@backstage/backend-defaults 0.5.3 → 0.6.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # @backstage/backend-defaults
 
+## 0.6.0-next.1
+
+### Patch Changes
+
+- fe87fbf: Add task metrics as two gauges that track the last start and end timestamps as epoch seconds.
+- 1ac6b72: Support `connection.type: cloudsql` in database client for usage with `@google-cloud/cloud-sql-connector` and `iam` auth
+- 5c9cc05: Use native fetch instead of node-fetch
+- cf627c6: Fixed an issue in the WinstonLogger where Errors thrown and given to logger.error with field values that could not be cast to a string would throw a TypeError
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.5-next.1
+  - @backstage/backend-app-api@1.1.0-next.1
+  - @backstage/config-loader@1.9.3-next.0
+  - @backstage/backend-plugin-api@1.1.0-next.1
+  - @backstage/plugin-permission-node@0.8.6-next.1
+  - @backstage/backend-dev-utils@0.1.5
+  - @backstage/cli-common@0.1.15
+  - @backstage/cli-node@0.2.11-next.0
+  - @backstage/config@1.3.0
+  - @backstage/errors@1.2.5
+  - @backstage/integration@1.16.0-next.0
+  - @backstage/integration-aws-node@0.1.13
+  - @backstage/types@1.2.0
+  - @backstage/plugin-events-node@0.4.6-next.1
+
+## 0.6.0-next.0
+
+### Minor Changes
+
+- de6f280: **BREAKING** Upgraded @keyv/redis and keyv packages to resolve a bug related to incorrect resolution of cache keys.
+
+  This is a breaking change for clients using the `redis` store for cache with `useRedisSets` option set to false since cache keys will be calculated differently (without the sets:namespace: prefix). For clients with default configuration (or useRedisSets set to false) the cache keys will stay the same, but since @keyv/redis library no longer supports redis sets they won't be utilised anymore.
+
+  If you were using `useRedisSets` option in configuration make sure to remove it from `app-config.yaml`:
+
+  ```diff
+  backend:
+    cache:
+      store: redis
+      connection: redis://user:pass@cache.example.com:6379
+  -   useRedisSets: false
+  ```
+
+- 277092a: Implemented `AzureBlobStorageUrlReader` to read from the url of committed location from the entity provider
+- 18a2c00: All middleware used by the default `coreServices.http` is now exported for use by custom implementations.
+
+### Patch Changes
+
+- 8863b38: Export `PluginTokenHandler` and `pluginTokenHandlerDecoratorServiceRef` to allow for custom decoration of the plugin token handler without having to re-implement the entire handler.
+- 97c6837: Export `DefaultHttpAuthService` to allow for custom token extraction logic.
+- e5255f1: Log request and response metadata so it can be used for filtering log messages.
+  The format of the request date was also changed from `clf` to `utc`.
+- Updated dependencies
+  - @backstage/integration@1.16.0-next.0
+  - @backstage/backend-plugin-api@1.0.3-next.0
+  - @backstage/backend-app-api@1.0.3-next.0
+  - @backstage/plugin-events-node@0.4.6-next.0
+  - @backstage/cli-node@0.2.11-next.0
+  - @backstage/plugin-auth-node@0.5.5-next.0
+  - @backstage/backend-dev-utils@0.1.5
+  - @backstage/cli-common@0.1.15
+  - @backstage/config@1.3.0
+  - @backstage/config-loader@1.9.2
+  - @backstage/errors@1.2.5
+  - @backstage/integration-aws-node@0.1.13
+  - @backstage/types@1.2.0
+  - @backstage/plugin-permission-node@0.8.6-next.0
+
 ## 0.5.3
 
 ### Patch Changes

package/config.d.ts

@@ -384,6 +384,16 @@ export interface Config {
        */
       connection:
         | string
+        | {
+            /**
+             * The specific config for cloudsql connections
+             */
+            type: 'cloudsql';
+            /**
+             * The instance connection name for the cloudsql instance, e.g. `project:region:instance`
+             */
+            instance: string;
+          }
         | {
             /**
              * Password that belongs to the client User
@@ -441,7 +451,30 @@ export interface Config {
            * Database connection string or Knex object override
            * @visibility secret
            */
-          connection?: string | object;
+          connection?:
+            | string
+            | {
+                /**
+                 * The specific config for cloudsql connections
+                 */
+                type: 'cloudsql';
+                /**
+                 * The instance connection name for the cloudsql instance, e.g. `project:region:instance`
+                 */
+                instance: string;
+              }
+            | {
+                /**
+                 * Password that belongs to the client User
+                 * @visibility secret
+                 */
+                password?: string;
+                /**
+                 * Other connection settings
+                 */
+                [key: string]: unknown;
+              };
+
           /**
            * Whether to ensure the given database exists by creating it if it does not.
            * Defaults to base config if unspecified.
@@ -486,11 +519,6 @@ export interface Config {
           connection: string;
           /** An optional default TTL (in milliseconds, if given as a number). */
           defaultTtl?: number | HumanDuration | string;
-          /**
-           * Whether or not [useRedisSets](https://github.com/jaredwray/keyv/tree/main/packages/redis#useredissets) should be configured to this redis cache.
-           * Defaults to true if unspecified.
-           */
-          useRedisSets?: boolean;
         }
       | {
           store: 'memcache';

package/dist/auth.cjs.js

@@ -5,4 +5,5 @@ var authServiceFactory = require('./entrypoints/auth/authServiceFactory.cjs.js')
 
 
 exports.authServiceFactory = authServiceFactory.authServiceFactory;
+exports.pluginTokenHandlerDecoratorServiceRef = authServiceFactory.pluginTokenHandlerDecoratorServiceRef;
 //# sourceMappingURL=auth.cjs.js.map

package/dist/auth.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;"}
+{"version":3,"file":"auth.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;"}

package/dist/auth.d.ts

@@ -1,5 +1,31 @@
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
 
+/**
+ * @public
+ * Issues and verifies {@link https://backstage.iceio/docs/auth/service-to-service-auth | service-to-service tokens}.
+ */
+interface PluginTokenHandler {
+    verifyToken(token: string): Promise<{
+        subject: string;
+        limitedUserToken?: string;
+    } | undefined>;
+    issueToken(options: {
+        pluginId: string;
+        targetPluginId: string;
+        onBehalfOf?: {
+            limitedUserToken: string;
+            expiresAt: Date;
+        };
+    }): Promise<{
+        token: string;
+    }>;
+}
+
+/**
+ * @public
+ * This service is used to decorate the default plugin token handler with custom logic.
+ */
+declare const pluginTokenHandlerDecoratorServiceRef: _backstage_backend_plugin_api.ServiceRef<(defaultImplementation: PluginTokenHandler) => PluginTokenHandler, "plugin", "singleton">;
 /**
  * Handles token authentication and credentials management.
  *
@@ -11,4 +37,4 @@ import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
  */
 declare const authServiceFactory: _backstage_backend_plugin_api.ServiceFactory<_backstage_backend_plugin_api.AuthService, "plugin", "singleton">;
 
-export { authServiceFactory };
+export { type PluginTokenHandler, authServiceFactory, pluginTokenHandlerDecoratorServiceRef };

package/dist/cache.d.ts

@@ -45,7 +45,6 @@ declare class CacheManager {
     private readonly logger?;
     private readonly store;
     private readonly connection;
-    private readonly useRedisSets;
     private readonly errorHandler;
     private readonly defaultTtl?;
     /**

package/dist/database.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="node" />
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
-import { RootConfigService, DatabaseService, RootLoggerService, RootLifecycleService, LoggerService, LifecycleService } from '@backstage/backend-plugin-api';
+import { DatabaseService, RootLoggerService, RootLifecycleService, RootConfigService, LoggerService, LifecycleService } from '@backstage/backend-plugin-api';
 
 /**
  * Database access and management via `knex`.

package/dist/entrypoints/auth/DefaultAuthService.cjs.js

@@ -95,7 +95,10 @@ class DefaultAuthService {
         return this.pluginTokenHandler.issueToken({
           pluginId: this.pluginId,
           targetPluginId,
-          onBehalfOf
+          onBehalfOf: {
+            limitedUserToken: onBehalfOf.token,
+            expiresAt: onBehalfOf.expiresAt
+          }
         });
       }
       default:

package/dist/entrypoints/auth/DefaultAuthService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultAuthService.cjs.js","sources":["../../../src/entrypoints/auth/DefaultAuthService.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalTypes,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { JsonObject } from '@backstage/types';\nimport { decodeJwt } from 'jose';\nimport { ExternalTokenHandler } from './external/ExternalTokenHandler';\nimport {\n  createCredentialsWithNonePrincipal,\n  createCredentialsWithServicePrincipal,\n  createCredentialsWithUserPrincipal,\n  toInternalBackstageCredentials,\n} from './helpers';\nimport { PluginTokenHandler } from './plugin/PluginTokenHandler';\nimport { PluginKeySource } from './plugin/keys/types';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/** @internal */\nexport class DefaultAuthService implements AuthService {\n  constructor(\n    private readonly userTokenHandler: UserTokenHandler,\n    private readonly pluginTokenHandler: PluginTokenHandler,\n    private readonly externalTokenHandler: ExternalTokenHandler,\n    private readonly pluginId: string,\n    private readonly disableDefaultAuthPolicy: boolean,\n    private readonly pluginKeySource: PluginKeySource,\n  ) {}\n\n  async authenticate(\n    token: string,\n    options?: {\n      allowLimitedAccess?: boolean;\n    },\n  ): Promise<BackstageCredentials> {\n    const pluginResult = await this.pluginTokenHandler.verifyToken(token);\n    if (pluginResult) {\n      if (pluginResult.limitedUserToken) {\n        const userResult = await this.userTokenHandler.verifyToken(\n          pluginResult.limitedUserToken,\n        );\n        if (!userResult) {\n          throw new AuthenticationError(\n            'Invalid user token in plugin token obo claim',\n          );\n        }\n        return createCredentialsWithUserPrincipal(\n          userResult.userEntityRef,\n          pluginResult.limitedUserToken,\n          this.#getJwtExpiration(pluginResult.limitedUserToken),\n        );\n      }\n      return createCredentialsWithServicePrincipal(pluginResult.subject);\n    }\n\n    const userResult = await this.userTokenHandler.verifyToken(token);\n    if (userResult) {\n      if (\n        !options?.allowLimitedAccess &&\n        this.userTokenHandler.isLimitedUserToken(token)\n      ) {\n        throw new AuthenticationError('Illegal limited user token');\n      }\n\n      return createCredentialsWithUserPrincipal(\n        userResult.userEntityRef,\n        token,\n        this.#getJwtExpiration(token),\n      );\n    }\n\n    const externalResult = await this.externalTokenHandler.verifyToken(token);\n    if (externalResult) {\n      return createCredentialsWithServicePrincipal(\n        externalResult.subject,\n        undefined,\n        externalResult.accessRestrictions,\n      );\n    }\n\n    throw new AuthenticationError('Illegal token');\n  }\n\n  isPrincipal<TType extends keyof BackstagePrincipalTypes>(\n    credentials: BackstageCredentials,\n    type: TType,\n  ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]> {\n    const principal = credentials.principal as\n      | BackstageUserPrincipal\n      | BackstageServicePrincipal;\n\n    if (type === 'unknown') {\n      return true;\n    }\n\n    if (principal.type !== type) {\n      return false;\n    }\n\n    return true;\n  }\n\n  async getNoneCredentials(): Promise<\n    BackstageCredentials<BackstageNonePrincipal>\n  > {\n    return createCredentialsWithNonePrincipal();\n  }\n\n  async getOwnServiceCredentials(): Promise<\n    BackstageCredentials<BackstageServicePrincipal>\n  > {\n    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);\n  }\n\n  async getPluginRequestToken(options: {\n    onBehalfOf: BackstageCredentials;\n    targetPluginId: string;\n  }): Promise<{ token: string }> {\n    const { targetPluginId } = options;\n    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);\n    const { type } = internalForward.principal;\n\n    // Since disabling the default policy means we'll be allowing\n    // unauthenticated requests through, we might have unauthenticated\n    // credentials from service calls that reach this point. If that's the case,\n    // we'll want to keep \"forwarding\" the unauthenticated credentials, which we\n    // do by returning an empty token.\n    if (type === 'none' && this.disableDefaultAuthPolicy) {\n      return { token: '' };\n    }\n\n    // check whether a plugin support the new auth system\n    // by checking the public keys endpoint existance.\n    switch (type) {\n      // TODO: Check whether the principal is ourselves\n      case 'service':\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n        });\n      case 'user': {\n        const { token } = internalForward;\n        if (!token) {\n          throw new Error('User credentials is unexpectedly missing token');\n        }\n        const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(\n          token,\n        );\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n          onBehalfOf,\n        });\n      }\n      default:\n        throw new AuthenticationError(\n          `Refused to issue service token for credential type '${type}'`,\n        );\n    }\n  }\n\n  async getLimitedUserToken(\n    credentials: BackstageCredentials<BackstageUserPrincipal>,\n  ): Promise<{ token: string; expiresAt: Date }> {\n    const { token: backstageToken } =\n      toInternalBackstageCredentials(credentials);\n    if (!backstageToken) {\n      throw new AuthenticationError(\n        'User credentials is unexpectedly missing token',\n      );\n    }\n\n    return this.userTokenHandler.createLimitedUserToken(backstageToken);\n  }\n\n  async listPublicServiceKeys(): Promise<{ keys: JsonObject[] }> {\n    const { keys } = await this.pluginKeySource.listKeys();\n    return { keys: keys.map(({ key }) => key) };\n  }\n\n  #getJwtExpiration(token: string) {\n    const { exp } = decodeJwt(token);\n    if (!exp) {\n      throw new AuthenticationError('User token is missing expiration');\n    }\n    return new Date(exp * 1000);\n  }\n}\n"],"names":["userResult","AuthenticationError","createCredentialsWithUserPrincipal","createCredentialsWithServicePrincipal","createCredentialsWithNonePrincipal","toInternalBackstageCredentials","decodeJwt"],"mappings":";;;;;;AAuCO,MAAM,kBAA0C,CAAA;AAAA,EACrD,YACmB,gBACA,EAAA,kBAAA,EACA,oBACA,EAAA,QAAA,EACA,0BACA,eACjB,EAAA;AANiB,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,oBAAA,GAAA,oBAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,wBAAA,GAAA,wBAAA;AACA,IAAA,IAAA,CAAA,eAAA,GAAA,eAAA;AAAA;AAChB,EAEH,MAAM,YACJ,CAAA,KAAA,EACA,OAG+B,EAAA;AAC/B,IAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,YAAY,KAAK,CAAA;AACpE,IAAA,IAAI,YAAc,EAAA;AAChB,MAAA,IAAI,aAAa,gBAAkB,EAAA;AACjC,QAAMA,MAAAA,WAAAA,GAAa,MAAM,IAAA,CAAK,gBAAiB,CAAA,WAAA;AAAA,UAC7C,YAAa,CAAA;AAAA,SACf;AACA,QAAA,IAAI,CAACA,WAAY,EAAA;AACf,UAAA,MAAM,IAAIC,0BAAA;AAAA,YACR;AAAA,WACF;AAAA;AAEF,QAAO,OAAAC,0CAAA;AAAA,UACLF,WAAW,CAAA,aAAA;AAAA,UACX,YAAa,CAAA,gBAAA;AAAA,UACb,IAAA,CAAK,iBAAkB,CAAA,YAAA,CAAa,gBAAgB;AAAA,SACtD;AAAA;AAEF,MAAO,OAAAG,6CAAA,CAAsC,aAAa,OAAO,CAAA;AAAA;AAGnE,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,gBAAA,CAAiB,YAAY,KAAK,CAAA;AAChE,IAAA,IAAI,UAAY,EAAA;AACd,MAAA,IACE,CAAC,OAAS,EAAA,kBAAA,IACV,KAAK,gBAAiB,CAAA,kBAAA,CAAmB,KAAK,CAC9C,EAAA;AACA,QAAM,MAAA,IAAIF,2BAAoB,4BAA4B,CAAA;AAAA;AAG5D,MAAO,OAAAC,0CAAA;AAAA,QACL,UAAW,CAAA,aAAA;AAAA,QACX,KAAA;AAAA,QACA,IAAA,CAAK,kBAAkB,KAAK;AAAA,OAC9B;AAAA;AAGF,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,oBAAA,CAAqB,YAAY,KAAK,CAAA;AACxE,IAAA,IAAI,cAAgB,EAAA;AAClB,MAAO,OAAAC,6CAAA;AAAA,QACL,cAAe,CAAA,OAAA;AAAA,QACf,KAAA,CAAA;AAAA,QACA,cAAe,CAAA;AAAA,OACjB;AAAA;AAGF,IAAM,MAAA,IAAIF,2BAAoB,eAAe,CAAA;AAAA;AAC/C,EAEA,WAAA,CACE,aACA,IACqE,EAAA;AACrE,IAAA,MAAM,YAAY,WAAY,CAAA,SAAA;AAI9B,IAAA,IAAI,SAAS,SAAW,EAAA;AACtB,MAAO,OAAA,IAAA;AAAA;AAGT,IAAI,IAAA,SAAA,CAAU,SAAS,IAAM,EAAA;AAC3B,MAAO,OAAA,KAAA;AAAA;AAGT,IAAO,OAAA,IAAA;AAAA;AACT,EAEA,MAAM,kBAEJ,GAAA;AACA,IAAA,OAAOG,0CAAmC,EAAA;AAAA;AAC5C,EAEA,MAAM,wBAEJ,GAAA;AACA,IAAA,OAAOD,6CAAsC,CAAA,CAAA,OAAA,EAAU,IAAK,CAAA,QAAQ,CAAE,CAAA,CAAA;AAAA;AACxE,EAEA,MAAM,sBAAsB,OAGG,EAAA;AAC7B,IAAM,MAAA,EAAE,gBAAmB,GAAA,OAAA;AAC3B,IAAM,MAAA,eAAA,GAAkBE,sCAA+B,CAAA,OAAA,CAAQ,UAAU,CAAA;AACzE,IAAM,MAAA,EAAE,IAAK,EAAA,GAAI,eAAgB,CAAA,SAAA;AAOjC,IAAI,IAAA,IAAA,KAAS,MAAU,IAAA,IAAA,CAAK,wBAA0B,EAAA;AACpD,MAAO,OAAA,EAAE,OAAO,EAAG,EAAA;AAAA;AAKrB,IAAA,QAAQ,IAAM;AAAA;AAAA,MAEZ,KAAK,SAAA;AACH,QAAO,OAAA,IAAA,CAAK,mBAAmB,UAAW,CAAA;AAAA,UACxC,UAAU,IAAK,CAAA,QAAA;AAAA,UACf;AAAA,SACD,CAAA;AAAA,MACH,KAAK,MAAQ,EAAA;AACX,QAAM,MAAA,EAAE,OAAU,GAAA,eAAA;AAClB,QAAA,IAAI,CAAC,KAAO,EAAA;AACV,UAAM,MAAA,IAAI,MAAM,gDAAgD,CAAA;AAAA;AAElE,QAAM,MAAA,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAiB,CAAA,sBAAA;AAAA,UAC7C;AAAA,SACF;AACA,QAAO,OAAA,IAAA,CAAK,mBAAmB,UAAW,CAAA;AAAA,UACxC,UAAU,IAAK,CAAA,QAAA;AAAA,UACf,cAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA;AACH,MACA;AACE,QAAA,MAAM,IAAIJ,0BAAA;AAAA,UACR,uDAAuD,IAAI,CAAA,CAAA;AAAA,SAC7D;AAAA;AACJ;AACF,EAEA,MAAM,oBACJ,WAC6C,EAAA;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAO,cAAe,EAAA,GAC5BI,uCAA+B,WAAW,CAAA;AAC5C,IAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAO,OAAA,IAAA,CAAK,gBAAiB,CAAA,sBAAA,CAAuB,cAAc,CAAA;AAAA;AACpE,EAEA,MAAM,qBAAyD,GAAA;AAC7D,IAAA,MAAM,EAAE,IAAK,EAAA,GAAI,MAAM,IAAA,CAAK,gBAAgB,QAAS,EAAA;AACrD,IAAO,OAAA,EAAE,MAAM,IAAK,CAAA,GAAA,CAAI,CAAC,EAAE,GAAA,EAAU,KAAA,GAAG,CAAE,EAAA;AAAA;AAC5C,EAEA,kBAAkB,KAAe,EAAA;AAC/B,IAAA,MAAM,EAAE,GAAA,EAAQ,GAAAK,cAAA,CAAU,KAAK,CAAA;AAC/B,IAAA,IAAI,CAAC,GAAK,EAAA;AACR,MAAM,MAAA,IAAIL,2BAAoB,kCAAkC,CAAA;AAAA;AAElE,IAAO,OAAA,IAAI,IAAK,CAAA,GAAA,GAAM,GAAI,CAAA;AAAA;AAE9B;;;;"}
+{"version":3,"file":"DefaultAuthService.cjs.js","sources":["../../../src/entrypoints/auth/DefaultAuthService.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  BackstageNonePrincipal,\n  BackstagePrincipalTypes,\n  BackstageServicePrincipal,\n  BackstageUserPrincipal,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { JsonObject } from '@backstage/types';\nimport { decodeJwt } from 'jose';\nimport { ExternalTokenHandler } from './external/ExternalTokenHandler';\nimport {\n  createCredentialsWithNonePrincipal,\n  createCredentialsWithServicePrincipal,\n  createCredentialsWithUserPrincipal,\n  toInternalBackstageCredentials,\n} from './helpers';\nimport { PluginTokenHandler } from './plugin/PluginTokenHandler';\nimport { PluginKeySource } from './plugin/keys/types';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/** @internal */\nexport class DefaultAuthService implements AuthService {\n  constructor(\n    private readonly userTokenHandler: UserTokenHandler,\n    private readonly pluginTokenHandler: PluginTokenHandler,\n    private readonly externalTokenHandler: ExternalTokenHandler,\n    private readonly pluginId: string,\n    private readonly disableDefaultAuthPolicy: boolean,\n    private readonly pluginKeySource: PluginKeySource,\n  ) {}\n\n  async authenticate(\n    token: string,\n    options?: {\n      allowLimitedAccess?: boolean;\n    },\n  ): Promise<BackstageCredentials> {\n    const pluginResult = await this.pluginTokenHandler.verifyToken(token);\n    if (pluginResult) {\n      if (pluginResult.limitedUserToken) {\n        const userResult = await this.userTokenHandler.verifyToken(\n          pluginResult.limitedUserToken,\n        );\n        if (!userResult) {\n          throw new AuthenticationError(\n            'Invalid user token in plugin token obo claim',\n          );\n        }\n        return createCredentialsWithUserPrincipal(\n          userResult.userEntityRef,\n          pluginResult.limitedUserToken,\n          this.#getJwtExpiration(pluginResult.limitedUserToken),\n        );\n      }\n      return createCredentialsWithServicePrincipal(pluginResult.subject);\n    }\n\n    const userResult = await this.userTokenHandler.verifyToken(token);\n    if (userResult) {\n      if (\n        !options?.allowLimitedAccess &&\n        this.userTokenHandler.isLimitedUserToken(token)\n      ) {\n        throw new AuthenticationError('Illegal limited user token');\n      }\n\n      return createCredentialsWithUserPrincipal(\n        userResult.userEntityRef,\n        token,\n        this.#getJwtExpiration(token),\n      );\n    }\n\n    const externalResult = await this.externalTokenHandler.verifyToken(token);\n    if (externalResult) {\n      return createCredentialsWithServicePrincipal(\n        externalResult.subject,\n        undefined,\n        externalResult.accessRestrictions,\n      );\n    }\n\n    throw new AuthenticationError('Illegal token');\n  }\n\n  isPrincipal<TType extends keyof BackstagePrincipalTypes>(\n    credentials: BackstageCredentials,\n    type: TType,\n  ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]> {\n    const principal = credentials.principal as\n      | BackstageUserPrincipal\n      | BackstageServicePrincipal;\n\n    if (type === 'unknown') {\n      return true;\n    }\n\n    if (principal.type !== type) {\n      return false;\n    }\n\n    return true;\n  }\n\n  async getNoneCredentials(): Promise<\n    BackstageCredentials<BackstageNonePrincipal>\n  > {\n    return createCredentialsWithNonePrincipal();\n  }\n\n  async getOwnServiceCredentials(): Promise<\n    BackstageCredentials<BackstageServicePrincipal>\n  > {\n    return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);\n  }\n\n  async getPluginRequestToken(options: {\n    onBehalfOf: BackstageCredentials;\n    targetPluginId: string;\n  }): Promise<{ token: string }> {\n    const { targetPluginId } = options;\n    const internalForward = toInternalBackstageCredentials(options.onBehalfOf);\n    const { type } = internalForward.principal;\n\n    // Since disabling the default policy means we'll be allowing\n    // unauthenticated requests through, we might have unauthenticated\n    // credentials from service calls that reach this point. If that's the case,\n    // we'll want to keep \"forwarding\" the unauthenticated credentials, which we\n    // do by returning an empty token.\n    if (type === 'none' && this.disableDefaultAuthPolicy) {\n      return { token: '' };\n    }\n\n    // check whether a plugin support the new auth system\n    // by checking the public keys endpoint existance.\n    switch (type) {\n      // TODO: Check whether the principal is ourselves\n      case 'service':\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n        });\n      case 'user': {\n        const { token } = internalForward;\n        if (!token) {\n          throw new Error('User credentials is unexpectedly missing token');\n        }\n        const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(\n          token,\n        );\n        return this.pluginTokenHandler.issueToken({\n          pluginId: this.pluginId,\n          targetPluginId,\n          onBehalfOf: {\n            limitedUserToken: onBehalfOf.token,\n            expiresAt: onBehalfOf.expiresAt,\n          },\n        });\n      }\n      default:\n        throw new AuthenticationError(\n          `Refused to issue service token for credential type '${type}'`,\n        );\n    }\n  }\n\n  async getLimitedUserToken(\n    credentials: BackstageCredentials<BackstageUserPrincipal>,\n  ): Promise<{ token: string; expiresAt: Date }> {\n    const { token: backstageToken } =\n      toInternalBackstageCredentials(credentials);\n    if (!backstageToken) {\n      throw new AuthenticationError(\n        'User credentials is unexpectedly missing token',\n      );\n    }\n\n    return this.userTokenHandler.createLimitedUserToken(backstageToken);\n  }\n\n  async listPublicServiceKeys(): Promise<{ keys: JsonObject[] }> {\n    const { keys } = await this.pluginKeySource.listKeys();\n    return { keys: keys.map(({ key }) => key) };\n  }\n\n  #getJwtExpiration(token: string) {\n    const { exp } = decodeJwt(token);\n    if (!exp) {\n      throw new AuthenticationError('User token is missing expiration');\n    }\n    return new Date(exp * 1000);\n  }\n}\n"],"names":["userResult","AuthenticationError","createCredentialsWithUserPrincipal","createCredentialsWithServicePrincipal","createCredentialsWithNonePrincipal","toInternalBackstageCredentials","decodeJwt"],"mappings":";;;;;;AAuCO,MAAM,kBAA0C,CAAA;AAAA,EACrD,YACmB,gBACA,EAAA,kBAAA,EACA,oBACA,EAAA,QAAA,EACA,0BACA,eACjB,EAAA;AANiB,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,oBAAA,GAAA,oBAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,wBAAA,GAAA,wBAAA;AACA,IAAA,IAAA,CAAA,eAAA,GAAA,eAAA;AAAA;AAChB,EAEH,MAAM,YACJ,CAAA,KAAA,EACA,OAG+B,EAAA;AAC/B,IAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,YAAY,KAAK,CAAA;AACpE,IAAA,IAAI,YAAc,EAAA;AAChB,MAAA,IAAI,aAAa,gBAAkB,EAAA;AACjC,QAAMA,MAAAA,WAAAA,GAAa,MAAM,IAAA,CAAK,gBAAiB,CAAA,WAAA;AAAA,UAC7C,YAAa,CAAA;AAAA,SACf;AACA,QAAA,IAAI,CAACA,WAAY,EAAA;AACf,UAAA,MAAM,IAAIC,0BAAA;AAAA,YACR;AAAA,WACF;AAAA;AAEF,QAAO,OAAAC,0CAAA;AAAA,UACLF,WAAW,CAAA,aAAA;AAAA,UACX,YAAa,CAAA,gBAAA;AAAA,UACb,IAAA,CAAK,iBAAkB,CAAA,YAAA,CAAa,gBAAgB;AAAA,SACtD;AAAA;AAEF,MAAO,OAAAG,6CAAA,CAAsC,aAAa,OAAO,CAAA;AAAA;AAGnE,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,gBAAA,CAAiB,YAAY,KAAK,CAAA;AAChE,IAAA,IAAI,UAAY,EAAA;AACd,MAAA,IACE,CAAC,OAAS,EAAA,kBAAA,IACV,KAAK,gBAAiB,CAAA,kBAAA,CAAmB,KAAK,CAC9C,EAAA;AACA,QAAM,MAAA,IAAIF,2BAAoB,4BAA4B,CAAA;AAAA;AAG5D,MAAO,OAAAC,0CAAA;AAAA,QACL,UAAW,CAAA,aAAA;AAAA,QACX,KAAA;AAAA,QACA,IAAA,CAAK,kBAAkB,KAAK;AAAA,OAC9B;AAAA;AAGF,IAAA,MAAM,cAAiB,GAAA,MAAM,IAAK,CAAA,oBAAA,CAAqB,YAAY,KAAK,CAAA;AACxE,IAAA,IAAI,cAAgB,EAAA;AAClB,MAAO,OAAAC,6CAAA;AAAA,QACL,cAAe,CAAA,OAAA;AAAA,QACf,KAAA,CAAA;AAAA,QACA,cAAe,CAAA;AAAA,OACjB;AAAA;AAGF,IAAM,MAAA,IAAIF,2BAAoB,eAAe,CAAA;AAAA;AAC/C,EAEA,WAAA,CACE,aACA,IACqE,EAAA;AACrE,IAAA,MAAM,YAAY,WAAY,CAAA,SAAA;AAI9B,IAAA,IAAI,SAAS,SAAW,EAAA;AACtB,MAAO,OAAA,IAAA;AAAA;AAGT,IAAI,IAAA,SAAA,CAAU,SAAS,IAAM,EAAA;AAC3B,MAAO,OAAA,KAAA;AAAA;AAGT,IAAO,OAAA,IAAA;AAAA;AACT,EAEA,MAAM,kBAEJ,GAAA;AACA,IAAA,OAAOG,0CAAmC,EAAA;AAAA;AAC5C,EAEA,MAAM,wBAEJ,GAAA;AACA,IAAA,OAAOD,6CAAsC,CAAA,CAAA,OAAA,EAAU,IAAK,CAAA,QAAQ,CAAE,CAAA,CAAA;AAAA;AACxE,EAEA,MAAM,sBAAsB,OAGG,EAAA;AAC7B,IAAM,MAAA,EAAE,gBAAmB,GAAA,OAAA;AAC3B,IAAM,MAAA,eAAA,GAAkBE,sCAA+B,CAAA,OAAA,CAAQ,UAAU,CAAA;AACzE,IAAM,MAAA,EAAE,IAAK,EAAA,GAAI,eAAgB,CAAA,SAAA;AAOjC,IAAI,IAAA,IAAA,KAAS,MAAU,IAAA,IAAA,CAAK,wBAA0B,EAAA;AACpD,MAAO,OAAA,EAAE,OAAO,EAAG,EAAA;AAAA;AAKrB,IAAA,QAAQ,IAAM;AAAA;AAAA,MAEZ,KAAK,SAAA;AACH,QAAO,OAAA,IAAA,CAAK,mBAAmB,UAAW,CAAA;AAAA,UACxC,UAAU,IAAK,CAAA,QAAA;AAAA,UACf;AAAA,SACD,CAAA;AAAA,MACH,KAAK,MAAQ,EAAA;AACX,QAAM,MAAA,EAAE,OAAU,GAAA,eAAA;AAClB,QAAA,IAAI,CAAC,KAAO,EAAA;AACV,UAAM,MAAA,IAAI,MAAM,gDAAgD,CAAA;AAAA;AAElE,QAAM,MAAA,UAAA,GAAa,MAAM,IAAA,CAAK,gBAAiB,CAAA,sBAAA;AAAA,UAC7C;AAAA,SACF;AACA,QAAO,OAAA,IAAA,CAAK,mBAAmB,UAAW,CAAA;AAAA,UACxC,UAAU,IAAK,CAAA,QAAA;AAAA,UACf,cAAA;AAAA,UACA,UAAY,EAAA;AAAA,YACV,kBAAkB,UAAW,CAAA,KAAA;AAAA,YAC7B,WAAW,UAAW,CAAA;AAAA;AACxB,SACD,CAAA;AAAA;AACH,MACA;AACE,QAAA,MAAM,IAAIJ,0BAAA;AAAA,UACR,uDAAuD,IAAI,CAAA,CAAA;AAAA,SAC7D;AAAA;AACJ;AACF,EAEA,MAAM,oBACJ,WAC6C,EAAA;AAC7C,IAAA,MAAM,EAAE,KAAA,EAAO,cAAe,EAAA,GAC5BI,uCAA+B,WAAW,CAAA;AAC5C,IAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAO,OAAA,IAAA,CAAK,gBAAiB,CAAA,sBAAA,CAAuB,cAAc,CAAA;AAAA;AACpE,EAEA,MAAM,qBAAyD,GAAA;AAC7D,IAAA,MAAM,EAAE,IAAK,EAAA,GAAI,MAAM,IAAA,CAAK,gBAAgB,QAAS,EAAA;AACrD,IAAO,OAAA,EAAE,MAAM,IAAK,CAAA,GAAA,CAAI,CAAC,EAAE,GAAA,EAAU,KAAA,GAAG,CAAE,EAAA;AAAA;AAC5C,EAEA,kBAAkB,KAAe,EAAA;AAC/B,IAAA,MAAM,EAAE,GAAA,EAAQ,GAAAK,cAAA,CAAU,KAAK,CAAA;AAC/B,IAAA,IAAI,CAAC,GAAK,EAAA;AACR,MAAM,MAAA,IAAIL,2BAAoB,kCAAkC,CAAA;AAAA;AAElE,IAAO,OAAA,IAAI,IAAK,CAAA,GAAA,GAAM,GAAI,CAAA;AAAA;AAE9B;;;;"}

package/dist/entrypoints/auth/authServiceFactory.cjs.js

@@ -7,6 +7,16 @@ var PluginTokenHandler = require('./plugin/PluginTokenHandler.cjs.js');
 var createPluginKeySource = require('./plugin/keys/createPluginKeySource.cjs.js');
 var UserTokenHandler = require('./user/UserTokenHandler.cjs.js');
 
+const pluginTokenHandlerDecoratorServiceRef = backendPluginApi.createServiceRef({
+  id: "core.auth.pluginTokenHandlerDecorator",
+  defaultFactory: async (service) => backendPluginApi.createServiceFactory({
+    service,
+    deps: {},
+    factory: async () => {
+      return (impl) => impl;
+    }
+  })
+});
 const authServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.auth,
   deps: {
@@ -14,9 +24,17 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
     logger: backendPluginApi.coreServices.rootLogger,
     discovery: backendPluginApi.coreServices.discovery,
     plugin: backendPluginApi.coreServices.pluginMetadata,
-    database: backendPluginApi.coreServices.database
+    database: backendPluginApi.coreServices.database,
+    pluginTokenHandlerDecorator: pluginTokenHandlerDecoratorServiceRef
   },
-  async factory({ config, discovery, plugin, logger, database }) {
+  async factory({
+    config,
+    discovery,
+    plugin,
+    logger,
+    database,
+    pluginTokenHandlerDecorator
+  }) {
     const disableDefaultAuthPolicy = config.getOptionalBoolean(
       "backend.auth.dangerouslyDisableDefaultAuthPolicy"
     ) ?? false;
@@ -30,13 +48,15 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
     const userTokens = UserTokenHandler.UserTokenHandler.create({
       discovery
     });
-    const pluginTokens = PluginTokenHandler.PluginTokenHandler.create({
-      ownPluginId: plugin.getId(),
-      logger,
-      keySource,
-      keyDuration,
-      discovery
-    });
+    const pluginTokens = pluginTokenHandlerDecorator(
+      PluginTokenHandler.DefaultPluginTokenHandler.create({
+        ownPluginId: plugin.getId(),
+        logger,
+        keySource,
+        keyDuration,
+        discovery
+      })
+    );
     const externalTokens = ExternalTokenHandler.ExternalTokenHandler.create({
       ownPluginId: plugin.getId(),
       config,
@@ -54,4 +74,5 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
 });
 
 exports.authServiceFactory = authServiceFactory;
+exports.pluginTokenHandlerDecoratorServiceRef = pluginTokenHandlerDecoratorServiceRef;
 //# sourceMappingURL=authServiceFactory.cjs.js.map

package/dist/entrypoints/auth/authServiceFactory.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authServiceFactory.cjs.js","sources":["../../../src/entrypoints/auth/authServiceFactory.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createServiceFactory,\n} from '@backstage/backend-plugin-api';\nimport { DefaultAuthService } from './DefaultAuthService';\nimport { ExternalTokenHandler } from './external/ExternalTokenHandler';\nimport { PluginTokenHandler } from './plugin/PluginTokenHandler';\nimport { createPluginKeySource } from './plugin/keys/createPluginKeySource';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/**\n * Handles token authentication and credentials management.\n *\n * See {@link @backstage/code-plugin-api#AuthService}\n * and {@link https://backstage.io/docs/backend-system/core-services/auth | the service docs}\n * for more information.\n *\n * @public\n */\nexport const authServiceFactory = createServiceFactory({\n  service: coreServices.auth,\n  deps: {\n    config: coreServices.rootConfig,\n    logger: coreServices.rootLogger,\n    discovery: coreServices.discovery,\n    plugin: coreServices.pluginMetadata,\n    database: coreServices.database,\n  },\n  async factory({ config, discovery, plugin, logger, database }) {\n    const disableDefaultAuthPolicy =\n      config.getOptionalBoolean(\n        'backend.auth.dangerouslyDisableDefaultAuthPolicy',\n      ) ?? false;\n\n    const keyDuration = { hours: 1 };\n\n    const keySource = await createPluginKeySource({\n      config,\n      database,\n      logger,\n      keyDuration,\n    });\n\n    const userTokens = UserTokenHandler.create({\n      discovery,\n    });\n\n    const pluginTokens = PluginTokenHandler.create({\n      ownPluginId: plugin.getId(),\n      logger,\n      keySource,\n      keyDuration,\n      discovery,\n    });\n\n    const externalTokens = ExternalTokenHandler.create({\n      ownPluginId: plugin.getId(),\n      config,\n      logger,\n    });\n\n    return new DefaultAuthService(\n      userTokens,\n      pluginTokens,\n      externalTokens,\n      plugin.getId(),\n      disableDefaultAuthPolicy,\n      keySource,\n    );\n  },\n});\n"],"names":["createServiceFactory","coreServices","createPluginKeySource","UserTokenHandler","PluginTokenHandler","ExternalTokenHandler","DefaultAuthService"],"mappings":";;;;;;;;;AAmCO,MAAM,qBAAqBA,qCAAqB,CAAA;AAAA,EACrD,SAASC,6BAAa,CAAA,IAAA;AAAA,EACtB,IAAM,EAAA;AAAA,IACJ,QAAQA,6BAAa,CAAA,UAAA;AAAA,IACrB,QAAQA,6BAAa,CAAA,UAAA;AAAA,IACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,IACxB,QAAQA,6BAAa,CAAA,cAAA;AAAA,IACrB,UAAUA,6BAAa,CAAA;AAAA,GACzB;AAAA,EACA,MAAM,QAAQ,EAAE,MAAA,EAAQ,WAAW,MAAQ,EAAA,MAAA,EAAQ,UAAY,EAAA;AAC7D,IAAA,MAAM,2BACJ,MAAO,CAAA,kBAAA;AAAA,MACL;AAAA,KACG,IAAA,KAAA;AAEP,IAAM,MAAA,WAAA,GAAc,EAAE,KAAA,EAAO,CAAE,EAAA;AAE/B,IAAM,MAAA,SAAA,GAAY,MAAMC,2CAAsB,CAAA;AAAA,MAC5C,MAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAM,MAAA,UAAA,GAAaC,kCAAiB,MAAO,CAAA;AAAA,MACzC;AAAA,KACD,CAAA;AAED,IAAM,MAAA,YAAA,GAAeC,sCAAmB,MAAO,CAAA;AAAA,MAC7C,WAAA,EAAa,OAAO,KAAM,EAAA;AAAA,MAC1B,MAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAM,MAAA,cAAA,GAAiBC,0CAAqB,MAAO,CAAA;AAAA,MACjD,WAAA,EAAa,OAAO,KAAM,EAAA;AAAA,MAC1B,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,IAAIC,qCAAA;AAAA,MACT,UAAA;AAAA,MACA,YAAA;AAAA,MACA,cAAA;AAAA,MACA,OAAO,KAAM,EAAA;AAAA,MACb,wBAAA;AAAA,MACA;AAAA,KACF;AAAA;AAEJ,CAAC;;;;"}
+{"version":3,"file":"authServiceFactory.cjs.js","sources":["../../../src/entrypoints/auth/authServiceFactory.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createServiceFactory,\n  createServiceRef,\n} from '@backstage/backend-plugin-api';\nimport { DefaultAuthService } from './DefaultAuthService';\nimport { ExternalTokenHandler } from './external/ExternalTokenHandler';\nimport {\n  DefaultPluginTokenHandler,\n  PluginTokenHandler,\n} from './plugin/PluginTokenHandler';\nimport { createPluginKeySource } from './plugin/keys/createPluginKeySource';\nimport { UserTokenHandler } from './user/UserTokenHandler';\n\n/**\n * @public\n * This service is used to decorate the default plugin token handler with custom logic.\n */\nexport const pluginTokenHandlerDecoratorServiceRef = createServiceRef<\n  (defaultImplementation: PluginTokenHandler) => PluginTokenHandler\n>({\n  id: 'core.auth.pluginTokenHandlerDecorator',\n  defaultFactory: async service =>\n    createServiceFactory({\n      service,\n      deps: {},\n      factory: async () => {\n        return impl => impl;\n      },\n    }),\n});\n\n/**\n * Handles token authentication and credentials management.\n *\n * See {@link @backstage/code-plugin-api#AuthService}\n * and {@link https://backstage.io/docs/backend-system/core-services/auth | the service docs}\n * for more information.\n *\n * @public\n */\nexport const authServiceFactory = createServiceFactory({\n  service: coreServices.auth,\n  deps: {\n    config: coreServices.rootConfig,\n    logger: coreServices.rootLogger,\n    discovery: coreServices.discovery,\n    plugin: coreServices.pluginMetadata,\n    database: coreServices.database,\n    pluginTokenHandlerDecorator: pluginTokenHandlerDecoratorServiceRef,\n  },\n  async factory({\n    config,\n    discovery,\n    plugin,\n    logger,\n    database,\n    pluginTokenHandlerDecorator,\n  }) {\n    const disableDefaultAuthPolicy =\n      config.getOptionalBoolean(\n        'backend.auth.dangerouslyDisableDefaultAuthPolicy',\n      ) ?? false;\n\n    const keyDuration = { hours: 1 };\n\n    const keySource = await createPluginKeySource({\n      config,\n      database,\n      logger,\n      keyDuration,\n    });\n\n    const userTokens = UserTokenHandler.create({\n      discovery,\n    });\n\n    const pluginTokens = pluginTokenHandlerDecorator(\n      DefaultPluginTokenHandler.create({\n        ownPluginId: plugin.getId(),\n        logger,\n        keySource,\n        keyDuration,\n        discovery,\n      }),\n    );\n\n    const externalTokens = ExternalTokenHandler.create({\n      ownPluginId: plugin.getId(),\n      config,\n      logger,\n    });\n\n    return new DefaultAuthService(\n      userTokens,\n      pluginTokens,\n      externalTokens,\n      plugin.getId(),\n      disableDefaultAuthPolicy,\n      keySource,\n    );\n  },\n});\n"],"names":["createServiceRef","createServiceFactory","coreServices","createPluginKeySource","UserTokenHandler","DefaultPluginTokenHandler","ExternalTokenHandler","DefaultAuthService"],"mappings":";;;;;;;;;AAkCO,MAAM,wCAAwCA,iCAEnD,CAAA;AAAA,EACA,EAAI,EAAA,uCAAA;AAAA,EACJ,cAAA,EAAgB,OAAM,OAAA,KACpBC,qCAAqB,CAAA;AAAA,IACnB,OAAA;AAAA,IACA,MAAM,EAAC;AAAA,IACP,SAAS,YAAY;AACnB,MAAA,OAAO,CAAQ,IAAA,KAAA,IAAA;AAAA;AACjB,GACD;AACL,CAAC;AAWM,MAAM,qBAAqBA,qCAAqB,CAAA;AAAA,EACrD,SAASC,6BAAa,CAAA,IAAA;AAAA,EACtB,IAAM,EAAA;AAAA,IACJ,QAAQA,6BAAa,CAAA,UAAA;AAAA,IACrB,QAAQA,6BAAa,CAAA,UAAA;AAAA,IACrB,WAAWA,6BAAa,CAAA,SAAA;AAAA,IACxB,QAAQA,6BAAa,CAAA,cAAA;AAAA,IACrB,UAAUA,6BAAa,CAAA,QAAA;AAAA,IACvB,2BAA6B,EAAA;AAAA,GAC/B;AAAA,EACA,MAAM,OAAQ,CAAA;AAAA,IACZ,MAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACC,EAAA;AACD,IAAA,MAAM,2BACJ,MAAO,CAAA,kBAAA;AAAA,MACL;AAAA,KACG,IAAA,KAAA;AAEP,IAAM,MAAA,WAAA,GAAc,EAAE,KAAA,EAAO,CAAE,EAAA;AAE/B,IAAM,MAAA,SAAA,GAAY,MAAMC,2CAAsB,CAAA;AAAA,MAC5C,MAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAM,MAAA,UAAA,GAAaC,kCAAiB,MAAO,CAAA;AAAA,MACzC;AAAA,KACD,CAAA;AAED,IAAA,MAAM,YAAe,GAAA,2BAAA;AAAA,MACnBC,6CAA0B,MAAO,CAAA;AAAA,QAC/B,WAAA,EAAa,OAAO,KAAM,EAAA;AAAA,QAC1B,MAAA;AAAA,QACA,SAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA,OACD;AAAA,KACH;AAEA,IAAM,MAAA,cAAA,GAAiBC,0CAAqB,MAAO,CAAA;AAAA,MACjD,WAAA,EAAa,OAAO,KAAM,EAAA;AAAA,MAC1B,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,IAAIC,qCAAA;AAAA,MACT,UAAA;AAAA,MACA,YAAA;AAAA,MACA,cAAA;AAAA,MACA,OAAO,KAAM,EAAA;AAAA,MACb,wBAAA;AAAA,MACA;AAAA,KACF;AAAA;AAEJ,CAAC;;;;;"}

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js

@@ -5,15 +5,10 @@ var errors = require('@backstage/errors');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var JwksClient = require('../JwksClient.cjs.js');
 var types = require('@backstage/types');
-var fetch = require('node-fetch');
-
-function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
-
-var fetch__default = /*#__PURE__*/_interopDefaultCompat(fetch);
 
 const SECONDS_IN_MS = 1e3;
 const ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;
-class PluginTokenHandler {
+class DefaultPluginTokenHandler {
   constructor(logger, ownPluginId, keySource, algorithm, keyDurationSeconds, discovery) {
     this.logger = logger;
     this.ownPluginId = ownPluginId;
@@ -27,7 +22,7 @@ class PluginTokenHandler {
   supportedTargetPlugins = /* @__PURE__ */ new Set();
   targetPluginInflightChecks = /* @__PURE__ */ new Map();
   static create(options) {
-    return new PluginTokenHandler(
+    return new DefaultPluginTokenHandler(
       options.logger,
       options.ownPluginId,
       options.keySource,
@@ -80,7 +75,7 @@ class PluginTokenHandler {
       ourExp,
       Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS)
     ) : ourExp;
-    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };
+    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.limitedUserToken };
     const token = await new jose.SignJWT(claims).setProtectedHeader({
       typ: pluginAuthNode.tokenTypes.plugin.typParam,
       alg: this.algorithm,
@@ -98,7 +93,7 @@ class PluginTokenHandler {
     }
     const doCheck = async () => {
       try {
-        const res = await fetch__default.default(
+        const res = await fetch(
           `${await this.discovery.getBaseUrl(
             targetPluginId
           )}/.backstage/auth/v1/jwks.json`
@@ -116,6 +111,7 @@ class PluginTokenHandler {
         this.supportedTargetPlugins.add(targetPluginId);
         return true;
       } catch (error) {
+        errors.assertError(error);
         this.logger.error("Unexpected failure for target JWKS check", error);
         return false;
       } finally {
@@ -148,5 +144,5 @@ class PluginTokenHandler {
   }
 }
 
-exports.PluginTokenHandler = PluginTokenHandler;
+exports.DefaultPluginTokenHandler = DefaultPluginTokenHandler;
 //# sourceMappingURL=PluginTokenHandler.cjs.js.map

package/dist/entrypoints/auth/plugin/PluginTokenHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\nimport fetch from 'node-fetch';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\nexport class PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new PluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private constructor(\n    private readonly logger: LoggerService,\n    private readonly ownPluginId: string,\n    private readonly keySource: PluginKeySource,\n    private readonly algorithm: string,\n    private readonly keyDurationSeconds: number,\n    private readonly discovery: DiscoveryService,\n  ) {}\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      throw new AuthenticationError('Invalid plugin token', e);\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { token: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","fetch","JwksClient"],"mappings":";;;;;;;;;;;;;AA0BA,MAAM,aAAgB,GAAA,GAAA;AAEtB,MAAM,yBAA4B,GAAA,gBAAA;AAmB3B,MAAM,kBAAmB,CAAA;AAAA,EAkBtB,YACW,MACA,EAAA,WAAA,EACA,SACA,EAAA,SAAA,EACA,oBACA,SACjB,EAAA;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA;AAChB,EAxBK,OAAA,uBAAc,GAAwB,EAAA;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAY,EAAA;AAAA,EACzC,0BAAA,uBAAiC,GAA8B,EAAA;AAAA,EAEvE,OAAO,OAAO,OAAkB,EAAA;AAC9B,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,OAAQ,CAAA,MAAA;AAAA,MACR,OAAQ,CAAA,WAAA;AAAA,MACR,OAAQ,CAAA,SAAA;AAAA,MACR,QAAQ,SAAa,IAAA,OAAA;AAAA,MACrB,KAAK,KAAM,CAAAA,4BAAA,CAAuB,OAAQ,CAAA,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAQ,CAAA;AAAA,KACV;AAAA;AACF,EAWA,MAAM,YACJ,KACqE,EAAA;AACrE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAI,IAAA,GAAA,KAAQC,yBAAW,CAAA,MAAA,CAAO,QAAU,EAAA;AACtC,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,KACM,CAAA,MAAA;AACN,MAAO,OAAA,KAAA,CAAA;AAAA;AAGT,IAAA,MAAM,QAAW,GAAA,MAAA,CAAOC,cAAU,CAAA,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAM,MAAA,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA;AAEvE,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAK,CAAA,QAAQ,CAAG,EAAA;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAM,MAAA,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAM,MAAA,EAAE,OAAQ,EAAA,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAW,CAAA,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAO,CAAA,QAAA;AAAA,QACvB,UAAU,IAAK,CAAA,WAAA;AAAA,QACf,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAK,CAAA,KAAA;AACX,MAAM,MAAA,IAAIE,0BAAoB,CAAA,sBAAA,EAAwB,CAAC,CAAA;AAAA,KACxD,CAAA;AAED,IAAO,OAAA,EAAE,SAAS,CAAU,OAAA,EAAA,OAAA,CAAQ,GAAG,CAAI,CAAA,EAAA,gBAAA,EAAkB,QAAQ,GAAI,EAAA;AAAA;AAC3E,EAEA,MAAM,WAAW,OAIc,EAAA;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAgB,EAAA,UAAA,EAAe,GAAA,OAAA;AACjD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,oBAAqB,EAAA;AAEtD,IAAA,MAAM,GAAM,GAAA,QAAA;AACZ,IAAA,MAAM,GAAM,GAAA,cAAA;AACZ,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAK,CAAA,kBAAA;AAC1B,IAAM,MAAA,GAAA,GAAM,aACR,IAAK,CAAA,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAM,CAAA,UAAA,CAAW,SAAU,CAAA,OAAA,KAAY,aAAa;AAAA,KAE3D,GAAA,MAAA;AAEJ,IAAM,MAAA,MAAA,GAAS,EAAE,GAAK,EAAA,GAAA,EAAK,KAAK,GAAK,EAAA,GAAA,EAAK,YAAY,KAAM,EAAA;AAC5D,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAQ,CAAA,MAAM,EACnC,kBAAmB,CAAA;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAO,CAAA,QAAA;AAAA,MACvB,KAAK,IAAK,CAAA,SAAA;AAAA,MACV,KAAK,GAAI,CAAA;AAAA,KACV,CACA,CAAA,WAAA,CAAY,GAAG,CACf,CAAA,UAAA,CAAW,GAAG,CACd,CAAA,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAM,EAAA;AAAA;AACjB,EAEA,MAAc,wBACZ,cACkB,EAAA;AAClB,IAAA,IAAI,IAAK,CAAA,sBAAA,CAAuB,GAAI,CAAA,cAAc,CAAG,EAAA;AACnD,MAAO,OAAA,IAAA;AAAA;AAET,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,0BAA2B,CAAA,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA;AAAA;AAGT,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAI,IAAA;AACF,QAAA,MAAM,MAAM,MAAMC,sBAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAI,IAAA,GAAA,CAAI,WAAW,GAAK,EAAA;AACtB,UAAO,OAAA,KAAA;AAAA;AAGT,QAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAA8B,2BAAA,EAAA,GAAA,CAAI,MAAM,CAAE,CAAA,CAAA;AAAA;AAG5D,QAAM,MAAA,IAAA,GAAO,MAAM,GAAA,CAAI,IAAK,EAAA;AAC5B,QAAI,IAAA,CAAC,KAAK,IAAM,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,CAA0C,wCAAA,CAAA,CAAA;AAAA;AAG5D,QAAK,IAAA,CAAA,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAO,OAAA,IAAA;AAAA,eACA,KAAO,EAAA;AACd,QAAK,IAAA,CAAA,MAAA,CAAO,KAAM,CAAA,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAO,OAAA,KAAA;AAAA,OACP,SAAA;AACA,QAAK,IAAA,CAAA,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA;AACvD,KACF;AAEA,IAAA,MAAM,QAAQ,OAAQ,EAAA;AACtB,IAAK,IAAA,CAAA,0BAAA,CAA2B,GAAI,CAAA,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,MAAc,cAAc,QAAkB,EAAA;AAC5C,IAAA,MAAM,MAAS,GAAA,IAAA,CAAK,OAAQ,CAAA,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAQ,EAAA;AACV,MAAO,OAAA,MAAA;AAAA;AAIT,IAAA,IAAI,CAAE,MAAM,IAAK,CAAA,uBAAA,CAAwB,QAAQ,CAAI,EAAA;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA;AAGF,IAAM,MAAA,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,KACD,CAAA;AAED,IAAK,IAAA,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,EAAU,SAAS,CAAA;AACpC,IAAO,OAAA,SAAA;AAAA;AAEX;;;;"}
+{"version":3,"file":"PluginTokenHandler.cjs.js","sources":["../../../../src/entrypoints/auth/plugin/PluginTokenHandler.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';\nimport { decodeJwt, importJWK, SignJWT, decodeProtectedHeader } from 'jose';\nimport { assertError, AuthenticationError } from '@backstage/errors';\nimport { jwtVerify } from 'jose';\nimport { tokenTypes } from '@backstage/plugin-auth-node';\nimport { JwksClient } from '../JwksClient';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\nimport { PluginKeySource } from './keys/types';\n\nconst SECONDS_IN_MS = 1000;\n\nconst ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;\n\ntype Options = {\n  ownPluginId: string;\n  keyDuration: HumanDuration;\n  keySource: PluginKeySource;\n  discovery: DiscoveryService;\n  logger: LoggerService;\n  /**\n   * JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\n   * Must match one of the algorithms defined for IdentityClient.\n   * When setting a different algorithm, check if the `key` field\n   * of the `signing_keys` table can fit the length of the generated keys.\n   * If not, add a knex migration file in the migrations folder.\n   * More info on supported algorithms: https://github.com/panva/jose\n   */\n  algorithm?: string;\n};\n\n/**\n * @public\n * Issues and verifies {@link https://backstage.iceio/docs/auth/service-to-service-auth | service-to-service tokens}.\n */\nexport interface PluginTokenHandler {\n  verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined>;\n  issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }>;\n}\n\nexport class DefaultPluginTokenHandler implements PluginTokenHandler {\n  private jwksMap = new Map<string, JwksClient>();\n\n  // Tracking state for isTargetPluginSupported\n  private supportedTargetPlugins = new Set<string>();\n  private targetPluginInflightChecks = new Map<string, Promise<boolean>>();\n\n  static create(options: Options) {\n    return new DefaultPluginTokenHandler(\n      options.logger,\n      options.ownPluginId,\n      options.keySource,\n      options.algorithm ?? 'ES256',\n      Math.round(durationToMilliseconds(options.keyDuration) / 1000),\n      options.discovery,\n    );\n  }\n\n  private constructor(\n    private readonly logger: LoggerService,\n    private readonly ownPluginId: string,\n    private readonly keySource: PluginKeySource,\n    private readonly algorithm: string,\n    private readonly keyDurationSeconds: number,\n    private readonly discovery: DiscoveryService,\n  ) {}\n\n  async verifyToken(\n    token: string,\n  ): Promise<{ subject: string; limitedUserToken?: string } | undefined> {\n    try {\n      const { typ } = decodeProtectedHeader(token);\n      if (typ !== tokenTypes.plugin.typParam) {\n        return undefined;\n      }\n    } catch {\n      return undefined;\n    }\n\n    const pluginId = String(decodeJwt(token).sub);\n    if (!pluginId) {\n      throw new AuthenticationError('Invalid plugin token: missing subject');\n    }\n    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new AuthenticationError(\n        'Invalid plugin token: forbidden subject format',\n      );\n    }\n\n    const jwksClient = await this.getJwksClient(pluginId);\n    await jwksClient.refreshKeyStore(token); // TODO(Rugvip): Refactor so that this isn't needed\n\n    const { payload } = await jwtVerify<{ sub: string; obo?: string }>(\n      token,\n      jwksClient.getKey,\n      {\n        typ: tokenTypes.plugin.typParam,\n        audience: this.ownPluginId,\n        requiredClaims: ['iat', 'exp', 'sub', 'aud'],\n      },\n    ).catch(e => {\n      throw new AuthenticationError('Invalid plugin token', e);\n    });\n\n    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };\n  }\n\n  async issueToken(options: {\n    pluginId: string;\n    targetPluginId: string;\n    onBehalfOf?: { limitedUserToken: string; expiresAt: Date };\n  }): Promise<{ token: string }> {\n    const { pluginId, targetPluginId, onBehalfOf } = options;\n    const key = await this.keySource.getPrivateSigningKey();\n\n    const sub = pluginId;\n    const aud = targetPluginId;\n    const iat = Math.floor(Date.now() / SECONDS_IN_MS);\n    const ourExp = iat + this.keyDurationSeconds;\n    const exp = onBehalfOf\n      ? Math.min(\n          ourExp,\n          Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS),\n        )\n      : ourExp;\n\n    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.limitedUserToken };\n    const token = await new SignJWT(claims)\n      .setProtectedHeader({\n        typ: tokenTypes.plugin.typParam,\n        alg: this.algorithm,\n        kid: key.kid,\n      })\n      .setAudience(aud)\n      .setSubject(sub)\n      .setIssuedAt(iat)\n      .setExpirationTime(exp)\n      .sign(await importJWK(key));\n\n    return { token };\n  }\n\n  private async isTargetPluginSupported(\n    targetPluginId: string,\n  ): Promise<boolean> {\n    if (this.supportedTargetPlugins.has(targetPluginId)) {\n      return true;\n    }\n    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const doCheck = async () => {\n      try {\n        const res = await fetch(\n          `${await this.discovery.getBaseUrl(\n            targetPluginId,\n          )}/.backstage/auth/v1/jwks.json`,\n        );\n        if (res.status === 404) {\n          return false;\n        }\n\n        if (!res.ok) {\n          throw new Error(`Failed to fetch jwks.json, ${res.status}`);\n        }\n\n        const data = await res.json();\n        if (!data.keys) {\n          throw new Error(`Invalid jwks.json response, missing keys`);\n        }\n\n        this.supportedTargetPlugins.add(targetPluginId);\n        return true;\n      } catch (error) {\n        assertError(error);\n        this.logger.error('Unexpected failure for target JWKS check', error);\n        return false;\n      } finally {\n        this.targetPluginInflightChecks.delete(targetPluginId);\n      }\n    };\n\n    const check = doCheck();\n    this.targetPluginInflightChecks.set(targetPluginId, check);\n    return check;\n  }\n\n  private async getJwksClient(pluginId: string) {\n    const client = this.jwksMap.get(pluginId);\n    if (client) {\n      return client;\n    }\n\n    // Double check that the target plugin has a valid JWKS endpoint, otherwise avoid creating a remote key set\n    if (!(await this.isTargetPluginSupported(pluginId))) {\n      throw new AuthenticationError(\n        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint. ` +\n          'The target plugin needs to be migrated to be installed in an app using the new backend system.',\n      );\n    }\n\n    const newClient = new JwksClient(async () => {\n      return new URL(\n        `${await this.discovery.getBaseUrl(\n          pluginId,\n        )}/.backstage/auth/v1/jwks.json`,\n      );\n    });\n\n    this.jwksMap.set(pluginId, newClient);\n    return newClient;\n  }\n}\n"],"names":["durationToMilliseconds","decodeProtectedHeader","tokenTypes","decodeJwt","AuthenticationError","jwtVerify","SignJWT","importJWK","assertError","JwksClient"],"mappings":";;;;;;;;AAyBA,MAAM,aAAgB,GAAA,GAAA;AAEtB,MAAM,yBAA4B,GAAA,gBAAA;AAkC3B,MAAM,yBAAwD,CAAA;AAAA,EAkB3D,YACW,MACA,EAAA,WAAA,EACA,SACA,EAAA,SAAA,EACA,oBACA,SACjB,EAAA;AANiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA;AAChB,EAxBK,OAAA,uBAAc,GAAwB,EAAA;AAAA;AAAA,EAGtC,sBAAA,uBAA6B,GAAY,EAAA;AAAA,EACzC,0BAAA,uBAAiC,GAA8B,EAAA;AAAA,EAEvE,OAAO,OAAO,OAAkB,EAAA;AAC9B,IAAA,OAAO,IAAI,yBAAA;AAAA,MACT,OAAQ,CAAA,MAAA;AAAA,MACR,OAAQ,CAAA,WAAA;AAAA,MACR,OAAQ,CAAA,SAAA;AAAA,MACR,QAAQ,SAAa,IAAA,OAAA;AAAA,MACrB,KAAK,KAAM,CAAAA,4BAAA,CAAuB,OAAQ,CAAA,WAAW,IAAI,GAAI,CAAA;AAAA,MAC7D,OAAQ,CAAA;AAAA,KACV;AAAA;AACF,EAWA,MAAM,YACJ,KACqE,EAAA;AACrE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,GAAA,EAAQ,GAAAC,0BAAA,CAAsB,KAAK,CAAA;AAC3C,MAAI,IAAA,GAAA,KAAQC,yBAAW,CAAA,MAAA,CAAO,QAAU,EAAA;AACtC,QAAO,OAAA,KAAA,CAAA;AAAA;AACT,KACM,CAAA,MAAA;AACN,MAAO,OAAA,KAAA,CAAA;AAAA;AAGT,IAAA,MAAM,QAAW,GAAA,MAAA,CAAOC,cAAU,CAAA,KAAK,EAAE,GAAG,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAM,MAAA,IAAIC,2BAAoB,uCAAuC,CAAA;AAAA;AAEvE,IAAA,IAAI,CAAC,yBAAA,CAA0B,IAAK,CAAA,QAAQ,CAAG,EAAA;AAC7C,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,UAAa,GAAA,MAAM,IAAK,CAAA,aAAA,CAAc,QAAQ,CAAA;AACpD,IAAM,MAAA,UAAA,CAAW,gBAAgB,KAAK,CAAA;AAEtC,IAAM,MAAA,EAAE,OAAQ,EAAA,GAAI,MAAMC,cAAA;AAAA,MACxB,KAAA;AAAA,MACA,UAAW,CAAA,MAAA;AAAA,MACX;AAAA,QACE,GAAA,EAAKH,0BAAW,MAAO,CAAA,QAAA;AAAA,QACvB,UAAU,IAAK,CAAA,WAAA;AAAA,QACf,cAAgB,EAAA,CAAC,KAAO,EAAA,KAAA,EAAO,OAAO,KAAK;AAAA;AAC7C,KACF,CAAE,MAAM,CAAK,CAAA,KAAA;AACX,MAAM,MAAA,IAAIE,0BAAoB,CAAA,sBAAA,EAAwB,CAAC,CAAA;AAAA,KACxD,CAAA;AAED,IAAO,OAAA,EAAE,SAAS,CAAU,OAAA,EAAA,OAAA,CAAQ,GAAG,CAAI,CAAA,EAAA,gBAAA,EAAkB,QAAQ,GAAI,EAAA;AAAA;AAC3E,EAEA,MAAM,WAAW,OAIc,EAAA;AAC7B,IAAA,MAAM,EAAE,QAAA,EAAU,cAAgB,EAAA,UAAA,EAAe,GAAA,OAAA;AACjD,IAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,oBAAqB,EAAA;AAEtD,IAAA,MAAM,GAAM,GAAA,QAAA;AACZ,IAAA,MAAM,GAAM,GAAA,cAAA;AACZ,IAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,aAAa,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAK,CAAA,kBAAA;AAC1B,IAAM,MAAA,GAAA,GAAM,aACR,IAAK,CAAA,GAAA;AAAA,MACH,MAAA;AAAA,MACA,KAAK,KAAM,CAAA,UAAA,CAAW,SAAU,CAAA,OAAA,KAAY,aAAa;AAAA,KAE3D,GAAA,MAAA;AAEJ,IAAM,MAAA,MAAA,GAAS,EAAE,GAAK,EAAA,GAAA,EAAK,KAAK,GAAK,EAAA,GAAA,EAAK,YAAY,gBAAiB,EAAA;AACvE,IAAA,MAAM,QAAQ,MAAM,IAAIE,YAAQ,CAAA,MAAM,EACnC,kBAAmB,CAAA;AAAA,MAClB,GAAA,EAAKJ,0BAAW,MAAO,CAAA,QAAA;AAAA,MACvB,KAAK,IAAK,CAAA,SAAA;AAAA,MACV,KAAK,GAAI,CAAA;AAAA,KACV,CACA,CAAA,WAAA,CAAY,GAAG,CACf,CAAA,UAAA,CAAW,GAAG,CACd,CAAA,WAAA,CAAY,GAAG,CAAA,CACf,kBAAkB,GAAG,CAAA,CACrB,KAAK,MAAMK,cAAA,CAAU,GAAG,CAAC,CAAA;AAE5B,IAAA,OAAO,EAAE,KAAM,EAAA;AAAA;AACjB,EAEA,MAAc,wBACZ,cACkB,EAAA;AAClB,IAAA,IAAI,IAAK,CAAA,sBAAA,CAAuB,GAAI,CAAA,cAAc,CAAG,EAAA;AACnD,MAAO,OAAA,IAAA;AAAA;AAET,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,0BAA2B,CAAA,GAAA,CAAI,cAAc,CAAA;AACnE,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA;AAAA;AAGT,IAAA,MAAM,UAAU,YAAY;AAC1B,MAAI,IAAA;AACF,QAAA,MAAM,MAAM,MAAM,KAAA;AAAA,UAChB,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,YACtB;AAAA,WACD,CAAA,6BAAA;AAAA,SACH;AACA,QAAI,IAAA,GAAA,CAAI,WAAW,GAAK,EAAA;AACtB,UAAO,OAAA,KAAA;AAAA;AAGT,QAAI,IAAA,CAAC,IAAI,EAAI,EAAA;AACX,UAAA,MAAM,IAAI,KAAA,CAAM,CAA8B,2BAAA,EAAA,GAAA,CAAI,MAAM,CAAE,CAAA,CAAA;AAAA;AAG5D,QAAM,MAAA,IAAA,GAAO,MAAM,GAAA,CAAI,IAAK,EAAA;AAC5B,QAAI,IAAA,CAAC,KAAK,IAAM,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,CAA0C,wCAAA,CAAA,CAAA;AAAA;AAG5D,QAAK,IAAA,CAAA,sBAAA,CAAuB,IAAI,cAAc,CAAA;AAC9C,QAAO,OAAA,IAAA;AAAA,eACA,KAAO,EAAA;AACd,QAAAC,kBAAA,CAAY,KAAK,CAAA;AACjB,QAAK,IAAA,CAAA,MAAA,CAAO,KAAM,CAAA,0CAAA,EAA4C,KAAK,CAAA;AACnE,QAAO,OAAA,KAAA;AAAA,OACP,SAAA;AACA,QAAK,IAAA,CAAA,0BAAA,CAA2B,OAAO,cAAc,CAAA;AAAA;AACvD,KACF;AAEA,IAAA,MAAM,QAAQ,OAAQ,EAAA;AACtB,IAAK,IAAA,CAAA,0BAAA,CAA2B,GAAI,CAAA,cAAA,EAAgB,KAAK,CAAA;AACzD,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,MAAc,cAAc,QAAkB,EAAA;AAC5C,IAAA,MAAM,MAAS,GAAA,IAAA,CAAK,OAAQ,CAAA,GAAA,CAAI,QAAQ,CAAA;AACxC,IAAA,IAAI,MAAQ,EAAA;AACV,MAAO,OAAA,MAAA;AAAA;AAIT,IAAA,IAAI,CAAE,MAAM,IAAK,CAAA,uBAAA,CAAwB,QAAQ,CAAI,EAAA;AACnD,MAAA,MAAM,IAAIJ,0BAAA;AAAA,QACR,6CAA6C,QAAQ,CAAA,mJAAA;AAAA,OAEvD;AAAA;AAGF,IAAM,MAAA,SAAA,GAAY,IAAIK,qBAAA,CAAW,YAAY;AAC3C,MAAA,OAAO,IAAI,GAAA;AAAA,QACT,CAAA,EAAG,MAAM,IAAA,CAAK,SAAU,CAAA,UAAA;AAAA,UACtB;AAAA,SACD,CAAA,6BAAA;AAAA,OACH;AAAA,KACD,CAAA;AAED,IAAK,IAAA,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,EAAU,SAAS,CAAA;AACpC,IAAO,OAAA,SAAA;AAAA;AAEX;;;;"}

package/dist/entrypoints/cache/CacheManager.cjs.js

@@ -23,7 +23,6 @@ class CacheManager {
   logger;
   store;
   connection;
-  useRedisSets;
   errorHandler;
   defaultTtl;
   /**
@@ -36,10 +35,14 @@ class CacheManager {
     const store = config$1.getOptionalString("backend.cache.store") || "memory";
     const defaultTtlConfig = config$1.getOptional("backend.cache.defaultTtl");
     const connectionString = config$1.getOptionalString("backend.cache.connection") || "";
-    const useRedisSets = config$1.getOptionalBoolean("backend.cache.useRedisSets") ?? true;
     const logger = options.logger?.child({
       type: "cacheManager"
     });
+    if (config$1.has("backend.cache.useRedisSets")) {
+      logger?.warn(
+        "The 'backend.cache.useRedisSets' configuration key is deprecated and no longer has any effect. The underlying '@keyv/redis' library no longer supports redis sets."
+      );
+    }
     let defaultTtl;
     if (defaultTtlConfig !== void 0) {
       if (typeof defaultTtlConfig === "number") {
@@ -53,21 +56,19 @@ class CacheManager {
     return new CacheManager(
       store,
       connectionString,
-      useRedisSets,
       options.onError,
       logger,
       defaultTtl
     );
   }
   /** @internal */
-  constructor(store, connectionString, useRedisSets, errorHandler, logger, defaultTtl) {
+  constructor(store, connectionString, errorHandler, logger, defaultTtl) {
     if (!this.storeFactories.hasOwnProperty(store)) {
       throw new Error(`Unknown cache store: ${store}`);
     }
     this.logger = logger;
     this.store = store;
     this.connection = connectionString;
-    this.useRedisSets = useRedisSets;
     this.errorHandler = errorHandler;
     this.defaultTtl = defaultTtl;
   }
@@ -91,14 +92,14 @@ class CacheManager {
     return this.storeFactories[this.store](pluginId, ttl);
   }
   createRedisStoreFactory() {
-    const KeyvRedis = require("@keyv/redis");
-    let store;
+    const KeyvRedis = require("@keyv/redis").default;
+    const stores = {};
     return (pluginId, defaultTtl) => {
-      if (!store) {
-        store = new KeyvRedis(this.connection, {
-          useRedisSets: this.useRedisSets
+      if (!stores[pluginId]) {
+        stores[pluginId] = new KeyvRedis(this.connection, {
+          keyPrefixSeparator: ":"
         });
-        store.on("error", (err) => {
+        stores[pluginId].on("error", (err) => {
           this.logger?.error("Failed to create redis cache client", err);
           this.errorHandler?.(err);
         });
@@ -106,19 +107,19 @@ class CacheManager {
       return new Keyv__default.default({
         namespace: pluginId,
         ttl: defaultTtl,
-        store,
+        store: stores[pluginId],
         emitErrors: false,
-        useRedisSets: this.useRedisSets
+        useKeyPrefix: false
       });
     };
   }
   createMemcacheStoreFactory() {
-    const KeyvMemcache = require("@keyv/memcache");
-    let store;
+    const KeyvMemcache = require("@keyv/memcache").default;
+    const stores = {};
     return (pluginId, defaultTtl) => {
-      if (!store) {
-        store = new KeyvMemcache(this.connection);
-        store.on("error", (err) => {
+      if (!stores[pluginId]) {
+        stores[pluginId] = new KeyvMemcache(this.connection);
+        stores[pluginId].on("error", (err) => {
           this.logger?.error("Failed to create memcache cache client", err);
           this.errorHandler?.(err);
         });
@@ -127,7 +128,7 @@ class CacheManager {
         namespace: pluginId,
         ttl: defaultTtl,
         emitErrors: false,
-        store
+        store: stores[pluginId]
       });
     };
   }

package/dist/entrypoints/cache/CacheManager.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"CacheManager.cjs.js","sources":["../../../src/entrypoints/cache/CacheManager.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  CacheService,\n  CacheServiceOptions,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport Keyv from 'keyv';\nimport { DefaultCacheClient } from './CacheClient';\nimport { CacheManagerOptions, ttlToMilliseconds } from './types';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { readDurationFromConfig } from '@backstage/config';\n\ntype StoreFactory = (pluginId: string, defaultTtl: number | undefined) => Keyv;\n\n/**\n * Implements a Cache Manager which will automatically create new cache clients\n * for plugins when requested. All requested cache clients are created with the\n * connection details provided.\n *\n * @public\n */\nexport class CacheManager {\n  /**\n   * Keys represent supported `backend.cache.store` values, mapped to factories\n   * that return Keyv instances appropriate to the store.\n   */\n  private readonly storeFactories = {\n    redis: this.createRedisStoreFactory(),\n    memcache: this.createMemcacheStoreFactory(),\n    memory: this.createMemoryStoreFactory(),\n  };\n\n  private readonly logger?: LoggerService;\n  private readonly store: keyof CacheManager['storeFactories'];\n  private readonly connection: string;\n  private readonly useRedisSets: boolean;\n  private readonly errorHandler: CacheManagerOptions['onError'];\n  private readonly defaultTtl?: number;\n\n  /**\n   * Creates a new {@link CacheManager} instance by reading from the `backend`\n   * config section, specifically the `.cache` key.\n   *\n   * @param config - The loaded application configuration.\n   */\n  static fromConfig(\n    config: RootConfigService,\n    options: CacheManagerOptions = {},\n  ): CacheManager {\n    // If no `backend.cache` config is provided, instantiate the CacheManager\n    // with an in-memory cache client.\n    const store = config.getOptionalString('backend.cache.store') || 'memory';\n    const defaultTtlConfig = config.getOptional('backend.cache.defaultTtl');\n    const connectionString =\n      config.getOptionalString('backend.cache.connection') || '';\n    const useRedisSets =\n      config.getOptionalBoolean('backend.cache.useRedisSets') ?? true;\n    const logger = options.logger?.child({\n      type: 'cacheManager',\n    });\n\n    let defaultTtl: number | undefined;\n    if (defaultTtlConfig !== undefined) {\n      if (typeof defaultTtlConfig === 'number') {\n        defaultTtl = defaultTtlConfig;\n      } else {\n        defaultTtl = durationToMilliseconds(\n          readDurationFromConfig(config, { key: 'backend.cache.defaultTtl' }),\n        );\n      }\n    }\n\n    return new CacheManager(\n      store,\n      connectionString,\n      useRedisSets,\n      options.onError,\n      logger,\n      defaultTtl,\n    );\n  }\n\n  /** @internal */\n  constructor(\n    store: string,\n    connectionString: string,\n    useRedisSets: boolean,\n    errorHandler: CacheManagerOptions['onError'],\n    logger?: LoggerService,\n    defaultTtl?: number,\n  ) {\n    if (!this.storeFactories.hasOwnProperty(store)) {\n      throw new Error(`Unknown cache store: ${store}`);\n    }\n    this.logger = logger;\n    this.store = store as keyof CacheManager['storeFactories'];\n    this.connection = connectionString;\n    this.useRedisSets = useRedisSets;\n    this.errorHandler = errorHandler;\n    this.defaultTtl = defaultTtl;\n  }\n\n  /**\n   * Generates a PluginCacheManager for consumption by plugins.\n   *\n   * @param pluginId - The plugin that the cache manager should be created for.\n   *        Plugin names should be unique.\n   */\n  forPlugin(pluginId: string): CacheService {\n    const clientFactory = (options: CacheServiceOptions) => {\n      const ttl = options.defaultTtl ?? this.defaultTtl;\n      return this.getClientWithTtl(\n        pluginId,\n        ttl !== undefined ? ttlToMilliseconds(ttl) : undefined,\n      );\n    };\n\n    return new DefaultCacheClient(clientFactory({}), clientFactory, {});\n  }\n\n  private getClientWithTtl(pluginId: string, ttl: number | undefined): Keyv {\n    return this.storeFactories[this.store](pluginId, ttl);\n  }\n\n  private createRedisStoreFactory(): StoreFactory {\n    const KeyvRedis = require('@keyv/redis');\n    let store: typeof KeyvRedis | undefined;\n    return (pluginId, defaultTtl) => {\n      if (!store) {\n        store = new KeyvRedis(this.connection, {\n          useRedisSets: this.useRedisSets,\n        });\n        // Always provide an error handler to avoid stopping the process\n        store.on('error', (err: Error) => {\n          this.logger?.error('Failed to create redis cache client', err);\n          this.errorHandler?.(err);\n        });\n      }\n      return new Keyv({\n        namespace: pluginId,\n        ttl: defaultTtl,\n        store,\n        emitErrors: false,\n        useRedisSets: this.useRedisSets,\n      });\n    };\n  }\n\n  private createMemcacheStoreFactory(): StoreFactory {\n    const KeyvMemcache = require('@keyv/memcache');\n    let store: typeof KeyvMemcache | undefined;\n    return (pluginId, defaultTtl) => {\n      if (!store) {\n        store = new KeyvMemcache(this.connection);\n        // Always provide an error handler to avoid stopping the process\n        store.on('error', (err: Error) => {\n          this.logger?.error('Failed to create memcache cache client', err);\n          this.errorHandler?.(err);\n        });\n      }\n      return new Keyv({\n        namespace: pluginId,\n        ttl: defaultTtl,\n        emitErrors: false,\n        store,\n      });\n    };\n  }\n\n  private createMemoryStoreFactory(): StoreFactory {\n    const store = new Map();\n    return (pluginId, defaultTtl) =>\n      new Keyv({\n        namespace: pluginId,\n        ttl: defaultTtl,\n        emitErrors: false,\n        store,\n      });\n  }\n}\n"],"names":["config","durationToMilliseconds","readDurationFromConfig","ttlToMilliseconds","DefaultCacheClient","Keyv"],"mappings":";;;;;;;;;;;;AAqCO,MAAM,YAAa,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKP,cAAiB,GAAA;AAAA,IAChC,KAAA,EAAO,KAAK,uBAAwB,EAAA;AAAA,IACpC,QAAA,EAAU,KAAK,0BAA2B,EAAA;AAAA,IAC1C,MAAA,EAAQ,KAAK,wBAAyB;AAAA,GACxC;AAAA,EAEiB,MAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,OAAO,UAAA,CACLA,QACA,EAAA,OAAA,GAA+B,EACjB,EAAA;AAGd,IAAA,MAAM,KAAQ,GAAAA,QAAA,CAAO,iBAAkB,CAAA,qBAAqB,CAAK,IAAA,QAAA;AACjE,IAAM,MAAA,gBAAA,GAAmBA,QAAO,CAAA,WAAA,CAAY,0BAA0B,CAAA;AACtE,IAAA,MAAM,gBACJ,GAAAA,QAAA,CAAO,iBAAkB,CAAA,0BAA0B,CAAK,IAAA,EAAA;AAC1D,IAAA,MAAM,YACJ,GAAAA,QAAA,CAAO,kBAAmB,CAAA,4BAA4B,CAAK,IAAA,IAAA;AAC7D,IAAM,MAAA,MAAA,GAAS,OAAQ,CAAA,MAAA,EAAQ,KAAM,CAAA;AAAA,MACnC,IAAM,EAAA;AAAA,KACP,CAAA;AAED,IAAI,IAAA,UAAA;AACJ,IAAA,IAAI,qBAAqB,KAAW,CAAA,EAAA;AAClC,MAAI,IAAA,OAAO,qBAAqB,QAAU,EAAA;AACxC,QAAa,UAAA,GAAA,gBAAA;AAAA,OACR,MAAA;AACL,QAAa,UAAA,GAAAC,4BAAA;AAAA,UACXC,6BAAuB,CAAAF,QAAA,EAAQ,EAAE,GAAA,EAAK,4BAA4B;AAAA,SACpE;AAAA;AACF;AAGF,IAAA,OAAO,IAAI,YAAA;AAAA,MACT,KAAA;AAAA,MACA,gBAAA;AAAA,MACA,YAAA;AAAA,MACA,OAAQ,CAAA,OAAA;AAAA,MACR,MAAA;AAAA,MACA;AAAA,KACF;AAAA;AACF;AAAA,EAGA,YACE,KACA,EAAA,gBAAA,EACA,YACA,EAAA,YAAA,EACA,QACA,UACA,EAAA;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,cAAe,CAAA,cAAA,CAAe,KAAK,CAAG,EAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAwB,qBAAA,EAAA,KAAK,CAAE,CAAA,CAAA;AAAA;AAEjD,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA;AACd,IAAA,IAAA,CAAK,KAAQ,GAAA,KAAA;AACb,IAAA,IAAA,CAAK,UAAa,GAAA,gBAAA;AAClB,IAAA,IAAA,CAAK,YAAe,GAAA,YAAA;AACpB,IAAA,IAAA,CAAK,YAAe,GAAA,YAAA;AACpB,IAAA,IAAA,CAAK,UAAa,GAAA,UAAA;AAAA;AACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,QAAgC,EAAA;AACxC,IAAM,MAAA,aAAA,GAAgB,CAAC,OAAiC,KAAA;AACtD,MAAM,MAAA,GAAA,GAAM,OAAQ,CAAA,UAAA,IAAc,IAAK,CAAA,UAAA;AACvC,MAAA,OAAO,IAAK,CAAA,gBAAA;AAAA,QACV,QAAA;AAAA,QACA,GAAQ,KAAA,KAAA,CAAA,GAAYG,yBAAkB,CAAA,GAAG,CAAI,GAAA,KAAA;AAAA,OAC/C;AAAA,KACF;AAEA,IAAO,OAAA,IAAIC,+BAAmB,aAAc,CAAA,EAAE,CAAG,EAAA,aAAA,EAAe,EAAE,CAAA;AAAA;AACpE,EAEQ,gBAAA,CAAiB,UAAkB,GAA+B,EAAA;AACxE,IAAA,OAAO,KAAK,cAAe,CAAA,IAAA,CAAK,KAAK,CAAA,CAAE,UAAU,GAAG,CAAA;AAAA;AACtD,EAEQ,uBAAwC,GAAA;AAC9C,IAAM,MAAA,SAAA,GAAY,QAAQ,aAAa,CAAA;AACvC,IAAI,IAAA,KAAA;AACJ,IAAO,OAAA,CAAC,UAAU,UAAe,KAAA;AAC/B,MAAA,IAAI,CAAC,KAAO,EAAA;AACV,QAAQ,KAAA,GAAA,IAAI,SAAU,CAAA,IAAA,CAAK,UAAY,EAAA;AAAA,UACrC,cAAc,IAAK,CAAA;AAAA,SACpB,CAAA;AAED,QAAM,KAAA,CAAA,EAAA,CAAG,OAAS,EAAA,CAAC,GAAe,KAAA;AAChC,UAAK,IAAA,CAAA,MAAA,EAAQ,KAAM,CAAA,qCAAA,EAAuC,GAAG,CAAA;AAC7D,UAAA,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,SACxB,CAAA;AAAA;AAEH,MAAA,OAAO,IAAIC,qBAAK,CAAA;AAAA,QACd,SAAW,EAAA,QAAA;AAAA,QACX,GAAK,EAAA,UAAA;AAAA,QACL,KAAA;AAAA,QACA,UAAY,EAAA,KAAA;AAAA,QACZ,cAAc,IAAK,CAAA;AAAA,OACpB,CAAA;AAAA,KACH;AAAA;AACF,EAEQ,0BAA2C,GAAA;AACjD,IAAM,MAAA,YAAA,GAAe,QAAQ,gBAAgB,CAAA;AAC7C,IAAI,IAAA,KAAA;AACJ,IAAO,OAAA,CAAC,UAAU,UAAe,KAAA;AAC/B,MAAA,IAAI,CAAC,KAAO,EAAA;AACV,QAAQ,KAAA,GAAA,IAAI,YAAa,CAAA,IAAA,CAAK,UAAU,CAAA;AAExC,QAAM,KAAA,CAAA,EAAA,CAAG,OAAS,EAAA,CAAC,GAAe,KAAA;AAChC,UAAK,IAAA,CAAA,MAAA,EAAQ,KAAM,CAAA,wCAAA,EAA0C,GAAG,CAAA;AAChE,UAAA,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,SACxB,CAAA;AAAA;AAEH,MAAA,OAAO,IAAIA,qBAAK,CAAA;AAAA,QACd,SAAW,EAAA,QAAA;AAAA,QACX,GAAK,EAAA,UAAA;AAAA,QACL,UAAY,EAAA,KAAA;AAAA,QACZ;AAAA,OACD,CAAA;AAAA,KACH;AAAA;AACF,EAEQ,wBAAyC,GAAA;AAC/C,IAAM,MAAA,KAAA,uBAAY,GAAI,EAAA;AACtB,IAAA,OAAO,CAAC,QAAA,EAAU,UAChB,KAAA,IAAIA,qBAAK,CAAA;AAAA,MACP,SAAW,EAAA,QAAA;AAAA,MACX,GAAK,EAAA,UAAA;AAAA,MACL,UAAY,EAAA,KAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA;AAEP;;;;"}
+{"version":3,"file":"CacheManager.cjs.js","sources":["../../../src/entrypoints/cache/CacheManager.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  CacheService,\n  CacheServiceOptions,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport Keyv from 'keyv';\nimport { DefaultCacheClient } from './CacheClient';\nimport { CacheManagerOptions, ttlToMilliseconds } from './types';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { readDurationFromConfig } from '@backstage/config';\n\ntype StoreFactory = (pluginId: string, defaultTtl: number | undefined) => Keyv;\n\n/**\n * Implements a Cache Manager which will automatically create new cache clients\n * for plugins when requested. All requested cache clients are created with the\n * connection details provided.\n *\n * @public\n */\nexport class CacheManager {\n  /**\n   * Keys represent supported `backend.cache.store` values, mapped to factories\n   * that return Keyv instances appropriate to the store.\n   */\n  private readonly storeFactories = {\n    redis: this.createRedisStoreFactory(),\n    memcache: this.createMemcacheStoreFactory(),\n    memory: this.createMemoryStoreFactory(),\n  };\n\n  private readonly logger?: LoggerService;\n  private readonly store: keyof CacheManager['storeFactories'];\n  private readonly connection: string;\n  private readonly errorHandler: CacheManagerOptions['onError'];\n  private readonly defaultTtl?: number;\n\n  /**\n   * Creates a new {@link CacheManager} instance by reading from the `backend`\n   * config section, specifically the `.cache` key.\n   *\n   * @param config - The loaded application configuration.\n   */\n  static fromConfig(\n    config: RootConfigService,\n    options: CacheManagerOptions = {},\n  ): CacheManager {\n    // If no `backend.cache` config is provided, instantiate the CacheManager\n    // with an in-memory cache client.\n    const store = config.getOptionalString('backend.cache.store') || 'memory';\n    const defaultTtlConfig = config.getOptional('backend.cache.defaultTtl');\n    const connectionString =\n      config.getOptionalString('backend.cache.connection') || '';\n    const logger = options.logger?.child({\n      type: 'cacheManager',\n    });\n\n    if (config.has('backend.cache.useRedisSets')) {\n      logger?.warn(\n        \"The 'backend.cache.useRedisSets' configuration key is deprecated and no longer has any effect. The underlying '@keyv/redis' library no longer supports redis sets.\",\n      );\n    }\n\n    let defaultTtl: number | undefined;\n    if (defaultTtlConfig !== undefined) {\n      if (typeof defaultTtlConfig === 'number') {\n        defaultTtl = defaultTtlConfig;\n      } else {\n        defaultTtl = durationToMilliseconds(\n          readDurationFromConfig(config, { key: 'backend.cache.defaultTtl' }),\n        );\n      }\n    }\n\n    return new CacheManager(\n      store,\n      connectionString,\n      options.onError,\n      logger,\n      defaultTtl,\n    );\n  }\n\n  /** @internal */\n  constructor(\n    store: string,\n    connectionString: string,\n    errorHandler: CacheManagerOptions['onError'],\n    logger?: LoggerService,\n    defaultTtl?: number,\n  ) {\n    if (!this.storeFactories.hasOwnProperty(store)) {\n      throw new Error(`Unknown cache store: ${store}`);\n    }\n    this.logger = logger;\n    this.store = store as keyof CacheManager['storeFactories'];\n    this.connection = connectionString;\n    this.errorHandler = errorHandler;\n    this.defaultTtl = defaultTtl;\n  }\n\n  /**\n   * Generates a PluginCacheManager for consumption by plugins.\n   *\n   * @param pluginId - The plugin that the cache manager should be created for.\n   *        Plugin names should be unique.\n   */\n  forPlugin(pluginId: string): CacheService {\n    const clientFactory = (options: CacheServiceOptions) => {\n      const ttl = options.defaultTtl ?? this.defaultTtl;\n      return this.getClientWithTtl(\n        pluginId,\n        ttl !== undefined ? ttlToMilliseconds(ttl) : undefined,\n      );\n    };\n\n    return new DefaultCacheClient(clientFactory({}), clientFactory, {});\n  }\n\n  private getClientWithTtl(pluginId: string, ttl: number | undefined): Keyv {\n    return this.storeFactories[this.store](pluginId, ttl);\n  }\n\n  private createRedisStoreFactory(): StoreFactory {\n    const KeyvRedis = require('@keyv/redis').default;\n    const stores: Record<string, typeof KeyvRedis> = {};\n\n    return (pluginId, defaultTtl) => {\n      if (!stores[pluginId]) {\n        stores[pluginId] = new KeyvRedis(this.connection, {\n          keyPrefixSeparator: ':',\n        });\n        // Always provide an error handler to avoid stopping the process\n        stores[pluginId].on('error', (err: Error) => {\n          this.logger?.error('Failed to create redis cache client', err);\n          this.errorHandler?.(err);\n        });\n      }\n      return new Keyv({\n        namespace: pluginId,\n        ttl: defaultTtl,\n        store: stores[pluginId],\n        emitErrors: false,\n        useKeyPrefix: false,\n      });\n    };\n  }\n\n  private createMemcacheStoreFactory(): StoreFactory {\n    const KeyvMemcache = require('@keyv/memcache').default;\n    const stores: Record<string, typeof KeyvMemcache> = {};\n\n    return (pluginId, defaultTtl) => {\n      if (!stores[pluginId]) {\n        stores[pluginId] = new KeyvMemcache(this.connection);\n        // Always provide an error handler to avoid stopping the process\n        stores[pluginId].on('error', (err: Error) => {\n          this.logger?.error('Failed to create memcache cache client', err);\n          this.errorHandler?.(err);\n        });\n      }\n      return new Keyv({\n        namespace: pluginId,\n        ttl: defaultTtl,\n        emitErrors: false,\n        store: stores[pluginId],\n      });\n    };\n  }\n\n  private createMemoryStoreFactory(): StoreFactory {\n    const store = new Map();\n    return (pluginId, defaultTtl) =>\n      new Keyv({\n        namespace: pluginId,\n        ttl: defaultTtl,\n        emitErrors: false,\n        store,\n      });\n  }\n}\n"],"names":["config","durationToMilliseconds","readDurationFromConfig","ttlToMilliseconds","DefaultCacheClient","Keyv"],"mappings":";;;;;;;;;;;;AAqCO,MAAM,YAAa,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKP,cAAiB,GAAA;AAAA,IAChC,KAAA,EAAO,KAAK,uBAAwB,EAAA;AAAA,IACpC,QAAA,EAAU,KAAK,0BAA2B,EAAA;AAAA,IAC1C,MAAA,EAAQ,KAAK,wBAAyB;AAAA,GACxC;AAAA,EAEiB,MAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,OAAO,UAAA,CACLA,QACA,EAAA,OAAA,GAA+B,EACjB,EAAA;AAGd,IAAA,MAAM,KAAQ,GAAAA,QAAA,CAAO,iBAAkB,CAAA,qBAAqB,CAAK,IAAA,QAAA;AACjE,IAAM,MAAA,gBAAA,GAAmBA,QAAO,CAAA,WAAA,CAAY,0BAA0B,CAAA;AACtE,IAAA,MAAM,gBACJ,GAAAA,QAAA,CAAO,iBAAkB,CAAA,0BAA0B,CAAK,IAAA,EAAA;AAC1D,IAAM,MAAA,MAAA,GAAS,OAAQ,CAAA,MAAA,EAAQ,KAAM,CAAA;AAAA,MACnC,IAAM,EAAA;AAAA,KACP,CAAA;AAED,IAAI,IAAAA,QAAA,CAAO,GAAI,CAAA,4BAA4B,CAAG,EAAA;AAC5C,MAAQ,MAAA,EAAA,IAAA;AAAA,QACN;AAAA,OACF;AAAA;AAGF,IAAI,IAAA,UAAA;AACJ,IAAA,IAAI,qBAAqB,KAAW,CAAA,EAAA;AAClC,MAAI,IAAA,OAAO,qBAAqB,QAAU,EAAA;AACxC,QAAa,UAAA,GAAA,gBAAA;AAAA,OACR,MAAA;AACL,QAAa,UAAA,GAAAC,4BAAA;AAAA,UACXC,6BAAuB,CAAAF,QAAA,EAAQ,EAAE,GAAA,EAAK,4BAA4B;AAAA,SACpE;AAAA;AACF;AAGF,IAAA,OAAO,IAAI,YAAA;AAAA,MACT,KAAA;AAAA,MACA,gBAAA;AAAA,MACA,OAAQ,CAAA,OAAA;AAAA,MACR,MAAA;AAAA,MACA;AAAA,KACF;AAAA;AACF;AAAA,EAGA,WACE,CAAA,KAAA,EACA,gBACA,EAAA,YAAA,EACA,QACA,UACA,EAAA;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,cAAe,CAAA,cAAA,CAAe,KAAK,CAAG,EAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAwB,qBAAA,EAAA,KAAK,CAAE,CAAA,CAAA;AAAA;AAEjD,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA;AACd,IAAA,IAAA,CAAK,KAAQ,GAAA,KAAA;AACb,IAAA,IAAA,CAAK,UAAa,GAAA,gBAAA;AAClB,IAAA,IAAA,CAAK,YAAe,GAAA,YAAA;AACpB,IAAA,IAAA,CAAK,UAAa,GAAA,UAAA;AAAA;AACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,QAAgC,EAAA;AACxC,IAAM,MAAA,aAAA,GAAgB,CAAC,OAAiC,KAAA;AACtD,MAAM,MAAA,GAAA,GAAM,OAAQ,CAAA,UAAA,IAAc,IAAK,CAAA,UAAA;AACvC,MAAA,OAAO,IAAK,CAAA,gBAAA;AAAA,QACV,QAAA;AAAA,QACA,GAAQ,KAAA,KAAA,CAAA,GAAYG,yBAAkB,CAAA,GAAG,CAAI,GAAA,KAAA;AAAA,OAC/C;AAAA,KACF;AAEA,IAAO,OAAA,IAAIC,+BAAmB,aAAc,CAAA,EAAE,CAAG,EAAA,aAAA,EAAe,EAAE,CAAA;AAAA;AACpE,EAEQ,gBAAA,CAAiB,UAAkB,GAA+B,EAAA;AACxE,IAAA,OAAO,KAAK,cAAe,CAAA,IAAA,CAAK,KAAK,CAAA,CAAE,UAAU,GAAG,CAAA;AAAA;AACtD,EAEQ,uBAAwC,GAAA;AAC9C,IAAM,MAAA,SAAA,GAAY,OAAQ,CAAA,aAAa,CAAE,CAAA,OAAA;AACzC,IAAA,MAAM,SAA2C,EAAC;AAElD,IAAO,OAAA,CAAC,UAAU,UAAe,KAAA;AAC/B,MAAI,IAAA,CAAC,MAAO,CAAA,QAAQ,CAAG,EAAA;AACrB,QAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,IAAI,SAAA,CAAU,KAAK,UAAY,EAAA;AAAA,UAChD,kBAAoB,EAAA;AAAA,SACrB,CAAA;AAED,QAAA,MAAA,CAAO,QAAQ,CAAA,CAAE,EAAG,CAAA,OAAA,EAAS,CAAC,GAAe,KAAA;AAC3C,UAAK,IAAA,CAAA,MAAA,EAAQ,KAAM,CAAA,qCAAA,EAAuC,GAAG,CAAA;AAC7D,UAAA,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,SACxB,CAAA;AAAA;AAEH,MAAA,OAAO,IAAIC,qBAAK,CAAA;AAAA,QACd,SAAW,EAAA,QAAA;AAAA,QACX,GAAK,EAAA,UAAA;AAAA,QACL,KAAA,EAAO,OAAO,QAAQ,CAAA;AAAA,QACtB,UAAY,EAAA,KAAA;AAAA,QACZ,YAAc,EAAA;AAAA,OACf,CAAA;AAAA,KACH;AAAA;AACF,EAEQ,0BAA2C,GAAA;AACjD,IAAM,MAAA,YAAA,GAAe,OAAQ,CAAA,gBAAgB,CAAE,CAAA,OAAA;AAC/C,IAAA,MAAM,SAA8C,EAAC;AAErD,IAAO,OAAA,CAAC,UAAU,UAAe,KAAA;AAC/B,MAAI,IAAA,CAAC,MAAO,CAAA,QAAQ,CAAG,EAAA;AACrB,QAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,IAAI,YAAA,CAAa,KAAK,UAAU,CAAA;AAEnD,QAAA,MAAA,CAAO,QAAQ,CAAA,CAAE,EAAG,CAAA,OAAA,EAAS,CAAC,GAAe,KAAA;AAC3C,UAAK,IAAA,CAAA,MAAA,EAAQ,KAAM,CAAA,wCAAA,EAA0C,GAAG,CAAA;AAChE,UAAA,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,SACxB,CAAA;AAAA;AAEH,MAAA,OAAO,IAAIA,qBAAK,CAAA;AAAA,QACd,SAAW,EAAA,QAAA;AAAA,QACX,GAAK,EAAA,UAAA;AAAA,QACL,UAAY,EAAA,KAAA;AAAA,QACZ,KAAA,EAAO,OAAO,QAAQ;AAAA,OACvB,CAAA;AAAA,KACH;AAAA;AACF,EAEQ,wBAAyC,GAAA;AAC/C,IAAM,MAAA,KAAA,uBAAY,GAAI,EAAA;AACtB,IAAA,OAAO,CAAC,QAAA,EAAU,UAChB,KAAA,IAAIA,qBAAK,CAAA;AAAA,MACP,SAAW,EAAA,QAAA;AAAA,MACX,GAAK,EAAA,UAAA;AAAA,MACL,UAAY,EAAA,KAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA;AAEP;;;;"}