@backstage/plugin-auth-backend-module-oidc-provider 0.0.0-nightly-20260127025640 → 0.0.0-nightly-20260128025246

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +18 -4
  2. package/dist/authenticator.cjs.js +1 -1
  3. package/dist/authenticator.cjs.js.map +1 -1
  4. package/package.json +7 -7
package/CHANGELOG.md CHANGED
@@ -1,14 +1,28 @@
1
1
  # @backstage/plugin-auth-backend-module-oidc-provider
2
2
 
3
- ## 0.0.0-nightly-20260127025640
3
+ ## 0.0.0-nightly-20260128025246
4
4
 
5
5
  ### Patch Changes
6
6
 
7
+ - 7455dae: Use node prefix on native imports
7
8
  - 69d880e: Bump to latest zod to ensure it has the latest features
8
9
  - Updated dependencies
9
- - @backstage/backend-plugin-api@0.0.0-nightly-20260127025640
10
- - @backstage/plugin-auth-node@0.0.0-nightly-20260127025640
11
- - @backstage/plugin-auth-backend@0.0.0-nightly-20260127025640
10
+ - @backstage/backend-plugin-api@0.0.0-nightly-20260128025246
11
+ - @backstage/plugin-auth-backend@0.0.0-nightly-20260128025246
12
+ - @backstage/plugin-auth-node@0.0.0-nightly-20260128025246
13
+ - @backstage/config@1.3.6
14
+ - @backstage/types@1.2.2
15
+
16
+ ## 0.4.12-next.0
17
+
18
+ ### Patch Changes
19
+
20
+ - 7455dae: Use node prefix on native imports
21
+ - 69d880e: Bump to latest zod to ensure it has the latest features
22
+ - Updated dependencies
23
+ - @backstage/backend-plugin-api@1.7.0-next.0
24
+ - @backstage/plugin-auth-backend@0.26.1-next.0
25
+ - @backstage/plugin-auth-node@0.6.12-next.0
12
26
  - @backstage/config@1.3.6
13
27
  - @backstage/types@1.2.2
14
28
 
package/dist/authenticator.cjs.js CHANGED
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- var crypto = require('crypto');
3
+ var crypto = require('node:crypto');
4
4
  var openidClient = require('openid-client');
5
5
  var pluginAuthNode = require('@backstage/plugin-auth-node');
6
6
  var types = require('@backstage/types');
package/dist/authenticator.cjs.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport crypto from 'crypto';\nimport {\n custom,\n CustomHttpOptionsProvider,\n Issuer,\n ClientAuthMethod,\n TokenSet,\n UserinfoResponse,\n Strategy as OidcStrategy,\n} from 'openid-client';\nimport {\n createOAuthAuthenticator,\n OAuthAuthenticatorResult,\n PassportDoneCallback,\n PassportHelpers,\n PassportOAuthAuthenticatorHelper,\n PassportOAuthPrivateInfo,\n} from '@backstage/plugin-auth-node';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { readDurationFromConfig } from '@backstage/config';\n\nconst HTTP_OPTION_TIMEOUT = 10000;\nconst createHttpOptionsProvider =\n ({ timeout }: { timeout?: number }): CustomHttpOptionsProvider =>\n (_url, options) => {\n return {\n ...options,\n timeout: timeout ?? HTTP_OPTION_TIMEOUT,\n };\n };\n\n/**\n * authentication result for the OIDC which includes the token set and user\n * profile response\n * @public\n */\nexport type OidcAuthResult = {\n tokenset: TokenSet;\n userinfo: UserinfoResponse;\n};\n\n/** @public */\nexport const oidcAuthenticator = createOAuthAuthenticator({\n defaultProfileTransform: async (\n input: OAuthAuthenticatorResult<OidcAuthResult>,\n ) => ({\n profile: {\n email: input.fullProfile.userinfo.email,\n picture: input.fullProfile.userinfo.picture,\n displayName: input.fullProfile.userinfo.name,\n },\n }),\n scopes: {\n persist: true,\n required: ['openid', 'profile', 'email'],\n },\n initialize({ callbackUrl, config }) {\n const clientId = config.getString('clientId');\n const clientSecret = config.getString('clientSecret');\n const metadataUrl = config.getString('metadataUrl');\n const customCallbackUrl = config.getOptionalString('callbackUrl');\n const tokenEndpointAuthMethod = config.getOptionalString(\n 'tokenEndpointAuthMethod',\n ) as ClientAuthMethod;\n const tokenSignedResponseAlg = config.getOptionalString(\n 'tokenSignedResponseAlg',\n );\n const initializedPrompt = config.getOptionalString('prompt');\n\n const startUrlSearchParams: Record<string, string> =\n config.getOptional('startUrlSearchParams') || {};\n\n if (config.has('scope')) {\n throw new Error(\n 'The oidc provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n );\n }\n\n const timeoutMilliseconds = config.has('timeout')\n ? durationToMilliseconds(\n readDurationFromConfig(config, { key: 'timeout' }),\n )\n : undefined;\n const httpOptionsProvider = createHttpOptionsProvider({\n timeout: timeoutMilliseconds,\n });\n\n Issuer[custom.http_options] = httpOptionsProvider;\n const promise = Issuer.discover(metadataUrl).then(issuer => {\n issuer[custom.http_options] = httpOptionsProvider;\n issuer.Client[custom.http_options] = httpOptionsProvider;\n\n const client = new issuer.Client({\n access_type: 'offline', // this option must be passed to provider to receive a refresh token\n client_id: clientId,\n client_secret: clientSecret,\n redirect_uris: [customCallbackUrl || callbackUrl],\n response_types: ['code'],\n token_endpoint_auth_method:\n tokenEndpointAuthMethod || 'client_secret_basic',\n id_token_signed_response_alg: tokenSignedResponseAlg || 'RS256',\n });\n client[custom.http_options] = httpOptionsProvider;\n\n const strategy = new OidcStrategy(\n {\n client,\n passReqToCallback: false,\n },\n (\n tokenset: TokenSet,\n userinfo: UserinfoResponse,\n done: PassportDoneCallback<OidcAuthResult, PassportOAuthPrivateInfo>,\n ) => {\n if (typeof done !== 'function') {\n throw new Error(\n 'OIDC IdP must provide a userinfo_endpoint in the metadata response',\n );\n }\n\n done(\n undefined,\n { tokenset, userinfo },\n { refreshToken: tokenset.refresh_token },\n );\n },\n );\n\n const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n return { helper, client, strategy };\n });\n\n return { initializedPrompt, promise, searchParams: startUrlSearchParams };\n },\n\n async start(input, ctx) {\n const { initializedPrompt, promise, searchParams } = ctx;\n const { helper } = await promise;\n\n // Merge the custom start URL params, but do not override the standard params (scope, state etc)\n const options: Record<string, string> = {\n ...searchParams,\n scope: input.scope,\n state: input.state,\n nonce: crypto.randomBytes(16).toString('base64'),\n };\n\n const prompt = initializedPrompt || 'none';\n if (prompt !== 'auto') {\n options.prompt = prompt;\n }\n\n return helper.start(input, {\n ...options,\n });\n },\n\n async authenticate(\n input,\n ctx,\n ): Promise<OAuthAuthenticatorResult<OidcAuthResult>> {\n const { strategy } = await ctx.promise;\n const { result, privateInfo } =\n await PassportHelpers.executeFrameHandlerStrategy<\n OidcAuthResult,\n PassportOAuthPrivateInfo\n >(input.req, strategy);\n\n return {\n fullProfile: result,\n session: {\n accessToken: result.tokenset.access_token!,\n tokenType: result.tokenset.token_type ?? 'bearer',\n scope: result.tokenset.scope!,\n expiresInSeconds: result.tokenset.expires_in,\n idToken: result.tokenset.id_token,\n refreshToken: privateInfo.refreshToken,\n },\n };\n },\n\n async refresh(input, ctx) {\n const { client } = await ctx.promise;\n const tokenset = await client.refresh(input.refreshToken);\n if (!tokenset.access_token) {\n throw new Error('Refresh failed');\n }\n const userinfo = await client.userinfo(tokenset.access_token);\n\n return new Promise((resolve, reject) => {\n if (!tokenset.access_token) {\n reject(new Error('Refresh Failed'));\n }\n resolve({\n fullProfile: { userinfo, tokenset },\n session: {\n accessToken: tokenset.access_token!,\n tokenType: tokenset.token_type ?? 'bearer',\n scope: tokenset.scope!,\n expiresInSeconds: tokenset.expires_in,\n idToken: tokenset.id_token,\n refreshToken: tokenset.refresh_token,\n },\n });\n });\n },\n\n async logout(input, ctx) {\n const { client } = await ctx.promise;\n const issuer = client.issuer;\n /**\n * https://github.com/panva/node-openid-client/blob/main/lib/client.js#L1398\n * client.revoke will check revocation_endpoint and if undefined throw error。\n *\n * if oidc server do not provide revocation_endpoint，we should not call revoke function\n */\n\n if (input.refreshToken && issuer.revocation_endpoint) {\n await client.revoke(input.refreshToken);\n }\n },\n});\n"],"names":["createOAuthAuthenticator","config","durationToMilliseconds","readDurationFromConfig","Issuer","custom","OidcStrategy","PassportOAuthAuthenticatorHelper","crypto","PassportHelpers"],"mappings":";;;;;;;;;;;;AAqCA,MAAM,mBAAA,GAAsB,GAAA;AAC5B,MAAM,4BACJ,CAAC,EAAE,SAAQ,KACX,CAAC,MAAM,OAAA,KAAY;AACjB,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,SAAS,OAAA,IAAW;AAAA,GACtB;AACF,CAAA;AAaK,MAAM,oBAAoBA,uCAAA,CAAyB;AAAA,EACxD,uBAAA,EAAyB,OACvB,KAAA,MACI;AAAA,IACJ,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,KAAA;AAAA,MAClC,OAAA,EAAS,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,OAAA;AAAA,MACpC,WAAA,EAAa,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS;AAAA;AAC1C,GACF,CAAA;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,QAAA,EAAU,SAAA,EAAW,OAAO;AAAA,GACzC;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,UAAaC,QAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAWA,QAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAeA,QAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,WAAA,GAAcA,QAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AAClD,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA;AAChE,IAAA,MAAM,0BAA0BA,QAAA,CAAO,iBAAA;AAAA,MACrC;AAAA,KACF;AACA,IAAA,MAAM,yBAAyBA,QAAA,CAAO,iBAAA;AAAA,MACpC;AAAA,KACF;AACA,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,QAAQ,CAAA;AAE3D,IAAA,MAAM,oBAAA,GACJA,QAAA,CAAO,WAAA,CAAY,sBAAsB,KAAK,EAAC;AAEjD,IAAA,IAAIA,QAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBAAA,GAAsBA,QAAA,CAAO,GAAA,CAAI,SAAS,CAAA,GAC5CC,4BAAA;AAAA,MACEC,6BAAA,CAAuBF,QAAA,EAAQ,EAAE,GAAA,EAAK,WAAW;AAAA,KACnD,GACA,MAAA;AACJ,IAAA,MAAM,sBAAsB,yBAAA,CAA0B;AAAA,MACpD,OAAA,EAAS;AAAA,KACV,CAAA;AAED,IAAAG,mBAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,IAAA,MAAM,UAAUD,mBAAA,CAAO,QAAA,CAAS,WAAW,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AAC1D,MAAA,MAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,MAAA,MAAA,CAAO,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAErC,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,MAAA,CAAO;AAAA,QAC/B,WAAA,EAAa,SAAA;AAAA;AAAA,QACb,SAAA,EAAW,QAAA;AAAA,QACX,aAAA,EAAe,YAAA;AAAA,QACf,aAAA,EAAe,CAAC,iBAAA,IAAqB,WAAW,CAAA;AAAA,QAChD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,QACvB,4BACE,uBAAA,IAA2B,qBAAA;AAAA,QAC7B,8BAA8B,sBAAA,IAA0B;AAAA,OACzD,CAAA;AACD,MAAA,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAE9B,MAAA,MAAM,WAAW,IAAIC,qBAAA;AAAA,QACnB;AAAA,UACE,MAAA;AAAA,UACA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,QAAA,EACA,QAAA,EACA,IAAA,KACG;AACH,UAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AAEA,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,UAAU,QAAA,EAAS;AAAA,YACrB,EAAE,YAAA,EAAc,QAAA,CAAS,aAAA;AAAc,WACzC;AAAA,QACF;AAAA,OACF;AAEA,MAAA,MAAM,MAAA,GAASC,+CAAA,CAAiC,IAAA,CAAK,QAAQ,CAAA;AAC7D,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAS;AAAA,IACpC,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,iBAAA,EAAmB,OAAA,EAAS,YAAA,EAAc,oBAAA,EAAqB;AAAA,EAC1E,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK;AACtB,IAAA,MAAM,EAAE,iBAAA,EAAmB,OAAA,EAAS,YAAA,EAAa,GAAI,GAAA;AACrD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAA;AAGzB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAG,YAAA;AAAA,MACH,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAOC,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,QAAQ;AAAA,KACjD;AAEA,IAAA,MAAM,SAAS,iBAAA,IAAqB,MAAA;AACpC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,OAAA,CAAQ,MAAA,GAAS,MAAA;AAAA,IACnB;AAEA,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,GAAG;AAAA,KACJ,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,EACA,GAAA,EACmD;AACnD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,GAAA,CAAI,OAAA;AAC/B,IAAA,MAAM,EAAE,QAAQ,WAAA,EAAY,GAC1B,MAAMC,8BAAA,CAAgB,2BAAA,CAGpB,KAAA,CAAM,GAAA,EAAK,QAAQ,CAAA;AAEvB,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,MAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,OAAO,QAAA,CAAS,YAAA;AAAA,QAC7B,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,UAAA,IAAc,QAAA;AAAA,QACzC,KAAA,EAAO,OAAO,QAAA,CAAS,KAAA;AAAA,QACvB,gBAAA,EAAkB,OAAO,QAAA,CAAS,UAAA;AAAA,QAClC,OAAA,EAAS,OAAO,QAAA,CAAS,QAAA;AAAA,QACzB,cAAc,WAAA,CAAY;AAAA;AAC5B,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK;AACxB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,MAAM,YAAY,CAAA;AACxD,IAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,gBAAgB,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,YAAY,CAAA;AAE5D,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAAA,MACpC;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,WAAA,EAAa,EAAE,QAAA,EAAU,QAAA,EAAS;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,aAAa,QAAA,CAAS,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAA,IAAc,QAAA;AAAA,UAClC,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,kBAAkB,QAAA,CAAS,UAAA;AAAA,UAC3B,SAAS,QAAA,CAAS,QAAA;AAAA,UAClB,cAAc,QAAA,CAAS;AAAA;AACzB,OACD,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,MAAA,CAAO,KAAA,EAAO,GAAA,EAAK;AACvB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAQtB,IAAA,IAAI,KAAA,CAAM,YAAA,IAAgB,MAAA,CAAO,mBAAA,EAAqB;AACpD,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA;AAAA,IACxC;AAAA,EACF;AACF,CAAC;;;;"}
1
+ {"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport crypto from 'node:crypto';\nimport {\n custom,\n CustomHttpOptionsProvider,\n Issuer,\n ClientAuthMethod,\n TokenSet,\n UserinfoResponse,\n Strategy as OidcStrategy,\n} from 'openid-client';\nimport {\n createOAuthAuthenticator,\n OAuthAuthenticatorResult,\n PassportDoneCallback,\n PassportHelpers,\n PassportOAuthAuthenticatorHelper,\n PassportOAuthPrivateInfo,\n} from '@backstage/plugin-auth-node';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { readDurationFromConfig } from '@backstage/config';\n\nconst HTTP_OPTION_TIMEOUT = 10000;\nconst createHttpOptionsProvider =\n ({ timeout }: { timeout?: number }): CustomHttpOptionsProvider =>\n (_url, options) => {\n return {\n ...options,\n timeout: timeout ?? HTTP_OPTION_TIMEOUT,\n };\n };\n\n/**\n * authentication result for the OIDC which includes the token set and user\n * profile response\n * @public\n */\nexport type OidcAuthResult = {\n tokenset: TokenSet;\n userinfo: UserinfoResponse;\n};\n\n/** @public */\nexport const oidcAuthenticator = createOAuthAuthenticator({\n defaultProfileTransform: async (\n input: OAuthAuthenticatorResult<OidcAuthResult>,\n ) => ({\n profile: {\n email: input.fullProfile.userinfo.email,\n picture: input.fullProfile.userinfo.picture,\n displayName: input.fullProfile.userinfo.name,\n },\n }),\n scopes: {\n persist: true,\n required: ['openid', 'profile', 'email'],\n },\n initialize({ callbackUrl, config }) {\n const clientId = config.getString('clientId');\n const clientSecret = config.getString('clientSecret');\n const metadataUrl = config.getString('metadataUrl');\n const customCallbackUrl = config.getOptionalString('callbackUrl');\n const tokenEndpointAuthMethod = config.getOptionalString(\n 'tokenEndpointAuthMethod',\n ) as ClientAuthMethod;\n const tokenSignedResponseAlg = config.getOptionalString(\n 'tokenSignedResponseAlg',\n );\n const initializedPrompt = config.getOptionalString('prompt');\n\n const startUrlSearchParams: Record<string, string> =\n config.getOptional('startUrlSearchParams') || {};\n\n if (config.has('scope')) {\n throw new Error(\n 'The oidc provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n );\n }\n\n const timeoutMilliseconds = config.has('timeout')\n ? durationToMilliseconds(\n readDurationFromConfig(config, { key: 'timeout' }),\n )\n : undefined;\n const httpOptionsProvider = createHttpOptionsProvider({\n timeout: timeoutMilliseconds,\n });\n\n Issuer[custom.http_options] = httpOptionsProvider;\n const promise = Issuer.discover(metadataUrl).then(issuer => {\n issuer[custom.http_options] = httpOptionsProvider;\n issuer.Client[custom.http_options] = httpOptionsProvider;\n\n const client = new issuer.Client({\n access_type: 'offline', // this option must be passed to provider to receive a refresh token\n client_id: clientId,\n client_secret: clientSecret,\n redirect_uris: [customCallbackUrl || callbackUrl],\n response_types: ['code'],\n token_endpoint_auth_method:\n tokenEndpointAuthMethod || 'client_secret_basic',\n id_token_signed_response_alg: tokenSignedResponseAlg || 'RS256',\n });\n client[custom.http_options] = httpOptionsProvider;\n\n const strategy = new OidcStrategy(\n {\n client,\n passReqToCallback: false,\n },\n (\n tokenset: TokenSet,\n userinfo: UserinfoResponse,\n done: PassportDoneCallback<OidcAuthResult, PassportOAuthPrivateInfo>,\n ) => {\n if (typeof done !== 'function') {\n throw new Error(\n 'OIDC IdP must provide a userinfo_endpoint in the metadata response',\n );\n }\n\n done(\n undefined,\n { tokenset, userinfo },\n { refreshToken: tokenset.refresh_token },\n );\n },\n );\n\n const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n return { helper, client, strategy };\n });\n\n return { initializedPrompt, promise, searchParams: startUrlSearchParams };\n },\n\n async start(input, ctx) {\n const { initializedPrompt, promise, searchParams } = ctx;\n const { helper } = await promise;\n\n // Merge the custom start URL params, but do not override the standard params (scope, state etc)\n const options: Record<string, string> = {\n ...searchParams,\n scope: input.scope,\n state: input.state,\n nonce: crypto.randomBytes(16).toString('base64'),\n };\n\n const prompt = initializedPrompt || 'none';\n if (prompt !== 'auto') {\n options.prompt = prompt;\n }\n\n return helper.start(input, {\n ...options,\n });\n },\n\n async authenticate(\n input,\n ctx,\n ): Promise<OAuthAuthenticatorResult<OidcAuthResult>> {\n const { strategy } = await ctx.promise;\n const { result, privateInfo } =\n await PassportHelpers.executeFrameHandlerStrategy<\n OidcAuthResult,\n PassportOAuthPrivateInfo\n >(input.req, strategy);\n\n return {\n fullProfile: result,\n session: {\n accessToken: result.tokenset.access_token!,\n tokenType: result.tokenset.token_type ?? 'bearer',\n scope: result.tokenset.scope!,\n expiresInSeconds: result.tokenset.expires_in,\n idToken: result.tokenset.id_token,\n refreshToken: privateInfo.refreshToken,\n },\n };\n },\n\n async refresh(input, ctx) {\n const { client } = await ctx.promise;\n const tokenset = await client.refresh(input.refreshToken);\n if (!tokenset.access_token) {\n throw new Error('Refresh failed');\n }\n const userinfo = await client.userinfo(tokenset.access_token);\n\n return new Promise((resolve, reject) => {\n if (!tokenset.access_token) {\n reject(new Error('Refresh Failed'));\n }\n resolve({\n fullProfile: { userinfo, tokenset },\n session: {\n accessToken: tokenset.access_token!,\n tokenType: tokenset.token_type ?? 'bearer',\n scope: tokenset.scope!,\n expiresInSeconds: tokenset.expires_in,\n idToken: tokenset.id_token,\n refreshToken: tokenset.refresh_token,\n },\n });\n });\n },\n\n async logout(input, ctx) {\n const { client } = await ctx.promise;\n const issuer = client.issuer;\n /**\n * https://github.com/panva/node-openid-client/blob/main/lib/client.js#L1398\n * client.revoke will check revocation_endpoint and if undefined throw error。\n *\n * if oidc server do not provide revocation_endpoint，we should not call revoke function\n */\n\n if (input.refreshToken && issuer.revocation_endpoint) {\n await client.revoke(input.refreshToken);\n }\n },\n});\n"],"names":["createOAuthAuthenticator","config","durationToMilliseconds","readDurationFromConfig","Issuer","custom","OidcStrategy","PassportOAuthAuthenticatorHelper","crypto","PassportHelpers"],"mappings":";;;;;;;;;;;;AAqCA,MAAM,mBAAA,GAAsB,GAAA;AAC5B,MAAM,4BACJ,CAAC,EAAE,SAAQ,KACX,CAAC,MAAM,OAAA,KAAY;AACjB,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,SAAS,OAAA,IAAW;AAAA,GACtB;AACF,CAAA;AAaK,MAAM,oBAAoBA,uCAAA,CAAyB;AAAA,EACxD,uBAAA,EAAyB,OACvB,KAAA,MACI;AAAA,IACJ,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,KAAA;AAAA,MAClC,OAAA,EAAS,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,OAAA;AAAA,MACpC,WAAA,EAAa,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS;AAAA;AAC1C,GACF,CAAA;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,QAAA,EAAU,SAAA,EAAW,OAAO;AAAA,GACzC;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,UAAaC,QAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAWA,QAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAeA,QAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,WAAA,GAAcA,QAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AAClD,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA;AAChE,IAAA,MAAM,0BAA0BA,QAAA,CAAO,iBAAA;AAAA,MACrC;AAAA,KACF;AACA,IAAA,MAAM,yBAAyBA,QAAA,CAAO,iBAAA;AAAA,MACpC;AAAA,KACF;AACA,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,QAAQ,CAAA;AAE3D,IAAA,MAAM,oBAAA,GACJA,QAAA,CAAO,WAAA,CAAY,sBAAsB,KAAK,EAAC;AAEjD,IAAA,IAAIA,QAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBAAA,GAAsBA,QAAA,CAAO,GAAA,CAAI,SAAS,CAAA,GAC5CC,4BAAA;AAAA,MACEC,6BAAA,CAAuBF,QAAA,EAAQ,EAAE,GAAA,EAAK,WAAW;AAAA,KACnD,GACA,MAAA;AACJ,IAAA,MAAM,sBAAsB,yBAAA,CAA0B;AAAA,MACpD,OAAA,EAAS;AAAA,KACV,CAAA;AAED,IAAAG,mBAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,IAAA,MAAM,UAAUD,mBAAA,CAAO,QAAA,CAAS,WAAW,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AAC1D,MAAA,MAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,MAAA,MAAA,CAAO,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAErC,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,MAAA,CAAO;AAAA,QAC/B,WAAA,EAAa,SAAA;AAAA;AAAA,QACb,SAAA,EAAW,QAAA;AAAA,QACX,aAAA,EAAe,YAAA;AAAA,QACf,aAAA,EAAe,CAAC,iBAAA,IAAqB,WAAW,CAAA;AAAA,QAChD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,QACvB,4BACE,uBAAA,IAA2B,qBAAA;AAAA,QAC7B,8BAA8B,sBAAA,IAA0B;AAAA,OACzD,CAAA;AACD,MAAA,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAE9B,MAAA,MAAM,WAAW,IAAIC,qBAAA;AAAA,QACnB;AAAA,UACE,MAAA;AAAA,UACA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,QAAA,EACA,QAAA,EACA,IAAA,KACG;AACH,UAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AAEA,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,UAAU,QAAA,EAAS;AAAA,YACrB,EAAE,YAAA,EAAc,QAAA,CAAS,aAAA;AAAc,WACzC;AAAA,QACF;AAAA,OACF;AAEA,MAAA,MAAM,MAAA,GAASC,+CAAA,CAAiC,IAAA,CAAK,QAAQ,CAAA;AAC7D,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAS;AAAA,IACpC,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,iBAAA,EAAmB,OAAA,EAAS,YAAA,EAAc,oBAAA,EAAqB;AAAA,EAC1E,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK;AACtB,IAAA,MAAM,EAAE,iBAAA,EAAmB,OAAA,EAAS,YAAA,EAAa,GAAI,GAAA;AACrD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAA;AAGzB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAG,YAAA;AAAA,MACH,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAOC,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,QAAQ;AAAA,KACjD;AAEA,IAAA,MAAM,SAAS,iBAAA,IAAqB,MAAA;AACpC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,OAAA,CAAQ,MAAA,GAAS,MAAA;AAAA,IACnB;AAEA,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,GAAG;AAAA,KACJ,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,EACA,GAAA,EACmD;AACnD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,GAAA,CAAI,OAAA;AAC/B,IAAA,MAAM,EAAE,QAAQ,WAAA,EAAY,GAC1B,MAAMC,8BAAA,CAAgB,2BAAA,CAGpB,KAAA,CAAM,GAAA,EAAK,QAAQ,CAAA;AAEvB,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,MAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,OAAO,QAAA,CAAS,YAAA;AAAA,QAC7B,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,UAAA,IAAc,QAAA;AAAA,QACzC,KAAA,EAAO,OAAO,QAAA,CAAS,KAAA;AAAA,QACvB,gBAAA,EAAkB,OAAO,QAAA,CAAS,UAAA;AAAA,QAClC,OAAA,EAAS,OAAO,QAAA,CAAS,QAAA;AAAA,QACzB,cAAc,WAAA,CAAY;AAAA;AAC5B,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK;AACxB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,MAAM,YAAY,CAAA;AACxD,IAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,gBAAgB,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,YAAY,CAAA;AAE5D,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAAA,MACpC;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,WAAA,EAAa,EAAE,QAAA,EAAU,QAAA,EAAS;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,aAAa,QAAA,CAAS,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAA,IAAc,QAAA;AAAA,UAClC,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,kBAAkB,QAAA,CAAS,UAAA;AAAA,UAC3B,SAAS,QAAA,CAAS,QAAA;AAAA,UAClB,cAAc,QAAA,CAAS;AAAA;AACzB,OACD,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,MAAA,CAAO,KAAA,EAAO,GAAA,EAAK;AACvB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAQtB,IAAA,IAAI,KAAA,CAAM,YAAA,IAAgB,MAAA,CAAO,mBAAA,EAAqB;AACpD,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA;AAAA,IACxC;AAAA,EACF;AACF,CAAC;;;;"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@backstage/plugin-auth-backend-module-oidc-provider",
3
- "version": "0.0.0-nightly-20260127025640",
3
+ "version": "0.0.0-nightly-20260128025246",
4
4
  "description": "The oidc-provider backend module for the auth plugin.",
5
5
  "backstage": {
6
6
  "role": "backend-plugin-module",
@@ -37,10 +37,10 @@
37
37
  "test": "backstage-cli package test"
38
38
  },
39
39
  "dependencies": {
40
- "@backstage/backend-plugin-api": "0.0.0-nightly-20260127025640",
40
+ "@backstage/backend-plugin-api": "0.0.0-nightly-20260128025246",
41
41
  "@backstage/config": "1.3.6",
42
- "@backstage/plugin-auth-backend": "0.0.0-nightly-20260127025640",
43
- "@backstage/plugin-auth-node": "0.0.0-nightly-20260127025640",
42
+ "@backstage/plugin-auth-backend": "0.0.0-nightly-20260128025246",
43
+ "@backstage/plugin-auth-node": "0.0.0-nightly-20260128025246",
44
44
  "@backstage/types": "1.2.2",
45
45
  "express": "^4.22.0",
46
46
  "openid-client": "^5.5.0",
@@ -48,9 +48,9 @@
48
48
  "zod": "^3.25.76"
49
49
  },
50
50
  "devDependencies": {
51
- "@backstage/backend-defaults": "0.0.0-nightly-20260127025640",
52
- "@backstage/backend-test-utils": "0.0.0-nightly-20260127025640",
53
- "@backstage/cli": "0.0.0-nightly-20260127025640",
51
+ "@backstage/backend-defaults": "0.0.0-nightly-20260128025246",
52
+ "@backstage/backend-test-utils": "0.0.0-nightly-20260128025246",
53
+ "@backstage/cli": "0.0.0-nightly-20260128025246",
54
54
  "@backstage/config": "1.3.6",
55
55
  "@backstage/types": "1.2.2",
56
56
  "cookie-parser": "^1.4.6",