@backstage/plugin-auth-backend-module-openshift-provider 0.1.5-next.1 → 0.1.5

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @backstage/plugin-auth-backend-module-openshift-provider
 
+## 0.1.5
+
+### Patch Changes
+
+- a49a40d: Updated dependency `zod` to `^3.25.76 || ^4.0.0` & migrated to `/v3` or `/v4` imports.
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.8.0
+  - @backstage/catalog-model@1.7.7
+  - @backstage/plugin-auth-node@0.6.14
+
 ## 0.1.5-next.1
 
 ### Patch Changes

package/dist/authenticator.cjs.js

@@ -3,15 +3,15 @@
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var node_crypto = require('node:crypto');
 var OAuth2Strategy = require('passport-oauth2');
-var zod = require('zod');
+var v3 = require('zod/v3');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
 var OAuth2Strategy__default = /*#__PURE__*/_interopDefaultCompat(OAuth2Strategy);
 
-const OpenShiftUser = zod.z.object({
-  metadata: zod.z.object({
-    name: zod.z.string()
+const OpenShiftUser = v3.z.object({
+  metadata: v3.z.object({
+    name: v3.z.string()
   })
 });
 const openshiftAuthenticator = pluginAuthNode.createOAuthAuthenticator({

package/dist/authenticator.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { createHash } from 'node:crypto';\nimport OAuth2Strategy from 'passport-oauth2';\nimport { z } from 'zod';\n\n/** @public */\nexport interface OpenShiftAuthenticatorContext {\n  openshiftApiServerUrl: string;\n  helper: PassportOAuthAuthenticatorHelper;\n}\n\n/** @private\n * Schema for user.openshift.io/v1,\n * see https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/user_and_group_apis/user-user-openshift-io-v1#user-user-openshift-io-v1\n */\nconst OpenShiftUser = z.object({\n  metadata: z.object({\n    name: z.string(),\n  }),\n});\n\n/** @public */\nexport const openshiftAuthenticator = createOAuthAuthenticator<\n  OpenShiftAuthenticatorContext,\n  PassportProfile\n>({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    required: ['user:full'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const authorizationUrl = config.getString('authorizationUrl');\n    const tokenUrl = config.getString('tokenUrl');\n    const openshiftApiServerUrl = config.getString('openshiftApiServerUrl');\n\n    // userUrl: `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,\n    const strategy = new OAuth2Strategy(\n      {\n        clientID: clientId,\n        clientSecret: clientSecret,\n        callbackURL: callbackUrl,\n        authorizationURL: authorizationUrl,\n        tokenURL: tokenUrl,\n        passReqToCallback: false,\n      },\n      (\n        accessToken: any,\n        refreshToken: string,\n        params: any,\n        fullProfile: PassportProfile,\n        done: PassportOAuthDoneCallback,\n      ) => {\n        done(undefined, { fullProfile, params, accessToken }, { refreshToken });\n      },\n    );\n\n    strategy.userProfile = function userProfile(\n      accessToken: string,\n      done: (err?: unknown, profile?: any) => void,\n    ): void {\n      this._oauth2.useAuthorizationHeaderforGET(true);\n\n      this._oauth2.get(\n        `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,\n        accessToken,\n        (error, data, _) => {\n          if (error !== null && error.statusCode !== 200) {\n            done(new Error(`HTTP error! Status: ${error.statusCode}`));\n            return;\n          }\n\n          if (!data) {\n            done(new Error('No data provided!'));\n            return;\n          }\n\n          if (typeof data !== 'string') {\n            done(new Error('Data of type Buffer is not supported!'));\n            return;\n          }\n\n          const user = OpenShiftUser.parse(JSON.parse(data));\n          done(null, { displayName: user.metadata.name });\n        },\n      );\n    };\n\n    return {\n      openshiftApiServerUrl,\n      helper: PassportOAuthAuthenticatorHelper.from(strategy),\n    };\n  },\n  async start(input, { helper }) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n  async authenticate(input, { helper }) {\n    // Same workaround as the GitHub provider; see https://github.com/backstage/backstage/issues/25383\n    const { fullProfile, session } = await helper.authenticate(input);\n    session.refreshToken = session.accessToken;\n    session.refreshTokenExpiresInSeconds = session.expiresInSeconds;\n    return { fullProfile, session };\n  },\n  async refresh(input, { helper }) {\n    // Because the session is refreshed on login, this override is crucial,\n    // see https://github.com/backstage/backstage/issues/25383\n    const accessToken = input.refreshToken;\n\n    const fullProfile = await helper.fetchProfile(accessToken).catch(error => {\n      if (error.oauthError?.statusCode === 401) {\n        throw new Error('Invalid access token');\n      }\n      throw error;\n    });\n\n    return {\n      fullProfile,\n      session: {\n        accessToken,\n        tokenType: 'bearer',\n        scope: input.scope,\n        refreshToken: input.refreshToken,\n      },\n    };\n  },\n  async logout(input, { openshiftApiServerUrl, helper }) {\n    // Due to the implementation of createOAuthRouteHandlers, only the refresh token is set.\n    // In this provider, the refresh token actually IS the access token.\n    const accessToken = input.refreshToken;\n    if (!accessToken) {\n      throw new Error('access token/refresh token needs to be set for logout');\n    }\n\n    // Check if access token is still valid.\n    try {\n      await helper.fetchProfile(accessToken);\n    } catch {\n      // Invalid token, no need to delete OAuthAccessToken.\n      return;\n    }\n\n    // Calculate token name, see:\n    // https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/oauth_apis/oauthaccesstoken-oauth-openshift-io-v1#apis-oauth-openshift-io-v1-oauthaccesstokens\n    const tokenName = createHash('sha256')\n      .update(accessToken.slice('sha256~'.length))\n      .digest()\n      .toString('base64url');\n\n    const response = await fetch(\n      `${openshiftApiServerUrl}/apis/oauth.openshift.io/v1/oauthaccesstokens/sha256~${tokenName}`,\n      { method: 'DELETE', headers: { Authorization: `Bearer ${accessToken}` } },\n    );\n\n    if (response.status === 401) {\n      throw new Error('unauthorized');\n    }\n  },\n});\n"],"names":["z","createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","OAuth2Strategy","createHash"],"mappings":";;;;;;;;;;;AAoCA,MAAM,aAAA,GAAgBA,MAAE,MAAA,CAAO;AAAA,EAC7B,QAAA,EAAUA,MAAE,MAAA,CAAO;AAAA,IACjB,IAAA,EAAMA,MAAE,MAAA;AAAO,GAChB;AACH,CAAC,CAAA;AAGM,MAAM,yBAAyBC,uCAAA,CAGpC;AAAA,EACA,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,SAAA,CAAU,kBAAkB,CAAA;AAC5D,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,SAAA,CAAU,uBAAuB,CAAA;AAGtE,IAAA,MAAM,WAAW,IAAIC,+BAAA;AAAA,MACnB;AAAA,QACE,QAAA,EAAU,QAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAA,EAAa,WAAA;AAAA,QACb,gBAAA,EAAkB,gBAAA;AAAA,QAClB,QAAA,EAAU,QAAA;AAAA,QACV,iBAAA,EAAmB;AAAA,OACrB;AAAA,MACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,QAAA,IAAA,CAAK,MAAA,EAAW,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAY,EAAG,EAAE,cAAc,CAAA;AAAA,MACxE;AAAA,KACF;AAEA,IAAA,QAAA,CAAS,WAAA,GAAc,SAAS,WAAA,CAC9B,WAAA,EACA,IAAA,EACM;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,6BAA6B,IAAI,CAAA;AAE9C,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA;AAAA,QACX,GAAG,qBAAqB,CAAA,kCAAA,CAAA;AAAA,QACxB,WAAA;AAAA,QACA,CAAC,KAAA,EAAO,IAAA,EAAM,CAAA,KAAM;AAClB,UAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,CAAM,UAAA,KAAe,GAAA,EAAK;AAC9C,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAA,CAAM,UAAU,EAAE,CAAC,CAAA;AACzD,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,CAAC,IAAA,EAAM;AACT,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AACnC,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AACvD,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,OAAO,aAAA,CAAc,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AACjD,UAAA,IAAA,CAAK,MAAM,EAAE,WAAA,EAAa,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AAAA,QAChD;AAAA,OACF;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,qBAAA;AAAA,MACA,MAAA,EAAQD,+CAAA,CAAiC,IAAA,CAAK,QAAQ;AAAA,KACxD;AAAA,EACF,CAAA;AAAA,EACA,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,QAAO,EAAG;AAC7B,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EACA,MAAM,YAAA,CAAa,KAAA,EAAO,EAAE,QAAO,EAAG;AAEpC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAChE,IAAA,OAAA,CAAQ,eAAe,OAAA,CAAQ,WAAA;AAC/B,IAAA,OAAA,CAAQ,+BAA+B,OAAA,CAAQ,gBAAA;AAC/C,IAAA,OAAO,EAAE,aAAa,OAAA,EAAQ;AAAA,EAChC,CAAA;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,QAAO,EAAG;AAG/B,IAAA,MAAM,cAAc,KAAA,CAAM,YAAA;AAE1B,IAAA,MAAM,cAAc,MAAM,MAAA,CAAO,aAAa,WAAW,CAAA,CAAE,MAAM,CAAA,KAAA,KAAS;AACxE,MAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,QAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,MACxC;AACA,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AAED,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,OAAA,EAAS;AAAA,QACP,WAAA;AAAA,QACA,SAAA,EAAW,QAAA;AAAA,QACX,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,cAAc,KAAA,CAAM;AAAA;AACtB,KACF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,MAAA,CAAO,KAAA,EAAO,EAAE,qBAAA,EAAuB,QAAO,EAAG;AAGrD,IAAA,MAAM,cAAc,KAAA,CAAM,YAAA;AAC1B,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,aAAa,WAAW,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,SAAA,GAAYE,sBAAA,CAAW,QAAQ,CAAA,CAClC,OAAO,WAAA,CAAY,KAAA,CAAM,SAAA,CAAU,MAAM,CAAC,CAAA,CAC1C,MAAA,EAAO,CACP,SAAS,WAAW,CAAA;AAEvB,IAAA,MAAM,WAAW,MAAM,KAAA;AAAA,MACrB,CAAA,EAAG,qBAAqB,CAAA,qDAAA,EAAwD,SAAS,CAAA,CAAA;AAAA,MACzF,EAAE,QAAQ,QAAA,EAAU,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA,EAAG;AAAE,KAC1E;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,IAAI,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,EACF;AACF,CAAC;;;;"}
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { createHash } from 'node:crypto';\nimport OAuth2Strategy from 'passport-oauth2';\nimport { z } from 'zod/v3';\n\n/** @public */\nexport interface OpenShiftAuthenticatorContext {\n  openshiftApiServerUrl: string;\n  helper: PassportOAuthAuthenticatorHelper;\n}\n\n/** @private\n * Schema for user.openshift.io/v1,\n * see https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/user_and_group_apis/user-user-openshift-io-v1#user-user-openshift-io-v1\n */\nconst OpenShiftUser = z.object({\n  metadata: z.object({\n    name: z.string(),\n  }),\n});\n\n/** @public */\nexport const openshiftAuthenticator = createOAuthAuthenticator<\n  OpenShiftAuthenticatorContext,\n  PassportProfile\n>({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    required: ['user:full'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const authorizationUrl = config.getString('authorizationUrl');\n    const tokenUrl = config.getString('tokenUrl');\n    const openshiftApiServerUrl = config.getString('openshiftApiServerUrl');\n\n    // userUrl: `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,\n    const strategy = new OAuth2Strategy(\n      {\n        clientID: clientId,\n        clientSecret: clientSecret,\n        callbackURL: callbackUrl,\n        authorizationURL: authorizationUrl,\n        tokenURL: tokenUrl,\n        passReqToCallback: false,\n      },\n      (\n        accessToken: any,\n        refreshToken: string,\n        params: any,\n        fullProfile: PassportProfile,\n        done: PassportOAuthDoneCallback,\n      ) => {\n        done(undefined, { fullProfile, params, accessToken }, { refreshToken });\n      },\n    );\n\n    strategy.userProfile = function userProfile(\n      accessToken: string,\n      done: (err?: unknown, profile?: any) => void,\n    ): void {\n      this._oauth2.useAuthorizationHeaderforGET(true);\n\n      this._oauth2.get(\n        `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,\n        accessToken,\n        (error, data, _) => {\n          if (error !== null && error.statusCode !== 200) {\n            done(new Error(`HTTP error! Status: ${error.statusCode}`));\n            return;\n          }\n\n          if (!data) {\n            done(new Error('No data provided!'));\n            return;\n          }\n\n          if (typeof data !== 'string') {\n            done(new Error('Data of type Buffer is not supported!'));\n            return;\n          }\n\n          const user = OpenShiftUser.parse(JSON.parse(data));\n          done(null, { displayName: user.metadata.name });\n        },\n      );\n    };\n\n    return {\n      openshiftApiServerUrl,\n      helper: PassportOAuthAuthenticatorHelper.from(strategy),\n    };\n  },\n  async start(input, { helper }) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n  async authenticate(input, { helper }) {\n    // Same workaround as the GitHub provider; see https://github.com/backstage/backstage/issues/25383\n    const { fullProfile, session } = await helper.authenticate(input);\n    session.refreshToken = session.accessToken;\n    session.refreshTokenExpiresInSeconds = session.expiresInSeconds;\n    return { fullProfile, session };\n  },\n  async refresh(input, { helper }) {\n    // Because the session is refreshed on login, this override is crucial,\n    // see https://github.com/backstage/backstage/issues/25383\n    const accessToken = input.refreshToken;\n\n    const fullProfile = await helper.fetchProfile(accessToken).catch(error => {\n      if (error.oauthError?.statusCode === 401) {\n        throw new Error('Invalid access token');\n      }\n      throw error;\n    });\n\n    return {\n      fullProfile,\n      session: {\n        accessToken,\n        tokenType: 'bearer',\n        scope: input.scope,\n        refreshToken: input.refreshToken,\n      },\n    };\n  },\n  async logout(input, { openshiftApiServerUrl, helper }) {\n    // Due to the implementation of createOAuthRouteHandlers, only the refresh token is set.\n    // In this provider, the refresh token actually IS the access token.\n    const accessToken = input.refreshToken;\n    if (!accessToken) {\n      throw new Error('access token/refresh token needs to be set for logout');\n    }\n\n    // Check if access token is still valid.\n    try {\n      await helper.fetchProfile(accessToken);\n    } catch {\n      // Invalid token, no need to delete OAuthAccessToken.\n      return;\n    }\n\n    // Calculate token name, see:\n    // https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/oauth_apis/oauthaccesstoken-oauth-openshift-io-v1#apis-oauth-openshift-io-v1-oauthaccesstokens\n    const tokenName = createHash('sha256')\n      .update(accessToken.slice('sha256~'.length))\n      .digest()\n      .toString('base64url');\n\n    const response = await fetch(\n      `${openshiftApiServerUrl}/apis/oauth.openshift.io/v1/oauthaccesstokens/sha256~${tokenName}`,\n      { method: 'DELETE', headers: { Authorization: `Bearer ${accessToken}` } },\n    );\n\n    if (response.status === 401) {\n      throw new Error('unauthorized');\n    }\n  },\n});\n"],"names":["z","createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","OAuth2Strategy","createHash"],"mappings":";;;;;;;;;;;AAoCA,MAAM,aAAA,GAAgBA,KAAE,MAAA,CAAO;AAAA,EAC7B,QAAA,EAAUA,KAAE,MAAA,CAAO;AAAA,IACjB,IAAA,EAAMA,KAAE,MAAA;AAAO,GAChB;AACH,CAAC,CAAA;AAGM,MAAM,yBAAyBC,uCAAA,CAGpC;AAAA,EACA,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,SAAA,CAAU,kBAAkB,CAAA;AAC5D,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,SAAA,CAAU,uBAAuB,CAAA;AAGtE,IAAA,MAAM,WAAW,IAAIC,+BAAA;AAAA,MACnB;AAAA,QACE,QAAA,EAAU,QAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAA,EAAa,WAAA;AAAA,QACb,gBAAA,EAAkB,gBAAA;AAAA,QAClB,QAAA,EAAU,QAAA;AAAA,QACV,iBAAA,EAAmB;AAAA,OACrB;AAAA,MACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,QAAA,IAAA,CAAK,MAAA,EAAW,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAY,EAAG,EAAE,cAAc,CAAA;AAAA,MACxE;AAAA,KACF;AAEA,IAAA,QAAA,CAAS,WAAA,GAAc,SAAS,WAAA,CAC9B,WAAA,EACA,IAAA,EACM;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,6BAA6B,IAAI,CAAA;AAE9C,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA;AAAA,QACX,GAAG,qBAAqB,CAAA,kCAAA,CAAA;AAAA,QACxB,WAAA;AAAA,QACA,CAAC,KAAA,EAAO,IAAA,EAAM,CAAA,KAAM;AAClB,UAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,CAAM,UAAA,KAAe,GAAA,EAAK;AAC9C,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAA,CAAM,UAAU,EAAE,CAAC,CAAA;AACzD,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,CAAC,IAAA,EAAM;AACT,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AACnC,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AACvD,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,OAAO,aAAA,CAAc,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AACjD,UAAA,IAAA,CAAK,MAAM,EAAE,WAAA,EAAa,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AAAA,QAChD;AAAA,OACF;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,qBAAA;AAAA,MACA,MAAA,EAAQD,+CAAA,CAAiC,IAAA,CAAK,QAAQ;AAAA,KACxD;AAAA,EACF,CAAA;AAAA,EACA,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,QAAO,EAAG;AAC7B,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EACA,MAAM,YAAA,CAAa,KAAA,EAAO,EAAE,QAAO,EAAG;AAEpC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAChE,IAAA,OAAA,CAAQ,eAAe,OAAA,CAAQ,WAAA;AAC/B,IAAA,OAAA,CAAQ,+BAA+B,OAAA,CAAQ,gBAAA;AAC/C,IAAA,OAAO,EAAE,aAAa,OAAA,EAAQ;AAAA,EAChC,CAAA;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,QAAO,EAAG;AAG/B,IAAA,MAAM,cAAc,KAAA,CAAM,YAAA;AAE1B,IAAA,MAAM,cAAc,MAAM,MAAA,CAAO,aAAa,WAAW,CAAA,CAAE,MAAM,CAAA,KAAA,KAAS;AACxE,MAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,QAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,MACxC;AACA,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AAED,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,OAAA,EAAS;AAAA,QACP,WAAA;AAAA,QACA,SAAA,EAAW,QAAA;AAAA,QACX,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,cAAc,KAAA,CAAM;AAAA;AACtB,KACF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,MAAA,CAAO,KAAA,EAAO,EAAE,qBAAA,EAAuB,QAAO,EAAG;AAGrD,IAAA,MAAM,cAAc,KAAA,CAAM,YAAA;AAC1B,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,aAAa,WAAW,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,SAAA,GAAYE,sBAAA,CAAW,QAAQ,CAAA,CAClC,OAAO,WAAA,CAAY,KAAA,CAAM,SAAA,CAAU,MAAM,CAAC,CAAA,CAC1C,MAAA,EAAO,CACP,SAAS,WAAW,CAAA;AAEvB,IAAA,MAAM,WAAW,MAAM,KAAA;AAAA,MACrB,CAAA,EAAG,qBAAqB,CAAA,qDAAA,EAAwD,SAAS,CAAA,CAAA;AAAA,MACzF,EAAE,QAAQ,QAAA,EAAU,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA,EAAG;AAAE,KAC1E;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,IAAI,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,EACF;AACF,CAAC;;;;"}

package/dist/resolvers.cjs.js

@@ -2,13 +2,13 @@
 
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var catalogModel = require('@backstage/catalog-model');
-var zod = require('zod');
+var v3 = require('zod/v3');
 
 exports.openshiftSignInResolvers = void 0;
 ((openshiftSignInResolvers2) => {
   openshiftSignInResolvers2.displayNameMatchingUserEntityName = pluginAuthNode.createSignInResolverFactory({
-    optionsSchema: zod.z.object({
-      dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+    optionsSchema: v3.z.object({
+      dangerouslyAllowSignInWithoutUserInCatalog: v3.z.boolean().optional()
     }).optional(),
     create(options = {}) {
       return async (info, ctx) => {

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\n\nimport {\n  DEFAULT_NAMESPACE,\n  stringifyEntityRef,\n} from '@backstage/catalog-model';\nimport { z } from 'zod';\n\nexport namespace openshiftSignInResolvers {\n  export const displayNameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { displayName } = info.profile;\n\n        if (!displayName) {\n          throw new Error(\n            `OpenShift user profile does not contain a displayName`,\n          );\n        }\n\n        const userRef = stringifyEntityRef({\n          kind: 'User',\n          name: displayName,\n          namespace: DEFAULT_NAMESPACE,\n        });\n\n        return await ctx.signInWithCatalogUser(\n          { entityRef: userRef },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: displayName } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["openshiftSignInResolvers","createSignInResolverFactory","z","stringifyEntityRef","DEFAULT_NAMESPACE"],"mappings":";;;;;;AA6BiBA;AAAA,CAAV,CAAUA,yBAAAA,KAAV;AACE,EAAMA,yBAAAA,CAAA,oCAAoCC,0CAAA,CAA4B;AAAA,IAC3E,aAAA,EAAeC,MACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,OAAA;AAE7B,QAAA,IAAI,CAAC,WAAA,EAAa;AAChB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qDAAA;AAAA,WACF;AAAA,QACF;AAEA,QAAA,MAAM,UAAUC,+BAAA,CAAmB;AAAA,UACjC,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,WAAA;AAAA,UACN,SAAA,EAAWC;AAAA,SACZ,CAAA;AAED,QAAA,OAAO,MAAM,GAAA,CAAI,qBAAA;AAAA,UACf,EAAE,WAAW,OAAA,EAAQ;AAAA,UACrB;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,WAAA,EAAY,EAAE,GACnC;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAAA,CAAA,EArCcJ,gCAAA,KAAAA,gCAAA,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\n\nimport {\n  DEFAULT_NAMESPACE,\n  stringifyEntityRef,\n} from '@backstage/catalog-model';\nimport { z } from 'zod/v3';\n\nexport namespace openshiftSignInResolvers {\n  export const displayNameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { displayName } = info.profile;\n\n        if (!displayName) {\n          throw new Error(\n            `OpenShift user profile does not contain a displayName`,\n          );\n        }\n\n        const userRef = stringifyEntityRef({\n          kind: 'User',\n          name: displayName,\n          namespace: DEFAULT_NAMESPACE,\n        });\n\n        return await ctx.signInWithCatalogUser(\n          { entityRef: userRef },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: displayName } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["openshiftSignInResolvers","createSignInResolverFactory","z","stringifyEntityRef","DEFAULT_NAMESPACE"],"mappings":";;;;;;AA6BiBA;AAAA,CAAV,CAAUA,yBAAAA,KAAV;AACE,EAAMA,yBAAAA,CAAA,oCAAoCC,0CAAA,CAA4B;AAAA,IAC3E,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,OAAA;AAE7B,QAAA,IAAI,CAAC,WAAA,EAAa;AAChB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qDAAA;AAAA,WACF;AAAA,QACF;AAEA,QAAA,MAAM,UAAUC,+BAAA,CAAmB;AAAA,UACjC,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,WAAA;AAAA,UACN,SAAA,EAAWC;AAAA,SACZ,CAAA;AAED,QAAA,OAAO,MAAM,GAAA,CAAI,qBAAA;AAAA,UACf,EAAE,WAAW,OAAA,EAAQ;AAAA,UACrB;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,WAAA,EAAY,EAAE,GACnC;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAAA,CAAA,EArCcJ,gCAAA,KAAAA,gCAAA,GAAA,EAAA,CAAA,CAAA;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-openshift-provider",
-  "version": "0.1.5-next.1",
+  "version": "0.1.5",
   "description": "The OpenShift backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -37,19 +37,19 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.8.0-next.1",
-    "@backstage/catalog-model": "1.7.6",
-    "@backstage/plugin-auth-node": "0.6.14-next.2",
-    "@backstage/types": "1.2.2",
+    "@backstage/backend-plugin-api": "^1.8.0",
+    "@backstage/catalog-model": "^1.7.7",
+    "@backstage/plugin-auth-node": "^0.6.14",
+    "@backstage/types": "^1.2.2",
     "passport-oauth2": "^1.8.0",
-    "zod": "^3.24.2"
+    "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.16.0-next.2",
-    "@backstage/backend-test-utils": "1.11.1-next.2",
-    "@backstage/cli": "0.36.0-next.2",
-    "@backstage/config": "1.3.6",
-    "@backstage/plugin-auth-backend": "0.27.1-next.2",
+    "@backstage/backend-defaults": "^0.16.0",
+    "@backstage/backend-test-utils": "^1.11.1",
+    "@backstage/cli": "^0.36.0",
+    "@backstage/config": "^1.3.6",
+    "@backstage/plugin-auth-backend": "^0.27.2",
     "express": "^4.22.0",
     "msw": "^2.7.3",
     "supertest": "^7.1.0"