@backstage/integration 1.21.0-next.0 → 2.0.0-next.2

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @backstage/integration
 
+## 2.0.0-next.2
+
+### Patch Changes
+
+- 1513a0b: Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.
+
+## 2.0.0-next.1
+
+### Major Changes
+
+- 527cf88: **BREAKING** Removed deprecated Azure DevOps, Bitbucket, Gerrit and GitHub code:
+
+  - For Azure DevOps, the long deprecated `token` string and `credential` object have been removed from the `config.d.ts`. Use the `credentials` array object instead.
+  - For Bitbucket, the long deprecated `bitbucket` object has been removed from the `config.d.ts`. Use the `bitbucketCloud` or `bitbucketServer` objects instead.
+  - For Gerrit, the `parseGerritGitilesUrl` function has been removed, use `parseGitilesUrlRef` instead. The `buildGerritGitilesArchiveUrl` function has also been removed, use `buildGerritGitilesArchiveUrlFromLocation` instead.
+  - For GitHub, the `getGitHubRequestOptions` function has been removed.
+
+### Patch Changes
+
+- 993a598: Fixed Azure integration config schema visibility annotations to use per-field `@visibility secret` instead of `@deepVisibility secret` on parent objects, so that non-secret fields like `clientId`, `tenantId`, `organizations`, and `managedIdentityClientId` are no longer incorrectly marked as secret.
+- Updated dependencies
+  - @backstage/config@1.3.6
+  - @backstage/errors@1.2.7
+
 ## 1.21.0-next.0
 
 ### Minor Changes

package/config.d.ts

@@ -27,40 +27,20 @@ export interface Config {
        * @visibility frontend
        */
       host: string;
-      /**
-       * Token used to authenticate requests.
-       * @visibility secret
-       * @deprecated Use `credentials` instead.
-       */
-      token?: string;
-
-      /**
-       * The credential to use for requests.
-       *
-       * If no credential is specified anonymous access is used.
-       *
-       * @deepVisibility secret
-       * @deprecated Use `credentials` instead.
-       */
-      credential?: {
-        clientId?: string;
-        clientSecret?: string;
-        tenantId?: string;
-        personalAccessToken?: string;
-      };
 
       /**
        * The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used.
        * If no organization matches the first credential without an organization is used.
        *
        * If no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used.
-       * @deepVisibility secret
        */
       credentials?: {
         organizations?: string[];
         clientId?: string;
+        /** @visibility secret */
         clientSecret?: string;
         tenantId?: string;
+        /** @visibility secret */
         personalAccessToken?: string;
         managedIdentityClientId?: string;
       }[];
@@ -111,7 +91,6 @@ export interface Config {
       endpoint?: string;
       /**
        * Optional credential to use for Azure Active Directory authentication.
-       * @deepVisibility secret
        */
       aadCredential?: {
         /**
@@ -126,48 +105,12 @@ export interface Config {
 
         /**
          * The client secret for the Azure AD application.
+         * @visibility secret
          */
         clientSecret: string;
       };
     }>;
 
-    /**
-     * Integration configuration for Bitbucket
-     * @deprecated replaced by bitbucketCloud and bitbucketServer
-     */
-    bitbucket?: Array<{
-      /**
-       * The hostname of the given Bitbucket instance
-       * @visibility frontend
-       */
-      host: string;
-      /**
-       * Token used to authenticate requests.
-       * @visibility secret
-       */
-      token?: string;
-      /**
-       * The base url for the Bitbucket API, for example https://api.bitbucket.org/2.0
-       * @visibility frontend
-       */
-      apiBaseUrl?: string;
-      /**
-       * The username to use for authenticated requests.
-       * @visibility secret
-       */
-      username?: string;
-      /**
-       * Bitbucket app password used to authenticate requests.
-       * @visibility secret
-       */
-      appPassword?: string;
-      /**
-       * PGP signing key for signing commits.
-       * @visibility secret
-       */
-      commitSigningKey?: string;
-    }>;
-
     /** Integration configuration for Bitbucket Cloud */
     bitbucketCloud?: Array<{
       /**

package/dist/ScmIntegrations.cjs.js

@@ -4,7 +4,6 @@ var AwsS3Integration = require('./awsS3/AwsS3Integration.cjs.js');
 var AwsCodeCommitIntegration = require('./awsCodeCommit/AwsCodeCommitIntegration.cjs.js');
 var AzureIntegration = require('./azure/AzureIntegration.cjs.js');
 var BitbucketCloudIntegration = require('./bitbucketCloud/BitbucketCloudIntegration.cjs.js');
-var BitbucketIntegration = require('./bitbucket/BitbucketIntegration.cjs.js');
 var BitbucketServerIntegration = require('./bitbucketServer/BitbucketServerIntegration.cjs.js');
 var GerritIntegration = require('./gerrit/GerritIntegration.cjs.js');
 var GithubIntegration = require('./github/GithubIntegration.cjs.js');
@@ -25,7 +24,6 @@ class ScmIntegrations {
       awsCodeCommit: AwsCodeCommitIntegration.AwsCodeCommitIntegration.factory({ config }),
       azureBlobStorage: AzureBlobStorageIntegration.AzureBlobStorageIntergation.factory({ config }),
       azure: AzureIntegration.AzureIntegration.factory({ config }),
-      bitbucket: BitbucketIntegration.BitbucketIntegration.factory({ config }),
       bitbucketCloud: BitbucketCloudIntegration.BitbucketCloudIntegration.factory({ config }),
       bitbucketServer: BitbucketServerIntegration.BitbucketServerIntegration.factory({ config }),
       gerrit: GerritIntegration.GerritIntegration.factory({ config }),
@@ -51,12 +49,6 @@ class ScmIntegrations {
   get azure() {
     return this.byType.azure;
   }
-  /**
-   * @deprecated in favor of `bitbucketCloud()` and `bitbucketServer()`
-   */
-  get bitbucket() {
-    return this.byType.bitbucket;
-  }
   get bitbucketCloud() {
     return this.byType.bitbucketCloud;
   }
@@ -87,15 +79,7 @@ class ScmIntegrations {
     );
   }
   byUrl(url) {
-    let candidates = Object.values(this.byType).map((i) => i.byUrl(url)).filter(Boolean);
-    if (candidates.length > 1) {
-      const filteredCandidates = candidates.filter(
-        (x) => !(x instanceof BitbucketIntegration.BitbucketIntegration)
-      );
-      if (filteredCandidates.length !== 0) {
-        candidates = filteredCandidates;
-      }
-    }
+    const candidates = Object.values(this.byType).map((i) => i.byUrl(url)).filter(Boolean);
     return candidates[0];
   }
   byHost(host) {

package/dist/ScmIntegrations.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"ScmIntegrations.cjs.js","sources":["../src/ScmIntegrations.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { AwsS3Integration } from './awsS3/AwsS3Integration';\nimport { AwsCodeCommitIntegration } from './awsCodeCommit/AwsCodeCommitIntegration';\nimport { AzureIntegration } from './azure/AzureIntegration';\nimport { BitbucketCloudIntegration } from './bitbucketCloud/BitbucketCloudIntegration';\nimport { BitbucketIntegration } from './bitbucket/BitbucketIntegration';\nimport { BitbucketServerIntegration } from './bitbucketServer/BitbucketServerIntegration';\nimport { GerritIntegration } from './gerrit/GerritIntegration';\nimport { GithubIntegration } from './github/GithubIntegration';\nimport { GitLabIntegration } from './gitlab/GitLabIntegration';\nimport { defaultScmResolveUrl } from './helpers';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\nimport { ScmIntegrationRegistry } from './registry';\nimport { GiteaIntegration } from './gitea';\nimport { HarnessIntegration } from './harness/HarnessIntegration';\nimport { AzureBlobStorageIntergation } from './azureBlobStorage';\nimport { GoogleGcsIntegration } from './googleGcs/GoogleGcsIntegration';\n\n/**\n * The set of supported integrations.\n *\n * @public\n */\nexport interface IntegrationsByType {\n  awsS3: ScmIntegrationsGroup<AwsS3Integration>;\n  awsCodeCommit: ScmIntegrationsGroup<AwsCodeCommitIntegration>;\n  azureBlobStorage: ScmIntegrationsGroup<AzureBlobStorageIntergation>;\n  azure: ScmIntegrationsGroup<AzureIntegration>;\n  /**\n   * @deprecated in favor of `bitbucketCloud` and `bitbucketServer`\n   */\n  bitbucket: ScmIntegrationsGroup<BitbucketIntegration>;\n  bitbucketCloud: ScmIntegrationsGroup<BitbucketCloudIntegration>;\n  bitbucketServer: ScmIntegrationsGroup<BitbucketServerIntegration>;\n  gerrit: ScmIntegrationsGroup<GerritIntegration>;\n  github: ScmIntegrationsGroup<GithubIntegration>;\n  gitlab: ScmIntegrationsGroup<GitLabIntegration>;\n  gitea: ScmIntegrationsGroup<GiteaIntegration>;\n  googleGcs: ScmIntegrationsGroup<GoogleGcsIntegration>;\n  harness: ScmIntegrationsGroup<HarnessIntegration>;\n}\n\n/**\n * Exposes the set of supported integrations.\n *\n * @public\n */\nexport class ScmIntegrations implements ScmIntegrationRegistry {\n  private readonly byType: IntegrationsByType;\n\n  static fromConfig(config: Config): ScmIntegrations {\n    return new ScmIntegrations({\n      awsS3: AwsS3Integration.factory({ config }),\n      awsCodeCommit: AwsCodeCommitIntegration.factory({ config }),\n      azureBlobStorage: AzureBlobStorageIntergation.factory({ config }),\n      azure: AzureIntegration.factory({ config }),\n      bitbucket: BitbucketIntegration.factory({ config }),\n      bitbucketCloud: BitbucketCloudIntegration.factory({ config }),\n      bitbucketServer: BitbucketServerIntegration.factory({ config }),\n      gerrit: GerritIntegration.factory({ config }),\n      github: GithubIntegration.factory({ config }),\n      gitlab: GitLabIntegration.factory({ config }),\n      gitea: GiteaIntegration.factory({ config }),\n      googleGcs: GoogleGcsIntegration.factory({ config }),\n      harness: HarnessIntegration.factory({ config }),\n    });\n  }\n\n  constructor(integrationsByType: IntegrationsByType) {\n    this.byType = integrationsByType;\n  }\n\n  get awsS3(): ScmIntegrationsGroup<AwsS3Integration> {\n    return this.byType.awsS3;\n  }\n\n  get awsCodeCommit(): ScmIntegrationsGroup<AwsCodeCommitIntegration> {\n    return this.byType.awsCodeCommit;\n  }\n\n  get azureBlobStorage(): ScmIntegrationsGroup<AzureBlobStorageIntergation> {\n    return this.byType.azureBlobStorage;\n  }\n\n  get azure(): ScmIntegrationsGroup<AzureIntegration> {\n    return this.byType.azure;\n  }\n\n  /**\n   * @deprecated in favor of `bitbucketCloud()` and `bitbucketServer()`\n   */\n  get bitbucket(): ScmIntegrationsGroup<BitbucketIntegration> {\n    return this.byType.bitbucket;\n  }\n\n  get bitbucketCloud(): ScmIntegrationsGroup<BitbucketCloudIntegration> {\n    return this.byType.bitbucketCloud;\n  }\n\n  get bitbucketServer(): ScmIntegrationsGroup<BitbucketServerIntegration> {\n    return this.byType.bitbucketServer;\n  }\n\n  get gerrit(): ScmIntegrationsGroup<GerritIntegration> {\n    return this.byType.gerrit;\n  }\n\n  get github(): ScmIntegrationsGroup<GithubIntegration> {\n    return this.byType.github;\n  }\n\n  get gitlab(): ScmIntegrationsGroup<GitLabIntegration> {\n    return this.byType.gitlab;\n  }\n\n  get gitea(): ScmIntegrationsGroup<GiteaIntegration> {\n    return this.byType.gitea;\n  }\n\n  get googleGcs(): ScmIntegrationsGroup<GoogleGcsIntegration> {\n    return this.byType.googleGcs;\n  }\n\n  get harness(): ScmIntegrationsGroup<HarnessIntegration> {\n    return this.byType.harness;\n  }\n\n  list(): ScmIntegration[] {\n    return Object.values(this.byType).flatMap(\n      i => i.list() as ScmIntegration[],\n    );\n  }\n\n  byUrl(url: string | URL): ScmIntegration | undefined {\n    let candidates = Object.values(this.byType)\n      .map(i => i.byUrl(url))\n      .filter(Boolean);\n\n    // Do not return deprecated integrations if there are other options\n    if (candidates.length > 1) {\n      const filteredCandidates = candidates.filter(\n        x => !(x instanceof BitbucketIntegration),\n      );\n      if (filteredCandidates.length !== 0) {\n        candidates = filteredCandidates;\n      }\n    }\n\n    return candidates[0];\n  }\n\n  byHost(host: string): ScmIntegration | undefined {\n    return Object.values(this.byType)\n      .map(i => i.byHost(host))\n      .find(Boolean);\n  }\n\n  resolveUrl(options: {\n    url: string;\n    base: string;\n    lineNumber?: number;\n  }): string {\n    const integration = this.byUrl(options.base);\n    if (!integration) {\n      return defaultScmResolveUrl(options);\n    }\n\n    return integration.resolveUrl(options);\n  }\n\n  resolveEditUrl(url: string): string {\n    const integration = this.byUrl(url);\n    if (!integration) {\n      return url;\n    }\n\n    return integration.resolveEditUrl(url);\n  }\n}\n"],"names":["AwsS3Integration","AwsCodeCommitIntegration","AzureBlobStorageIntergation","AzureIntegration","BitbucketIntegration","BitbucketCloudIntegration","BitbucketServerIntegration","GerritIntegration","GithubIntegration","GitLabIntegration","GiteaIntegration","GoogleGcsIntegration","HarnessIntegration","defaultScmResolveUrl"],"mappings":";;;;;;;;;;;;;;;;;;;AA+DO,MAAM,eAAA,CAAkD;AAAA,EAC5C,MAAA;AAAA,EAEjB,OAAO,WAAW,MAAA,EAAiC;AACjD,IAAA,OAAO,IAAI,eAAA,CAAgB;AAAA,MACzB,KAAA,EAAOA,iCAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,aAAA,EAAeC,iDAAA,CAAyB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1D,gBAAA,EAAkBC,uDAAA,CAA4B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAChE,KAAA,EAAOC,iCAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,SAAA,EAAWC,yCAAA,CAAqB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAClD,cAAA,EAAgBC,mDAAA,CAA0B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5D,eAAA,EAAiBC,qDAAA,CAA2B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC9D,MAAA,EAAQC,mCAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQC,mCAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQC,mCAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,KAAA,EAAOC,iCAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,SAAA,EAAWC,yCAAA,CAAqB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAClD,OAAA,EAASC,qCAAA,CAAmB,OAAA,CAAQ,EAAE,QAAQ;AAAA,KAC/C,CAAA;AAAA,EACH;AAAA,EAEA,YAAY,kBAAA,EAAwC;AAClD,IAAA,IAAA,CAAK,MAAA,GAAS,kBAAA;AAAA,EAChB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,aAAA,GAAgE;AAClE,IAAA,OAAO,KAAK,MAAA,CAAO,aAAA;AAAA,EACrB;AAAA,EAEA,IAAI,gBAAA,GAAsE;AACxE,IAAA,OAAO,KAAK,MAAA,CAAO,gBAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,SAAA,GAAwD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,SAAA;AAAA,EACrB;AAAA,EAEA,IAAI,cAAA,GAAkE;AACpE,IAAA,OAAO,KAAK,MAAA,CAAO,cAAA;AAAA,EACrB;AAAA,EAEA,IAAI,eAAA,GAAoE;AACtE,IAAA,OAAO,KAAK,MAAA,CAAO,eAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,SAAA,GAAwD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,SAAA;AAAA,EACrB;AAAA,EAEA,IAAI,OAAA,GAAoD;AACtD,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,EACrB;AAAA,EAEA,IAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA;AAAA,MAChC,CAAA,CAAA,KAAK,EAAE,IAAA;AAAK,KACd;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,EAA+C;AACnD,IAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CACvC,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA,CACrB,OAAO,OAAO,CAAA;AAGjB,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,MAAM,qBAAqB,UAAA,CAAW,MAAA;AAAA,QACpC,CAAA,CAAA,KAAK,EAAE,CAAA,YAAaR,yCAAA;AAAA,OACtB;AACA,MAAA,IAAI,kBAAA,CAAmB,WAAW,CAAA,EAAG;AACnC,QAAA,UAAA,GAAa,kBAAA;AAAA,MACf;AAAA,IACF;AAEA,IAAA,OAAO,WAAW,CAAC,CAAA;AAAA,EACrB;AAAA,EAEA,OAAO,IAAA,EAA0C;AAC/C,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAC7B,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA,CACvB,KAAK,OAAO,CAAA;AAAA,EACjB;AAAA,EAEA,WAAW,OAAA,EAIA;AACT,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAC3C,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAOS,6BAAqB,OAAO,CAAA;AAAA,IACrC;AAEA,IAAA,OAAO,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,EACvC;AAAA,EAEA,eAAe,GAAA,EAAqB;AAClC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,WAAA,CAAY,eAAe,GAAG,CAAA;AAAA,EACvC;AACF;;;;"}
+{"version":3,"file":"ScmIntegrations.cjs.js","sources":["../src/ScmIntegrations.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { AwsS3Integration } from './awsS3/AwsS3Integration';\nimport { AwsCodeCommitIntegration } from './awsCodeCommit/AwsCodeCommitIntegration';\nimport { AzureIntegration } from './azure/AzureIntegration';\nimport { BitbucketCloudIntegration } from './bitbucketCloud/BitbucketCloudIntegration';\nimport { BitbucketServerIntegration } from './bitbucketServer/BitbucketServerIntegration';\nimport { GerritIntegration } from './gerrit/GerritIntegration';\nimport { GithubIntegration } from './github/GithubIntegration';\nimport { GitLabIntegration } from './gitlab/GitLabIntegration';\nimport { defaultScmResolveUrl } from './helpers';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\nimport { ScmIntegrationRegistry } from './registry';\nimport { GiteaIntegration } from './gitea';\nimport { HarnessIntegration } from './harness/HarnessIntegration';\nimport { AzureBlobStorageIntergation } from './azureBlobStorage';\nimport { GoogleGcsIntegration } from './googleGcs/GoogleGcsIntegration';\n\n/**\n * The set of supported integrations.\n *\n * @public\n */\nexport interface IntegrationsByType {\n  awsS3: ScmIntegrationsGroup<AwsS3Integration>;\n  awsCodeCommit: ScmIntegrationsGroup<AwsCodeCommitIntegration>;\n  azureBlobStorage: ScmIntegrationsGroup<AzureBlobStorageIntergation>;\n  azure: ScmIntegrationsGroup<AzureIntegration>;\n  bitbucketCloud: ScmIntegrationsGroup<BitbucketCloudIntegration>;\n  bitbucketServer: ScmIntegrationsGroup<BitbucketServerIntegration>;\n  gerrit: ScmIntegrationsGroup<GerritIntegration>;\n  github: ScmIntegrationsGroup<GithubIntegration>;\n  gitlab: ScmIntegrationsGroup<GitLabIntegration>;\n  gitea: ScmIntegrationsGroup<GiteaIntegration>;\n  googleGcs: ScmIntegrationsGroup<GoogleGcsIntegration>;\n  harness: ScmIntegrationsGroup<HarnessIntegration>;\n}\n\n/**\n * Exposes the set of supported integrations.\n *\n * @public\n */\nexport class ScmIntegrations implements ScmIntegrationRegistry {\n  private readonly byType: IntegrationsByType;\n\n  static fromConfig(config: Config): ScmIntegrations {\n    return new ScmIntegrations({\n      awsS3: AwsS3Integration.factory({ config }),\n      awsCodeCommit: AwsCodeCommitIntegration.factory({ config }),\n      azureBlobStorage: AzureBlobStorageIntergation.factory({ config }),\n      azure: AzureIntegration.factory({ config }),\n      bitbucketCloud: BitbucketCloudIntegration.factory({ config }),\n      bitbucketServer: BitbucketServerIntegration.factory({ config }),\n      gerrit: GerritIntegration.factory({ config }),\n      github: GithubIntegration.factory({ config }),\n      gitlab: GitLabIntegration.factory({ config }),\n      gitea: GiteaIntegration.factory({ config }),\n      googleGcs: GoogleGcsIntegration.factory({ config }),\n      harness: HarnessIntegration.factory({ config }),\n    });\n  }\n\n  constructor(integrationsByType: IntegrationsByType) {\n    this.byType = integrationsByType;\n  }\n\n  get awsS3(): ScmIntegrationsGroup<AwsS3Integration> {\n    return this.byType.awsS3;\n  }\n\n  get awsCodeCommit(): ScmIntegrationsGroup<AwsCodeCommitIntegration> {\n    return this.byType.awsCodeCommit;\n  }\n\n  get azureBlobStorage(): ScmIntegrationsGroup<AzureBlobStorageIntergation> {\n    return this.byType.azureBlobStorage;\n  }\n\n  get azure(): ScmIntegrationsGroup<AzureIntegration> {\n    return this.byType.azure;\n  }\n\n  get bitbucketCloud(): ScmIntegrationsGroup<BitbucketCloudIntegration> {\n    return this.byType.bitbucketCloud;\n  }\n\n  get bitbucketServer(): ScmIntegrationsGroup<BitbucketServerIntegration> {\n    return this.byType.bitbucketServer;\n  }\n\n  get gerrit(): ScmIntegrationsGroup<GerritIntegration> {\n    return this.byType.gerrit;\n  }\n\n  get github(): ScmIntegrationsGroup<GithubIntegration> {\n    return this.byType.github;\n  }\n\n  get gitlab(): ScmIntegrationsGroup<GitLabIntegration> {\n    return this.byType.gitlab;\n  }\n\n  get gitea(): ScmIntegrationsGroup<GiteaIntegration> {\n    return this.byType.gitea;\n  }\n\n  get googleGcs(): ScmIntegrationsGroup<GoogleGcsIntegration> {\n    return this.byType.googleGcs;\n  }\n\n  get harness(): ScmIntegrationsGroup<HarnessIntegration> {\n    return this.byType.harness;\n  }\n\n  list(): ScmIntegration[] {\n    return Object.values(this.byType).flatMap(\n      i => i.list() as ScmIntegration[],\n    );\n  }\n\n  byUrl(url: string | URL): ScmIntegration | undefined {\n    const candidates = Object.values(this.byType)\n      .map(i => i.byUrl(url))\n      .filter(Boolean);\n\n    return candidates[0];\n  }\n\n  byHost(host: string): ScmIntegration | undefined {\n    return Object.values(this.byType)\n      .map(i => i.byHost(host))\n      .find(Boolean);\n  }\n\n  resolveUrl(options: {\n    url: string;\n    base: string;\n    lineNumber?: number;\n  }): string {\n    const integration = this.byUrl(options.base);\n    if (!integration) {\n      return defaultScmResolveUrl(options);\n    }\n\n    return integration.resolveUrl(options);\n  }\n\n  resolveEditUrl(url: string): string {\n    const integration = this.byUrl(url);\n    if (!integration) {\n      return url;\n    }\n\n    return integration.resolveEditUrl(url);\n  }\n}\n"],"names":["AwsS3Integration","AwsCodeCommitIntegration","AzureBlobStorageIntergation","AzureIntegration","BitbucketCloudIntegration","BitbucketServerIntegration","GerritIntegration","GithubIntegration","GitLabIntegration","GiteaIntegration","GoogleGcsIntegration","HarnessIntegration","defaultScmResolveUrl"],"mappings":";;;;;;;;;;;;;;;;;;AA0DO,MAAM,eAAA,CAAkD;AAAA,EAC5C,MAAA;AAAA,EAEjB,OAAO,WAAW,MAAA,EAAiC;AACjD,IAAA,OAAO,IAAI,eAAA,CAAgB;AAAA,MACzB,KAAA,EAAOA,iCAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,aAAA,EAAeC,iDAAA,CAAyB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1D,gBAAA,EAAkBC,uDAAA,CAA4B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAChE,KAAA,EAAOC,iCAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,cAAA,EAAgBC,mDAAA,CAA0B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5D,eAAA,EAAiBC,qDAAA,CAA2B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC9D,MAAA,EAAQC,mCAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQC,mCAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQC,mCAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,KAAA,EAAOC,iCAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,SAAA,EAAWC,yCAAA,CAAqB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAClD,OAAA,EAASC,qCAAA,CAAmB,OAAA,CAAQ,EAAE,QAAQ;AAAA,KAC/C,CAAA;AAAA,EACH;AAAA,EAEA,YAAY,kBAAA,EAAwC;AAClD,IAAA,IAAA,CAAK,MAAA,GAAS,kBAAA;AAAA,EAChB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,aAAA,GAAgE;AAClE,IAAA,OAAO,KAAK,MAAA,CAAO,aAAA;AAAA,EACrB;AAAA,EAEA,IAAI,gBAAA,GAAsE;AACxE,IAAA,OAAO,KAAK,MAAA,CAAO,gBAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,cAAA,GAAkE;AACpE,IAAA,OAAO,KAAK,MAAA,CAAO,cAAA;AAAA,EACrB;AAAA,EAEA,IAAI,eAAA,GAAoE;AACtE,IAAA,OAAO,KAAK,MAAA,CAAO,eAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,SAAA,GAAwD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,SAAA;AAAA,EACrB;AAAA,EAEA,IAAI,OAAA,GAAoD;AACtD,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,EACrB;AAAA,EAEA,IAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA;AAAA,MAChC,CAAA,CAAA,KAAK,EAAE,IAAA;AAAK,KACd;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,EAA+C;AACnD,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CACzC,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA,CACrB,OAAO,OAAO,CAAA;AAEjB,IAAA,OAAO,WAAW,CAAC,CAAA;AAAA,EACrB;AAAA,EAEA,OAAO,IAAA,EAA0C;AAC/C,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAC7B,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA,CACvB,KAAK,OAAO,CAAA;AAAA,EACjB;AAAA,EAEA,WAAW,OAAA,EAIA;AACT,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAC3C,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAOC,6BAAqB,OAAO,CAAA;AAAA,IACrC;AAEA,IAAA,OAAO,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,EACvC;AAAA,EAEA,eAAe,GAAA,EAAqB;AAClC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,WAAA,CAAY,eAAe,GAAG,CAAA;AAAA,EACvC;AACF;;;;"}

package/dist/ScmIntegrations.esm.js

@@ -2,7 +2,6 @@ import { AwsS3Integration } from './awsS3/AwsS3Integration.esm.js';
 import { AwsCodeCommitIntegration } from './awsCodeCommit/AwsCodeCommitIntegration.esm.js';
 import { AzureIntegration } from './azure/AzureIntegration.esm.js';
 import { BitbucketCloudIntegration } from './bitbucketCloud/BitbucketCloudIntegration.esm.js';
-import { BitbucketIntegration } from './bitbucket/BitbucketIntegration.esm.js';
 import { BitbucketServerIntegration } from './bitbucketServer/BitbucketServerIntegration.esm.js';
 import { GerritIntegration } from './gerrit/GerritIntegration.esm.js';
 import { GithubIntegration } from './github/GithubIntegration.esm.js';
@@ -23,7 +22,6 @@ class ScmIntegrations {
       awsCodeCommit: AwsCodeCommitIntegration.factory({ config }),
       azureBlobStorage: AzureBlobStorageIntergation.factory({ config }),
       azure: AzureIntegration.factory({ config }),
-      bitbucket: BitbucketIntegration.factory({ config }),
       bitbucketCloud: BitbucketCloudIntegration.factory({ config }),
       bitbucketServer: BitbucketServerIntegration.factory({ config }),
       gerrit: GerritIntegration.factory({ config }),
@@ -49,12 +47,6 @@ class ScmIntegrations {
   get azure() {
     return this.byType.azure;
   }
-  /**
-   * @deprecated in favor of `bitbucketCloud()` and `bitbucketServer()`
-   */
-  get bitbucket() {
-    return this.byType.bitbucket;
-  }
   get bitbucketCloud() {
     return this.byType.bitbucketCloud;
   }
@@ -85,15 +77,7 @@ class ScmIntegrations {
     );
   }
   byUrl(url) {
-    let candidates = Object.values(this.byType).map((i) => i.byUrl(url)).filter(Boolean);
-    if (candidates.length > 1) {
-      const filteredCandidates = candidates.filter(
-        (x) => !(x instanceof BitbucketIntegration)
-      );
-      if (filteredCandidates.length !== 0) {
-        candidates = filteredCandidates;
-      }
-    }
+    const candidates = Object.values(this.byType).map((i) => i.byUrl(url)).filter(Boolean);
     return candidates[0];
   }
   byHost(host) {

package/dist/ScmIntegrations.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"ScmIntegrations.esm.js","sources":["../src/ScmIntegrations.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { AwsS3Integration } from './awsS3/AwsS3Integration';\nimport { AwsCodeCommitIntegration } from './awsCodeCommit/AwsCodeCommitIntegration';\nimport { AzureIntegration } from './azure/AzureIntegration';\nimport { BitbucketCloudIntegration } from './bitbucketCloud/BitbucketCloudIntegration';\nimport { BitbucketIntegration } from './bitbucket/BitbucketIntegration';\nimport { BitbucketServerIntegration } from './bitbucketServer/BitbucketServerIntegration';\nimport { GerritIntegration } from './gerrit/GerritIntegration';\nimport { GithubIntegration } from './github/GithubIntegration';\nimport { GitLabIntegration } from './gitlab/GitLabIntegration';\nimport { defaultScmResolveUrl } from './helpers';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\nimport { ScmIntegrationRegistry } from './registry';\nimport { GiteaIntegration } from './gitea';\nimport { HarnessIntegration } from './harness/HarnessIntegration';\nimport { AzureBlobStorageIntergation } from './azureBlobStorage';\nimport { GoogleGcsIntegration } from './googleGcs/GoogleGcsIntegration';\n\n/**\n * The set of supported integrations.\n *\n * @public\n */\nexport interface IntegrationsByType {\n  awsS3: ScmIntegrationsGroup<AwsS3Integration>;\n  awsCodeCommit: ScmIntegrationsGroup<AwsCodeCommitIntegration>;\n  azureBlobStorage: ScmIntegrationsGroup<AzureBlobStorageIntergation>;\n  azure: ScmIntegrationsGroup<AzureIntegration>;\n  /**\n   * @deprecated in favor of `bitbucketCloud` and `bitbucketServer`\n   */\n  bitbucket: ScmIntegrationsGroup<BitbucketIntegration>;\n  bitbucketCloud: ScmIntegrationsGroup<BitbucketCloudIntegration>;\n  bitbucketServer: ScmIntegrationsGroup<BitbucketServerIntegration>;\n  gerrit: ScmIntegrationsGroup<GerritIntegration>;\n  github: ScmIntegrationsGroup<GithubIntegration>;\n  gitlab: ScmIntegrationsGroup<GitLabIntegration>;\n  gitea: ScmIntegrationsGroup<GiteaIntegration>;\n  googleGcs: ScmIntegrationsGroup<GoogleGcsIntegration>;\n  harness: ScmIntegrationsGroup<HarnessIntegration>;\n}\n\n/**\n * Exposes the set of supported integrations.\n *\n * @public\n */\nexport class ScmIntegrations implements ScmIntegrationRegistry {\n  private readonly byType: IntegrationsByType;\n\n  static fromConfig(config: Config): ScmIntegrations {\n    return new ScmIntegrations({\n      awsS3: AwsS3Integration.factory({ config }),\n      awsCodeCommit: AwsCodeCommitIntegration.factory({ config }),\n      azureBlobStorage: AzureBlobStorageIntergation.factory({ config }),\n      azure: AzureIntegration.factory({ config }),\n      bitbucket: BitbucketIntegration.factory({ config }),\n      bitbucketCloud: BitbucketCloudIntegration.factory({ config }),\n      bitbucketServer: BitbucketServerIntegration.factory({ config }),\n      gerrit: GerritIntegration.factory({ config }),\n      github: GithubIntegration.factory({ config }),\n      gitlab: GitLabIntegration.factory({ config }),\n      gitea: GiteaIntegration.factory({ config }),\n      googleGcs: GoogleGcsIntegration.factory({ config }),\n      harness: HarnessIntegration.factory({ config }),\n    });\n  }\n\n  constructor(integrationsByType: IntegrationsByType) {\n    this.byType = integrationsByType;\n  }\n\n  get awsS3(): ScmIntegrationsGroup<AwsS3Integration> {\n    return this.byType.awsS3;\n  }\n\n  get awsCodeCommit(): ScmIntegrationsGroup<AwsCodeCommitIntegration> {\n    return this.byType.awsCodeCommit;\n  }\n\n  get azureBlobStorage(): ScmIntegrationsGroup<AzureBlobStorageIntergation> {\n    return this.byType.azureBlobStorage;\n  }\n\n  get azure(): ScmIntegrationsGroup<AzureIntegration> {\n    return this.byType.azure;\n  }\n\n  /**\n   * @deprecated in favor of `bitbucketCloud()` and `bitbucketServer()`\n   */\n  get bitbucket(): ScmIntegrationsGroup<BitbucketIntegration> {\n    return this.byType.bitbucket;\n  }\n\n  get bitbucketCloud(): ScmIntegrationsGroup<BitbucketCloudIntegration> {\n    return this.byType.bitbucketCloud;\n  }\n\n  get bitbucketServer(): ScmIntegrationsGroup<BitbucketServerIntegration> {\n    return this.byType.bitbucketServer;\n  }\n\n  get gerrit(): ScmIntegrationsGroup<GerritIntegration> {\n    return this.byType.gerrit;\n  }\n\n  get github(): ScmIntegrationsGroup<GithubIntegration> {\n    return this.byType.github;\n  }\n\n  get gitlab(): ScmIntegrationsGroup<GitLabIntegration> {\n    return this.byType.gitlab;\n  }\n\n  get gitea(): ScmIntegrationsGroup<GiteaIntegration> {\n    return this.byType.gitea;\n  }\n\n  get googleGcs(): ScmIntegrationsGroup<GoogleGcsIntegration> {\n    return this.byType.googleGcs;\n  }\n\n  get harness(): ScmIntegrationsGroup<HarnessIntegration> {\n    return this.byType.harness;\n  }\n\n  list(): ScmIntegration[] {\n    return Object.values(this.byType).flatMap(\n      i => i.list() as ScmIntegration[],\n    );\n  }\n\n  byUrl(url: string | URL): ScmIntegration | undefined {\n    let candidates = Object.values(this.byType)\n      .map(i => i.byUrl(url))\n      .filter(Boolean);\n\n    // Do not return deprecated integrations if there are other options\n    if (candidates.length > 1) {\n      const filteredCandidates = candidates.filter(\n        x => !(x instanceof BitbucketIntegration),\n      );\n      if (filteredCandidates.length !== 0) {\n        candidates = filteredCandidates;\n      }\n    }\n\n    return candidates[0];\n  }\n\n  byHost(host: string): ScmIntegration | undefined {\n    return Object.values(this.byType)\n      .map(i => i.byHost(host))\n      .find(Boolean);\n  }\n\n  resolveUrl(options: {\n    url: string;\n    base: string;\n    lineNumber?: number;\n  }): string {\n    const integration = this.byUrl(options.base);\n    if (!integration) {\n      return defaultScmResolveUrl(options);\n    }\n\n    return integration.resolveUrl(options);\n  }\n\n  resolveEditUrl(url: string): string {\n    const integration = this.byUrl(url);\n    if (!integration) {\n      return url;\n    }\n\n    return integration.resolveEditUrl(url);\n  }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA+DO,MAAM,eAAA,CAAkD;AAAA,EAC5C,MAAA;AAAA,EAEjB,OAAO,WAAW,MAAA,EAAiC;AACjD,IAAA,OAAO,IAAI,eAAA,CAAgB;AAAA,MACzB,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,aAAA,EAAe,wBAAA,CAAyB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1D,gBAAA,EAAkB,2BAAA,CAA4B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAChE,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,SAAA,EAAW,oBAAA,CAAqB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAClD,cAAA,EAAgB,yBAAA,CAA0B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5D,eAAA,EAAiB,0BAAA,CAA2B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC9D,MAAA,EAAQ,iBAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQ,iBAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQ,iBAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,SAAA,EAAW,oBAAA,CAAqB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAClD,OAAA,EAAS,kBAAA,CAAmB,OAAA,CAAQ,EAAE,QAAQ;AAAA,KAC/C,CAAA;AAAA,EACH;AAAA,EAEA,YAAY,kBAAA,EAAwC;AAClD,IAAA,IAAA,CAAK,MAAA,GAAS,kBAAA;AAAA,EAChB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,aAAA,GAAgE;AAClE,IAAA,OAAO,KAAK,MAAA,CAAO,aAAA;AAAA,EACrB;AAAA,EAEA,IAAI,gBAAA,GAAsE;AACxE,IAAA,OAAO,KAAK,MAAA,CAAO,gBAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,SAAA,GAAwD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,SAAA;AAAA,EACrB;AAAA,EAEA,IAAI,cAAA,GAAkE;AACpE,IAAA,OAAO,KAAK,MAAA,CAAO,cAAA;AAAA,EACrB;AAAA,EAEA,IAAI,eAAA,GAAoE;AACtE,IAAA,OAAO,KAAK,MAAA,CAAO,eAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,SAAA,GAAwD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,SAAA;AAAA,EACrB;AAAA,EAEA,IAAI,OAAA,GAAoD;AACtD,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,EACrB;AAAA,EAEA,IAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA;AAAA,MAChC,CAAA,CAAA,KAAK,EAAE,IAAA;AAAK,KACd;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,EAA+C;AACnD,IAAA,IAAI,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CACvC,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA,CACrB,OAAO,OAAO,CAAA;AAGjB,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,MAAM,qBAAqB,UAAA,CAAW,MAAA;AAAA,QACpC,CAAA,CAAA,KAAK,EAAE,CAAA,YAAa,oBAAA;AAAA,OACtB;AACA,MAAA,IAAI,kBAAA,CAAmB,WAAW,CAAA,EAAG;AACnC,QAAA,UAAA,GAAa,kBAAA;AAAA,MACf;AAAA,IACF;AAEA,IAAA,OAAO,WAAW,CAAC,CAAA;AAAA,EACrB;AAAA,EAEA,OAAO,IAAA,EAA0C;AAC/C,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAC7B,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA,CACvB,KAAK,OAAO,CAAA;AAAA,EACjB;AAAA,EAEA,WAAW,OAAA,EAIA;AACT,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAC3C,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,qBAAqB,OAAO,CAAA;AAAA,IACrC;AAEA,IAAA,OAAO,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,EACvC;AAAA,EAEA,eAAe,GAAA,EAAqB;AAClC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,WAAA,CAAY,eAAe,GAAG,CAAA;AAAA,EACvC;AACF;;;;"}
+{"version":3,"file":"ScmIntegrations.esm.js","sources":["../src/ScmIntegrations.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { AwsS3Integration } from './awsS3/AwsS3Integration';\nimport { AwsCodeCommitIntegration } from './awsCodeCommit/AwsCodeCommitIntegration';\nimport { AzureIntegration } from './azure/AzureIntegration';\nimport { BitbucketCloudIntegration } from './bitbucketCloud/BitbucketCloudIntegration';\nimport { BitbucketServerIntegration } from './bitbucketServer/BitbucketServerIntegration';\nimport { GerritIntegration } from './gerrit/GerritIntegration';\nimport { GithubIntegration } from './github/GithubIntegration';\nimport { GitLabIntegration } from './gitlab/GitLabIntegration';\nimport { defaultScmResolveUrl } from './helpers';\nimport { ScmIntegration, ScmIntegrationsGroup } from './types';\nimport { ScmIntegrationRegistry } from './registry';\nimport { GiteaIntegration } from './gitea';\nimport { HarnessIntegration } from './harness/HarnessIntegration';\nimport { AzureBlobStorageIntergation } from './azureBlobStorage';\nimport { GoogleGcsIntegration } from './googleGcs/GoogleGcsIntegration';\n\n/**\n * The set of supported integrations.\n *\n * @public\n */\nexport interface IntegrationsByType {\n  awsS3: ScmIntegrationsGroup<AwsS3Integration>;\n  awsCodeCommit: ScmIntegrationsGroup<AwsCodeCommitIntegration>;\n  azureBlobStorage: ScmIntegrationsGroup<AzureBlobStorageIntergation>;\n  azure: ScmIntegrationsGroup<AzureIntegration>;\n  bitbucketCloud: ScmIntegrationsGroup<BitbucketCloudIntegration>;\n  bitbucketServer: ScmIntegrationsGroup<BitbucketServerIntegration>;\n  gerrit: ScmIntegrationsGroup<GerritIntegration>;\n  github: ScmIntegrationsGroup<GithubIntegration>;\n  gitlab: ScmIntegrationsGroup<GitLabIntegration>;\n  gitea: ScmIntegrationsGroup<GiteaIntegration>;\n  googleGcs: ScmIntegrationsGroup<GoogleGcsIntegration>;\n  harness: ScmIntegrationsGroup<HarnessIntegration>;\n}\n\n/**\n * Exposes the set of supported integrations.\n *\n * @public\n */\nexport class ScmIntegrations implements ScmIntegrationRegistry {\n  private readonly byType: IntegrationsByType;\n\n  static fromConfig(config: Config): ScmIntegrations {\n    return new ScmIntegrations({\n      awsS3: AwsS3Integration.factory({ config }),\n      awsCodeCommit: AwsCodeCommitIntegration.factory({ config }),\n      azureBlobStorage: AzureBlobStorageIntergation.factory({ config }),\n      azure: AzureIntegration.factory({ config }),\n      bitbucketCloud: BitbucketCloudIntegration.factory({ config }),\n      bitbucketServer: BitbucketServerIntegration.factory({ config }),\n      gerrit: GerritIntegration.factory({ config }),\n      github: GithubIntegration.factory({ config }),\n      gitlab: GitLabIntegration.factory({ config }),\n      gitea: GiteaIntegration.factory({ config }),\n      googleGcs: GoogleGcsIntegration.factory({ config }),\n      harness: HarnessIntegration.factory({ config }),\n    });\n  }\n\n  constructor(integrationsByType: IntegrationsByType) {\n    this.byType = integrationsByType;\n  }\n\n  get awsS3(): ScmIntegrationsGroup<AwsS3Integration> {\n    return this.byType.awsS3;\n  }\n\n  get awsCodeCommit(): ScmIntegrationsGroup<AwsCodeCommitIntegration> {\n    return this.byType.awsCodeCommit;\n  }\n\n  get azureBlobStorage(): ScmIntegrationsGroup<AzureBlobStorageIntergation> {\n    return this.byType.azureBlobStorage;\n  }\n\n  get azure(): ScmIntegrationsGroup<AzureIntegration> {\n    return this.byType.azure;\n  }\n\n  get bitbucketCloud(): ScmIntegrationsGroup<BitbucketCloudIntegration> {\n    return this.byType.bitbucketCloud;\n  }\n\n  get bitbucketServer(): ScmIntegrationsGroup<BitbucketServerIntegration> {\n    return this.byType.bitbucketServer;\n  }\n\n  get gerrit(): ScmIntegrationsGroup<GerritIntegration> {\n    return this.byType.gerrit;\n  }\n\n  get github(): ScmIntegrationsGroup<GithubIntegration> {\n    return this.byType.github;\n  }\n\n  get gitlab(): ScmIntegrationsGroup<GitLabIntegration> {\n    return this.byType.gitlab;\n  }\n\n  get gitea(): ScmIntegrationsGroup<GiteaIntegration> {\n    return this.byType.gitea;\n  }\n\n  get googleGcs(): ScmIntegrationsGroup<GoogleGcsIntegration> {\n    return this.byType.googleGcs;\n  }\n\n  get harness(): ScmIntegrationsGroup<HarnessIntegration> {\n    return this.byType.harness;\n  }\n\n  list(): ScmIntegration[] {\n    return Object.values(this.byType).flatMap(\n      i => i.list() as ScmIntegration[],\n    );\n  }\n\n  byUrl(url: string | URL): ScmIntegration | undefined {\n    const candidates = Object.values(this.byType)\n      .map(i => i.byUrl(url))\n      .filter(Boolean);\n\n    return candidates[0];\n  }\n\n  byHost(host: string): ScmIntegration | undefined {\n    return Object.values(this.byType)\n      .map(i => i.byHost(host))\n      .find(Boolean);\n  }\n\n  resolveUrl(options: {\n    url: string;\n    base: string;\n    lineNumber?: number;\n  }): string {\n    const integration = this.byUrl(options.base);\n    if (!integration) {\n      return defaultScmResolveUrl(options);\n    }\n\n    return integration.resolveUrl(options);\n  }\n\n  resolveEditUrl(url: string): string {\n    const integration = this.byUrl(url);\n    if (!integration) {\n      return url;\n    }\n\n    return integration.resolveEditUrl(url);\n  }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AA0DO,MAAM,eAAA,CAAkD;AAAA,EAC5C,MAAA;AAAA,EAEjB,OAAO,WAAW,MAAA,EAAiC;AACjD,IAAA,OAAO,IAAI,eAAA,CAAgB;AAAA,MACzB,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,aAAA,EAAe,wBAAA,CAAyB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1D,gBAAA,EAAkB,2BAAA,CAA4B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAChE,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,cAAA,EAAgB,yBAAA,CAA0B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5D,eAAA,EAAiB,0BAAA,CAA2B,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC9D,MAAA,EAAQ,iBAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQ,iBAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,MAAA,EAAQ,iBAAA,CAAkB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC5C,KAAA,EAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAC1C,SAAA,EAAW,oBAAA,CAAqB,OAAA,CAAQ,EAAE,QAAQ,CAAA;AAAA,MAClD,OAAA,EAAS,kBAAA,CAAmB,OAAA,CAAQ,EAAE,QAAQ;AAAA,KAC/C,CAAA;AAAA,EACH;AAAA,EAEA,YAAY,kBAAA,EAAwC;AAClD,IAAA,IAAA,CAAK,MAAA,GAAS,kBAAA;AAAA,EAChB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,aAAA,GAAgE;AAClE,IAAA,OAAO,KAAK,MAAA,CAAO,aAAA;AAAA,EACrB;AAAA,EAEA,IAAI,gBAAA,GAAsE;AACxE,IAAA,OAAO,KAAK,MAAA,CAAO,gBAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,cAAA,GAAkE;AACpE,IAAA,OAAO,KAAK,MAAA,CAAO,cAAA;AAAA,EACrB;AAAA,EAEA,IAAI,eAAA,GAAoE;AACtE,IAAA,OAAO,KAAK,MAAA,CAAO,eAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,MAAA,GAAkD;AACpD,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA,EAEA,IAAI,KAAA,GAAgD;AAClD,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAEA,IAAI,SAAA,GAAwD;AAC1D,IAAA,OAAO,KAAK,MAAA,CAAO,SAAA;AAAA,EACrB;AAAA,EAEA,IAAI,OAAA,GAAoD;AACtD,IAAA,OAAO,KAAK,MAAA,CAAO,OAAA;AAAA,EACrB;AAAA,EAEA,IAAA,GAAyB;AACvB,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA;AAAA,MAChC,CAAA,CAAA,KAAK,EAAE,IAAA;AAAK,KACd;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,EAA+C;AACnD,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CACzC,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA,CACrB,OAAO,OAAO,CAAA;AAEjB,IAAA,OAAO,WAAW,CAAC,CAAA;AAAA,EACrB;AAAA,EAEA,OAAO,IAAA,EAA0C;AAC/C,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAC7B,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA,CACvB,KAAK,OAAO,CAAA;AAAA,EACjB;AAAA,EAEA,WAAW,OAAA,EAIA;AACT,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AAC3C,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,qBAAqB,OAAO,CAAA;AAAA,IACrC;AAEA,IAAA,OAAO,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,EACvC;AAAA,EAEA,eAAe,GAAA,EAAqB;AAClC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,WAAA,CAAY,eAAe,GAAG,CAAA;AAAA,EACvC;AACF;;;;"}

package/dist/azure/config.cjs.js

@@ -39,8 +39,14 @@ function asAzureDevOpsCredential(credential) {
   throw new Error("is not a valid credential");
 }
 function readAzureIntegrationConfig(config) {
+  deprecatedConfigCheck(config);
   const host = config.getOptionalString("host") ?? AZURE_HOST;
-  let credentialConfigs = config.getOptionalConfigArray("credentials")?.map((credential) => {
+  if (!helpers.isValidHost(host)) {
+    throw new Error(
+      `Invalid Azure integration config, '${host}' is not a valid host`
+    );
+  }
+  const credentialConfigs = config.getOptionalConfigArray("credentials")?.map((credential) => {
     const result = {
       organizations: credential.getOptionalStringArray("organizations"),
       personalAccessToken: credential.getOptionalString("personalAccessToken")?.trim(),
@@ -51,40 +57,6 @@ function readAzureIntegrationConfig(config) {
     };
     return result;
   });
-  const token = config.getOptionalString("token")?.trim();
-  if (config.getOptional("credential") !== void 0 && config.getOptional("credentials") !== void 0) {
-    throw new Error(
-      `Invalid Azure integration config, 'credential' and 'credentials' cannot be used together. Use 'credentials' instead.`
-    );
-  }
-  if (config.getOptional("token") !== void 0 && config.getOptional("credentials") !== void 0) {
-    throw new Error(
-      `Invalid Azure integration config, 'token' and 'credentials' cannot be used together. Use 'credentials' instead.`
-    );
-  }
-  if (token !== void 0) {
-    const mapped = [{ personalAccessToken: token }];
-    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;
-  }
-  if (config.getOptional("credential") !== void 0) {
-    const mapped = [
-      {
-        organizations: config.getOptionalStringArray(
-          "credential.organizations"
-        ),
-        token: config.getOptionalString("credential.token")?.trim(),
-        tenantId: config.getOptionalString("credential.tenantId"),
-        clientId: config.getOptionalString("credential.clientId"),
-        clientSecret: config.getOptionalString("credential.clientSecret")?.trim()
-      }
-    ];
-    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;
-  }
-  if (!helpers.isValidHost(host)) {
-    throw new Error(
-      `Invalid Azure integration config, '${host}' is not a valid host`
-    );
-  }
   let credentials = void 0;
   if (credentialConfigs !== void 0) {
     const errors = credentialConfigs?.reduce((acc, credentialConfig, index) => {
@@ -154,6 +126,13 @@ function readAzureIntegrationConfigs(configs) {
   }
   return result;
 }
+function deprecatedConfigCheck(config) {
+  if (config.getOptional("credential") || config.getOptional("token")) {
+    throw new Error(
+      `Invalid Azure integration config, 'credential' and 'token' have been removed. Use 'credentials' instead.`
+    );
+  }
+}
 
 exports.readAzureIntegrationConfig = readAzureIntegrationConfig;
 exports.readAzureIntegrationConfigs = readAzureIntegrationConfigs;

package/dist/azure/config.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs.js","sources":["../../src/azure/config.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { isValidHost } from '../helpers';\n\nconst AZURE_HOST = 'dev.azure.com';\n\n/**\n * The configuration parameters for a single Azure provider.\n *\n * @public\n */\nexport type AzureIntegrationConfig = {\n  /**\n   * The host of the target that this matches on, e.g. \"dev.azure.com\".\n   *\n   * Currently only \"dev.azure.com\" is supported.\n   */\n  host: string;\n\n  /**\n   * The authorization token to use for requests.\n   *\n   * If no token is specified, anonymous access is used.\n   *\n   * @deprecated Use `credentials` instead.\n   */\n  token?: string;\n\n  /**\n   * The credential to use for requests.\n   *\n   * If no credential is specified anonymous access is used.\n   *\n   * @deprecated Use `credentials` instead.\n   */\n  credential?: AzureDevOpsCredential;\n\n  /**\n   * The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used.\n   * If not organization matches the first credential without an organization is used.\n   *\n   * If no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used.\n   */\n  credentials?: AzureDevOpsCredential[];\n\n  /**\n   * Signing key for commits\n   */\n  commitSigningKey?: string;\n};\n\n/**\n * The kind of Azure DevOps credential.\n * @public\n */\nexport type AzureDevOpsCredentialKind =\n  | 'PersonalAccessToken'\n  | 'ClientSecret'\n  | 'ManagedIdentity'\n  | 'ManagedIdentityClientAssertion';\n\n/**\n * Common fields for the Azure DevOps credentials.\n * @public\n */\nexport type AzureCredentialBase = {\n  /**\n   * The kind of credential.\n   */\n  kind: AzureDevOpsCredentialKind;\n  /**\n   * The Azure DevOps organizations for which to use this credential.\n   */\n  organizations?: string[];\n};\n\n/**\n * A client secret credential that was generated for an App Registration.\n * @public\n */\nexport type AzureClientSecretCredential = AzureCredentialBase & {\n  kind: 'ClientSecret';\n  /**\n   * The Entra ID tenant\n   */\n  tenantId: string;\n  /**\n   * The client id\n   */\n  clientId: string;\n\n  /**\n   * The client secret\n   */\n  clientSecret: string;\n};\n\n/**\n * A client assertion credential that uses a managed identity to generate a client assertion (JWT).\n * @public\n */\nexport type AzureManagedIdentityClientAssertionCredential =\n  AzureCredentialBase & {\n    kind: 'ManagedIdentityClientAssertion';\n    /**\n     * The Entra ID tenant\n     */\n    tenantId: string;\n\n    /**\n     * The client ID of the app registration you want to authenticate as.\n     */\n    clientId: string;\n\n    /**\n     * The client ID of the managed identity used to generate a client assertion (JWT).\n     * Set to \"system-assigned\" to automatically use the system-assigned managed identity.\n     * For user-assigned managed identities, specify the client ID of the managed identity you want to use.\n     */\n    managedIdentityClientId: 'system-assigned' | string;\n  };\n\n/**\n * A managed identity credential.\n * @public\n */\nexport type AzureManagedIdentityCredential = AzureCredentialBase & {\n  kind: 'ManagedIdentity';\n  /**\n   * The clientId\n   */\n  clientId: 'system-assigned' | string;\n};\n\n/**\n * A personal access token credential.\n * @public\n */\nexport type PersonalAccessTokenCredential = AzureCredentialBase & {\n  kind: 'PersonalAccessToken';\n  personalAccessToken: string;\n};\n\n/**\n * The general shape of a credential that can be used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredentialLike = Omit<\n  Partial<AzureClientSecretCredential> &\n    Partial<AzureManagedIdentityClientAssertionCredential> &\n    Partial<AzureManagedIdentityCredential> &\n    Partial<PersonalAccessTokenCredential>,\n  'kind'\n>;\n\n/**\n * Credential used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredential =\n  | AzureClientSecretCredential\n  | AzureManagedIdentityClientAssertionCredential\n  | AzureManagedIdentityCredential\n  | PersonalAccessTokenCredential;\n\nconst AzureDevOpsCredentialFields = [\n  'clientId',\n  'clientSecret',\n  'managedIdentityClientId',\n  'tenantId',\n  'personalAccessToken',\n] as const;\ntype AzureDevOpsCredentialField = (typeof AzureDevOpsCredentialFields)[number];\n\nconst AzureDevopsCredentialFieldMap = new Map<\n  AzureDevOpsCredentialKind,\n  AzureDevOpsCredentialField[]\n>([\n  ['ClientSecret', ['clientId', 'clientSecret', 'tenantId']],\n  ['ManagedIdentity', ['clientId']],\n  [\n    'ManagedIdentityClientAssertion',\n    ['clientId', 'managedIdentityClientId', 'tenantId'],\n  ],\n  ['PersonalAccessToken', ['personalAccessToken']],\n]);\n\nfunction asAzureDevOpsCredential(\n  credential: AzureDevOpsCredentialLike,\n): AzureDevOpsCredential {\n  for (const entry of AzureDevopsCredentialFieldMap.entries()) {\n    const [kind, requiredFields] = entry;\n\n    const forbiddenFields = AzureDevOpsCredentialFields.filter(\n      field => !requiredFields.includes(field as AzureDevOpsCredentialField),\n    );\n\n    if (\n      requiredFields.every(field => credential[field] !== undefined) &&\n      forbiddenFields.every(field => credential[field] === undefined)\n    ) {\n      return {\n        kind,\n        organizations: credential.organizations,\n        ...requiredFields.reduce((acc, field) => {\n          acc[field] = credential[field];\n          return acc;\n        }, {} as Record<string, any>),\n      } as AzureDevOpsCredential;\n    }\n  }\n  throw new Error('is not a valid credential');\n}\n\n/**\n * Reads a single Azure integration config.\n *\n * @param config - The config object of a single integration\n * @public\n */\nexport function readAzureIntegrationConfig(\n  config: Config,\n): AzureIntegrationConfig {\n  const host = config.getOptionalString('host') ?? AZURE_HOST;\n\n  let credentialConfigs = config\n    .getOptionalConfigArray('credentials')\n    ?.map(credential => {\n      const result: Partial<AzureDevOpsCredentialLike> = {\n        organizations: credential.getOptionalStringArray('organizations'),\n        personalAccessToken: credential\n          .getOptionalString('personalAccessToken')\n          ?.trim(),\n        tenantId: credential.getOptionalString('tenantId')?.trim(),\n        clientId: credential.getOptionalString('clientId')?.trim(),\n        clientSecret: credential.getOptionalString('clientSecret')?.trim(),\n        managedIdentityClientId: credential\n          .getOptionalString('managedIdentityClientId')\n          ?.trim(),\n      };\n\n      return result;\n    });\n\n  const token = config.getOptionalString('token')?.trim();\n\n  if (\n    config.getOptional('credential') !== undefined &&\n    config.getOptional('credentials') !== undefined\n  ) {\n    throw new Error(\n      `Invalid Azure integration config, 'credential' and 'credentials' cannot be used together. Use 'credentials' instead.`,\n    );\n  }\n\n  if (\n    config.getOptional('token') !== undefined &&\n    config.getOptional('credentials') !== undefined\n  ) {\n    throw new Error(\n      `Invalid Azure integration config, 'token' and 'credentials' cannot be used together. Use 'credentials' instead.`,\n    );\n  }\n\n  if (token !== undefined) {\n    const mapped = [{ personalAccessToken: token }];\n    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;\n  }\n\n  if (config.getOptional('credential') !== undefined) {\n    const mapped = [\n      {\n        organizations: config.getOptionalStringArray(\n          'credential.organizations',\n        ),\n        token: config.getOptionalString('credential.token')?.trim(),\n        tenantId: config.getOptionalString('credential.tenantId'),\n        clientId: config.getOptionalString('credential.clientId'),\n        clientSecret: config\n          .getOptionalString('credential.clientSecret')\n          ?.trim(),\n      },\n    ];\n    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;\n  }\n\n  if (!isValidHost(host)) {\n    throw new Error(\n      `Invalid Azure integration config, '${host}' is not a valid host`,\n    );\n  }\n\n  let credentials: AzureDevOpsCredential[] | undefined = undefined;\n  if (credentialConfigs !== undefined) {\n    const errors = credentialConfigs\n      ?.reduce((acc, credentialConfig, index) => {\n        let error: string | undefined = undefined;\n        try {\n          asAzureDevOpsCredential(credentialConfig);\n        } catch (e) {\n          error = e.message;\n        }\n\n        if (error !== undefined) {\n          acc.push(`credential at position ${index + 1} ${error}`);\n        }\n\n        return acc;\n      }, Array.of<string>())\n      .concat(\n        Object.entries(\n          credentialConfigs\n            .filter(\n              credential =>\n                credential.organizations !== undefined &&\n                credential.organizations.length > 0,\n            )\n            .reduce((acc, credential, index) => {\n              credential.organizations?.forEach(organization => {\n                if (!acc[organization]) {\n                  acc[organization] = [];\n                }\n\n                acc[organization].push(index + 1);\n              });\n\n              return acc;\n            }, {} as Record<string, number[]>),\n        )\n          .filter(([_, indexes]) => indexes.length > 1)\n          .reduce((acc, [org, indexes]) => {\n            acc.push(\n              `organization ${org} is specified multiple times in credentials at positions ${indexes\n                .slice(0, indexes.length - 1)\n                .join(', ')} and ${indexes[indexes.length - 1]}`,\n            );\n            return acc;\n          }, Array.of<string>()),\n      );\n\n    if (errors?.length > 0) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}: ${errors.join('; ')}`,\n      );\n    }\n\n    credentials = credentialConfigs.map(credentialConfig =>\n      asAzureDevOpsCredential(credentialConfig),\n    );\n\n    if (\n      credentials.some(\n        credential => credential.kind !== 'PersonalAccessToken',\n      ) &&\n      host !== AZURE_HOST\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, only personal access tokens can be used with hosts other than ${AZURE_HOST}`,\n      );\n    }\n\n    if (\n      credentials.filter(\n        credential =>\n          credential.organizations === undefined ||\n          credential.organizations.length === 0,\n      ).length > 1\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, you cannot specify multiple credentials without organizations`,\n      );\n    }\n  }\n\n  return {\n    host,\n    credentials,\n    commitSigningKey: config.getOptionalString('commitSigningKey'),\n  };\n}\n\n/**\n * Reads a set of Azure integration configs, and inserts some defaults for\n * public Azure if not specified.\n *\n * @param configs - All of the integration config objects\n * @public\n */\nexport function readAzureIntegrationConfigs(\n  configs: Config[],\n): AzureIntegrationConfig[] {\n  // First read all the explicit integrations\n  const result = configs.map(readAzureIntegrationConfig);\n\n  // If no explicit dev.azure.com integration was added, put one in the list as\n  // a convenience\n  if (!result.some(c => c.host === AZURE_HOST)) {\n    result.push({ host: AZURE_HOST });\n  }\n\n  return result;\n}\n"],"names":["isValidHost"],"mappings":";;;;AAmBA,MAAM,UAAA,GAAa,eAAA;AAiKnB,MAAM,2BAAA,GAA8B;AAAA,EAClC,UAAA;AAAA,EACA,cAAA;AAAA,EACA,yBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAGA,MAAM,6BAAA,uBAAoC,GAAA,CAGxC;AAAA,EACA,CAAC,cAAA,EAAgB,CAAC,UAAA,EAAY,cAAA,EAAgB,UAAU,CAAC,CAAA;AAAA,EACzD,CAAC,iBAAA,EAAmB,CAAC,UAAU,CAAC,CAAA;AAAA,EAChC;AAAA,IACE,gCAAA;AAAA,IACA,CAAC,UAAA,EAAY,yBAAA,EAA2B,UAAU;AAAA,GACpD;AAAA,EACA,CAAC,qBAAA,EAAuB,CAAC,qBAAqB,CAAC;AACjD,CAAC,CAAA;AAED,SAAS,wBACP,UAAA,EACuB;AACvB,EAAA,KAAA,MAAW,KAAA,IAAS,6BAAA,CAA8B,OAAA,EAAQ,EAAG;AAC3D,IAAA,MAAM,CAAC,IAAA,EAAM,cAAc,CAAA,GAAI,KAAA;AAE/B,IAAA,MAAM,kBAAkB,2BAAA,CAA4B,MAAA;AAAA,MAClD,CAAA,KAAA,KAAS,CAAC,cAAA,CAAe,QAAA,CAAS,KAAmC;AAAA,KACvE;AAEA,IAAA,IACE,cAAA,CAAe,KAAA,CAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,IAC7D,eAAA,CAAgB,MAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,EAC9D;AACA,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,eAAe,UAAA,CAAW,aAAA;AAAA,QAC1B,GAAG,cAAA,CAAe,MAAA,CAAO,CAAC,KAAK,KAAA,KAAU;AACvC,UAAA,GAAA,CAAI,KAAK,CAAA,GAAI,UAAA,CAAW,KAAK,CAAA;AAC7B,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAAyB;AAAA,OAC9B;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAC7C;AAQO,SAAS,2BACd,MAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA,IAAK,UAAA;AAEjD,EAAA,IAAI,oBAAoB,MAAA,CACrB,sBAAA,CAAuB,aAAa,CAAA,EACnC,IAAI,CAAA,UAAA,KAAc;AAClB,IAAA,MAAM,MAAA,GAA6C;AAAA,MACjD,aAAA,EAAe,UAAA,CAAW,sBAAA,CAAuB,eAAe,CAAA;AAAA,MAChE,mBAAA,EAAqB,UAAA,CAClB,iBAAA,CAAkB,qBAAqB,GACtC,IAAA,EAAK;AAAA,MACT,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,YAAA,EAAc,UAAA,CAAW,iBAAA,CAAkB,cAAc,GAAG,IAAA,EAAK;AAAA,MACjE,uBAAA,EAAyB,UAAA,CACtB,iBAAA,CAAkB,yBAAyB,GAC1C,IAAA;AAAK,KACX;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AAEH,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,iBAAA,CAAkB,OAAO,GAAG,IAAA,EAAK;AAEtD,EAAA,IACE,MAAA,CAAO,YAAY,YAAY,CAAA,KAAM,UACrC,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA,KAAM,MAAA,EACtC;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,oHAAA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IACE,MAAA,CAAO,YAAY,OAAO,CAAA,KAAM,UAChC,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA,KAAM,MAAA,EACtC;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,+GAAA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,MAAM,MAAA,GAAS,CAAC,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAC9C,IAAA,iBAAA,GAAoB,iBAAA,EAAmB,MAAA,CAAO,MAAM,CAAA,IAAK,MAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,MAAA,CAAO,WAAA,CAAY,YAAY,CAAA,KAAM,MAAA,EAAW;AAClD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb;AAAA,QACE,eAAe,MAAA,CAAO,sBAAA;AAAA,UACpB;AAAA,SACF;AAAA,QACA,KAAA,EAAO,MAAA,CAAO,iBAAA,CAAkB,kBAAkB,GAAG,IAAA,EAAK;AAAA,QAC1D,QAAA,EAAU,MAAA,CAAO,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACxD,QAAA,EAAU,MAAA,CAAO,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACxD,YAAA,EAAc,MAAA,CACX,iBAAA,CAAkB,yBAAyB,GAC1C,IAAA;AAAK;AACX,KACF;AACA,IAAA,iBAAA,GAAoB,iBAAA,EAAmB,MAAA,CAAO,MAAM,CAAA,IAAK,MAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,CAACA,mBAAA,CAAY,IAAI,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sCAAsC,IAAI,CAAA,qBAAA;AAAA,KAC5C;AAAA,EACF;AAEA,EAAA,IAAI,WAAA,GAAmD,MAAA;AACvD,EAAA,IAAI,sBAAsB,MAAA,EAAW;AACnC,IAAA,MAAM,SAAS,iBAAA,EACX,MAAA,CAAO,CAAC,GAAA,EAAK,kBAAkB,KAAA,KAAU;AACzC,MAAA,IAAI,KAAA,GAA4B,MAAA;AAChC,MAAA,IAAI;AACF,QAAA,uBAAA,CAAwB,gBAAgB,CAAA;AAAA,MAC1C,SAAS,CAAA,EAAG;AACV,QAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AAAA,MACZ;AAEA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,KAAK,CAAA,uBAAA,EAA0B,KAAA,GAAQ,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,MACzD;AAEA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY,CAAA,CACpB,MAAA;AAAA,MACC,MAAA,CAAO,OAAA;AAAA,QACL,iBAAA,CACG,MAAA;AAAA,UACC,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,GAAS;AAAA,SACtC,CACC,MAAA,CAAO,CAAC,GAAA,EAAK,YAAY,KAAA,KAAU;AAClC,UAAA,UAAA,CAAW,aAAA,EAAe,QAAQ,CAAA,YAAA,KAAgB;AAChD,YAAA,IAAI,CAAC,GAAA,CAAI,YAAY,CAAA,EAAG;AACtB,cAAA,GAAA,CAAI,YAAY,IAAI,EAAC;AAAA,YACvB;AAEA,YAAA,GAAA,CAAI,YAAY,CAAA,CAAE,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,UAClC,CAAC,CAAA;AAED,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAA8B;AAAA,QAElC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,OAAO,CAAA,KAAM,OAAA,CAAQ,MAAA,GAAS,CAAC,EAC3C,MAAA,CAAO,CAAC,KAAK,CAAC,GAAA,EAAK,OAAO,CAAA,KAAM;AAC/B,QAAA,GAAA,CAAI,IAAA;AAAA,UACF,gBAAgB,GAAG,CAAA,yDAAA,EAA4D,QAC5E,KAAA,CAAM,CAAA,EAAG,QAAQ,MAAA,GAAS,CAAC,CAAA,CAC3B,IAAA,CAAK,IAAI,CAAC,CAAA,KAAA,EAAQ,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAC,CAAA;AAAA,SAClD;AACA,QAAA,OAAO,GAAA;AAAA,MACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY;AAAA,KACzB;AAEF,IAAA,IAAI,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,EAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACpE;AAAA,IACF;AAEA,IAAA,WAAA,GAAc,iBAAA,CAAkB,GAAA;AAAA,MAAI,CAAA,gBAAA,KAClC,wBAAwB,gBAAgB;AAAA,KAC1C;AAEA,IAAA,IACE,WAAA,CAAY,IAAA;AAAA,MACV,CAAA,UAAA,KAAc,WAAW,IAAA,KAAS;AAAA,KACpC,IACA,SAAS,UAAA,EACT;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qCAAA,EAAwC,IAAI,CAAA,gEAAA,EAAmE,UAAU,CAAA;AAAA,OAC3H;AAAA,IACF;AAEA,IAAA,IACE,WAAA,CAAY,MAAA;AAAA,MACV,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,KAAW;AAAA,KACxC,CAAE,SAAS,CAAA,EACX;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,+DAAA;AAAA,OAC9C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA,EAAkB,MAAA,CAAO,iBAAA,CAAkB,kBAAkB;AAAA,GAC/D;AACF;AASO,SAAS,4BACd,OAAA,EAC0B;AAE1B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA;AAIrD,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,OAAK,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA,EAAG;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,CAAA;AAAA,EAClC;AAEA,EAAA,OAAO,MAAA;AACT;;;;;"}
+{"version":3,"file":"config.cjs.js","sources":["../../src/azure/config.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { isValidHost } from '../helpers';\n\nconst AZURE_HOST = 'dev.azure.com';\n\n/**\n * The configuration parameters for a single Azure provider.\n *\n * @public\n */\nexport type AzureIntegrationConfig = {\n  /**\n   * The host of the target that this matches on, e.g. \"dev.azure.com\".\n   *\n   * Currently only \"dev.azure.com\" is supported.\n   */\n  host: string;\n\n  /**\n   * The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used.\n   * If not organization matches the first credential without an organization is used.\n   *\n   * If no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used.\n   */\n  credentials?: AzureDevOpsCredential[];\n\n  /**\n   * Signing key for commits\n   */\n  commitSigningKey?: string;\n};\n\n/**\n * The kind of Azure DevOps credential.\n * @public\n */\nexport type AzureDevOpsCredentialKind =\n  | 'PersonalAccessToken'\n  | 'ClientSecret'\n  | 'ManagedIdentity'\n  | 'ManagedIdentityClientAssertion';\n\n/**\n * Common fields for the Azure DevOps credentials.\n * @public\n */\nexport type AzureCredentialBase = {\n  /**\n   * The kind of credential.\n   */\n  kind: AzureDevOpsCredentialKind;\n  /**\n   * The Azure DevOps organizations for which to use this credential.\n   */\n  organizations?: string[];\n};\n\n/**\n * A client secret credential that was generated for an App Registration.\n * @public\n */\nexport type AzureClientSecretCredential = AzureCredentialBase & {\n  kind: 'ClientSecret';\n  /**\n   * The Entra ID tenant\n   */\n  tenantId: string;\n  /**\n   * The client id\n   */\n  clientId: string;\n\n  /**\n   * The client secret\n   */\n  clientSecret: string;\n};\n\n/**\n * A client assertion credential that uses a managed identity to generate a client assertion (JWT).\n * @public\n */\nexport type AzureManagedIdentityClientAssertionCredential =\n  AzureCredentialBase & {\n    kind: 'ManagedIdentityClientAssertion';\n    /**\n     * The Entra ID tenant\n     */\n    tenantId: string;\n\n    /**\n     * The client ID of the app registration you want to authenticate as.\n     */\n    clientId: string;\n\n    /**\n     * The client ID of the managed identity used to generate a client assertion (JWT).\n     * Set to \"system-assigned\" to automatically use the system-assigned managed identity.\n     * For user-assigned managed identities, specify the client ID of the managed identity you want to use.\n     */\n    managedIdentityClientId: 'system-assigned' | string;\n  };\n\n/**\n * A managed identity credential.\n * @public\n */\nexport type AzureManagedIdentityCredential = AzureCredentialBase & {\n  kind: 'ManagedIdentity';\n  /**\n   * The clientId\n   */\n  clientId: 'system-assigned' | string;\n};\n\n/**\n * A personal access token credential.\n * @public\n */\nexport type PersonalAccessTokenCredential = AzureCredentialBase & {\n  kind: 'PersonalAccessToken';\n  personalAccessToken: string;\n};\n\n/**\n * The general shape of a credential that can be used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredentialLike = Omit<\n  Partial<AzureClientSecretCredential> &\n    Partial<AzureManagedIdentityClientAssertionCredential> &\n    Partial<AzureManagedIdentityCredential> &\n    Partial<PersonalAccessTokenCredential>,\n  'kind'\n>;\n\n/**\n * Credential used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredential =\n  | AzureClientSecretCredential\n  | AzureManagedIdentityClientAssertionCredential\n  | AzureManagedIdentityCredential\n  | PersonalAccessTokenCredential;\n\nconst AzureDevOpsCredentialFields = [\n  'clientId',\n  'clientSecret',\n  'managedIdentityClientId',\n  'tenantId',\n  'personalAccessToken',\n] as const;\ntype AzureDevOpsCredentialField = (typeof AzureDevOpsCredentialFields)[number];\n\nconst AzureDevopsCredentialFieldMap = new Map<\n  AzureDevOpsCredentialKind,\n  AzureDevOpsCredentialField[]\n>([\n  ['ClientSecret', ['clientId', 'clientSecret', 'tenantId']],\n  ['ManagedIdentity', ['clientId']],\n  [\n    'ManagedIdentityClientAssertion',\n    ['clientId', 'managedIdentityClientId', 'tenantId'],\n  ],\n  ['PersonalAccessToken', ['personalAccessToken']],\n]);\n\nfunction asAzureDevOpsCredential(\n  credential: AzureDevOpsCredentialLike,\n): AzureDevOpsCredential {\n  for (const entry of AzureDevopsCredentialFieldMap.entries()) {\n    const [kind, requiredFields] = entry;\n\n    const forbiddenFields = AzureDevOpsCredentialFields.filter(\n      field => !requiredFields.includes(field as AzureDevOpsCredentialField),\n    );\n\n    if (\n      requiredFields.every(field => credential[field] !== undefined) &&\n      forbiddenFields.every(field => credential[field] === undefined)\n    ) {\n      return {\n        kind,\n        organizations: credential.organizations,\n        ...requiredFields.reduce((acc, field) => {\n          acc[field] = credential[field];\n          return acc;\n        }, {} as Record<string, any>),\n      } as AzureDevOpsCredential;\n    }\n  }\n  throw new Error('is not a valid credential');\n}\n\n/**\n * Reads a single Azure integration config.\n *\n * @param config - The config object of a single integration\n * @public\n */\nexport function readAzureIntegrationConfig(\n  config: Config,\n): AzureIntegrationConfig {\n  deprecatedConfigCheck(config);\n\n  const host = config.getOptionalString('host') ?? AZURE_HOST;\n\n  if (!isValidHost(host)) {\n    throw new Error(\n      `Invalid Azure integration config, '${host}' is not a valid host`,\n    );\n  }\n\n  const credentialConfigs = config\n    .getOptionalConfigArray('credentials')\n    ?.map(credential => {\n      const result: Partial<AzureDevOpsCredentialLike> = {\n        organizations: credential.getOptionalStringArray('organizations'),\n        personalAccessToken: credential\n          .getOptionalString('personalAccessToken')\n          ?.trim(),\n        tenantId: credential.getOptionalString('tenantId')?.trim(),\n        clientId: credential.getOptionalString('clientId')?.trim(),\n        clientSecret: credential.getOptionalString('clientSecret')?.trim(),\n        managedIdentityClientId: credential\n          .getOptionalString('managedIdentityClientId')\n          ?.trim(),\n      };\n\n      return result;\n    });\n\n  let credentials: AzureDevOpsCredential[] | undefined = undefined;\n  if (credentialConfigs !== undefined) {\n    const errors = credentialConfigs\n      ?.reduce((acc, credentialConfig, index) => {\n        let error: string | undefined = undefined;\n        try {\n          asAzureDevOpsCredential(credentialConfig);\n        } catch (e) {\n          error = e.message;\n        }\n\n        if (error !== undefined) {\n          acc.push(`credential at position ${index + 1} ${error}`);\n        }\n\n        return acc;\n      }, Array.of<string>())\n      .concat(\n        Object.entries(\n          credentialConfigs\n            .filter(\n              credential =>\n                credential.organizations !== undefined &&\n                credential.organizations.length > 0,\n            )\n            .reduce((acc, credential, index) => {\n              credential.organizations?.forEach(organization => {\n                if (!acc[organization]) {\n                  acc[organization] = [];\n                }\n\n                acc[organization].push(index + 1);\n              });\n\n              return acc;\n            }, {} as Record<string, number[]>),\n        )\n          .filter(([_, indexes]) => indexes.length > 1)\n          .reduce((acc, [org, indexes]) => {\n            acc.push(\n              `organization ${org} is specified multiple times in credentials at positions ${indexes\n                .slice(0, indexes.length - 1)\n                .join(', ')} and ${indexes[indexes.length - 1]}`,\n            );\n            return acc;\n          }, Array.of<string>()),\n      );\n\n    if (errors?.length > 0) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}: ${errors.join('; ')}`,\n      );\n    }\n\n    credentials = credentialConfigs.map(credentialConfig =>\n      asAzureDevOpsCredential(credentialConfig),\n    );\n\n    if (\n      credentials.some(\n        credential => credential.kind !== 'PersonalAccessToken',\n      ) &&\n      host !== AZURE_HOST\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, only personal access tokens can be used with hosts other than ${AZURE_HOST}`,\n      );\n    }\n\n    if (\n      credentials.filter(\n        credential =>\n          credential.organizations === undefined ||\n          credential.organizations.length === 0,\n      ).length > 1\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, you cannot specify multiple credentials without organizations`,\n      );\n    }\n  }\n\n  return {\n    host,\n    credentials,\n    commitSigningKey: config.getOptionalString('commitSigningKey'),\n  };\n}\n\n/**\n * Reads a set of Azure integration configs, and inserts some defaults for\n * public Azure if not specified.\n *\n * @param configs - All of the integration config objects\n * @public\n */\nexport function readAzureIntegrationConfigs(\n  configs: Config[],\n): AzureIntegrationConfig[] {\n  // First read all the explicit integrations\n  const result = configs.map(readAzureIntegrationConfig);\n\n  // If no explicit dev.azure.com integration was added, put one in the list as\n  // a convenience\n  if (!result.some(c => c.host === AZURE_HOST)) {\n    result.push({ host: AZURE_HOST });\n  }\n\n  return result;\n}\n\n/**\n * These config sections have been removed but to ensure they\n * don't leak sensitive tokens we have this check in place\n * to throw an error if found\n *\n * @internal\n * @deprecated To be removed at a later date\n */\nfunction deprecatedConfigCheck(config: Config) {\n  if (config.getOptional('credential') || config.getOptional('token')) {\n    throw new Error(\n      `Invalid Azure integration config, 'credential' and 'token' have been removed. Use 'credentials' instead.`,\n    );\n  }\n}\n"],"names":["isValidHost"],"mappings":";;;;AAmBA,MAAM,UAAA,GAAa,eAAA;AA+InB,MAAM,2BAAA,GAA8B;AAAA,EAClC,UAAA;AAAA,EACA,cAAA;AAAA,EACA,yBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAGA,MAAM,6BAAA,uBAAoC,GAAA,CAGxC;AAAA,EACA,CAAC,cAAA,EAAgB,CAAC,UAAA,EAAY,cAAA,EAAgB,UAAU,CAAC,CAAA;AAAA,EACzD,CAAC,iBAAA,EAAmB,CAAC,UAAU,CAAC,CAAA;AAAA,EAChC;AAAA,IACE,gCAAA;AAAA,IACA,CAAC,UAAA,EAAY,yBAAA,EAA2B,UAAU;AAAA,GACpD;AAAA,EACA,CAAC,qBAAA,EAAuB,CAAC,qBAAqB,CAAC;AACjD,CAAC,CAAA;AAED,SAAS,wBACP,UAAA,EACuB;AACvB,EAAA,KAAA,MAAW,KAAA,IAAS,6BAAA,CAA8B,OAAA,EAAQ,EAAG;AAC3D,IAAA,MAAM,CAAC,IAAA,EAAM,cAAc,CAAA,GAAI,KAAA;AAE/B,IAAA,MAAM,kBAAkB,2BAAA,CAA4B,MAAA;AAAA,MAClD,CAAA,KAAA,KAAS,CAAC,cAAA,CAAe,QAAA,CAAS,KAAmC;AAAA,KACvE;AAEA,IAAA,IACE,cAAA,CAAe,KAAA,CAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,IAC7D,eAAA,CAAgB,MAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,EAC9D;AACA,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,eAAe,UAAA,CAAW,aAAA;AAAA,QAC1B,GAAG,cAAA,CAAe,MAAA,CAAO,CAAC,KAAK,KAAA,KAAU;AACvC,UAAA,GAAA,CAAI,KAAK,CAAA,GAAI,UAAA,CAAW,KAAK,CAAA;AAC7B,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAAyB;AAAA,OAC9B;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAC7C;AAQO,SAAS,2BACd,MAAA,EACwB;AACxB,EAAA,qBAAA,CAAsB,MAAM,CAAA;AAE5B,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA,IAAK,UAAA;AAEjD,EAAA,IAAI,CAACA,mBAAA,CAAY,IAAI,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sCAAsC,IAAI,CAAA,qBAAA;AAAA,KAC5C;AAAA,EACF;AAEA,EAAA,MAAM,oBAAoB,MAAA,CACvB,sBAAA,CAAuB,aAAa,CAAA,EACnC,IAAI,CAAA,UAAA,KAAc;AAClB,IAAA,MAAM,MAAA,GAA6C;AAAA,MACjD,aAAA,EAAe,UAAA,CAAW,sBAAA,CAAuB,eAAe,CAAA;AAAA,MAChE,mBAAA,EAAqB,UAAA,CAClB,iBAAA,CAAkB,qBAAqB,GACtC,IAAA,EAAK;AAAA,MACT,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,YAAA,EAAc,UAAA,CAAW,iBAAA,CAAkB,cAAc,GAAG,IAAA,EAAK;AAAA,MACjE,uBAAA,EAAyB,UAAA,CACtB,iBAAA,CAAkB,yBAAyB,GAC1C,IAAA;AAAK,KACX;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AAEH,EAAA,IAAI,WAAA,GAAmD,MAAA;AACvD,EAAA,IAAI,sBAAsB,MAAA,EAAW;AACnC,IAAA,MAAM,SAAS,iBAAA,EACX,MAAA,CAAO,CAAC,GAAA,EAAK,kBAAkB,KAAA,KAAU;AACzC,MAAA,IAAI,KAAA,GAA4B,MAAA;AAChC,MAAA,IAAI;AACF,QAAA,uBAAA,CAAwB,gBAAgB,CAAA;AAAA,MAC1C,SAAS,CAAA,EAAG;AACV,QAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AAAA,MACZ;AAEA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,KAAK,CAAA,uBAAA,EAA0B,KAAA,GAAQ,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,MACzD;AAEA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY,CAAA,CACpB,MAAA;AAAA,MACC,MAAA,CAAO,OAAA;AAAA,QACL,iBAAA,CACG,MAAA;AAAA,UACC,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,GAAS;AAAA,SACtC,CACC,MAAA,CAAO,CAAC,GAAA,EAAK,YAAY,KAAA,KAAU;AAClC,UAAA,UAAA,CAAW,aAAA,EAAe,QAAQ,CAAA,YAAA,KAAgB;AAChD,YAAA,IAAI,CAAC,GAAA,CAAI,YAAY,CAAA,EAAG;AACtB,cAAA,GAAA,CAAI,YAAY,IAAI,EAAC;AAAA,YACvB;AAEA,YAAA,GAAA,CAAI,YAAY,CAAA,CAAE,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,UAClC,CAAC,CAAA;AAED,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAA8B;AAAA,QAElC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,OAAO,CAAA,KAAM,OAAA,CAAQ,MAAA,GAAS,CAAC,EAC3C,MAAA,CAAO,CAAC,KAAK,CAAC,GAAA,EAAK,OAAO,CAAA,KAAM;AAC/B,QAAA,GAAA,CAAI,IAAA;AAAA,UACF,gBAAgB,GAAG,CAAA,yDAAA,EAA4D,QAC5E,KAAA,CAAM,CAAA,EAAG,QAAQ,MAAA,GAAS,CAAC,CAAA,CAC3B,IAAA,CAAK,IAAI,CAAC,CAAA,KAAA,EAAQ,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAC,CAAA;AAAA,SAClD;AACA,QAAA,OAAO,GAAA;AAAA,MACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY;AAAA,KACzB;AAEF,IAAA,IAAI,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,EAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACpE;AAAA,IACF;AAEA,IAAA,WAAA,GAAc,iBAAA,CAAkB,GAAA;AAAA,MAAI,CAAA,gBAAA,KAClC,wBAAwB,gBAAgB;AAAA,KAC1C;AAEA,IAAA,IACE,WAAA,CAAY,IAAA;AAAA,MACV,CAAA,UAAA,KAAc,WAAW,IAAA,KAAS;AAAA,KACpC,IACA,SAAS,UAAA,EACT;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qCAAA,EAAwC,IAAI,CAAA,gEAAA,EAAmE,UAAU,CAAA;AAAA,OAC3H;AAAA,IACF;AAEA,IAAA,IACE,WAAA,CAAY,MAAA;AAAA,MACV,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,KAAW;AAAA,KACxC,CAAE,SAAS,CAAA,EACX;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,+DAAA;AAAA,OAC9C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA,EAAkB,MAAA,CAAO,iBAAA,CAAkB,kBAAkB;AAAA,GAC/D;AACF;AASO,SAAS,4BACd,OAAA,EAC0B;AAE1B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA;AAIrD,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,OAAK,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA,EAAG;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,CAAA;AAAA,EAClC;AAEA,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,sBAAsB,MAAA,EAAgB;AAC7C,EAAA,IAAI,OAAO,WAAA,CAAY,YAAY,KAAK,MAAA,CAAO,WAAA,CAAY,OAAO,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wGAAA;AAAA,KACF;AAAA,EACF;AACF;;;;;"}

package/dist/azure/config.esm.js

@@ -37,8 +37,14 @@ function asAzureDevOpsCredential(credential) {
   throw new Error("is not a valid credential");
 }
 function readAzureIntegrationConfig(config) {
+  deprecatedConfigCheck(config);
   const host = config.getOptionalString("host") ?? AZURE_HOST;
-  let credentialConfigs = config.getOptionalConfigArray("credentials")?.map((credential) => {
+  if (!isValidHost(host)) {
+    throw new Error(
+      `Invalid Azure integration config, '${host}' is not a valid host`
+    );
+  }
+  const credentialConfigs = config.getOptionalConfigArray("credentials")?.map((credential) => {
     const result = {
       organizations: credential.getOptionalStringArray("organizations"),
       personalAccessToken: credential.getOptionalString("personalAccessToken")?.trim(),
@@ -49,40 +55,6 @@ function readAzureIntegrationConfig(config) {
     };
     return result;
   });
-  const token = config.getOptionalString("token")?.trim();
-  if (config.getOptional("credential") !== void 0 && config.getOptional("credentials") !== void 0) {
-    throw new Error(
-      `Invalid Azure integration config, 'credential' and 'credentials' cannot be used together. Use 'credentials' instead.`
-    );
-  }
-  if (config.getOptional("token") !== void 0 && config.getOptional("credentials") !== void 0) {
-    throw new Error(
-      `Invalid Azure integration config, 'token' and 'credentials' cannot be used together. Use 'credentials' instead.`
-    );
-  }
-  if (token !== void 0) {
-    const mapped = [{ personalAccessToken: token }];
-    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;
-  }
-  if (config.getOptional("credential") !== void 0) {
-    const mapped = [
-      {
-        organizations: config.getOptionalStringArray(
-          "credential.organizations"
-        ),
-        token: config.getOptionalString("credential.token")?.trim(),
-        tenantId: config.getOptionalString("credential.tenantId"),
-        clientId: config.getOptionalString("credential.clientId"),
-        clientSecret: config.getOptionalString("credential.clientSecret")?.trim()
-      }
-    ];
-    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;
-  }
-  if (!isValidHost(host)) {
-    throw new Error(
-      `Invalid Azure integration config, '${host}' is not a valid host`
-    );
-  }
   let credentials = void 0;
   if (credentialConfigs !== void 0) {
     const errors = credentialConfigs?.reduce((acc, credentialConfig, index) => {
@@ -152,6 +124,13 @@ function readAzureIntegrationConfigs(configs) {
   }
   return result;
 }
+function deprecatedConfigCheck(config) {
+  if (config.getOptional("credential") || config.getOptional("token")) {
+    throw new Error(
+      `Invalid Azure integration config, 'credential' and 'token' have been removed. Use 'credentials' instead.`
+    );
+  }
+}
 
 export { readAzureIntegrationConfig, readAzureIntegrationConfigs };
 //# sourceMappingURL=config.esm.js.map

package/dist/azure/config.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.esm.js","sources":["../../src/azure/config.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { isValidHost } from '../helpers';\n\nconst AZURE_HOST = 'dev.azure.com';\n\n/**\n * The configuration parameters for a single Azure provider.\n *\n * @public\n */\nexport type AzureIntegrationConfig = {\n  /**\n   * The host of the target that this matches on, e.g. \"dev.azure.com\".\n   *\n   * Currently only \"dev.azure.com\" is supported.\n   */\n  host: string;\n\n  /**\n   * The authorization token to use for requests.\n   *\n   * If no token is specified, anonymous access is used.\n   *\n   * @deprecated Use `credentials` instead.\n   */\n  token?: string;\n\n  /**\n   * The credential to use for requests.\n   *\n   * If no credential is specified anonymous access is used.\n   *\n   * @deprecated Use `credentials` instead.\n   */\n  credential?: AzureDevOpsCredential;\n\n  /**\n   * The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used.\n   * If not organization matches the first credential without an organization is used.\n   *\n   * If no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used.\n   */\n  credentials?: AzureDevOpsCredential[];\n\n  /**\n   * Signing key for commits\n   */\n  commitSigningKey?: string;\n};\n\n/**\n * The kind of Azure DevOps credential.\n * @public\n */\nexport type AzureDevOpsCredentialKind =\n  | 'PersonalAccessToken'\n  | 'ClientSecret'\n  | 'ManagedIdentity'\n  | 'ManagedIdentityClientAssertion';\n\n/**\n * Common fields for the Azure DevOps credentials.\n * @public\n */\nexport type AzureCredentialBase = {\n  /**\n   * The kind of credential.\n   */\n  kind: AzureDevOpsCredentialKind;\n  /**\n   * The Azure DevOps organizations for which to use this credential.\n   */\n  organizations?: string[];\n};\n\n/**\n * A client secret credential that was generated for an App Registration.\n * @public\n */\nexport type AzureClientSecretCredential = AzureCredentialBase & {\n  kind: 'ClientSecret';\n  /**\n   * The Entra ID tenant\n   */\n  tenantId: string;\n  /**\n   * The client id\n   */\n  clientId: string;\n\n  /**\n   * The client secret\n   */\n  clientSecret: string;\n};\n\n/**\n * A client assertion credential that uses a managed identity to generate a client assertion (JWT).\n * @public\n */\nexport type AzureManagedIdentityClientAssertionCredential =\n  AzureCredentialBase & {\n    kind: 'ManagedIdentityClientAssertion';\n    /**\n     * The Entra ID tenant\n     */\n    tenantId: string;\n\n    /**\n     * The client ID of the app registration you want to authenticate as.\n     */\n    clientId: string;\n\n    /**\n     * The client ID of the managed identity used to generate a client assertion (JWT).\n     * Set to \"system-assigned\" to automatically use the system-assigned managed identity.\n     * For user-assigned managed identities, specify the client ID of the managed identity you want to use.\n     */\n    managedIdentityClientId: 'system-assigned' | string;\n  };\n\n/**\n * A managed identity credential.\n * @public\n */\nexport type AzureManagedIdentityCredential = AzureCredentialBase & {\n  kind: 'ManagedIdentity';\n  /**\n   * The clientId\n   */\n  clientId: 'system-assigned' | string;\n};\n\n/**\n * A personal access token credential.\n * @public\n */\nexport type PersonalAccessTokenCredential = AzureCredentialBase & {\n  kind: 'PersonalAccessToken';\n  personalAccessToken: string;\n};\n\n/**\n * The general shape of a credential that can be used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredentialLike = Omit<\n  Partial<AzureClientSecretCredential> &\n    Partial<AzureManagedIdentityClientAssertionCredential> &\n    Partial<AzureManagedIdentityCredential> &\n    Partial<PersonalAccessTokenCredential>,\n  'kind'\n>;\n\n/**\n * Credential used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredential =\n  | AzureClientSecretCredential\n  | AzureManagedIdentityClientAssertionCredential\n  | AzureManagedIdentityCredential\n  | PersonalAccessTokenCredential;\n\nconst AzureDevOpsCredentialFields = [\n  'clientId',\n  'clientSecret',\n  'managedIdentityClientId',\n  'tenantId',\n  'personalAccessToken',\n] as const;\ntype AzureDevOpsCredentialField = (typeof AzureDevOpsCredentialFields)[number];\n\nconst AzureDevopsCredentialFieldMap = new Map<\n  AzureDevOpsCredentialKind,\n  AzureDevOpsCredentialField[]\n>([\n  ['ClientSecret', ['clientId', 'clientSecret', 'tenantId']],\n  ['ManagedIdentity', ['clientId']],\n  [\n    'ManagedIdentityClientAssertion',\n    ['clientId', 'managedIdentityClientId', 'tenantId'],\n  ],\n  ['PersonalAccessToken', ['personalAccessToken']],\n]);\n\nfunction asAzureDevOpsCredential(\n  credential: AzureDevOpsCredentialLike,\n): AzureDevOpsCredential {\n  for (const entry of AzureDevopsCredentialFieldMap.entries()) {\n    const [kind, requiredFields] = entry;\n\n    const forbiddenFields = AzureDevOpsCredentialFields.filter(\n      field => !requiredFields.includes(field as AzureDevOpsCredentialField),\n    );\n\n    if (\n      requiredFields.every(field => credential[field] !== undefined) &&\n      forbiddenFields.every(field => credential[field] === undefined)\n    ) {\n      return {\n        kind,\n        organizations: credential.organizations,\n        ...requiredFields.reduce((acc, field) => {\n          acc[field] = credential[field];\n          return acc;\n        }, {} as Record<string, any>),\n      } as AzureDevOpsCredential;\n    }\n  }\n  throw new Error('is not a valid credential');\n}\n\n/**\n * Reads a single Azure integration config.\n *\n * @param config - The config object of a single integration\n * @public\n */\nexport function readAzureIntegrationConfig(\n  config: Config,\n): AzureIntegrationConfig {\n  const host = config.getOptionalString('host') ?? AZURE_HOST;\n\n  let credentialConfigs = config\n    .getOptionalConfigArray('credentials')\n    ?.map(credential => {\n      const result: Partial<AzureDevOpsCredentialLike> = {\n        organizations: credential.getOptionalStringArray('organizations'),\n        personalAccessToken: credential\n          .getOptionalString('personalAccessToken')\n          ?.trim(),\n        tenantId: credential.getOptionalString('tenantId')?.trim(),\n        clientId: credential.getOptionalString('clientId')?.trim(),\n        clientSecret: credential.getOptionalString('clientSecret')?.trim(),\n        managedIdentityClientId: credential\n          .getOptionalString('managedIdentityClientId')\n          ?.trim(),\n      };\n\n      return result;\n    });\n\n  const token = config.getOptionalString('token')?.trim();\n\n  if (\n    config.getOptional('credential') !== undefined &&\n    config.getOptional('credentials') !== undefined\n  ) {\n    throw new Error(\n      `Invalid Azure integration config, 'credential' and 'credentials' cannot be used together. Use 'credentials' instead.`,\n    );\n  }\n\n  if (\n    config.getOptional('token') !== undefined &&\n    config.getOptional('credentials') !== undefined\n  ) {\n    throw new Error(\n      `Invalid Azure integration config, 'token' and 'credentials' cannot be used together. Use 'credentials' instead.`,\n    );\n  }\n\n  if (token !== undefined) {\n    const mapped = [{ personalAccessToken: token }];\n    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;\n  }\n\n  if (config.getOptional('credential') !== undefined) {\n    const mapped = [\n      {\n        organizations: config.getOptionalStringArray(\n          'credential.organizations',\n        ),\n        token: config.getOptionalString('credential.token')?.trim(),\n        tenantId: config.getOptionalString('credential.tenantId'),\n        clientId: config.getOptionalString('credential.clientId'),\n        clientSecret: config\n          .getOptionalString('credential.clientSecret')\n          ?.trim(),\n      },\n    ];\n    credentialConfigs = credentialConfigs?.concat(mapped) ?? mapped;\n  }\n\n  if (!isValidHost(host)) {\n    throw new Error(\n      `Invalid Azure integration config, '${host}' is not a valid host`,\n    );\n  }\n\n  let credentials: AzureDevOpsCredential[] | undefined = undefined;\n  if (credentialConfigs !== undefined) {\n    const errors = credentialConfigs\n      ?.reduce((acc, credentialConfig, index) => {\n        let error: string | undefined = undefined;\n        try {\n          asAzureDevOpsCredential(credentialConfig);\n        } catch (e) {\n          error = e.message;\n        }\n\n        if (error !== undefined) {\n          acc.push(`credential at position ${index + 1} ${error}`);\n        }\n\n        return acc;\n      }, Array.of<string>())\n      .concat(\n        Object.entries(\n          credentialConfigs\n            .filter(\n              credential =>\n                credential.organizations !== undefined &&\n                credential.organizations.length > 0,\n            )\n            .reduce((acc, credential, index) => {\n              credential.organizations?.forEach(organization => {\n                if (!acc[organization]) {\n                  acc[organization] = [];\n                }\n\n                acc[organization].push(index + 1);\n              });\n\n              return acc;\n            }, {} as Record<string, number[]>),\n        )\n          .filter(([_, indexes]) => indexes.length > 1)\n          .reduce((acc, [org, indexes]) => {\n            acc.push(\n              `organization ${org} is specified multiple times in credentials at positions ${indexes\n                .slice(0, indexes.length - 1)\n                .join(', ')} and ${indexes[indexes.length - 1]}`,\n            );\n            return acc;\n          }, Array.of<string>()),\n      );\n\n    if (errors?.length > 0) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}: ${errors.join('; ')}`,\n      );\n    }\n\n    credentials = credentialConfigs.map(credentialConfig =>\n      asAzureDevOpsCredential(credentialConfig),\n    );\n\n    if (\n      credentials.some(\n        credential => credential.kind !== 'PersonalAccessToken',\n      ) &&\n      host !== AZURE_HOST\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, only personal access tokens can be used with hosts other than ${AZURE_HOST}`,\n      );\n    }\n\n    if (\n      credentials.filter(\n        credential =>\n          credential.organizations === undefined ||\n          credential.organizations.length === 0,\n      ).length > 1\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, you cannot specify multiple credentials without organizations`,\n      );\n    }\n  }\n\n  return {\n    host,\n    credentials,\n    commitSigningKey: config.getOptionalString('commitSigningKey'),\n  };\n}\n\n/**\n * Reads a set of Azure integration configs, and inserts some defaults for\n * public Azure if not specified.\n *\n * @param configs - All of the integration config objects\n * @public\n */\nexport function readAzureIntegrationConfigs(\n  configs: Config[],\n): AzureIntegrationConfig[] {\n  // First read all the explicit integrations\n  const result = configs.map(readAzureIntegrationConfig);\n\n  // If no explicit dev.azure.com integration was added, put one in the list as\n  // a convenience\n  if (!result.some(c => c.host === AZURE_HOST)) {\n    result.push({ host: AZURE_HOST });\n  }\n\n  return result;\n}\n"],"names":[],"mappings":";;AAmBA,MAAM,UAAA,GAAa,eAAA;AAiKnB,MAAM,2BAAA,GAA8B;AAAA,EAClC,UAAA;AAAA,EACA,cAAA;AAAA,EACA,yBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAGA,MAAM,6BAAA,uBAAoC,GAAA,CAGxC;AAAA,EACA,CAAC,cAAA,EAAgB,CAAC,UAAA,EAAY,cAAA,EAAgB,UAAU,CAAC,CAAA;AAAA,EACzD,CAAC,iBAAA,EAAmB,CAAC,UAAU,CAAC,CAAA;AAAA,EAChC;AAAA,IACE,gCAAA;AAAA,IACA,CAAC,UAAA,EAAY,yBAAA,EAA2B,UAAU;AAAA,GACpD;AAAA,EACA,CAAC,qBAAA,EAAuB,CAAC,qBAAqB,CAAC;AACjD,CAAC,CAAA;AAED,SAAS,wBACP,UAAA,EACuB;AACvB,EAAA,KAAA,MAAW,KAAA,IAAS,6BAAA,CAA8B,OAAA,EAAQ,EAAG;AAC3D,IAAA,MAAM,CAAC,IAAA,EAAM,cAAc,CAAA,GAAI,KAAA;AAE/B,IAAA,MAAM,kBAAkB,2BAAA,CAA4B,MAAA;AAAA,MAClD,CAAA,KAAA,KAAS,CAAC,cAAA,CAAe,QAAA,CAAS,KAAmC;AAAA,KACvE;AAEA,IAAA,IACE,cAAA,CAAe,KAAA,CAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,IAC7D,eAAA,CAAgB,MAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,EAC9D;AACA,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,eAAe,UAAA,CAAW,aAAA;AAAA,QAC1B,GAAG,cAAA,CAAe,MAAA,CAAO,CAAC,KAAK,KAAA,KAAU;AACvC,UAAA,GAAA,CAAI,KAAK,CAAA,GAAI,UAAA,CAAW,KAAK,CAAA;AAC7B,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAAyB;AAAA,OAC9B;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAC7C;AAQO,SAAS,2BACd,MAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA,IAAK,UAAA;AAEjD,EAAA,IAAI,oBAAoB,MAAA,CACrB,sBAAA,CAAuB,aAAa,CAAA,EACnC,IAAI,CAAA,UAAA,KAAc;AAClB,IAAA,MAAM,MAAA,GAA6C;AAAA,MACjD,aAAA,EAAe,UAAA,CAAW,sBAAA,CAAuB,eAAe,CAAA;AAAA,MAChE,mBAAA,EAAqB,UAAA,CAClB,iBAAA,CAAkB,qBAAqB,GACtC,IAAA,EAAK;AAAA,MACT,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,YAAA,EAAc,UAAA,CAAW,iBAAA,CAAkB,cAAc,GAAG,IAAA,EAAK;AAAA,MACjE,uBAAA,EAAyB,UAAA,CACtB,iBAAA,CAAkB,yBAAyB,GAC1C,IAAA;AAAK,KACX;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AAEH,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,iBAAA,CAAkB,OAAO,GAAG,IAAA,EAAK;AAEtD,EAAA,IACE,MAAA,CAAO,YAAY,YAAY,CAAA,KAAM,UACrC,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA,KAAM,MAAA,EACtC;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,oHAAA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IACE,MAAA,CAAO,YAAY,OAAO,CAAA,KAAM,UAChC,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA,KAAM,MAAA,EACtC;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,+GAAA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,MAAM,MAAA,GAAS,CAAC,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAC9C,IAAA,iBAAA,GAAoB,iBAAA,EAAmB,MAAA,CAAO,MAAM,CAAA,IAAK,MAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,MAAA,CAAO,WAAA,CAAY,YAAY,CAAA,KAAM,MAAA,EAAW;AAClD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb;AAAA,QACE,eAAe,MAAA,CAAO,sBAAA;AAAA,UACpB;AAAA,SACF;AAAA,QACA,KAAA,EAAO,MAAA,CAAO,iBAAA,CAAkB,kBAAkB,GAAG,IAAA,EAAK;AAAA,QAC1D,QAAA,EAAU,MAAA,CAAO,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACxD,QAAA,EAAU,MAAA,CAAO,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACxD,YAAA,EAAc,MAAA,CACX,iBAAA,CAAkB,yBAAyB,GAC1C,IAAA;AAAK;AACX,KACF;AACA,IAAA,iBAAA,GAAoB,iBAAA,EAAmB,MAAA,CAAO,MAAM,CAAA,IAAK,MAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,CAAC,WAAA,CAAY,IAAI,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sCAAsC,IAAI,CAAA,qBAAA;AAAA,KAC5C;AAAA,EACF;AAEA,EAAA,IAAI,WAAA,GAAmD,MAAA;AACvD,EAAA,IAAI,sBAAsB,MAAA,EAAW;AACnC,IAAA,MAAM,SAAS,iBAAA,EACX,MAAA,CAAO,CAAC,GAAA,EAAK,kBAAkB,KAAA,KAAU;AACzC,MAAA,IAAI,KAAA,GAA4B,MAAA;AAChC,MAAA,IAAI;AACF,QAAA,uBAAA,CAAwB,gBAAgB,CAAA;AAAA,MAC1C,SAAS,CAAA,EAAG;AACV,QAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AAAA,MACZ;AAEA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,KAAK,CAAA,uBAAA,EAA0B,KAAA,GAAQ,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,MACzD;AAEA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY,CAAA,CACpB,MAAA;AAAA,MACC,MAAA,CAAO,OAAA;AAAA,QACL,iBAAA,CACG,MAAA;AAAA,UACC,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,GAAS;AAAA,SACtC,CACC,MAAA,CAAO,CAAC,GAAA,EAAK,YAAY,KAAA,KAAU;AAClC,UAAA,UAAA,CAAW,aAAA,EAAe,QAAQ,CAAA,YAAA,KAAgB;AAChD,YAAA,IAAI,CAAC,GAAA,CAAI,YAAY,CAAA,EAAG;AACtB,cAAA,GAAA,CAAI,YAAY,IAAI,EAAC;AAAA,YACvB;AAEA,YAAA,GAAA,CAAI,YAAY,CAAA,CAAE,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,UAClC,CAAC,CAAA;AAED,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAA8B;AAAA,QAElC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,OAAO,CAAA,KAAM,OAAA,CAAQ,MAAA,GAAS,CAAC,EAC3C,MAAA,CAAO,CAAC,KAAK,CAAC,GAAA,EAAK,OAAO,CAAA,KAAM;AAC/B,QAAA,GAAA,CAAI,IAAA;AAAA,UACF,gBAAgB,GAAG,CAAA,yDAAA,EAA4D,QAC5E,KAAA,CAAM,CAAA,EAAG,QAAQ,MAAA,GAAS,CAAC,CAAA,CAC3B,IAAA,CAAK,IAAI,CAAC,CAAA,KAAA,EAAQ,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAC,CAAA;AAAA,SAClD;AACA,QAAA,OAAO,GAAA;AAAA,MACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY;AAAA,KACzB;AAEF,IAAA,IAAI,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,EAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACpE;AAAA,IACF;AAEA,IAAA,WAAA,GAAc,iBAAA,CAAkB,GAAA;AAAA,MAAI,CAAA,gBAAA,KAClC,wBAAwB,gBAAgB;AAAA,KAC1C;AAEA,IAAA,IACE,WAAA,CAAY,IAAA;AAAA,MACV,CAAA,UAAA,KAAc,WAAW,IAAA,KAAS;AAAA,KACpC,IACA,SAAS,UAAA,EACT;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qCAAA,EAAwC,IAAI,CAAA,gEAAA,EAAmE,UAAU,CAAA;AAAA,OAC3H;AAAA,IACF;AAEA,IAAA,IACE,WAAA,CAAY,MAAA;AAAA,MACV,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,KAAW;AAAA,KACxC,CAAE,SAAS,CAAA,EACX;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,+DAAA;AAAA,OAC9C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA,EAAkB,MAAA,CAAO,iBAAA,CAAkB,kBAAkB;AAAA,GAC/D;AACF;AASO,SAAS,4BACd,OAAA,EAC0B;AAE1B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA;AAIrD,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,OAAK,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA,EAAG;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,CAAA;AAAA,EAClC;AAEA,EAAA,OAAO,MAAA;AACT;;;;"}
+{"version":3,"file":"config.esm.js","sources":["../../src/azure/config.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\nimport { isValidHost } from '../helpers';\n\nconst AZURE_HOST = 'dev.azure.com';\n\n/**\n * The configuration parameters for a single Azure provider.\n *\n * @public\n */\nexport type AzureIntegrationConfig = {\n  /**\n   * The host of the target that this matches on, e.g. \"dev.azure.com\".\n   *\n   * Currently only \"dev.azure.com\" is supported.\n   */\n  host: string;\n\n  /**\n   * The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used.\n   * If not organization matches the first credential without an organization is used.\n   *\n   * If no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used.\n   */\n  credentials?: AzureDevOpsCredential[];\n\n  /**\n   * Signing key for commits\n   */\n  commitSigningKey?: string;\n};\n\n/**\n * The kind of Azure DevOps credential.\n * @public\n */\nexport type AzureDevOpsCredentialKind =\n  | 'PersonalAccessToken'\n  | 'ClientSecret'\n  | 'ManagedIdentity'\n  | 'ManagedIdentityClientAssertion';\n\n/**\n * Common fields for the Azure DevOps credentials.\n * @public\n */\nexport type AzureCredentialBase = {\n  /**\n   * The kind of credential.\n   */\n  kind: AzureDevOpsCredentialKind;\n  /**\n   * The Azure DevOps organizations for which to use this credential.\n   */\n  organizations?: string[];\n};\n\n/**\n * A client secret credential that was generated for an App Registration.\n * @public\n */\nexport type AzureClientSecretCredential = AzureCredentialBase & {\n  kind: 'ClientSecret';\n  /**\n   * The Entra ID tenant\n   */\n  tenantId: string;\n  /**\n   * The client id\n   */\n  clientId: string;\n\n  /**\n   * The client secret\n   */\n  clientSecret: string;\n};\n\n/**\n * A client assertion credential that uses a managed identity to generate a client assertion (JWT).\n * @public\n */\nexport type AzureManagedIdentityClientAssertionCredential =\n  AzureCredentialBase & {\n    kind: 'ManagedIdentityClientAssertion';\n    /**\n     * The Entra ID tenant\n     */\n    tenantId: string;\n\n    /**\n     * The client ID of the app registration you want to authenticate as.\n     */\n    clientId: string;\n\n    /**\n     * The client ID of the managed identity used to generate a client assertion (JWT).\n     * Set to \"system-assigned\" to automatically use the system-assigned managed identity.\n     * For user-assigned managed identities, specify the client ID of the managed identity you want to use.\n     */\n    managedIdentityClientId: 'system-assigned' | string;\n  };\n\n/**\n * A managed identity credential.\n * @public\n */\nexport type AzureManagedIdentityCredential = AzureCredentialBase & {\n  kind: 'ManagedIdentity';\n  /**\n   * The clientId\n   */\n  clientId: 'system-assigned' | string;\n};\n\n/**\n * A personal access token credential.\n * @public\n */\nexport type PersonalAccessTokenCredential = AzureCredentialBase & {\n  kind: 'PersonalAccessToken';\n  personalAccessToken: string;\n};\n\n/**\n * The general shape of a credential that can be used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredentialLike = Omit<\n  Partial<AzureClientSecretCredential> &\n    Partial<AzureManagedIdentityClientAssertionCredential> &\n    Partial<AzureManagedIdentityCredential> &\n    Partial<PersonalAccessTokenCredential>,\n  'kind'\n>;\n\n/**\n * Credential used to authenticate to Azure DevOps.\n * @public\n */\nexport type AzureDevOpsCredential =\n  | AzureClientSecretCredential\n  | AzureManagedIdentityClientAssertionCredential\n  | AzureManagedIdentityCredential\n  | PersonalAccessTokenCredential;\n\nconst AzureDevOpsCredentialFields = [\n  'clientId',\n  'clientSecret',\n  'managedIdentityClientId',\n  'tenantId',\n  'personalAccessToken',\n] as const;\ntype AzureDevOpsCredentialField = (typeof AzureDevOpsCredentialFields)[number];\n\nconst AzureDevopsCredentialFieldMap = new Map<\n  AzureDevOpsCredentialKind,\n  AzureDevOpsCredentialField[]\n>([\n  ['ClientSecret', ['clientId', 'clientSecret', 'tenantId']],\n  ['ManagedIdentity', ['clientId']],\n  [\n    'ManagedIdentityClientAssertion',\n    ['clientId', 'managedIdentityClientId', 'tenantId'],\n  ],\n  ['PersonalAccessToken', ['personalAccessToken']],\n]);\n\nfunction asAzureDevOpsCredential(\n  credential: AzureDevOpsCredentialLike,\n): AzureDevOpsCredential {\n  for (const entry of AzureDevopsCredentialFieldMap.entries()) {\n    const [kind, requiredFields] = entry;\n\n    const forbiddenFields = AzureDevOpsCredentialFields.filter(\n      field => !requiredFields.includes(field as AzureDevOpsCredentialField),\n    );\n\n    if (\n      requiredFields.every(field => credential[field] !== undefined) &&\n      forbiddenFields.every(field => credential[field] === undefined)\n    ) {\n      return {\n        kind,\n        organizations: credential.organizations,\n        ...requiredFields.reduce((acc, field) => {\n          acc[field] = credential[field];\n          return acc;\n        }, {} as Record<string, any>),\n      } as AzureDevOpsCredential;\n    }\n  }\n  throw new Error('is not a valid credential');\n}\n\n/**\n * Reads a single Azure integration config.\n *\n * @param config - The config object of a single integration\n * @public\n */\nexport function readAzureIntegrationConfig(\n  config: Config,\n): AzureIntegrationConfig {\n  deprecatedConfigCheck(config);\n\n  const host = config.getOptionalString('host') ?? AZURE_HOST;\n\n  if (!isValidHost(host)) {\n    throw new Error(\n      `Invalid Azure integration config, '${host}' is not a valid host`,\n    );\n  }\n\n  const credentialConfigs = config\n    .getOptionalConfigArray('credentials')\n    ?.map(credential => {\n      const result: Partial<AzureDevOpsCredentialLike> = {\n        organizations: credential.getOptionalStringArray('organizations'),\n        personalAccessToken: credential\n          .getOptionalString('personalAccessToken')\n          ?.trim(),\n        tenantId: credential.getOptionalString('tenantId')?.trim(),\n        clientId: credential.getOptionalString('clientId')?.trim(),\n        clientSecret: credential.getOptionalString('clientSecret')?.trim(),\n        managedIdentityClientId: credential\n          .getOptionalString('managedIdentityClientId')\n          ?.trim(),\n      };\n\n      return result;\n    });\n\n  let credentials: AzureDevOpsCredential[] | undefined = undefined;\n  if (credentialConfigs !== undefined) {\n    const errors = credentialConfigs\n      ?.reduce((acc, credentialConfig, index) => {\n        let error: string | undefined = undefined;\n        try {\n          asAzureDevOpsCredential(credentialConfig);\n        } catch (e) {\n          error = e.message;\n        }\n\n        if (error !== undefined) {\n          acc.push(`credential at position ${index + 1} ${error}`);\n        }\n\n        return acc;\n      }, Array.of<string>())\n      .concat(\n        Object.entries(\n          credentialConfigs\n            .filter(\n              credential =>\n                credential.organizations !== undefined &&\n                credential.organizations.length > 0,\n            )\n            .reduce((acc, credential, index) => {\n              credential.organizations?.forEach(organization => {\n                if (!acc[organization]) {\n                  acc[organization] = [];\n                }\n\n                acc[organization].push(index + 1);\n              });\n\n              return acc;\n            }, {} as Record<string, number[]>),\n        )\n          .filter(([_, indexes]) => indexes.length > 1)\n          .reduce((acc, [org, indexes]) => {\n            acc.push(\n              `organization ${org} is specified multiple times in credentials at positions ${indexes\n                .slice(0, indexes.length - 1)\n                .join(', ')} and ${indexes[indexes.length - 1]}`,\n            );\n            return acc;\n          }, Array.of<string>()),\n      );\n\n    if (errors?.length > 0) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}: ${errors.join('; ')}`,\n      );\n    }\n\n    credentials = credentialConfigs.map(credentialConfig =>\n      asAzureDevOpsCredential(credentialConfig),\n    );\n\n    if (\n      credentials.some(\n        credential => credential.kind !== 'PersonalAccessToken',\n      ) &&\n      host !== AZURE_HOST\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, only personal access tokens can be used with hosts other than ${AZURE_HOST}`,\n      );\n    }\n\n    if (\n      credentials.filter(\n        credential =>\n          credential.organizations === undefined ||\n          credential.organizations.length === 0,\n      ).length > 1\n    ) {\n      throw new Error(\n        `Invalid Azure integration config for ${host}, you cannot specify multiple credentials without organizations`,\n      );\n    }\n  }\n\n  return {\n    host,\n    credentials,\n    commitSigningKey: config.getOptionalString('commitSigningKey'),\n  };\n}\n\n/**\n * Reads a set of Azure integration configs, and inserts some defaults for\n * public Azure if not specified.\n *\n * @param configs - All of the integration config objects\n * @public\n */\nexport function readAzureIntegrationConfigs(\n  configs: Config[],\n): AzureIntegrationConfig[] {\n  // First read all the explicit integrations\n  const result = configs.map(readAzureIntegrationConfig);\n\n  // If no explicit dev.azure.com integration was added, put one in the list as\n  // a convenience\n  if (!result.some(c => c.host === AZURE_HOST)) {\n    result.push({ host: AZURE_HOST });\n  }\n\n  return result;\n}\n\n/**\n * These config sections have been removed but to ensure they\n * don't leak sensitive tokens we have this check in place\n * to throw an error if found\n *\n * @internal\n * @deprecated To be removed at a later date\n */\nfunction deprecatedConfigCheck(config: Config) {\n  if (config.getOptional('credential') || config.getOptional('token')) {\n    throw new Error(\n      `Invalid Azure integration config, 'credential' and 'token' have been removed. Use 'credentials' instead.`,\n    );\n  }\n}\n"],"names":[],"mappings":";;AAmBA,MAAM,UAAA,GAAa,eAAA;AA+InB,MAAM,2BAAA,GAA8B;AAAA,EAClC,UAAA;AAAA,EACA,cAAA;AAAA,EACA,yBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAGA,MAAM,6BAAA,uBAAoC,GAAA,CAGxC;AAAA,EACA,CAAC,cAAA,EAAgB,CAAC,UAAA,EAAY,cAAA,EAAgB,UAAU,CAAC,CAAA;AAAA,EACzD,CAAC,iBAAA,EAAmB,CAAC,UAAU,CAAC,CAAA;AAAA,EAChC;AAAA,IACE,gCAAA;AAAA,IACA,CAAC,UAAA,EAAY,yBAAA,EAA2B,UAAU;AAAA,GACpD;AAAA,EACA,CAAC,qBAAA,EAAuB,CAAC,qBAAqB,CAAC;AACjD,CAAC,CAAA;AAED,SAAS,wBACP,UAAA,EACuB;AACvB,EAAA,KAAA,MAAW,KAAA,IAAS,6BAAA,CAA8B,OAAA,EAAQ,EAAG;AAC3D,IAAA,MAAM,CAAC,IAAA,EAAM,cAAc,CAAA,GAAI,KAAA;AAE/B,IAAA,MAAM,kBAAkB,2BAAA,CAA4B,MAAA;AAAA,MAClD,CAAA,KAAA,KAAS,CAAC,cAAA,CAAe,QAAA,CAAS,KAAmC;AAAA,KACvE;AAEA,IAAA,IACE,cAAA,CAAe,KAAA,CAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,IAC7D,eAAA,CAAgB,MAAM,CAAA,KAAA,KAAS,UAAA,CAAW,KAAK,CAAA,KAAM,MAAS,CAAA,EAC9D;AACA,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,eAAe,UAAA,CAAW,aAAA;AAAA,QAC1B,GAAG,cAAA,CAAe,MAAA,CAAO,CAAC,KAAK,KAAA,KAAU;AACvC,UAAA,GAAA,CAAI,KAAK,CAAA,GAAI,UAAA,CAAW,KAAK,CAAA;AAC7B,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAAyB;AAAA,OAC9B;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAC7C;AAQO,SAAS,2BACd,MAAA,EACwB;AACxB,EAAA,qBAAA,CAAsB,MAAM,CAAA;AAE5B,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,iBAAA,CAAkB,MAAM,CAAA,IAAK,UAAA;AAEjD,EAAA,IAAI,CAAC,WAAA,CAAY,IAAI,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sCAAsC,IAAI,CAAA,qBAAA;AAAA,KAC5C;AAAA,EACF;AAEA,EAAA,MAAM,oBAAoB,MAAA,CACvB,sBAAA,CAAuB,aAAa,CAAA,EACnC,IAAI,CAAA,UAAA,KAAc;AAClB,IAAA,MAAM,MAAA,GAA6C;AAAA,MACjD,aAAA,EAAe,UAAA,CAAW,sBAAA,CAAuB,eAAe,CAAA;AAAA,MAChE,mBAAA,EAAqB,UAAA,CAClB,iBAAA,CAAkB,qBAAqB,GACtC,IAAA,EAAK;AAAA,MACT,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,QAAA,EAAU,UAAA,CAAW,iBAAA,CAAkB,UAAU,GAAG,IAAA,EAAK;AAAA,MACzD,YAAA,EAAc,UAAA,CAAW,iBAAA,CAAkB,cAAc,GAAG,IAAA,EAAK;AAAA,MACjE,uBAAA,EAAyB,UAAA,CACtB,iBAAA,CAAkB,yBAAyB,GAC1C,IAAA;AAAK,KACX;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AAEH,EAAA,IAAI,WAAA,GAAmD,MAAA;AACvD,EAAA,IAAI,sBAAsB,MAAA,EAAW;AACnC,IAAA,MAAM,SAAS,iBAAA,EACX,MAAA,CAAO,CAAC,GAAA,EAAK,kBAAkB,KAAA,KAAU;AACzC,MAAA,IAAI,KAAA,GAA4B,MAAA;AAChC,MAAA,IAAI;AACF,QAAA,uBAAA,CAAwB,gBAAgB,CAAA;AAAA,MAC1C,SAAS,CAAA,EAAG;AACV,QAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AAAA,MACZ;AAEA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,KAAK,CAAA,uBAAA,EAA0B,KAAA,GAAQ,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,MACzD;AAEA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY,CAAA,CACpB,MAAA;AAAA,MACC,MAAA,CAAO,OAAA;AAAA,QACL,iBAAA,CACG,MAAA;AAAA,UACC,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,GAAS;AAAA,SACtC,CACC,MAAA,CAAO,CAAC,GAAA,EAAK,YAAY,KAAA,KAAU;AAClC,UAAA,UAAA,CAAW,aAAA,EAAe,QAAQ,CAAA,YAAA,KAAgB;AAChD,YAAA,IAAI,CAAC,GAAA,CAAI,YAAY,CAAA,EAAG;AACtB,cAAA,GAAA,CAAI,YAAY,IAAI,EAAC;AAAA,YACvB;AAEA,YAAA,GAAA,CAAI,YAAY,CAAA,CAAE,IAAA,CAAK,KAAA,GAAQ,CAAC,CAAA;AAAA,UAClC,CAAC,CAAA;AAED,UAAA,OAAO,GAAA;AAAA,QACT,CAAA,EAAG,EAA8B;AAAA,QAElC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,OAAO,CAAA,KAAM,OAAA,CAAQ,MAAA,GAAS,CAAC,EAC3C,MAAA,CAAO,CAAC,KAAK,CAAC,GAAA,EAAK,OAAO,CAAA,KAAM;AAC/B,QAAA,GAAA,CAAI,IAAA;AAAA,UACF,gBAAgB,GAAG,CAAA,yDAAA,EAA4D,QAC5E,KAAA,CAAM,CAAA,EAAG,QAAQ,MAAA,GAAS,CAAC,CAAA,CAC3B,IAAA,CAAK,IAAI,CAAC,CAAA,KAAA,EAAQ,QAAQ,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAC,CAAA;AAAA,SAClD;AACA,QAAA,OAAO,GAAA;AAAA,MACT,CAAA,EAAG,KAAA,CAAM,EAAA,EAAY;AAAA,KACzB;AAEF,IAAA,IAAI,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,EAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACpE;AAAA,IACF;AAEA,IAAA,WAAA,GAAc,iBAAA,CAAkB,GAAA;AAAA,MAAI,CAAA,gBAAA,KAClC,wBAAwB,gBAAgB;AAAA,KAC1C;AAEA,IAAA,IACE,WAAA,CAAY,IAAA;AAAA,MACV,CAAA,UAAA,KAAc,WAAW,IAAA,KAAS;AAAA,KACpC,IACA,SAAS,UAAA,EACT;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,qCAAA,EAAwC,IAAI,CAAA,gEAAA,EAAmE,UAAU,CAAA;AAAA,OAC3H;AAAA,IACF;AAEA,IAAA,IACE,WAAA,CAAY,MAAA;AAAA,MACV,gBACE,UAAA,CAAW,aAAA,KAAkB,MAAA,IAC7B,UAAA,CAAW,cAAc,MAAA,KAAW;AAAA,KACxC,CAAE,SAAS,CAAA,EACX;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wCAAwC,IAAI,CAAA,+DAAA;AAAA,OAC9C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA,EAAkB,MAAA,CAAO,iBAAA,CAAkB,kBAAkB;AAAA,GAC/D;AACF;AASO,SAAS,4BACd,OAAA,EAC0B;AAE1B,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA;AAIrD,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,OAAK,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA,EAAG;AAC5C,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,UAAA,EAAY,CAAA;AAAA,EAClC;AAEA,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,sBAAsB,MAAA,EAAgB;AAC7C,EAAA,IAAI,OAAO,WAAA,CAAY,YAAY,KAAK,MAAA,CAAO,WAAA,CAAY,OAAO,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wGAAA;AAAA,KACF;AAAA,EACF;AACF;;;;"}