url.decode(payloadRaw))
+    );
+    const tokenType = header.typ;
+    if (!tokenType || tokenType === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+      return { token: backstageToken, expiresAt: new Date(payload.exp * 1e3) };
+    }
+    if (tokenType !== pluginAuthNode.tokenTypes.user.typParam) {
+      throw new errors.AuthenticationError(
+        "Failed to create limited user token, invalid token type"
+      );
+    }
+    const limitedUserToken = [
+      jose.base64url.encode(
+        JSON.stringify({
+          typ: pluginAuthNode.tokenTypes.limitedUser.typParam,
+          alg: header.alg,
+          kid: header.kid
+        })
+      ),
+      jose.base64url.encode(
+        JSON.stringify({
+          sub: payload.sub,
+          iat: payload.iat,
+          exp: payload.exp
+        })
+      ),
+      payload.uip
+    ].join(".");
+    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1e3) };
+  }
+  isLimitedUserToken(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      return typ === pluginAuthNode.tokenTypes.limitedUser.typParam;
+    } catch {
+      return false;
+    }
+  }
+}
+
+exports.UserTokenHandler = UserTokenHandler;
+//# sourceMappingURL=UserTokenHandler.cjs.js.map

package/dist/entrypoints/auth/user/UserTokenHandler.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/user/UserTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService } from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport {\n  base64url,\n  decodeJwt,\n  decodeProtectedHeader,\n  jwtVerify,\n  JWTVerifyOptions,\n} from 'jose';\nimport { JwksClient } from '../JwksClient';\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @internal\n */\nexport class UserTokenHandler {\n  static create(options: { discovery: DiscoveryService }): UserTokenHandler {\n    const jwksClient = new JwksClient(async () => {\n      const url = await options.discovery.getBaseUrl('auth');\n      return new URL(`${url}/.well-known/jwks.json`);\n    });\n    return new UserTokenHandler(jwksClient);\n  }\n\n  constructor(private readonly jwksClient: JwksClient) {}\n\n  async verifyToken(token: string) {\n    const verifyOpts = this.#getTokenVerificationOptions(token);\n    if (!verifyOpts) {\n      return undefined;\n    }\n\n    await this.jwksClient.refreshKeyStore(token);\n\n    // Verify a limited token, ensuring the necessarily claims are present and token type is correct\n    const { payload } = await jwtVerify(\n      token,\n      this.jwksClient.getKey,\n      verifyOpts,\n    ).catch(e => {\n      throw new AuthenticationError('Invalid token', e);\n    });\n\n    const userEntityRef = payload.sub;\n\n    if (!userEntityRef) {\n      throw new AuthenticationError('No user sub found in token');\n    }\n\n    return { userEntityRef };\n  }\n\n  #getTokenVerificationOptions(token: string): JWTVerifyOptions | undefined {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n\n      if (typ === tokenTypes.user.typParam) {\n        return {\n          requiredClaims: ['iat', 'exp', 'sub'],\n          typ: tokenTypes.user.typParam,\n        };\n      }\n\n      if (typ === tokenTypes.limitedUser.typParam) {\n        return {\n          requiredClaims: ['iat', 'exp', 'sub'],\n          typ: tokenTypes.limitedUser.typParam,\n        };\n      }\n\n      const { aud } = decodeJwt(token);\n      if (aud === tokenTypes.user.audClaim) {\n        return {\n          audience: tokenTypes.user.audClaim,\n        };\n      }\n    } catch {\n      /* ignore */\n    }\n\n    return undefined;\n  }\n\n  createLimitedUserToken(backstageToken: string) {\n    const [headerRaw, payloadRaw] = backstageToken.split('.');\n    const header = JSON.parse(\n      new TextDecoder().decode(base64url.decode(headerRaw)),\n    );\n    const payload = JSON.parse(\n      new TextDecoder().decode(base64url.decode(payloadRaw)),\n    );\n\n    const tokenType = header.typ;\n\n    // Only new user tokens can be used to create a limited user token. If we\n    // can't create a limited token, or the token is already a limited one, we\n    // return the original token\n    if (!tokenType || tokenType === tokenTypes.limitedUser.typParam) {\n      return { token: backstageToken, expiresAt: new Date(payload.exp * 1000) };\n    }\n\n    if (tokenType !== tokenTypes.user.typParam) {\n      throw new AuthenticationError(\n        'Failed to create limited user token, invalid token type',\n      );\n    }\n\n    // NOTE: The order and properties in both the header and payload must match\n    //       the usage in plugins/auth-backend/src/identity/TokenFactory.ts\n    const limitedUserToken = [\n      base64url.encode(\n        JSON.stringify({\n          typ: tokenTypes.limitedUser.typParam,\n          alg: header.alg,\n          kid: header.kid,\n        }),\n      ),\n      base64url.encode(\n        JSON.stringify({\n          sub: payload.sub,\n          iat: payload.iat,\n          exp: payload.exp,\n        }),\n      ),\n      payload.uip,\n    ].join('.');\n\n    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1000) };\n  }\n\n  isLimitedUserToken(token: string): boolean {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      return typ === tokenTypes.limitedUser.typParam;\n    } catch {\n      return false;\n    }\n  }\n}\n"],"names":["JwksClient","jwtVerify","AuthenticationError","decodeProtectedHeader","tokenTypes","decodeJwt","base64url"],"mappings":";;;;;;;AAkCO,MAAM,gBAAiB,CAAA;AAAA,EAS5B,YAA6B,UAAwB,EAAA;AAAxB,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA,CAAA;AAAA,GAAyB;AAAA,EARtD,OAAO,OAAO,OAA4D,EAAA;AACxE,IAAM,MAAA,UAAA,GAAa,IAAIA,qBAAA,CAAW,YAAY;AAC5C,MAAA,MAAM,GAAM,GAAA,MAAM,OAAQ,CAAA,SAAA,CAAU,WAAW,MAAM,CAAA,CAAA;AACrD,MAAA,OAAO,IAAI,GAAA,CAAI,CAAG,EAAA,GAAG,CAAwB,sBAAA,CAAA,CAAA,CAAA;AAAA,KAC9C,CAAA,CAAA;AACD,IAAO,OAAA,IAAI,iBAAiB,UAAU,CAAA,CAAA;AAAA,GACxC;AAAA,EAIA,MAAM,YAAY,KAAe,EAAA;AAC/B,IAAM,MAAA,UAAA,GAAa,IAAK,CAAA,4BAAA,CAA6B,KAAK,CAAA,CAAA;AAC1D,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAO,OAAA,KAAA,CAAA,CAAA;AAAA,KACT;AAEA,IAAM,MAAA,IAAA,CAAK,UAAW,CAAA,eAAA,CAAgB,KAAK,CAAA,CAAA;AAG3C,IAAM,MAAA,EAAE,OAAQ,EAAA,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,KAAK,UAAW,CAAA,MAAA;AAAA,MAChB,UAAA;AAAA,KACF,CAAE,MAAM,CAAK,CAAA,KAAA;AACX,MAAM,MAAA,IAAIC,0BAAoB,CAAA,eAAA,EAAiB,CAAC,CAAA,CAAA;AAAA,KACjD,CAAA,CAAA;AAED,IAAA,MAAM,gBAAgB,OAAQ,CAAA,GAAA,CAAA;AAE9B,IAAA,IAAI,CAAC,aAAe,EAAA;AAClB,MAAM,MAAA,IAAIA,2BAAoB,4BAA4B,CAAA,CAAA;AAAA,KAC5D;AAEA,IAAA,OAAO,EAAE,aAAc,EAAA,CAAA;AAAA,GACzB;AAAA,EAEA,6BAA6B,KAA6C,EAAA;AACxE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA,CAAA;AAE3C,MAAI,IAAA,GAAA,KAAQC,yBAAW,CAAA,IAAA,CAAK,QAAU,EAAA;AACpC,QAAO,OAAA;AAAA,UACL,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,KAAK,CAAA;AAAA,UACpC,GAAA,EAAKA,0BAAW,IAAK,CAAA,QAAA;AAAA,SACvB,CAAA;AAAA,OACF;AAEA,MAAI,IAAA,GAAA,KAAQA,yBAAW,CAAA,WAAA,CAAY,QAAU,EAAA;AAC3C,QAAO,OAAA;AAAA,UACL,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,KAAK,CAAA;AAAA,UACpC,GAAA,EAAKA,0BAAW,WAAY,CAAA,QAAA;AAAA,SAC9B,CAAA;AAAA,OACF;AAEA,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,cAAA,CAAU,KAAK,CAAA,CAAA;AAC/B,MAAI,IAAA,GAAA,KAAQD,yBAAW,CAAA,IAAA,CAAK,QAAU,EAAA;AACpC,QAAO,OAAA;AAAA,UACL,QAAA,EAAUA,0BAAW,IAAK,CAAA,QAAA;AAAA,SAC5B,CAAA;AAAA,OACF;AAAA,KACM,CAAA,MAAA;AAAA,KAER;AAEA,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AAAA,EAEA,uBAAuB,cAAwB,EAAA;AAC7C,IAAA,MAAM,CAAC,SAAW,EAAA,UAAU,CAAI,GAAA,cAAA,CAAe,MAAM,GAAG,CAAA,CAAA;AACxD,IAAA,MAAM,SAAS,IAAK,CAAA,KAAA;AAAA,MAClB,IAAI,WAAY,EAAA,CAAE,OAAOE,cAAU,CAAA,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,KACtD,CAAA;AACA,IAAA,MAAM,UAAU,IAAK,CAAA,KAAA;AAAA,MACnB,IAAI,WAAY,EAAA,CAAE,OAAOA,cAAU,CAAA,MAAA,CAAO,UAAU,CAAC,CAAA;AAAA,KACvD,CAAA;AAEA,IAAA,MAAM,YAAY,MAAO,CAAA,GAAA,CAAA;AAKzB,IAAA,IAAI,CAAC,SAAA,IAAa,SAAc,KAAAF,yBAAA,CAAW,YAAY,QAAU,EAAA;AAC/D,MAAO,OAAA,EAAE,OAAO,cAAgB,EAAA,SAAA,EAAW,IAAI,IAAK,CAAA,OAAA,CAAQ,GAAM,GAAA,GAAI,CAAE,EAAA,CAAA;AAAA,KAC1E;AAEA,IAAI,IAAA,SAAA,KAAcA,yBAAW,CAAA,IAAA,CAAK,QAAU,EAAA;AAC1C,MAAA,MAAM,IAAIF,0BAAA;AAAA,QACR,yDAAA;AAAA,OACF,CAAA;AAAA,KACF;AAIA,IAAA,MAAM,gBAAmB,GAAA;AAAA,MACvBI,cAAU,CAAA,MAAA;AAAA,QACR,KAAK,SAAU,CAAA;AAAA,UACb,GAAA,EAAKF,0BAAW,WAAY,CAAA,QAAA;AAAA,UAC5B,KAAK,MAAO,CAAA,GAAA;AAAA,UACZ,KAAK,MAAO,CAAA,GAAA;AAAA,SACb,CAAA;AAAA,OACH;AAAA,MACAE,cAAU,CAAA,MAAA;AAAA,QACR,KAAK,SAAU,CAAA;AAAA,UACb,KAAK,OAAQ,CAAA,GAAA;AAAA,UACb,KAAK,OAAQ,CAAA,GAAA;AAAA,UACb,KAAK,OAAQ,CAAA,GAAA;AAAA,SACd,CAAA;AAAA,OACH;AAAA,MACA,OAAQ,CAAA,GAAA;AAAA,KACV,CAAE,KAAK,GAAG,CAAA,CAAA;AAEV,IAAO,OAAA,EAAE,OAAO,gBAAkB,EAAA,SAAA,EAAW,IAAI,IAAK,CAAA,OAAA,CAAQ,GAAM,GAAA,GAAI,CAAE,EAAA,CAAA;AAAA,GAC5E;AAAA,EAEA,mBAAmB,KAAwB,EAAA;AACzC,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAH,0BAAA,CAAsB,KAAK,CAAA,CAAA;AAC3C,MAAO,OAAA,GAAA,KAAQC,0BAAW,WAAY,CAAA,QAAA,CAAA;AAAA,KAChC,CAAA,MAAA;AACN,MAAO,OAAA,KAAA,CAAA;AAAA,KACT;AAAA,GACF;AACF;;;;"}

package/dist/entrypoints/cache/CacheClient.cjs.js

@@ -0,0 +1,50 @@
+'use strict';
+
+var crypto = require('crypto');
+var types = require('./types.cjs.js');
+
+class DefaultCacheClient {
+  #client;
+  #clientFactory;
+  #options;
+  constructor(client, clientFactory, options) {
+    this.#client = client;
+    this.#clientFactory = clientFactory;
+    this.#options = options;
+  }
+  async get(key) {
+    const k = this.getNormalizedKey(key);
+    const value = await this.#client.get(k);
+    return value;
+  }
+  async set(key, value, opts = {}) {
+    const k = this.getNormalizedKey(key);
+    const ttl = opts.ttl !== void 0 ? types.ttlToMilliseconds(opts.ttl) : void 0;
+    await this.#client.set(k, value, ttl);
+  }
+  async delete(key) {
+    const k = this.getNormalizedKey(key);
+    await this.#client.delete(k);
+  }
+  withOptions(options) {
+    const newOptions = { ...this.#options, ...options };
+    return new DefaultCacheClient(
+      this.#clientFactory(newOptions),
+      this.#clientFactory,
+      newOptions
+    );
+  }
+  /**
+   * Ensures keys are well-formed for any/all cache stores.
+   */
+  getNormalizedKey(candidateKey) {
+    const wellFormedKey = Buffer.from(candidateKey).toString("base64");
+    if (wellFormedKey.length < 200) {
+      return wellFormedKey;
+    }
+    return crypto.createHash("sha256").update(candidateKey).digest("base64");
+  }
+}
+
+exports.DefaultCacheClient = DefaultCacheClient;
+//# sourceMappingURL=CacheClient.cjs.js.map

package/dist/entrypoints/cache/CacheClient.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CacheClient.cjs.js","sources":["../../../src/entrypoints/cache/CacheClient.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  CacheService,\n  CacheServiceOptions,\n  CacheServiceSetOptions,\n} from '@backstage/backend-plugin-api';\nimport { JsonValue } from '@backstage/types';\nimport { createHash } from 'crypto';\nimport Keyv from 'keyv';\nimport { ttlToMilliseconds } from './types';\n\nexport type CacheClientFactory = (options: CacheServiceOptions) => Keyv;\n\n/**\n * A basic, concrete implementation of the CacheService, suitable for almost\n * all uses in Backstage.\n */\nexport class DefaultCacheClient implements CacheService {\n  #client: Keyv;\n  #clientFactory: CacheClientFactory;\n  #options: CacheServiceOptions;\n\n  constructor(\n    client: Keyv,\n    clientFactory: CacheClientFactory,\n    options: CacheServiceOptions,\n  ) {\n    this.#client = client;\n    this.#clientFactory = clientFactory;\n    this.#options = options;\n  }\n\n  async get<TValue extends JsonValue>(\n    key: string,\n  ): Promise<TValue | undefined> {\n    const k = this.getNormalizedKey(key);\n    const value = await this.#client.get(k);\n    return value as TValue | undefined;\n  }\n\n  async set(\n    key: string,\n    value: JsonValue,\n    opts: CacheServiceSetOptions = {},\n  ): Promise<void> {\n    const k = this.getNormalizedKey(key);\n    const ttl =\n      opts.ttl !== undefined ? ttlToMilliseconds(opts.ttl) : undefined;\n    await this.#client.set(k, value, ttl);\n  }\n\n  async delete(key: string): Promise<void> {\n    const k = this.getNormalizedKey(key);\n    await this.#client.delete(k);\n  }\n\n  withOptions(options: CacheServiceOptions): CacheService {\n    const newOptions = { ...this.#options, ...options };\n    return new DefaultCacheClient(\n      this.#clientFactory(newOptions),\n      this.#clientFactory,\n      newOptions,\n    );\n  }\n\n  /**\n   * Ensures keys are well-formed for any/all cache stores.\n   */\n  private getNormalizedKey(candidateKey: string): string {\n    // Remove potentially invalid characters.\n    const wellFormedKey = Buffer.from(candidateKey).toString('base64');\n\n    // Memcache in particular doesn't do well with keys > 250 bytes.\n    // Padded because a plugin ID is also prepended to the key.\n    if (wellFormedKey.length < 200) {\n      return wellFormedKey;\n    }\n\n    return createHash('sha256').update(candidateKey).digest('base64');\n  }\n}\n"],"names":["ttlToMilliseconds","createHash"],"mappings":";;;;;AAgCO,MAAM,kBAA2C,CAAA;AAAA,EACtD,OAAA,CAAA;AAAA,EACA,cAAA,CAAA;AAAA,EACA,QAAA,CAAA;AAAA,EAEA,WAAA,CACE,MACA,EAAA,aAAA,EACA,OACA,EAAA;AACA,IAAA,IAAA,CAAK,OAAU,GAAA,MAAA,CAAA;AACf,IAAA,IAAA,CAAK,cAAiB,GAAA,aAAA,CAAA;AACtB,IAAA,IAAA,CAAK,QAAW,GAAA,OAAA,CAAA;AAAA,GAClB;AAAA,EAEA,MAAM,IACJ,GAC6B,EAAA;AAC7B,IAAM,MAAA,CAAA,GAAI,IAAK,CAAA,gBAAA,CAAiB,GAAG,CAAA,CAAA;AACnC,IAAA,MAAM,KAAQ,GAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,IAAI,CAAC,CAAA,CAAA;AACtC,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AAAA,EAEA,MAAM,GACJ,CAAA,GAAA,EACA,KACA,EAAA,IAAA,GAA+B,EAChB,EAAA;AACf,IAAM,MAAA,CAAA,GAAI,IAAK,CAAA,gBAAA,CAAiB,GAAG,CAAA,CAAA;AACnC,IAAA,MAAM,MACJ,IAAK,CAAA,GAAA,KAAQ,SAAYA,uBAAkB,CAAA,IAAA,CAAK,GAAG,CAAI,GAAA,KAAA,CAAA,CAAA;AACzD,IAAA,MAAM,IAAK,CAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,EAAG,OAAO,GAAG,CAAA,CAAA;AAAA,GACtC;AAAA,EAEA,MAAM,OAAO,GAA4B,EAAA;AACvC,IAAM,MAAA,CAAA,GAAI,IAAK,CAAA,gBAAA,CAAiB,GAAG,CAAA,CAAA;AACnC,IAAM,MAAA,IAAA,CAAK,OAAQ,CAAA,MAAA,CAAO,CAAC,CAAA,CAAA;AAAA,GAC7B;AAAA,EAEA,YAAY,OAA4C,EAAA;AACtD,IAAA,MAAM,aAAa,EAAE,GAAG,IAAK,CAAA,QAAA,EAAU,GAAG,OAAQ,EAAA,CAAA;AAClD,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,IAAA,CAAK,eAAe,UAAU,CAAA;AAAA,MAC9B,IAAK,CAAA,cAAA;AAAA,MACL,UAAA;AAAA,KACF,CAAA;AAAA,GACF;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAiB,YAA8B,EAAA;AAErD,IAAA,MAAM,gBAAgB,MAAO,CAAA,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,QAAQ,CAAA,CAAA;AAIjE,IAAI,IAAA,aAAA,CAAc,SAAS,GAAK,EAAA;AAC9B,MAAO,OAAA,aAAA,CAAA;AAAA,KACT;AAEA,IAAA,OAAOC,kBAAW,QAAQ,CAAA,CAAE,OAAO,YAAY,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAA;AAAA,GAClE;AACF;;;;"}