@backstage/plugin-auth-backend-module-oidc-provider 0.4.10 → 0.4.11-next.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @backstage/plugin-auth-backend-module-oidc-provider
 
+## 0.4.11-next.0
+
+### Patch Changes
+
+- e54fcb2: Added support for custom start URL search parameters (with the new `startUrlSearchParams` config property)
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.6.0
+  - @backstage/config@1.3.6
+  - @backstage/types@1.2.2
+  - @backstage/plugin-auth-backend@0.25.7
+  - @backstage/plugin-auth-node@0.6.10
+
 ## 0.4.10
 
 ### Patch Changes

package/config.d.ts

@@ -33,6 +33,7 @@ export interface Config {
           additionalScopes?: string | string[];
           prompt?: string;
           timeout?: HumanDuration | string;
+          startUrlSearchParams?: [string: string];
           signIn?: {
             resolvers: Array<
               | {

package/dist/authenticator.cjs.js

@@ -41,6 +41,7 @@ const oidcAuthenticator = pluginAuthNode.createOAuthAuthenticator({
       "tokenSignedResponseAlg"
     );
     const initializedPrompt = config$1.getOptionalString("prompt");
+    const startUrlSearchParams = config$1.getOptional("startUrlSearchParams") || {};
     if (config$1.has("scope")) {
       throw new Error(
         'The oidc provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
@@ -88,12 +89,13 @@ const oidcAuthenticator = pluginAuthNode.createOAuthAuthenticator({
       const helper = pluginAuthNode.PassportOAuthAuthenticatorHelper.from(strategy);
       return { helper, client, strategy };
     });
-    return { initializedPrompt, promise };
+    return { initializedPrompt, promise, searchParams: startUrlSearchParams };
   },
   async start(input, ctx) {
-    const { initializedPrompt, promise } = ctx;
+    const { initializedPrompt, promise, searchParams } = ctx;
     const { helper } = await promise;
     const options = {
+      ...searchParams,
       scope: input.scope,
       state: input.state,
       nonce: crypto__default.default.randomBytes(16).toString("base64")

package/dist/authenticator.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport crypto from 'crypto';\nimport {\n  custom,\n  CustomHttpOptionsProvider,\n  Issuer,\n  ClientAuthMethod,\n  TokenSet,\n  UserinfoResponse,\n  Strategy as OidcStrategy,\n} from 'openid-client';\nimport {\n  createOAuthAuthenticator,\n  OAuthAuthenticatorResult,\n  PassportDoneCallback,\n  PassportHelpers,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthPrivateInfo,\n} from '@backstage/plugin-auth-node';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { readDurationFromConfig } from '@backstage/config';\n\nconst HTTP_OPTION_TIMEOUT = 10000;\nconst createHttpOptionsProvider =\n  ({ timeout }: { timeout?: number }): CustomHttpOptionsProvider =>\n  (_url, options) => {\n    return {\n      ...options,\n      timeout: timeout ?? HTTP_OPTION_TIMEOUT,\n    };\n  };\n\n/**\n * authentication result for the OIDC which includes the token set and user\n * profile response\n * @public\n */\nexport type OidcAuthResult = {\n  tokenset: TokenSet;\n  userinfo: UserinfoResponse;\n};\n\n/** @public */\nexport const oidcAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform: async (\n    input: OAuthAuthenticatorResult<OidcAuthResult>,\n  ) => ({\n    profile: {\n      email: input.fullProfile.userinfo.email,\n      picture: input.fullProfile.userinfo.picture,\n      displayName: input.fullProfile.userinfo.name,\n    },\n  }),\n  scopes: {\n    persist: true,\n    required: ['openid', 'profile', 'email'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const metadataUrl = config.getString('metadataUrl');\n    const customCallbackUrl = config.getOptionalString('callbackUrl');\n    const tokenEndpointAuthMethod = config.getOptionalString(\n      'tokenEndpointAuthMethod',\n    ) as ClientAuthMethod;\n    const tokenSignedResponseAlg = config.getOptionalString(\n      'tokenSignedResponseAlg',\n    );\n    const initializedPrompt = config.getOptionalString('prompt');\n\n    if (config.has('scope')) {\n      throw new Error(\n        'The oidc provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n\n    const timeoutMilliseconds = config.has('timeout')\n      ? durationToMilliseconds(\n          readDurationFromConfig(config, { key: 'timeout' }),\n        )\n      : undefined;\n    const httpOptionsProvider = createHttpOptionsProvider({\n      timeout: timeoutMilliseconds,\n    });\n\n    Issuer[custom.http_options] = httpOptionsProvider;\n    const promise = Issuer.discover(metadataUrl).then(issuer => {\n      issuer[custom.http_options] = httpOptionsProvider;\n      issuer.Client[custom.http_options] = httpOptionsProvider;\n\n      const client = new issuer.Client({\n        access_type: 'offline', // this option must be passed to provider to receive a refresh token\n        client_id: clientId,\n        client_secret: clientSecret,\n        redirect_uris: [customCallbackUrl || callbackUrl],\n        response_types: ['code'],\n        token_endpoint_auth_method:\n          tokenEndpointAuthMethod || 'client_secret_basic',\n        id_token_signed_response_alg: tokenSignedResponseAlg || 'RS256',\n      });\n      client[custom.http_options] = httpOptionsProvider;\n\n      const strategy = new OidcStrategy(\n        {\n          client,\n          passReqToCallback: false,\n        },\n        (\n          tokenset: TokenSet,\n          userinfo: UserinfoResponse,\n          done: PassportDoneCallback<OidcAuthResult, PassportOAuthPrivateInfo>,\n        ) => {\n          if (typeof done !== 'function') {\n            throw new Error(\n              'OIDC IdP must provide a userinfo_endpoint in the metadata response',\n            );\n          }\n\n          done(\n            undefined,\n            { tokenset, userinfo },\n            { refreshToken: tokenset.refresh_token },\n          );\n        },\n      );\n\n      const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n      return { helper, client, strategy };\n    });\n\n    return { initializedPrompt, promise };\n  },\n\n  async start(input, ctx) {\n    const { initializedPrompt, promise } = ctx;\n    const { helper } = await promise;\n    const options: Record<string, string> = {\n      scope: input.scope,\n      state: input.state,\n      nonce: crypto.randomBytes(16).toString('base64'),\n    };\n    const prompt = initializedPrompt || 'none';\n    if (prompt !== 'auto') {\n      options.prompt = prompt;\n    }\n\n    return helper.start(input, {\n      ...options,\n    });\n  },\n\n  async authenticate(\n    input,\n    ctx,\n  ): Promise<OAuthAuthenticatorResult<OidcAuthResult>> {\n    const { strategy } = await ctx.promise;\n    const { result, privateInfo } =\n      await PassportHelpers.executeFrameHandlerStrategy<\n        OidcAuthResult,\n        PassportOAuthPrivateInfo\n      >(input.req, strategy);\n\n    return {\n      fullProfile: result,\n      session: {\n        accessToken: result.tokenset.access_token!,\n        tokenType: result.tokenset.token_type ?? 'bearer',\n        scope: result.tokenset.scope!,\n        expiresInSeconds: result.tokenset.expires_in,\n        idToken: result.tokenset.id_token,\n        refreshToken: privateInfo.refreshToken,\n      },\n    };\n  },\n\n  async refresh(input, ctx) {\n    const { client } = await ctx.promise;\n    const tokenset = await client.refresh(input.refreshToken);\n    if (!tokenset.access_token) {\n      throw new Error('Refresh failed');\n    }\n    const userinfo = await client.userinfo(tokenset.access_token);\n\n    return new Promise((resolve, reject) => {\n      if (!tokenset.access_token) {\n        reject(new Error('Refresh Failed'));\n      }\n      resolve({\n        fullProfile: { userinfo, tokenset },\n        session: {\n          accessToken: tokenset.access_token!,\n          tokenType: tokenset.token_type ?? 'bearer',\n          scope: tokenset.scope!,\n          expiresInSeconds: tokenset.expires_in,\n          idToken: tokenset.id_token,\n          refreshToken: tokenset.refresh_token,\n        },\n      });\n    });\n  },\n\n  async logout(input, ctx) {\n    const { client } = await ctx.promise;\n    const issuer = client.issuer;\n    /**\n     * https://github.com/panva/node-openid-client/blob/main/lib/client.js#L1398\n     * client.revoke will check revocation_endpoint and if undefined throw error。\n     *\n     * if oidc server do not provide revocation_endpoint，we should not call revoke function\n     */\n\n    if (input.refreshToken && issuer.revocation_endpoint) {\n      await client.revoke(input.refreshToken);\n    }\n  },\n});\n"],"names":["createOAuthAuthenticator","config","durationToMilliseconds","readDurationFromConfig","Issuer","custom","OidcStrategy","PassportOAuthAuthenticatorHelper","crypto","PassportHelpers"],"mappings":";;;;;;;;;;;;AAqCA,MAAM,mBAAA,GAAsB,GAAA;AAC5B,MAAM,4BACJ,CAAC,EAAE,SAAQ,KACX,CAAC,MAAM,OAAA,KAAY;AACjB,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,SAAS,OAAA,IAAW;AAAA,GACtB;AACF,CAAA;AAaK,MAAM,oBAAoBA,uCAAA,CAAyB;AAAA,EACxD,uBAAA,EAAyB,OACvB,KAAA,MACI;AAAA,IACJ,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,KAAA;AAAA,MAClC,OAAA,EAAS,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,OAAA;AAAA,MACpC,WAAA,EAAa,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS;AAAA;AAC1C,GACF,CAAA;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,QAAA,EAAU,SAAA,EAAW,OAAO;AAAA,GACzC;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,UAAaC,QAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAWA,QAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAeA,QAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,WAAA,GAAcA,QAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AAClD,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA;AAChE,IAAA,MAAM,0BAA0BA,QAAA,CAAO,iBAAA;AAAA,MACrC;AAAA,KACF;AACA,IAAA,MAAM,yBAAyBA,QAAA,CAAO,iBAAA;AAAA,MACpC;AAAA,KACF;AACA,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,QAAQ,CAAA;AAE3D,IAAA,IAAIA,QAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBAAA,GAAsBA,QAAA,CAAO,GAAA,CAAI,SAAS,CAAA,GAC5CC,4BAAA;AAAA,MACEC,6BAAA,CAAuBF,QAAA,EAAQ,EAAE,GAAA,EAAK,WAAW;AAAA,KACnD,GACA,MAAA;AACJ,IAAA,MAAM,sBAAsB,yBAAA,CAA0B;AAAA,MACpD,OAAA,EAAS;AAAA,KACV,CAAA;AAED,IAAAG,mBAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,IAAA,MAAM,UAAUD,mBAAA,CAAO,QAAA,CAAS,WAAW,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AAC1D,MAAA,MAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,MAAA,MAAA,CAAO,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAErC,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,MAAA,CAAO;AAAA,QAC/B,WAAA,EAAa,SAAA;AAAA;AAAA,QACb,SAAA,EAAW,QAAA;AAAA,QACX,aAAA,EAAe,YAAA;AAAA,QACf,aAAA,EAAe,CAAC,iBAAA,IAAqB,WAAW,CAAA;AAAA,QAChD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,QACvB,4BACE,uBAAA,IAA2B,qBAAA;AAAA,QAC7B,8BAA8B,sBAAA,IAA0B;AAAA,OACzD,CAAA;AACD,MAAA,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAE9B,MAAA,MAAM,WAAW,IAAIC,qBAAA;AAAA,QACnB;AAAA,UACE,MAAA;AAAA,UACA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,QAAA,EACA,QAAA,EACA,IAAA,KACG;AACH,UAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AAEA,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,UAAU,QAAA,EAAS;AAAA,YACrB,EAAE,YAAA,EAAc,QAAA,CAAS,aAAA;AAAc,WACzC;AAAA,QACF;AAAA,OACF;AAEA,MAAA,MAAM,MAAA,GAASC,+CAAA,CAAiC,IAAA,CAAK,QAAQ,CAAA;AAC7D,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAS;AAAA,IACpC,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,mBAAmB,OAAA,EAAQ;AAAA,EACtC,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK;AACtB,IAAA,MAAM,EAAE,iBAAA,EAAmB,OAAA,EAAQ,GAAI,GAAA;AACvC,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAA;AACzB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAOC,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,QAAQ;AAAA,KACjD;AACA,IAAA,MAAM,SAAS,iBAAA,IAAqB,MAAA;AACpC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,OAAA,CAAQ,MAAA,GAAS,MAAA;AAAA,IACnB;AAEA,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,GAAG;AAAA,KACJ,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,EACA,GAAA,EACmD;AACnD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,GAAA,CAAI,OAAA;AAC/B,IAAA,MAAM,EAAE,QAAQ,WAAA,EAAY,GAC1B,MAAMC,8BAAA,CAAgB,2BAAA,CAGpB,KAAA,CAAM,GAAA,EAAK,QAAQ,CAAA;AAEvB,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,MAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,OAAO,QAAA,CAAS,YAAA;AAAA,QAC7B,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,UAAA,IAAc,QAAA;AAAA,QACzC,KAAA,EAAO,OAAO,QAAA,CAAS,KAAA;AAAA,QACvB,gBAAA,EAAkB,OAAO,QAAA,CAAS,UAAA;AAAA,QAClC,OAAA,EAAS,OAAO,QAAA,CAAS,QAAA;AAAA,QACzB,cAAc,WAAA,CAAY;AAAA;AAC5B,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK;AACxB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,MAAM,YAAY,CAAA;AACxD,IAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,gBAAgB,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,YAAY,CAAA;AAE5D,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAAA,MACpC;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,WAAA,EAAa,EAAE,QAAA,EAAU,QAAA,EAAS;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,aAAa,QAAA,CAAS,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAA,IAAc,QAAA;AAAA,UAClC,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,kBAAkB,QAAA,CAAS,UAAA;AAAA,UAC3B,SAAS,QAAA,CAAS,QAAA;AAAA,UAClB,cAAc,QAAA,CAAS;AAAA;AACzB,OACD,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,MAAA,CAAO,KAAA,EAAO,GAAA,EAAK;AACvB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAQtB,IAAA,IAAI,KAAA,CAAM,YAAA,IAAgB,MAAA,CAAO,mBAAA,EAAqB;AACpD,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA;AAAA,IACxC;AAAA,EACF;AACF,CAAC;;;;"}
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport crypto from 'crypto';\nimport {\n  custom,\n  CustomHttpOptionsProvider,\n  Issuer,\n  ClientAuthMethod,\n  TokenSet,\n  UserinfoResponse,\n  Strategy as OidcStrategy,\n} from 'openid-client';\nimport {\n  createOAuthAuthenticator,\n  OAuthAuthenticatorResult,\n  PassportDoneCallback,\n  PassportHelpers,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthPrivateInfo,\n} from '@backstage/plugin-auth-node';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { readDurationFromConfig } from '@backstage/config';\n\nconst HTTP_OPTION_TIMEOUT = 10000;\nconst createHttpOptionsProvider =\n  ({ timeout }: { timeout?: number }): CustomHttpOptionsProvider =>\n  (_url, options) => {\n    return {\n      ...options,\n      timeout: timeout ?? HTTP_OPTION_TIMEOUT,\n    };\n  };\n\n/**\n * authentication result for the OIDC which includes the token set and user\n * profile response\n * @public\n */\nexport type OidcAuthResult = {\n  tokenset: TokenSet;\n  userinfo: UserinfoResponse;\n};\n\n/** @public */\nexport const oidcAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform: async (\n    input: OAuthAuthenticatorResult<OidcAuthResult>,\n  ) => ({\n    profile: {\n      email: input.fullProfile.userinfo.email,\n      picture: input.fullProfile.userinfo.picture,\n      displayName: input.fullProfile.userinfo.name,\n    },\n  }),\n  scopes: {\n    persist: true,\n    required: ['openid', 'profile', 'email'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const metadataUrl = config.getString('metadataUrl');\n    const customCallbackUrl = config.getOptionalString('callbackUrl');\n    const tokenEndpointAuthMethod = config.getOptionalString(\n      'tokenEndpointAuthMethod',\n    ) as ClientAuthMethod;\n    const tokenSignedResponseAlg = config.getOptionalString(\n      'tokenSignedResponseAlg',\n    );\n    const initializedPrompt = config.getOptionalString('prompt');\n\n    const startUrlSearchParams: Record<string, string> =\n      config.getOptional('startUrlSearchParams') || {};\n\n    if (config.has('scope')) {\n      throw new Error(\n        'The oidc provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n\n    const timeoutMilliseconds = config.has('timeout')\n      ? durationToMilliseconds(\n          readDurationFromConfig(config, { key: 'timeout' }),\n        )\n      : undefined;\n    const httpOptionsProvider = createHttpOptionsProvider({\n      timeout: timeoutMilliseconds,\n    });\n\n    Issuer[custom.http_options] = httpOptionsProvider;\n    const promise = Issuer.discover(metadataUrl).then(issuer => {\n      issuer[custom.http_options] = httpOptionsProvider;\n      issuer.Client[custom.http_options] = httpOptionsProvider;\n\n      const client = new issuer.Client({\n        access_type: 'offline', // this option must be passed to provider to receive a refresh token\n        client_id: clientId,\n        client_secret: clientSecret,\n        redirect_uris: [customCallbackUrl || callbackUrl],\n        response_types: ['code'],\n        token_endpoint_auth_method:\n          tokenEndpointAuthMethod || 'client_secret_basic',\n        id_token_signed_response_alg: tokenSignedResponseAlg || 'RS256',\n      });\n      client[custom.http_options] = httpOptionsProvider;\n\n      const strategy = new OidcStrategy(\n        {\n          client,\n          passReqToCallback: false,\n        },\n        (\n          tokenset: TokenSet,\n          userinfo: UserinfoResponse,\n          done: PassportDoneCallback<OidcAuthResult, PassportOAuthPrivateInfo>,\n        ) => {\n          if (typeof done !== 'function') {\n            throw new Error(\n              'OIDC IdP must provide a userinfo_endpoint in the metadata response',\n            );\n          }\n\n          done(\n            undefined,\n            { tokenset, userinfo },\n            { refreshToken: tokenset.refresh_token },\n          );\n        },\n      );\n\n      const helper = PassportOAuthAuthenticatorHelper.from(strategy);\n      return { helper, client, strategy };\n    });\n\n    return { initializedPrompt, promise, searchParams: startUrlSearchParams };\n  },\n\n  async start(input, ctx) {\n    const { initializedPrompt, promise, searchParams } = ctx;\n    const { helper } = await promise;\n\n    // Merge the custom start URL params, but do not override the standard params (scope, state etc)\n    const options: Record<string, string> = {\n      ...searchParams,\n      scope: input.scope,\n      state: input.state,\n      nonce: crypto.randomBytes(16).toString('base64'),\n    };\n\n    const prompt = initializedPrompt || 'none';\n    if (prompt !== 'auto') {\n      options.prompt = prompt;\n    }\n\n    return helper.start(input, {\n      ...options,\n    });\n  },\n\n  async authenticate(\n    input,\n    ctx,\n  ): Promise<OAuthAuthenticatorResult<OidcAuthResult>> {\n    const { strategy } = await ctx.promise;\n    const { result, privateInfo } =\n      await PassportHelpers.executeFrameHandlerStrategy<\n        OidcAuthResult,\n        PassportOAuthPrivateInfo\n      >(input.req, strategy);\n\n    return {\n      fullProfile: result,\n      session: {\n        accessToken: result.tokenset.access_token!,\n        tokenType: result.tokenset.token_type ?? 'bearer',\n        scope: result.tokenset.scope!,\n        expiresInSeconds: result.tokenset.expires_in,\n        idToken: result.tokenset.id_token,\n        refreshToken: privateInfo.refreshToken,\n      },\n    };\n  },\n\n  async refresh(input, ctx) {\n    const { client } = await ctx.promise;\n    const tokenset = await client.refresh(input.refreshToken);\n    if (!tokenset.access_token) {\n      throw new Error('Refresh failed');\n    }\n    const userinfo = await client.userinfo(tokenset.access_token);\n\n    return new Promise((resolve, reject) => {\n      if (!tokenset.access_token) {\n        reject(new Error('Refresh Failed'));\n      }\n      resolve({\n        fullProfile: { userinfo, tokenset },\n        session: {\n          accessToken: tokenset.access_token!,\n          tokenType: tokenset.token_type ?? 'bearer',\n          scope: tokenset.scope!,\n          expiresInSeconds: tokenset.expires_in,\n          idToken: tokenset.id_token,\n          refreshToken: tokenset.refresh_token,\n        },\n      });\n    });\n  },\n\n  async logout(input, ctx) {\n    const { client } = await ctx.promise;\n    const issuer = client.issuer;\n    /**\n     * https://github.com/panva/node-openid-client/blob/main/lib/client.js#L1398\n     * client.revoke will check revocation_endpoint and if undefined throw error。\n     *\n     * if oidc server do not provide revocation_endpoint，we should not call revoke function\n     */\n\n    if (input.refreshToken && issuer.revocation_endpoint) {\n      await client.revoke(input.refreshToken);\n    }\n  },\n});\n"],"names":["createOAuthAuthenticator","config","durationToMilliseconds","readDurationFromConfig","Issuer","custom","OidcStrategy","PassportOAuthAuthenticatorHelper","crypto","PassportHelpers"],"mappings":";;;;;;;;;;;;AAqCA,MAAM,mBAAA,GAAsB,GAAA;AAC5B,MAAM,4BACJ,CAAC,EAAE,SAAQ,KACX,CAAC,MAAM,OAAA,KAAY;AACjB,EAAA,OAAO;AAAA,IACL,GAAG,OAAA;AAAA,IACH,SAAS,OAAA,IAAW;AAAA,GACtB;AACF,CAAA;AAaK,MAAM,oBAAoBA,uCAAA,CAAyB;AAAA,EACxD,uBAAA,EAAyB,OACvB,KAAA,MACI;AAAA,IACJ,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,KAAA;AAAA,MAClC,OAAA,EAAS,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS,OAAA;AAAA,MACpC,WAAA,EAAa,KAAA,CAAM,WAAA,CAAY,QAAA,CAAS;AAAA;AAC1C,GACF,CAAA;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,QAAA,EAAU,SAAA,EAAW,OAAO;AAAA,GACzC;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,UAAaC,QAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAWA,QAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAeA,QAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,WAAA,GAAcA,QAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AAClD,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA;AAChE,IAAA,MAAM,0BAA0BA,QAAA,CAAO,iBAAA;AAAA,MACrC;AAAA,KACF;AACA,IAAA,MAAM,yBAAyBA,QAAA,CAAO,iBAAA;AAAA,MACpC;AAAA,KACF;AACA,IAAA,MAAM,iBAAA,GAAoBA,QAAA,CAAO,iBAAA,CAAkB,QAAQ,CAAA;AAE3D,IAAA,MAAM,oBAAA,GACJA,QAAA,CAAO,WAAA,CAAY,sBAAsB,KAAK,EAAC;AAEjD,IAAA,IAAIA,QAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBAAA,GAAsBA,QAAA,CAAO,GAAA,CAAI,SAAS,CAAA,GAC5CC,4BAAA;AAAA,MACEC,6BAAA,CAAuBF,QAAA,EAAQ,EAAE,GAAA,EAAK,WAAW;AAAA,KACnD,GACA,MAAA;AACJ,IAAA,MAAM,sBAAsB,yBAAA,CAA0B;AAAA,MACpD,OAAA,EAAS;AAAA,KACV,CAAA;AAED,IAAAG,mBAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,IAAA,MAAM,UAAUD,mBAAA,CAAO,QAAA,CAAS,WAAW,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AAC1D,MAAA,MAAA,CAAOC,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAC9B,MAAA,MAAA,CAAO,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAErC,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,MAAA,CAAO;AAAA,QAC/B,WAAA,EAAa,SAAA;AAAA;AAAA,QACb,SAAA,EAAW,QAAA;AAAA,QACX,aAAA,EAAe,YAAA;AAAA,QACf,aAAA,EAAe,CAAC,iBAAA,IAAqB,WAAW,CAAA;AAAA,QAChD,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,QACvB,4BACE,uBAAA,IAA2B,qBAAA;AAAA,QAC7B,8BAA8B,sBAAA,IAA0B;AAAA,OACzD,CAAA;AACD,MAAA,MAAA,CAAOA,mBAAA,CAAO,YAAY,CAAA,GAAI,mBAAA;AAE9B,MAAA,MAAM,WAAW,IAAIC,qBAAA;AAAA,QACnB;AAAA,UACE,MAAA;AAAA,UACA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,QAAA,EACA,QAAA,EACA,IAAA,KACG;AACH,UAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AAEA,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,UAAU,QAAA,EAAS;AAAA,YACrB,EAAE,YAAA,EAAc,QAAA,CAAS,aAAA;AAAc,WACzC;AAAA,QACF;AAAA,OACF;AAEA,MAAA,MAAM,MAAA,GAASC,+CAAA,CAAiC,IAAA,CAAK,QAAQ,CAAA;AAC7D,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAS;AAAA,IACpC,CAAC,CAAA;AAED,IAAA,OAAO,EAAE,iBAAA,EAAmB,OAAA,EAAS,YAAA,EAAc,oBAAA,EAAqB;AAAA,EAC1E,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK;AACtB,IAAA,MAAM,EAAE,iBAAA,EAAmB,OAAA,EAAS,YAAA,EAAa,GAAI,GAAA;AACrD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAA;AAGzB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAG,YAAA;AAAA,MACH,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAOC,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,QAAQ;AAAA,KACjD;AAEA,IAAA,MAAM,SAAS,iBAAA,IAAqB,MAAA;AACpC,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,OAAA,CAAQ,MAAA,GAAS,MAAA;AAAA,IACnB;AAEA,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,GAAG;AAAA,KACJ,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CACJ,KAAA,EACA,GAAA,EACmD;AACnD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,GAAA,CAAI,OAAA;AAC/B,IAAA,MAAM,EAAE,QAAQ,WAAA,EAAY,GAC1B,MAAMC,8BAAA,CAAgB,2BAAA,CAGpB,KAAA,CAAM,GAAA,EAAK,QAAQ,CAAA;AAEvB,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,MAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,OAAO,QAAA,CAAS,YAAA;AAAA,QAC7B,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,UAAA,IAAc,QAAA;AAAA,QACzC,KAAA,EAAO,OAAO,QAAA,CAAS,KAAA;AAAA,QACvB,gBAAA,EAAkB,OAAO,QAAA,CAAS,UAAA;AAAA,QAClC,OAAA,EAAS,OAAO,QAAA,CAAS,QAAA;AAAA,QACzB,cAAc,WAAA,CAAY;AAAA;AAC5B,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK;AACxB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,MAAM,YAAY,CAAA;AACxD,IAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,MAAA,MAAM,IAAI,MAAM,gBAAgB,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,YAAY,CAAA;AAE5D,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI,CAAC,SAAS,YAAA,EAAc;AAC1B,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAAA,MACpC;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,WAAA,EAAa,EAAE,QAAA,EAAU,QAAA,EAAS;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,aAAa,QAAA,CAAS,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAA,IAAc,QAAA;AAAA,UAClC,OAAO,QAAA,CAAS,KAAA;AAAA,UAChB,kBAAkB,QAAA,CAAS,UAAA;AAAA,UAC3B,SAAS,QAAA,CAAS,QAAA;AAAA,UAClB,cAAc,QAAA,CAAS;AAAA;AACzB,OACD,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,MAAA,CAAO,KAAA,EAAO,GAAA,EAAK;AACvB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,OAAA;AAC7B,IAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAQtB,IAAA,IAAI,KAAA,CAAM,YAAA,IAAgB,MAAA,CAAO,mBAAA,EAAqB;AACpD,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA;AAAA,IACxC;AAAA,EACF;AACF,CAAC;;;;"}

package/dist/index.d.ts

@@ -21,6 +21,7 @@ declare const oidcAuthenticator: _backstage_plugin_auth_node.OAuthAuthenticator<
         client: openid_client.BaseClient;
         strategy: Strategy<OidcAuthResult, openid_client.BaseClient>;
     }>;
+    searchParams: Record<string, string>;
 }, OidcAuthResult>;
 
 /** @public */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-oidc-provider",
-  "version": "0.4.10",
+  "version": "0.4.11-next.0",
   "description": "The oidc-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -37,22 +37,22 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.6.0",
-    "@backstage/config": "^1.3.6",
-    "@backstage/plugin-auth-backend": "^0.25.7",
-    "@backstage/plugin-auth-node": "^0.6.10",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-plugin-api": "1.6.0",
+    "@backstage/config": "1.3.6",
+    "@backstage/plugin-auth-backend": "0.25.7",
+    "@backstage/plugin-auth-node": "0.6.10",
+    "@backstage/types": "1.2.2",
     "express": "^4.22.0",
     "openid-client": "^5.5.0",
     "passport": "^0.7.0",
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.14.0",
-    "@backstage/backend-test-utils": "^1.10.2",
-    "@backstage/cli": "^0.35.0",
-    "@backstage/config": "^1.3.6",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-defaults": "0.14.1-next.0",
+    "@backstage/backend-test-utils": "1.10.3-next.0",
+    "@backstage/cli": "0.35.2-next.0",
+    "@backstage/config": "1.3.6",
+    "@backstage/types": "1.2.2",
     "cookie-parser": "^1.4.6",
     "express-promise-router": "^4.1.1",
     "express-session": "^1.17.3",