@backstage/plugin-auth-backend-module-gcp-iap-provider 0.4.19-next.0 → 0.4.20-next.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @backstage/plugin-auth-backend-module-gcp-iap-provider
 
+## 0.4.20-next.0
+
+### Patch Changes
+
+- b96ec9e: Cache Google IAP public verification keys according to the response cache headers to reduce repeated key requests during authentication.
+- Updated dependencies
+  - @backstage/errors@1.3.2-next.0
+  - @backstage/backend-plugin-api@1.10.2-next.0
+  - @backstage/plugin-auth-node@0.7.7-next.0
+
+## 0.4.19
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.7.6
+  - @backstage/backend-plugin-api@1.10.1
+
 ## 0.4.19-next.0
 
 ### Patch Changes

package/dist/authenticator.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthenticationError } from '@backstage/errors';\nimport { createProxyAuthenticator } from '@backstage/plugin-auth-node';\nimport { createTokenValidator } from './helpers';\nimport { GcpIapResult } from './types';\n\n/**\n * The header name used by the IAP.\n */\nconst DEFAULT_IAP_JWT_HEADER = 'x-goog-iap-jwt-assertion';\n\n/** @public */\nexport const gcpIapAuthenticator = createProxyAuthenticator({\n  defaultProfileTransform: async (result: GcpIapResult) => {\n    return { profile: { email: result.iapToken.email } };\n  },\n  initialize({ config }) {\n    const audience = config.getString('audience');\n    const jwtHeader =\n      config.getOptionalString('jwtHeader') ?? DEFAULT_IAP_JWT_HEADER;\n\n    const tokenValidator = createTokenValidator(audience);\n\n    return { jwtHeader, tokenValidator };\n  },\n  async authenticate({ req }, { jwtHeader, tokenValidator }) {\n    const token = req.header(jwtHeader);\n\n    if (!token || typeof token !== 'string') {\n      throw new AuthenticationError('Missing Google IAP header');\n    }\n\n    const iapToken = await tokenValidator(token);\n\n    return {\n      result: { iapToken },\n      providerInfo: { iapToken },\n    };\n  },\n});\n"],"names":["createProxyAuthenticator","createTokenValidator","AuthenticationError"],"mappings":";;;;;;AAwBA,MAAM,sBAAA,GAAyB,0BAAA;AAGxB,MAAM,sBAAsBA,uCAAA,CAAyB;AAAA,EAC1D,uBAAA,EAAyB,OAAO,MAAA,KAAyB;AACvD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAE,OAAO,MAAA,CAAO,QAAA,CAAS,OAAM,EAAE;AAAA,EACrD,CAAA;AAAA,EACA,UAAA,CAAW,EAAE,MAAA,EAAO,EAAG;AACrB,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,SAAA,GACJ,MAAA,CAAO,iBAAA,CAAkB,WAAW,CAAA,IAAK,sBAAA;AAE3C,IAAA,MAAM,cAAA,GAAiBC,6BAAqB,QAAQ,CAAA;AAEpD,IAAA,OAAO,EAAE,WAAW,cAAA,EAAe;AAAA,EACrC,CAAA;AAAA,EACA,MAAM,aAAa,EAAE,GAAA,IAAO,EAAE,SAAA,EAAW,gBAAe,EAAG;AACzD,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AAElC,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,MAAM,IAAIC,2BAAoB,2BAA2B,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,KAAK,CAAA;AAE3C,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,MACnB,YAAA,EAAc,EAAE,QAAA;AAAS,KAC3B;AAAA,EACF;AACF,CAAC;;;;"}
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthenticationError } from '@backstage/errors';\nimport { createProxyAuthenticator } from '@backstage/plugin-auth-node';\nimport { createTokenValidator } from './helpers';\nimport { GcpIapResult } from './types';\n\n/**\n * The header name used by the IAP.\n */\nconst DEFAULT_IAP_JWT_HEADER = 'x-goog-iap-jwt-assertion';\n\n/** @public */\nexport const gcpIapAuthenticator = createProxyAuthenticator({\n  defaultProfileTransform: async (result: GcpIapResult) => {\n    return { profile: { email: result.iapToken.email } };\n  },\n  initialize({ config }) {\n    const audience = config.getString('audience');\n    const jwtHeader =\n      config.getOptionalString('jwtHeader') ?? DEFAULT_IAP_JWT_HEADER;\n\n    const tokenValidator = createTokenValidator(audience);\n\n    return { jwtHeader, tokenValidator };\n  },\n  async authenticate({ req }, { jwtHeader, tokenValidator }) {\n    const token = req.header(jwtHeader);\n\n    if (!token || typeof token !== 'string') {\n      throw new AuthenticationError('Missing Google IAP header');\n    }\n\n    const iapToken = await tokenValidator(token);\n\n    return {\n      result: { iapToken },\n      providerInfo: { iapToken },\n    };\n  },\n});\n"],"names":["createProxyAuthenticator","createTokenValidator","AuthenticationError"],"mappings":";;;;;;AAwBA,MAAM,sBAAA,GAAyB,0BAAA;AAGxB,MAAM,sBAAsBA,uCAAA,CAAyB;AAAA,EAC1D,uBAAA,EAAyB,OAAO,MAAA,KAAyB;AACvD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAE,OAAO,MAAA,CAAO,QAAA,CAAS,OAAM,EAAE;AAAA,EACrD,CAAA;AAAA,EACA,UAAA,CAAW,EAAE,MAAA,EAAO,EAAG;AACrB,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,SAAA,GACJ,MAAA,CAAO,iBAAA,CAAkB,WAAW,CAAA,IAAK,sBAAA;AAE3C,IAAA,MAAM,cAAA,GAAiBC,6BAAqB,QAAQ,CAAA;AAEpD,IAAA,OAAO,EAAE,WAAW,cAAA,EAAe;AAAA,EACrC,CAAA;AAAA,EACA,MAAM,aAAa,EAAE,GAAA,IAAO,EAAE,SAAA,EAAW,gBAAe,EAAG;AACzD,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AAElC,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,MAAM,IAAIC,2BAAoB,2BAA2B,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,KAAK,CAAA;AAE3C,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,MACnB,YAAA,EAAc,EAAE,QAAA;AAAS,KAC3B;AAAA,EACF;AACF,CAAC;;"}

package/dist/helpers.cjs.js

@@ -3,15 +3,86 @@
 var errors = require('@backstage/errors');
 var googleAuthLibrary = require('google-auth-library');
 
+const FALLBACK_IAP_PUBLIC_KEYS_CACHE_TTL_MS = 5 * 60 * 1e3;
+const IAP_PUBLIC_KEYS_CACHE_SAFETY_MARGIN_MS = 5 * 60 * 1e3;
+function getResponseHeader(headers, name) {
+  if (!headers || typeof headers !== "object") {
+    return void 0;
+  }
+  const value = headers[name];
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    return value.join(", ");
+  }
+  return void 0;
+}
+function getResponseAgeMs(headers) {
+  const age = getResponseHeader(headers, "age");
+  if (!age || !/^\d+$/.test(age)) {
+    return 0;
+  }
+  const ageMs = Number(age) * 1e3;
+  return Number.isSafeInteger(ageMs) ? ageMs : 0;
+}
+function getPublicKeysCacheTtl(headers, now) {
+  const cacheControl = getResponseHeader(headers, "cache-control");
+  if (/(?:^|,)\s*no-(?:cache|store)\s*(?:,|$)/i.test(cacheControl ?? "")) {
+    return 0;
+  }
+  const maxAge = /(?:^|,)\s*max-age\s*=\s*"?(?<seconds>\d+)"?/i.exec(
+    cacheControl ?? ""
+  )?.groups?.seconds;
+  if (maxAge !== void 0) {
+    const ttl = Number(maxAge) * 1e3;
+    if (Number.isSafeInteger(ttl)) {
+      return Math.max(
+        0,
+        ttl - getResponseAgeMs(headers) - IAP_PUBLIC_KEYS_CACHE_SAFETY_MARGIN_MS
+      );
+    }
+  }
+  const expires = getResponseHeader(headers, "expires");
+  if (expires) {
+    const expiresAt = Date.parse(expires);
+    if (Number.isFinite(expiresAt)) {
+      return Math.max(
+        0,
+        expiresAt - now - IAP_PUBLIC_KEYS_CACHE_SAFETY_MARGIN_MS
+      );
+    }
+  }
+  return FALLBACK_IAP_PUBLIC_KEYS_CACHE_TTL_MS;
+}
 function createTokenValidator(audience, providedClient) {
   const client = new googleAuthLibrary.OAuth2Client();
+  let cachedPublicKeys;
+  let publicKeysExpiresAt = 0;
+  let pendingPublicKeys;
+  const getPublicKeys = async () => {
+    if (cachedPublicKeys && Date.now() < publicKeysExpiresAt) {
+      return cachedPublicKeys;
+    }
+    if (!pendingPublicKeys) {
+      pendingPublicKeys = client.getIapPublicKeys().then((response) => {
+        cachedPublicKeys = response.pubkeys;
+        const now = Date.now();
+        publicKeysExpiresAt = now + getPublicKeysCacheTtl(response.res?.headers, now);
+        return cachedPublicKeys;
+      }).catch((error) => {
+        throw new errors.AuthenticationError(
+          `Unable to list Google IAP token verification keys, ${error}`
+        );
+      }).finally(() => {
+        pendingPublicKeys = void 0;
+      });
+    }
+    return pendingPublicKeys;
+  };
   return async function tokenValidator(token) {
-    const response = await client.getIapPublicKeys().catch((error) => {
-      throw new errors.AuthenticationError(
-        `Unable to list Google IAP token verification keys, ${error}`
-      );
-    });
-    const ticket = await client.verifySignedJwtWithCertsAsync(token, response.pubkeys, audience, [
+    const publicKeys = await getPublicKeys();
+    const ticket = await client.verifySignedJwtWithCertsAsync(token, publicKeys, audience, [
       "https://cloud.google.com/iap"
     ]).catch((error) => {
       throw new errors.AuthenticationError(

package/dist/helpers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.cjs.js","sources":["../src/helpers.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthenticationError } from '@backstage/errors';\nimport { OAuth2Client } from 'google-auth-library';\nimport { GcpIapTokenInfo } from './types';\n\nexport function createTokenValidator(\n  audience: string,\n  providedClient?: OAuth2Client,\n): (token: string) => Promise<GcpIapTokenInfo> {\n  const client = providedClient ?? new OAuth2Client();\n\n  return async function tokenValidator(token) {\n    // TODO(freben): Rate limit the public key reads. It may be sensible to\n    // cache these for some reasonable time rather than asking for the public\n    // keys on every single sign-in. But since the rate of events here is so\n    // slow, I decided to keep it simple for now.\n    const response = await client.getIapPublicKeys().catch(error => {\n      throw new AuthenticationError(\n        `Unable to list Google IAP token verification keys, ${error}`,\n      );\n    });\n    const ticket = await client\n      .verifySignedJwtWithCertsAsync(token, response.pubkeys, audience, [\n        'https://cloud.google.com/iap',\n      ])\n      .catch(error => {\n        throw new AuthenticationError(\n          `Google IAP token verification failed, ${error}`,\n        );\n      });\n\n    const payload = ticket.getPayload();\n    if (!payload) {\n      throw new AuthenticationError(\n        'Google IAP token verification failed, token had no payload',\n      );\n    }\n\n    if (!payload.sub) {\n      throw new AuthenticationError(\n        'Google IAP token payload is missing subject claim',\n      );\n    }\n    if (!payload.email) {\n      throw new AuthenticationError(\n        'Google IAP token payload is missing email claim',\n      );\n    }\n\n    return payload as unknown as GcpIapTokenInfo;\n  };\n}\n"],"names":["OAuth2Client","AuthenticationError"],"mappings":";;;;;AAoBO,SAAS,oBAAA,CACd,UACA,cAAA,EAC6C;AAC7C,EAAA,MAAM,MAAA,GAA2B,IAAIA,8BAAA,EAAa;AAElD,EAAA,OAAO,eAAe,eAAe,KAAA,EAAO;AAK1C,IAAA,MAAM,WAAW,MAAM,MAAA,CAAO,gBAAA,EAAiB,CAAE,MAAM,CAAA,KAAA,KAAS;AAC9D,MAAA,MAAM,IAAIC,0BAAA;AAAA,QACR,sDAAsD,KAAK,CAAA;AAAA,OAC7D;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAM,SAAS,MAAM,MAAA,CAClB,8BAA8B,KAAA,EAAO,QAAA,CAAS,SAAS,QAAA,EAAU;AAAA,MAChE;AAAA,KACD,CAAA,CACA,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR,yCAAyC,KAAK,CAAA;AAAA,OAChD;AAAA,IACF,CAAC,CAAA;AAEH,IAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAClC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAQ,GAAA,EAAK;AAChB,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AACF;;;;"}
+{"version":3,"file":"helpers.cjs.js","sources":["../src/helpers.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthenticationError } from '@backstage/errors';\nimport { OAuth2Client } from 'google-auth-library';\nimport { GcpIapTokenInfo } from './types';\n\nconst FALLBACK_IAP_PUBLIC_KEYS_CACHE_TTL_MS = 5 * 60 * 1000;\nconst IAP_PUBLIC_KEYS_CACHE_SAFETY_MARGIN_MS = 5 * 60 * 1000;\n\nfunction getResponseHeader(headers: unknown, name: string): string | undefined {\n  if (!headers || typeof headers !== 'object') {\n    return undefined;\n  }\n\n  const value = (headers as Record<string, unknown>)[name];\n  if (typeof value === 'string') {\n    return value;\n  }\n  if (Array.isArray(value) && value.every(item => typeof item === 'string')) {\n    return value.join(', ');\n  }\n  return undefined;\n}\n\nfunction getResponseAgeMs(headers: unknown): number {\n  const age = getResponseHeader(headers, 'age');\n  if (!age || !/^\\d+$/.test(age)) {\n    return 0;\n  }\n\n  const ageMs = Number(age) * 1000;\n  return Number.isSafeInteger(ageMs) ? ageMs : 0;\n}\n\nfunction getPublicKeysCacheTtl(headers: unknown, now: number): number {\n  const cacheControl = getResponseHeader(headers, 'cache-control');\n  if (/(?:^|,)\\s*no-(?:cache|store)\\s*(?:,|$)/i.test(cacheControl ?? '')) {\n    return 0;\n  }\n\n  const maxAge = /(?:^|,)\\s*max-age\\s*=\\s*\"?(?<seconds>\\d+)\"?/i.exec(\n    cacheControl ?? '',\n  )?.groups?.seconds;\n\n  if (maxAge !== undefined) {\n    const ttl = Number(maxAge) * 1000;\n    if (Number.isSafeInteger(ttl)) {\n      return Math.max(\n        0,\n        ttl -\n          getResponseAgeMs(headers) -\n          IAP_PUBLIC_KEYS_CACHE_SAFETY_MARGIN_MS,\n      );\n    }\n  }\n\n  const expires = getResponseHeader(headers, 'expires');\n  if (expires) {\n    const expiresAt = Date.parse(expires);\n    if (Number.isFinite(expiresAt)) {\n      return Math.max(\n        0,\n        expiresAt - now - IAP_PUBLIC_KEYS_CACHE_SAFETY_MARGIN_MS,\n      );\n    }\n  }\n\n  return FALLBACK_IAP_PUBLIC_KEYS_CACHE_TTL_MS;\n}\n\nexport function createTokenValidator(\n  audience: string,\n  providedClient?: OAuth2Client,\n): (token: string) => Promise<GcpIapTokenInfo> {\n  const client = providedClient ?? new OAuth2Client();\n  let cachedPublicKeys: Record<string, string> | undefined;\n  let publicKeysExpiresAt = 0;\n  let pendingPublicKeys: Promise<Record<string, string>> | undefined;\n\n  const getPublicKeys = async () => {\n    if (cachedPublicKeys && Date.now() < publicKeysExpiresAt) {\n      return cachedPublicKeys;\n    }\n\n    if (!pendingPublicKeys) {\n      pendingPublicKeys = client\n        .getIapPublicKeys()\n        .then(response => {\n          cachedPublicKeys = response.pubkeys;\n          const now = Date.now();\n          publicKeysExpiresAt =\n            now + getPublicKeysCacheTtl(response.res?.headers, now);\n          return cachedPublicKeys;\n        })\n        .catch(error => {\n          throw new AuthenticationError(\n            `Unable to list Google IAP token verification keys, ${error}`,\n          );\n        })\n        .finally(() => {\n          pendingPublicKeys = undefined;\n        });\n    }\n\n    return pendingPublicKeys;\n  };\n\n  return async function tokenValidator(token) {\n    const publicKeys = await getPublicKeys();\n    const ticket = await client\n      .verifySignedJwtWithCertsAsync(token, publicKeys, audience, [\n        'https://cloud.google.com/iap',\n      ])\n      .catch(error => {\n        throw new AuthenticationError(\n          `Google IAP token verification failed, ${error}`,\n        );\n      });\n\n    const payload = ticket.getPayload();\n    if (!payload) {\n      throw new AuthenticationError(\n        'Google IAP token verification failed, token had no payload',\n      );\n    }\n\n    if (!payload.sub) {\n      throw new AuthenticationError(\n        'Google IAP token payload is missing subject claim',\n      );\n    }\n    if (!payload.email) {\n      throw new AuthenticationError(\n        'Google IAP token payload is missing email claim',\n      );\n    }\n\n    return payload as unknown as GcpIapTokenInfo;\n  };\n}\n"],"names":["OAuth2Client","AuthenticationError"],"mappings":";;;;;AAoBA,MAAM,qCAAA,GAAwC,IAAI,EAAA,GAAK,GAAA;AACvD,MAAM,sCAAA,GAAyC,IAAI,EAAA,GAAK,GAAA;AAExD,SAAS,iBAAA,CAAkB,SAAkB,IAAA,EAAkC;AAC7E,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAS,QAAoC,IAAI,CAAA;AACvD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,MAAM,CAAA,IAAA,KAAQ,OAAO,IAAA,KAAS,QAAQ,CAAA,EAAG;AACzE,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,OAAA,EAA0B;AAClD,EAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,OAAA,EAAS,KAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AAC9B,IAAA,OAAO,CAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAG,CAAA,GAAI,GAAA;AAC5B,EAAA,OAAO,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAA;AAC/C;AAEA,SAAS,qBAAA,CAAsB,SAAkB,GAAA,EAAqB;AACpE,EAAA,MAAM,YAAA,GAAe,iBAAA,CAAkB,OAAA,EAAS,eAAe,CAAA;AAC/D,EAAA,IAAI,yCAAA,CAA0C,IAAA,CAAK,YAAA,IAAgB,EAAE,CAAA,EAAG;AACtE,IAAA,OAAO,CAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAAS,8CAAA,CAA+C,IAAA;AAAA,IAC5D,YAAA,IAAgB;AAAA,KACf,MAAA,EAAQ,OAAA;AAEX,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAM,CAAA,GAAI,GAAA;AAC7B,IAAA,IAAI,MAAA,CAAO,aAAA,CAAc,GAAG,CAAA,EAAG;AAC7B,MAAA,OAAO,IAAA,CAAK,GAAA;AAAA,QACV,CAAA;AAAA,QACA,GAAA,GACE,gBAAA,CAAiB,OAAO,CAAA,GACxB;AAAA,OACJ;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,OAAA,EAAS,SAAS,CAAA;AACpD,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACpC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9B,MAAA,OAAO,IAAA,CAAK,GAAA;AAAA,QACV,CAAA;AAAA,QACA,YAAY,GAAA,GAAM;AAAA,OACpB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,qCAAA;AACT;AAEO,SAAS,oBAAA,CACd,UACA,cAAA,EAC6C;AAC7C,EAAA,MAAM,MAAA,GAA2B,IAAIA,8BAAA,EAAa;AAClD,EAAA,IAAI,gBAAA;AACJ,EAAA,IAAI,mBAAA,GAAsB,CAAA;AAC1B,EAAA,IAAI,iBAAA;AAEJ,EAAA,MAAM,gBAAgB,YAAY;AAChC,IAAA,IAAI,gBAAA,IAAoB,IAAA,CAAK,GAAA,EAAI,GAAI,mBAAA,EAAqB;AACxD,MAAA,OAAO,gBAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,iBAAA,GAAoB,MAAA,CACjB,gBAAA,EAAiB,CACjB,IAAA,CAAK,CAAA,QAAA,KAAY;AAChB,QAAA,gBAAA,GAAmB,QAAA,CAAS,OAAA;AAC5B,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,mBAAA,GACE,GAAA,GAAM,qBAAA,CAAsB,QAAA,CAAS,GAAA,EAAK,SAAS,GAAG,CAAA;AACxD,QAAA,OAAO,gBAAA;AAAA,MACT,CAAC,CAAA,CACA,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,QAAA,MAAM,IAAIC,0BAAA;AAAA,UACR,sDAAsD,KAAK,CAAA;AAAA,SAC7D;AAAA,MACF,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,QAAA,iBAAA,GAAoB,MAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,OAAO,iBAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,eAAe,eAAe,KAAA,EAAO;AAC1C,IAAA,MAAM,UAAA,GAAa,MAAM,aAAA,EAAc;AACvC,IAAA,MAAM,SAAS,MAAM,MAAA,CAClB,6BAAA,CAA8B,KAAA,EAAO,YAAY,QAAA,EAAU;AAAA,MAC1D;AAAA,KACD,CAAA,CACA,KAAA,CAAM,CAAA,KAAA,KAAS;AACd,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR,yCAAyC,KAAK,CAAA;AAAA,OAChD;AAAA,IACF,CAAC,CAAA;AAEH,IAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAClC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAQ,GAAA,EAAK;AAChB,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AACF;;"}

package/dist/module.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createProxyAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { gcpIapAuthenticator } from './authenticator';\nimport { gcpIapSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleGcpIapProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'gcp-iap-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'gcpIap',\n          factory: createProxyAuthProviderFactory({\n            authenticator: gcpIapAuthenticator,\n            signInResolverFactories: {\n              ...gcpIapSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createProxyAuthProviderFactory","gcpIapAuthenticator","gcpIapSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;AA0BO,MAAM,2BAA2BA,oCAAA,CAAoB;AAAA,EAC1D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,kBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,SAAA,EAAWC;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAU,EAAG;AACxB,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,QAAA;AAAA,UACZ,SAASC,6CAAA,CAA+B;AAAA,YACtC,aAAA,EAAeC,iCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC,+BAAA;AAAA,cACH,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createProxyAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { gcpIapAuthenticator } from './authenticator';\nimport { gcpIapSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleGcpIapProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'gcp-iap-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'gcpIap',\n          factory: createProxyAuthProviderFactory({\n            authenticator: gcpIapAuthenticator,\n            signInResolverFactories: {\n              ...gcpIapSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createProxyAuthProviderFactory","gcpIapAuthenticator","gcpIapSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;AA0BO,MAAM,2BAA2BA,oCAAA,CAAoB;AAAA,EAC1D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,kBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,SAAA,EAAWC;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAU,EAAG;AACxB,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,QAAA;AAAA,UACZ,SAASC,6CAAA,CAA+B;AAAA,YACtC,aAAA,EAAeC,iCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC,+BAAA;AAAA,cACH,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;"}

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { GcpIapResult } from './types';\nimport { z } from 'zod/v3';\n\n/**\n * Available sign-in resolvers for the Google auth provider.\n *\n * @public\n */\nexport namespace gcpIapSignInResolvers {\n  /**\n   * Looks up the user by matching their email to the `google.com/email` annotation.\n   */\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const email = info.result.iapToken.email;\n\n        if (!email) {\n          throw new Error('Google IAP sign-in result is missing email');\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'google.com/email': email,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: email } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their user ID to the `google.com/user-id` annotation.\n   */\n  export const idMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const userId = info.result.iapToken.sub.split(':')[1];\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'google.com/user-id': userId,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["gcpIapSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA4BiBA;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAIE,EAAMA,sBAAAA,CAAA,oCAAoCC,0CAAA,CAA4B;AAAA,IAC3E,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OAAO,MAAgC,GAAA,KAAQ;AACpD,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAA;AAEnC,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,QAC9D;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,WAAA,EAAa;AAAA,cACX,kBAAA,EAAoB;AAAA;AACtB,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,KAAA,EAAM,EAAE,GAC7B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OAAO,MAAgC,GAAA,KAAQ;AACpD,QAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,QAAA,CAAS,IAAI,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAEpD,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,WAAA,EAAa;AAAA,cACX,oBAAA,EAAsB;AAAA;AACxB,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAAA,CAAA,EA/DcF,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { GcpIapResult } from './types';\nimport { z } from 'zod/v3';\n\n/**\n * Available sign-in resolvers for the Google auth provider.\n *\n * @public\n */\nexport namespace gcpIapSignInResolvers {\n  /**\n   * Looks up the user by matching their email to the `google.com/email` annotation.\n   */\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const email = info.result.iapToken.email;\n\n        if (!email) {\n          throw new Error('Google IAP sign-in result is missing email');\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'google.com/email': email,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: email } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their user ID to the `google.com/user-id` annotation.\n   */\n  export const idMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const userId = info.result.iapToken.sub.split(':')[1];\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'google.com/user-id': userId,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["gcpIapSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA4BiBA;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAIE,EAAMA,sBAAAA,CAAA,oCAAoCC,0CAAA,CAA4B;AAAA,IAC3E,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OAAO,MAAgC,GAAA,KAAQ;AACpD,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAA;AAEnC,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,QAC9D;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,WAAA,EAAa;AAAA,cACX,kBAAA,EAAoB;AAAA;AACtB,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,KAAA,EAAM,EAAE,GAC7B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OAAO,MAAgC,GAAA,KAAQ;AACpD,QAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,QAAA,CAAS,IAAI,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAEpD,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,WAAA,EAAa;AAAA,cACX,oBAAA,EAAsB;AAAA;AACxB,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAAA,CAAA,EA/DcF,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-gcp-iap-provider",
-  "version": "0.4.19-next.0",
+  "version": "0.4.20-next.0",
   "description": "A GCP IAP auth provider module for the Backstage auth backend",
   "backstage": {
     "role": "backend-plugin-module",
@@ -41,16 +41,16 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.10.1-next.0",
-    "@backstage/errors": "1.3.1",
-    "@backstage/plugin-auth-node": "0.7.5-next.0",
+    "@backstage/backend-plugin-api": "1.10.2-next.0",
+    "@backstage/errors": "1.3.2-next.0",
+    "@backstage/plugin-auth-node": "0.7.7-next.0",
     "@backstage/types": "1.2.2",
     "google-auth-library": "^9.0.0",
     "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "1.11.7-next.0",
-    "@backstage/cli": "0.36.6-next.0",
+    "@backstage/backend-test-utils": "1.11.8-next.0",
+    "@backstage/cli": "0.36.7-next.0",
     "express": "^4.22.0"
   },
   "configSchema": "config.schema.json",