@backstage/plugin-auth-backend-module-pinniped-provider 0.2.0 → 0.2.1-next.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @backstage/plugin-auth-backend-module-pinniped-provider
 
+## 0.2.1-next.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3-next.1
+  - @backstage/backend-plugin-api@1.0.1-next.1
+  - @backstage/config@1.2.0
+
+## 0.2.1-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3-next.0
+  - @backstage/backend-plugin-api@1.0.1-next.0
+  - @backstage/config@1.2.0
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/authenticator.cjs.js

@@ -0,0 +1,185 @@
+'use strict';
+
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var openidClient = require('openid-client');
+var luxon = require('luxon');
+
+const rfc8693TokenExchange = async ({
+  subject_token,
+  target_audience,
+  ctx
+}) => {
+  const { client } = await ctx;
+  return client.grant({
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+    subject_token,
+    audience: target_audience,
+    subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
+    requested_token_type: "urn:ietf:params:oauth:token-type:jwt"
+  }).then((tokenset) => tokenset.access_token).catch((err) => {
+    throw new Error(`RFC8693 token exchange failed with error: ${err}`);
+  });
+};
+const OIDC_METADATA_TTL_SECONDS = 3600;
+class PinnipedStrategyCache {
+  callbackUrl;
+  config;
+  strategyPromise;
+  cachedPromise;
+  cachedPromiseExpiry;
+  constructor(callbackUrl, config) {
+    this.callbackUrl = callbackUrl;
+    this.config = config;
+    this.strategyPromise = this.buildStrategy();
+  }
+  async getStrategy() {
+    if (this.cachedPromise) {
+      if (this.cachedPromiseExpiry && luxon.DateTime.fromJSDate(this.cachedPromiseExpiry) > luxon.DateTime.local()) {
+        return this.cachedPromise;
+      }
+      this.strategyPromise = this.buildStrategy();
+      delete this.cachedPromise;
+    }
+    try {
+      await this.strategyPromise;
+      this.cachedPromise = this.strategyPromise;
+      this.cachedPromiseExpiry = luxon.DateTime.utc().plus({ seconds: OIDC_METADATA_TTL_SECONDS }).toJSDate();
+    } catch (error) {
+      this.strategyPromise = this.buildStrategy();
+      delete this.cachedPromise;
+      delete this.cachedPromiseExpiry;
+    }
+    return this.strategyPromise;
+  }
+  async buildStrategy() {
+    const issuer = await openidClient.Issuer.discover(
+      `${this.config.getString(
+        "federationDomain"
+      )}/.well-known/openid-configuration`
+    );
+    const client = new issuer.Client({
+      access_type: "offline",
+      client_id: this.config.getString("clientId"),
+      client_secret: this.config.getString("clientSecret"),
+      redirect_uris: [this.callbackUrl],
+      response_types: ["code"],
+      id_token_signed_response_alg: "ES256"
+    });
+    const providerStrategy = new openidClient.Strategy(
+      {
+        client,
+        passReqToCallback: false
+      },
+      (tokenset, done) => {
+        done(void 0, { tokenset }, {});
+      }
+    );
+    return { providerStrategy, client };
+  }
+}
+const pinnipedAuthenticator = pluginAuthNode.createOAuthAuthenticator({
+  defaultProfileTransform: async (_r, _c) => ({ profile: {} }),
+  scopes: {
+    required: [
+      "openid",
+      "pinniped:request-audience",
+      "username",
+      "offline_access"
+    ]
+  },
+  initialize({ callbackUrl, config }) {
+    if (config.has("scope")) {
+      throw new Error(
+        'The pinniped provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
+      );
+    }
+    return new PinnipedStrategyCache(callbackUrl, config);
+  },
+  async start(input, ctx) {
+    const { providerStrategy } = await ctx.getStrategy();
+    const stringifiedAudience = input.req.query?.audience;
+    const decodedState = pluginAuthNode.decodeOAuthState(input.state);
+    const state = { ...decodedState, audience: stringifiedAudience };
+    const options = {
+      scope: input.scope,
+      state: pluginAuthNode.encodeOAuthState(state)
+    };
+    return new Promise((resolve, reject) => {
+      const strategy = Object.create(providerStrategy);
+      strategy.redirect = (url) => {
+        resolve({ url });
+      };
+      strategy.error = (error) => {
+        reject(error);
+      };
+      strategy.authenticate(input.req, { ...options });
+    });
+  },
+  async authenticate(input, ctx) {
+    const { providerStrategy } = await ctx.getStrategy();
+    const { req } = input;
+    const { searchParams } = new URL(req.url, "https://pinniped.com");
+    const stateParam = searchParams.get("state");
+    const audience = stateParam ? pluginAuthNode.decodeOAuthState(stateParam).audience : void 0;
+    return new Promise((resolve, reject) => {
+      const strategy = Object.create(providerStrategy);
+      strategy.success = (user) => {
+        (audience ? rfc8693TokenExchange({
+          subject_token: user.tokenset.access_token,
+          target_audience: audience,
+          ctx: ctx.getStrategy()
+        }).catch(
+          (err) => reject(
+            new Error(
+              `Failed to get cluster specific ID token for "${audience}": ${err}`
+            )
+          )
+        ) : Promise.resolve(user.tokenset.id_token)).then((idToken) => {
+          resolve({
+            fullProfile: { provider: "", id: "", displayName: "" },
+            session: {
+              accessToken: user.tokenset.access_token,
+              tokenType: user.tokenset.token_type ?? "bearer",
+              scope: user.tokenset.scope,
+              idToken,
+              refreshToken: user.tokenset.refresh_token
+            }
+          });
+        });
+      };
+      strategy.fail = (info) => {
+        reject(new Error(`Authentication rejected, ${info.message || ""}`));
+      };
+      strategy.error = (error) => {
+        reject(error);
+      };
+      strategy.redirect = () => {
+        reject(new Error("Unexpected redirect"));
+      };
+      strategy.authenticate(req);
+    });
+  },
+  async refresh(input, ctx) {
+    const { client } = await ctx.getStrategy();
+    const tokenset = await client.refresh(input.refreshToken);
+    return new Promise((resolve, reject) => {
+      if (!tokenset.access_token) {
+        reject(new Error("Refresh Failed"));
+      }
+      resolve({
+        fullProfile: { provider: "", id: "", displayName: "" },
+        session: {
+          accessToken: tokenset.access_token,
+          tokenType: tokenset.token_type ?? "bearer",
+          scope: tokenset.scope,
+          idToken: tokenset.id_token,
+          refreshToken: tokenset.refresh_token
+        }
+      });
+    });
+  }
+});
+
+exports.PinnipedStrategyCache = PinnipedStrategyCache;
+exports.pinnipedAuthenticator = pinnipedAuthenticator;
+//# sourceMappingURL=authenticator.cjs.js.map

package/dist/authenticator.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport { PassportDoneCallback } from '@backstage/plugin-auth-node';\nimport {\n  createOAuthAuthenticator,\n  decodeOAuthState,\n  encodeOAuthState,\n} from '@backstage/plugin-auth-node';\nimport {\n  Client,\n  Issuer,\n  TokenSet,\n  Strategy as OidcStrategy,\n  BaseClient,\n} from 'openid-client';\nimport { DateTime } from 'luxon';\n\nconst rfc8693TokenExchange = async ({\n  subject_token,\n  target_audience,\n  ctx,\n}: {\n  subject_token: string;\n  target_audience: string;\n  ctx: Promise<{\n    providerStrategy: OidcStrategy<{}>;\n    client: Client;\n  }>;\n}): Promise<string | undefined> => {\n  const { client } = await ctx;\n  return client\n    .grant({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token,\n      audience: target_audience,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n      requested_token_type: 'urn:ietf:params:oauth:token-type:jwt',\n    })\n    .then(tokenset => tokenset.access_token)\n    .catch(err => {\n      throw new Error(`RFC8693 token exchange failed with error: ${err}`);\n    });\n};\n\nconst OIDC_METADATA_TTL_SECONDS = 3600;\n\n/** @public */\nexport class PinnipedStrategyCache {\n  private readonly callbackUrl: string;\n  private readonly config: Config;\n  private strategyPromise: Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }>;\n\n  private cachedPromise?: Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }>;\n  private cachedPromiseExpiry?: Date;\n\n  constructor(callbackUrl: string, config: Config) {\n    this.callbackUrl = callbackUrl;\n    this.config = config;\n    this.strategyPromise = this.buildStrategy();\n  }\n\n  public async getStrategy(): Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }> {\n    if (this.cachedPromise) {\n      if (\n        this.cachedPromiseExpiry &&\n        DateTime.fromJSDate(this.cachedPromiseExpiry) > DateTime.local()\n      ) {\n        return this.cachedPromise;\n      }\n      // cachedPromise has expired, remove promise from cache and regenerate strategy\n      this.strategyPromise = this.buildStrategy();\n      delete this.cachedPromise;\n    }\n\n    try {\n      // if strategy is generated successfully, save it to cache\n      await this.strategyPromise;\n      this.cachedPromise = this.strategyPromise;\n      this.cachedPromiseExpiry = DateTime.utc()\n        .plus({ seconds: OIDC_METADATA_TTL_SECONDS })\n        .toJSDate();\n    } catch (error) {\n      // if we fail to generate a strategy, retry and overwrite strategy\n      this.strategyPromise = this.buildStrategy();\n      delete this.cachedPromise;\n      delete this.cachedPromiseExpiry;\n    }\n\n    return this.strategyPromise;\n  }\n\n  private async buildStrategy(): Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }> {\n    const issuer = await Issuer.discover(\n      `${this.config.getString(\n        'federationDomain',\n      )}/.well-known/openid-configuration`,\n    );\n    const client = new issuer.Client({\n      access_type: 'offline',\n      client_id: this.config.getString('clientId'),\n      client_secret: this.config.getString('clientSecret'),\n      redirect_uris: [this.callbackUrl],\n      response_types: ['code'],\n      id_token_signed_response_alg: 'ES256',\n    });\n    const providerStrategy = new OidcStrategy(\n      {\n        client,\n        passReqToCallback: false,\n      },\n      (\n        tokenset: TokenSet,\n        done: PassportDoneCallback<\n          { tokenset: TokenSet },\n          {\n            refreshToken?: string;\n          }\n        >,\n      ) => {\n        done(undefined, { tokenset }, {});\n      },\n    );\n    return { providerStrategy, client };\n  }\n}\n\n/** @public */\nexport const pinnipedAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform: async (_r, _c) => ({ profile: {} }),\n  scopes: {\n    required: [\n      'openid',\n      'pinniped:request-audience',\n      'username',\n      'offline_access',\n    ],\n  },\n  initialize({ callbackUrl, config }) {\n    if (config.has('scope')) {\n      throw new Error(\n        'The pinniped provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n    return new PinnipedStrategyCache(callbackUrl, config);\n  },\n  async start(input, ctx): Promise<{ url: string; status?: number }> {\n    const { providerStrategy } = await ctx.getStrategy();\n    const stringifiedAudience = input.req.query?.audience as string;\n    const decodedState = decodeOAuthState(input.state);\n    const state = { ...decodedState, audience: stringifiedAudience };\n    const options: Record<string, string> = {\n      scope: input.scope,\n      state: encodeOAuthState(state),\n    };\n\n    return new Promise((resolve, reject) => {\n      const strategy = Object.create(providerStrategy);\n      strategy.redirect = (url: string) => {\n        resolve({ url });\n      };\n      strategy.error = (error: Error) => {\n        reject(error);\n      };\n      strategy.authenticate(input.req, { ...options });\n    });\n  },\n\n  async authenticate(input, ctx) {\n    const { providerStrategy } = await ctx.getStrategy();\n    const { req } = input;\n    const { searchParams } = new URL(req.url, 'https://pinniped.com');\n    const stateParam = searchParams.get('state');\n    const audience = stateParam\n      ? decodeOAuthState(stateParam).audience\n      : undefined;\n\n    return new Promise((resolve, reject) => {\n      const strategy = Object.create(providerStrategy);\n      strategy.success = (user: any) => {\n        (audience\n          ? rfc8693TokenExchange({\n              subject_token: user.tokenset.access_token,\n              target_audience: audience,\n              ctx: ctx.getStrategy(),\n            }).catch(err =>\n              reject(\n                new Error(\n                  `Failed to get cluster specific ID token for \"${audience}\": ${err}`,\n                ),\n              ),\n            )\n          : Promise.resolve(user.tokenset.id_token)\n        ).then(idToken => {\n          resolve({\n            fullProfile: { provider: '', id: '', displayName: '' },\n            session: {\n              accessToken: user.tokenset.access_token!,\n              tokenType: user.tokenset.token_type ?? 'bearer',\n              scope: user.tokenset.scope!,\n              idToken,\n              refreshToken: user.tokenset.refresh_token,\n            },\n          });\n        });\n      };\n\n      strategy.fail = (info: any) => {\n        reject(new Error(`Authentication rejected, ${info.message || ''}`));\n      };\n\n      strategy.error = (error: Error) => {\n        reject(error);\n      };\n\n      strategy.redirect = () => {\n        reject(new Error('Unexpected redirect'));\n      };\n\n      strategy.authenticate(req);\n    });\n  },\n\n  async refresh(input, ctx) {\n    const { client } = await ctx.getStrategy();\n    const tokenset = await client.refresh(input.refreshToken);\n\n    return new Promise((resolve, reject) => {\n      if (!tokenset.access_token) {\n        reject(new Error('Refresh Failed'));\n      }\n\n      resolve({\n        fullProfile: { provider: '', id: '', displayName: '' },\n        session: {\n          accessToken: tokenset.access_token!,\n          tokenType: tokenset.token_type ?? 'bearer',\n          scope: tokenset.scope!,\n          idToken: tokenset.id_token,\n          refreshToken: tokenset.refresh_token,\n        },\n      });\n    });\n  },\n});\n"],"names":["DateTime","Issuer","OidcStrategy","createOAuthAuthenticator","decodeOAuthState","encodeOAuthState"],"mappings":";;;;;;AA+BA,MAAM,uBAAuB,OAAO;AAAA,EAClC,aAAA;AAAA,EACA,eAAA;AAAA,EACA,GAAA;AACF,CAOmC,KAAA;AACjC,EAAM,MAAA,EAAE,MAAO,EAAA,GAAI,MAAM,GAAA,CAAA;AACzB,EAAA,OAAO,OACJ,KAAM,CAAA;AAAA,IACL,UAAY,EAAA,iDAAA;AAAA,IACZ,aAAA;AAAA,IACA,QAAU,EAAA,eAAA;AAAA,IACV,kBAAoB,EAAA,+CAAA;AAAA,IACpB,oBAAsB,EAAA,sCAAA;AAAA,GACvB,EACA,IAAK,CAAA,CAAA,QAAA,KAAY,SAAS,YAAY,CAAA,CACtC,MAAM,CAAO,GAAA,KAAA;AACZ,IAAA,MAAM,IAAI,KAAA,CAAM,CAA6C,0CAAA,EAAA,GAAG,CAAE,CAAA,CAAA,CAAA;AAAA,GACnE,CAAA,CAAA;AACL,CAAA,CAAA;AAEA,MAAM,yBAA4B,GAAA,IAAA,CAAA;AAG3B,MAAM,qBAAsB,CAAA;AAAA,EAChB,WAAA,CAAA;AAAA,EACA,MAAA,CAAA;AAAA,EACT,eAAA,CAAA;AAAA,EAKA,aAAA,CAAA;AAAA,EAIA,mBAAA,CAAA;AAAA,EAER,WAAA,CAAY,aAAqB,MAAgB,EAAA;AAC/C,IAAA,IAAA,CAAK,WAAc,GAAA,WAAA,CAAA;AACnB,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA,CAAA;AACd,IAAK,IAAA,CAAA,eAAA,GAAkB,KAAK,aAAc,EAAA,CAAA;AAAA,GAC5C;AAAA,EAEA,MAAa,WAGV,GAAA;AACD,IAAA,IAAI,KAAK,aAAe,EAAA;AACtB,MACE,IAAA,IAAA,CAAK,uBACLA,cAAS,CAAA,UAAA,CAAW,KAAK,mBAAmB,CAAA,GAAIA,cAAS,CAAA,KAAA,EACzD,EAAA;AACA,QAAA,OAAO,IAAK,CAAA,aAAA,CAAA;AAAA,OACd;AAEA,MAAK,IAAA,CAAA,eAAA,GAAkB,KAAK,aAAc,EAAA,CAAA;AAC1C,MAAA,OAAO,IAAK,CAAA,aAAA,CAAA;AAAA,KACd;AAEA,IAAI,IAAA;AAEF,MAAA,MAAM,IAAK,CAAA,eAAA,CAAA;AACX,MAAA,IAAA,CAAK,gBAAgB,IAAK,CAAA,eAAA,CAAA;AAC1B,MAAK,IAAA,CAAA,mBAAA,GAAsBA,cAAS,CAAA,GAAA,EACjC,CAAA,IAAA,CAAK,EAAE,OAAS,EAAA,yBAAA,EAA2B,CAAA,CAC3C,QAAS,EAAA,CAAA;AAAA,aACL,KAAO,EAAA;AAEd,MAAK,IAAA,CAAA,eAAA,GAAkB,KAAK,aAAc,EAAA,CAAA;AAC1C,MAAA,OAAO,IAAK,CAAA,aAAA,CAAA;AACZ,MAAA,OAAO,IAAK,CAAA,mBAAA,CAAA;AAAA,KACd;AAEA,IAAA,OAAO,IAAK,CAAA,eAAA,CAAA;AAAA,GACd;AAAA,EAEA,MAAc,aAGX,GAAA;AACD,IAAM,MAAA,MAAA,GAAS,MAAMC,mBAAO,CAAA,QAAA;AAAA,MAC1B,CAAA,EAAG,KAAK,MAAO,CAAA,SAAA;AAAA,QACb,kBAAA;AAAA,OACD,CAAA,iCAAA,CAAA;AAAA,KACH,CAAA;AACA,IAAM,MAAA,MAAA,GAAS,IAAI,MAAA,CAAO,MAAO,CAAA;AAAA,MAC/B,WAAa,EAAA,SAAA;AAAA,MACb,SAAW,EAAA,IAAA,CAAK,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,MAC3C,aAAe,EAAA,IAAA,CAAK,MAAO,CAAA,SAAA,CAAU,cAAc,CAAA;AAAA,MACnD,aAAA,EAAe,CAAC,IAAA,CAAK,WAAW,CAAA;AAAA,MAChC,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,MACvB,4BAA8B,EAAA,OAAA;AAAA,KAC/B,CAAA,CAAA;AACD,IAAA,MAAM,mBAAmB,IAAIC,qBAAA;AAAA,MAC3B;AAAA,QACE,MAAA;AAAA,QACA,iBAAmB,EAAA,KAAA;AAAA,OACrB;AAAA,MACA,CACE,UACA,IAMG,KAAA;AACH,QAAA,IAAA,CAAK,KAAW,CAAA,EAAA,EAAE,QAAS,EAAA,EAAG,EAAE,CAAA,CAAA;AAAA,OAClC;AAAA,KACF,CAAA;AACA,IAAO,OAAA,EAAE,kBAAkB,MAAO,EAAA,CAAA;AAAA,GACpC;AACF,CAAA;AAGO,MAAM,wBAAwBC,uCAAyB,CAAA;AAAA,EAC5D,yBAAyB,OAAO,EAAA,EAAI,QAAQ,EAAE,OAAA,EAAS,EAAG,EAAA,CAAA;AAAA,EAC1D,MAAQ,EAAA;AAAA,IACN,QAAU,EAAA;AAAA,MACR,QAAA;AAAA,MACA,2BAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA;AAAA,KACF;AAAA,GACF;AAAA,EACA,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,OAAO,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,8HAAA;AAAA,OACF,CAAA;AAAA,KACF;AACA,IAAO,OAAA,IAAI,qBAAsB,CAAA,WAAA,EAAa,MAAM,CAAA,CAAA;AAAA,GACtD;AAAA,EACA,MAAM,KAAM,CAAA,KAAA,EAAO,GAAgD,EAAA;AACjE,IAAA,MAAM,EAAE,gBAAA,EAAqB,GAAA,MAAM,IAAI,WAAY,EAAA,CAAA;AACnD,IAAM,MAAA,mBAAA,GAAsB,KAAM,CAAA,GAAA,CAAI,KAAO,EAAA,QAAA,CAAA;AAC7C,IAAM,MAAA,YAAA,GAAeC,+BAAiB,CAAA,KAAA,CAAM,KAAK,CAAA,CAAA;AACjD,IAAA,MAAM,KAAQ,GAAA,EAAE,GAAG,YAAA,EAAc,UAAU,mBAAoB,EAAA,CAAA;AAC/D,IAAA,MAAM,OAAkC,GAAA;AAAA,MACtC,OAAO,KAAM,CAAA,KAAA;AAAA,MACb,KAAA,EAAOC,gCAAiB,KAAK,CAAA;AAAA,KAC/B,CAAA;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAM,MAAA,QAAA,GAAW,MAAO,CAAA,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAC/C,MAAS,QAAA,CAAA,QAAA,GAAW,CAAC,GAAgB,KAAA;AACnC,QAAQ,OAAA,CAAA,EAAE,KAAK,CAAA,CAAA;AAAA,OACjB,CAAA;AACA,MAAS,QAAA,CAAA,KAAA,GAAQ,CAAC,KAAiB,KAAA;AACjC,QAAA,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,OACd,CAAA;AACA,MAAA,QAAA,CAAS,aAAa,KAAM,CAAA,GAAA,EAAK,EAAE,GAAG,SAAS,CAAA,CAAA;AAAA,KAChD,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAa,CAAA,KAAA,EAAO,GAAK,EAAA;AAC7B,IAAA,MAAM,EAAE,gBAAA,EAAqB,GAAA,MAAM,IAAI,WAAY,EAAA,CAAA;AACnD,IAAM,MAAA,EAAE,KAAQ,GAAA,KAAA,CAAA;AAChB,IAAA,MAAM,EAAE,YAAa,EAAA,GAAI,IAAI,GAAI,CAAA,GAAA,CAAI,KAAK,sBAAsB,CAAA,CAAA;AAChE,IAAM,MAAA,UAAA,GAAa,YAAa,CAAA,GAAA,CAAI,OAAO,CAAA,CAAA;AAC3C,IAAA,MAAM,QAAW,GAAA,UAAA,GACbD,+BAAiB,CAAA,UAAU,EAAE,QAC7B,GAAA,KAAA,CAAA,CAAA;AAEJ,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAM,MAAA,QAAA,GAAW,MAAO,CAAA,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAC/C,MAAS,QAAA,CAAA,OAAA,GAAU,CAAC,IAAc,KAAA;AAChC,QAAA,CAAC,WACG,oBAAqB,CAAA;AAAA,UACnB,aAAA,EAAe,KAAK,QAAS,CAAA,YAAA;AAAA,UAC7B,eAAiB,EAAA,QAAA;AAAA,UACjB,GAAA,EAAK,IAAI,WAAY,EAAA;AAAA,SACtB,CAAE,CAAA,KAAA;AAAA,UAAM,CACP,GAAA,KAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,6CAAA,EAAgD,QAAQ,CAAA,GAAA,EAAM,GAAG,CAAA,CAAA;AAAA,aACnE;AAAA,WACF;AAAA,SACF,GACA,QAAQ,OAAQ,CAAA,IAAA,CAAK,SAAS,QAAQ,CAAA,EACxC,KAAK,CAAW,OAAA,KAAA;AAChB,UAAQ,OAAA,CAAA;AAAA,YACN,aAAa,EAAE,QAAA,EAAU,IAAI,EAAI,EAAA,EAAA,EAAI,aAAa,EAAG,EAAA;AAAA,YACrD,OAAS,EAAA;AAAA,cACP,WAAA,EAAa,KAAK,QAAS,CAAA,YAAA;AAAA,cAC3B,SAAA,EAAW,IAAK,CAAA,QAAA,CAAS,UAAc,IAAA,QAAA;AAAA,cACvC,KAAA,EAAO,KAAK,QAAS,CAAA,KAAA;AAAA,cACrB,OAAA;AAAA,cACA,YAAA,EAAc,KAAK,QAAS,CAAA,aAAA;AAAA,aAC9B;AAAA,WACD,CAAA,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH,CAAA;AAEA,MAAS,QAAA,CAAA,IAAA,GAAO,CAAC,IAAc,KAAA;AAC7B,QAAA,MAAA,CAAO,IAAI,KAAM,CAAA,CAAA,yBAAA,EAA4B,KAAK,OAAW,IAAA,EAAE,EAAE,CAAC,CAAA,CAAA;AAAA,OACpE,CAAA;AAEA,MAAS,QAAA,CAAA,KAAA,GAAQ,CAAC,KAAiB,KAAA;AACjC,QAAA,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,OACd,CAAA;AAEA,MAAA,QAAA,CAAS,WAAW,MAAM;AACxB,QAAO,MAAA,CAAA,IAAI,KAAM,CAAA,qBAAqB,CAAC,CAAA,CAAA;AAAA,OACzC,CAAA;AAEA,MAAA,QAAA,CAAS,aAAa,GAAG,CAAA,CAAA;AAAA,KAC1B,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,GAAK,EAAA;AACxB,IAAA,MAAM,EAAE,MAAA,EAAW,GAAA,MAAM,IAAI,WAAY,EAAA,CAAA;AACzC,IAAA,MAAM,QAAW,GAAA,MAAM,MAAO,CAAA,OAAA,CAAQ,MAAM,YAAY,CAAA,CAAA;AAExD,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAI,IAAA,CAAC,SAAS,YAAc,EAAA;AAC1B,QAAO,MAAA,CAAA,IAAI,KAAM,CAAA,gBAAgB,CAAC,CAAA,CAAA;AAAA,OACpC;AAEA,MAAQ,OAAA,CAAA;AAAA,QACN,aAAa,EAAE,QAAA,EAAU,IAAI,EAAI,EAAA,EAAA,EAAI,aAAa,EAAG,EAAA;AAAA,QACrD,OAAS,EAAA;AAAA,UACP,aAAa,QAAS,CAAA,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAc,IAAA,QAAA;AAAA,UAClC,OAAO,QAAS,CAAA,KAAA;AAAA,UAChB,SAAS,QAAS,CAAA,QAAA;AAAA,UAClB,cAAc,QAAS,CAAA,aAAA;AAAA,SACzB;AAAA,OACD,CAAA,CAAA;AAAA,KACF,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;;"}

package/dist/deprecated.cjs.js

@@ -0,0 +1,8 @@
+'use strict';
+
+var module$1 = require('./module.cjs.js');
+
+const authModulePinnipedProvider = module$1.authModulePinnipedProvider;
+
+exports.authModulePinnipedProvider = authModulePinnipedProvider;
+//# sourceMappingURL=deprecated.cjs.js.map

package/dist/deprecated.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.cjs.js","sources":["../src/deprecated.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { authModulePinnipedProvider as deprecatedAuthModulePinnipedProvider } from './module';\n\n/**\n * @public\n * @deprecated Use default import instead\n */\nexport const authModulePinnipedProvider = deprecatedAuthModulePinnipedProvider;\n"],"names":["deprecatedAuthModulePinnipedProvider"],"mappings":";;;;AAsBO,MAAM,0BAA6B,GAAAA;;;;"}

package/dist/index.cjs.js

@@ -2,214 +2,14 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var pluginAuthNode = require('@backstage/plugin-auth-node');
-var openidClient = require('openid-client');
-var luxon = require('luxon');
-var backendPluginApi = require('@backstage/backend-plugin-api');
+var authenticator = require('./authenticator.cjs.js');
+var module$1 = require('./module.cjs.js');
+var deprecated = require('./deprecated.cjs.js');
 
-const rfc8693TokenExchange = async ({
-  subject_token,
-  target_audience,
-  ctx
-}) => {
-  const { client } = await ctx;
-  return client.grant({
-    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
-    subject_token,
-    audience: target_audience,
-    subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
-    requested_token_type: "urn:ietf:params:oauth:token-type:jwt"
-  }).then((tokenset) => tokenset.access_token).catch((err) => {
-    throw new Error(`RFC8693 token exchange failed with error: ${err}`);
-  });
-};
-const OIDC_METADATA_TTL_SECONDS = 3600;
-class PinnipedStrategyCache {
-  callbackUrl;
-  config;
-  strategyPromise;
-  cachedPromise;
-  cachedPromiseExpiry;
-  constructor(callbackUrl, config) {
-    this.callbackUrl = callbackUrl;
-    this.config = config;
-    this.strategyPromise = this.buildStrategy();
-  }
-  async getStrategy() {
-    if (this.cachedPromise) {
-      if (this.cachedPromiseExpiry && luxon.DateTime.fromJSDate(this.cachedPromiseExpiry) > luxon.DateTime.local()) {
-        return this.cachedPromise;
-      }
-      this.strategyPromise = this.buildStrategy();
-      delete this.cachedPromise;
-    }
-    try {
-      await this.strategyPromise;
-      this.cachedPromise = this.strategyPromise;
-      this.cachedPromiseExpiry = luxon.DateTime.utc().plus({ seconds: OIDC_METADATA_TTL_SECONDS }).toJSDate();
-    } catch (error) {
-      this.strategyPromise = this.buildStrategy();
-      delete this.cachedPromise;
-      delete this.cachedPromiseExpiry;
-    }
-    return this.strategyPromise;
-  }
-  async buildStrategy() {
-    const issuer = await openidClient.Issuer.discover(
-      `${this.config.getString(
-        "federationDomain"
-      )}/.well-known/openid-configuration`
-    );
-    const client = new issuer.Client({
-      access_type: "offline",
-      client_id: this.config.getString("clientId"),
-      client_secret: this.config.getString("clientSecret"),
-      redirect_uris: [this.callbackUrl],
-      response_types: ["code"],
-      id_token_signed_response_alg: "ES256"
-    });
-    const providerStrategy = new openidClient.Strategy(
-      {
-        client,
-        passReqToCallback: false
-      },
-      (tokenset, done) => {
-        done(void 0, { tokenset }, {});
-      }
-    );
-    return { providerStrategy, client };
-  }
-}
-const pinnipedAuthenticator = pluginAuthNode.createOAuthAuthenticator({
-  defaultProfileTransform: async (_r, _c) => ({ profile: {} }),
-  scopes: {
-    required: [
-      "openid",
-      "pinniped:request-audience",
-      "username",
-      "offline_access"
-    ]
-  },
-  initialize({ callbackUrl, config }) {
-    if (config.has("scope")) {
-      throw new Error(
-        'The pinniped provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
-      );
-    }
-    return new PinnipedStrategyCache(callbackUrl, config);
-  },
-  async start(input, ctx) {
-    const { providerStrategy } = await ctx.getStrategy();
-    const stringifiedAudience = input.req.query?.audience;
-    const decodedState = pluginAuthNode.decodeOAuthState(input.state);
-    const state = { ...decodedState, audience: stringifiedAudience };
-    const options = {
-      scope: input.scope,
-      state: pluginAuthNode.encodeOAuthState(state)
-    };
-    return new Promise((resolve, reject) => {
-      const strategy = Object.create(providerStrategy);
-      strategy.redirect = (url) => {
-        resolve({ url });
-      };
-      strategy.error = (error) => {
-        reject(error);
-      };
-      strategy.authenticate(input.req, { ...options });
-    });
-  },
-  async authenticate(input, ctx) {
-    const { providerStrategy } = await ctx.getStrategy();
-    const { req } = input;
-    const { searchParams } = new URL(req.url, "https://pinniped.com");
-    const stateParam = searchParams.get("state");
-    const audience = stateParam ? pluginAuthNode.decodeOAuthState(stateParam).audience : void 0;
-    return new Promise((resolve, reject) => {
-      const strategy = Object.create(providerStrategy);
-      strategy.success = (user) => {
-        (audience ? rfc8693TokenExchange({
-          subject_token: user.tokenset.access_token,
-          target_audience: audience,
-          ctx: ctx.getStrategy()
-        }).catch(
-          (err) => reject(
-            new Error(
-              `Failed to get cluster specific ID token for "${audience}": ${err}`
-            )
-          )
-        ) : Promise.resolve(user.tokenset.id_token)).then((idToken) => {
-          resolve({
-            fullProfile: { provider: "", id: "", displayName: "" },
-            session: {
-              accessToken: user.tokenset.access_token,
-              tokenType: user.tokenset.token_type ?? "bearer",
-              scope: user.tokenset.scope,
-              idToken,
-              refreshToken: user.tokenset.refresh_token
-            }
-          });
-        });
-      };
-      strategy.fail = (info) => {
-        reject(new Error(`Authentication rejected, ${info.message || ""}`));
-      };
-      strategy.error = (error) => {
-        reject(error);
-      };
-      strategy.redirect = () => {
-        reject(new Error("Unexpected redirect"));
-      };
-      strategy.authenticate(req);
-    });
-  },
-  async refresh(input, ctx) {
-    const { client } = await ctx.getStrategy();
-    const tokenset = await client.refresh(input.refreshToken);
-    return new Promise((resolve, reject) => {
-      if (!tokenset.access_token) {
-        reject(new Error("Refresh Failed"));
-      }
-      resolve({
-        fullProfile: { provider: "", id: "", displayName: "" },
-        session: {
-          accessToken: tokenset.access_token,
-          tokenType: tokenset.token_type ?? "bearer",
-          scope: tokenset.scope,
-          idToken: tokenset.id_token,
-          refreshToken: tokenset.refresh_token
-        }
-      });
-    });
-  }
-});
 
-const authModulePinnipedProvider$1 = backendPluginApi.createBackendModule({
-  pluginId: "auth",
-  moduleId: "pinniped-provider",
-  register(reg) {
-    reg.registerInit({
-      deps: {
-        providers: pluginAuthNode.authProvidersExtensionPoint
-      },
-      async init({ providers }) {
-        providers.registerProvider({
-          providerId: "pinniped",
-          factory: pluginAuthNode.createOAuthProviderFactory({
-            authenticator: pinnipedAuthenticator,
-            signInResolverFactories: {
-              ...pluginAuthNode.commonSignInResolvers
-            }
-          })
-        });
-      }
-    });
-  }
-});
 
-const authModulePinnipedProvider = authModulePinnipedProvider$1;
-
-exports.PinnipedStrategyCache = PinnipedStrategyCache;
-exports.authModulePinnipedProvider = authModulePinnipedProvider;
-exports.default = authModulePinnipedProvider$1;
-exports.pinnipedAuthenticator = pinnipedAuthenticator;
+exports.PinnipedStrategyCache = authenticator.PinnipedStrategyCache;
+exports.pinnipedAuthenticator = authenticator.pinnipedAuthenticator;
+exports.default = module$1.authModulePinnipedProvider;
+exports.authModulePinnipedProvider = deprecated.authModulePinnipedProvider;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/authenticator.ts","../src/module.ts","../src/deprecated.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport { PassportDoneCallback } from '@backstage/plugin-auth-node';\nimport {\n  createOAuthAuthenticator,\n  decodeOAuthState,\n  encodeOAuthState,\n} from '@backstage/plugin-auth-node';\nimport {\n  Client,\n  Issuer,\n  TokenSet,\n  Strategy as OidcStrategy,\n  BaseClient,\n} from 'openid-client';\nimport { DateTime } from 'luxon';\n\nconst rfc8693TokenExchange = async ({\n  subject_token,\n  target_audience,\n  ctx,\n}: {\n  subject_token: string;\n  target_audience: string;\n  ctx: Promise<{\n    providerStrategy: OidcStrategy<{}>;\n    client: Client;\n  }>;\n}): Promise<string | undefined> => {\n  const { client } = await ctx;\n  return client\n    .grant({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token,\n      audience: target_audience,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n      requested_token_type: 'urn:ietf:params:oauth:token-type:jwt',\n    })\n    .then(tokenset => tokenset.access_token)\n    .catch(err => {\n      throw new Error(`RFC8693 token exchange failed with error: ${err}`);\n    });\n};\n\nconst OIDC_METADATA_TTL_SECONDS = 3600;\n\n/** @public */\nexport class PinnipedStrategyCache {\n  private readonly callbackUrl: string;\n  private readonly config: Config;\n  private strategyPromise: Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }>;\n\n  private cachedPromise?: Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }>;\n  private cachedPromiseExpiry?: Date;\n\n  constructor(callbackUrl: string, config: Config) {\n    this.callbackUrl = callbackUrl;\n    this.config = config;\n    this.strategyPromise = this.buildStrategy();\n  }\n\n  public async getStrategy(): Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }> {\n    if (this.cachedPromise) {\n      if (\n        this.cachedPromiseExpiry &&\n        DateTime.fromJSDate(this.cachedPromiseExpiry) > DateTime.local()\n      ) {\n        return this.cachedPromise;\n      }\n      // cachedPromise has expired, remove promise from cache and regenerate strategy\n      this.strategyPromise = this.buildStrategy();\n      delete this.cachedPromise;\n    }\n\n    try {\n      // if strategy is generated successfully, save it to cache\n      await this.strategyPromise;\n      this.cachedPromise = this.strategyPromise;\n      this.cachedPromiseExpiry = DateTime.utc()\n        .plus({ seconds: OIDC_METADATA_TTL_SECONDS })\n        .toJSDate();\n    } catch (error) {\n      // if we fail to generate a strategy, retry and overwrite strategy\n      this.strategyPromise = this.buildStrategy();\n      delete this.cachedPromise;\n      delete this.cachedPromiseExpiry;\n    }\n\n    return this.strategyPromise;\n  }\n\n  private async buildStrategy(): Promise<{\n    providerStrategy: OidcStrategy<{ tokenset: TokenSet }, BaseClient>;\n    client: BaseClient;\n  }> {\n    const issuer = await Issuer.discover(\n      `${this.config.getString(\n        'federationDomain',\n      )}/.well-known/openid-configuration`,\n    );\n    const client = new issuer.Client({\n      access_type: 'offline',\n      client_id: this.config.getString('clientId'),\n      client_secret: this.config.getString('clientSecret'),\n      redirect_uris: [this.callbackUrl],\n      response_types: ['code'],\n      id_token_signed_response_alg: 'ES256',\n    });\n    const providerStrategy = new OidcStrategy(\n      {\n        client,\n        passReqToCallback: false,\n      },\n      (\n        tokenset: TokenSet,\n        done: PassportDoneCallback<\n          { tokenset: TokenSet },\n          {\n            refreshToken?: string;\n          }\n        >,\n      ) => {\n        done(undefined, { tokenset }, {});\n      },\n    );\n    return { providerStrategy, client };\n  }\n}\n\n/** @public */\nexport const pinnipedAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform: async (_r, _c) => ({ profile: {} }),\n  scopes: {\n    required: [\n      'openid',\n      'pinniped:request-audience',\n      'username',\n      'offline_access',\n    ],\n  },\n  initialize({ callbackUrl, config }) {\n    if (config.has('scope')) {\n      throw new Error(\n        'The pinniped provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n    return new PinnipedStrategyCache(callbackUrl, config);\n  },\n  async start(input, ctx): Promise<{ url: string; status?: number }> {\n    const { providerStrategy } = await ctx.getStrategy();\n    const stringifiedAudience = input.req.query?.audience as string;\n    const decodedState = decodeOAuthState(input.state);\n    const state = { ...decodedState, audience: stringifiedAudience };\n    const options: Record<string, string> = {\n      scope: input.scope,\n      state: encodeOAuthState(state),\n    };\n\n    return new Promise((resolve, reject) => {\n      const strategy = Object.create(providerStrategy);\n      strategy.redirect = (url: string) => {\n        resolve({ url });\n      };\n      strategy.error = (error: Error) => {\n        reject(error);\n      };\n      strategy.authenticate(input.req, { ...options });\n    });\n  },\n\n  async authenticate(input, ctx) {\n    const { providerStrategy } = await ctx.getStrategy();\n    const { req } = input;\n    const { searchParams } = new URL(req.url, 'https://pinniped.com');\n    const stateParam = searchParams.get('state');\n    const audience = stateParam\n      ? decodeOAuthState(stateParam).audience\n      : undefined;\n\n    return new Promise((resolve, reject) => {\n      const strategy = Object.create(providerStrategy);\n      strategy.success = (user: any) => {\n        (audience\n          ? rfc8693TokenExchange({\n              subject_token: user.tokenset.access_token,\n              target_audience: audience,\n              ctx: ctx.getStrategy(),\n            }).catch(err =>\n              reject(\n                new Error(\n                  `Failed to get cluster specific ID token for \"${audience}\": ${err}`,\n                ),\n              ),\n            )\n          : Promise.resolve(user.tokenset.id_token)\n        ).then(idToken => {\n          resolve({\n            fullProfile: { provider: '', id: '', displayName: '' },\n            session: {\n              accessToken: user.tokenset.access_token!,\n              tokenType: user.tokenset.token_type ?? 'bearer',\n              scope: user.tokenset.scope!,\n              idToken,\n              refreshToken: user.tokenset.refresh_token,\n            },\n          });\n        });\n      };\n\n      strategy.fail = (info: any) => {\n        reject(new Error(`Authentication rejected, ${info.message || ''}`));\n      };\n\n      strategy.error = (error: Error) => {\n        reject(error);\n      };\n\n      strategy.redirect = () => {\n        reject(new Error('Unexpected redirect'));\n      };\n\n      strategy.authenticate(req);\n    });\n  },\n\n  async refresh(input, ctx) {\n    const { client } = await ctx.getStrategy();\n    const tokenset = await client.refresh(input.refreshToken);\n\n    return new Promise((resolve, reject) => {\n      if (!tokenset.access_token) {\n        reject(new Error('Refresh Failed'));\n      }\n\n      resolve({\n        fullProfile: { provider: '', id: '', displayName: '' },\n        session: {\n          accessToken: tokenset.access_token!,\n          tokenType: tokenset.token_type ?? 'bearer',\n          scope: tokenset.scope!,\n          idToken: tokenset.id_token,\n          refreshToken: tokenset.refresh_token,\n        },\n      });\n    });\n  },\n});\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { pinnipedAuthenticator } from './authenticator';\n\n/** @public */\nexport const authModulePinnipedProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'pinniped-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'pinniped',\n          factory: createOAuthProviderFactory({\n            authenticator: pinnipedAuthenticator,\n            signInResolverFactories: {\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { authModulePinnipedProvider as deprecatedAuthModulePinnipedProvider } from './module';\n\n/**\n * @public\n * @deprecated Use default import instead\n */\nexport const authModulePinnipedProvider = deprecatedAuthModulePinnipedProvider;\n"],"names":["DateTime","Issuer","OidcStrategy","createOAuthAuthenticator","decodeOAuthState","encodeOAuthState","authModulePinnipedProvider","createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","commonSignInResolvers","deprecatedAuthModulePinnipedProvider"],"mappings":";;;;;;;;;AA+BA,MAAM,uBAAuB,OAAO;AAAA,EAClC,aAAA;AAAA,EACA,eAAA;AAAA,EACA,GAAA;AACF,CAOmC,KAAA;AACjC,EAAM,MAAA,EAAE,MAAO,EAAA,GAAI,MAAM,GAAA,CAAA;AACzB,EAAA,OAAO,OACJ,KAAM,CAAA;AAAA,IACL,UAAY,EAAA,iDAAA;AAAA,IACZ,aAAA;AAAA,IACA,QAAU,EAAA,eAAA;AAAA,IACV,kBAAoB,EAAA,+CAAA;AAAA,IACpB,oBAAsB,EAAA,sCAAA;AAAA,GACvB,EACA,IAAK,CAAA,CAAA,QAAA,KAAY,SAAS,YAAY,CAAA,CACtC,MAAM,CAAO,GAAA,KAAA;AACZ,IAAA,MAAM,IAAI,KAAA,CAAM,CAA6C,0CAAA,EAAA,GAAG,CAAE,CAAA,CAAA,CAAA;AAAA,GACnE,CAAA,CAAA;AACL,CAAA,CAAA;AAEA,MAAM,yBAA4B,GAAA,IAAA,CAAA;AAG3B,MAAM,qBAAsB,CAAA;AAAA,EAChB,WAAA,CAAA;AAAA,EACA,MAAA,CAAA;AAAA,EACT,eAAA,CAAA;AAAA,EAKA,aAAA,CAAA;AAAA,EAIA,mBAAA,CAAA;AAAA,EAER,WAAA,CAAY,aAAqB,MAAgB,EAAA;AAC/C,IAAA,IAAA,CAAK,WAAc,GAAA,WAAA,CAAA;AACnB,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA,CAAA;AACd,IAAK,IAAA,CAAA,eAAA,GAAkB,KAAK,aAAc,EAAA,CAAA;AAAA,GAC5C;AAAA,EAEA,MAAa,WAGV,GAAA;AACD,IAAA,IAAI,KAAK,aAAe,EAAA;AACtB,MACE,IAAA,IAAA,CAAK,uBACLA,cAAS,CAAA,UAAA,CAAW,KAAK,mBAAmB,CAAA,GAAIA,cAAS,CAAA,KAAA,EACzD,EAAA;AACA,QAAA,OAAO,IAAK,CAAA,aAAA,CAAA;AAAA,OACd;AAEA,MAAK,IAAA,CAAA,eAAA,GAAkB,KAAK,aAAc,EAAA,CAAA;AAC1C,MAAA,OAAO,IAAK,CAAA,aAAA,CAAA;AAAA,KACd;AAEA,IAAI,IAAA;AAEF,MAAA,MAAM,IAAK,CAAA,eAAA,CAAA;AACX,MAAA,IAAA,CAAK,gBAAgB,IAAK,CAAA,eAAA,CAAA;AAC1B,MAAK,IAAA,CAAA,mBAAA,GAAsBA,cAAS,CAAA,GAAA,EACjC,CAAA,IAAA,CAAK,EAAE,OAAS,EAAA,yBAAA,EAA2B,CAAA,CAC3C,QAAS,EAAA,CAAA;AAAA,aACL,KAAO,EAAA;AAEd,MAAK,IAAA,CAAA,eAAA,GAAkB,KAAK,aAAc,EAAA,CAAA;AAC1C,MAAA,OAAO,IAAK,CAAA,aAAA,CAAA;AACZ,MAAA,OAAO,IAAK,CAAA,mBAAA,CAAA;AAAA,KACd;AAEA,IAAA,OAAO,IAAK,CAAA,eAAA,CAAA;AAAA,GACd;AAAA,EAEA,MAAc,aAGX,GAAA;AACD,IAAM,MAAA,MAAA,GAAS,MAAMC,mBAAO,CAAA,QAAA;AAAA,MAC1B,CAAA,EAAG,KAAK,MAAO,CAAA,SAAA;AAAA,QACb,kBAAA;AAAA,OACD,CAAA,iCAAA,CAAA;AAAA,KACH,CAAA;AACA,IAAM,MAAA,MAAA,GAAS,IAAI,MAAA,CAAO,MAAO,CAAA;AAAA,MAC/B,WAAa,EAAA,SAAA;AAAA,MACb,SAAW,EAAA,IAAA,CAAK,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,MAC3C,aAAe,EAAA,IAAA,CAAK,MAAO,CAAA,SAAA,CAAU,cAAc,CAAA;AAAA,MACnD,aAAA,EAAe,CAAC,IAAA,CAAK,WAAW,CAAA;AAAA,MAChC,cAAA,EAAgB,CAAC,MAAM,CAAA;AAAA,MACvB,4BAA8B,EAAA,OAAA;AAAA,KAC/B,CAAA,CAAA;AACD,IAAA,MAAM,mBAAmB,IAAIC,qBAAA;AAAA,MAC3B;AAAA,QACE,MAAA;AAAA,QACA,iBAAmB,EAAA,KAAA;AAAA,OACrB;AAAA,MACA,CACE,UACA,IAMG,KAAA;AACH,QAAA,IAAA,CAAK,KAAW,CAAA,EAAA,EAAE,QAAS,EAAA,EAAG,EAAE,CAAA,CAAA;AAAA,OAClC;AAAA,KACF,CAAA;AACA,IAAO,OAAA,EAAE,kBAAkB,MAAO,EAAA,CAAA;AAAA,GACpC;AACF,CAAA;AAGO,MAAM,wBAAwBC,uCAAyB,CAAA;AAAA,EAC5D,yBAAyB,OAAO,EAAA,EAAI,QAAQ,EAAE,OAAA,EAAS,EAAG,EAAA,CAAA;AAAA,EAC1D,MAAQ,EAAA;AAAA,IACN,QAAU,EAAA;AAAA,MACR,QAAA;AAAA,MACA,2BAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA;AAAA,KACF;AAAA,GACF;AAAA,EACA,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,OAAO,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,8HAAA;AAAA,OACF,CAAA;AAAA,KACF;AACA,IAAO,OAAA,IAAI,qBAAsB,CAAA,WAAA,EAAa,MAAM,CAAA,CAAA;AAAA,GACtD;AAAA,EACA,MAAM,KAAM,CAAA,KAAA,EAAO,GAAgD,EAAA;AACjE,IAAA,MAAM,EAAE,gBAAA,EAAqB,GAAA,MAAM,IAAI,WAAY,EAAA,CAAA;AACnD,IAAM,MAAA,mBAAA,GAAsB,KAAM,CAAA,GAAA,CAAI,KAAO,EAAA,QAAA,CAAA;AAC7C,IAAM,MAAA,YAAA,GAAeC,+BAAiB,CAAA,KAAA,CAAM,KAAK,CAAA,CAAA;AACjD,IAAA,MAAM,KAAQ,GAAA,EAAE,GAAG,YAAA,EAAc,UAAU,mBAAoB,EAAA,CAAA;AAC/D,IAAA,MAAM,OAAkC,GAAA;AAAA,MACtC,OAAO,KAAM,CAAA,KAAA;AAAA,MACb,KAAA,EAAOC,gCAAiB,KAAK,CAAA;AAAA,KAC/B,CAAA;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAM,MAAA,QAAA,GAAW,MAAO,CAAA,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAC/C,MAAS,QAAA,CAAA,QAAA,GAAW,CAAC,GAAgB,KAAA;AACnC,QAAQ,OAAA,CAAA,EAAE,KAAK,CAAA,CAAA;AAAA,OACjB,CAAA;AACA,MAAS,QAAA,CAAA,KAAA,GAAQ,CAAC,KAAiB,KAAA;AACjC,QAAA,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,OACd,CAAA;AACA,MAAA,QAAA,CAAS,aAAa,KAAM,CAAA,GAAA,EAAK,EAAE,GAAG,SAAS,CAAA,CAAA;AAAA,KAChD,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAa,CAAA,KAAA,EAAO,GAAK,EAAA;AAC7B,IAAA,MAAM,EAAE,gBAAA,EAAqB,GAAA,MAAM,IAAI,WAAY,EAAA,CAAA;AACnD,IAAM,MAAA,EAAE,KAAQ,GAAA,KAAA,CAAA;AAChB,IAAA,MAAM,EAAE,YAAa,EAAA,GAAI,IAAI,GAAI,CAAA,GAAA,CAAI,KAAK,sBAAsB,CAAA,CAAA;AAChE,IAAM,MAAA,UAAA,GAAa,YAAa,CAAA,GAAA,CAAI,OAAO,CAAA,CAAA;AAC3C,IAAA,MAAM,QAAW,GAAA,UAAA,GACbD,+BAAiB,CAAA,UAAU,EAAE,QAC7B,GAAA,KAAA,CAAA,CAAA;AAEJ,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAM,MAAA,QAAA,GAAW,MAAO,CAAA,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAC/C,MAAS,QAAA,CAAA,OAAA,GAAU,CAAC,IAAc,KAAA;AAChC,QAAA,CAAC,WACG,oBAAqB,CAAA;AAAA,UACnB,aAAA,EAAe,KAAK,QAAS,CAAA,YAAA;AAAA,UAC7B,eAAiB,EAAA,QAAA;AAAA,UACjB,GAAA,EAAK,IAAI,WAAY,EAAA;AAAA,SACtB,CAAE,CAAA,KAAA;AAAA,UAAM,CACP,GAAA,KAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,6CAAA,EAAgD,QAAQ,CAAA,GAAA,EAAM,GAAG,CAAA,CAAA;AAAA,aACnE;AAAA,WACF;AAAA,SACF,GACA,QAAQ,OAAQ,CAAA,IAAA,CAAK,SAAS,QAAQ,CAAA,EACxC,KAAK,CAAW,OAAA,KAAA;AAChB,UAAQ,OAAA,CAAA;AAAA,YACN,aAAa,EAAE,QAAA,EAAU,IAAI,EAAI,EAAA,EAAA,EAAI,aAAa,EAAG,EAAA;AAAA,YACrD,OAAS,EAAA;AAAA,cACP,WAAA,EAAa,KAAK,QAAS,CAAA,YAAA;AAAA,cAC3B,SAAA,EAAW,IAAK,CAAA,QAAA,CAAS,UAAc,IAAA,QAAA;AAAA,cACvC,KAAA,EAAO,KAAK,QAAS,CAAA,KAAA;AAAA,cACrB,OAAA;AAAA,cACA,YAAA,EAAc,KAAK,QAAS,CAAA,aAAA;AAAA,aAC9B;AAAA,WACD,CAAA,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH,CAAA;AAEA,MAAS,QAAA,CAAA,IAAA,GAAO,CAAC,IAAc,KAAA;AAC7B,QAAA,MAAA,CAAO,IAAI,KAAM,CAAA,CAAA,yBAAA,EAA4B,KAAK,OAAW,IAAA,EAAE,EAAE,CAAC,CAAA,CAAA;AAAA,OACpE,CAAA;AAEA,MAAS,QAAA,CAAA,KAAA,GAAQ,CAAC,KAAiB,KAAA;AACjC,QAAA,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,OACd,CAAA;AAEA,MAAA,QAAA,CAAS,WAAW,MAAM;AACxB,QAAO,MAAA,CAAA,IAAI,KAAM,CAAA,qBAAqB,CAAC,CAAA,CAAA;AAAA,OACzC,CAAA;AAEA,MAAA,QAAA,CAAS,aAAa,GAAG,CAAA,CAAA;AAAA,KAC1B,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,GAAK,EAAA;AACxB,IAAA,MAAM,EAAE,MAAA,EAAW,GAAA,MAAM,IAAI,WAAY,EAAA,CAAA;AACzC,IAAA,MAAM,QAAW,GAAA,MAAM,MAAO,CAAA,OAAA,CAAQ,MAAM,YAAY,CAAA,CAAA;AAExD,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAI,IAAA,CAAC,SAAS,YAAc,EAAA;AAC1B,QAAO,MAAA,CAAA,IAAI,KAAM,CAAA,gBAAgB,CAAC,CAAA,CAAA;AAAA,OACpC;AAEA,MAAQ,OAAA,CAAA;AAAA,QACN,aAAa,EAAE,QAAA,EAAU,IAAI,EAAI,EAAA,EAAA,EAAI,aAAa,EAAG,EAAA;AAAA,QACrD,OAAS,EAAA;AAAA,UACP,aAAa,QAAS,CAAA,YAAA;AAAA,UACtB,SAAA,EAAW,SAAS,UAAc,IAAA,QAAA;AAAA,UAClC,OAAO,QAAS,CAAA,KAAA;AAAA,UAChB,SAAS,QAAS,CAAA,QAAA;AAAA,UAClB,cAAc,QAAS,CAAA,aAAA;AAAA,SACzB;AAAA,OACD,CAAA,CAAA;AAAA,KACF,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;ACrPM,MAAME,+BAA6BC,oCAAoB,CAAA;AAAA,EAC5D,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,mBAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,SAAW,EAAAC,0CAAA;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,UAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAA,qBAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGC,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;ACvBM,MAAM,0BAA6B,GAAAC;;;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;"}

package/dist/module.cjs.js

@@ -0,0 +1,31 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var authenticator = require('./authenticator.cjs.js');
+
+const authModulePinnipedProvider = backendPluginApi.createBackendModule({
+  pluginId: "auth",
+  moduleId: "pinniped-provider",
+  register(reg) {
+    reg.registerInit({
+      deps: {
+        providers: pluginAuthNode.authProvidersExtensionPoint
+      },
+      async init({ providers }) {
+        providers.registerProvider({
+          providerId: "pinniped",
+          factory: pluginAuthNode.createOAuthProviderFactory({
+            authenticator: authenticator.pinnipedAuthenticator,
+            signInResolverFactories: {
+              ...pluginAuthNode.commonSignInResolvers
+            }
+          })
+        });
+      }
+    });
+  }
+});
+
+exports.authModulePinnipedProvider = authModulePinnipedProvider;
+//# sourceMappingURL=module.cjs.js.map

package/dist/module.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { pinnipedAuthenticator } from './authenticator';\n\n/** @public */\nexport const authModulePinnipedProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'pinniped-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'pinniped',\n          factory: createOAuthProviderFactory({\n            authenticator: pinnipedAuthenticator,\n            signInResolverFactories: {\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","pinnipedAuthenticator","commonSignInResolvers"],"mappings":";;;;;;AAwBO,MAAM,6BAA6BA,oCAAoB,CAAA;AAAA,EAC5D,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,mBAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,SAAW,EAAAC,0CAAA;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,UAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAAC,mCAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGC,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-pinniped-provider",
-  "version": "0.2.0",
+  "version": "0.2.1-next.1",
   "description": "The pinniped-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -33,17 +33,17 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.0.0",
-    "@backstage/config": "^1.2.0",
-    "@backstage/plugin-auth-node": "^0.5.2",
+    "@backstage/backend-plugin-api": "1.0.1-next.1",
+    "@backstage/config": "1.2.0",
+    "@backstage/plugin-auth-node": "0.5.3-next.1",
     "luxon": "^3.4.3",
     "openid-client": "^5.4.3"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.5.0",
-    "@backstage/backend-test-utils": "^1.0.0",
-    "@backstage/cli": "^0.27.1",
-    "@backstage/plugin-auth-backend": "^0.23.0",
+    "@backstage/backend-defaults": "0.5.1-next.2",
+    "@backstage/backend-test-utils": "1.0.1-next.2",
+    "@backstage/cli": "0.28.0-next.2",
+    "@backstage/plugin-auth-backend": "0.23.1-next.1",
     "cookie-parser": "^1.4.6",
     "express": "^4.18.2",
     "express-session": "^1.17.3",