@backstage/integration 2.0.3 → 2.1.0-next.0

package/dist/github/DefaultGithubCredentialsProvider.cjs.js

@@ -1,11 +1,9 @@
 'use strict';
 
 var SingleInstanceGithubCredentialsProvider = require('./SingleInstanceGithubCredentialsProvider.cjs.js');
+var errors = require('@backstage/errors');
 
 class DefaultGithubCredentialsProvider {
-  constructor(providers) {
-    this.providers = providers;
-  }
   static fromIntegrations(integrations) {
     const credentialsProviders = /* @__PURE__ */ new Map();
     integrations.github.list().forEach((integration) => {
@@ -14,6 +12,24 @@ class DefaultGithubCredentialsProvider {
     });
     return new DefaultGithubCredentialsProvider(credentialsProviders);
   }
+  /**
+   * Creates a credentials provider backed by the connections service.
+   *
+   * @param connections - The connections service used to resolve GitHub credentials.
+   * @internal
+   */
+  static experimentalFromConnections(connections) {
+    return new DefaultGithubCredentialsProvider(
+      /* @__PURE__ */ new Map(),
+      connections
+    );
+  }
+  providers;
+  #connections;
+  constructor(providers, connections) {
+    this.providers = providers;
+    this.#connections = connections;
+  }
   /**
    * Returns {@link GithubCredentials} for a given URL.
    *
@@ -39,6 +55,62 @@ class DefaultGithubCredentialsProvider {
    * @returns A promise of {@link GithubCredentials}.
    */
   async getCredentials(opts) {
+    if (this.#connections) {
+      const connection = await this.#connections.find({
+        type: "github",
+        url: opts.url,
+        authMethods: ["app", "token", "none"]
+      }).catch((error) => {
+        throw new errors.ForwardedError(
+          "Failed getting credentials from connection",
+          error
+        );
+      });
+      const { auth } = connection;
+      const config = {
+        host: connection.host,
+        apiBaseUrl: connection.apiBaseUrl,
+        rawBaseUrl: connection.rawBaseUrl
+      };
+      let providerKey;
+      if (auth.method === "app") {
+        const appId = Number(auth.appId);
+        if (!Number.isSafeInteger(appId) || appId <= 0) {
+          throw new errors.InputError(
+            `Invalid GitHub App ID "${auth.appId}", expected a positive safe integer`
+          );
+        }
+        const normalizedOrgs = auth.orgs?.length ? Array.from(
+          new Set(auth.orgs.map((org) => org.toLocaleLowerCase("en-US")))
+        ).sort() : void 0;
+        config.apps = [
+          {
+            appId,
+            privateKey: auth.privateKey,
+            clientId: auth.clientId,
+            clientSecret: auth.clientSecret,
+            webhookSecret: auth.webhookSecret,
+            publicAccess: auth.publicAccess,
+            allowedInstallationOwners: normalizedOrgs
+          }
+        ];
+        providerKey = `${connection.host}:app:${appId}:${JSON.stringify(
+          normalizedOrgs ?? []
+        )}:${String(auth.publicAccess ?? false)}`;
+      } else if (auth.method === "token") {
+        config.token = auth.token;
+      } else {
+        providerKey = `${connection.host}:none`;
+      }
+      let provider2 = providerKey ? this.providers.get(providerKey) : void 0;
+      if (!provider2) {
+        provider2 = SingleInstanceGithubCredentialsProvider.SingleInstanceGithubCredentialsProvider.create(config);
+        if (providerKey) {
+          this.providers.set(providerKey, provider2);
+        }
+      }
+      return provider2.getCredentials(opts);
+    }
     const parsed = new URL(opts.url);
     const provider = this.providers.get(parsed.host);
     if (!provider) {

package/dist/github/DefaultGithubCredentialsProvider.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultGithubCredentialsProvider.cjs.js","sources":["../../src/github/DefaultGithubCredentialsProvider.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { GithubCredentials, GithubCredentialsProvider } from './types';\nimport { ScmIntegrationRegistry } from '../registry';\nimport { SingleInstanceGithubCredentialsProvider } from './SingleInstanceGithubCredentialsProvider';\n\n/**\n * Handles the creation and caching of credentials for GitHub integrations.\n *\n * @public\n * @remarks\n *\n * TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake\n */\nexport class DefaultGithubCredentialsProvider\n  implements GithubCredentialsProvider\n{\n  static fromIntegrations(integrations: ScmIntegrationRegistry) {\n    const credentialsProviders: Map<string, GithubCredentialsProvider> =\n      new Map<string, GithubCredentialsProvider>();\n\n    integrations.github.list().forEach(integration => {\n      const credentialsProvider =\n        SingleInstanceGithubCredentialsProvider.create(integration.config);\n      credentialsProviders.set(integration.config.host, credentialsProvider);\n    });\n    return new DefaultGithubCredentialsProvider(credentialsProviders);\n  }\n\n  private constructor(\n    private readonly providers: Map<string, GithubCredentialsProvider>,\n  ) {}\n\n  /**\n   * Returns {@link GithubCredentials} for a given URL.\n   *\n   * @remarks\n   *\n   * Consecutive calls to this method with the same URL will return cached\n   * credentials.\n   *\n   * The shortest lifetime for a token returned is 10 minutes.\n   *\n   * @example\n   * ```ts\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage/foobar'\n   * })\n   *\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage'\n   * })\n   * ```\n   *\n   * @param opts - The organization or repository URL\n   * @returns A promise of {@link GithubCredentials}.\n   */\n  async getCredentials(opts: { url: string }): Promise<GithubCredentials> {\n    const parsed = new URL(opts.url);\n    const provider = this.providers.get(parsed.host);\n\n    if (!provider) {\n      throw new Error(\n        `There is no GitHub integration that matches ${opts.url}. Please add a configuration for an integration.`,\n      );\n    }\n\n    return provider.getCredentials(opts);\n  }\n}\n"],"names":["SingleInstanceGithubCredentialsProvider"],"mappings":";;;;AA4BO,MAAM,gCAAA,CAEb;AAAA,EAaU,YACW,SAAA,EACjB;AADiB,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAChB;AAAA,EAdH,OAAO,iBAAiB,YAAA,EAAsC;AAC5D,IAAA,MAAM,oBAAA,uBACA,GAAA,EAAuC;AAE7C,IAAA,YAAA,CAAa,MAAA,CAAO,IAAA,EAAK,CAAE,OAAA,CAAQ,CAAA,WAAA,KAAe;AAChD,MAAA,MAAM,mBAAA,GACJA,+EAAA,CAAwC,MAAA,CAAO,WAAA,CAAY,MAAM,CAAA;AACnE,MAAA,oBAAA,CAAqB,GAAA,CAAI,WAAA,CAAY,MAAA,CAAO,IAAA,EAAM,mBAAmB,CAAA;AAAA,IACvE,CAAC,CAAA;AACD,IAAA,OAAO,IAAI,iCAAiC,oBAAoB,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAM,eAAe,IAAA,EAAmD;AACtE,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAC/B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,IAAI,CAAA;AAE/C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4CAAA,EAA+C,KAAK,GAAG,CAAA,gDAAA;AAAA,OACzD;AAAA,IACF;AAEA,IAAA,OAAO,QAAA,CAAS,eAAe,IAAI,CAAA;AAAA,EACrC;AACF;;;;"}
+{"version":3,"file":"DefaultGithubCredentialsProvider.cjs.js","sources":["../../src/github/DefaultGithubCredentialsProvider.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { GithubCredentials, GithubCredentialsProvider } from './types';\nimport { ScmIntegrationRegistry } from '../registry';\nimport { SingleInstanceGithubCredentialsProvider } from './SingleInstanceGithubCredentialsProvider';\nimport type { ConnectionsService } from '@backstage/connections';\nimport { ForwardedError, InputError } from '@backstage/errors';\nimport type { GithubIntegrationConfig } from './config';\n\n/**\n * Handles the creation and caching of credentials for GitHub integrations.\n *\n * @public\n * @remarks\n *\n * TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake\n */\nexport class DefaultGithubCredentialsProvider\n  implements GithubCredentialsProvider\n{\n  static fromIntegrations(integrations: ScmIntegrationRegistry) {\n    const credentialsProviders: Map<string, GithubCredentialsProvider> =\n      new Map<string, GithubCredentialsProvider>();\n\n    integrations.github.list().forEach(integration => {\n      const credentialsProvider =\n        SingleInstanceGithubCredentialsProvider.create(integration.config);\n      credentialsProviders.set(integration.config.host, credentialsProvider);\n    });\n    return new DefaultGithubCredentialsProvider(credentialsProviders);\n  }\n\n  /**\n   * Creates a credentials provider backed by the connections service.\n   *\n   * @param connections - The connections service used to resolve GitHub credentials.\n   * @internal\n   */\n  static experimentalFromConnections(connections: ConnectionsService) {\n    return new DefaultGithubCredentialsProvider(\n      new Map<string, GithubCredentialsProvider>(),\n      connections,\n    );\n  }\n\n  private readonly providers: Map<string, GithubCredentialsProvider>;\n  readonly #connections?: ConnectionsService;\n\n  private constructor(\n    providers: Map<string, GithubCredentialsProvider>,\n    connections?: ConnectionsService,\n  ) {\n    this.providers = providers;\n    this.#connections = connections;\n  }\n\n  /**\n   * Returns {@link GithubCredentials} for a given URL.\n   *\n   * @remarks\n   *\n   * Consecutive calls to this method with the same URL will return cached\n   * credentials.\n   *\n   * The shortest lifetime for a token returned is 10 minutes.\n   *\n   * @example\n   * ```ts\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage/foobar'\n   * })\n   *\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage'\n   * })\n   * ```\n   *\n   * @param opts - The organization or repository URL\n   * @returns A promise of {@link GithubCredentials}.\n   */\n  async getCredentials(opts: { url: string }): Promise<GithubCredentials> {\n    if (this.#connections) {\n      // Ask the connections service to select auth for this URL. A host may\n      // have different GitHub Apps for different organizations, so this\n      // selection cannot be done once when the provider is created.\n\n      const connection = await this.#connections\n        .find({\n          type: 'github',\n          url: opts.url,\n          authMethods: ['app', 'token', 'none'],\n        })\n        .catch(error => {\n          throw new ForwardedError(\n            'Failed getting credentials from connection',\n            error,\n          );\n        });\n\n      const { auth } = connection;\n\n      // Adapt the connection schema to the existing provider configuration so\n      // credential creation and token caching stay in one implementation.\n      const config: GithubIntegrationConfig = {\n        host: connection.host,\n        apiBaseUrl: connection.apiBaseUrl,\n        rawBaseUrl: connection.rawBaseUrl,\n      };\n\n      // Reusing an App provider preserves its installation-token cache. App\n      // organizations are canonicalized because GitHub owner matching is\n      // case-insensitive and does not depend on ordering. Static token\n      // providers have no internal token cache, so they are recreated rather\n      // than placing their secret token in a cache key.\n      let providerKey: string | undefined;\n      if (auth.method === 'app') {\n        const appId = Number(auth.appId);\n        if (!Number.isSafeInteger(appId) || appId <= 0) {\n          throw new InputError(\n            `Invalid GitHub App ID \"${auth.appId}\", expected a positive safe integer`,\n          );\n        }\n        const normalizedOrgs = auth.orgs?.length\n          ? Array.from(\n              new Set(auth.orgs.map(org => org.toLocaleLowerCase('en-US'))),\n            ).sort()\n          : undefined;\n        config.apps = [\n          {\n            appId,\n            privateKey: auth.privateKey,\n            clientId: auth.clientId,\n            clientSecret: auth.clientSecret,\n            webhookSecret: auth.webhookSecret,\n            publicAccess: auth.publicAccess,\n            allowedInstallationOwners: normalizedOrgs,\n          },\n        ];\n        providerKey = `${connection.host}:app:${appId}:${JSON.stringify(\n          normalizedOrgs ?? [],\n        )}:${String(auth.publicAccess ?? false)}`;\n      } else if (auth.method === 'token') {\n        config.token = auth.token;\n      } else {\n        providerKey = `${connection.host}:none`;\n      }\n\n      let provider = providerKey ? this.providers.get(providerKey) : undefined;\n      if (!provider) {\n        provider = SingleInstanceGithubCredentialsProvider.create(config);\n        if (providerKey) {\n          this.providers.set(providerKey, provider);\n        }\n      }\n\n      return provider.getCredentials(opts);\n    }\n\n    const parsed = new URL(opts.url);\n    const provider = this.providers.get(parsed.host);\n\n    if (!provider) {\n      throw new Error(\n        `There is no GitHub integration that matches ${opts.url}. Please add a configuration for an integration.`,\n      );\n    }\n\n    return provider.getCredentials(opts);\n  }\n}\n"],"names":["SingleInstanceGithubCredentialsProvider","ForwardedError","InputError","provider"],"mappings":";;;;;AA+BO,MAAM,gCAAA,CAEb;AAAA,EACE,OAAO,iBAAiB,YAAA,EAAsC;AAC5D,IAAA,MAAM,oBAAA,uBACA,GAAA,EAAuC;AAE7C,IAAA,YAAA,CAAa,MAAA,CAAO,IAAA,EAAK,CAAE,OAAA,CAAQ,CAAA,WAAA,KAAe;AAChD,MAAA,MAAM,mBAAA,GACJA,+EAAA,CAAwC,MAAA,CAAO,WAAA,CAAY,MAAM,CAAA;AACnE,MAAA,oBAAA,CAAqB,GAAA,CAAI,WAAA,CAAY,MAAA,CAAO,IAAA,EAAM,mBAAmB,CAAA;AAAA,IACvE,CAAC,CAAA;AACD,IAAA,OAAO,IAAI,iCAAiC,oBAAoB,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,4BAA4B,WAAA,EAAiC;AAClE,IAAA,OAAO,IAAI,gCAAA;AAAA,0BACL,GAAA,EAAuC;AAAA,MAC3C;AAAA,KACF;AAAA,EACF;AAAA,EAEiB,SAAA;AAAA,EACR,YAAA;AAAA,EAED,WAAA,CACN,WACA,WAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,YAAA,GAAe,WAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,eAAe,IAAA,EAAmD;AACtE,IAAA,IAAI,KAAK,YAAA,EAAc;AAKrB,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAC3B,IAAA,CAAK;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,WAAA,EAAa,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM;AAAA,OACrC,CAAA,CACA,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,QAAA,MAAM,IAAIC,qBAAA;AAAA,UACR,4CAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AAEH,MAAA,MAAM,EAAE,MAAK,GAAI,UAAA;AAIjB,MAAA,MAAM,MAAA,GAAkC;AAAA,QACtC,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,YAAY,UAAA,CAAW,UAAA;AAAA,QACvB,YAAY,UAAA,CAAW;AAAA,OACzB;AAOA,MAAA,IAAI,WAAA;AACJ,MAAA,IAAI,IAAA,CAAK,WAAW,KAAA,EAAO;AACzB,QAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAC/B,QAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC9C,UAAA,MAAM,IAAIC,iBAAA;AAAA,YACR,CAAA,uBAAA,EAA0B,KAAK,KAAK,CAAA,mCAAA;AAAA,WACtC;AAAA,QACF;AACA,QAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,IAAA,EAAM,MAAA,GAC9B,KAAA,CAAM,IAAA;AAAA,UACJ,IAAI,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,SAAO,GAAA,CAAI,iBAAA,CAAkB,OAAO,CAAC,CAAC;AAAA,SAC9D,CAAE,MAAK,GACP,MAAA;AACJ,QAAA,MAAA,CAAO,IAAA,GAAO;AAAA,UACZ;AAAA,YACE,KAAA;AAAA,YACA,YAAY,IAAA,CAAK,UAAA;AAAA,YACjB,UAAU,IAAA,CAAK,QAAA;AAAA,YACf,cAAc,IAAA,CAAK,YAAA;AAAA,YACnB,eAAe,IAAA,CAAK,aAAA;AAAA,YACpB,cAAc,IAAA,CAAK,YAAA;AAAA,YACnB,yBAAA,EAA2B;AAAA;AAC7B,SACF;AACA,QAAA,WAAA,GAAc,GAAG,UAAA,CAAW,IAAI,CAAA,KAAA,EAAQ,KAAK,IAAI,IAAA,CAAK,SAAA;AAAA,UACpD,kBAAkB;AAAC,SACpB,CAAA,CAAA,EAAI,MAAA,CAAO,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAC,CAAA,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,IAAA,CAAK,MAAA,KAAW,OAAA,EAAS;AAClC,QAAA,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA;AAAA,MACtB,CAAA,MAAO;AACL,QAAA,WAAA,GAAc,CAAA,EAAG,WAAW,IAAI,CAAA,KAAA,CAAA;AAAA,MAClC;AAEA,MAAA,IAAIC,YAAW,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,WAAW,CAAA,GAAI,MAAA;AAC/D,MAAA,IAAI,CAACA,SAAAA,EAAU;AACb,QAAAA,SAAAA,GAAWH,+EAAA,CAAwC,MAAA,CAAO,MAAM,CAAA;AAChE,QAAA,IAAI,WAAA,EAAa;AACf,UAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,WAAA,EAAaG,SAAQ,CAAA;AAAA,QAC1C;AAAA,MACF;AAEA,MAAA,OAAOA,SAAAA,CAAS,eAAe,IAAI,CAAA;AAAA,IACrC;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAC/B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,IAAI,CAAA;AAE/C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4CAAA,EAA+C,KAAK,GAAG,CAAA,gDAAA;AAAA,OACzD;AAAA,IACF;AAEA,IAAA,OAAO,QAAA,CAAS,eAAe,IAAI,CAAA;AAAA,EACrC;AACF;;;;"}

package/dist/github/DefaultGithubCredentialsProvider.esm.js

@@ -1,9 +1,7 @@
 import { SingleInstanceGithubCredentialsProvider } from './SingleInstanceGithubCredentialsProvider.esm.js';
+import { ForwardedError, InputError } from '@backstage/errors';
 
 class DefaultGithubCredentialsProvider {
-  constructor(providers) {
-    this.providers = providers;
-  }
   static fromIntegrations(integrations) {
     const credentialsProviders = /* @__PURE__ */ new Map();
     integrations.github.list().forEach((integration) => {
@@ -12,6 +10,24 @@ class DefaultGithubCredentialsProvider {
     });
     return new DefaultGithubCredentialsProvider(credentialsProviders);
   }
+  /**
+   * Creates a credentials provider backed by the connections service.
+   *
+   * @param connections - The connections service used to resolve GitHub credentials.
+   * @internal
+   */
+  static experimentalFromConnections(connections) {
+    return new DefaultGithubCredentialsProvider(
+      /* @__PURE__ */ new Map(),
+      connections
+    );
+  }
+  providers;
+  #connections;
+  constructor(providers, connections) {
+    this.providers = providers;
+    this.#connections = connections;
+  }
   /**
    * Returns {@link GithubCredentials} for a given URL.
    *
@@ -37,6 +53,62 @@ class DefaultGithubCredentialsProvider {
    * @returns A promise of {@link GithubCredentials}.
    */
   async getCredentials(opts) {
+    if (this.#connections) {
+      const connection = await this.#connections.find({
+        type: "github",
+        url: opts.url,
+        authMethods: ["app", "token", "none"]
+      }).catch((error) => {
+        throw new ForwardedError(
+          "Failed getting credentials from connection",
+          error
+        );
+      });
+      const { auth } = connection;
+      const config = {
+        host: connection.host,
+        apiBaseUrl: connection.apiBaseUrl,
+        rawBaseUrl: connection.rawBaseUrl
+      };
+      let providerKey;
+      if (auth.method === "app") {
+        const appId = Number(auth.appId);
+        if (!Number.isSafeInteger(appId) || appId <= 0) {
+          throw new InputError(
+            `Invalid GitHub App ID "${auth.appId}", expected a positive safe integer`
+          );
+        }
+        const normalizedOrgs = auth.orgs?.length ? Array.from(
+          new Set(auth.orgs.map((org) => org.toLocaleLowerCase("en-US")))
+        ).sort() : void 0;
+        config.apps = [
+          {
+            appId,
+            privateKey: auth.privateKey,
+            clientId: auth.clientId,
+            clientSecret: auth.clientSecret,
+            webhookSecret: auth.webhookSecret,
+            publicAccess: auth.publicAccess,
+            allowedInstallationOwners: normalizedOrgs
+          }
+        ];
+        providerKey = `${connection.host}:app:${appId}:${JSON.stringify(
+          normalizedOrgs ?? []
+        )}:${String(auth.publicAccess ?? false)}`;
+      } else if (auth.method === "token") {
+        config.token = auth.token;
+      } else {
+        providerKey = `${connection.host}:none`;
+      }
+      let provider2 = providerKey ? this.providers.get(providerKey) : void 0;
+      if (!provider2) {
+        provider2 = SingleInstanceGithubCredentialsProvider.create(config);
+        if (providerKey) {
+          this.providers.set(providerKey, provider2);
+        }
+      }
+      return provider2.getCredentials(opts);
+    }
     const parsed = new URL(opts.url);
     const provider = this.providers.get(parsed.host);
     if (!provider) {

package/dist/github/DefaultGithubCredentialsProvider.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultGithubCredentialsProvider.esm.js","sources":["../../src/github/DefaultGithubCredentialsProvider.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { GithubCredentials, GithubCredentialsProvider } from './types';\nimport { ScmIntegrationRegistry } from '../registry';\nimport { SingleInstanceGithubCredentialsProvider } from './SingleInstanceGithubCredentialsProvider';\n\n/**\n * Handles the creation and caching of credentials for GitHub integrations.\n *\n * @public\n * @remarks\n *\n * TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake\n */\nexport class DefaultGithubCredentialsProvider\n  implements GithubCredentialsProvider\n{\n  static fromIntegrations(integrations: ScmIntegrationRegistry) {\n    const credentialsProviders: Map<string, GithubCredentialsProvider> =\n      new Map<string, GithubCredentialsProvider>();\n\n    integrations.github.list().forEach(integration => {\n      const credentialsProvider =\n        SingleInstanceGithubCredentialsProvider.create(integration.config);\n      credentialsProviders.set(integration.config.host, credentialsProvider);\n    });\n    return new DefaultGithubCredentialsProvider(credentialsProviders);\n  }\n\n  private constructor(\n    private readonly providers: Map<string, GithubCredentialsProvider>,\n  ) {}\n\n  /**\n   * Returns {@link GithubCredentials} for a given URL.\n   *\n   * @remarks\n   *\n   * Consecutive calls to this method with the same URL will return cached\n   * credentials.\n   *\n   * The shortest lifetime for a token returned is 10 minutes.\n   *\n   * @example\n   * ```ts\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage/foobar'\n   * })\n   *\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage'\n   * })\n   * ```\n   *\n   * @param opts - The organization or repository URL\n   * @returns A promise of {@link GithubCredentials}.\n   */\n  async getCredentials(opts: { url: string }): Promise<GithubCredentials> {\n    const parsed = new URL(opts.url);\n    const provider = this.providers.get(parsed.host);\n\n    if (!provider) {\n      throw new Error(\n        `There is no GitHub integration that matches ${opts.url}. Please add a configuration for an integration.`,\n      );\n    }\n\n    return provider.getCredentials(opts);\n  }\n}\n"],"names":[],"mappings":";;AA4BO,MAAM,gCAAA,CAEb;AAAA,EAaU,YACW,SAAA,EACjB;AADiB,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAChB;AAAA,EAdH,OAAO,iBAAiB,YAAA,EAAsC;AAC5D,IAAA,MAAM,oBAAA,uBACA,GAAA,EAAuC;AAE7C,IAAA,YAAA,CAAa,MAAA,CAAO,IAAA,EAAK,CAAE,OAAA,CAAQ,CAAA,WAAA,KAAe;AAChD,MAAA,MAAM,mBAAA,GACJ,uCAAA,CAAwC,MAAA,CAAO,WAAA,CAAY,MAAM,CAAA;AACnE,MAAA,oBAAA,CAAqB,GAAA,CAAI,WAAA,CAAY,MAAA,CAAO,IAAA,EAAM,mBAAmB,CAAA;AAAA,IACvE,CAAC,CAAA;AACD,IAAA,OAAO,IAAI,iCAAiC,oBAAoB,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAM,eAAe,IAAA,EAAmD;AACtE,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAC/B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,IAAI,CAAA;AAE/C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4CAAA,EAA+C,KAAK,GAAG,CAAA,gDAAA;AAAA,OACzD;AAAA,IACF;AAEA,IAAA,OAAO,QAAA,CAAS,eAAe,IAAI,CAAA;AAAA,EACrC;AACF;;;;"}
+{"version":3,"file":"DefaultGithubCredentialsProvider.esm.js","sources":["../../src/github/DefaultGithubCredentialsProvider.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { GithubCredentials, GithubCredentialsProvider } from './types';\nimport { ScmIntegrationRegistry } from '../registry';\nimport { SingleInstanceGithubCredentialsProvider } from './SingleInstanceGithubCredentialsProvider';\nimport type { ConnectionsService } from '@backstage/connections';\nimport { ForwardedError, InputError } from '@backstage/errors';\nimport type { GithubIntegrationConfig } from './config';\n\n/**\n * Handles the creation and caching of credentials for GitHub integrations.\n *\n * @public\n * @remarks\n *\n * TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake\n */\nexport class DefaultGithubCredentialsProvider\n  implements GithubCredentialsProvider\n{\n  static fromIntegrations(integrations: ScmIntegrationRegistry) {\n    const credentialsProviders: Map<string, GithubCredentialsProvider> =\n      new Map<string, GithubCredentialsProvider>();\n\n    integrations.github.list().forEach(integration => {\n      const credentialsProvider =\n        SingleInstanceGithubCredentialsProvider.create(integration.config);\n      credentialsProviders.set(integration.config.host, credentialsProvider);\n    });\n    return new DefaultGithubCredentialsProvider(credentialsProviders);\n  }\n\n  /**\n   * Creates a credentials provider backed by the connections service.\n   *\n   * @param connections - The connections service used to resolve GitHub credentials.\n   * @internal\n   */\n  static experimentalFromConnections(connections: ConnectionsService) {\n    return new DefaultGithubCredentialsProvider(\n      new Map<string, GithubCredentialsProvider>(),\n      connections,\n    );\n  }\n\n  private readonly providers: Map<string, GithubCredentialsProvider>;\n  readonly #connections?: ConnectionsService;\n\n  private constructor(\n    providers: Map<string, GithubCredentialsProvider>,\n    connections?: ConnectionsService,\n  ) {\n    this.providers = providers;\n    this.#connections = connections;\n  }\n\n  /**\n   * Returns {@link GithubCredentials} for a given URL.\n   *\n   * @remarks\n   *\n   * Consecutive calls to this method with the same URL will return cached\n   * credentials.\n   *\n   * The shortest lifetime for a token returned is 10 minutes.\n   *\n   * @example\n   * ```ts\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage/foobar'\n   * })\n   *\n   * const { token, headers } = await getCredentials({\n   *   url: 'https://github.com/backstage'\n   * })\n   * ```\n   *\n   * @param opts - The organization or repository URL\n   * @returns A promise of {@link GithubCredentials}.\n   */\n  async getCredentials(opts: { url: string }): Promise<GithubCredentials> {\n    if (this.#connections) {\n      // Ask the connections service to select auth for this URL. A host may\n      // have different GitHub Apps for different organizations, so this\n      // selection cannot be done once when the provider is created.\n\n      const connection = await this.#connections\n        .find({\n          type: 'github',\n          url: opts.url,\n          authMethods: ['app', 'token', 'none'],\n        })\n        .catch(error => {\n          throw new ForwardedError(\n            'Failed getting credentials from connection',\n            error,\n          );\n        });\n\n      const { auth } = connection;\n\n      // Adapt the connection schema to the existing provider configuration so\n      // credential creation and token caching stay in one implementation.\n      const config: GithubIntegrationConfig = {\n        host: connection.host,\n        apiBaseUrl: connection.apiBaseUrl,\n        rawBaseUrl: connection.rawBaseUrl,\n      };\n\n      // Reusing an App provider preserves its installation-token cache. App\n      // organizations are canonicalized because GitHub owner matching is\n      // case-insensitive and does not depend on ordering. Static token\n      // providers have no internal token cache, so they are recreated rather\n      // than placing their secret token in a cache key.\n      let providerKey: string | undefined;\n      if (auth.method === 'app') {\n        const appId = Number(auth.appId);\n        if (!Number.isSafeInteger(appId) || appId <= 0) {\n          throw new InputError(\n            `Invalid GitHub App ID \"${auth.appId}\", expected a positive safe integer`,\n          );\n        }\n        const normalizedOrgs = auth.orgs?.length\n          ? Array.from(\n              new Set(auth.orgs.map(org => org.toLocaleLowerCase('en-US'))),\n            ).sort()\n          : undefined;\n        config.apps = [\n          {\n            appId,\n            privateKey: auth.privateKey,\n            clientId: auth.clientId,\n            clientSecret: auth.clientSecret,\n            webhookSecret: auth.webhookSecret,\n            publicAccess: auth.publicAccess,\n            allowedInstallationOwners: normalizedOrgs,\n          },\n        ];\n        providerKey = `${connection.host}:app:${appId}:${JSON.stringify(\n          normalizedOrgs ?? [],\n        )}:${String(auth.publicAccess ?? false)}`;\n      } else if (auth.method === 'token') {\n        config.token = auth.token;\n      } else {\n        providerKey = `${connection.host}:none`;\n      }\n\n      let provider = providerKey ? this.providers.get(providerKey) : undefined;\n      if (!provider) {\n        provider = SingleInstanceGithubCredentialsProvider.create(config);\n        if (providerKey) {\n          this.providers.set(providerKey, provider);\n        }\n      }\n\n      return provider.getCredentials(opts);\n    }\n\n    const parsed = new URL(opts.url);\n    const provider = this.providers.get(parsed.host);\n\n    if (!provider) {\n      throw new Error(\n        `There is no GitHub integration that matches ${opts.url}. Please add a configuration for an integration.`,\n      );\n    }\n\n    return provider.getCredentials(opts);\n  }\n}\n"],"names":["provider"],"mappings":";;;AA+BO,MAAM,gCAAA,CAEb;AAAA,EACE,OAAO,iBAAiB,YAAA,EAAsC;AAC5D,IAAA,MAAM,oBAAA,uBACA,GAAA,EAAuC;AAE7C,IAAA,YAAA,CAAa,MAAA,CAAO,IAAA,EAAK,CAAE,OAAA,CAAQ,CAAA,WAAA,KAAe;AAChD,MAAA,MAAM,mBAAA,GACJ,uCAAA,CAAwC,MAAA,CAAO,WAAA,CAAY,MAAM,CAAA;AACnE,MAAA,oBAAA,CAAqB,GAAA,CAAI,WAAA,CAAY,MAAA,CAAO,IAAA,EAAM,mBAAmB,CAAA;AAAA,IACvE,CAAC,CAAA;AACD,IAAA,OAAO,IAAI,iCAAiC,oBAAoB,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,4BAA4B,WAAA,EAAiC;AAClE,IAAA,OAAO,IAAI,gCAAA;AAAA,0BACL,GAAA,EAAuC;AAAA,MAC3C;AAAA,KACF;AAAA,EACF;AAAA,EAEiB,SAAA;AAAA,EACR,YAAA;AAAA,EAED,WAAA,CACN,WACA,WAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,YAAA,GAAe,WAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,MAAM,eAAe,IAAA,EAAmD;AACtE,IAAA,IAAI,KAAK,YAAA,EAAc;AAKrB,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAC3B,IAAA,CAAK;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,WAAA,EAAa,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM;AAAA,OACrC,CAAA,CACA,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,QAAA,MAAM,IAAI,cAAA;AAAA,UACR,4CAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AAEH,MAAA,MAAM,EAAE,MAAK,GAAI,UAAA;AAIjB,MAAA,MAAM,MAAA,GAAkC;AAAA,QACtC,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,YAAY,UAAA,CAAW,UAAA;AAAA,QACvB,YAAY,UAAA,CAAW;AAAA,OACzB;AAOA,MAAA,IAAI,WAAA;AACJ,MAAA,IAAI,IAAA,CAAK,WAAW,KAAA,EAAO;AACzB,QAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAC/B,QAAA,IAAI,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC9C,UAAA,MAAM,IAAI,UAAA;AAAA,YACR,CAAA,uBAAA,EAA0B,KAAK,KAAK,CAAA,mCAAA;AAAA,WACtC;AAAA,QACF;AACA,QAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,IAAA,EAAM,MAAA,GAC9B,KAAA,CAAM,IAAA;AAAA,UACJ,IAAI,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,SAAO,GAAA,CAAI,iBAAA,CAAkB,OAAO,CAAC,CAAC;AAAA,SAC9D,CAAE,MAAK,GACP,MAAA;AACJ,QAAA,MAAA,CAAO,IAAA,GAAO;AAAA,UACZ;AAAA,YACE,KAAA;AAAA,YACA,YAAY,IAAA,CAAK,UAAA;AAAA,YACjB,UAAU,IAAA,CAAK,QAAA;AAAA,YACf,cAAc,IAAA,CAAK,YAAA;AAAA,YACnB,eAAe,IAAA,CAAK,aAAA;AAAA,YACpB,cAAc,IAAA,CAAK,YAAA;AAAA,YACnB,yBAAA,EAA2B;AAAA;AAC7B,SACF;AACA,QAAA,WAAA,GAAc,GAAG,UAAA,CAAW,IAAI,CAAA,KAAA,EAAQ,KAAK,IAAI,IAAA,CAAK,SAAA;AAAA,UACpD,kBAAkB;AAAC,SACpB,CAAA,CAAA,EAAI,MAAA,CAAO,IAAA,CAAK,YAAA,IAAgB,KAAK,CAAC,CAAA,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,IAAA,CAAK,MAAA,KAAW,OAAA,EAAS;AAClC,QAAA,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA;AAAA,MACtB,CAAA,MAAO;AACL,QAAA,WAAA,GAAc,CAAA,EAAG,WAAW,IAAI,CAAA,KAAA,CAAA;AAAA,MAClC;AAEA,MAAA,IAAIA,YAAW,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,WAAW,CAAA,GAAI,MAAA;AAC/D,MAAA,IAAI,CAACA,SAAAA,EAAU;AACb,QAAAA,SAAAA,GAAW,uCAAA,CAAwC,MAAA,CAAO,MAAM,CAAA;AAChE,QAAA,IAAI,WAAA,EAAa;AACf,UAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,WAAA,EAAaA,SAAQ,CAAA;AAAA,QAC1C;AAAA,MACF;AAEA,MAAA,OAAOA,SAAAA,CAAS,eAAe,IAAI,CAAA;AAAA,IACrC;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA;AAC/B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,IAAI,CAAA;AAE/C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4CAAA,EAA+C,KAAK,GAAG,CAAA,gDAAA;AAAA,OACzD;AAAA,IACF;AAEA,IAAA,OAAO,QAAA,CAAS,eAAe,IAAI,CAAA;AAAA,EACrC;AACF;;;;"}

package/dist/index.d.ts

@@ -1577,8 +1577,9 @@ declare function getGithubFileFetchUrl(url: string, config: GithubIntegrationCon
  * TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake
  */
 declare class DefaultGithubCredentialsProvider implements GithubCredentialsProvider {
-    private readonly providers;
+    #private;
     static fromIntegrations(integrations: ScmIntegrationRegistry): DefaultGithubCredentialsProvider;
+    private readonly providers;
     private constructor();
     /**
      * Returns {@link GithubCredentials} for a given URL.

package/package.json

@@ -1,15 +1,12 @@
 {
   "name": "@backstage/integration",
-  "version": "2.0.3",
+  "version": "2.1.0-next.0",
   "description": "Helpers for managing integrations towards external systems",
   "backstage": {
     "role": "common-library"
   },
   "publishConfig": {
-    "access": "public",
-    "main": "dist/index.cjs.js",
-    "module": "dist/index.esm.js",
-    "types": "dist/index.d.ts"
+    "access": "public"
   },
   "keywords": [
     "backstage"
@@ -22,11 +19,36 @@
   },
   "license": "Apache-2.0",
   "sideEffects": false,
-  "main": "dist/index.cjs.js",
-  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.esm.js",
+      "require": "./dist/index.cjs.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.cjs.js"
+    },
+    "./alpha": {
+      "import": "./dist/alpha.esm.js",
+      "require": "./dist/alpha.cjs.js",
+      "types": "./dist/alpha.d.ts",
+      "default": "./dist/alpha.cjs.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs.js",
+  "types": "./dist/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "alpha": [
+        "dist/alpha.d.ts"
+      ],
+      "package.json": [
+        "package.json"
+      ]
+    }
+  },
   "files": [
     "dist",
-    "config.d.ts"
+    "config.schema.json"
   ],
   "scripts": {
     "build": "backstage-cli package build",
@@ -39,8 +61,9 @@
   "dependencies": {
     "@azure/identity": "^4.0.0",
     "@azure/storage-blob": "^12.5.0",
-    "@backstage/config": "^1.3.8",
-    "@backstage/errors": "^1.3.1",
+    "@backstage/config": "1.3.8",
+    "@backstage/connections": "0.3.0-next.1",
+    "@backstage/errors": "1.3.1",
     "@octokit/auth-app": "^4.0.0",
     "@octokit/rest": "^19.0.3",
     "cross-fetch": "^4.0.0",
@@ -50,18 +73,11 @@
     "p-throttle": "^4.1.1"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "^1.11.4",
-    "@backstage/cli": "^0.36.3",
-    "@backstage/config-loader": "^1.10.12",
-    "msw": "^1.0.0"
-  },
-  "configSchema": "config.d.ts",
-  "typesVersions": {
-    "*": {
-      "package.json": [
-        "package.json"
-      ]
-    }
+    "@backstage/backend-test-utils": "1.11.6-next.0",
+    "@backstage/cli": "0.36.5-next.0",
+    "@backstage/config-loader": "1.11.0",
+    "msw": "^2.0.0"
   },
-  "module": "dist/index.esm.js"
+  "configSchema": "config.schema.json",
+  "module": "./dist/index.esm.js"
 }