@backstage/plugin-auth-backend-module-oidc-provider 0.3.1-next.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @backstage/plugin-auth-backend-module-oidc-provider
 
+## 0.3.1
+
+### Patch Changes
+
+- 217458a: Updated configuration schema to include the new `allowedDomains` option for the `emailLocalPartMatchingUserEntityName` sign-in resolver.
+- 094eaa3: Remove references to in-repo backend-common
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3
+  - @backstage/plugin-auth-backend@0.23.1
+  - @backstage/backend-plugin-api@1.0.1
+
+## 0.3.1-next.1
+
+### Patch Changes
+
+- 217458a: Updated configuration schema to include the new `allowedDomains` option for the `emailLocalPartMatchingUserEntityName` sign-in resolver.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3-next.1
+  - @backstage/backend-plugin-api@1.0.1-next.1
+  - @backstage/plugin-auth-backend@0.23.1-next.1
+
 ## 0.3.1-next.0
 
 ### Patch Changes

package/config.d.ts

@@ -33,7 +33,10 @@ export interface Config {
           prompt?: string;
           signIn?: {
             resolvers: Array<
-              | { resolver: 'emailLocalPartMatchingUserEntityName' }
+              | {
+                  resolver: 'emailLocalPartMatchingUserEntityName';
+                  allowedDomains?: string[];
+                }
               | { resolver: 'emailMatchingUserEntityProfileEmail' }
             >;
           };

package/dist/authenticator.cjs.js

@@ -0,0 +1,153 @@
+'use strict';
+
+var crypto = require('crypto');
+var openidClient = require('openid-client');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var crypto__default = /*#__PURE__*/_interopDefaultCompat(crypto);
+
+const HTTP_OPTION_TIMEOUT = 1e4;
+const httpOptionsProvider = (_url, options) => {
+  return {
+    ...options,
+    timeout: HTTP_OPTION_TIMEOUT
+  };
+};
+const oidcAuthenticator = pluginAuthNode.createOAuthAuthenticator({
+  defaultProfileTransform: async (input) => ({
+    profile: {
+      email: input.fullProfile.userinfo.email,
+      picture: input.fullProfile.userinfo.picture,
+      displayName: input.fullProfile.userinfo.name
+    }
+  }),
+  scopes: {
+    persist: true,
+    required: ["openid", "profile", "email"]
+  },
+  initialize({ callbackUrl, config }) {
+    const clientId = config.getString("clientId");
+    const clientSecret = config.getString("clientSecret");
+    const metadataUrl = config.getString("metadataUrl");
+    const customCallbackUrl = config.getOptionalString("callbackUrl");
+    const tokenEndpointAuthMethod = config.getOptionalString(
+      "tokenEndpointAuthMethod"
+    );
+    const tokenSignedResponseAlg = config.getOptionalString(
+      "tokenSignedResponseAlg"
+    );
+    const initializedPrompt = config.getOptionalString("prompt");
+    if (config.has("scope")) {
+      throw new Error(
+        'The oidc provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
+      );
+    }
+    openidClient.Issuer[openidClient.custom.http_options] = httpOptionsProvider;
+    const promise = openidClient.Issuer.discover(metadataUrl).then((issuer) => {
+      issuer[openidClient.custom.http_options] = httpOptionsProvider;
+      issuer.Client[openidClient.custom.http_options] = httpOptionsProvider;
+      const client = new issuer.Client({
+        access_type: "offline",
+        // this option must be passed to provider to receive a refresh token
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uris: [customCallbackUrl || callbackUrl],
+        response_types: ["code"],
+        token_endpoint_auth_method: tokenEndpointAuthMethod || "client_secret_basic",
+        id_token_signed_response_alg: tokenSignedResponseAlg || "RS256"
+      });
+      client[openidClient.custom.http_options] = httpOptionsProvider;
+      const strategy = new openidClient.Strategy(
+        {
+          client,
+          passReqToCallback: false
+        },
+        (tokenset, userinfo, done) => {
+          if (typeof done !== "function") {
+            throw new Error(
+              "OIDC IdP must provide a userinfo_endpoint in the metadata response"
+            );
+          }
+          done(
+            void 0,
+            { tokenset, userinfo },
+            { refreshToken: tokenset.refresh_token }
+          );
+        }
+      );
+      const helper = pluginAuthNode.PassportOAuthAuthenticatorHelper.from(strategy);
+      return { helper, client, strategy };
+    });
+    return { initializedPrompt, promise };
+  },
+  async start(input, ctx) {
+    const { initializedPrompt, promise } = ctx;
+    const { helper, strategy } = await promise;
+    const options = {
+      scope: input.scope,
+      state: input.state,
+      nonce: crypto__default.default.randomBytes(16).toString("base64")
+    };
+    const prompt = initializedPrompt || "none";
+    if (prompt !== "auto") {
+      options.prompt = prompt;
+    }
+    return new Promise((resolve, reject) => {
+      strategy.error = reject;
+      return helper.start(input, {
+        ...options
+      }).then(resolve);
+    });
+  },
+  async authenticate(input, ctx) {
+    const { strategy } = await ctx.promise;
+    const { result, privateInfo } = await pluginAuthNode.PassportHelpers.executeFrameHandlerStrategy(input.req, strategy);
+    return {
+      fullProfile: result,
+      session: {
+        accessToken: result.tokenset.access_token,
+        tokenType: result.tokenset.token_type ?? "bearer",
+        scope: result.tokenset.scope,
+        expiresInSeconds: result.tokenset.expires_in,
+        idToken: result.tokenset.id_token,
+        refreshToken: privateInfo.refreshToken
+      }
+    };
+  },
+  async refresh(input, ctx) {
+    const { client } = await ctx.promise;
+    const tokenset = await client.refresh(input.refreshToken);
+    if (!tokenset.access_token) {
+      throw new Error("Refresh failed");
+    }
+    const userinfo = await client.userinfo(tokenset.access_token);
+    return new Promise((resolve, reject) => {
+      if (!tokenset.access_token) {
+        reject(new Error("Refresh Failed"));
+      }
+      resolve({
+        fullProfile: { userinfo, tokenset },
+        session: {
+          accessToken: tokenset.access_token,
+          tokenType: tokenset.token_type ?? "bearer",
+          scope: tokenset.scope,
+          expiresInSeconds: tokenset.expires_in,
+          idToken: tokenset.id_token,
+          refreshToken: tokenset.refresh_token
+        }
+      });
+    });
+  },
+  async logout(input, ctx) {
+    const { client } = await ctx.promise;
+    const issuer = client.issuer;
+    if (input.refreshToken && issuer.revocation_endpoint) {
+      await client.revoke(input.refreshToken);
+    }
+  }
+});
+
+exports.oidcAuthenticator = oidcAuthenticator;
+//# sourceMappingURL=authenticator.cjs.js.map

package/dist/authenticator.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport crypto from 'crypto';\nimport {\n  custom,\n  CustomHttpOptionsProvider,\n  Issuer,\n  ClientAuthMethod,\n  TokenSet,\n  UserinfoResponse,\n  Strategy as OidcStrategy,\n} from 'openid-client';\nimport {\n  createOAuthAuthenticator,\n  OAuthAuthenticatorResult,\n  PassportDoneCallback,\n  PassportHelpers,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthPrivateInfo,\n} from '@backstage/plugin-auth-node';\n\nconst HTTP_OPTION_TIMEOUT = 10000;\nconst httpOptionsProvider: CustomHttpOptionsProvider = (_url, options) => {\n  return {\n    ...options,\n    timeout: HTTP_OPTION_TIMEOUT,\n  };\n};\n\n/**\n * authentication result for the OIDC which includes the token set and user\n * profile response\n * @public\n */\nexport type OidcAuthResult = {\n  tokenset: TokenSet;\n  userinfo: UserinfoResponse;\n};\n\n/** @public */\nexport const oidcAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform: async (\n    input: OAuthAuthenticatorResult<OidcAuthResult>,\n  ) => ({\n    profile: {\n      email: input.fullProfile.userinfo.email,\n      picture: input.fullProfile.userinfo.picture,\n      displayName: input.fullProfile.userinfo.name,\n    },\n  }),\n  scopes: {\n    persist: true,\n    required: ['openid', 'profile', 'email'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const metadataUrl = config.getString('metadataUrl');\n    const customCallbackUrl = config.getOptionalString('callbackUrl');\n    const tokenEndpointAuthMethod = config.getOptionalString(\n      'tokenEndpointAuthMethod',\n    ) as ClientAuthMethod;\n    const tokenSignedResponseAlg = config.getOptionalString(\n      'tokenSignedResponseAlg',\n    );\n    const initializedPrompt = config.getOptionalString('prompt');\n\n    if (config.has('scope')) {\n      throw new Error(\n        'The oidc provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n\n    Issuer[custom.http_options] = httpOptionsProvider;\n    const promise = Issuer.discover(metadataUrl).then(issuer => {\n      issuer[custom.http_options] = httpOptionsProvider;\n      issuer.Client[custom.http_options] = httpOptionsProvider;\n\n      const client = new issuer.Client({\n        access_type: 'offline', // this option must be passed to provider to receive a refresh token\n        client_id: clientId,\n        client_secret: clientSecret,\n        redirect_uris: [customCallbackUrl || callbackUrl],\n        response_types: ['code'],\n        token_endpoint_auth_method:\n          tokenEndpointAuthMethod || 'client_secret_basic',\n        id_token_signed_response_alg: tokenSignedResponseAlg || 'RS256',\n      });\n      client[custom.http_options] = httpOptionsProvider;\n\n      const strategy = new OidcStrategy(\n        {\n          client,\n          passReqToCallback: false,\n        },\n        (\n          tokenset: TokenSet,\n          userinfo: UserinfoResponse,\n          done: PassportDoneCallback<OidcAuthResult, PassportOAuthPrivateInfo>,\n        ) => {\n          if (typeof done !== 'function') {\n            throw new Error(\n              'OIDC IdP must provide a userinfo_endpoint in the metadata response',\n            );\n          }\n\n          done(\n            undefined,\n            { tokenset, userinfo },\n            { refreshToken: tokenset.refresh_token },\n          );\n        },\n      );\n\n      const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n      return { helper, client, strategy };\n    });\n\n    return { initializedPrompt, promise };\n  },\n\n  async start(input, ctx) {\n    const { initializedPrompt, promise } = ctx;\n    const { helper, strategy } = await promise;\n    const options: Record<string, string> = {\n      scope: input.scope,\n      state: input.state,\n      nonce: crypto.randomBytes(16).toString('base64'),\n    };\n    const prompt = initializedPrompt || 'none';\n    if (prompt !== 'auto') {\n      options.prompt = prompt;\n    }\n\n    return new Promise((resolve, reject) => {\n      strategy.error = reject;\n\n      return helper\n        .start(input, {\n          ...options,\n        })\n        .then(resolve);\n    });\n  },\n\n  async authenticate(\n    input,\n    ctx,\n  ): Promise<OAuthAuthenticatorResult<OidcAuthResult>> {\n    const { strategy } = await ctx.promise;\n    const { result, privateInfo } =\n      await PassportHelpers.executeFrameHandlerStrategy<\n        OidcAuthResult,\n        PassportOAuthPrivateInfo\n      >(input.req, strategy);\n\n    return {\n      fullProfile: result,\n      session: {\n        accessToken: result.tokenset.access_token!,\n        tokenType: result.tokenset.token_type ?? 'bearer',\n        scope: result.tokenset.scope!,\n        expiresInSeconds: result.tokenset.expires_in,\n        idToken: result.tokenset.id_token,\n        refreshToken: privateInfo.refreshToken,\n      },\n    };\n  },\n\n  async refresh(input, ctx) {\n    const { client } = await ctx.promise;\n    const tokenset = await client.refresh(input.refreshToken);\n    if (!tokenset.access_token) {\n      throw new Error('Refresh failed');\n    }\n    const userinfo = await client.userinfo(tokenset.access_token);\n\n    return new Promise((resolve, reject) => {\n      if (!tokenset.access_token) {\n        reject(new Error('Refresh Failed'));\n      }\n      resolve({\n        fullProfile: { userinfo, tokenset },\n        session: {\n          accessToken: tokenset.access_token!,\n          tokenType: tokenset.token_type ?? 'bearer',\n          scope: tokenset.scope!,\n          expiresInSeconds: tokenset.expires_in,\n          idToken: tokenset.id_token,\n          refreshToken: tokenset.refresh_token,\n        },\n      });\n    });\n  },\n\n  async logout(input, ctx) {\n    const { client } = await ctx.promise;\n    const issuer = client.issuer;\n    /**\n     * https://github.com/panva/node-openid-client/blob/main/lib/client.js#L1398\n     * client.revoke will check revocation_endpoint and if undefined throw error。\n     *\n     * if oidc server do not provide revocation_endpoint，we should not call revoke function\n     */\n\n    if (input.refreshToken && issuer.revocation_endpoint) {\n      await client.revoke(input.refreshToken);\n    }\n  },\n});\n"],"names":["createOAuthAuthenticator","Issuer","custom","OidcStrategy","PassportOAuthAuthenticatorHelper","crypto","PassportHelpers"],"mappings":";;;;;;;;;;AAmCA,MAAM,mBAAsB,GAAA,GAAA,CAAA;AAC5B,MAAM,mBAAA,GAAiD,CAAC,IAAA,EAAM,OAAY,KAAA;AACxE,EAAO,OAAA;AAAA,IACL,GAAG,OAAA;AAAA,IACH,OAAS,EAAA,mBAAA;AAAA,GACX,CAAA;AACF,CAAA,CAAA;AAaO,MAAM,oBAAoBA,uCAAyB,CAAA;AAAA,EACxD,uBAAA,EAAyB,OACvB,KACI,MAAA;AAAA,IACJ,OAAS,EAAA;AAAA,MACP,KAAA,EAAO,KAAM,CAAA,WAAA,CAAY,QAAS,CAAA,KAAA;AAAA,MAClC,OAAA,EAAS,KAAM,CAAA,WAAA,CAAY,QAAS,CAAA,OAAA;AAAA,MACpC,WAAA,EAAa,KAAM,CAAA,WAAA,CAAY,QAAS,CAAA,IAAA;AAAA,KAC1C;AAAA,GACF,CAAA;AAAA,EACA,MAAQ,EAAA;AAAA,IACN,OAAS,EAAA,IAAA;AAAA,IACT,QAAU,EAAA,CAAC,QAAU,EAAA,SAAA,EAAW,OAAO,CAAA;AAAA,GACzC;AAAA,EACA,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAM,MAAA,QAAA,GAAW,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA,CAAA;AAC5C,IAAM,MAAA,YAAA,GAAe,MAAO,CAAA,SAAA,CAAU,cAAc,CAAA,CAAA;AACpD,IAAM,MAAA,WAAA,GAAc,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA,CAAA;AAClD,IAAM,MAAA,iBAAA,GAAoB,MAAO,CAAA,iBAAA,CAAkB,aAAa,CAAA,CAAA;AAChE,IAAA,MAAM,0BAA0B,MAAO,CAAA,iBAAA;AAAA,MACrC,yBAAA;AAAA,KACF,CAAA;AACA,IAAA,MAAM,yBAAyB,MAAO,CAAA,iBAAA;AAAA,MACpC,wBAAA;AAAA,KACF,CAAA;AACA,IAAM,MAAA,iBAAA,GAAoB,MAAO,CAAA,iBAAA,CAAkB,QAAQ,CAAA,CAAA;AAE3D,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,OAAO,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,0HAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAOC,mBAAA,CAAAC,mBAAA,CAAO,YAAY,CAAI,GAAA,mBAAA,CAAA;AAC9B,IAAA,MAAM,UAAUD,mBAAO,CAAA,QAAA,CAAS,WAAW,CAAA,CAAE,KAAK,CAAU,MAAA,KAAA;AAC1D,MAAO,MAAA,CAAAC,mBAAA,CAAO,YAAY,CAAI,GAAA,mBAAA,CAAA;AAC9B,MAAO,MAAA,CAAA,MAAA,CAAOA,mBAAO,CAAA,YAAY,CAAI,GAAA,mBAAA,CAAA;AAErC,MAAM,MAAA,MAAA,GAAS,IAAI,MAAA,CAAO,MAAO,CAAA;AAAA,QAC/B,WAAa,EAAA,SAAA;AAAA;AAAA,QACb,SAAW,EAAA,QAAA;AAAA,QACX,aAAe,EAAA,YAAA;AAAA,QACf,aAAA,EAAe,CAAC,iBAAA,IAAqB,WAAW,CAAA;AAAA,QAChD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,QACvB,4BACE,uBAA2B,IAAA,qBAAA;AAAA,QAC7B,8BAA8B,sBAA0B,IAAA,OAAA;AAAA,OACzD,CAAA,CAAA;AACD,MAAO,MAAA,CAAAA,mBAAA,CAAO,YAAY,CAAI,GAAA,mBAAA,CAAA;AAE9B,MAAA,MAAM,WAAW,IAAIC,qBAAA;AAAA,QACnB;AAAA,UACE,MAAA;AAAA,UACA,iBAAmB,EAAA,KAAA;AAAA,SACrB;AAAA,QACA,CACE,QACA,EAAA,QAAA,EACA,IACG,KAAA;AACH,UAAI,IAAA,OAAO,SAAS,UAAY,EAAA;AAC9B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,oEAAA;AAAA,aACF,CAAA;AAAA,WACF;AAEA,UAAA,IAAA;AAAA,YACE,KAAA,CAAA;AAAA,YACA,EAAE,UAAU,QAAS,EAAA;AAAA,YACrB,EAAE,YAAc,EAAA,QAAA,CAAS,aAAc,EAAA;AAAA,WACzC,CAAA;AAAA,SACF;AAAA,OACF,CAAA;AAEA,MAAM,MAAA,MAAA,GAASC,+CAAiC,CAAA,IAAA,CAAK,QAAQ,CAAA,CAAA;AAC7D,MAAO,OAAA,EAAE,MAAQ,EAAA,MAAA,EAAQ,QAAS,EAAA,CAAA;AAAA,KACnC,CAAA,CAAA;AAED,IAAO,OAAA,EAAE,mBAAmB,OAAQ,EAAA,CAAA;AAAA,GACtC;AAAA,EAEA,MAAM,KAAM,CAAA,KAAA,EAAO,GAAK,EAAA;AACtB,IAAM,MAAA,EAAE,iBAAmB,EAAA,OAAA,EAAY,GAAA,GAAA,CAAA;AACvC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAS,EAAA,GAAI,MAAM,OAAA,CAAA;AACnC,IAAA,MAAM,OAAkC,GAAA;AAAA,MACtC,OAAO,KAAM,CAAA,KAAA;AAAA,MACb,OAAO,KAAM,CAAA,KAAA;AAAA,MACb,OAAOC,uBAAO,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,KACjD,CAAA;AACA,IAAA,MAAM,SAAS,iBAAqB,IAAA,MAAA,CAAA;AACpC,IAAA,IAAI,WAAW,MAAQ,EAAA;AACrB,MAAA,OAAA,CAAQ,MAAS,GAAA,MAAA,CAAA;AAAA,KACnB;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAA,QAAA,CAAS,KAAQ,GAAA,MAAA,CAAA;AAEjB,MAAO,OAAA,MAAA,CACJ,MAAM,KAAO,EAAA;AAAA,QACZ,GAAG,OAAA;AAAA,OACJ,CACA,CAAA,IAAA,CAAK,OAAO,CAAA,CAAA;AAAA,KAChB,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YACJ,CAAA,KAAA,EACA,GACmD,EAAA;AACnD,IAAA,MAAM,EAAE,QAAA,EAAa,GAAA,MAAM,GAAI,CAAA,OAAA,CAAA;AAC/B,IAAM,MAAA,EAAE,QAAQ,WAAY,EAAA,GAC1B,MAAMC,8BAAgB,CAAA,2BAAA,CAGpB,KAAM,CAAA,GAAA,EAAK,QAAQ,CAAA,CAAA;AAEvB,IAAO,OAAA;AAAA,MACL,WAAa,EAAA,MAAA;AAAA,MACb,OAAS,EAAA;AAAA,QACP,WAAA,EAAa,OAAO,QAAS,CAAA,YAAA;AAAA,QAC7B,SAAA,EAAW,MAAO,CAAA,QAAA,CAAS,UAAc,IAAA,QAAA;AAAA,QACzC,KAAA,EAAO,OAAO,QAAS,CAAA,KAAA;AAAA,QACvB,gBAAA,EAAkB,OAAO,QAAS,CAAA,UAAA;AAAA,QAClC,OAAA,EAAS,OAAO,QAAS,CAAA,QAAA;AAAA,QACzB,cAAc,WAAY,CAAA,YAAA;AAAA,OAC5B;AAAA,KACF,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,GAAK,EAAA;AACxB,IAAA,MAAM,EAAE,MAAA,EAAW,GAAA,MAAM,GAAI,CAAA,OAAA,CAAA;AAC7B,IAAA,MAAM,QAAW,GAAA,MAAM,MAAO,CAAA,OAAA,CAAQ,MAAM,YAAY,CAAA,CAAA;AACxD,IAAI,IAAA,CAAC,SAAS,YAAc,EAAA;AAC1B,MAAM,MAAA,IAAI,MAAM,gBAAgB,CAAA,CAAA;AAAA,KAClC;AACA,IAAA,MAAM,QAAW,GAAA,MAAM,MAAO,CAAA,QAAA,CAAS,SAAS,YAAY,CAAA,CAAA;AAE5D,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAI,IAAA,CAAC,SAAS,YAAc,EAAA;AAC1B,QAAO,MAAA,CAAA,IAAI,KAAM,CAAA,gBAAgB,CAAC,CAAA,CAAA;AAAA,OACpC;AACA,MAAQ,OAAA,CAAA;AAAA,QACN,WAAA,EAAa,EAAE,QAAA,EAAU,QAAS,EAAA;AAAA,QAClC,OAAS,EAAA;AAAA,UACP,aAAa,QAAS,CAAA,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAc,IAAA,QAAA;AAAA,UAClC,OAAO,QAAS,CAAA,KAAA;AAAA,UAChB,kBAAkB,QAAS,CAAA,UAAA;AAAA,UAC3B,SAAS,QAAS,CAAA,QAAA;AAAA,UAClB,cAAc,QAAS,CAAA,aAAA;AAAA,SACzB;AAAA,OACD,CAAA,CAAA;AAAA,KACF,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,MAAO,CAAA,KAAA,EAAO,GAAK,EAAA;AACvB,IAAA,MAAM,EAAE,MAAA,EAAW,GAAA,MAAM,GAAI,CAAA,OAAA,CAAA;AAC7B,IAAA,MAAM,SAAS,MAAO,CAAA,MAAA,CAAA;AAQtB,IAAI,IAAA,KAAA,CAAM,YAAgB,IAAA,MAAA,CAAO,mBAAqB,EAAA;AACpD,MAAM,MAAA,MAAA,CAAO,MAAO,CAAA,KAAA,CAAM,YAAY,CAAA,CAAA;AAAA,KACxC;AAAA,GACF;AACF,CAAC;;;;"}

package/dist/index.cjs.js

@@ -2,186 +2,16 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var crypto = require('crypto');
-var openidClient = require('openid-client');
-var pluginAuthNode = require('@backstage/plugin-auth-node');
-var backendPluginApi = require('@backstage/backend-plugin-api');
+var authenticator = require('./authenticator.cjs.js');
+var module$1 = require('./module.cjs.js');
+var resolvers = require('./resolvers.cjs.js');
 
-function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
-var crypto__default = /*#__PURE__*/_interopDefaultCompat(crypto);
 
-const HTTP_OPTION_TIMEOUT = 1e4;
-const httpOptionsProvider = (_url, options) => {
-  return {
-    ...options,
-    timeout: HTTP_OPTION_TIMEOUT
-  };
-};
-const oidcAuthenticator = pluginAuthNode.createOAuthAuthenticator({
-  defaultProfileTransform: async (input) => ({
-    profile: {
-      email: input.fullProfile.userinfo.email,
-      picture: input.fullProfile.userinfo.picture,
-      displayName: input.fullProfile.userinfo.name
-    }
-  }),
-  scopes: {
-    persist: true,
-    required: ["openid", "profile", "email"]
-  },
-  initialize({ callbackUrl, config }) {
-    const clientId = config.getString("clientId");
-    const clientSecret = config.getString("clientSecret");
-    const metadataUrl = config.getString("metadataUrl");
-    const customCallbackUrl = config.getOptionalString("callbackUrl");
-    const tokenEndpointAuthMethod = config.getOptionalString(
-      "tokenEndpointAuthMethod"
-    );
-    const tokenSignedResponseAlg = config.getOptionalString(
-      "tokenSignedResponseAlg"
-    );
-    const initializedPrompt = config.getOptionalString("prompt");
-    if (config.has("scope")) {
-      throw new Error(
-        'The oidc provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
-      );
-    }
-    openidClient.Issuer[openidClient.custom.http_options] = httpOptionsProvider;
-    const promise = openidClient.Issuer.discover(metadataUrl).then((issuer) => {
-      issuer[openidClient.custom.http_options] = httpOptionsProvider;
-      issuer.Client[openidClient.custom.http_options] = httpOptionsProvider;
-      const client = new issuer.Client({
-        access_type: "offline",
-        // this option must be passed to provider to receive a refresh token
-        client_id: clientId,
-        client_secret: clientSecret,
-        redirect_uris: [customCallbackUrl || callbackUrl],
-        response_types: ["code"],
-        token_endpoint_auth_method: tokenEndpointAuthMethod || "client_secret_basic",
-        id_token_signed_response_alg: tokenSignedResponseAlg || "RS256"
-      });
-      client[openidClient.custom.http_options] = httpOptionsProvider;
-      const strategy = new openidClient.Strategy(
-        {
-          client,
-          passReqToCallback: false
-        },
-        (tokenset, userinfo, done) => {
-          if (typeof done !== "function") {
-            throw new Error(
-              "OIDC IdP must provide a userinfo_endpoint in the metadata response"
-            );
-          }
-          done(
-            void 0,
-            { tokenset, userinfo },
-            { refreshToken: tokenset.refresh_token }
-          );
-        }
-      );
-      const helper = pluginAuthNode.PassportOAuthAuthenticatorHelper.from(strategy);
-      return { helper, client, strategy };
-    });
-    return { initializedPrompt, promise };
-  },
-  async start(input, ctx) {
-    const { initializedPrompt, promise } = ctx;
-    const { helper, strategy } = await promise;
-    const options = {
-      scope: input.scope,
-      state: input.state,
-      nonce: crypto__default.default.randomBytes(16).toString("base64")
-    };
-    const prompt = initializedPrompt || "none";
-    if (prompt !== "auto") {
-      options.prompt = prompt;
-    }
-    return new Promise((resolve, reject) => {
-      strategy.error = reject;
-      return helper.start(input, {
-        ...options
-      }).then(resolve);
-    });
-  },
-  async authenticate(input, ctx) {
-    const { strategy } = await ctx.promise;
-    const { result, privateInfo } = await pluginAuthNode.PassportHelpers.executeFrameHandlerStrategy(input.req, strategy);
-    return {
-      fullProfile: result,
-      session: {
-        accessToken: result.tokenset.access_token,
-        tokenType: result.tokenset.token_type ?? "bearer",
-        scope: result.tokenset.scope,
-        expiresInSeconds: result.tokenset.expires_in,
-        idToken: result.tokenset.id_token,
-        refreshToken: privateInfo.refreshToken
-      }
-    };
-  },
-  async refresh(input, ctx) {
-    const { client } = await ctx.promise;
-    const tokenset = await client.refresh(input.refreshToken);
-    if (!tokenset.access_token) {
-      throw new Error("Refresh failed");
-    }
-    const userinfo = await client.userinfo(tokenset.access_token);
-    return new Promise((resolve, reject) => {
-      if (!tokenset.access_token) {
-        reject(new Error("Refresh Failed"));
-      }
-      resolve({
-        fullProfile: { userinfo, tokenset },
-        session: {
-          accessToken: tokenset.access_token,
-          tokenType: tokenset.token_type ?? "bearer",
-          scope: tokenset.scope,
-          expiresInSeconds: tokenset.expires_in,
-          idToken: tokenset.id_token,
-          refreshToken: tokenset.refresh_token
-        }
-      });
-    });
-  },
-  async logout(input, ctx) {
-    const { client } = await ctx.promise;
-    const issuer = client.issuer;
-    if (input.refreshToken && issuer.revocation_endpoint) {
-      await client.revoke(input.refreshToken);
-    }
-  }
+exports.oidcAuthenticator = authenticator.oidcAuthenticator;
+exports.default = module$1.authModuleOidcProvider;
+Object.defineProperty(exports, "oidcSignInResolvers", {
+	enumerable: true,
+	get: function () { return resolvers.oidcSignInResolvers; }
 });
-
-exports.oidcSignInResolvers = void 0;
-((oidcSignInResolvers2) => {
-  oidcSignInResolvers2.emailLocalPartMatchingUserEntityName = pluginAuthNode.commonSignInResolvers.emailLocalPartMatchingUserEntityName;
-  oidcSignInResolvers2.emailMatchingUserEntityProfileEmail = pluginAuthNode.commonSignInResolvers.emailMatchingUserEntityProfileEmail;
-})(exports.oidcSignInResolvers || (exports.oidcSignInResolvers = {}));
-
-const authModuleOidcProvider = backendPluginApi.createBackendModule({
-  pluginId: "auth",
-  moduleId: "oidc-provider",
-  register(reg) {
-    reg.registerInit({
-      deps: {
-        providers: pluginAuthNode.authProvidersExtensionPoint
-      },
-      async init({ providers }) {
-        providers.registerProvider({
-          providerId: "oidc",
-          factory: pluginAuthNode.createOAuthProviderFactory({
-            authenticator: oidcAuthenticator,
-            signInResolverFactories: {
-              ...exports.oidcSignInResolvers,
-              ...pluginAuthNode.commonSignInResolvers
-            }
-          })
-        });
-      }
-    });
-  }
-});
-
-exports.default = authModuleOidcProvider;
-exports.oidcAuthenticator = oidcAuthenticator;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/authenticator.ts","../src/resolvers.ts","../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport crypto from 'crypto';\nimport {\n  custom,\n  CustomHttpOptionsProvider,\n  Issuer,\n  ClientAuthMethod,\n  TokenSet,\n  UserinfoResponse,\n  Strategy as OidcStrategy,\n} from 'openid-client';\nimport {\n  createOAuthAuthenticator,\n  OAuthAuthenticatorResult,\n  PassportDoneCallback,\n  PassportHelpers,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthPrivateInfo,\n} from '@backstage/plugin-auth-node';\n\nconst HTTP_OPTION_TIMEOUT = 10000;\nconst httpOptionsProvider: CustomHttpOptionsProvider = (_url, options) => {\n  return {\n    ...options,\n    timeout: HTTP_OPTION_TIMEOUT,\n  };\n};\n\n/**\n * authentication result for the OIDC which includes the token set and user\n * profile response\n * @public\n */\nexport type OidcAuthResult = {\n  tokenset: TokenSet;\n  userinfo: UserinfoResponse;\n};\n\n/** @public */\nexport const oidcAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform: async (\n    input: OAuthAuthenticatorResult<OidcAuthResult>,\n  ) => ({\n    profile: {\n      email: input.fullProfile.userinfo.email,\n      picture: input.fullProfile.userinfo.picture,\n      displayName: input.fullProfile.userinfo.name,\n    },\n  }),\n  scopes: {\n    persist: true,\n    required: ['openid', 'profile', 'email'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const metadataUrl = config.getString('metadataUrl');\n    const customCallbackUrl = config.getOptionalString('callbackUrl');\n    const tokenEndpointAuthMethod = config.getOptionalString(\n      'tokenEndpointAuthMethod',\n    ) as ClientAuthMethod;\n    const tokenSignedResponseAlg = config.getOptionalString(\n      'tokenSignedResponseAlg',\n    );\n    const initializedPrompt = config.getOptionalString('prompt');\n\n    if (config.has('scope')) {\n      throw new Error(\n        'The oidc provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n\n    Issuer[custom.http_options] = httpOptionsProvider;\n    const promise = Issuer.discover(metadataUrl).then(issuer => {\n      issuer[custom.http_options] = httpOptionsProvider;\n      issuer.Client[custom.http_options] = httpOptionsProvider;\n\n      const client = new issuer.Client({\n        access_type: 'offline', // this option must be passed to provider to receive a refresh token\n        client_id: clientId,\n        client_secret: clientSecret,\n        redirect_uris: [customCallbackUrl || callbackUrl],\n        response_types: ['code'],\n        token_endpoint_auth_method:\n          tokenEndpointAuthMethod || 'client_secret_basic',\n        id_token_signed_response_alg: tokenSignedResponseAlg || 'RS256',\n      });\n      client[custom.http_options] = httpOptionsProvider;\n\n      const strategy = new OidcStrategy(\n        {\n          client,\n          passReqToCallback: false,\n        },\n        (\n          tokenset: TokenSet,\n          userinfo: UserinfoResponse,\n          done: PassportDoneCallback<OidcAuthResult, PassportOAuthPrivateInfo>,\n        ) => {\n          if (typeof done !== 'function') {\n            throw new Error(\n              'OIDC IdP must provide a userinfo_endpoint in the metadata response',\n            );\n          }\n\n          done(\n            undefined,\n            { tokenset, userinfo },\n            { refreshToken: tokenset.refresh_token },\n          );\n        },\n      );\n\n      const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n      return { helper, client, strategy };\n    });\n\n    return { initializedPrompt, promise };\n  },\n\n  async start(input, ctx) {\n    const { initializedPrompt, promise } = ctx;\n    const { helper, strategy } = await promise;\n    const options: Record<string, string> = {\n      scope: input.scope,\n      state: input.state,\n      nonce: crypto.randomBytes(16).toString('base64'),\n    };\n    const prompt = initializedPrompt || 'none';\n    if (prompt !== 'auto') {\n      options.prompt = prompt;\n    }\n\n    return new Promise((resolve, reject) => {\n      strategy.error = reject;\n\n      return helper\n        .start(input, {\n          ...options,\n        })\n        .then(resolve);\n    });\n  },\n\n  async authenticate(\n    input,\n    ctx,\n  ): Promise<OAuthAuthenticatorResult<OidcAuthResult>> {\n    const { strategy } = await ctx.promise;\n    const { result, privateInfo } =\n      await PassportHelpers.executeFrameHandlerStrategy<\n        OidcAuthResult,\n        PassportOAuthPrivateInfo\n      >(input.req, strategy);\n\n    return {\n      fullProfile: result,\n      session: {\n        accessToken: result.tokenset.access_token!,\n        tokenType: result.tokenset.token_type ?? 'bearer',\n        scope: result.tokenset.scope!,\n        expiresInSeconds: result.tokenset.expires_in,\n        idToken: result.tokenset.id_token,\n        refreshToken: privateInfo.refreshToken,\n      },\n    };\n  },\n\n  async refresh(input, ctx) {\n    const { client } = await ctx.promise;\n    const tokenset = await client.refresh(input.refreshToken);\n    if (!tokenset.access_token) {\n      throw new Error('Refresh failed');\n    }\n    const userinfo = await client.userinfo(tokenset.access_token);\n\n    return new Promise((resolve, reject) => {\n      if (!tokenset.access_token) {\n        reject(new Error('Refresh Failed'));\n      }\n      resolve({\n        fullProfile: { userinfo, tokenset },\n        session: {\n          accessToken: tokenset.access_token!,\n          tokenType: tokenset.token_type ?? 'bearer',\n          scope: tokenset.scope!,\n          expiresInSeconds: tokenset.expires_in,\n          idToken: tokenset.id_token,\n          refreshToken: tokenset.refresh_token,\n        },\n      });\n    });\n  },\n\n  async logout(input, ctx) {\n    const { client } = await ctx.promise;\n    const issuer = client.issuer;\n    /**\n     * https://github.com/panva/node-openid-client/blob/main/lib/client.js#L1398\n     * client.revoke will check revocation_endpoint and if undefined throw error。\n     *\n     * if oidc server do not provide revocation_endpoint，we should not call revoke function\n     */\n\n    if (input.refreshToken && issuer.revocation_endpoint) {\n      await client.revoke(input.refreshToken);\n    }\n  },\n});\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { commonSignInResolvers } from '@backstage/plugin-auth-node';\n\n/**\n * Available sign-in resolvers for the Oidc auth provider.\n *\n * @public\n */\nexport namespace oidcSignInResolvers {\n  /**\n   * A oidc resolver that looks up the user using the local part of\n   * their email address as the entity name.\n   */\n  export const emailLocalPartMatchingUserEntityName =\n    commonSignInResolvers.emailLocalPartMatchingUserEntityName;\n\n  /**\n   * A oidc resolver that looks up the user using their email address\n   * as email of the entity.\n   */\n  export const emailMatchingUserEntityProfileEmail =\n    commonSignInResolvers.emailMatchingUserEntityProfileEmail;\n}\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { oidcAuthenticator } from './authenticator';\nimport { oidcSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleOidcProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'oidc-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'oidc',\n          factory: createOAuthProviderFactory({\n            authenticator: oidcAuthenticator,\n            signInResolverFactories: {\n              ...oidcSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createOAuthAuthenticator","Issuer","custom","OidcStrategy","PassportOAuthAuthenticatorHelper","crypto","PassportHelpers","oidcSignInResolvers","commonSignInResolvers","createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory"],"mappings":";;;;;;;;;;;;;AAmCA,MAAM,mBAAsB,GAAA,GAAA,CAAA;AAC5B,MAAM,mBAAA,GAAiD,CAAC,IAAA,EAAM,OAAY,KAAA;AACxE,EAAO,OAAA;AAAA,IACL,GAAG,OAAA;AAAA,IACH,OAAS,EAAA,mBAAA;AAAA,GACX,CAAA;AACF,CAAA,CAAA;AAaO,MAAM,oBAAoBA,uCAAyB,CAAA;AAAA,EACxD,uBAAA,EAAyB,OACvB,KACI,MAAA;AAAA,IACJ,OAAS,EAAA;AAAA,MACP,KAAA,EAAO,KAAM,CAAA,WAAA,CAAY,QAAS,CAAA,KAAA;AAAA,MAClC,OAAA,EAAS,KAAM,CAAA,WAAA,CAAY,QAAS,CAAA,OAAA;AAAA,MACpC,WAAA,EAAa,KAAM,CAAA,WAAA,CAAY,QAAS,CAAA,IAAA;AAAA,KAC1C;AAAA,GACF,CAAA;AAAA,EACA,MAAQ,EAAA;AAAA,IACN,OAAS,EAAA,IAAA;AAAA,IACT,QAAU,EAAA,CAAC,QAAU,EAAA,SAAA,EAAW,OAAO,CAAA;AAAA,GACzC;AAAA,EACA,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAM,MAAA,QAAA,GAAW,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA,CAAA;AAC5C,IAAM,MAAA,YAAA,GAAe,MAAO,CAAA,SAAA,CAAU,cAAc,CAAA,CAAA;AACpD,IAAM,MAAA,WAAA,GAAc,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA,CAAA;AAClD,IAAM,MAAA,iBAAA,GAAoB,MAAO,CAAA,iBAAA,CAAkB,aAAa,CAAA,CAAA;AAChE,IAAA,MAAM,0BAA0B,MAAO,CAAA,iBAAA;AAAA,MACrC,yBAAA;AAAA,KACF,CAAA;AACA,IAAA,MAAM,yBAAyB,MAAO,CAAA,iBAAA;AAAA,MACpC,wBAAA;AAAA,KACF,CAAA;AACA,IAAM,MAAA,iBAAA,GAAoB,MAAO,CAAA,iBAAA,CAAkB,QAAQ,CAAA,CAAA;AAE3D,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,OAAO,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,0HAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAOC,mBAAA,CAAAC,mBAAA,CAAO,YAAY,CAAI,GAAA,mBAAA,CAAA;AAC9B,IAAA,MAAM,UAAUD,mBAAO,CAAA,QAAA,CAAS,WAAW,CAAA,CAAE,KAAK,CAAU,MAAA,KAAA;AAC1D,MAAO,MAAA,CAAAC,mBAAA,CAAO,YAAY,CAAI,GAAA,mBAAA,CAAA;AAC9B,MAAO,MAAA,CAAA,MAAA,CAAOA,mBAAO,CAAA,YAAY,CAAI,GAAA,mBAAA,CAAA;AAErC,MAAM,MAAA,MAAA,GAAS,IAAI,MAAA,CAAO,MAAO,CAAA;AAAA,QAC/B,WAAa,EAAA,SAAA;AAAA;AAAA,QACb,SAAW,EAAA,QAAA;AAAA,QACX,aAAe,EAAA,YAAA;AAAA,QACf,aAAA,EAAe,CAAC,iBAAA,IAAqB,WAAW,CAAA;AAAA,QAChD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,QACvB,4BACE,uBAA2B,IAAA,qBAAA;AAAA,QAC7B,8BAA8B,sBAA0B,IAAA,OAAA;AAAA,OACzD,CAAA,CAAA;AACD,MAAO,MAAA,CAAAA,mBAAA,CAAO,YAAY,CAAI,GAAA,mBAAA,CAAA;AAE9B,MAAA,MAAM,WAAW,IAAIC,qBAAA;AAAA,QACnB;AAAA,UACE,MAAA;AAAA,UACA,iBAAmB,EAAA,KAAA;AAAA,SACrB;AAAA,QACA,CACE,QACA,EAAA,QAAA,EACA,IACG,KAAA;AACH,UAAI,IAAA,OAAO,SAAS,UAAY,EAAA;AAC9B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,oEAAA;AAAA,aACF,CAAA;AAAA,WACF;AAEA,UAAA,IAAA;AAAA,YACE,KAAA,CAAA;AAAA,YACA,EAAE,UAAU,QAAS,EAAA;AAAA,YACrB,EAAE,YAAc,EAAA,QAAA,CAAS,aAAc,EAAA;AAAA,WACzC,CAAA;AAAA,SACF;AAAA,OACF,CAAA;AAEA,MAAM,MAAA,MAAA,GAASC,+CAAiC,CAAA,IAAA,CAAK,QAAQ,CAAA,CAAA;AAC7D,MAAO,OAAA,EAAE,MAAQ,EAAA,MAAA,EAAQ,QAAS,EAAA,CAAA;AAAA,KACnC,CAAA,CAAA;AAED,IAAO,OAAA,EAAE,mBAAmB,OAAQ,EAAA,CAAA;AAAA,GACtC;AAAA,EAEA,MAAM,KAAM,CAAA,KAAA,EAAO,GAAK,EAAA;AACtB,IAAM,MAAA,EAAE,iBAAmB,EAAA,OAAA,EAAY,GAAA,GAAA,CAAA;AACvC,IAAA,MAAM,EAAE,MAAA,EAAQ,QAAS,EAAA,GAAI,MAAM,OAAA,CAAA;AACnC,IAAA,MAAM,OAAkC,GAAA;AAAA,MACtC,OAAO,KAAM,CAAA,KAAA;AAAA,MACb,OAAO,KAAM,CAAA,KAAA;AAAA,MACb,OAAOC,uBAAO,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,KACjD,CAAA;AACA,IAAA,MAAM,SAAS,iBAAqB,IAAA,MAAA,CAAA;AACpC,IAAA,IAAI,WAAW,MAAQ,EAAA;AACrB,MAAA,OAAA,CAAQ,MAAS,GAAA,MAAA,CAAA;AAAA,KACnB;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAA,QAAA,CAAS,KAAQ,GAAA,MAAA,CAAA;AAEjB,MAAO,OAAA,MAAA,CACJ,MAAM,KAAO,EAAA;AAAA,QACZ,GAAG,OAAA;AAAA,OACJ,CACA,CAAA,IAAA,CAAK,OAAO,CAAA,CAAA;AAAA,KAChB,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YACJ,CAAA,KAAA,EACA,GACmD,EAAA;AACnD,IAAA,MAAM,EAAE,QAAA,EAAa,GAAA,MAAM,GAAI,CAAA,OAAA,CAAA;AAC/B,IAAM,MAAA,EAAE,QAAQ,WAAY,EAAA,GAC1B,MAAMC,8BAAgB,CAAA,2BAAA,CAGpB,KAAM,CAAA,GAAA,EAAK,QAAQ,CAAA,CAAA;AAEvB,IAAO,OAAA;AAAA,MACL,WAAa,EAAA,MAAA;AAAA,MACb,OAAS,EAAA;AAAA,QACP,WAAA,EAAa,OAAO,QAAS,CAAA,YAAA;AAAA,QAC7B,SAAA,EAAW,MAAO,CAAA,QAAA,CAAS,UAAc,IAAA,QAAA;AAAA,QACzC,KAAA,EAAO,OAAO,QAAS,CAAA,KAAA;AAAA,QACvB,gBAAA,EAAkB,OAAO,QAAS,CAAA,UAAA;AAAA,QAClC,OAAA,EAAS,OAAO,QAAS,CAAA,QAAA;AAAA,QACzB,cAAc,WAAY,CAAA,YAAA;AAAA,OAC5B;AAAA,KACF,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,GAAK,EAAA;AACxB,IAAA,MAAM,EAAE,MAAA,EAAW,GAAA,MAAM,GAAI,CAAA,OAAA,CAAA;AAC7B,IAAA,MAAM,QAAW,GAAA,MAAM,MAAO,CAAA,OAAA,CAAQ,MAAM,YAAY,CAAA,CAAA;AACxD,IAAI,IAAA,CAAC,SAAS,YAAc,EAAA;AAC1B,MAAM,MAAA,IAAI,MAAM,gBAAgB,CAAA,CAAA;AAAA,KAClC;AACA,IAAA,MAAM,QAAW,GAAA,MAAM,MAAO,CAAA,QAAA,CAAS,SAAS,YAAY,CAAA,CAAA;AAE5D,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAI,IAAA,CAAC,SAAS,YAAc,EAAA;AAC1B,QAAO,MAAA,CAAA,IAAI,KAAM,CAAA,gBAAgB,CAAC,CAAA,CAAA;AAAA,OACpC;AACA,MAAQ,OAAA,CAAA;AAAA,QACN,WAAA,EAAa,EAAE,QAAA,EAAU,QAAS,EAAA;AAAA,QAClC,OAAS,EAAA;AAAA,UACP,aAAa,QAAS,CAAA,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAc,IAAA,QAAA;AAAA,UAClC,OAAO,QAAS,CAAA,KAAA;AAAA,UAChB,kBAAkB,QAAS,CAAA,UAAA;AAAA,UAC3B,SAAS,QAAS,CAAA,QAAA;AAAA,UAClB,cAAc,QAAS,CAAA,aAAA;AAAA,SACzB;AAAA,OACD,CAAA,CAAA;AAAA,KACF,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,MAAO,CAAA,KAAA,EAAO,GAAK,EAAA;AACvB,IAAA,MAAM,EAAE,MAAA,EAAW,GAAA,MAAM,GAAI,CAAA,OAAA,CAAA;AAC7B,IAAA,MAAM,SAAS,MAAO,CAAA,MAAA,CAAA;AAQtB,IAAI,IAAA,KAAA,CAAM,YAAgB,IAAA,MAAA,CAAO,mBAAqB,EAAA;AACpD,MAAM,MAAA,MAAA,CAAO,MAAO,CAAA,KAAA,CAAM,YAAY,CAAA,CAAA;AAAA,KACxC;AAAA,GACF;AACF,CAAC;;ACxMgBC,qCAAA;AAAA,CAAV,CAAUA,oBAAV,KAAA;AAKE,EAAMA,oBAAAA,CAAA,uCACXC,oCAAsB,CAAA,oCAAA,CAAA;AAMjB,EAAMD,oBAAAA,CAAA,sCACXC,oCAAsB,CAAA,mCAAA,CAAA;AAAA,CAbT,EAAAD,2BAAA,KAAAA,2BAAA,GAAA,EAAA,CAAA,CAAA;;ACEV,MAAM,yBAAyBE,oCAAoB,CAAA;AAAA,EACxD,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,eAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,SAAW,EAAAC,0CAAA;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,MAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAA,iBAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGJ,2BAAA;AAAA,cACH,GAAGC,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;"}

package/dist/index.d.ts

@@ -36,7 +36,9 @@ declare namespace oidcSignInResolvers {
      * A oidc resolver that looks up the user using the local part of
      * their email address as the entity name.
      */
-    const emailLocalPartMatchingUserEntityName: _backstage_plugin_auth_node.SignInResolverFactory<unknown, unknown>;
+    const emailLocalPartMatchingUserEntityName: _backstage_plugin_auth_node.SignInResolverFactory<unknown, {
+        allowedDomains?: string[] | undefined;
+    } | undefined>;
     /**
      * A oidc resolver that looks up the user using their email address
      * as email of the entity.

package/dist/module.cjs.js

@@ -0,0 +1,33 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var authenticator = require('./authenticator.cjs.js');
+var resolvers = require('./resolvers.cjs.js');
+
+const authModuleOidcProvider = backendPluginApi.createBackendModule({
+  pluginId: "auth",
+  moduleId: "oidc-provider",
+  register(reg) {
+    reg.registerInit({
+      deps: {
+        providers: pluginAuthNode.authProvidersExtensionPoint
+      },
+      async init({ providers }) {
+        providers.registerProvider({
+          providerId: "oidc",
+          factory: pluginAuthNode.createOAuthProviderFactory({
+            authenticator: authenticator.oidcAuthenticator,
+            signInResolverFactories: {
+              ...resolvers.oidcSignInResolvers,
+              ...pluginAuthNode.commonSignInResolvers
+            }
+          })
+        });
+      }
+    });
+  }
+});
+
+exports.authModuleOidcProvider = authModuleOidcProvider;
+//# sourceMappingURL=module.cjs.js.map

package/dist/module.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { oidcAuthenticator } from './authenticator';\nimport { oidcSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleOidcProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'oidc-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'oidc',\n          factory: createOAuthProviderFactory({\n            authenticator: oidcAuthenticator,\n            signInResolverFactories: {\n              ...oidcSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","oidcAuthenticator","oidcSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;AAyBO,MAAM,yBAAyBA,oCAAoB,CAAA;AAAA,EACxD,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,eAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,SAAW,EAAAC,0CAAA;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,MAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAAC,+BAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGC,6BAAA;AAAA,cACH,GAAGC,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}

package/dist/resolvers.cjs.js

@@ -0,0 +1,10 @@
+'use strict';
+
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+
+exports.oidcSignInResolvers = void 0;
+((oidcSignInResolvers2) => {
+  oidcSignInResolvers2.emailLocalPartMatchingUserEntityName = pluginAuthNode.commonSignInResolvers.emailLocalPartMatchingUserEntityName;
+  oidcSignInResolvers2.emailMatchingUserEntityProfileEmail = pluginAuthNode.commonSignInResolvers.emailMatchingUserEntityProfileEmail;
+})(exports.oidcSignInResolvers || (exports.oidcSignInResolvers = {}));
+//# sourceMappingURL=resolvers.cjs.js.map

package/dist/resolvers.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { commonSignInResolvers } from '@backstage/plugin-auth-node';\n\n/**\n * Available sign-in resolvers for the Oidc auth provider.\n *\n * @public\n */\nexport namespace oidcSignInResolvers {\n  /**\n   * A oidc resolver that looks up the user using the local part of\n   * their email address as the entity name.\n   */\n  export const emailLocalPartMatchingUserEntityName =\n    commonSignInResolvers.emailLocalPartMatchingUserEntityName;\n\n  /**\n   * A oidc resolver that looks up the user using their email address\n   * as email of the entity.\n   */\n  export const emailMatchingUserEntityProfileEmail =\n    commonSignInResolvers.emailMatchingUserEntityProfileEmail;\n}\n"],"names":["oidcSignInResolvers","commonSignInResolvers"],"mappings":";;;;AAuBiBA,qCAAA;AAAA,CAAV,CAAUA,oBAAV,KAAA;AAKE,EAAMA,oBAAAA,CAAA,uCACXC,oCAAsB,CAAA,oCAAA,CAAA;AAMjB,EAAMD,oBAAAA,CAAA,sCACXC,oCAAsB,CAAA,mCAAA,CAAA;AAAA,CAbT,EAAAD,2BAAA,KAAAA,2BAAA,GAAA,EAAA,CAAA,CAAA;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-oidc-provider",
-  "version": "0.3.1-next.0",
+  "version": "0.3.1",
   "description": "The oidc-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -35,17 +35,17 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.25.0",
-    "@backstage/backend-plugin-api": "^1.0.1-next.0",
-    "@backstage/plugin-auth-backend": "^0.23.1-next.0",
-    "@backstage/plugin-auth-node": "^0.5.3-next.0",
+    "@backstage/backend-plugin-api": "^1.0.1",
+    "@backstage/plugin-auth-backend": "^0.23.1",
+    "@backstage/plugin-auth-node": "^0.5.3",
     "express": "^4.18.2",
     "openid-client": "^5.5.0",
     "passport": "^0.7.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.5.1-next.0",
-    "@backstage/backend-test-utils": "^1.0.1-next.0",
-    "@backstage/cli": "^0.28.0-next.0",
+    "@backstage/backend-defaults": "^0.5.1",
+    "@backstage/backend-test-utils": "^1.0.1",
+    "@backstage/cli": "^0.28.0",
     "@backstage/config": "^1.2.0",
     "cookie-parser": "^1.4.6",
     "express-promise-router": "^4.1.1",