@backstage/core-app-api 1.15.5 → 1.16.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @backstage/core-app-api
 
+## 1.16.0
+
+### Minor Changes
+
+- 9262001: The default auth injection middleware for the `FetchApi` will now also take configuration under `discovery.endpoints` into consideration when deciding whether to include credentials or not.
+- 12f8e01: The `discovery.endpoints` configuration no longer requires both `internal` and `external` target when using the object form, instead falling back to the default.
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/core-plugin-api@1.10.5
+  - @backstage/config@1.3.2
+  - @backstage/types@1.2.1
+  - @backstage/version-bridge@1.0.11
+
+## 1.16.0-next.0
+
+### Minor Changes
+
+- 9262001: The default auth injection middleware for the `FetchApi` will now also take configuration under `discovery.endpoints` into consideration when deciding whether to include credentials or not.
+- 12f8e01: The `discovery.endpoints` configuration no longer requires both `internal` and `external` target when using the object form, instead falling back to the default.
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/config@1.3.2
+  - @backstage/core-plugin-api@1.10.4
+  - @backstage/types@1.2.1
+  - @backstage/version-bridge@1.0.11
+
 ## 1.15.5
 
 ### Patch Changes

package/config.d.ts

@@ -163,7 +163,7 @@ export interface Config {
             /**
              * @visibility frontend
              */
-            external: string;
+            external?: string;
           };
       /**
        * Array of plugins which use the target baseUrl.

package/dist/apis/implementations/DiscoveryApi/FrontendHostDiscovery.esm.js

@@ -30,7 +30,10 @@ class FrontendHostDiscovery {
     const path = options?.pathPattern ?? "/api/{{ pluginId }}";
     const baseUrl = config.getString("backend.baseUrl");
     const endpoints = config.getOptionalConfigArray("discovery.endpoints")?.flatMap((e) => {
-      const target = typeof e.get("target") === "object" ? e.getString("target.external") : e.getString("target");
+      const target = typeof e.get("target") === "object" ? e.getOptionalString("target.external") : e.getString("target");
+      if (!target) {
+        return [];
+      }
       const discovery = UrlPatternDiscovery.compile(target);
       return e.getStringArray("plugins").map((pluginId) => [pluginId, discovery]);
     });

package/dist/apis/implementations/DiscoveryApi/FrontendHostDiscovery.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"FrontendHostDiscovery.esm.js","sources":["../../../../src/apis/implementations/DiscoveryApi/FrontendHostDiscovery.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport { DiscoveryApi } from '@backstage/core-plugin-api';\nimport { UrlPatternDiscovery } from './UrlPatternDiscovery';\n\n/**\n * FrontendHostDiscovery is a config driven DiscoveryApi implementation.\n * It uses the app-config to determine the url for a plugin.\n *\n * @public\n */\nexport class FrontendHostDiscovery implements DiscoveryApi {\n  /**\n   * Creates a new FrontendHostDiscovery discovery instance by reading\n   * the external target URL from the `discovery.endpoints` config section.\n   *\n   * eg.\n   * ```yaml\n   * discovery:\n   *  endpoints:\n   *    - target: https://internal.example.com/internal-catalog\n   *      plugins: [catalog]\n   *    - target: https://internal.example.com/secure/api/{{pluginId}}\n   *      plugins: [auth, permissions]\n   *    - target:\n   *        internal: https://internal.example.com/search\n   *        external: https://example.com/search\n   *      plugins: [search]\n   * ```\n   *\n   * If a plugin is not declared in the config, the discovery will fall back to using the baseUrl with\n   * the provided `pathPattern` appended. The default path pattern is `\"/api/{{ pluginId }}\"`.\n   */\n  static fromConfig(config: Config, options?: { pathPattern?: string }) {\n    const path = options?.pathPattern ?? '/api/{{ pluginId }}';\n    const baseUrl = config.getString('backend.baseUrl');\n\n    const endpoints = config\n      .getOptionalConfigArray('discovery.endpoints')\n      ?.flatMap(e => {\n        const target =\n          typeof e.get('target') === 'object'\n            ? e.getString('target.external')\n            : e.getString('target');\n        const discovery = UrlPatternDiscovery.compile(target);\n        return e\n          .getStringArray('plugins')\n          .map(pluginId => [pluginId, discovery] as const);\n      });\n\n    return new FrontendHostDiscovery(\n      new Map(endpoints),\n      UrlPatternDiscovery.compile(`${baseUrl}${path}`),\n    );\n  }\n\n  private constructor(\n    private readonly endpoints: Map<string, DiscoveryApi>,\n    private readonly defaultEndpoint: DiscoveryApi,\n  ) {}\n\n  async getBaseUrl(pluginId: string): Promise<string> {\n    const endpoint = this.endpoints.get(pluginId);\n    if (endpoint) {\n      return endpoint.getBaseUrl(pluginId);\n    }\n    return this.defaultEndpoint.getBaseUrl(pluginId);\n  }\n}\n"],"names":[],"mappings":";;AAyBO,MAAM,qBAA8C,CAAA;AAAA,EA6CjD,WAAA,CACW,WACA,eACjB,EAAA;AAFiB,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,eAAA,GAAA,eAAA;AAAA;AAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA1BH,OAAO,UAAW,CAAA,MAAA,EAAgB,OAAoC,EAAA;AACpE,IAAM,MAAA,IAAA,GAAO,SAAS,WAAe,IAAA,qBAAA;AACrC,IAAM,MAAA,OAAA,GAAU,MAAO,CAAA,SAAA,CAAU,iBAAiB,CAAA;AAElD,IAAA,MAAM,YAAY,MACf,CAAA,sBAAA,CAAuB,qBAAqB,CAAA,EAC3C,QAAQ,CAAK,CAAA,KAAA;AACb,MAAA,MAAM,MACJ,GAAA,OAAO,CAAE,CAAA,GAAA,CAAI,QAAQ,CAAA,KAAM,QACvB,GAAA,CAAA,CAAE,SAAU,CAAA,iBAAiB,CAC7B,GAAA,CAAA,CAAE,UAAU,QAAQ,CAAA;AAC1B,MAAM,MAAA,SAAA,GAAY,mBAAoB,CAAA,OAAA,CAAQ,MAAM,CAAA;AACpD,MAAO,OAAA,CAAA,CACJ,eAAe,SAAS,CAAA,CACxB,IAAI,CAAY,QAAA,KAAA,CAAC,QAAU,EAAA,SAAS,CAAU,CAAA;AAAA,KAClD,CAAA;AAEH,IAAA,OAAO,IAAI,qBAAA;AAAA,MACT,IAAI,IAAI,SAAS,CAAA;AAAA,MACjB,oBAAoB,OAAQ,CAAA,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAE,CAAA;AAAA,KACjD;AAAA;AACF,EAOA,MAAM,WAAW,QAAmC,EAAA;AAClD,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,SAAU,CAAA,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA,CAAS,WAAW,QAAQ,CAAA;AAAA;AAErC,IAAO,OAAA,IAAA,CAAK,eAAgB,CAAA,UAAA,CAAW,QAAQ,CAAA;AAAA;AAEnD;;;;"}
+{"version":3,"file":"FrontendHostDiscovery.esm.js","sources":["../../../../src/apis/implementations/DiscoveryApi/FrontendHostDiscovery.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport { DiscoveryApi } from '@backstage/core-plugin-api';\nimport { UrlPatternDiscovery } from './UrlPatternDiscovery';\n\n/**\n * FrontendHostDiscovery is a config driven DiscoveryApi implementation.\n * It uses the app-config to determine the url for a plugin.\n *\n * @public\n */\nexport class FrontendHostDiscovery implements DiscoveryApi {\n  /**\n   * Creates a new FrontendHostDiscovery discovery instance by reading\n   * the external target URL from the `discovery.endpoints` config section.\n   *\n   * eg.\n   * ```yaml\n   * discovery:\n   *  endpoints:\n   *    - target: https://internal.example.com/internal-catalog\n   *      plugins: [catalog]\n   *    - target: https://internal.example.com/secure/api/{{pluginId}}\n   *      plugins: [auth, permissions]\n   *    - target:\n   *        internal: https://internal.example.com/search\n   *        external: https://example.com/search\n   *      plugins: [search]\n   * ```\n   *\n   * If a plugin is not declared in the config, the discovery will fall back to using the baseUrl with\n   * the provided `pathPattern` appended. The default path pattern is `\"/api/{{ pluginId }}\"`.\n   */\n  static fromConfig(config: Config, options?: { pathPattern?: string }) {\n    const path = options?.pathPattern ?? '/api/{{ pluginId }}';\n    const baseUrl = config.getString('backend.baseUrl');\n\n    const endpoints = config\n      .getOptionalConfigArray('discovery.endpoints')\n      ?.flatMap(e => {\n        const target =\n          typeof e.get('target') === 'object'\n            ? e.getOptionalString('target.external')\n            : e.getString('target');\n        if (!target) {\n          return [];\n        }\n        const discovery = UrlPatternDiscovery.compile(target);\n        return e\n          .getStringArray('plugins')\n          .map(pluginId => [pluginId, discovery] as const);\n      });\n\n    return new FrontendHostDiscovery(\n      new Map(endpoints),\n      UrlPatternDiscovery.compile(`${baseUrl}${path}`),\n    );\n  }\n\n  private constructor(\n    private readonly endpoints: Map<string, DiscoveryApi>,\n    private readonly defaultEndpoint: DiscoveryApi,\n  ) {}\n\n  async getBaseUrl(pluginId: string): Promise<string> {\n    const endpoint = this.endpoints.get(pluginId);\n    if (endpoint) {\n      return endpoint.getBaseUrl(pluginId);\n    }\n    return this.defaultEndpoint.getBaseUrl(pluginId);\n  }\n}\n"],"names":[],"mappings":";;AAyBO,MAAM,qBAA8C,CAAA;AAAA,EAgDjD,WAAA,CACW,WACA,eACjB,EAAA;AAFiB,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,eAAA,GAAA,eAAA;AAAA;AAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA7BH,OAAO,UAAW,CAAA,MAAA,EAAgB,OAAoC,EAAA;AACpE,IAAM,MAAA,IAAA,GAAO,SAAS,WAAe,IAAA,qBAAA;AACrC,IAAM,MAAA,OAAA,GAAU,MAAO,CAAA,SAAA,CAAU,iBAAiB,CAAA;AAElD,IAAA,MAAM,YAAY,MACf,CAAA,sBAAA,CAAuB,qBAAqB,CAAA,EAC3C,QAAQ,CAAK,CAAA,KAAA;AACb,MAAA,MAAM,MACJ,GAAA,OAAO,CAAE,CAAA,GAAA,CAAI,QAAQ,CAAA,KAAM,QACvB,GAAA,CAAA,CAAE,iBAAkB,CAAA,iBAAiB,CACrC,GAAA,CAAA,CAAE,UAAU,QAAQ,CAAA;AAC1B,MAAA,IAAI,CAAC,MAAQ,EAAA;AACX,QAAA,OAAO,EAAC;AAAA;AAEV,MAAM,MAAA,SAAA,GAAY,mBAAoB,CAAA,OAAA,CAAQ,MAAM,CAAA;AACpD,MAAO,OAAA,CAAA,CACJ,eAAe,SAAS,CAAA,CACxB,IAAI,CAAY,QAAA,KAAA,CAAC,QAAU,EAAA,SAAS,CAAU,CAAA;AAAA,KAClD,CAAA;AAEH,IAAA,OAAO,IAAI,qBAAA;AAAA,MACT,IAAI,IAAI,SAAS,CAAA;AAAA,MACjB,oBAAoB,OAAQ,CAAA,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAE,CAAA;AAAA,KACjD;AAAA;AACF,EAOA,MAAM,WAAW,QAAmC,EAAA;AAClD,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,SAAU,CAAA,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,QAAU,EAAA;AACZ,MAAO,OAAA,QAAA,CAAS,WAAW,QAAQ,CAAA;AAAA;AAErC,IAAO,OAAA,IAAA,CAAK,eAAgB,CAAA,UAAA,CAAW,QAAQ,CAAA;AAAA;AAEnD;;;;"}

package/dist/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.esm.js

@@ -16,6 +16,20 @@ class IdentityAuthInjectorFetchMiddleware {
       headerValue
     );
   }
+  /**
+   * Returns an array of plugin URL prefixes derived from the static `discovery`
+   * configuration, to be used as `urlPrefixAllowlist` option of {@link create}.
+   */
+  static getDiscoveryUrlPrefixes(config) {
+    const endpointConfigs = config.getOptionalConfigArray("discovery.endpoints") || [];
+    return endpointConfigs.flatMap((c) => {
+      const target = typeof c.get("target") === "object" ? c.getString("target.external") : c.getString("target");
+      const plugins = c.getStringArray("plugins");
+      return plugins.map(
+        (pluginId) => target.replace(/\{\{\s*pluginId\s*\}\}/g, pluginId)
+      );
+    });
+  }
   apply(next) {
     return async (input, init) => {
       const request = new Request(input, init);
@@ -34,7 +48,12 @@ function buildMatcher(options) {
   } else if (options.urlPrefixAllowlist) {
     return buildPrefixMatcher(options.urlPrefixAllowlist);
   } else if (options.config) {
-    return buildPrefixMatcher([options.config.getString("backend.baseUrl")]);
+    return buildPrefixMatcher([
+      options.config.getString("backend.baseUrl"),
+      ...IdentityAuthInjectorFetchMiddleware.getDiscoveryUrlPrefixes(
+        options.config
+      )
+    ]);
   }
   return () => false;
 }

package/dist/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityAuthInjectorFetchMiddleware.esm.js","sources":["../../../../src/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { IdentityApi } from '@backstage/core-plugin-api';\nimport { FetchMiddleware } from './types';\n\n/**\n * A fetch middleware, which injects a Backstage token header when the user is\n * signed in.\n */\nexport class IdentityAuthInjectorFetchMiddleware implements FetchMiddleware {\n  static create(options: {\n    identityApi: IdentityApi;\n    config?: Config;\n    urlPrefixAllowlist?: string[];\n    allowUrl?: (url: string) => boolean;\n    header?: {\n      name: string;\n      value: (backstageToken: string) => string;\n    };\n  }): IdentityAuthInjectorFetchMiddleware {\n    const matcher = buildMatcher(options);\n    const headerName = options.header?.name || 'authorization';\n    const headerValue = options.header?.value || (token => `Bearer ${token}`);\n\n    return new IdentityAuthInjectorFetchMiddleware(\n      options.identityApi,\n      matcher,\n      headerName,\n      headerValue,\n    );\n  }\n\n  constructor(\n    public readonly identityApi: IdentityApi,\n    public readonly allowUrl: (url: string) => boolean,\n    public readonly headerName: string,\n    public readonly headerValue: (pluginId: string) => string,\n  ) {}\n\n  apply(next: typeof fetch): typeof fetch {\n    return async (input, init) => {\n      // Skip this middleware if the header already exists, or if the URL\n      // doesn't match any of the allowlist items, or if there was no token.\n      // NOTE(freben): The \"as any\" casts here and below are because of subtle\n      // undici type differences that happened in a node types bump. Those are\n      // immaterial to the code at hand at runtime, as the global fetch and\n      // Request are always taken from the same place.\n      const request = new Request(input as any, init);\n      const { token } = await this.identityApi.getCredentials();\n      if (\n        request.headers.get(this.headerName) ||\n        typeof token !== 'string' ||\n        !token ||\n        !this.allowUrl(request.url)\n      ) {\n        return next(input as any, init);\n      }\n\n      request.headers.set(this.headerName, this.headerValue(token));\n      return next(request);\n    };\n  }\n}\n\nfunction buildMatcher(options: {\n  config?: Config;\n  urlPrefixAllowlist?: string[];\n  allowUrl?: (url: string) => boolean;\n}): (url: string) => boolean {\n  if (options.allowUrl) {\n    return options.allowUrl;\n  } else if (options.urlPrefixAllowlist) {\n    return buildPrefixMatcher(options.urlPrefixAllowlist);\n  } else if (options.config) {\n    return buildPrefixMatcher([options.config.getString('backend.baseUrl')]);\n  }\n  return () => false;\n}\n\nfunction buildPrefixMatcher(prefixes: string[]): (url: string) => boolean {\n  const trimmedPrefixes = prefixes.map(prefix => prefix.replace(/\\/$/, ''));\n  return url =>\n    trimmedPrefixes.some(\n      prefix => url === prefix || url.startsWith(`${prefix}/`),\n    );\n}\n"],"names":[],"mappings":"AAwBO,MAAM,mCAA+D,CAAA;AAAA,EAuB1E,WACkB,CAAA,WAAA,EACA,QACA,EAAA,UAAA,EACA,WAChB,EAAA;AAJgB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA;AACf,EA3BH,OAAO,OAAO,OAS0B,EAAA;AACtC,IAAM,MAAA,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,IAAM,MAAA,UAAA,GAAa,OAAQ,CAAA,MAAA,EAAQ,IAAQ,IAAA,eAAA;AAC3C,IAAA,MAAM,cAAc,OAAQ,CAAA,MAAA,EAAQ,KAAU,KAAA,CAAA,KAAA,KAAS,UAAU,KAAK,CAAA,CAAA,CAAA;AAEtE,IAAA,OAAO,IAAI,mCAAA;AAAA,MACT,OAAQ,CAAA,WAAA;AAAA,MACR,OAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACF;AAAA;AACF,EASA,MAAM,IAAkC,EAAA;AACtC,IAAO,OAAA,OAAO,OAAO,IAAS,KAAA;AAO5B,MAAA,MAAM,OAAU,GAAA,IAAI,OAAQ,CAAA,KAAA,EAAc,IAAI,CAAA;AAC9C,MAAA,MAAM,EAAE,KAAM,EAAA,GAAI,MAAM,IAAA,CAAK,YAAY,cAAe,EAAA;AACxD,MAAA,IACE,QAAQ,OAAQ,CAAA,GAAA,CAAI,IAAK,CAAA,UAAU,KACnC,OAAO,KAAA,KAAU,QACjB,IAAA,CAAC,SACD,CAAC,IAAA,CAAK,QAAS,CAAA,OAAA,CAAQ,GAAG,CAC1B,EAAA;AACA,QAAO,OAAA,IAAA,CAAK,OAAc,IAAI,CAAA;AAAA;AAGhC,MAAA,OAAA,CAAQ,QAAQ,GAAI,CAAA,IAAA,CAAK,YAAY,IAAK,CAAA,WAAA,CAAY,KAAK,CAAC,CAAA;AAC5D,MAAA,OAAO,KAAK,OAAO,CAAA;AAAA,KACrB;AAAA;AAEJ;AAEA,SAAS,aAAa,OAIO,EAAA;AAC3B,EAAA,IAAI,QAAQ,QAAU,EAAA;AACpB,IAAA,OAAO,OAAQ,CAAA,QAAA;AAAA,GACjB,MAAA,IAAW,QAAQ,kBAAoB,EAAA;AACrC,IAAO,OAAA,kBAAA,CAAmB,QAAQ,kBAAkB,CAAA;AAAA,GACtD,MAAA,IAAW,QAAQ,MAAQ,EAAA;AACzB,IAAA,OAAO,mBAAmB,CAAC,OAAA,CAAQ,OAAO,SAAU,CAAA,iBAAiB,CAAC,CAAC,CAAA;AAAA;AAEzE,EAAA,OAAO,MAAM,KAAA;AACf;AAEA,SAAS,mBAAmB,QAA8C,EAAA;AACxE,EAAM,MAAA,eAAA,GAAkB,SAAS,GAAI,CAAA,CAAA,MAAA,KAAU,OAAO,OAAQ,CAAA,KAAA,EAAO,EAAE,CAAC,CAAA;AACxE,EAAA,OAAO,SACL,eAAgB,CAAA,IAAA;AAAA,IACd,YAAU,GAAQ,KAAA,MAAA,IAAU,IAAI,UAAW,CAAA,CAAA,EAAG,MAAM,CAAG,CAAA,CAAA;AAAA,GACzD;AACJ;;;;"}
+{"version":3,"file":"IdentityAuthInjectorFetchMiddleware.esm.js","sources":["../../../../src/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { IdentityApi } from '@backstage/core-plugin-api';\nimport { FetchMiddleware } from './types';\n\n/**\n * A fetch middleware, which injects a Backstage token header when the user is\n * signed in.\n */\nexport class IdentityAuthInjectorFetchMiddleware implements FetchMiddleware {\n  static create(options: {\n    identityApi: IdentityApi;\n    config?: Config;\n    urlPrefixAllowlist?: string[];\n    allowUrl?: (url: string) => boolean;\n    header?: {\n      name: string;\n      value: (backstageToken: string) => string;\n    };\n  }): IdentityAuthInjectorFetchMiddleware {\n    const matcher = buildMatcher(options);\n    const headerName = options.header?.name || 'authorization';\n    const headerValue = options.header?.value || (token => `Bearer ${token}`);\n\n    return new IdentityAuthInjectorFetchMiddleware(\n      options.identityApi,\n      matcher,\n      headerName,\n      headerValue,\n    );\n  }\n\n  /**\n   * Returns an array of plugin URL prefixes derived from the static `discovery`\n   * configuration, to be used as `urlPrefixAllowlist` option of {@link create}.\n   */\n  static getDiscoveryUrlPrefixes(config: Config): string[] {\n    const endpointConfigs =\n      config.getOptionalConfigArray('discovery.endpoints') || [];\n    return endpointConfigs.flatMap(c => {\n      const target =\n        typeof c.get('target') === 'object'\n          ? c.getString('target.external')\n          : c.getString('target');\n      const plugins = c.getStringArray('plugins');\n      return plugins.map(pluginId =>\n        target.replace(/\\{\\{\\s*pluginId\\s*\\}\\}/g, pluginId),\n      );\n    });\n  }\n\n  constructor(\n    public readonly identityApi: IdentityApi,\n    public readonly allowUrl: (url: string) => boolean,\n    public readonly headerName: string,\n    public readonly headerValue: (pluginId: string) => string,\n  ) {}\n\n  apply(next: typeof fetch): typeof fetch {\n    return async (input, init) => {\n      // Skip this middleware if the header already exists, or if the URL\n      // doesn't match any of the allowlist items, or if there was no token.\n      // NOTE(freben): The \"as any\" casts here and below are because of subtle\n      // undici type differences that happened in a node types bump. Those are\n      // immaterial to the code at hand at runtime, as the global fetch and\n      // Request are always taken from the same place.\n      const request = new Request(input as any, init);\n      const { token } = await this.identityApi.getCredentials();\n      if (\n        request.headers.get(this.headerName) ||\n        typeof token !== 'string' ||\n        !token ||\n        !this.allowUrl(request.url)\n      ) {\n        return next(input as any, init);\n      }\n\n      request.headers.set(this.headerName, this.headerValue(token));\n      return next(request);\n    };\n  }\n}\n\nfunction buildMatcher(options: {\n  config?: Config;\n  urlPrefixAllowlist?: string[];\n  allowUrl?: (url: string) => boolean;\n}): (url: string) => boolean {\n  if (options.allowUrl) {\n    return options.allowUrl;\n  } else if (options.urlPrefixAllowlist) {\n    return buildPrefixMatcher(options.urlPrefixAllowlist);\n  } else if (options.config) {\n    return buildPrefixMatcher([\n      options.config.getString('backend.baseUrl'),\n      ...IdentityAuthInjectorFetchMiddleware.getDiscoveryUrlPrefixes(\n        options.config,\n      ),\n    ]);\n  }\n  return () => false;\n}\n\nfunction buildPrefixMatcher(prefixes: string[]): (url: string) => boolean {\n  const trimmedPrefixes = prefixes.map(prefix => prefix.replace(/\\/$/, ''));\n  return url =>\n    trimmedPrefixes.some(\n      prefix => url === prefix || url.startsWith(`${prefix}/`),\n    );\n}\n"],"names":[],"mappings":"AAwBO,MAAM,mCAA+D,CAAA;AAAA,EA0C1E,WACkB,CAAA,WAAA,EACA,QACA,EAAA,UAAA,EACA,WAChB,EAAA;AAJgB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA;AACf,EA9CH,OAAO,OAAO,OAS0B,EAAA;AACtC,IAAM,MAAA,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,IAAM,MAAA,UAAA,GAAa,OAAQ,CAAA,MAAA,EAAQ,IAAQ,IAAA,eAAA;AAC3C,IAAA,MAAM,cAAc,OAAQ,CAAA,MAAA,EAAQ,KAAU,KAAA,CAAA,KAAA,KAAS,UAAU,KAAK,CAAA,CAAA,CAAA;AAEtE,IAAA,OAAO,IAAI,mCAAA;AAAA,MACT,OAAQ,CAAA,WAAA;AAAA,MACR,OAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACF;AAAA;AACF;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,wBAAwB,MAA0B,EAAA;AACvD,IAAA,MAAM,eACJ,GAAA,MAAA,CAAO,sBAAuB,CAAA,qBAAqB,KAAK,EAAC;AAC3D,IAAO,OAAA,eAAA,CAAgB,QAAQ,CAAK,CAAA,KAAA;AAClC,MAAA,MAAM,MACJ,GAAA,OAAO,CAAE,CAAA,GAAA,CAAI,QAAQ,CAAA,KAAM,QACvB,GAAA,CAAA,CAAE,SAAU,CAAA,iBAAiB,CAC7B,GAAA,CAAA,CAAE,UAAU,QAAQ,CAAA;AAC1B,MAAM,MAAA,OAAA,GAAU,CAAE,CAAA,cAAA,CAAe,SAAS,CAAA;AAC1C,MAAA,OAAO,OAAQ,CAAA,GAAA;AAAA,QAAI,CACjB,QAAA,KAAA,MAAA,CAAO,OAAQ,CAAA,yBAAA,EAA2B,QAAQ;AAAA,OACpD;AAAA,KACD,CAAA;AAAA;AACH,EASA,MAAM,IAAkC,EAAA;AACtC,IAAO,OAAA,OAAO,OAAO,IAAS,KAAA;AAO5B,MAAA,MAAM,OAAU,GAAA,IAAI,OAAQ,CAAA,KAAA,EAAc,IAAI,CAAA;AAC9C,MAAA,MAAM,EAAE,KAAM,EAAA,GAAI,MAAM,IAAA,CAAK,YAAY,cAAe,EAAA;AACxD,MAAA,IACE,QAAQ,OAAQ,CAAA,GAAA,CAAI,IAAK,CAAA,UAAU,KACnC,OAAO,KAAA,KAAU,QACjB,IAAA,CAAC,SACD,CAAC,IAAA,CAAK,QAAS,CAAA,OAAA,CAAQ,GAAG,CAC1B,EAAA;AACA,QAAO,OAAA,IAAA,CAAK,OAAc,IAAI,CAAA;AAAA;AAGhC,MAAA,OAAA,CAAQ,QAAQ,GAAI,CAAA,IAAA,CAAK,YAAY,IAAK,CAAA,WAAA,CAAY,KAAK,CAAC,CAAA;AAC5D,MAAA,OAAO,KAAK,OAAO,CAAA;AAAA,KACrB;AAAA;AAEJ;AAEA,SAAS,aAAa,OAIO,EAAA;AAC3B,EAAA,IAAI,QAAQ,QAAU,EAAA;AACpB,IAAA,OAAO,OAAQ,CAAA,QAAA;AAAA,GACjB,MAAA,IAAW,QAAQ,kBAAoB,EAAA;AACrC,IAAO,OAAA,kBAAA,CAAmB,QAAQ,kBAAkB,CAAA;AAAA,GACtD,MAAA,IAAW,QAAQ,MAAQ,EAAA;AACzB,IAAA,OAAO,kBAAmB,CAAA;AAAA,MACxB,OAAA,CAAQ,MAAO,CAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,MAC1C,GAAG,mCAAoC,CAAA,uBAAA;AAAA,QACrC,OAAQ,CAAA;AAAA;AACV,KACD,CAAA;AAAA;AAEH,EAAA,OAAO,MAAM,KAAA;AACf;AAEA,SAAS,mBAAmB,QAA8C,EAAA;AACxE,EAAM,MAAA,eAAA,GAAkB,SAAS,GAAI,CAAA,CAAA,MAAA,KAAU,OAAO,OAAQ,CAAA,KAAA,EAAO,EAAE,CAAC,CAAA;AACxE,EAAA,OAAO,SACL,eAAgB,CAAA,IAAA;AAAA,IACd,YAAU,GAAQ,KAAA,MAAA,IAAU,IAAI,UAAW,CAAA,CAAA,EAAG,MAAM,CAAG,CAAA,CAAA;AAAA,GACzD;AACJ;;;;"}

package/dist/index.d.ts

@@ -487,7 +487,7 @@ declare class ErrorAlerter implements ErrorApi {
     post(error: ErrorApiError, context?: ErrorApiErrorContext): void;
     error$(): _backstage_types.Observable<{
         error: ErrorApiError;
-        context?: ErrorApiErrorContext | undefined;
+        context?: ErrorApiErrorContext;
     }>;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/core-app-api",
-  "version": "1.15.5",
+  "version": "1.16.0",
   "description": "Core app API used by Backstage apps",
   "backstage": {
     "role": "web-library"
@@ -29,13 +29,6 @@
   },
   "main": "./dist/index.esm.js",
   "types": "./dist/index.d.ts",
-  "typesVersions": {
-    "*": {
-      "index": [
-        "dist/index.d.ts"
-      ]
-    }
-  },
   "files": [
     "dist",
     "config.d.ts"
@@ -51,7 +44,7 @@
   },
   "dependencies": {
     "@backstage/config": "^1.3.2",
-    "@backstage/core-plugin-api": "^1.10.4",
+    "@backstage/core-plugin-api": "^1.10.5",
     "@backstage/types": "^1.2.1",
     "@backstage/version-bridge": "^1.0.11",
     "@types/prop-types": "^15.7.3",
@@ -64,8 +57,8 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.30.0",
-    "@backstage/test-utils": "^1.7.5",
+    "@backstage/cli": "^0.31.0",
+    "@backstage/test-utils": "^1.7.6",
     "@testing-library/dom": "^10.0.0",
     "@testing-library/jest-dom": "^6.0.0",
     "@testing-library/react": "^16.0.0",