@backstage/plugin-auth-backend-module-auth0-provider 0.4.2 → 0.4.3-next.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @backstage/plugin-auth-backend-module-auth0-provider
 
+## 0.4.3-next.1
+
+### Patch Changes
+
+- 5446838: Added an optional `prompt` setting for Auth0 authorization requests. Set it to
+  `auto` to let Auth0 determine whether the user needs to be prompted. Existing
+  configurations continue to use `consent` by default.
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.9.3-next.1
+
+## 0.4.3-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.7.3-next.0
+  - @backstage/backend-plugin-api@1.9.3-next.0
+
 ## 0.4.2
 
 ### Patch Changes

package/config.schema.json

@@ -0,0 +1,100 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "auth": {
+      "type": "object",
+      "properties": {
+        "providers": {
+          "type": "object",
+          "properties": {
+            "auth0": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "object",
+                "properties": {
+                  "clientId": {
+                    "type": "string"
+                  },
+                  "clientSecret": {
+                    "type": "string",
+                    "visibility": "secret"
+                  },
+                  "domain": {
+                    "type": "string"
+                  },
+                  "callbackUrl": {
+                    "type": "string"
+                  },
+                  "audience": {
+                    "type": "string"
+                  },
+                  "connection": {
+                    "type": "string"
+                  },
+                  "connectionScope": {
+                    "type": "string"
+                  },
+                  "prompt": {
+                    "type": "string",
+                    "description": "Controls the prompt sent to Auth0. Set to `auto` to omit the parameter and let Auth0 determine whether to prompt the user. Defaults to `consent`."
+                  },
+                  "organization": {
+                    "type": "string"
+                  },
+                  "federatedLogout": {
+                    "type": "boolean",
+                    "description": "Whether to perform federated logout, clearing both the Auth0 session and any upstream IdP session. Defaults to false."
+                  },
+                  "sessionDuration": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "years": {
+                            "type": "number"
+                          },
+                          "months": {
+                            "type": "number"
+                          },
+                          "weeks": {
+                            "type": "number"
+                          },
+                          "days": {
+                            "type": "number"
+                          },
+                          "hours": {
+                            "type": "number"
+                          },
+                          "minutes": {
+                            "type": "number"
+                          },
+                          "seconds": {
+                            "type": "number"
+                          },
+                          "milliseconds": {
+                            "type": "number"
+                          }
+                        },
+                        "description": "Human friendly durations object."
+                      },
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  }
+                },
+                "required": [
+                  "clientId",
+                  "clientSecret",
+                  "domain"
+                ]
+              },
+              "visibility": "frontend"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/authenticator.cjs.js

@@ -17,6 +17,7 @@ function createAuth0Authenticator(options) {
       const audience = config.getOptionalString("audience");
       const connection = config.getOptionalString("connection");
       const connectionScope = config.getOptionalString("connectionScope");
+      const prompt = config.getOptionalString("prompt") ?? "consent";
       const callbackURL = config.getOptionalString("callbackUrl") ?? callbackUrl;
       const organization = config.getOptionalString("organization");
       const store = {
@@ -61,15 +62,22 @@ function createAuth0Authenticator(options) {
         audience,
         connection,
         connectionScope,
+        prompt,
         domain,
         clientID,
         federated
       };
     },
-    async start(input, { helper, audience, connection, connectionScope: connection_scope }) {
+    async start(input, {
+      helper,
+      audience,
+      connection,
+      connectionScope: connection_scope,
+      prompt
+    }) {
       return helper.start(input, {
         accessType: "offline",
-        prompt: "consent",
+        ...prompt !== "auto" ? { prompt } : {},
         ...audience ? { audience } : {},
         ...connection ? { connection } : {},
         ...connection_scope ? { connection_scope } : {}

package/dist/authenticator.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { CacheService } from '@backstage/backend-plugin-api';\nimport express from 'express';\nimport { decodeJwt } from 'jose';\nimport { Strategy } from 'passport';\nimport {\n  createOAuthAuthenticator,\n  PassportHelpers,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { Auth0Strategy } from './strategy';\n\n/** @public */\nexport function createAuth0Authenticator(options?: { cache?: CacheService }) {\n  const profileCache = options?.cache?.withOptions({\n    defaultTtl: { minutes: 1 },\n  });\n\n  return createOAuthAuthenticator({\n    defaultProfileTransform:\n      PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n    initialize({ callbackUrl, config }) {\n      const clientID = config.getString('clientId');\n      const clientSecret = config.getString('clientSecret');\n      const domain = config.getString('domain');\n      const audience = config.getOptionalString('audience');\n      const connection = config.getOptionalString('connection');\n      const connectionScope = config.getOptionalString('connectionScope');\n      const callbackURL =\n        config.getOptionalString('callbackUrl') ?? callbackUrl;\n      const organization = config.getOptionalString('organization');\n      // Due to passport-auth0 forcing options.state = true,\n      // passport-oauth2 requires express-session to be installed\n      // so that the 'state' parameter of the oauth2 flow can be stored.\n      // This implementation of StateStore matches the NullStore found within\n      // passport-oauth2, which is the StateStore implementation used when options.state = false,\n      // allowing us to avoid using express-session in order to integrate with auth0.\n      const store = {\n        store(_req: express.Request, cb: any) {\n          cb(null, null);\n        },\n        verify(_req: express.Request, _state: string, cb: any) {\n          cb(null, true);\n        },\n      };\n\n      const strategy = new Auth0Strategy(\n        {\n          clientID,\n          clientSecret,\n          callbackURL,\n          domain,\n          store,\n          organization,\n          // We need passReqToCallback set to false to get params, but there's\n          // no matching type signature for that, so instead behold this beauty\n          passReqToCallback: false as true,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            {\n              fullProfile,\n              accessToken,\n              params,\n            },\n            {\n              refreshToken,\n            },\n          );\n        },\n      );\n\n      const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n      const federated = config.getOptionalBoolean('federatedLogout') ?? false;\n      return {\n        helper,\n        strategy: strategy as Strategy,\n        audience,\n        connection,\n        connectionScope,\n        domain,\n        clientID,\n        federated,\n      };\n    },\n\n    async start(\n      input,\n      { helper, audience, connection, connectionScope: connection_scope },\n    ) {\n      return helper.start(input, {\n        accessType: 'offline',\n        prompt: 'consent',\n        ...(audience ? { audience } : {}),\n        ...(connection ? { connection } : {}),\n        ...(connection_scope ? { connection_scope } : {}),\n      });\n    },\n\n    async authenticate(\n      input,\n      { helper, audience, connection, connectionScope: connection_scope },\n    ) {\n      return helper.authenticate(input, {\n        ...(audience ? { audience } : {}),\n        ...(connection ? { connection } : {}),\n        ...(connection_scope ? { connection_scope } : {}),\n      });\n    },\n\n    async refresh(input, { helper, strategy }) {\n      const result = await PassportHelpers.executeRefreshTokenStrategy(\n        strategy,\n        input.refreshToken,\n        input.scope,\n      );\n\n      const { sub } = decodeJwt(result.params.id_token);\n      const cacheKey = sub ? `auth0-profile:${sub}` : undefined;\n\n      let fullProfile = cacheKey\n        ? ((await profileCache?.get(cacheKey)) as PassportProfile | undefined)\n        : undefined;\n\n      if (!fullProfile) {\n        fullProfile = await helper.fetchProfile(result.accessToken);\n        if (cacheKey) {\n          await profileCache?.set(\n            cacheKey,\n            JSON.parse(JSON.stringify(fullProfile)),\n          );\n        }\n      }\n\n      return {\n        fullProfile,\n        session: {\n          accessToken: result.accessToken,\n          tokenType: result.params.token_type ?? 'bearer',\n          scope: result.params.scope,\n          expiresInSeconds: result.params.expires_in,\n          idToken: result.params.id_token,\n          refreshToken: result.refreshToken,\n        },\n      };\n    },\n\n    async logout(input, { domain, clientID, federated }) {\n      const logoutUrl = new URL(`https://${domain}/v2/logout`);\n      if (federated) {\n        logoutUrl.searchParams.set('federated', '');\n      }\n      logoutUrl.searchParams.set('client_id', clientID);\n      const origin = input.req.get('origin');\n      if (origin) {\n        logoutUrl.searchParams.set('returnTo', origin);\n      }\n      return { logoutUrl: logoutUrl.toString() };\n    },\n  });\n}\n\n/** @public */\nexport const auth0Authenticator = createAuth0Authenticator();\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","strategy","Auth0Strategy","PassportHelpers","decodeJwt"],"mappings":";;;;;;AA8BO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,KAAA,EAAO,WAAA,CAAY;AAAA,IAC/C,UAAA,EAAY,EAAE,OAAA,EAAS,CAAA;AAAE,GAC1B,CAAA;AAED,EAAA,OAAOA,uCAAA,CAAyB;AAAA,IAC9B,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,IACnC,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,MAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACxC,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,iBAAA,CAAkB,UAAU,CAAA;AACpD,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,iBAAA,CAAkB,YAAY,CAAA;AACxD,MAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,iBAAA,CAAkB,iBAAiB,CAAA;AAClE,MAAA,MAAM,WAAA,GACJ,MAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA,IAAK,WAAA;AAC7C,MAAA,MAAM,YAAA,GAAe,MAAA,CAAO,iBAAA,CAAkB,cAAc,CAAA;AAO5D,MAAA,MAAM,KAAA,GAAQ;AAAA,QACZ,KAAA,CAAM,MAAuB,EAAA,EAAS;AACpC,UAAA,EAAA,CAAG,MAAM,IAAI,CAAA;AAAA,QACf,CAAA;AAAA,QACA,MAAA,CAAO,IAAA,EAAuB,MAAA,EAAgB,EAAA,EAAS;AACrD,UAAA,EAAA,CAAG,MAAM,IAAI,CAAA;AAAA,QACf;AAAA,OACF;AAEA,MAAA,MAAMC,aAAW,IAAIC,sBAAA;AAAA,QACnB;AAAA,UACE,QAAA;AAAA,UACA,YAAA;AAAA,UACA,WAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,YAAA;AAAA;AAAA;AAAA,UAGA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA;AAAA,cACE,WAAA;AAAA,cACA,WAAA;AAAA,cACA;AAAA,aACF;AAAA,YACA;AAAA,cACE;AAAA;AACF,WACF;AAAA,QACF;AAAA,OACF;AAEA,MAAA,MAAM,MAAA,GAASF,+CAAA,CAAiC,IAAA,CAAKC,UAAQ,CAAA;AAC7D,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,kBAAA,CAAmB,iBAAiB,CAAA,IAAK,KAAA;AAClE,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,kBACAA,UAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA,QACA,eAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MACJ,KAAA,EACA,EAAE,QAAQ,QAAA,EAAU,UAAA,EAAY,eAAA,EAAiB,gBAAA,EAAiB,EAClE;AACA,MAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,QACzB,UAAA,EAAY,SAAA;AAAA,QACZ,MAAA,EAAQ,SAAA;AAAA,QACR,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,QAC/B,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,QACnC,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB;AAAC,OAChD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,aACJ,KAAA,EACA,EAAE,QAAQ,QAAA,EAAU,UAAA,EAAY,eAAA,EAAiB,gBAAA,EAAiB,EAClE;AACA,MAAA,OAAO,MAAA,CAAO,aAAa,KAAA,EAAO;AAAA,QAChC,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,QAC/B,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,QACnC,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB;AAAC,OAChD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,MAAA,EAAQ,UAAS,EAAG;AACzC,MAAA,MAAM,MAAA,GAAS,MAAME,8BAAA,CAAgB,2BAAA;AAAA,QACnC,QAAA;AAAA,QACA,KAAA,CAAM,YAAA;AAAA,QACN,KAAA,CAAM;AAAA,OACR;AAEA,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,cAAA,CAAU,MAAA,CAAO,OAAO,QAAQ,CAAA;AAChD,MAAA,MAAM,QAAA,GAAW,GAAA,GAAM,CAAA,cAAA,EAAiB,GAAG,CAAA,CAAA,GAAK,MAAA;AAEhD,MAAA,IAAI,cAAc,QAAA,GACZ,MAAM,YAAA,EAAc,GAAA,CAAI,QAAQ,CAAA,GAClC,MAAA;AAEJ,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,WAAA,GAAc,MAAM,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,WAAW,CAAA;AAC1D,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,MAAM,YAAA,EAAc,GAAA;AAAA,YAClB,QAAA;AAAA,YACA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC;AAAA,WACxC;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,SAAA,EAAW,MAAA,CAAO,MAAA,CAAO,UAAA,IAAc,QAAA;AAAA,UACvC,KAAA,EAAO,OAAO,MAAA,CAAO,KAAA;AAAA,UACrB,gBAAA,EAAkB,OAAO,MAAA,CAAO,UAAA;AAAA,UAChC,OAAA,EAAS,OAAO,MAAA,CAAO,QAAA;AAAA,UACvB,cAAc,MAAA,CAAO;AAAA;AACvB,OACF;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,WAAU,EAAG;AACnD,MAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,CAAA,QAAA,EAAW,MAAM,CAAA,UAAA,CAAY,CAAA;AACvD,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAAA,MAC5C;AACA,MAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AAChD,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AACrC,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,MAAM,CAAA;AAAA,MAC/C;AACA,MAAA,OAAO,EAAE,SAAA,EAAW,SAAA,CAAU,QAAA,EAAS,EAAE;AAAA,IAC3C;AAAA,GACD,CAAA;AACH;AAGO,MAAM,qBAAqB,wBAAA;;;;;"}
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { CacheService } from '@backstage/backend-plugin-api';\nimport express from 'express';\nimport { decodeJwt } from 'jose';\nimport { Strategy } from 'passport';\nimport {\n  createOAuthAuthenticator,\n  PassportHelpers,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { Auth0Strategy } from './strategy';\n\n/** @public */\nexport function createAuth0Authenticator(options?: { cache?: CacheService }) {\n  const profileCache = options?.cache?.withOptions({\n    defaultTtl: { minutes: 1 },\n  });\n\n  return createOAuthAuthenticator({\n    defaultProfileTransform:\n      PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n    initialize({ callbackUrl, config }) {\n      const clientID = config.getString('clientId');\n      const clientSecret = config.getString('clientSecret');\n      const domain = config.getString('domain');\n      const audience = config.getOptionalString('audience');\n      const connection = config.getOptionalString('connection');\n      const connectionScope = config.getOptionalString('connectionScope');\n      const prompt = config.getOptionalString('prompt') ?? 'consent';\n      const callbackURL =\n        config.getOptionalString('callbackUrl') ?? callbackUrl;\n      const organization = config.getOptionalString('organization');\n      // Due to passport-auth0 forcing options.state = true,\n      // passport-oauth2 requires express-session to be installed\n      // so that the 'state' parameter of the oauth2 flow can be stored.\n      // This implementation of StateStore matches the NullStore found within\n      // passport-oauth2, which is the StateStore implementation used when options.state = false,\n      // allowing us to avoid using express-session in order to integrate with auth0.\n      const store = {\n        store(_req: express.Request, cb: any) {\n          cb(null, null);\n        },\n        verify(_req: express.Request, _state: string, cb: any) {\n          cb(null, true);\n        },\n      };\n\n      const strategy = new Auth0Strategy(\n        {\n          clientID,\n          clientSecret,\n          callbackURL,\n          domain,\n          store,\n          organization,\n          // We need passReqToCallback set to false to get params, but there's\n          // no matching type signature for that, so instead behold this beauty\n          passReqToCallback: false as true,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            {\n              fullProfile,\n              accessToken,\n              params,\n            },\n            {\n              refreshToken,\n            },\n          );\n        },\n      );\n\n      const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n      const federated = config.getOptionalBoolean('federatedLogout') ?? false;\n      return {\n        helper,\n        strategy: strategy as Strategy,\n        audience,\n        connection,\n        connectionScope,\n        prompt,\n        domain,\n        clientID,\n        federated,\n      };\n    },\n\n    async start(\n      input,\n      {\n        helper,\n        audience,\n        connection,\n        connectionScope: connection_scope,\n        prompt,\n      },\n    ) {\n      return helper.start(input, {\n        accessType: 'offline',\n        ...(prompt !== 'auto' ? { prompt } : {}),\n        ...(audience ? { audience } : {}),\n        ...(connection ? { connection } : {}),\n        ...(connection_scope ? { connection_scope } : {}),\n      });\n    },\n\n    async authenticate(\n      input,\n      { helper, audience, connection, connectionScope: connection_scope },\n    ) {\n      return helper.authenticate(input, {\n        ...(audience ? { audience } : {}),\n        ...(connection ? { connection } : {}),\n        ...(connection_scope ? { connection_scope } : {}),\n      });\n    },\n\n    async refresh(input, { helper, strategy }) {\n      const result = await PassportHelpers.executeRefreshTokenStrategy(\n        strategy,\n        input.refreshToken,\n        input.scope,\n      );\n\n      const { sub } = decodeJwt(result.params.id_token);\n      const cacheKey = sub ? `auth0-profile:${sub}` : undefined;\n\n      let fullProfile = cacheKey\n        ? ((await profileCache?.get(cacheKey)) as PassportProfile | undefined)\n        : undefined;\n\n      if (!fullProfile) {\n        fullProfile = await helper.fetchProfile(result.accessToken);\n        if (cacheKey) {\n          await profileCache?.set(\n            cacheKey,\n            JSON.parse(JSON.stringify(fullProfile)),\n          );\n        }\n      }\n\n      return {\n        fullProfile,\n        session: {\n          accessToken: result.accessToken,\n          tokenType: result.params.token_type ?? 'bearer',\n          scope: result.params.scope,\n          expiresInSeconds: result.params.expires_in,\n          idToken: result.params.id_token,\n          refreshToken: result.refreshToken,\n        },\n      };\n    },\n\n    async logout(input, { domain, clientID, federated }) {\n      const logoutUrl = new URL(`https://${domain}/v2/logout`);\n      if (federated) {\n        logoutUrl.searchParams.set('federated', '');\n      }\n      logoutUrl.searchParams.set('client_id', clientID);\n      const origin = input.req.get('origin');\n      if (origin) {\n        logoutUrl.searchParams.set('returnTo', origin);\n      }\n      return { logoutUrl: logoutUrl.toString() };\n    },\n  });\n}\n\n/** @public */\nexport const auth0Authenticator = createAuth0Authenticator();\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","strategy","Auth0Strategy","PassportHelpers","decodeJwt"],"mappings":";;;;;;AA8BO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,YAAA,GAAe,OAAA,EAAS,KAAA,EAAO,WAAA,CAAY;AAAA,IAC/C,UAAA,EAAY,EAAE,OAAA,EAAS,CAAA;AAAE,GAC1B,CAAA;AAED,EAAA,OAAOA,uCAAA,CAAyB;AAAA,IAC9B,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,IACnC,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,MAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACxC,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,iBAAA,CAAkB,UAAU,CAAA;AACpD,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,iBAAA,CAAkB,YAAY,CAAA;AACxD,MAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,iBAAA,CAAkB,iBAAiB,CAAA;AAClE,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,iBAAA,CAAkB,QAAQ,CAAA,IAAK,SAAA;AACrD,MAAA,MAAM,WAAA,GACJ,MAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA,IAAK,WAAA;AAC7C,MAAA,MAAM,YAAA,GAAe,MAAA,CAAO,iBAAA,CAAkB,cAAc,CAAA;AAO5D,MAAA,MAAM,KAAA,GAAQ;AAAA,QACZ,KAAA,CAAM,MAAuB,EAAA,EAAS;AACpC,UAAA,EAAA,CAAG,MAAM,IAAI,CAAA;AAAA,QACf,CAAA;AAAA,QACA,MAAA,CAAO,IAAA,EAAuB,MAAA,EAAgB,EAAA,EAAS;AACrD,UAAA,EAAA,CAAG,MAAM,IAAI,CAAA;AAAA,QACf;AAAA,OACF;AAEA,MAAA,MAAMC,aAAW,IAAIC,sBAAA;AAAA,QACnB;AAAA,UACE,QAAA;AAAA,UACA,YAAA;AAAA,UACA,WAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,YAAA;AAAA;AAAA;AAAA,UAGA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA;AAAA,cACE,WAAA;AAAA,cACA,WAAA;AAAA,cACA;AAAA,aACF;AAAA,YACA;AAAA,cACE;AAAA;AACF,WACF;AAAA,QACF;AAAA,OACF;AAEA,MAAA,MAAM,MAAA,GAASF,+CAAA,CAAiC,IAAA,CAAKC,UAAQ,CAAA;AAC7D,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,kBAAA,CAAmB,iBAAiB,CAAA,IAAK,KAAA;AAClE,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,kBACAA,UAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA,QACA,eAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MACJ,KAAA,EACA;AAAA,MACE,MAAA;AAAA,MACA,QAAA;AAAA,MACA,UAAA;AAAA,MACA,eAAA,EAAiB,gBAAA;AAAA,MACjB;AAAA,KACF,EACA;AACA,MAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,QACzB,UAAA,EAAY,SAAA;AAAA,QACZ,GAAI,MAAA,KAAW,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,QACtC,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,QAC/B,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,QACnC,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB;AAAC,OAChD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,aACJ,KAAA,EACA,EAAE,QAAQ,QAAA,EAAU,UAAA,EAAY,eAAA,EAAiB,gBAAA,EAAiB,EAClE;AACA,MAAA,OAAO,MAAA,CAAO,aAAa,KAAA,EAAO;AAAA,QAChC,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,QAC/B,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,QACnC,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB;AAAC,OAChD,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,MAAA,EAAQ,UAAS,EAAG;AACzC,MAAA,MAAM,MAAA,GAAS,MAAME,8BAAA,CAAgB,2BAAA;AAAA,QACnC,QAAA;AAAA,QACA,KAAA,CAAM,YAAA;AAAA,QACN,KAAA,CAAM;AAAA,OACR;AAEA,MAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,cAAA,CAAU,MAAA,CAAO,OAAO,QAAQ,CAAA;AAChD,MAAA,MAAM,QAAA,GAAW,GAAA,GAAM,CAAA,cAAA,EAAiB,GAAG,CAAA,CAAA,GAAK,MAAA;AAEhD,MAAA,IAAI,cAAc,QAAA,GACZ,MAAM,YAAA,EAAc,GAAA,CAAI,QAAQ,CAAA,GAClC,MAAA;AAEJ,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,WAAA,GAAc,MAAM,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,WAAW,CAAA;AAC1D,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,MAAM,YAAA,EAAc,GAAA;AAAA,YAClB,QAAA;AAAA,YACA,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC;AAAA,WACxC;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,SAAA,EAAW,MAAA,CAAO,MAAA,CAAO,UAAA,IAAc,QAAA;AAAA,UACvC,KAAA,EAAO,OAAO,MAAA,CAAO,KAAA;AAAA,UACrB,gBAAA,EAAkB,OAAO,MAAA,CAAO,UAAA;AAAA,UAChC,OAAA,EAAS,OAAO,MAAA,CAAO,QAAA;AAAA,UACvB,cAAc,MAAA,CAAO;AAAA;AACvB,OACF;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,WAAU,EAAG;AACnD,MAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,CAAA,QAAA,EAAW,MAAM,CAAA,UAAA,CAAY,CAAA;AACvD,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAAA,MAC5C;AACA,MAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AAChD,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AACrC,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,MAAM,CAAA;AAAA,MAC/C;AACA,MAAA,OAAO,EAAE,SAAA,EAAW,SAAA,CAAU,QAAA,EAAS,EAAE;AAAA,IAC3C;AAAA,GACD,CAAA;AACH;AAGO,MAAM,qBAAqB,wBAAA;;;;;"}

package/dist/index.d.ts

@@ -13,6 +13,7 @@ declare function createAuth0Authenticator(options?: {
     audience: string | undefined;
     connection: string | undefined;
     connectionScope: string | undefined;
+    prompt: string;
     domain: string;
     clientID: string;
     federated: boolean;
@@ -24,6 +25,7 @@ declare const auth0Authenticator: _backstage_plugin_auth_node.OAuthAuthenticator
     audience: string | undefined;
     connection: string | undefined;
     connectionScope: string | undefined;
+    prompt: string;
     domain: string;
     clientID: string;
     federated: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-auth0-provider",
-  "version": "0.4.2",
+  "version": "0.4.3-next.1",
   "description": "The auth0-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -25,7 +25,7 @@
   "types": "dist/index.d.ts",
   "files": [
     "dist",
-    "config.d.ts"
+    "config.schema.json"
   ],
   "scripts": {
     "build": "backstage-cli package build",
@@ -37,9 +37,9 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.9.2",
-    "@backstage/errors": "^1.3.1",
-    "@backstage/plugin-auth-node": "^0.7.2",
+    "@backstage/backend-plugin-api": "1.9.3-next.1",
+    "@backstage/errors": "1.3.1",
+    "@backstage/plugin-auth-node": "0.7.3-next.0",
     "@types/passport": "^1.0.3",
     "express": "^4.22.0",
     "jose": "^5.0.0",
@@ -48,16 +48,16 @@
     "passport-oauth2": "^1.6.1"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.17.3",
-    "@backstage/backend-test-utils": "^1.11.4",
-    "@backstage/cli": "^0.36.3",
-    "@backstage/plugin-auth-backend": "^0.29.1",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-defaults": "0.17.5-next.2",
+    "@backstage/backend-test-utils": "1.11.5-next.0",
+    "@backstage/cli": "0.36.4-next.2",
+    "@backstage/plugin-auth-backend": "0.29.2-next.1",
+    "@backstage/types": "1.2.2",
     "@types/passport-auth0": "^1.0.5",
     "@types/passport-oauth2": "^1.4.15",
     "supertest": "^7.0.0"
   },
-  "configSchema": "config.d.ts",
+  "configSchema": "config.schema.json",
   "typesVersions": {
     "*": {
       "package.json": [

package/config.d.ts

@@ -1,46 +0,0 @@
-/*
- * Copyright 2024 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { HumanDuration } from '@backstage/types';
-
-export interface Config {
-  auth?: {
-    providers?: {
-      /** @visibility frontend */
-      auth0?: {
-        [authEnv: string]: {
-          clientId: string;
-          /**
-           * @visibility secret
-           */
-          clientSecret: string;
-          domain: string;
-          callbackUrl?: string;
-          audience?: string;
-          connection?: string;
-          connectionScope?: string;
-          organization?: string;
-          /**
-           * Whether to perform federated logout, clearing both the Auth0
-           * session and any upstream IdP session. Defaults to false.
-           */
-          federatedLogout?: boolean;
-          sessionDuration?: HumanDuration | string;
-        };
-      };
-    };
-  };
-}