@backstage/core-app-api 1.20.3-next.0 → 1.20.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @backstage/core-app-api
 
+## 1.20.3
+
+### Patch Changes
+
+- 3ef5974: Added support for wildcard plugin entries in frontend discovery endpoints, matching the backend discovery behavior.
+- 6172725: Fixed the default fetch API to support discovery endpoints that only define an internal target.
+- Updated dependencies
+  - @backstage/ui@0.17.0
+  - @backstage/core-plugin-api@1.12.8
+
 ## 1.20.3-next.0
 
 ### Patch Changes

package/config.schema.json

@@ -199,7 +199,7 @@
                 "items": {
                   "type": "string"
                 },
-                "description": "Array of plugins which use the target baseUrl.",
+                "description": "Array of plugins which use the target baseUrl. Use `'*'` to configure a fallback target for all plugins without an explicit target.",
                 "visibility": "frontend"
               }
             },

package/dist/apis/implementations/DiscoveryApi/FrontendHostDiscovery.esm.js

@@ -17,10 +17,14 @@ class FrontendHostDiscovery {
    *        internal: https://internal.example.com/search
    *        external: https://example.com/search
    *      plugins: [search]
+   *    - target: https://example.com/api/{{pluginId}}
+   *      plugins: ['*']
    * ```
    *
-   * If a plugin is not declared in the config, the discovery will fall back to using the baseUrl with
-   * the provided `pathPattern` appended. The default path pattern is `"/api/{{ pluginId }}"`.
+   * If a plugin is not declared in the config, discovery will first use the
+   * wildcard target, if one is configured, and otherwise fall back to using
+   * the baseUrl with the provided `pathPattern` appended. The default path
+   * pattern is `"/api/{{ pluginId }}"`.
    */
   static fromConfig(config, options) {
     const path = options?.pathPattern ?? "/api/{{ pluginId }}";
@@ -45,7 +49,7 @@ class FrontendHostDiscovery {
     this.defaultEndpoint = defaultEndpoint;
   }
   async getBaseUrl(pluginId) {
-    const endpoint = this.endpoints.get(pluginId);
+    const endpoint = this.endpoints.get(pluginId) ?? this.endpoints.get("*");
     if (endpoint) {
       return endpoint.getBaseUrl(pluginId);
     }

package/dist/apis/implementations/DiscoveryApi/FrontendHostDiscovery.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"FrontendHostDiscovery.esm.js","sources":["../../../../src/apis/implementations/DiscoveryApi/FrontendHostDiscovery.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport { DiscoveryApi } from '@backstage/core-plugin-api';\nimport { UrlPatternDiscovery } from './UrlPatternDiscovery';\n\n/**\n * FrontendHostDiscovery is a config driven DiscoveryApi implementation.\n * It uses the app-config to determine the url for a plugin.\n *\n * @public\n */\nexport class FrontendHostDiscovery implements DiscoveryApi {\n  /**\n   * Creates a new FrontendHostDiscovery discovery instance by reading\n   * the external target URL from the `discovery.endpoints` config section.\n   *\n   * eg.\n   * ```yaml\n   * discovery:\n   *  endpoints:\n   *    - target: https://internal.example.com/internal-catalog\n   *      plugins: [catalog]\n   *    - target: https://internal.example.com/secure/api/{{pluginId}}\n   *      plugins: [auth, permissions]\n   *    - target:\n   *        internal: https://internal.example.com/search\n   *        external: https://example.com/search\n   *      plugins: [search]\n   * ```\n   *\n   * If a plugin is not declared in the config, the discovery will fall back to using the baseUrl with\n   * the provided `pathPattern` appended. The default path pattern is `\"/api/{{ pluginId }}\"`.\n   */\n  static fromConfig(config: Config, options?: { pathPattern?: string }) {\n    const path = options?.pathPattern ?? '/api/{{ pluginId }}';\n    const baseUrl = config.getString('backend.baseUrl');\n\n    const endpoints = config\n      .getOptionalConfigArray('discovery.endpoints')\n      ?.flatMap(e => {\n        const target =\n          typeof e.get('target') === 'object'\n            ? e.getOptionalString('target.external')\n            : e.getString('target');\n        if (!target) {\n          return [];\n        }\n        const discovery = UrlPatternDiscovery.compile(target);\n        return e\n          .getStringArray('plugins')\n          .map(pluginId => [pluginId, discovery] as const);\n      });\n\n    return new FrontendHostDiscovery(\n      new Map(endpoints),\n      UrlPatternDiscovery.compile(`${baseUrl}${path}`),\n    );\n  }\n\n  private readonly endpoints: Map<string, DiscoveryApi>;\n  private readonly defaultEndpoint: DiscoveryApi;\n\n  private constructor(\n    endpoints: Map<string, DiscoveryApi>,\n    defaultEndpoint: DiscoveryApi,\n  ) {\n    this.endpoints = endpoints;\n    this.defaultEndpoint = defaultEndpoint;\n  }\n\n  async getBaseUrl(pluginId: string): Promise<string> {\n    const endpoint = this.endpoints.get(pluginId);\n    if (endpoint) {\n      return endpoint.getBaseUrl(pluginId);\n    }\n    return this.defaultEndpoint.getBaseUrl(pluginId);\n  }\n}\n"],"names":[],"mappings":";;AAyBO,MAAM,qBAAA,CAA8C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBzD,OAAO,UAAA,CAAW,MAAA,EAAgB,OAAA,EAAoC;AACpE,IAAA,MAAM,IAAA,GAAO,SAAS,WAAA,IAAe,qBAAA;AACrC,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,SAAA,CAAU,iBAAiB,CAAA;AAElD,IAAA,MAAM,YAAY,MAAA,CACf,sBAAA,CAAuB,qBAAqB,CAAA,EAC3C,QAAQ,CAAA,CAAA,KAAK;AACb,MAAA,MAAM,MAAA,GACJ,OAAO,CAAA,CAAE,GAAA,CAAI,QAAQ,CAAA,KAAM,QAAA,GACvB,CAAA,CAAE,iBAAA,CAAkB,iBAAiB,CAAA,GACrC,CAAA,CAAE,UAAU,QAAQ,CAAA;AAC1B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,OAAO,EAAC;AAAA,MACV;AACA,MAAA,MAAM,SAAA,GAAY,mBAAA,CAAoB,OAAA,CAAQ,MAAM,CAAA;AACpD,MAAA,OAAO,CAAA,CACJ,eAAe,SAAS,CAAA,CACxB,IAAI,CAAA,QAAA,KAAY,CAAC,QAAA,EAAU,SAAS,CAAU,CAAA;AAAA,IACnD,CAAC,CAAA;AAEH,IAAA,OAAO,IAAI,qBAAA;AAAA,MACT,IAAI,IAAI,SAAS,CAAA;AAAA,MACjB,oBAAoB,OAAA,CAAQ,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE;AAAA,KACjD;AAAA,EACF;AAAA,EAEiB,SAAA;AAAA,EACA,eAAA;AAAA,EAET,WAAA,CACN,WACA,eAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AAAA,EAEA,MAAM,WAAW,QAAA,EAAmC;AAClD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA,CAAS,WAAW,QAAQ,CAAA;AAAA,IACrC;AACA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,UAAA,CAAW,QAAQ,CAAA;AAAA,EACjD;AACF;;;;"}
+{"version":3,"file":"FrontendHostDiscovery.esm.js","sources":["../../../../src/apis/implementations/DiscoveryApi/FrontendHostDiscovery.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport { DiscoveryApi } from '@backstage/core-plugin-api';\nimport { UrlPatternDiscovery } from './UrlPatternDiscovery';\n\n/**\n * FrontendHostDiscovery is a config driven DiscoveryApi implementation.\n * It uses the app-config to determine the url for a plugin.\n *\n * @public\n */\nexport class FrontendHostDiscovery implements DiscoveryApi {\n  /**\n   * Creates a new FrontendHostDiscovery discovery instance by reading\n   * the external target URL from the `discovery.endpoints` config section.\n   *\n   * eg.\n   * ```yaml\n   * discovery:\n   *  endpoints:\n   *    - target: https://internal.example.com/internal-catalog\n   *      plugins: [catalog]\n   *    - target: https://internal.example.com/secure/api/{{pluginId}}\n   *      plugins: [auth, permissions]\n   *    - target:\n   *        internal: https://internal.example.com/search\n   *        external: https://example.com/search\n   *      plugins: [search]\n   *    - target: https://example.com/api/{{pluginId}}\n   *      plugins: ['*']\n   * ```\n   *\n   * If a plugin is not declared in the config, discovery will first use the\n   * wildcard target, if one is configured, and otherwise fall back to using\n   * the baseUrl with the provided `pathPattern` appended. The default path\n   * pattern is `\"/api/{{ pluginId }}\"`.\n   */\n  static fromConfig(config: Config, options?: { pathPattern?: string }) {\n    const path = options?.pathPattern ?? '/api/{{ pluginId }}';\n    const baseUrl = config.getString('backend.baseUrl');\n\n    const endpoints = config\n      .getOptionalConfigArray('discovery.endpoints')\n      ?.flatMap(e => {\n        const target =\n          typeof e.get('target') === 'object'\n            ? e.getOptionalString('target.external')\n            : e.getString('target');\n        if (!target) {\n          return [];\n        }\n        const discovery = UrlPatternDiscovery.compile(target);\n        return e\n          .getStringArray('plugins')\n          .map(pluginId => [pluginId, discovery] as const);\n      });\n\n    return new FrontendHostDiscovery(\n      new Map(endpoints),\n      UrlPatternDiscovery.compile(`${baseUrl}${path}`),\n    );\n  }\n\n  private readonly endpoints: Map<string, DiscoveryApi>;\n  private readonly defaultEndpoint: DiscoveryApi;\n\n  private constructor(\n    endpoints: Map<string, DiscoveryApi>,\n    defaultEndpoint: DiscoveryApi,\n  ) {\n    this.endpoints = endpoints;\n    this.defaultEndpoint = defaultEndpoint;\n  }\n\n  async getBaseUrl(pluginId: string): Promise<string> {\n    const endpoint = this.endpoints.get(pluginId) ?? this.endpoints.get('*');\n    if (endpoint) {\n      return endpoint.getBaseUrl(pluginId);\n    }\n    return this.defaultEndpoint.getBaseUrl(pluginId);\n  }\n}\n"],"names":[],"mappings":";;AAyBO,MAAM,qBAAA,CAA8C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BzD,OAAO,UAAA,CAAW,MAAA,EAAgB,OAAA,EAAoC;AACpE,IAAA,MAAM,IAAA,GAAO,SAAS,WAAA,IAAe,qBAAA;AACrC,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,SAAA,CAAU,iBAAiB,CAAA;AAElD,IAAA,MAAM,YAAY,MAAA,CACf,sBAAA,CAAuB,qBAAqB,CAAA,EAC3C,QAAQ,CAAA,CAAA,KAAK;AACb,MAAA,MAAM,MAAA,GACJ,OAAO,CAAA,CAAE,GAAA,CAAI,QAAQ,CAAA,KAAM,QAAA,GACvB,CAAA,CAAE,iBAAA,CAAkB,iBAAiB,CAAA,GACrC,CAAA,CAAE,UAAU,QAAQ,CAAA;AAC1B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,OAAO,EAAC;AAAA,MACV;AACA,MAAA,MAAM,SAAA,GAAY,mBAAA,CAAoB,OAAA,CAAQ,MAAM,CAAA;AACpD,MAAA,OAAO,CAAA,CACJ,eAAe,SAAS,CAAA,CACxB,IAAI,CAAA,QAAA,KAAY,CAAC,QAAA,EAAU,SAAS,CAAU,CAAA;AAAA,IACnD,CAAC,CAAA;AAEH,IAAA,OAAO,IAAI,qBAAA;AAAA,MACT,IAAI,IAAI,SAAS,CAAA;AAAA,MACjB,oBAAoB,OAAA,CAAQ,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE;AAAA,KACjD;AAAA,EACF;AAAA,EAEiB,SAAA;AAAA,EACA,eAAA;AAAA,EAET,WAAA,CACN,WACA,eAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AAAA,EAEA,MAAM,WAAW,QAAA,EAAmC;AAClD,IAAA,MAAM,QAAA,GAAW,KAAK,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,GAAG,CAAA;AACvE,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA,CAAS,WAAW,QAAQ,CAAA;AAAA,IACrC;AACA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,UAAA,CAAW,QAAQ,CAAA;AAAA,EACjD;AACF;;;;"}

package/dist/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.esm.js

@@ -1,3 +1,4 @@
+const PLUGIN_ID_TEMPLATE = /\{\{\s*pluginId\s*\}\}/g;
 class IdentityAuthInjectorFetchMiddleware {
   static create(options) {
     const matcher = buildMatcher(options);
@@ -17,11 +18,17 @@ class IdentityAuthInjectorFetchMiddleware {
   static getDiscoveryUrlPrefixes(config) {
     const endpointConfigs = config.getOptionalConfigArray("discovery.endpoints") || [];
     return endpointConfigs.flatMap((c) => {
-      const target = typeof c.get("target") === "object" ? c.getString("target.external") : c.getString("target");
+      const target = getExternalTarget(c);
+      if (!target) {
+        return [];
+      }
       const plugins = c.getStringArray("plugins");
-      return plugins.map(
-        (pluginId) => target.replace(/\{\{\s*pluginId\s*\}\}/g, pluginId)
-      );
+      return plugins.flatMap((pluginId) => {
+        if (pluginId === "*") {
+          return [];
+        }
+        return target.replace(PLUGIN_ID_TEMPLATE, pluginId);
+      });
     });
   }
   identityApi;
@@ -52,15 +59,43 @@ function buildMatcher(options) {
   } else if (options.urlPrefixAllowlist) {
     return buildPrefixMatcher(options.urlPrefixAllowlist);
   } else if (options.config) {
-    return buildPrefixMatcher([
+    const prefixMatcher = buildPrefixMatcher([
       options.config.getString("backend.baseUrl"),
       ...IdentityAuthInjectorFetchMiddleware.getDiscoveryUrlPrefixes(
         options.config
       )
     ]);
+    const wildcardMatcher = buildWildcardDiscoveryMatcher(options.config);
+    return (url) => prefixMatcher(url) || wildcardMatcher(url);
   }
   return () => false;
 }
+function getExternalTarget(config) {
+  return typeof config.get("target") === "object" ? config.getOptionalString("target.external") : config.getString("target");
+}
+function buildWildcardDiscoveryMatcher(config) {
+  const matchers = config.getOptionalConfigArray("discovery.endpoints")?.flatMap((endpoint) => {
+    if (!endpoint.getStringArray("plugins").includes("*")) {
+      return [];
+    }
+    const target = getExternalTarget(endpoint);
+    return target ? [buildUrlPatternMatcher(target)] : [];
+  }) ?? [];
+  return (url) => matchers.some((matcher) => matcher(url));
+}
+function buildUrlPatternMatcher(pattern) {
+  const parts = pattern.replace(/\/$/, "").split(PLUGIN_ID_TEMPLATE);
+  let source = escapeRegExp(parts[0]);
+  for (let i = 1; i < parts.length; i++) {
+    source += i === 1 ? "([^/?#]+)" : "\\1";
+    source += escapeRegExp(parts[i]);
+  }
+  const regex = new RegExp(`^${source}(?:/|$|[?#])`);
+  return (url) => regex.test(url);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function buildPrefixMatcher(prefixes) {
   const trimmedPrefixes = prefixes.map((prefix) => prefix.replace(/\/$/, ""));
   return (url) => trimmedPrefixes.some(

package/dist/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityAuthInjectorFetchMiddleware.esm.js","sources":["../../../../src/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { IdentityApi } from '@backstage/core-plugin-api';\nimport { FetchMiddleware } from './types';\n\n/**\n * A fetch middleware, which injects a Backstage token header when the user is\n * signed in.\n */\nexport class IdentityAuthInjectorFetchMiddleware implements FetchMiddleware {\n  static create(options: {\n    identityApi: IdentityApi;\n    config?: Config;\n    urlPrefixAllowlist?: string[];\n    allowUrl?: (url: string) => boolean;\n    header?: {\n      name: string;\n      value: (backstageToken: string) => string;\n    };\n  }): IdentityAuthInjectorFetchMiddleware {\n    const matcher = buildMatcher(options);\n    const headerName = options.header?.name || 'authorization';\n    const headerValue = options.header?.value || (token => `Bearer ${token}`);\n\n    return new IdentityAuthInjectorFetchMiddleware(\n      options.identityApi,\n      matcher,\n      headerName,\n      headerValue,\n    );\n  }\n\n  /**\n   * Returns an array of plugin URL prefixes derived from the static `discovery`\n   * configuration, to be used as `urlPrefixAllowlist` option of {@link create}.\n   */\n  static getDiscoveryUrlPrefixes(config: Config): string[] {\n    const endpointConfigs =\n      config.getOptionalConfigArray('discovery.endpoints') || [];\n    return endpointConfigs.flatMap(c => {\n      const target =\n        typeof c.get('target') === 'object'\n          ? c.getString('target.external')\n          : c.getString('target');\n      const plugins = c.getStringArray('plugins');\n      return plugins.map(pluginId =>\n        target.replace(/\\{\\{\\s*pluginId\\s*\\}\\}/g, pluginId),\n      );\n    });\n  }\n\n  public readonly identityApi: IdentityApi;\n  public readonly allowUrl: (url: string) => boolean;\n  public readonly headerName: string;\n  public readonly headerValue: (pluginId: string) => string;\n\n  constructor(\n    identityApi: IdentityApi,\n    allowUrl: (url: string) => boolean,\n    headerName: string,\n    headerValue: (pluginId: string) => string,\n  ) {\n    this.identityApi = identityApi;\n    this.allowUrl = allowUrl;\n    this.headerName = headerName;\n    this.headerValue = headerValue;\n  }\n\n  apply(next: typeof fetch): typeof fetch {\n    return async (input, init) => {\n      // Skip this middleware if the header already exists, or if the URL\n      // doesn't match any of the allowlist items, or if there was no token.\n      // NOTE(freben): The \"as any\" casts here and below are because of subtle\n      // undici type differences that happened in a node types bump. Those are\n      // immaterial to the code at hand at runtime, as the global fetch and\n      // Request are always taken from the same place.\n      const request = new Request(input as any, init);\n      const { token } = await this.identityApi.getCredentials();\n      if (\n        request.headers.get(this.headerName) ||\n        typeof token !== 'string' ||\n        !token ||\n        !this.allowUrl(request.url)\n      ) {\n        return next(input as any, init);\n      }\n\n      request.headers.set(this.headerName, this.headerValue(token));\n      return next(request);\n    };\n  }\n}\n\nfunction buildMatcher(options: {\n  config?: Config;\n  urlPrefixAllowlist?: string[];\n  allowUrl?: (url: string) => boolean;\n}): (url: string) => boolean {\n  if (options.allowUrl) {\n    return options.allowUrl;\n  } else if (options.urlPrefixAllowlist) {\n    return buildPrefixMatcher(options.urlPrefixAllowlist);\n  } else if (options.config) {\n    return buildPrefixMatcher([\n      options.config.getString('backend.baseUrl'),\n      ...IdentityAuthInjectorFetchMiddleware.getDiscoveryUrlPrefixes(\n        options.config,\n      ),\n    ]);\n  }\n  return () => false;\n}\n\nfunction buildPrefixMatcher(prefixes: string[]): (url: string) => boolean {\n  const trimmedPrefixes = prefixes.map(prefix => prefix.replace(/\\/$/, ''));\n  return url =>\n    trimmedPrefixes.some(\n      prefix => url === prefix || url.startsWith(`${prefix}/`),\n    );\n}\n"],"names":[],"mappings":"AAwBO,MAAM,mCAAA,CAA+D;AAAA,EAC1E,OAAO,OAAO,OAAA,EAS0B;AACtC,IAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,EAAQ,IAAA,IAAQ,eAAA;AAC3C,IAAA,MAAM,cAAc,OAAA,CAAQ,MAAA,EAAQ,KAAA,KAAU,CAAA,KAAA,KAAS,UAAU,KAAK,CAAA,CAAA,CAAA;AAEtE,IAAA,OAAO,IAAI,mCAAA;AAAA,MACT,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,wBAAwB,MAAA,EAA0B;AACvD,IAAA,MAAM,eAAA,GACJ,MAAA,CAAO,sBAAA,CAAuB,qBAAqB,KAAK,EAAC;AAC3D,IAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAA,KAAK;AAClC,MAAA,MAAM,MAAA,GACJ,OAAO,CAAA,CAAE,GAAA,CAAI,QAAQ,CAAA,KAAM,QAAA,GACvB,CAAA,CAAE,SAAA,CAAU,iBAAiB,CAAA,GAC7B,CAAA,CAAE,UAAU,QAAQ,CAAA;AAC1B,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,cAAA,CAAe,SAAS,CAAA;AAC1C,MAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,QAAI,CAAA,QAAA,KACjB,MAAA,CAAO,OAAA,CAAQ,yBAAA,EAA2B,QAAQ;AAAA,OACpD;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEgB,WAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EAEhB,WAAA,CACE,WAAA,EACA,QAAA,EACA,UAAA,EACA,WAAA,EACA;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AAAA,EAEA,MAAM,IAAA,EAAkC;AACtC,IAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAO5B,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,EAAc,IAAI,CAAA;AAC9C,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,YAAY,cAAA,EAAe;AACxD,MAAA,IACE,QAAQ,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,UAAU,KACnC,OAAO,KAAA,KAAU,QAAA,IACjB,CAAC,SACD,CAAC,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA,EAC1B;AACA,QAAA,OAAO,IAAA,CAAK,OAAc,IAAI,CAAA;AAAA,MAChC;AAEA,MAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,KAAK,CAAC,CAAA;AAC5D,MAAA,OAAO,KAAK,OAAO,CAAA;AAAA,IACrB,CAAA;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAAA,EAIO;AAC3B,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,OAAO,OAAA,CAAQ,QAAA;AAAA,EACjB,CAAA,MAAA,IAAW,QAAQ,kBAAA,EAAoB;AACrC,IAAA,OAAO,kBAAA,CAAmB,QAAQ,kBAAkB,CAAA;AAAA,EACtD,CAAA,MAAA,IAAW,QAAQ,MAAA,EAAQ;AACzB,IAAA,OAAO,kBAAA,CAAmB;AAAA,MACxB,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,iBAAiB,CAAA;AAAA,MAC1C,GAAG,mCAAA,CAAoC,uBAAA;AAAA,QACrC,OAAA,CAAQ;AAAA;AACV,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAM,KAAA;AACf;AAEA,SAAS,mBAAmB,QAAA,EAA8C;AACxE,EAAA,MAAM,eAAA,GAAkB,SAAS,GAAA,CAAI,CAAA,MAAA,KAAU,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA;AACxE,EAAA,OAAO,SACL,eAAA,CAAgB,IAAA;AAAA,IACd,YAAU,GAAA,KAAQ,MAAA,IAAU,IAAI,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,CAAA,CAAG;AAAA,GACzD;AACJ;;;;"}
+{"version":3,"file":"IdentityAuthInjectorFetchMiddleware.esm.js","sources":["../../../../src/apis/implementations/FetchApi/IdentityAuthInjectorFetchMiddleware.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { IdentityApi } from '@backstage/core-plugin-api';\nimport { FetchMiddleware } from './types';\n\nconst PLUGIN_ID_TEMPLATE = /\\{\\{\\s*pluginId\\s*\\}\\}/g;\n\n/**\n * A fetch middleware, which injects a Backstage token header when the user is\n * signed in.\n */\nexport class IdentityAuthInjectorFetchMiddleware implements FetchMiddleware {\n  static create(options: {\n    identityApi: IdentityApi;\n    config?: Config;\n    urlPrefixAllowlist?: string[];\n    allowUrl?: (url: string) => boolean;\n    header?: {\n      name: string;\n      value: (backstageToken: string) => string;\n    };\n  }): IdentityAuthInjectorFetchMiddleware {\n    const matcher = buildMatcher(options);\n    const headerName = options.header?.name || 'authorization';\n    const headerValue = options.header?.value || (token => `Bearer ${token}`);\n\n    return new IdentityAuthInjectorFetchMiddleware(\n      options.identityApi,\n      matcher,\n      headerName,\n      headerValue,\n    );\n  }\n\n  /**\n   * Returns an array of plugin URL prefixes derived from the static `discovery`\n   * configuration, to be used as `urlPrefixAllowlist` option of {@link create}.\n   */\n  static getDiscoveryUrlPrefixes(config: Config): string[] {\n    const endpointConfigs =\n      config.getOptionalConfigArray('discovery.endpoints') || [];\n    return endpointConfigs.flatMap(c => {\n      const target = getExternalTarget(c);\n      if (!target) {\n        return [];\n      }\n      const plugins = c.getStringArray('plugins');\n      return plugins.flatMap(pluginId => {\n        if (pluginId === '*') {\n          return [];\n        }\n        return target.replace(PLUGIN_ID_TEMPLATE, pluginId);\n      });\n    });\n  }\n\n  public readonly identityApi: IdentityApi;\n  public readonly allowUrl: (url: string) => boolean;\n  public readonly headerName: string;\n  public readonly headerValue: (pluginId: string) => string;\n\n  constructor(\n    identityApi: IdentityApi,\n    allowUrl: (url: string) => boolean,\n    headerName: string,\n    headerValue: (pluginId: string) => string,\n  ) {\n    this.identityApi = identityApi;\n    this.allowUrl = allowUrl;\n    this.headerName = headerName;\n    this.headerValue = headerValue;\n  }\n\n  apply(next: typeof fetch): typeof fetch {\n    return async (input, init) => {\n      // Skip this middleware if the header already exists, or if the URL\n      // doesn't match any of the allowlist items, or if there was no token.\n      // NOTE(freben): The \"as any\" casts here and below are because of subtle\n      // undici type differences that happened in a node types bump. Those are\n      // immaterial to the code at hand at runtime, as the global fetch and\n      // Request are always taken from the same place.\n      const request = new Request(input as any, init);\n      const { token } = await this.identityApi.getCredentials();\n      if (\n        request.headers.get(this.headerName) ||\n        typeof token !== 'string' ||\n        !token ||\n        !this.allowUrl(request.url)\n      ) {\n        return next(input as any, init);\n      }\n\n      request.headers.set(this.headerName, this.headerValue(token));\n      return next(request);\n    };\n  }\n}\n\nfunction buildMatcher(options: {\n  config?: Config;\n  urlPrefixAllowlist?: string[];\n  allowUrl?: (url: string) => boolean;\n}): (url: string) => boolean {\n  if (options.allowUrl) {\n    return options.allowUrl;\n  } else if (options.urlPrefixAllowlist) {\n    return buildPrefixMatcher(options.urlPrefixAllowlist);\n  } else if (options.config) {\n    const prefixMatcher = buildPrefixMatcher([\n      options.config.getString('backend.baseUrl'),\n      ...IdentityAuthInjectorFetchMiddleware.getDiscoveryUrlPrefixes(\n        options.config,\n      ),\n    ]);\n    const wildcardMatcher = buildWildcardDiscoveryMatcher(options.config);\n    return url => prefixMatcher(url) || wildcardMatcher(url);\n  }\n  return () => false;\n}\n\nfunction getExternalTarget(config: Config): string | undefined {\n  return typeof config.get('target') === 'object'\n    ? config.getOptionalString('target.external')\n    : config.getString('target');\n}\n\nfunction buildWildcardDiscoveryMatcher(\n  config: Config,\n): (url: string) => boolean {\n  const matchers =\n    config.getOptionalConfigArray('discovery.endpoints')?.flatMap(endpoint => {\n      if (!endpoint.getStringArray('plugins').includes('*')) {\n        return [];\n      }\n      const target = getExternalTarget(endpoint);\n      return target ? [buildUrlPatternMatcher(target)] : [];\n    }) ?? [];\n\n  return url => matchers.some(matcher => matcher(url));\n}\n\nfunction buildUrlPatternMatcher(pattern: string): (url: string) => boolean {\n  const parts = pattern.replace(/\\/$/, '').split(PLUGIN_ID_TEMPLATE);\n  let source = escapeRegExp(parts[0]);\n\n  for (let i = 1; i < parts.length; i++) {\n    source += i === 1 ? '([^/?#]+)' : '\\\\1';\n    source += escapeRegExp(parts[i]);\n  }\n\n  const regex = new RegExp(`^${source}(?:/|$|[?#])`);\n  return url => regex.test(url);\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nfunction buildPrefixMatcher(prefixes: string[]): (url: string) => boolean {\n  const trimmedPrefixes = prefixes.map(prefix => prefix.replace(/\\/$/, ''));\n  return url =>\n    trimmedPrefixes.some(\n      prefix => url === prefix || url.startsWith(`${prefix}/`),\n    );\n}\n"],"names":[],"mappings":"AAoBA,MAAM,kBAAA,GAAqB,yBAAA;AAMpB,MAAM,mCAAA,CAA+D;AAAA,EAC1E,OAAO,OAAO,OAAA,EAS0B;AACtC,IAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,EAAQ,IAAA,IAAQ,eAAA;AAC3C,IAAA,MAAM,cAAc,OAAA,CAAQ,MAAA,EAAQ,KAAA,KAAU,CAAA,KAAA,KAAS,UAAU,KAAK,CAAA,CAAA,CAAA;AAEtE,IAAA,OAAO,IAAI,mCAAA;AAAA,MACT,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA;AAAA,MACA,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,wBAAwB,MAAA,EAA0B;AACvD,IAAA,MAAM,eAAA,GACJ,MAAA,CAAO,sBAAA,CAAuB,qBAAqB,KAAK,EAAC;AAC3D,IAAA,OAAO,eAAA,CAAgB,QAAQ,CAAA,CAAA,KAAK;AAClC,MAAA,MAAM,MAAA,GAAS,kBAAkB,CAAC,CAAA;AAClC,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,OAAO,EAAC;AAAA,MACV;AACA,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,cAAA,CAAe,SAAS,CAAA;AAC1C,MAAA,OAAO,OAAA,CAAQ,QAAQ,CAAA,QAAA,KAAY;AACjC,QAAA,IAAI,aAAa,GAAA,EAAK;AACpB,UAAA,OAAO,EAAC;AAAA,QACV;AACA,QAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,kBAAA,EAAoB,QAAQ,CAAA;AAAA,MACpD,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEgB,WAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EAEhB,WAAA,CACE,WAAA,EACA,QAAA,EACA,UAAA,EACA,WAAA,EACA;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACrB;AAAA,EAEA,MAAM,IAAA,EAAkC;AACtC,IAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAO5B,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,EAAc,IAAI,CAAA;AAC9C,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,YAAY,cAAA,EAAe;AACxD,MAAA,IACE,QAAQ,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,UAAU,KACnC,OAAO,KAAA,KAAU,QAAA,IACjB,CAAC,SACD,CAAC,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA,EAC1B;AACA,QAAA,OAAO,IAAA,CAAK,OAAc,IAAI,CAAA;AAAA,MAChC;AAEA,MAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,KAAK,CAAC,CAAA;AAC5D,MAAA,OAAO,KAAK,OAAO,CAAA;AAAA,IACrB,CAAA;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAAA,EAIO;AAC3B,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,OAAO,OAAA,CAAQ,QAAA;AAAA,EACjB,CAAA,MAAA,IAAW,QAAQ,kBAAA,EAAoB;AACrC,IAAA,OAAO,kBAAA,CAAmB,QAAQ,kBAAkB,CAAA;AAAA,EACtD,CAAA,MAAA,IAAW,QAAQ,MAAA,EAAQ;AACzB,IAAA,MAAM,gBAAgB,kBAAA,CAAmB;AAAA,MACvC,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,iBAAiB,CAAA;AAAA,MAC1C,GAAG,mCAAA,CAAoC,uBAAA;AAAA,QACrC,OAAA,CAAQ;AAAA;AACV,KACD,CAAA;AACD,IAAA,MAAM,eAAA,GAAkB,6BAAA,CAA8B,OAAA,CAAQ,MAAM,CAAA;AACpE,IAAA,OAAO,CAAA,GAAA,KAAO,aAAA,CAAc,GAAG,CAAA,IAAK,gBAAgB,GAAG,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,MAAM,KAAA;AACf;AAEA,SAAS,kBAAkB,MAAA,EAAoC;AAC7D,EAAA,OAAO,OAAO,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA,KAAM,QAAA,GACnC,MAAA,CAAO,iBAAA,CAAkB,iBAAiB,CAAA,GAC1C,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AAC/B;AAEA,SAAS,8BACP,MAAA,EAC0B;AAC1B,EAAA,MAAM,WACJ,MAAA,CAAO,sBAAA,CAAuB,qBAAqB,CAAA,EAAG,QAAQ,CAAA,QAAA,KAAY;AACxE,IAAA,IAAI,CAAC,QAAA,CAAS,cAAA,CAAe,SAAS,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACrD,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,IAAA,OAAO,SAAS,CAAC,sBAAA,CAAuB,MAAM,CAAC,IAAI,EAAC;AAAA,EACtD,CAAC,KAAK,EAAC;AAET,EAAA,OAAO,SAAO,QAAA,CAAS,IAAA,CAAK,CAAA,OAAA,KAAW,OAAA,CAAQ,GAAG,CAAC,CAAA;AACrD;AAEA,SAAS,uBAAuB,OAAA,EAA2C;AACzE,EAAA,MAAM,QAAQ,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA,CAAE,MAAM,kBAAkB,CAAA;AACjE,EAAA,IAAI,MAAA,GAAS,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAElC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAA,IAAU,CAAA,KAAM,IAAI,WAAA,GAAc,KAAA;AAClC,IAAA,MAAA,IAAU,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,MAAM,CAAA,YAAA,CAAc,CAAA;AACjD,EAAA,OAAO,CAAA,GAAA,KAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC9B;AAEA,SAAS,aAAa,KAAA,EAAuB;AAC3C,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AACpD;AAEA,SAAS,mBAAmB,QAAA,EAA8C;AACxE,EAAA,MAAM,eAAA,GAAkB,SAAS,GAAA,CAAI,CAAA,MAAA,KAAU,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA;AACxE,EAAA,OAAO,SACL,eAAA,CAAgB,IAAA;AAAA,IACd,YAAU,GAAA,KAAQ,MAAA,IAAU,IAAI,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,CAAA,CAAG;AAAA,GACzD;AACJ;;;;"}

package/dist/index.d.ts

@@ -559,10 +559,14 @@ declare class FrontendHostDiscovery implements DiscoveryApi {
      *        internal: https://internal.example.com/search
      *        external: https://example.com/search
      *      plugins: [search]
+     *    - target: https://example.com/api/{{pluginId}}
+     *      plugins: ['*']
      * ```
      *
-     * If a plugin is not declared in the config, the discovery will fall back to using the baseUrl with
-     * the provided `pathPattern` appended. The default path pattern is `"/api/{{ pluginId }}"`.
+     * If a plugin is not declared in the config, discovery will first use the
+     * wildcard target, if one is configured, and otherwise fall back to using
+     * the baseUrl with the provided `pathPattern` appended. The default path
+     * pattern is `"/api/{{ pluginId }}"`.
      */
     static fromConfig(config: Config, options?: {
         pathPattern?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/core-app-api",
-  "version": "1.20.3-next.0",
+  "version": "1.20.3",
   "description": "Core app API used by Backstage apps",
   "backstage": {
     "role": "web-library"
@@ -50,11 +50,11 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/config": "1.3.8",
-    "@backstage/core-plugin-api": "1.12.8-next.0",
-    "@backstage/types": "1.2.2",
-    "@backstage/ui": "0.17.0-next.0",
-    "@backstage/version-bridge": "1.0.12",
+    "@backstage/config": "^1.3.8",
+    "@backstage/core-plugin-api": "^1.12.8",
+    "@backstage/types": "^1.2.2",
+    "@backstage/ui": "^0.17.0",
+    "@backstage/version-bridge": "^1.0.12",
     "@types/prop-types": "^15.7.3",
     "history": "^5.0.0",
     "i18next": "^22.4.15",
@@ -65,8 +65,8 @@
     "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/cli": "0.36.4-next.0",
-    "@backstage/test-utils": "1.7.20-next.0",
+    "@backstage/cli": "^0.36.4",
+    "@backstage/test-utils": "^1.7.20",
     "@testing-library/dom": "^10.0.0",
     "@testing-library/jest-dom": "^6.0.0",
     "@testing-library/react": "^16.0.0",