@backstage/plugin-app-backend 0.5.19-next.1 → 0.5.19

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @backstage/plugin-app-backend
 
+## 0.5.19
+
+### Patch Changes
+
+- a18df8f: Added optional `app.publicConfig` allowlists for config key paths and extension IDs exposed to unauthenticated users of protected apps. Authenticated users retain access to all frontend-visible configuration, and existing behavior is unchanged unless filtering is enabled.
+- c55505e: Fix protected app sign-in returning a 404 when an authenticated browser repeats the sign-in handoff for the same user.
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.11.0
+  - @backstage/config-loader@1.11.4
+  - @backstage/config@1.3.10
+  - @backstage/errors@1.3.2
+  - @backstage/plugin-auth-node@0.7.7
+  - @backstage/plugin-app-node@0.1.50
+
+## 0.5.19-next.2
+
+### Patch Changes
+
+- c55505e: Fix protected app sign-in returning a 404 when an authenticated browser repeats the sign-in handoff for the same user.
+
 ## 0.5.19-next.1
 
 ### Patch Changes

package/README.md

@@ -43,3 +43,8 @@ createServiceBuilder(module)
 ```
 
 Be sure to register the app router last, as it serves content for HTML5-mode navigation, i.e. falling back to serving `index.html` for any route that can't be found.
+
+## Public entry point configuration
+
+To restrict configuration exposed to unauthenticated users, see
+[Restricting public configuration](https://backstage.io/docs/conf/writing/#restricting-public-configuration).

package/config.schema.json

@@ -20,6 +20,26 @@
         "disablePublicEntryPoint": {
           "type": "boolean",
           "description": "Disables the public entry point used for unauthenticated sign-in pages. When the app is bundled with an `index-public-experimental` entry point, the app backend will automatically serve it to unauthenticated users. Set this to `true` to skip that behavior and always serve the main entry point instead."
+        },
+        "publicConfig": {
+          "type": "object",
+          "properties": {
+            "allowedConfig": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Config key paths to include. Omitted or empty means no keys are allowed. Extension configuration is controlled exclusively by allowedExtensions, even when this list includes app or app.extensions."
+            },
+            "allowedExtensions": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Exact extension IDs whose app.extensions entries are included. Omitted or empty means no extension configuration is included."
+            }
+          },
+          "description": "Restricts frontend-visible configuration injected into the unauthenticated public entry point. If omitted, all frontend-visible configuration is included. Does not affect configuration served to authenticated users or apps without an enabled public entry point. Do not combine with disableConfigInjection."
         }
       }
     }

package/dist/lib/config/filterPublicConfig.cjs.js

@@ -0,0 +1,48 @@
+'use strict';
+
+var cloneDeep = require('lodash/cloneDeep');
+var pick = require('lodash/pick');
+var set = require('lodash/set');
+var unset = require('lodash/unset');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var cloneDeep__default = /*#__PURE__*/_interopDefaultCompat(cloneDeep);
+var pick__default = /*#__PURE__*/_interopDefaultCompat(pick);
+var set__default = /*#__PURE__*/_interopDefaultCompat(set);
+var unset__default = /*#__PURE__*/_interopDefaultCompat(unset);
+
+function filterPublicConfig(appConfigs, config) {
+  const publicConfig = config.getOptionalConfig("app.publicConfig");
+  if (!publicConfig) {
+    return appConfigs;
+  }
+  const allowedConfig = publicConfig.getOptionalStringArray("allowedConfig") ?? [];
+  const allowedExtensions = publicConfig.getOptionalStringArray("allowedExtensions") ?? [];
+  return appConfigs.map((appConfig) => {
+    const source = cloneDeep__default.default(appConfig.data);
+    const extensions = source.app && source.app.extensions;
+    unset__default.default(source, "app.extensions");
+    const data = pick__default.default(source, allowedConfig);
+    if (Array.isArray(extensions)) {
+      set__default.default(
+        data,
+        "app.extensions",
+        extensions.filter((extension) => {
+          if (typeof extension === "string") {
+            return allowedExtensions.includes(extension);
+          }
+          if (extension && typeof extension === "object" && !Array.isArray(extension)) {
+            const ids = Object.keys(extension);
+            return ids.length === 1 && allowedExtensions.includes(ids[0]);
+          }
+          return false;
+        })
+      );
+    }
+    return { ...appConfig, data };
+  });
+}
+
+exports.filterPublicConfig = filterPublicConfig;
+//# sourceMappingURL=filterPublicConfig.cjs.js.map

package/dist/lib/config/filterPublicConfig.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterPublicConfig.cjs.js","sources":["../../../src/lib/config/filterPublicConfig.ts"],"sourcesContent":["/*\n * Copyright 2026 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AppConfig, Config } from '@backstage/config';\nimport { JsonObject } from '@backstage/types';\nimport cloneDeep from 'lodash/cloneDeep';\nimport pick from 'lodash/pick';\nimport set from 'lodash/set';\nimport unset from 'lodash/unset';\n\n/** @internal */\nexport function filterPublicConfig(\n  appConfigs: AppConfig[],\n  config: Config,\n): AppConfig[] {\n  const publicConfig = config.getOptionalConfig('app.publicConfig');\n  if (!publicConfig) {\n    return appConfigs;\n  }\n\n  const allowedConfig =\n    publicConfig.getOptionalStringArray('allowedConfig') ?? [];\n  const allowedExtensions =\n    publicConfig.getOptionalStringArray('allowedExtensions') ?? [];\n\n  return appConfigs.map(appConfig => {\n    const source = cloneDeep(appConfig.data);\n    const extensions = source.app && (source.app as JsonObject).extensions;\n    // Remove extensions before picking so parent and descendant paths cannot bypass the allowlist.\n    unset(source, 'app.extensions');\n    const data = pick(source, allowedConfig);\n\n    if (Array.isArray(extensions)) {\n      set(\n        data,\n        'app.extensions',\n        extensions.filter(extension => {\n          if (typeof extension === 'string') {\n            return allowedExtensions.includes(extension);\n          }\n          if (\n            extension &&\n            typeof extension === 'object' &&\n            !Array.isArray(extension)\n          ) {\n            const ids = Object.keys(extension);\n            return ids.length === 1 && allowedExtensions.includes(ids[0]);\n          }\n          return false;\n        }),\n      );\n    }\n\n    return { ...appConfig, data };\n  });\n}\n"],"names":["cloneDeep","unset","pick","set"],"mappings":";;;;;;;;;;;;;;AAwBO,SAAS,kBAAA,CACd,YACA,MAAA,EACa;AACb,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,iBAAA,CAAkB,kBAAkB,CAAA;AAChE,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,OAAO,UAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAA,GACJ,YAAA,CAAa,sBAAA,CAAuB,eAAe,KAAK,EAAC;AAC3D,EAAA,MAAM,iBAAA,GACJ,YAAA,CAAa,sBAAA,CAAuB,mBAAmB,KAAK,EAAC;AAE/D,EAAA,OAAO,UAAA,CAAW,IAAI,CAAA,SAAA,KAAa;AACjC,IAAA,MAAM,MAAA,GAASA,0BAAA,CAAU,SAAA,CAAU,IAAI,CAAA;AACvC,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,GAAA,IAAQ,MAAA,CAAO,GAAA,CAAmB,UAAA;AAE5D,IAAAC,sBAAA,CAAM,QAAQ,gBAAgB,CAAA;AAC9B,IAAA,MAAM,IAAA,GAAOC,qBAAA,CAAK,MAAA,EAAQ,aAAa,CAAA;AAEvC,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC7B,MAAAC,oBAAA;AAAA,QACE,IAAA;AAAA,QACA,gBAAA;AAAA,QACA,UAAA,CAAW,OAAO,CAAA,SAAA,KAAa;AAC7B,UAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,YAAA,OAAO,iBAAA,CAAkB,SAAS,SAAS,CAAA;AAAA,UAC7C;AACA,UAAA,IACE,SAAA,IACA,OAAO,SAAA,KAAc,QAAA,IACrB,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EACxB;AACA,YAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACjC,YAAA,OAAO,IAAI,MAAA,KAAW,CAAA,IAAK,kBAAkB,QAAA,CAAS,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,UAC9D;AACA,UAAA,OAAO,KAAA;AAAA,QACT,CAAC;AAAA,OACH;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,GAAG,SAAA,EAAW,IAAA,EAAK;AAAA,EAC9B,CAAC,CAAA;AACH;;"}

package/dist/lib/config/injectConfigIntoHtml.cjs.js

@@ -12,7 +12,7 @@ var compileTemplate__default = /*#__PURE__*/_interopDefaultCompat(compileTemplat
 
 const HTML_TEMPLATE_NAME = "index.html.tmpl";
 async function injectConfigIntoHtml(options) {
-  const { rootDir, appConfigs } = options;
+  const { rootDir, appConfigs, configFilter } = options;
   const templatePath = node_path.resolve(rootDir, HTML_TEMPLATE_NAME);
   if (!await fs__default.default.exists(templatePath)) {
     return void 0;
@@ -34,7 +34,7 @@ async function injectConfigIntoHtml(options) {
     "</head>",
     `
 <script type="backstage.io/config">
-${JSON.stringify(appConfigs, null, 2).replaceAll("<\/script", "").replaceAll("<!--", "")}
+${JSON.stringify(configFilter?.(appConfigs) ?? appConfigs, null, 2).replaceAll("<\/script", "").replaceAll("<!--", "")}
 <\/script>
 </head>`
   );

package/dist/lib/config/injectConfigIntoHtml.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"injectConfigIntoHtml.cjs.js","sources":["../../../src/lib/config/injectConfigIntoHtml.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fs from 'fs-extra';\nimport { resolve as resolvePath } from 'node:path';\nimport { InjectOptions } from './types';\nimport compileTemplate from 'lodash/template';\nimport { Config, ConfigReader } from '@backstage/config';\n\nconst HTML_TEMPLATE_NAME = 'index.html.tmpl';\n\n/** @internal */\nexport async function injectConfigIntoHtml(\n  options: InjectOptions,\n): Promise<Buffer | undefined> {\n  const { rootDir, appConfigs } = options;\n\n  const templatePath = resolvePath(rootDir, HTML_TEMPLATE_NAME);\n\n  if (!(await fs.exists(templatePath))) {\n    return undefined;\n  }\n\n  const templateContent = await fs.readFile(\n    resolvePath(rootDir, HTML_TEMPLATE_NAME),\n    'utf8',\n  );\n\n  const config = ConfigReader.fromConfigs(appConfigs);\n\n  const templateSource = compileTemplate(templateContent, {\n    interpolate: /<%=([\\s\\S]+?)%>/g,\n  });\n\n  const publicPath = resolvePublicPath(config);\n  const indexHtmlContent = templateSource({\n    config,\n    publicPath,\n  });\n\n  const indexHtmlContentWithConfig = indexHtmlContent.replace(\n    '</head>',\n    `\n<script type=\"backstage.io/config\">\n${JSON.stringify(appConfigs, null, 2)\n  // Note on the security aspects of this: We generally trust the app config to\n  // be safe, since control of the app config effectively means full control of\n  // the app. These substitutions are here as an extra precaution to avoid\n  // unintentionally breaking the app, to avoid this being flagged, and in case\n  // someone decides to hook up user input to the app config in their own setup.\n  .replaceAll('</script', '')\n  .replaceAll('<!--', '')}\n</script>\n</head>`,\n  );\n\n  return Buffer.from(indexHtmlContentWithConfig, 'utf8');\n}\n\nfunction resolvePublicPath(config: Config) {\n  const baseUrl = new URL(\n    config.getOptionalString('app.baseUrl') ?? '/',\n    'http://localhost:7007',\n  );\n  return baseUrl.pathname.replace(/\\/+$/, '');\n}\n"],"names":["resolvePath","fs","config","ConfigReader","compileTemplate"],"mappings":";;;;;;;;;;;;AAsBA,MAAM,kBAAA,GAAqB,iBAAA;AAG3B,eAAsB,qBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAW,GAAI,OAAA;AAEhC,EAAA,MAAM,YAAA,GAAeA,iBAAA,CAAY,OAAA,EAAS,kBAAkB,CAAA;AAE5D,EAAA,IAAI,CAAE,MAAMC,mBAAA,CAAG,MAAA,CAAO,YAAY,CAAA,EAAI;AACpC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,eAAA,GAAkB,MAAMA,mBAAA,CAAG,QAAA;AAAA,IAC/BD,iBAAA,CAAY,SAAS,kBAAkB,CAAA;AAAA,IACvC;AAAA,GACF;AAEA,EAAA,MAAME,QAAA,GAASC,mBAAA,CAAa,WAAA,CAAY,UAAU,CAAA;AAElD,EAAA,MAAM,cAAA,GAAiBC,iCAAgB,eAAA,EAAiB;AAAA,IACtD,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,kBAAkBF,QAAM,CAAA;AAC3C,EAAA,MAAM,mBAAmB,cAAA,CAAe;AAAA,YACtCA,QAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAA,MAAM,6BAA6B,gBAAA,CAAiB,OAAA;AAAA,IAClD,SAAA;AAAA,IACA;AAAA;AAAA,EAEF,IAAA,CAAK,SAAA,CAAU,UAAA,EAAY,IAAA,EAAM,CAAC,CAAA,CAMjC,UAAA,CAAW,WAAA,EAAY,EAAE,CAAA,CACzB,UAAA,CAAW,MAAA,EAAQ,EAAE,CAAC;AAAA;AAAA,OAAA;AAAA,GAGvB;AAEA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,0BAAA,EAA4B,MAAM,CAAA;AACvD;AAEA,SAAS,kBAAkB,MAAA,EAAgB;AACzC,EAAA,MAAM,UAAU,IAAI,GAAA;AAAA,IAClB,MAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA,IAAK,GAAA;AAAA,IAC3C;AAAA,GACF;AACA,EAAA,OAAO,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC5C;;"}
+{"version":3,"file":"injectConfigIntoHtml.cjs.js","sources":["../../../src/lib/config/injectConfigIntoHtml.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fs from 'fs-extra';\nimport { resolve as resolvePath } from 'node:path';\nimport { InjectOptions } from './types';\nimport compileTemplate from 'lodash/template';\nimport { Config, ConfigReader } from '@backstage/config';\n\nconst HTML_TEMPLATE_NAME = 'index.html.tmpl';\n\n/** @internal */\nexport async function injectConfigIntoHtml(\n  options: InjectOptions,\n): Promise<Buffer | undefined> {\n  const { rootDir, appConfigs, configFilter } = options;\n\n  const templatePath = resolvePath(rootDir, HTML_TEMPLATE_NAME);\n\n  if (!(await fs.exists(templatePath))) {\n    return undefined;\n  }\n\n  const templateContent = await fs.readFile(\n    resolvePath(rootDir, HTML_TEMPLATE_NAME),\n    'utf8',\n  );\n\n  const config = ConfigReader.fromConfigs(appConfigs);\n\n  const templateSource = compileTemplate(templateContent, {\n    interpolate: /<%=([\\s\\S]+?)%>/g,\n  });\n\n  const publicPath = resolvePublicPath(config);\n  const indexHtmlContent = templateSource({\n    config,\n    publicPath,\n  });\n\n  const indexHtmlContentWithConfig = indexHtmlContent.replace(\n    '</head>',\n    `\n<script type=\"backstage.io/config\">\n${JSON.stringify(configFilter?.(appConfigs) ?? appConfigs, null, 2)\n  // Note on the security aspects of this: We generally trust the app config to\n  // be safe, since control of the app config effectively means full control of\n  // the app. These substitutions are here as an extra precaution to avoid\n  // unintentionally breaking the app, to avoid this being flagged, and in case\n  // someone decides to hook up user input to the app config in their own setup.\n  .replaceAll('</script', '')\n  .replaceAll('<!--', '')}\n</script>\n</head>`,\n  );\n\n  return Buffer.from(indexHtmlContentWithConfig, 'utf8');\n}\n\nfunction resolvePublicPath(config: Config) {\n  const baseUrl = new URL(\n    config.getOptionalString('app.baseUrl') ?? '/',\n    'http://localhost:7007',\n  );\n  return baseUrl.pathname.replace(/\\/+$/, '');\n}\n"],"names":["resolvePath","fs","config","ConfigReader","compileTemplate"],"mappings":";;;;;;;;;;;;AAsBA,MAAM,kBAAA,GAAqB,iBAAA;AAG3B,eAAsB,qBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAY,YAAA,EAAa,GAAI,OAAA;AAE9C,EAAA,MAAM,YAAA,GAAeA,iBAAA,CAAY,OAAA,EAAS,kBAAkB,CAAA;AAE5D,EAAA,IAAI,CAAE,MAAMC,mBAAA,CAAG,MAAA,CAAO,YAAY,CAAA,EAAI;AACpC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,eAAA,GAAkB,MAAMA,mBAAA,CAAG,QAAA;AAAA,IAC/BD,iBAAA,CAAY,SAAS,kBAAkB,CAAA;AAAA,IACvC;AAAA,GACF;AAEA,EAAA,MAAME,QAAA,GAASC,mBAAA,CAAa,WAAA,CAAY,UAAU,CAAA;AAElD,EAAA,MAAM,cAAA,GAAiBC,iCAAgB,eAAA,EAAiB;AAAA,IACtD,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,kBAAkBF,QAAM,CAAA;AAC3C,EAAA,MAAM,mBAAmB,cAAA,CAAe;AAAA,YACtCA,QAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAA,MAAM,6BAA6B,gBAAA,CAAiB,OAAA;AAAA,IAClD,SAAA;AAAA,IACA;AAAA;AAAA,EAEF,KAAK,SAAA,CAAU,YAAA,GAAe,UAAU,CAAA,IAAK,YAAY,IAAA,EAAM,CAAC,CAAA,CAM/D,UAAA,CAAW,aAAY,EAAE,CAAA,CACzB,UAAA,CAAW,MAAA,EAAQ,EAAE,CAAC;AAAA;AAAA,OAAA;AAAA,GAGvB;AAEA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,0BAAA,EAA4B,MAAM,CAAA;AACvD;AAEA,SAAS,kBAAkB,MAAA,EAAgB;AACzC,EAAA,MAAM,UAAU,IAAI,GAAA;AAAA,IAClB,MAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA,IAAK,GAAA;AAAA,IAC3C;AAAA,GACF;AACA,EAAA,OAAO,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC5C;;"}

package/dist/lib/config/injectConfigIntoStatic.cjs.js

@@ -8,10 +8,12 @@ function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'defau
 var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
 
 async function injectConfigIntoStatic(options) {
-  const { staticDir, logger, appConfigs } = options;
+  const { staticDir, logger, appConfigs, configFilter } = options;
   const files = await fs__default.default.readdir(staticDir);
   const jsFiles = files.filter((file) => file.endsWith(".js"));
-  const escapedData = JSON.stringify(appConfigs).replace(/("|'|\\)/g, "\\$1");
+  const escapedData = JSON.stringify(
+    configFilter?.(appConfigs) ?? appConfigs
+  ).replace(/("|'|\\)/g, "\\$1");
   const injected = `/*__APP_INJECTED_CONFIG_MARKER__*/"${escapedData}"/*__INJECTED_END__*/`;
   for (const jsFile of jsFiles) {
     const path = node_path.resolve(staticDir, jsFile);

package/dist/lib/config/injectConfigIntoStatic.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"injectConfigIntoStatic.cjs.js","sources":["../../../src/lib/config/injectConfigIntoStatic.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fs from 'fs-extra';\nimport { resolve as resolvePath } from 'node:path';\nimport { InjectOptions } from './types';\n\n/**\n * Injects configs into the app bundle, replacing any existing injected config.\n */\nexport async function injectConfigIntoStatic(\n  options: InjectOptions,\n): Promise<string | undefined> {\n  const { staticDir, logger, appConfigs } = options;\n\n  const files = await fs.readdir(staticDir);\n  const jsFiles = files.filter(file => file.endsWith('.js'));\n\n  const escapedData = JSON.stringify(appConfigs).replace(/(\"|'|\\\\)/g, '\\\\$1');\n  const injected = `/*__APP_INJECTED_CONFIG_MARKER__*/\"${escapedData}\"/*__INJECTED_END__*/`;\n\n  for (const jsFile of jsFiles) {\n    const path = resolvePath(staticDir, jsFile);\n\n    const content = await fs.readFile(path, 'utf8');\n    if (content.includes('__APP_INJECTED_RUNTIME_CONFIG__')) {\n      logger.info(`Injecting env config into ${jsFile}`);\n\n      const newContent = content.replaceAll(\n        '\"__APP_INJECTED_RUNTIME_CONFIG__\"',\n        injected,\n      );\n      await fs.writeFile(path, newContent, 'utf8');\n      return path;\n    } else if (content.includes('__APP_INJECTED_CONFIG_MARKER__')) {\n      logger.info(`Replacing injected env config in ${jsFile}`);\n\n      const newContent = content.replaceAll(\n        /\\/\\*__APP_INJECTED_CONFIG_MARKER__\\*\\/.*?\\/\\*__INJECTED_END__\\*\\//g,\n        injected,\n      );\n      await fs.writeFile(path, newContent, 'utf8');\n      return path;\n    }\n  }\n  logger.info('Env config not injected');\n  return undefined;\n}\n"],"names":["fs","resolvePath"],"mappings":";;;;;;;;;AAuBA,eAAsB,uBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAW,GAAI,OAAA;AAE1C,EAAA,MAAM,KAAA,GAAQ,MAAMA,mBAAA,CAAG,OAAA,CAAQ,SAAS,CAAA;AACxC,EAAA,MAAM,UAAU,KAAA,CAAM,MAAA,CAAO,UAAQ,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,CAAA;AAEzD,EAAA,MAAM,cAAc,IAAA,CAAK,SAAA,CAAU,UAAU,CAAA,CAAE,OAAA,CAAQ,aAAa,MAAM,CAAA;AAC1E,EAAA,MAAM,QAAA,GAAW,sCAAsC,WAAW,CAAA,qBAAA,CAAA;AAElE,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,IAAA,GAAOC,iBAAA,CAAY,SAAA,EAAW,MAAM,CAAA;AAE1C,IAAA,MAAM,OAAA,GAAU,MAAMD,mBAAA,CAAG,QAAA,CAAS,MAAM,MAAM,CAAA;AAC9C,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,iCAAiC,CAAA,EAAG;AACvD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAEjD,MAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAAA,QACzB,mCAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAMA,mBAAA,CAAG,SAAA,CAAU,IAAA,EAAM,UAAA,EAAY,MAAM,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,MAAA,IAAW,OAAA,CAAQ,QAAA,CAAS,gCAAgC,CAAA,EAAG;AAC7D,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,MAAM,CAAA,CAAE,CAAA;AAExD,MAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAAA,QACzB,oEAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAMA,mBAAA,CAAG,SAAA,CAAU,IAAA,EAAM,UAAA,EAAY,MAAM,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,MAAA,CAAO,KAAK,yBAAyB,CAAA;AACrC,EAAA,OAAO,MAAA;AACT;;"}
+{"version":3,"file":"injectConfigIntoStatic.cjs.js","sources":["../../../src/lib/config/injectConfigIntoStatic.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport fs from 'fs-extra';\nimport { resolve as resolvePath } from 'node:path';\nimport { InjectOptions } from './types';\n\n/**\n * Injects configs into the app bundle, replacing any existing injected config.\n */\nexport async function injectConfigIntoStatic(\n  options: InjectOptions,\n): Promise<string | undefined> {\n  const { staticDir, logger, appConfigs, configFilter } = options;\n\n  const files = await fs.readdir(staticDir);\n  const jsFiles = files.filter(file => file.endsWith('.js'));\n\n  const escapedData = JSON.stringify(\n    configFilter?.(appConfigs) ?? appConfigs,\n  ).replace(/(\"|'|\\\\)/g, '\\\\$1');\n  const injected = `/*__APP_INJECTED_CONFIG_MARKER__*/\"${escapedData}\"/*__INJECTED_END__*/`;\n\n  for (const jsFile of jsFiles) {\n    const path = resolvePath(staticDir, jsFile);\n\n    const content = await fs.readFile(path, 'utf8');\n    if (content.includes('__APP_INJECTED_RUNTIME_CONFIG__')) {\n      logger.info(`Injecting env config into ${jsFile}`);\n\n      const newContent = content.replaceAll(\n        '\"__APP_INJECTED_RUNTIME_CONFIG__\"',\n        injected,\n      );\n      await fs.writeFile(path, newContent, 'utf8');\n      return path;\n    } else if (content.includes('__APP_INJECTED_CONFIG_MARKER__')) {\n      logger.info(`Replacing injected env config in ${jsFile}`);\n\n      const newContent = content.replaceAll(\n        /\\/\\*__APP_INJECTED_CONFIG_MARKER__\\*\\/.*?\\/\\*__INJECTED_END__\\*\\//g,\n        injected,\n      );\n      await fs.writeFile(path, newContent, 'utf8');\n      return path;\n    }\n  }\n  logger.info('Env config not injected');\n  return undefined;\n}\n"],"names":["fs","resolvePath"],"mappings":";;;;;;;;;AAuBA,eAAsB,uBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAY,cAAa,GAAI,OAAA;AAExD,EAAA,MAAM,KAAA,GAAQ,MAAMA,mBAAA,CAAG,OAAA,CAAQ,SAAS,CAAA;AACxC,EAAA,MAAM,UAAU,KAAA,CAAM,MAAA,CAAO,UAAQ,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,CAAA;AAEzD,EAAA,MAAM,cAAc,IAAA,CAAK,SAAA;AAAA,IACvB,YAAA,GAAe,UAAU,CAAA,IAAK;AAAA,GAChC,CAAE,OAAA,CAAQ,WAAA,EAAa,MAAM,CAAA;AAC7B,EAAA,MAAM,QAAA,GAAW,sCAAsC,WAAW,CAAA,qBAAA,CAAA;AAElE,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,IAAA,GAAOC,iBAAA,CAAY,SAAA,EAAW,MAAM,CAAA;AAE1C,IAAA,MAAM,OAAA,GAAU,MAAMD,mBAAA,CAAG,QAAA,CAAS,MAAM,MAAM,CAAA;AAC9C,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,iCAAiC,CAAA,EAAG;AACvD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAEjD,MAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAAA,QACzB,mCAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAMA,mBAAA,CAAG,SAAA,CAAU,IAAA,EAAM,UAAA,EAAY,MAAM,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,MAAA,IAAW,OAAA,CAAQ,QAAA,CAAS,gCAAgC,CAAA,EAAG;AAC7D,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,MAAM,CAAA,CAAE,CAAA;AAExD,MAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAAA,QACzB,oEAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAMA,mBAAA,CAAG,SAAA,CAAU,IAAA,EAAM,UAAA,EAAY,MAAM,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,MAAA,CAAO,KAAK,yBAAyB,CAAA;AACrC,EAAA,OAAO,MAAA;AACT;;"}

package/dist/service/router.cjs.js

@@ -13,6 +13,7 @@ var headers = require('../lib/headers.cjs.js');
 var errors = require('@backstage/errors');
 var injectConfig = require('../lib/config/injectConfig.cjs.js');
 var readFrontendConfig = require('../lib/config/readFrontendConfig.cjs.js');
+var filterPublicConfig = require('../lib/config/filterPublicConfig.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -70,33 +71,39 @@ async function createRouter(options) {
       `App is running in protected mode, serving public content from ${publicDistDir}`
     );
     const publicRouter = Router__default.default();
-    publicRouter.use(async (req, res, next) => {
+    const getRequestCredentials = async (req, res) => {
       try {
-        const credentials = await httpAuth.credentials(req, {
+        return await httpAuth.credentials(req, {
           allow: ["user", "service", "none"],
           allowLimitedAccess: true
         });
-        if (credentials.principal.type === "none") {
-          next();
-        } else {
-          next("router");
-        }
       } catch {
+        const credentials = await auth.getNoneCredentials();
         await httpAuth.issueUserCookie(res, {
-          credentials: await auth.getNoneCredentials()
+          credentials
         });
-        next();
+        return credentials;
       }
-    });
+    };
     publicRouter.post(
       "*",
       express__default.default.urlencoded({ extended: true }),
       async (req, res, next) => {
         if (req.body.type === "sign-in") {
+          const existingCredentials = await getRequestCredentials(req, res);
+          if (auth.isPrincipal(existingCredentials, "service")) {
+            next("router");
+            return;
+          }
           const credentials = await auth.authenticate(req.body.token);
           if (!auth.isPrincipal(credentials, "user")) {
             throw new errors.AuthenticationError("Invalid token, not a user");
           }
+          if (auth.isPrincipal(existingCredentials, "user") && existingCredentials.principal.userEntityRef !== credentials.principal.userEntityRef) {
+            throw new errors.AuthenticationError(
+              "Refused to replace an existing authenticated session"
+            );
+          }
           await httpAuth.issueUserCookie(res, {
             credentials
           });
@@ -109,13 +116,21 @@ async function createRouter(options) {
         }
       }
     );
+    publicRouter.use(async (req, res, next) => {
+      const credentials = await getRequestCredentials(req, res);
+      if (credentials.principal.type === "none") {
+        next();
+      } else {
+        next("router");
+      }
+    });
     publicRouter.use(
       await createEntryPointRouter({
         logger: logger.child({ entry: "public" }),
         rootDir: publicDistDir,
         assetStore: assetStore?.withNamespace("public"),
-        appConfigs
-        // TODO(Rugvip): We should not be including the full config here
+        appConfigs,
+        configFilter: (configs) => filterPublicConfig.filterPublicConfig(configs, config)
       })
     );
     router.use(publicRouter);
@@ -136,10 +151,17 @@ async function createEntryPointRouter({
   rootDir,
   assetStore,
   staticFallbackHandler,
-  appConfigs
+  appConfigs,
+  configFilter
 }) {
   const staticDir = node_path.resolve(rootDir, "static");
-  const injectResult = appConfigs && await injectConfig.injectConfig({ appConfigs, logger, rootDir, staticDir });
+  const injectResult = appConfigs && await injectConfig.injectConfig({
+    appConfigs,
+    logger,
+    rootDir,
+    staticDir,
+    configFilter
+  });
   const router = Router__default.default();
   const staticRouter = Router__default.default();
   staticRouter.use(
@@ -167,8 +189,24 @@ async function createEntryPointRouter({
   });
   router.use("/static", staticRouter);
   const rootRouter = Router__default.default();
-  rootRouter.use((req, _res, next) => {
-    if (req.path === "/" || req.path === "/index.html") {
+  rootRouter.use(async (req, _res, next) => {
+    let isIndex = req.path === "/" || req.path === "/index.html";
+    if (injectResult?.indexHtmlContent && !isIndex) {
+      try {
+        const path = backendPluginApi.resolveSafeChildPath(
+          rootDir,
+          `.${decodeURIComponent(req.path).replaceAll("\\", "/")}`
+        );
+        const [file, index] = await Promise.all([
+          fs__default.default.stat(path),
+          fs__default.default.stat(node_path.resolve(rootDir, "index.html"))
+        ]);
+        const candidate = file.isDirectory() ? await fs__default.default.stat(node_path.resolve(path, "index.html")) : file;
+        isIndex = candidate.dev === index.dev && candidate.ino === index.ino;
+      } catch {
+      }
+    }
+    if (isIndex) {
       next("router");
     } else {
       next();

package/dist/service/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  resolvePackagePath,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport type { AppConfig } from '@backstage/config';\nimport helmet from 'helmet';\nimport express, { Request, Response } from 'express';\nimport Router from 'express-promise-router';\nimport fs from 'fs-extra';\nimport { resolve as resolvePath } from 'node:path';\nimport {\n  createStaticAssetMiddleware,\n  findStaticAssets,\n  StaticAssetsStore,\n} from '../lib/assets';\nimport {\n  CACHE_CONTROL_MAX_CACHE,\n  CACHE_CONTROL_NO_CACHE,\n  CACHE_CONTROL_REVALIDATE_CACHE,\n} from '../lib/headers';\nimport type { ConfigSchema } from '@backstage/config-loader';\nimport {\n  AuthService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError, InputError } from '@backstage/errors';\nimport { injectConfig, readFrontendConfig } from '../lib/config';\n\n// express uses mime v1 while we only have types for mime v2\ntype Mime = { lookup(arg0: string): string };\n\n/**\n * @internal\n */\nexport interface RouterOptions {\n  config: RootConfigService;\n  logger: LoggerService;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n\n  /**\n   * If a database is provided it will be used to cache previously deployed static assets.\n   *\n   * This is a built-in alternative to using a `staticFallbackHandler`.\n   */\n  database: DatabaseService;\n\n  /**\n   * The name of the app package that content should be served from. The same app package should be\n   * added as a dependency to the backend package in order for it to be accessible at runtime.\n   *\n   * In a typical setup with a single app package this would be set to 'app'.\n   */\n  appPackageName: string;\n\n  /**\n   * A request handler to handle requests for static content that are not present in the app bundle.\n   *\n   * This can be used to avoid issues with clients on older deployment versions trying to access lazy\n   * loaded content that is no longer present. Typically the requests would fall back to a long-term\n   * object store where all recently deployed versions of the app are present.\n   *\n   * Another option is to provide a `database` that will take care of storing the static assets instead.\n   *\n   * If both `database` and `staticFallbackHandler` are provided, the `database` will attempt to serve\n   * static assets first, and if they are not found, the `staticFallbackHandler` will be called.\n   */\n  staticFallbackHandler?: express.Handler;\n\n  /**\n   *\n   * Provides a ConfigSchema.\n   *\n   */\n  schema?: ConfigSchema;\n}\n\n/**\n * @internal\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    config,\n    logger,\n    appPackageName,\n    staticFallbackHandler,\n    auth,\n    httpAuth,\n    schema,\n  } = options;\n\n  const disableConfigInjection = config.getOptionalBoolean(\n    'app.disableConfigInjection',\n  );\n  const disableStaticFallbackCache = config.getOptionalBoolean(\n    'app.disableStaticFallbackCache',\n  );\n\n  const appDistDir = resolvePackagePath(appPackageName, 'dist');\n  const staticDir = resolvePath(appDistDir, 'static');\n\n  if (!(await fs.pathExists(staticDir))) {\n    if (process.env.NODE_ENV === 'production') {\n      logger.error(\n        `Can't serve static app content from ${staticDir}, directory doesn't exist`,\n      );\n    }\n\n    return Router();\n  }\n\n  logger.info(`Serving static app content from ${appDistDir}`);\n\n  const appConfigs = disableConfigInjection\n    ? undefined\n    : await readFrontendConfig({\n        config,\n        appDistDir,\n        env: process.env,\n        schema,\n      });\n\n  const assetStore = !disableStaticFallbackCache\n    ? await StaticAssetsStore.create({\n        logger,\n        database: options.database,\n      })\n    : undefined;\n\n  const router = Router();\n\n  router.use(helmet.frameguard({ action: 'deny' }));\n\n  const publicDistDir = resolvePath(appDistDir, 'public');\n\n  const disablePublicEntryPoint = config.getOptionalBoolean(\n    'app.disablePublicEntryPoint',\n  );\n  const enablePublicEntryPoint =\n    !disablePublicEntryPoint && (await fs.pathExists(publicDistDir));\n\n  if (enablePublicEntryPoint) {\n    logger.info(\n      `App is running in protected mode, serving public content from ${publicDistDir}`,\n    );\n\n    const publicRouter = Router();\n\n    publicRouter.use(async (req, res, next) => {\n      try {\n        const credentials = await httpAuth.credentials(req, {\n          allow: ['user', 'service', 'none'],\n          allowLimitedAccess: true,\n        });\n\n        if (credentials.principal.type === 'none') {\n          next();\n        } else {\n          next('router');\n        }\n      } catch {\n        // If we fail to authenticate, make sure the session cookie is cleared\n        // and continue as unauthenticated. If the user is logged in they will\n        // immediately be redirected back to the protected app via the POST.\n        await httpAuth.issueUserCookie(res, {\n          credentials: await auth.getNoneCredentials(),\n        });\n        next();\n      }\n    });\n\n    publicRouter.post(\n      '*',\n      express.urlencoded({ extended: true }),\n      async (req, res, next) => {\n        if (req.body.type === 'sign-in') {\n          const credentials = await auth.authenticate(req.body.token);\n\n          if (!auth.isPrincipal(credentials, 'user')) {\n            throw new AuthenticationError('Invalid token, not a user');\n          }\n\n          await httpAuth.issueUserCookie(res, {\n            credentials,\n          });\n\n          // Resume as if it was a GET request towards the outer protected router, serving index.html\n          req.method = 'GET';\n          next('router');\n        } else {\n          throw new InputError(\n            'Invalid POST request to app-backend wildcard endpoint',\n          );\n        }\n      },\n    );\n\n    publicRouter.use(\n      await createEntryPointRouter({\n        logger: logger.child({ entry: 'public' }),\n        rootDir: publicDistDir,\n        assetStore: assetStore?.withNamespace('public'),\n        appConfigs, // TODO(Rugvip): We should not be including the full config here\n      }),\n    );\n\n    router.use(publicRouter);\n  }\n\n  router.use(\n    await createEntryPointRouter({\n      logger: logger.child({ entry: 'main' }),\n      rootDir: appDistDir,\n      assetStore,\n      staticFallbackHandler,\n      appConfigs,\n    }),\n  );\n\n  return router;\n}\n\nasync function createEntryPointRouter({\n  logger,\n  rootDir,\n  assetStore,\n  staticFallbackHandler,\n  appConfigs,\n}: {\n  logger: LoggerService;\n  rootDir: string;\n  assetStore?: StaticAssetsStore;\n  staticFallbackHandler?: express.Handler;\n  appConfigs?: AppConfig[];\n}) {\n  const staticDir = resolvePath(rootDir, 'static');\n\n  const injectResult =\n    appConfigs &&\n    (await injectConfig({ appConfigs, logger, rootDir, staticDir }));\n\n  const router = Router();\n\n  // Use a separate router for static content so that a fallback can be provided by backend\n  const staticRouter = Router();\n  staticRouter.use(\n    express.static(staticDir, {\n      setHeaders: (res, path) => {\n        if (injectResult?.injectedPath === path) {\n          res.setHeader('Cache-Control', CACHE_CONTROL_REVALIDATE_CACHE);\n        } else {\n          res.setHeader('Cache-Control', CACHE_CONTROL_MAX_CACHE);\n        }\n      },\n    }),\n  );\n\n  if (assetStore) {\n    const assets = await findStaticAssets(staticDir);\n    await assetStore.storeAssets(assets);\n    // Remove any assets that are older than 7 days\n    await assetStore.trimAssets({ maxAgeSeconds: 60 * 60 * 24 * 7 });\n\n    staticRouter.use(createStaticAssetMiddleware(assetStore));\n  }\n\n  if (staticFallbackHandler) {\n    staticRouter.use(staticFallbackHandler);\n  }\n  staticRouter.use((_req: Request, res: Response) => {\n    res.status(404).end();\n  });\n\n  router.use('/static', staticRouter);\n\n  const rootRouter = Router();\n  rootRouter.use((req, _res, next) => {\n    // Make sure / and /index.html are handled by the HTML5 route below\n    if (req.path === '/' || req.path === '/index.html') {\n      next('router');\n    } else {\n      next();\n    }\n  });\n  rootRouter.use(\n    express.static(rootDir, {\n      setHeaders: (res, path) => {\n        // The Cache-Control header instructs the browser to not cache html files since it might\n        // link to static assets from recently deployed versions.\n        if (\n          (express.static.mime as unknown as Mime).lookup(path) === 'text/html'\n        ) {\n          res.setHeader('Cache-Control', CACHE_CONTROL_NO_CACHE);\n        }\n      },\n    }),\n  );\n  router.use(rootRouter);\n\n  // HTML5 routing\n  router.get('/*', (_req, res) => {\n    if (injectResult?.indexHtmlContent) {\n      res.setHeader('Content-Type', 'text/html; charset=utf-8');\n      res.setHeader('Cache-Control', CACHE_CONTROL_NO_CACHE);\n      res.send(injectResult.indexHtmlContent);\n    } else {\n      res.sendFile(resolvePath(rootDir, 'index.html'), {\n        headers: {\n          // The Cache-Control header instructs the browser to not cache the index.html since it might\n          // link to static assets from recently deployed versions.\n          'cache-control': CACHE_CONTROL_NO_CACHE,\n        },\n      });\n    }\n  });\n\n  return router;\n}\n"],"names":["resolvePackagePath","resolvePath","fs","Router","readFrontendConfig","StaticAssetsStore","helmet","express","AuthenticationError","InputError","injectConfig","CACHE_CONTROL_REVALIDATE_CACHE","CACHE_CONTROL_MAX_CACHE","findStaticAssets","createStaticAssetMiddleware","CACHE_CONTROL_NO_CACHE"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkGA,eAAsB,aACpB,OAAA,EACyB;AACzB,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,cAAA;AAAA,IACA,qBAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,yBAAyB,MAAA,CAAO,kBAAA;AAAA,IACpC;AAAA,GACF;AACA,EAAA,MAAM,6BAA6B,MAAA,CAAO,kBAAA;AAAA,IACxC;AAAA,GACF;AAEA,EAAA,MAAM,UAAA,GAAaA,mCAAA,CAAmB,cAAA,EAAgB,MAAM,CAAA;AAC5D,EAAA,MAAM,SAAA,GAAYC,iBAAA,CAAY,UAAA,EAAY,QAAQ,CAAA;AAElD,EAAA,IAAI,CAAE,MAAMC,mBAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAI;AACrC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,MAAA,MAAA,CAAO,KAAA;AAAA,QACL,uCAAuC,SAAS,CAAA,yBAAA;AAAA,OAClD;AAAA,IACF;AAEA,IAAA,OAAOC,uBAAA,EAAO;AAAA,EAChB;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,CAAA,gCAAA,EAAmC,UAAU,CAAA,CAAE,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa,sBAAA,GACf,MAAA,GACA,MAAMC,qCAAA,CAAmB;AAAA,IACvB,MAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb;AAAA,GACD,CAAA;AAEL,EAAA,MAAM,UAAA,GAAa,CAAC,0BAAA,GAChB,MAAMC,oCAAkB,MAAA,CAAO;AAAA,IAC7B,MAAA;AAAA,IACA,UAAU,OAAA,CAAQ;AAAA,GACnB,CAAA,GACD,MAAA;AAEJ,EAAA,MAAM,SAASF,uBAAA,EAAO;AAEtB,EAAA,MAAA,CAAO,IAAIG,uBAAA,CAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,MAAA,EAAQ,CAAC,CAAA;AAEhD,EAAA,MAAM,aAAA,GAAgBL,iBAAA,CAAY,UAAA,EAAY,QAAQ,CAAA;AAEtD,EAAA,MAAM,0BAA0B,MAAA,CAAO,kBAAA;AAAA,IACrC;AAAA,GACF;AACA,EAAA,MAAM,yBACJ,CAAC,uBAAA,IAA4B,MAAMC,mBAAA,CAAG,WAAW,aAAa,CAAA;AAEhE,EAAA,IAAI,sBAAA,EAAwB;AAC1B,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,iEAAiE,aAAa,CAAA;AAAA,KAChF;AAEA,IAAA,MAAM,eAAeC,uBAAA,EAAO;AAE5B,IAAA,YAAA,CAAa,GAAA,CAAI,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAA,EAAK;AAAA,UAClD,KAAA,EAAO,CAAC,MAAA,EAAQ,SAAA,EAAW,MAAM,CAAA;AAAA,UACjC,kBAAA,EAAoB;AAAA,SACrB,CAAA;AAED,QAAA,IAAI,WAAA,CAAY,SAAA,CAAU,IAAA,KAAS,MAAA,EAAQ;AACzC,UAAA,IAAA,EAAK;AAAA,QACP,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,QAAQ,CAAA;AAAA,QACf;AAAA,MACF,CAAA,CAAA,MAAQ;AAIN,QAAA,MAAM,QAAA,CAAS,gBAAgB,GAAA,EAAK;AAAA,UAClC,WAAA,EAAa,MAAM,IAAA,CAAK,kBAAA;AAAmB,SAC5C,CAAA;AACD,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF,CAAC,CAAA;AAED,IAAA,YAAA,CAAa,IAAA;AAAA,MACX,GAAA;AAAA,MACAI,wBAAA,CAAQ,UAAA,CAAW,EAAE,QAAA,EAAU,MAAM,CAAA;AAAA,MACrC,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AACxB,QAAA,IAAI,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,SAAA,EAAW;AAC/B,UAAA,MAAM,cAAc,MAAM,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAA;AAE1D,UAAA,IAAI,CAAC,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC1C,YAAA,MAAM,IAAIC,2BAAoB,2BAA2B,CAAA;AAAA,UAC3D;AAEA,UAAA,MAAM,QAAA,CAAS,gBAAgB,GAAA,EAAK;AAAA,YAClC;AAAA,WACD,CAAA;AAGD,UAAA,GAAA,CAAI,MAAA,GAAS,KAAA;AACb,UAAA,IAAA,CAAK,QAAQ,CAAA;AAAA,QACf,CAAA,MAAO;AACL,UAAA,MAAM,IAAIC,iBAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAAA,MACF;AAAA,KACF;AAEA,IAAA,YAAA,CAAa,GAAA;AAAA,MACX,MAAM,sBAAA,CAAuB;AAAA,QAC3B,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,KAAA,EAAO,UAAU,CAAA;AAAA,QACxC,OAAA,EAAS,aAAA;AAAA,QACT,UAAA,EAAY,UAAA,EAAY,aAAA,CAAc,QAAQ,CAAA;AAAA,QAC9C;AAAA;AAAA,OACD;AAAA,KACH;AAEA,IAAA,MAAA,CAAO,IAAI,YAAY,CAAA;AAAA,EACzB;AAEA,EAAA,MAAA,CAAO,GAAA;AAAA,IACL,MAAM,sBAAA,CAAuB;AAAA,MAC3B,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,KAAA,EAAO,QAAQ,CAAA;AAAA,MACtC,OAAA,EAAS,UAAA;AAAA,MACT,UAAA;AAAA,MACA,qBAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,sBAAA,CAAuB;AAAA,EACpC,MAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF,CAAA,EAMG;AACD,EAAA,MAAM,SAAA,GAAYR,iBAAA,CAAY,OAAA,EAAS,QAAQ,CAAA;AAE/C,EAAA,MAAM,YAAA,GACJ,cACC,MAAMS,yBAAA,CAAa,EAAE,UAAA,EAAY,MAAA,EAAQ,OAAA,EAAS,SAAA,EAAW,CAAA;AAEhE,EAAA,MAAM,SAASP,uBAAA,EAAO;AAGtB,EAAA,MAAM,eAAeA,uBAAA,EAAO;AAC5B,EAAA,YAAA,CAAa,GAAA;AAAA,IACXI,wBAAA,CAAQ,OAAO,SAAA,EAAW;AAAA,MACxB,UAAA,EAAY,CAAC,GAAA,EAAK,IAAA,KAAS;AACzB,QAAA,IAAI,YAAA,EAAc,iBAAiB,IAAA,EAAM;AACvC,UAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBI,sCAA8B,CAAA;AAAA,QAC/D,CAAA,MAAO;AACL,UAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBC,+BAAuB,CAAA;AAAA,QACxD;AAAA,MACF;AAAA,KACD;AAAA,GACH;AAEA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,MAAA,GAAS,MAAMC,iCAAA,CAAiB,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,CAAW,YAAY,MAAM,CAAA;AAEnC,IAAA,MAAM,UAAA,CAAW,WAAW,EAAE,aAAA,EAAe,KAAK,EAAA,GAAK,EAAA,GAAK,GAAG,CAAA;AAE/D,IAAA,YAAA,CAAa,GAAA,CAAIC,uDAAA,CAA4B,UAAU,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,IAAI,qBAAA,EAAuB;AACzB,IAAA,YAAA,CAAa,IAAI,qBAAqB,CAAA;AAAA,EACxC;AACA,EAAA,YAAA,CAAa,GAAA,CAAI,CAAC,IAAA,EAAe,GAAA,KAAkB;AACjD,IAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,EACtB,CAAC,CAAA;AAED,EAAA,MAAA,CAAO,GAAA,CAAI,WAAW,YAAY,CAAA;AAElC,EAAA,MAAM,aAAaX,uBAAA,EAAO;AAC1B,EAAA,UAAA,CAAW,GAAA,CAAI,CAAC,GAAA,EAAK,IAAA,EAAM,IAAA,KAAS;AAElC,IAAA,IAAI,GAAA,CAAI,IAAA,KAAS,GAAA,IAAO,GAAA,CAAI,SAAS,aAAA,EAAe;AAClD,MAAA,IAAA,CAAK,QAAQ,CAAA;AAAA,IACf,CAAA,MAAO;AACL,MAAA,IAAA,EAAK;AAAA,IACP;AAAA,EACF,CAAC,CAAA;AACD,EAAA,UAAA,CAAW,GAAA;AAAA,IACTI,wBAAA,CAAQ,OAAO,OAAA,EAAS;AAAA,MACtB,UAAA,EAAY,CAAC,GAAA,EAAK,IAAA,KAAS;AAGzB,QAAA,IACGA,yBAAQ,MAAA,CAAO,IAAA,CAAyB,MAAA,CAAO,IAAI,MAAM,WAAA,EAC1D;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBQ,8BAAsB,CAAA;AAAA,QACvD;AAAA,MACF;AAAA,KACD;AAAA,GACH;AACA,EAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AAGrB,EAAA,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC9B,IAAA,IAAI,cAAc,gBAAA,EAAkB;AAClC,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,0BAA0B,CAAA;AACxD,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBA,8BAAsB,CAAA;AACrD,MAAA,GAAA,CAAI,IAAA,CAAK,aAAa,gBAAgB,CAAA;AAAA,IACxC,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,QAAA,CAASd,iBAAA,CAAY,OAAA,EAAS,YAAY,CAAA,EAAG;AAAA,QAC/C,OAAA,EAAS;AAAA;AAAA;AAAA,UAGP,eAAA,EAAiBc;AAAA;AACnB,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO,MAAA;AACT;;"}
+{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  resolvePackagePath,\n  resolveSafeChildPath,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport type { AppConfig } from '@backstage/config';\nimport helmet from 'helmet';\nimport express, { Request, Response } from 'express';\nimport Router from 'express-promise-router';\nimport fs from 'fs-extra';\nimport { resolve as resolvePath } from 'node:path';\nimport {\n  createStaticAssetMiddleware,\n  findStaticAssets,\n  StaticAssetsStore,\n} from '../lib/assets';\nimport {\n  CACHE_CONTROL_MAX_CACHE,\n  CACHE_CONTROL_NO_CACHE,\n  CACHE_CONTROL_REVALIDATE_CACHE,\n} from '../lib/headers';\nimport type { ConfigSchema } from '@backstage/config-loader';\nimport {\n  AuthService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError, InputError } from '@backstage/errors';\nimport { injectConfig, readFrontendConfig } from '../lib/config';\nimport { filterPublicConfig } from '../lib/config/filterPublicConfig';\n\n// express uses mime v1 while we only have types for mime v2\ntype Mime = { lookup(arg0: string): string };\n\n/**\n * @internal\n */\nexport interface RouterOptions {\n  config: RootConfigService;\n  logger: LoggerService;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n\n  /**\n   * If a database is provided it will be used to cache previously deployed static assets.\n   *\n   * This is a built-in alternative to using a `staticFallbackHandler`.\n   */\n  database: DatabaseService;\n\n  /**\n   * The name of the app package that content should be served from. The same app package should be\n   * added as a dependency to the backend package in order for it to be accessible at runtime.\n   *\n   * In a typical setup with a single app package this would be set to 'app'.\n   */\n  appPackageName: string;\n\n  /**\n   * A request handler to handle requests for static content that are not present in the app bundle.\n   *\n   * This can be used to avoid issues with clients on older deployment versions trying to access lazy\n   * loaded content that is no longer present. Typically the requests would fall back to a long-term\n   * object store where all recently deployed versions of the app are present.\n   *\n   * Another option is to provide a `database` that will take care of storing the static assets instead.\n   *\n   * If both `database` and `staticFallbackHandler` are provided, the `database` will attempt to serve\n   * static assets first, and if they are not found, the `staticFallbackHandler` will be called.\n   */\n  staticFallbackHandler?: express.Handler;\n\n  /**\n   *\n   * Provides a ConfigSchema.\n   *\n   */\n  schema?: ConfigSchema;\n}\n\n/**\n * @internal\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    config,\n    logger,\n    appPackageName,\n    staticFallbackHandler,\n    auth,\n    httpAuth,\n    schema,\n  } = options;\n\n  const disableConfigInjection = config.getOptionalBoolean(\n    'app.disableConfigInjection',\n  );\n  const disableStaticFallbackCache = config.getOptionalBoolean(\n    'app.disableStaticFallbackCache',\n  );\n\n  const appDistDir = resolvePackagePath(appPackageName, 'dist');\n  const staticDir = resolvePath(appDistDir, 'static');\n\n  if (!(await fs.pathExists(staticDir))) {\n    if (process.env.NODE_ENV === 'production') {\n      logger.error(\n        `Can't serve static app content from ${staticDir}, directory doesn't exist`,\n      );\n    }\n\n    return Router();\n  }\n\n  logger.info(`Serving static app content from ${appDistDir}`);\n\n  const appConfigs = disableConfigInjection\n    ? undefined\n    : await readFrontendConfig({\n        config,\n        appDistDir,\n        env: process.env,\n        schema,\n      });\n\n  const assetStore = !disableStaticFallbackCache\n    ? await StaticAssetsStore.create({\n        logger,\n        database: options.database,\n      })\n    : undefined;\n\n  const router = Router();\n\n  router.use(helmet.frameguard({ action: 'deny' }));\n\n  const publicDistDir = resolvePath(appDistDir, 'public');\n\n  const disablePublicEntryPoint = config.getOptionalBoolean(\n    'app.disablePublicEntryPoint',\n  );\n  const enablePublicEntryPoint =\n    !disablePublicEntryPoint && (await fs.pathExists(publicDistDir));\n\n  if (enablePublicEntryPoint) {\n    logger.info(\n      `App is running in protected mode, serving public content from ${publicDistDir}`,\n    );\n\n    const publicRouter = Router();\n\n    const getRequestCredentials = async (\n      req: express.Request,\n      res: express.Response,\n    ) => {\n      try {\n        return await httpAuth.credentials(req, {\n          allow: ['user', 'service', 'none'],\n          allowLimitedAccess: true,\n        });\n      } catch {\n        // If we fail to authenticate, make sure the session cookie is cleared\n        // and continue as unauthenticated. If the user is logged in they will\n        // immediately be redirected back to the protected app via the POST.\n        const credentials = await auth.getNoneCredentials();\n        await httpAuth.issueUserCookie(res, {\n          credentials,\n        });\n        return credentials;\n      }\n    };\n\n    // Handle sign-in before checking the existing session cookie so repeated\n    // handoffs remain idempotent for users that are already authenticated.\n    publicRouter.post(\n      '*',\n      express.urlencoded({ extended: true }),\n      async (req, res, next) => {\n        if (req.body.type === 'sign-in') {\n          const existingCredentials = await getRequestCredentials(req, res);\n\n          if (auth.isPrincipal(existingCredentials, 'service')) {\n            next('router');\n            return;\n          }\n\n          const credentials = await auth.authenticate(req.body.token);\n\n          if (!auth.isPrincipal(credentials, 'user')) {\n            throw new AuthenticationError('Invalid token, not a user');\n          }\n\n          if (\n            auth.isPrincipal(existingCredentials, 'user') &&\n            existingCredentials.principal.userEntityRef !==\n              credentials.principal.userEntityRef\n          ) {\n            throw new AuthenticationError(\n              'Refused to replace an existing authenticated session',\n            );\n          }\n\n          await httpAuth.issueUserCookie(res, {\n            credentials,\n          });\n\n          // Resume as if it was a GET request towards the outer protected router, serving index.html\n          req.method = 'GET';\n          next('router');\n        } else {\n          throw new InputError(\n            'Invalid POST request to app-backend wildcard endpoint',\n          );\n        }\n      },\n    );\n\n    publicRouter.use(async (req, res, next) => {\n      const credentials = await getRequestCredentials(req, res);\n\n      if (credentials.principal.type === 'none') {\n        next();\n      } else {\n        next('router');\n      }\n    });\n\n    publicRouter.use(\n      await createEntryPointRouter({\n        logger: logger.child({ entry: 'public' }),\n        rootDir: publicDistDir,\n        assetStore: assetStore?.withNamespace('public'),\n        appConfigs,\n        configFilter: configs => filterPublicConfig(configs, config),\n      }),\n    );\n\n    router.use(publicRouter);\n  }\n\n  router.use(\n    await createEntryPointRouter({\n      logger: logger.child({ entry: 'main' }),\n      rootDir: appDistDir,\n      assetStore,\n      staticFallbackHandler,\n      appConfigs,\n    }),\n  );\n\n  return router;\n}\n\nasync function createEntryPointRouter({\n  logger,\n  rootDir,\n  assetStore,\n  staticFallbackHandler,\n  appConfigs,\n  configFilter,\n}: {\n  logger: LoggerService;\n  rootDir: string;\n  assetStore?: StaticAssetsStore;\n  staticFallbackHandler?: express.Handler;\n  appConfigs?: AppConfig[];\n  configFilter?: (appConfigs: AppConfig[]) => AppConfig[];\n}) {\n  const staticDir = resolvePath(rootDir, 'static');\n\n  const injectResult =\n    appConfigs &&\n    (await injectConfig({\n      appConfigs,\n      logger,\n      rootDir,\n      staticDir,\n      configFilter,\n    }));\n\n  const router = Router();\n\n  // Use a separate router for static content so that a fallback can be provided by backend\n  const staticRouter = Router();\n  staticRouter.use(\n    express.static(staticDir, {\n      setHeaders: (res, path) => {\n        if (injectResult?.injectedPath === path) {\n          res.setHeader('Cache-Control', CACHE_CONTROL_REVALIDATE_CACHE);\n        } else {\n          res.setHeader('Cache-Control', CACHE_CONTROL_MAX_CACHE);\n        }\n      },\n    }),\n  );\n\n  if (assetStore) {\n    const assets = await findStaticAssets(staticDir);\n    await assetStore.storeAssets(assets);\n    // Remove any assets that are older than 7 days\n    await assetStore.trimAssets({ maxAgeSeconds: 60 * 60 * 24 * 7 });\n\n    staticRouter.use(createStaticAssetMiddleware(assetStore));\n  }\n\n  if (staticFallbackHandler) {\n    staticRouter.use(staticFallbackHandler);\n  }\n  staticRouter.use((_req: Request, res: Response) => {\n    res.status(404).end();\n  });\n\n  router.use('/static', staticRouter);\n\n  const rootRouter = Router();\n  rootRouter.use(async (req, _res, next) => {\n    // Make sure / and /index.html are handled by the HTML5 route below.\n    let isIndex = req.path === '/' || req.path === '/index.html';\n    if (injectResult?.indexHtmlContent && !isIndex) {\n      try {\n        const path = resolveSafeChildPath(\n          rootDir,\n          `.${decodeURIComponent(req.path).replaceAll('\\\\', '/')}`,\n        );\n        const [file, index] = await Promise.all([\n          fs.stat(path),\n          fs.stat(resolvePath(rootDir, 'index.html')),\n        ]);\n        const candidate = file.isDirectory()\n          ? await fs.stat(resolvePath(path, 'index.html'))\n          : file;\n        // Every alias of the built index must use the injected HTML as well.\n        isIndex = candidate.dev === index.dev && candidate.ino === index.ino;\n      } catch {\n        // Let express.static handle missing files, invalid paths, and malformed URL encoding.\n      }\n    }\n    if (isIndex) {\n      next('router');\n    } else {\n      next();\n    }\n  });\n  rootRouter.use(\n    express.static(rootDir, {\n      setHeaders: (res, path) => {\n        // The Cache-Control header instructs the browser to not cache html files since it might\n        // link to static assets from recently deployed versions.\n        if (\n          (express.static.mime as unknown as Mime).lookup(path) === 'text/html'\n        ) {\n          res.setHeader('Cache-Control', CACHE_CONTROL_NO_CACHE);\n        }\n      },\n    }),\n  );\n  router.use(rootRouter);\n\n  // HTML5 routing\n  router.get('/*', (_req, res) => {\n    if (injectResult?.indexHtmlContent) {\n      res.setHeader('Content-Type', 'text/html; charset=utf-8');\n      res.setHeader('Cache-Control', CACHE_CONTROL_NO_CACHE);\n      res.send(injectResult.indexHtmlContent);\n    } else {\n      res.sendFile(resolvePath(rootDir, 'index.html'), {\n        headers: {\n          // The Cache-Control header instructs the browser to not cache the index.html since it might\n          // link to static assets from recently deployed versions.\n          'cache-control': CACHE_CONTROL_NO_CACHE,\n        },\n      });\n    }\n  });\n\n  return router;\n}\n"],"names":["resolvePackagePath","resolvePath","fs","Router","readFrontendConfig","StaticAssetsStore","helmet","express","AuthenticationError","InputError","filterPublicConfig","injectConfig","CACHE_CONTROL_REVALIDATE_CACHE","CACHE_CONTROL_MAX_CACHE","findStaticAssets","createStaticAssetMiddleware","resolveSafeChildPath","CACHE_CONTROL_NO_CACHE"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoGA,eAAsB,aACpB,OAAA,EACyB;AACzB,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,cAAA;AAAA,IACA,qBAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,yBAAyB,MAAA,CAAO,kBAAA;AAAA,IACpC;AAAA,GACF;AACA,EAAA,MAAM,6BAA6B,MAAA,CAAO,kBAAA;AAAA,IACxC;AAAA,GACF;AAEA,EAAA,MAAM,UAAA,GAAaA,mCAAA,CAAmB,cAAA,EAAgB,MAAM,CAAA;AAC5D,EAAA,MAAM,SAAA,GAAYC,iBAAA,CAAY,UAAA,EAAY,QAAQ,CAAA;AAElD,EAAA,IAAI,CAAE,MAAMC,mBAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAI;AACrC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,MAAA,MAAA,CAAO,KAAA;AAAA,QACL,uCAAuC,SAAS,CAAA,yBAAA;AAAA,OAClD;AAAA,IACF;AAEA,IAAA,OAAOC,uBAAA,EAAO;AAAA,EAChB;AAEA,EAAA,MAAA,CAAO,IAAA,CAAK,CAAA,gCAAA,EAAmC,UAAU,CAAA,CAAE,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa,sBAAA,GACf,MAAA,GACA,MAAMC,qCAAA,CAAmB;AAAA,IACvB,MAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb;AAAA,GACD,CAAA;AAEL,EAAA,MAAM,UAAA,GAAa,CAAC,0BAAA,GAChB,MAAMC,oCAAkB,MAAA,CAAO;AAAA,IAC7B,MAAA;AAAA,IACA,UAAU,OAAA,CAAQ;AAAA,GACnB,CAAA,GACD,MAAA;AAEJ,EAAA,MAAM,SAASF,uBAAA,EAAO;AAEtB,EAAA,MAAA,CAAO,IAAIG,uBAAA,CAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,MAAA,EAAQ,CAAC,CAAA;AAEhD,EAAA,MAAM,aAAA,GAAgBL,iBAAA,CAAY,UAAA,EAAY,QAAQ,CAAA;AAEtD,EAAA,MAAM,0BAA0B,MAAA,CAAO,kBAAA;AAAA,IACrC;AAAA,GACF;AACA,EAAA,MAAM,yBACJ,CAAC,uBAAA,IAA4B,MAAMC,mBAAA,CAAG,WAAW,aAAa,CAAA;AAEhE,EAAA,IAAI,sBAAA,EAAwB;AAC1B,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,iEAAiE,aAAa,CAAA;AAAA,KAChF;AAEA,IAAA,MAAM,eAAeC,uBAAA,EAAO;AAE5B,IAAA,MAAM,qBAAA,GAAwB,OAC5B,GAAA,EACA,GAAA,KACG;AACH,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,QAAA,CAAS,WAAA,CAAY,GAAA,EAAK;AAAA,UACrC,KAAA,EAAO,CAAC,MAAA,EAAQ,SAAA,EAAW,MAAM,CAAA;AAAA,UACjC,kBAAA,EAAoB;AAAA,SACrB,CAAA;AAAA,MACH,CAAA,CAAA,MAAQ;AAIN,QAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,kBAAA,EAAmB;AAClD,QAAA,MAAM,QAAA,CAAS,gBAAgB,GAAA,EAAK;AAAA,UAClC;AAAA,SACD,CAAA;AACD,QAAA,OAAO,WAAA;AAAA,MACT;AAAA,IACF,CAAA;AAIA,IAAA,YAAA,CAAa,IAAA;AAAA,MACX,GAAA;AAAA,MACAI,wBAAA,CAAQ,UAAA,CAAW,EAAE,QAAA,EAAU,MAAM,CAAA;AAAA,MACrC,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AACxB,QAAA,IAAI,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,SAAA,EAAW;AAC/B,UAAA,MAAM,mBAAA,GAAsB,MAAM,qBAAA,CAAsB,GAAA,EAAK,GAAG,CAAA;AAEhE,UAAA,IAAI,IAAA,CAAK,WAAA,CAAY,mBAAA,EAAqB,SAAS,CAAA,EAAG;AACpD,YAAA,IAAA,CAAK,QAAQ,CAAA;AACb,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,cAAc,MAAM,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAA;AAE1D,UAAA,IAAI,CAAC,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC1C,YAAA,MAAM,IAAIC,2BAAoB,2BAA2B,CAAA;AAAA,UAC3D;AAEA,UAAA,IACE,IAAA,CAAK,WAAA,CAAY,mBAAA,EAAqB,MAAM,CAAA,IAC5C,oBAAoB,SAAA,CAAU,aAAA,KAC5B,WAAA,CAAY,SAAA,CAAU,aAAA,EACxB;AACA,YAAA,MAAM,IAAIA,0BAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AAEA,UAAA,MAAM,QAAA,CAAS,gBAAgB,GAAA,EAAK;AAAA,YAClC;AAAA,WACD,CAAA;AAGD,UAAA,GAAA,CAAI,MAAA,GAAS,KAAA;AACb,UAAA,IAAA,CAAK,QAAQ,CAAA;AAAA,QACf,CAAA,MAAO;AACL,UAAA,MAAM,IAAIC,iBAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAAA,MACF;AAAA,KACF;AAEA,IAAA,YAAA,CAAa,GAAA,CAAI,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AACzC,MAAA,MAAM,WAAA,GAAc,MAAM,qBAAA,CAAsB,GAAA,EAAK,GAAG,CAAA;AAExD,MAAA,IAAI,WAAA,CAAY,SAAA,CAAU,IAAA,KAAS,MAAA,EAAQ;AACzC,QAAA,IAAA,EAAK;AAAA,MACP,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,QAAQ,CAAA;AAAA,MACf;AAAA,IACF,CAAC,CAAA;AAED,IAAA,YAAA,CAAa,GAAA;AAAA,MACX,MAAM,sBAAA,CAAuB;AAAA,QAC3B,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,KAAA,EAAO,UAAU,CAAA;AAAA,QACxC,OAAA,EAAS,aAAA;AAAA,QACT,UAAA,EAAY,UAAA,EAAY,aAAA,CAAc,QAAQ,CAAA;AAAA,QAC9C,UAAA;AAAA,QACA,YAAA,EAAc,CAAA,OAAA,KAAWC,qCAAA,CAAmB,OAAA,EAAS,MAAM;AAAA,OAC5D;AAAA,KACH;AAEA,IAAA,MAAA,CAAO,IAAI,YAAY,CAAA;AAAA,EACzB;AAEA,EAAA,MAAA,CAAO,GAAA;AAAA,IACL,MAAM,sBAAA,CAAuB;AAAA,MAC3B,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,KAAA,EAAO,QAAQ,CAAA;AAAA,MACtC,OAAA,EAAS,UAAA;AAAA,MACT,UAAA;AAAA,MACA,qBAAA;AAAA,MACA;AAAA,KACD;AAAA,GACH;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,sBAAA,CAAuB;AAAA,EACpC,MAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,qBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,EAOG;AACD,EAAA,MAAM,SAAA,GAAYT,iBAAA,CAAY,OAAA,EAAS,QAAQ,CAAA;AAE/C,EAAA,MAAM,YAAA,GACJ,UAAA,IACC,MAAMU,yBAAA,CAAa;AAAA,IAClB,UAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACD,CAAA;AAEH,EAAA,MAAM,SAASR,uBAAA,EAAO;AAGtB,EAAA,MAAM,eAAeA,uBAAA,EAAO;AAC5B,EAAA,YAAA,CAAa,GAAA;AAAA,IACXI,wBAAA,CAAQ,OAAO,SAAA,EAAW;AAAA,MACxB,UAAA,EAAY,CAAC,GAAA,EAAK,IAAA,KAAS;AACzB,QAAA,IAAI,YAAA,EAAc,iBAAiB,IAAA,EAAM;AACvC,UAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBK,sCAA8B,CAAA;AAAA,QAC/D,CAAA,MAAO;AACL,UAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBC,+BAAuB,CAAA;AAAA,QACxD;AAAA,MACF;AAAA,KACD;AAAA,GACH;AAEA,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,MAAA,GAAS,MAAMC,iCAAA,CAAiB,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,CAAW,YAAY,MAAM,CAAA;AAEnC,IAAA,MAAM,UAAA,CAAW,WAAW,EAAE,aAAA,EAAe,KAAK,EAAA,GAAK,EAAA,GAAK,GAAG,CAAA;AAE/D,IAAA,YAAA,CAAa,GAAA,CAAIC,uDAAA,CAA4B,UAAU,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,IAAI,qBAAA,EAAuB;AACzB,IAAA,YAAA,CAAa,IAAI,qBAAqB,CAAA;AAAA,EACxC;AACA,EAAA,YAAA,CAAa,GAAA,CAAI,CAAC,IAAA,EAAe,GAAA,KAAkB;AACjD,IAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,EACtB,CAAC,CAAA;AAED,EAAA,MAAA,CAAO,GAAA,CAAI,WAAW,YAAY,CAAA;AAElC,EAAA,MAAM,aAAaZ,uBAAA,EAAO;AAC1B,EAAA,UAAA,CAAW,GAAA,CAAI,OAAO,GAAA,EAAK,IAAA,EAAM,IAAA,KAAS;AAExC,IAAA,IAAI,OAAA,GAAU,GAAA,CAAI,IAAA,KAAS,GAAA,IAAO,IAAI,IAAA,KAAS,aAAA;AAC/C,IAAA,IAAI,YAAA,EAAc,gBAAA,IAAoB,CAAC,OAAA,EAAS;AAC9C,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAOa,qCAAA;AAAA,UACX,OAAA;AAAA,UACA,CAAA,CAAA,EAAI,mBAAmB,GAAA,CAAI,IAAI,EAAE,UAAA,CAAW,IAAA,EAAM,GAAG,CAAC,CAAA;AAAA,SACxD;AACA,QAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,UACtCd,mBAAA,CAAG,KAAK,IAAI,CAAA;AAAA,UACZA,mBAAA,CAAG,IAAA,CAAKD,iBAAA,CAAY,OAAA,EAAS,YAAY,CAAC;AAAA,SAC3C,CAAA;AACD,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,EAAY,GAC/B,MAAMC,mBAAA,CAAG,IAAA,CAAKD,iBAAA,CAAY,IAAA,EAAM,YAAY,CAAC,CAAA,GAC7C,IAAA;AAEJ,QAAA,OAAA,GAAU,UAAU,GAAA,KAAQ,KAAA,CAAM,GAAA,IAAO,SAAA,CAAU,QAAQ,KAAA,CAAM,GAAA;AAAA,MACnE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAA,CAAK,QAAQ,CAAA;AAAA,IACf,CAAA,MAAO;AACL,MAAA,IAAA,EAAK;AAAA,IACP;AAAA,EACF,CAAC,CAAA;AACD,EAAA,UAAA,CAAW,GAAA;AAAA,IACTM,wBAAA,CAAQ,OAAO,OAAA,EAAS;AAAA,MACtB,UAAA,EAAY,CAAC,GAAA,EAAK,IAAA,KAAS;AAGzB,QAAA,IACGA,yBAAQ,MAAA,CAAO,IAAA,CAAyB,MAAA,CAAO,IAAI,MAAM,WAAA,EAC1D;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBU,8BAAsB,CAAA;AAAA,QACvD;AAAA,MACF;AAAA,KACD;AAAA,GACH;AACA,EAAA,MAAA,CAAO,IAAI,UAAU,CAAA;AAGrB,EAAA,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC9B,IAAA,IAAI,cAAc,gBAAA,EAAkB;AAClC,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,0BAA0B,CAAA;AACxD,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiBA,8BAAsB,CAAA;AACrD,MAAA,GAAA,CAAI,IAAA,CAAK,aAAa,gBAAgB,CAAA;AAAA,IACxC,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,QAAA,CAAShB,iBAAA,CAAY,OAAA,EAAS,YAAY,CAAA,EAAG;AAAA,QAC/C,OAAA,EAAS;AAAA;AAAA;AAAA,UAGP,eAAA,EAAiBgB;AAAA;AACnB,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO,MAAA;AACT;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-app-backend",
-  "version": "0.5.19-next.1",
+  "version": "0.5.19",
   "description": "A Backstage backend plugin that serves the Backstage frontend app",
   "backstage": {
     "role": "backend-plugin",
@@ -62,13 +62,13 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.11.0-next.1",
-    "@backstage/config": "1.3.10-next.0",
-    "@backstage/config-loader": "1.11.4-next.0",
-    "@backstage/errors": "1.3.2-next.0",
-    "@backstage/plugin-app-node": "0.1.50-next.1",
-    "@backstage/plugin-auth-node": "0.7.7-next.1",
-    "@backstage/types": "1.2.2",
+    "@backstage/backend-plugin-api": "^1.11.0",
+    "@backstage/config": "^1.3.10",
+    "@backstage/config-loader": "^1.11.4",
+    "@backstage/errors": "^1.3.2",
+    "@backstage/plugin-app-node": "^0.1.50",
+    "@backstage/plugin-auth-node": "^0.7.7",
+    "@backstage/types": "^1.2.2",
     "express": "^4.22.0",
     "express-promise-router": "^4.1.0",
     "fs-extra": "^11.2.0",
@@ -79,10 +79,10 @@
     "luxon": "^3.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-app-api": "1.8.0-next.1",
-    "@backstage/backend-defaults": "0.18.1-next.1",
-    "@backstage/backend-test-utils": "1.11.8-next.1",
-    "@backstage/cli": "0.36.7-next.0",
+    "@backstage/backend-app-api": "^1.8.0",
+    "@backstage/backend-defaults": "^0.18.1",
+    "@backstage/backend-test-utils": "^1.11.8",
+    "@backstage/cli": "^0.36.7",
     "@types/express": "^4.17.6",
     "@types/supertest": "^2.0.8",
     "supertest": "^7.0.0"