@backstage/plugin-auth-backend-module-guest-provider 0.1.0-next.1 → 0.1.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @backstage/plugin-auth-backend-module-guest-provider
 
+## 0.1.0
+
+### Minor Changes
+
+- 1bedb23: Adds a new guest provider that maps guest users to actual tokens. This also shifts the default guest login to `user:development/guest` to reduce overlap with your production/real data. To change that (or set it back to the old default, use the new `auth.providers.guest.userEntityRef` config key) like so,
+
+  ```yaml title=app-config.yaml
+  auth:
+    providers:
+      guest:
+        userEntityRef: user:default/guest
+  ```
+
+  This also adds a new property to control the ownership entity refs,
+
+  ```yaml title=app-config.yaml
+  auth:
+    providers:
+      guest:
+        ownershipEntityRefs:
+          - guests
+          - development/custom
+  ```
+
+### Patch Changes
+
+- 72dd380: Ensure that the config schema is present
+- 50a331b: Fix issue for issuing a token when `guest` user does not exist in catalog
+- Updated dependencies
+  - @backstage/backend-common@0.21.4
+  - @backstage/plugin-auth-node@0.4.9
+  - @backstage/errors@1.2.4
+  - @backstage/backend-plugin-api@0.6.14
+  - @backstage/catalog-model@1.4.5
+
+## 0.1.0-next.2
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.21.4-next.2
+  - @backstage/plugin-auth-node@0.4.9-next.2
+  - @backstage/backend-plugin-api@0.6.14-next.2
+  - @backstage/catalog-model@1.4.5-next.0
+  - @backstage/errors@1.2.4-next.0
+
 ## 0.1.0-next.1
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -34,7 +34,7 @@ const signInAsGuestUser = (config) => async (_, ctx) => {
     "ownershipEntityRefs"
   )) != null ? _b : [userRef];
   try {
-    return ctx.signInWithCatalogUser({ entityRef: userRef });
+    return await ctx.signInWithCatalogUser({ entityRef: userRef });
   } catch (err) {
     return ctx.issueToken({
       claims: {

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/authenticator.ts","../src/resolvers.ts","../src/module.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createProxyAuthenticator } from '@backstage/plugin-auth-node';\n\nexport const guestAuthenticator = createProxyAuthenticator({\n  defaultProfileTransform: async () => {\n    return { profile: {} };\n  },\n  initialize() {},\n  async authenticate() {\n    return { result: {} };\n  },\n});\n","/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { stringifyEntityRef } from '@backstage/catalog-model';\nimport type { Config } from '@backstage/config';\nimport { SignInResolver } from '@backstage/plugin-auth-node';\nimport { NotImplementedError } from '@backstage/errors';\n\n/**\n * Provide a default implementation of the user to resolve to. By default, this\n *  is `user:development/guest`. We will attempt to get that user if they're in the\n *  catalog. If that user doesn't exist in the catalog, we will still create a\n *  token for them so they can keep viewing.\n */\nexport const signInAsGuestUser: (config: Config) => SignInResolver<{}> =\n  (config: Config) => async (_, ctx) => {\n    if (\n      process.env.NODE_ENV !== 'development' &&\n      config.getOptionalBoolean('dangerouslyAllowOutsideDevelopment') !== true\n    ) {\n      throw new NotImplementedError(\n        'The guest provider is NOT recommended for use outside of a development environment. If you want to enable this, set `auth.providers.guest.dangerouslyAllowOutsideDevelopment: true` in your app config.',\n      );\n    }\n    const userRef =\n      config.getOptionalString('userEntityRef') ??\n      stringifyEntityRef({\n        kind: 'user',\n        namespace: 'development',\n        name: 'guest',\n      });\n    const ownershipRefs = config.getOptionalStringArray(\n      'ownershipEntityRefs',\n    ) ?? [userRef];\n    try {\n      return ctx.signInWithCatalogUser({ entityRef: userRef });\n    } catch (err) {\n      // We can't guarantee that a guest user exists in the catalog, so we issue a token directly,\n      return ctx.issueToken({\n        claims: {\n          sub: userRef,\n          ent: ownershipRefs,\n        },\n      });\n    }\n  };\n","/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  createProxyAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { guestAuthenticator } from './authenticator';\nimport { signInAsGuestUser } from './resolvers';\n\n/** @public */\nexport const authModuleGuestProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'guest-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        providers: authProvidersExtensionPoint,\n        config: coreServices.rootConfig,\n      },\n      async init({ providers, logger, config }) {\n        if (process.env.NODE_ENV !== 'development') {\n          logger.warn(\n            'You should NOT be using the guest provider outside of a development environment.',\n          );\n        }\n        providers.registerProvider({\n          providerId: 'guest',\n          factory: createProxyAuthProviderFactory({\n            authenticator: guestAuthenticator,\n            signInResolver: signInAsGuestUser(\n              config.getConfig('auth.providers.guest'),\n            ),\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createProxyAuthenticator","NotImplementedError","stringifyEntityRef","createBackendModule","coreServices","authProvidersExtensionPoint","createProxyAuthProviderFactory"],"mappings":";;;;;;;;;AAkBO,MAAM,qBAAqBA,uCAAyB,CAAA;AAAA,EACzD,yBAAyB,YAAY;AACnC,IAAO,OAAA,EAAE,OAAS,EAAA,EAAG,EAAA,CAAA;AAAA,GACvB;AAAA,EACA,UAAa,GAAA;AAAA,GAAC;AAAA,EACd,MAAM,YAAe,GAAA;AACnB,IAAO,OAAA,EAAE,MAAQ,EAAA,EAAG,EAAA,CAAA;AAAA,GACtB;AACF,CAAC,CAAA;;ACCM,MAAM,iBACX,GAAA,CAAC,MAAmB,KAAA,OAAO,GAAG,GAAQ,KAAA;AA5BxC,EAAA,IAAA,EAAA,EAAA,EAAA,CAAA;AA6BI,EACE,IAAA,OAAA,CAAQ,IAAI,QAAa,KAAA,aAAA,IACzB,OAAO,kBAAmB,CAAA,oCAAoC,MAAM,IACpE,EAAA;AACA,IAAA,MAAM,IAAIC,0BAAA;AAAA,MACR,yMAAA;AAAA,KACF,CAAA;AAAA,GACF;AACA,EAAA,MAAM,WACJ,EAAO,GAAA,MAAA,CAAA,iBAAA,CAAkB,eAAe,CAAA,KAAxC,YACAC,+BAAmB,CAAA;AAAA,IACjB,IAAM,EAAA,MAAA;AAAA,IACN,SAAW,EAAA,aAAA;AAAA,IACX,IAAM,EAAA,OAAA;AAAA,GACP,CAAA,CAAA;AACH,EAAA,MAAM,iBAAgB,EAAO,GAAA,MAAA,CAAA,sBAAA;AAAA,IAC3B,qBAAA;AAAA,GACF,KAFsB,IAEjB,GAAA,EAAA,GAAA,CAAC,OAAO,CAAA,CAAA;AACb,EAAI,IAAA;AACF,IAAA,OAAO,GAAI,CAAA,qBAAA,CAAsB,EAAE,SAAA,EAAW,SAAS,CAAA,CAAA;AAAA,WAChD,GAAK,EAAA;AAEZ,IAAA,OAAO,IAAI,UAAW,CAAA;AAAA,MACpB,MAAQ,EAAA;AAAA,QACN,GAAK,EAAA,OAAA;AAAA,QACL,GAAK,EAAA,aAAA;AAAA,OACP;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAA;;AC/BK,MAAM,0BAA0BC,oCAAoB,CAAA;AAAA,EACzD,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,gBAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,QAAQC,6BAAa,CAAA,MAAA;AAAA,QACrB,SAAW,EAAAC,0CAAA;AAAA,QACX,QAAQD,6BAAa,CAAA,UAAA;AAAA,OACvB;AAAA,MACA,MAAM,IAAK,CAAA,EAAE,SAAW,EAAA,MAAA,EAAQ,QAAU,EAAA;AACxC,QAAI,IAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,aAAe,EAAA;AAC1C,UAAO,MAAA,CAAA,IAAA;AAAA,YACL,kFAAA;AAAA,WACF,CAAA;AAAA,SACF;AACA,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,OAAA;AAAA,UACZ,SAASE,6CAA+B,CAAA;AAAA,YACtC,aAAe,EAAA,kBAAA;AAAA,YACf,cAAgB,EAAA,iBAAA;AAAA,cACd,MAAA,CAAO,UAAU,sBAAsB,CAAA;AAAA,aACzC;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/authenticator.ts","../src/resolvers.ts","../src/module.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createProxyAuthenticator } from '@backstage/plugin-auth-node';\n\nexport const guestAuthenticator = createProxyAuthenticator({\n  defaultProfileTransform: async () => {\n    return { profile: {} };\n  },\n  initialize() {},\n  async authenticate() {\n    return { result: {} };\n  },\n});\n","/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { stringifyEntityRef } from '@backstage/catalog-model';\nimport type { Config } from '@backstage/config';\nimport { SignInResolver } from '@backstage/plugin-auth-node';\nimport { NotImplementedError } from '@backstage/errors';\n\n/**\n * Provide a default implementation of the user to resolve to. By default, this\n *  is `user:development/guest`. We will attempt to get that user if they're in the\n *  catalog. If that user doesn't exist in the catalog, we will still create a\n *  token for them so they can keep viewing.\n */\nexport const signInAsGuestUser: (config: Config) => SignInResolver<{}> =\n  (config: Config) => async (_, ctx) => {\n    if (\n      process.env.NODE_ENV !== 'development' &&\n      config.getOptionalBoolean('dangerouslyAllowOutsideDevelopment') !== true\n    ) {\n      throw new NotImplementedError(\n        'The guest provider is NOT recommended for use outside of a development environment. If you want to enable this, set `auth.providers.guest.dangerouslyAllowOutsideDevelopment: true` in your app config.',\n      );\n    }\n    const userRef =\n      config.getOptionalString('userEntityRef') ??\n      stringifyEntityRef({\n        kind: 'user',\n        namespace: 'development',\n        name: 'guest',\n      });\n    const ownershipRefs = config.getOptionalStringArray(\n      'ownershipEntityRefs',\n    ) ?? [userRef];\n    try {\n      return await ctx.signInWithCatalogUser({ entityRef: userRef });\n    } catch (err) {\n      // We can't guarantee that a guest user exists in the catalog, so we issue a token directly,\n      return ctx.issueToken({\n        claims: {\n          sub: userRef,\n          ent: ownershipRefs,\n        },\n      });\n    }\n  };\n","/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  createProxyAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { guestAuthenticator } from './authenticator';\nimport { signInAsGuestUser } from './resolvers';\n\n/** @public */\nexport const authModuleGuestProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'guest-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        providers: authProvidersExtensionPoint,\n        config: coreServices.rootConfig,\n      },\n      async init({ providers, logger, config }) {\n        if (process.env.NODE_ENV !== 'development') {\n          logger.warn(\n            'You should NOT be using the guest provider outside of a development environment.',\n          );\n        }\n        providers.registerProvider({\n          providerId: 'guest',\n          factory: createProxyAuthProviderFactory({\n            authenticator: guestAuthenticator,\n            signInResolver: signInAsGuestUser(\n              config.getConfig('auth.providers.guest'),\n            ),\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createProxyAuthenticator","NotImplementedError","stringifyEntityRef","createBackendModule","coreServices","authProvidersExtensionPoint","createProxyAuthProviderFactory"],"mappings":";;;;;;;;;AAkBO,MAAM,qBAAqBA,uCAAyB,CAAA;AAAA,EACzD,yBAAyB,YAAY;AACnC,IAAO,OAAA,EAAE,OAAS,EAAA,EAAG,EAAA,CAAA;AAAA,GACvB;AAAA,EACA,UAAa,GAAA;AAAA,GAAC;AAAA,EACd,MAAM,YAAe,GAAA;AACnB,IAAO,OAAA,EAAE,MAAQ,EAAA,EAAG,EAAA,CAAA;AAAA,GACtB;AACF,CAAC,CAAA;;ACCM,MAAM,iBACX,GAAA,CAAC,MAAmB,KAAA,OAAO,GAAG,GAAQ,KAAA;AA5BxC,EAAA,IAAA,EAAA,EAAA,EAAA,CAAA;AA6BI,EACE,IAAA,OAAA,CAAQ,IAAI,QAAa,KAAA,aAAA,IACzB,OAAO,kBAAmB,CAAA,oCAAoC,MAAM,IACpE,EAAA;AACA,IAAA,MAAM,IAAIC,0BAAA;AAAA,MACR,yMAAA;AAAA,KACF,CAAA;AAAA,GACF;AACA,EAAA,MAAM,WACJ,EAAO,GAAA,MAAA,CAAA,iBAAA,CAAkB,eAAe,CAAA,KAAxC,YACAC,+BAAmB,CAAA;AAAA,IACjB,IAAM,EAAA,MAAA;AAAA,IACN,SAAW,EAAA,aAAA;AAAA,IACX,IAAM,EAAA,OAAA;AAAA,GACP,CAAA,CAAA;AACH,EAAA,MAAM,iBAAgB,EAAO,GAAA,MAAA,CAAA,sBAAA;AAAA,IAC3B,qBAAA;AAAA,GACF,KAFsB,IAEjB,GAAA,EAAA,GAAA,CAAC,OAAO,CAAA,CAAA;AACb,EAAI,IAAA;AACF,IAAA,OAAO,MAAM,GAAI,CAAA,qBAAA,CAAsB,EAAE,SAAA,EAAW,SAAS,CAAA,CAAA;AAAA,WACtD,GAAK,EAAA;AAEZ,IAAA,OAAO,IAAI,UAAW,CAAA;AAAA,MACpB,MAAQ,EAAA;AAAA,QACN,GAAK,EAAA,OAAA;AAAA,QACL,GAAK,EAAA,aAAA;AAAA,OACP;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAA;;AC/BK,MAAM,0BAA0BC,oCAAoB,CAAA;AAAA,EACzD,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,gBAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,QAAQC,6BAAa,CAAA,MAAA;AAAA,QACrB,SAAW,EAAAC,0CAAA;AAAA,QACX,QAAQD,6BAAa,CAAA,UAAA;AAAA,OACvB;AAAA,MACA,MAAM,IAAK,CAAA,EAAE,SAAW,EAAA,MAAA,EAAQ,QAAU,EAAA;AACxC,QAAI,IAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,aAAe,EAAA;AAC1C,UAAO,MAAA,CAAA,IAAA;AAAA,YACL,kFAAA;AAAA,WACF,CAAA;AAAA,SACF;AACA,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,OAAA;AAAA,UACZ,SAASE,6CAA+B,CAAA;AAAA,YACtC,aAAe,EAAA,kBAAA;AAAA,YACf,cAAgB,EAAA,iBAAA;AAAA,cACd,MAAA,CAAO,UAAU,sBAAsB,CAAA;AAAA,aACzC;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-guest-provider",
-  "version": "0.1.0-next.1",
+  "version": "0.1.0",
   "description": "The guest-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module"
@@ -32,17 +32,17 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.21.4-next.1",
-    "@backstage/backend-plugin-api": "^0.6.14-next.1",
-    "@backstage/catalog-model": "^1.4.5-next.0",
-    "@backstage/errors": "^1.2.4-next.0",
-    "@backstage/plugin-auth-node": "^0.4.9-next.1",
+    "@backstage/backend-common": "^0.21.4",
+    "@backstage/backend-plugin-api": "^0.6.14",
+    "@backstage/catalog-model": "^1.4.5",
+    "@backstage/errors": "^1.2.4",
+    "@backstage/plugin-auth-node": "^0.4.9",
     "passport-oauth2": "^1.7.0"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "^0.3.4-next.1",
-    "@backstage/cli": "^0.25.3-next.1",
-    "@backstage/config": "^1.2.0-next.1",
+    "@backstage/backend-test-utils": "^0.3.4",
+    "@backstage/cli": "^0.26.0",
+    "@backstage/config": "^1.2.0",
     "express": "^4.18.2"
   },
   "configSchema": "config.d.ts"