@backstage/backend-defaults 0.5.3-next.2 → 0.5.3-next.3

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @backstage/backend-defaults
 
+## 0.5.3-next.3
+
+### Patch Changes
+
+- ecf6b39: Use `node-fetch` instead of native fetch, as per https://backstage.io/docs/architecture-decisions/adrs-adr013
+- Updated dependencies
+  - @backstage/integration-aws-node@0.1.13-next.0
+  - @backstage/plugin-events-node@0.4.5-next.3
+  - @backstage/backend-app-api@1.0.2-next.2
+  - @backstage/backend-dev-utils@0.1.5
+  - @backstage/backend-plugin-api@1.0.2-next.2
+  - @backstage/cli-common@0.1.15-next.0
+  - @backstage/cli-node@0.2.10-next.0
+  - @backstage/config@1.2.0
+  - @backstage/config-loader@1.9.2-next.0
+  - @backstage/errors@1.2.4
+  - @backstage/integration@1.15.1
+  - @backstage/types@1.1.1
+  - @backstage/plugin-auth-node@0.5.4-next.2
+  - @backstage/plugin-permission-node@0.8.5-next.2
+
 ## 0.5.3-next.2
 
 ### Patch Changes

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js

@@ -5,6 +5,11 @@ var errors = require('@backstage/errors');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var JwksClient = require('../JwksClient.cjs.js');
 var types = require('@backstage/types');
+var fetch = require('node-fetch');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var fetch__default = /*#__PURE__*/_interopDefaultCompat(fetch);
 
 const SECONDS_IN_MS = 1e3;
 const ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;
@@ -93,7 +98,7 @@ class PluginTokenHandler {
     }
     const doCheck = async () => {
       try {
-        const res = await fetch(
+        const res = await fetch__default.default(
           `${await this.discovery.getBaseUrl(
             targetPluginId
           )}/.backstage/auth/v1/jwks.json`

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\nexport class PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new PluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private constructor(\n    private readonly logger: LoggerService,\n    private readonly ownPluginId: string,\n    private readonly keySource: PluginKeySource,\n    private readonly algorithm: string,\n    private readonly keyDurationSeconds: number,\n    private readonly discovery: DiscoveryService,\n  ) {}\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      throw new AuthenticationError('Invalid plugin token', e);\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { token: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAgB,GAAA,GAAA;AAEtB,MAAM,yBAA4B,GAAA,gBAAA;AAmB3B,MAAM,kBAAmB,CAAA;AAAA,EAkBtB,YACW,MACA,EAAA,WAAA,EACA,SACA,EAAA,SAAA,EACA,oBACA,SACjB,EAAA;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA;AAChB,EAxBK,OAAA,uBAAc,GAAwB,EAAA;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAY,EAAA;AAAA,EACzC,0BAAA,uBAAiC,GAA8B,EAAA;AAAA,EAEvE,OAAO,OAAO,OAAkB,EAAA;AAC9B,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,OAAQ,CAAA,MAAA;AAAA,MACR,OAAQ,CAAA,WAAA;AAAA,MACR,OAAQ,CAAA,SAAA;AAAA,MACR,QAAQ,SAAa,IAAA,OAAA;AAAA,MACrB,KAAK,KAAM,CAAAA,4BAAA,CAAuB,OAAQ,CAAA,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAQ,CAAA;AAAA,KACV;AAAA;AACF,EAWA,MAAM,YACJ,KACqE,EAAA;AACrE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAI,IAAA,GAAA,KAAQC,yBAAW,CAAA,MAAA,CAAO,QAAU,EAAA;AACtC,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,KACM,CAAA,MAAA;AACN,MAAO,OAAA,KAAA,CAAA;AAAA;AAGT,IAAA,MAAM,QAAW,GAAA,MAAA,CAAOC,cAAU,CAAA,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAM,MAAA,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA;AAEvE,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAK,CAAA,QAAQ,CAAG,EAAA;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAM,MAAA,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAM,MAAA,EAAE,OAAQ,EAAA,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAW,CAAA,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAO,CAAA,QAAA;AAAA,QACvB,UAAU,IAAK,CAAA,WAAA;AAAA,QACf,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAK,CAAA,KAAA;AACX,MAAM,MAAA,IAAIE,0BAAoB,CAAA,sBAAA,EAAwB,CAAC,CAAA;AAAA,KACxD,CAAA;AAED,IAAO,OAAA,EAAE,SAAS,CAAU,OAAA,EAAA,OAAA,CAAQ,GAAG,CAAI,CAAA,EAAA,gBAAA,EAAkB,QAAQ,GAAI,EAAA;AAAA;AAC3E,EAEA,MAAM,WAAW,OAIc,EAAA;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAgB,EAAA,UAAA,EAAe,GAAA,OAAA;AACjD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,oBAAqB,EAAA;AAEtD,IAAA,MAAM,GAAM,GAAA,QAAA;AACZ,IAAA,MAAM,GAAM,GAAA,cAAA;AACZ,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAK,CAAA,kBAAA;AAC1B,IAAM,MAAA,GAAA,GAAM,aACR,IAAK,CAAA,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAM,CAAA,UAAA,CAAW,SAAU,CAAA,OAAA,KAAY,aAAa;AAAA,KAE3D,GAAA,MAAA;AAEJ,IAAM,MAAA,MAAA,GAAS,EAAE,GAAK,EAAA,GAAA,EAAK,KAAK,GAAK,EAAA,GAAA,EAAK,YAAY,KAAM,EAAA;AAC5D,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAQ,CAAA,MAAM,EACnC,kBAAmB,CAAA;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAO,CAAA,QAAA;AAAA,MACvB,KAAK,IAAK,CAAA,SAAA;AAAA,MACV,KAAK,GAAI,CAAA;AAAA,KACV,CACA,CAAA,WAAA,CAAY,GAAG,CACf,CAAA,UAAA,CAAW,GAAG,CACd,CAAA,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAM,EAAA;AAAA;AACjB,EAEA,MAAc,wBACZ,cACkB,EAAA;AAClB,IAAA,IAAI,IAAK,CAAA,sBAAA,CAAuB,GAAI,CAAA,cAAc,CAAG,EAAA;AACnD,MAAO,OAAA,IAAA;AAAA;AAET,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,0BAA2B,CAAA,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA;AAAA;AAGT,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAI,IAAA;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAI,IAAA,GAAA,CAAI,WAAW,GAAK,EAAA;AACtB,UAAO,OAAA,KAAA;AAAA;AAGT,QAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAA8B,2BAAA,EAAA,GAAA,CAAI,MAAM,CAAE,CAAA,CAAA;AAAA;AAG5D,QAAM,MAAA,IAAA,GAAO,MAAM,GAAA,CAAI,IAAK,EAAA;AAC5B,QAAI,IAAA,CAAC,KAAK,IAAM,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,CAA0C,wCAAA,CAAA,CAAA;AAAA;AAG5D,QAAK,IAAA,CAAA,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAO,OAAA,IAAA;AAAA,eACA,KAAO,EAAA;AACd,QAAK,IAAA,CAAA,MAAA,CAAO,KAAM,CAAA,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAO,OAAA,KAAA;AAAA,OACP,SAAA;AACA,QAAK,IAAA,CAAA,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA;AACvD,KACF;AAEA,IAAA,MAAM,QAAQ,OAAQ,EAAA;AACtB,IAAK,IAAA,CAAA,0BAAA,CAA2B,GAAI,CAAA,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,MAAc,cAAc,QAAkB,EAAA;AAC5C,IAAA,MAAM,MAAS,GAAA,IAAA,CAAK,OAAQ,CAAA,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAQ,EAAA;AACV,MAAO,OAAA,MAAA;AAAA;AAIT,IAAA,IAAI,CAAE,MAAM,IAAK,CAAA,uBAAA,CAAwB,QAAQ,CAAI,EAAA;AACnD,MAAA,MAAM,IAAIH,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA;AAGF,IAAM,MAAA,SAAA,GAAY,IAAII,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,KACD,CAAA;AAED,IAAK,IAAA,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,EAAU,SAAS,CAAA;AACpC,IAAO,OAAA,SAAA;AAAA;AAEX;;;;"}
+{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\nimport fetch from 'node-fetch';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\nexport class PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new PluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private constructor(\n    private readonly logger: LoggerService,\n    private readonly ownPluginId: string,\n    private readonly keySource: PluginKeySource,\n    private readonly algorithm: string,\n    private readonly keyDurationSeconds: number,\n    private readonly discovery: DiscoveryService,\n  ) {}\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      throw new AuthenticationError('Invalid plugin token', e);\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { token: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","fetch","JwksClient"],"mappings":";;;;;;;;;;;;;AA0BA,MAAM,aAAgB,GAAA,GAAA;AAEtB,MAAM,yBAA4B,GAAA,gBAAA;AAmB3B,MAAM,kBAAmB,CAAA;AAAA,EAkBtB,YACW,MACA,EAAA,WAAA,EACA,SACA,EAAA,SAAA,EACA,oBACA,SACjB,EAAA;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA;AAChB,EAxBK,OAAA,uBAAc,GAAwB,EAAA;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAY,EAAA;AAAA,EACzC,0BAAA,uBAAiC,GAA8B,EAAA;AAAA,EAEvE,OAAO,OAAO,OAAkB,EAAA;AAC9B,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,OAAQ,CAAA,MAAA;AAAA,MACR,OAAQ,CAAA,WAAA;AAAA,MACR,OAAQ,CAAA,SAAA;AAAA,MACR,QAAQ,SAAa,IAAA,OAAA;AAAA,MACrB,KAAK,KAAM,CAAAA,4BAAA,CAAuB,OAAQ,CAAA,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAQ,CAAA;AAAA,KACV;AAAA;AACF,EAWA,MAAM,YACJ,KACqE,EAAA;AACrE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAI,IAAA,GAAA,KAAQC,yBAAW,CAAA,MAAA,CAAO,QAAU,EAAA;AACtC,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,KACM,CAAA,MAAA;AACN,MAAO,OAAA,KAAA,CAAA;AAAA;AAGT,IAAA,MAAM,QAAW,GAAA,MAAA,CAAOC,cAAU,CAAA,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAM,MAAA,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA;AAEvE,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAK,CAAA,QAAQ,CAAG,EAAA;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAM,MAAA,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAM,MAAA,EAAE,OAAQ,EAAA,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAW,CAAA,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAO,CAAA,QAAA;AAAA,QACvB,UAAU,IAAK,CAAA,WAAA;AAAA,QACf,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAK,CAAA,KAAA;AACX,MAAM,MAAA,IAAIE,0BAAoB,CAAA,sBAAA,EAAwB,CAAC,CAAA;AAAA,KACxD,CAAA;AAED,IAAO,OAAA,EAAE,SAAS,CAAU,OAAA,EAAA,OAAA,CAAQ,GAAG,CAAI,CAAA,EAAA,gBAAA,EAAkB,QAAQ,GAAI,EAAA;AAAA;AAC3E,EAEA,MAAM,WAAW,OAIc,EAAA;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAgB,EAAA,UAAA,EAAe,GAAA,OAAA;AACjD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,oBAAqB,EAAA;AAEtD,IAAA,MAAM,GAAM,GAAA,QAAA;AACZ,IAAA,MAAM,GAAM,GAAA,cAAA;AACZ,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAK,CAAA,kBAAA;AAC1B,IAAM,MAAA,GAAA,GAAM,aACR,IAAK,CAAA,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAM,CAAA,UAAA,CAAW,SAAU,CAAA,OAAA,KAAY,aAAa;AAAA,KAE3D,GAAA,MAAA;AAEJ,IAAM,MAAA,MAAA,GAAS,EAAE,GAAK,EAAA,GAAA,EAAK,KAAK,GAAK,EAAA,GAAA,EAAK,YAAY,KAAM,EAAA;AAC5D,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAQ,CAAA,MAAM,EACnC,kBAAmB,CAAA;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAO,CAAA,QAAA;AAAA,MACvB,KAAK,IAAK,CAAA,SAAA;AAAA,MACV,KAAK,GAAI,CAAA;AAAA,KACV,CACA,CAAA,WAAA,CAAY,GAAG,CACf,CAAA,UAAA,CAAW,GAAG,CACd,CAAA,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAM,EAAA;AAAA;AACjB,EAEA,MAAc,wBACZ,cACkB,EAAA;AAClB,IAAA,IAAI,IAAK,CAAA,sBAAA,CAAuB,GAAI,CAAA,cAAc,CAAG,EAAA;AACnD,MAAO,OAAA,IAAA;AAAA;AAET,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,0BAA2B,CAAA,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA;AAAA;AAGT,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAI,IAAA;AACF,QAAA,MAAM,MAAM,MAAMC,sBAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAI,IAAA,GAAA,CAAI,WAAW,GAAK,EAAA;AACtB,UAAO,OAAA,KAAA;AAAA;AAGT,QAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAA8B,2BAAA,EAAA,GAAA,CAAI,MAAM,CAAE,CAAA,CAAA;AAAA;AAG5D,QAAM,MAAA,IAAA,GAAO,MAAM,GAAA,CAAI,IAAK,EAAA;AAC5B,QAAI,IAAA,CAAC,KAAK,IAAM,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,CAA0C,wCAAA,CAAA,CAAA;AAAA;AAG5D,QAAK,IAAA,CAAA,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAO,OAAA,IAAA;AAAA,eACA,KAAO,EAAA;AACd,QAAK,IAAA,CAAA,MAAA,CAAO,KAAM,CAAA,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAO,OAAA,KAAA;AAAA,OACP,SAAA;AACA,QAAK,IAAA,CAAA,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA;AACvD,KACF;AAEA,IAAA,MAAM,QAAQ,OAAQ,EAAA;AACtB,IAAK,IAAA,CAAA,0BAAA,CAA2B,GAAI,CAAA,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,MAAc,cAAc,QAAkB,EAAA;AAC5C,IAAA,MAAM,MAAS,GAAA,IAAA,CAAK,OAAQ,CAAA,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAQ,EAAA;AACV,MAAO,OAAA,MAAA;AAAA;AAIT,IAAA,IAAI,CAAE,MAAM,IAAK,CAAA,uBAAA,CAAwB,QAAQ,CAAI,EAAA;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA;AAGF,IAAM,MAAA,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,KACD,CAAA;AAED,IAAK,IAAA,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,EAAU,SAAS,CAAA;AACpC,IAAO,OAAA,SAAA;AAAA;AAEX;;;;"}

package/dist/package.json.cjs.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var name = "@backstage/backend-defaults";
-var version = "0.5.3-next.2";
+var version = "0.5.3-next.3";
 var description = "Backend defaults used by Backstage backend apps";
 var backstage = {
 	role: "node-library"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/backend-defaults",
-  "version": "0.5.3-next.2",
+  "version": "0.5.3-next.3",
   "description": "Backend defaults used by Backstage backend apps",
   "backstage": {
     "role": "node-library"
@@ -113,27 +113,68 @@
   },
   "main": "./dist/index.cjs.js",
   "types": "./dist/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "index": [
+        "dist/index.d.ts"
+      ],
+      "auth": [
+        "dist/auth.d.ts"
+      ],
+      "cache": [
+        "dist/cache.d.ts"
+      ],
+      "database": [
+        "dist/database.d.ts"
+      ],
+      "discovery": [
+        "dist/discovery.d.ts"
+      ],
+      "httpAuth": [
+        "dist/httpAuth.d.ts"
+      ],
+      "httpRouter": [
+        "dist/httpRouter.d.ts"
+      ],
+      "lifecycle": [
+        "dist/lifecycle.d.ts"
+      ],
+      "logger": [
+        "dist/logger.d.ts"
+      ],
+      "permissions": [
+        "dist/permissions.d.ts"
+      ],
+      "rootConfig": [
+        "dist/rootConfig.d.ts"
+      ],
+      "rootHealth": [
+        "dist/rootHealth.d.ts"
+      ],
+      "rootHttpRouter": [
+        "dist/rootHttpRouter.d.ts"
+      ],
+      "rootLifecycle": [
+        "dist/rootLifecycle.d.ts"
+      ],
+      "rootLogger": [
+        "dist/rootLogger.d.ts"
+      ],
+      "scheduler": [
+        "dist/scheduler.d.ts"
+      ],
+      "urlReader": [
+        "dist/urlReader.d.ts"
+      ],
+      "userInfo": [
+        "dist/userInfo.d.ts"
+      ]
+    }
+  },
   "files": [
     "config.d.ts",
     "dist",
-    "migrations",
-    "auth",
-    "cache",
-    "database",
-    "discovery",
-    "httpAuth",
-    "httpRouter",
-    "lifecycle",
-    "logger",
-    "permissions",
-    "rootConfig",
-    "rootHealth",
-    "rootHttpRouter",
-    "rootLifecycle",
-    "rootLogger",
-    "scheduler",
-    "urlReader",
-    "userInfo"
+    "migrations"
   ],
   "scripts": {
     "build": "backstage-cli package build",
@@ -160,9 +201,9 @@
     "@backstage/config-loader": "1.9.2-next.0",
     "@backstage/errors": "1.2.4",
     "@backstage/integration": "1.15.1",
-    "@backstage/integration-aws-node": "0.1.12",
+    "@backstage/integration-aws-node": "0.1.13-next.0",
     "@backstage/plugin-auth-node": "0.5.4-next.2",
-    "@backstage/plugin-events-node": "0.4.5-next.2",
+    "@backstage/plugin-events-node": "0.4.5-next.3",
     "@backstage/plugin-permission-node": "0.8.5-next.2",
     "@backstage/types": "1.1.1",
     "@google-cloud/storage": "^7.0.0",
@@ -219,8 +260,8 @@
   "devDependencies": {
     "@aws-sdk/util-stream-node": "^3.350.0",
     "@backstage/backend-plugin-api": "1.0.2-next.2",
-    "@backstage/backend-test-utils": "1.1.0-next.2",
-    "@backstage/cli": "0.29.0-next.2",
+    "@backstage/backend-test-utils": "1.1.0-next.3",
+    "@backstage/cli": "0.29.0-next.3",
     "@types/archiver": "^6.0.0",
     "@types/base64-stream": "^1.0.2",
     "@types/concat-stream": "^2.0.0",

package/auth/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__auth",
-  "version": "0.5.3-next.2",
-  "main": "../dist/auth.cjs.js",
-  "types": "../dist/auth.d.ts"
-}

package/cache/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__cache",
-  "version": "0.5.3-next.2",
-  "main": "../dist/cache.cjs.js",
-  "types": "../dist/cache.d.ts"
-}

package/database/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__database",
-  "version": "0.5.3-next.2",
-  "main": "../dist/database.cjs.js",
-  "types": "../dist/database.d.ts"
-}

package/discovery/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__discovery",
-  "version": "0.5.3-next.2",
-  "main": "../dist/discovery.cjs.js",
-  "types": "../dist/discovery.d.ts"
-}

package/httpAuth/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__httpauth",
-  "version": "0.5.3-next.2",
-  "main": "../dist/httpAuth.cjs.js",
-  "types": "../dist/httpAuth.d.ts"
-}

package/httpRouter/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__httprouter",
-  "version": "0.5.3-next.2",
-  "main": "../dist/httpRouter.cjs.js",
-  "types": "../dist/httpRouter.d.ts"
-}

package/lifecycle/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__lifecycle",
-  "version": "0.5.3-next.2",
-  "main": "../dist/lifecycle.cjs.js",
-  "types": "../dist/lifecycle.d.ts"
-}

package/logger/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__logger",
-  "version": "0.5.3-next.2",
-  "main": "../dist/logger.cjs.js",
-  "types": "../dist/logger.d.ts"
-}

package/permissions/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__permissions",
-  "version": "0.5.3-next.2",
-  "main": "../dist/permissions.cjs.js",
-  "types": "../dist/permissions.d.ts"
-}

package/rootConfig/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__rootconfig",
-  "version": "0.5.3-next.2",
-  "main": "../dist/rootConfig.cjs.js",
-  "types": "../dist/rootConfig.d.ts"
-}

package/rootHealth/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__roothealth",
-  "version": "0.5.3-next.2",
-  "main": "../dist/rootHealth.cjs.js",
-  "types": "../dist/rootHealth.d.ts"
-}

package/rootHttpRouter/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__roothttprouter",
-  "version": "0.5.3-next.2",
-  "main": "../dist/rootHttpRouter.cjs.js",
-  "types": "../dist/rootHttpRouter.d.ts"
-}

package/rootLifecycle/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__rootlifecycle",
-  "version": "0.5.3-next.2",
-  "main": "../dist/rootLifecycle.cjs.js",
-  "types": "../dist/rootLifecycle.d.ts"
-}

package/rootLogger/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__rootlogger",
-  "version": "0.5.3-next.2",
-  "main": "../dist/rootLogger.cjs.js",
-  "types": "../dist/rootLogger.d.ts"
-}

package/scheduler/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__scheduler",
-  "version": "0.5.3-next.2",
-  "main": "../dist/scheduler.cjs.js",
-  "types": "../dist/scheduler.d.ts"
-}

package/urlReader/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__urlreader",
-  "version": "0.5.3-next.2",
-  "main": "../dist/urlReader.cjs.js",
-  "types": "../dist/urlReader.d.ts"
-}

package/userInfo/package.json

@@ -1,6 +0,0 @@
-{
-  "name": "@backstage/backend-defaults__userinfo",
-  "version": "0.5.3-next.2",
-  "main": "../dist/userInfo.cjs.js",
-  "types": "../dist/userInfo.d.ts"
-}