@backstage/plugin-auth-backend-module-vmware-cloud-provider 0.3.0 → 0.4.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @backstage/plugin-auth-backend-module-vmware-cloud-provider
 
+## 0.4.0-next.1
+
+### Minor Changes
+
+- d0edfec: **BREAKING**: The `profileEmailMatchingUserEntityEmail` sign-in resolver has been removed as it was using an insecure fallback for resolving user identities. See https://backstage.io/docs/auth/identity-resolver#sign-in-without-users-in-the-catalog for how to create a custom sign-in resolver if needed as a replacement.
+
+### Patch Changes
+
+- 217458a: Updated configuration schema to include the new `allowedDomains` option for the `emailLocalPartMatchingUserEntityName` sign-in resolver.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3-next.1
+  - @backstage/backend-plugin-api@1.0.1-next.1
+  - @backstage/catalog-model@1.7.0
+
+## 0.3.1-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.5.3-next.0
+  - @backstage/backend-plugin-api@1.0.1-next.0
+  - @backstage/catalog-model@1.7.0
+
 ## 0.3.0
 
 ### Minor Changes

package/dist/authenticator.cjs.js

@@ -0,0 +1,158 @@
+'use strict';
+
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var jose = require('jose');
+var passportOauth2 = require('passport-oauth2');
+
+const vmwareCloudAuthenticator = pluginAuthNode.createOAuthAuthenticator({
+  defaultProfileTransform: async (input) => {
+    if (!input.session.idToken) {
+      throw new Error(
+        `Failed to parse id token and get profile info, missing token from session`
+      );
+    }
+    const vmwareClaims = ["email", "given_name", "family_name", "context_name"];
+    const identity = jose.decodeJwt(input.session.idToken);
+    const missingClaims = vmwareClaims.filter((key) => !(key in identity));
+    if (missingClaims.length > 0) {
+      throw new Error(
+        `ID token missing required claims: ${missingClaims.join(", ")}`
+      );
+    }
+    const typeMismatchClaims = vmwareClaims.filter(
+      (key) => typeof identity[key] !== "string"
+    );
+    if (typeMismatchClaims.length > 0) {
+      throw new Error(
+        `ID token claims type mismatch: ${typeMismatchClaims.join(", ")}`
+      );
+    }
+    const { email, given_name, family_name, context_name } = identity;
+    if (context_name !== input.fullProfile.organizationId) {
+      throw new Error(`ID token organizationId mismatch`);
+    }
+    return {
+      profile: {
+        displayName: `${given_name} ${family_name}`,
+        email
+      }
+    };
+  },
+  scopes: {
+    required: ["openid", "offline_access"]
+  },
+  initialize({ callbackUrl, config }) {
+    const consoleEndpoint = config.getOptionalString("consoleEndpoint") ?? "https://console.cloud.vmware.com";
+    const organizationId = config.getString("organizationId");
+    const clientId = config.getString("clientId");
+    const clientSecret = "";
+    const authorizationUrl = `${consoleEndpoint}/csp/gateway/discovery`;
+    const tokenUrl = `${consoleEndpoint}/csp/gateway/am/api/auth/token`;
+    if (config.has("scope")) {
+      throw new Error(
+        'The vmware-cloud provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
+      );
+    }
+    const providerStrategy = new passportOauth2.Strategy(
+      {
+        clientID: clientId,
+        clientSecret,
+        callbackURL: callbackUrl,
+        authorizationURL: authorizationUrl,
+        tokenURL: tokenUrl,
+        passReqToCallback: false,
+        pkce: true,
+        state: true,
+        customHeaders: {
+          Authorization: `Basic ${encodeClientCredentials(
+            clientId,
+            clientSecret
+          )}`
+        }
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, { fullProfile, params, accessToken }, { refreshToken });
+      }
+    );
+    const pkceSessionStore = Object.create(
+      providerStrategy._stateStore
+    );
+    providerStrategy._stateStore = {
+      verify(req, state, callback) {
+        pkceSessionStore.verify(
+          req,
+          pluginAuthNode.decodeOAuthState(state).handle,
+          callback
+        );
+      },
+      store(req, verifier, state, meta, callback) {
+        pkceSessionStore.store(
+          req,
+          verifier,
+          state,
+          meta,
+          (err, handle) => {
+            callback(
+              err,
+              pluginAuthNode.encodeOAuthState({
+                handle,
+                ...state,
+                ...req.state
+              })
+            );
+          }
+        );
+      }
+    };
+    return {
+      organizationId,
+      providerStrategy,
+      helper: pluginAuthNode.PassportOAuthAuthenticatorHelper.from(providerStrategy)
+    };
+  },
+  async start(input, ctx) {
+    return new Promise((resolve, reject) => {
+      const strategy = Object.create(ctx.providerStrategy);
+      strategy.redirect = (url, status) => {
+        const parsed = new URL(url);
+        if (ctx.organizationId) {
+          parsed.searchParams.set("orgId", ctx.organizationId);
+        }
+        resolve({ url: parsed.toString(), status: status ?? void 0 });
+      };
+      strategy.error = (error) => {
+        reject(error);
+      };
+      strategy.authenticate(input.req, {
+        scope: input.scope,
+        state: pluginAuthNode.decodeOAuthState(input.state),
+        accessType: "offline",
+        prompt: "consent"
+      });
+    });
+  },
+  async authenticate(input, ctx) {
+    return ctx.helper.authenticate(input).then((result) => ({
+      ...result,
+      fullProfile: {
+        ...result.fullProfile,
+        organizationId: ctx.organizationId
+      }
+    }));
+  },
+  async refresh(input, ctx) {
+    return ctx.helper.refresh(input).then((result) => ({
+      ...result,
+      fullProfile: {
+        ...result.fullProfile,
+        organizationId: ctx.organizationId
+      }
+    }));
+  }
+});
+function encodeClientCredentials(clientID, clientSecret) {
+  return Buffer.from(`${clientID}:${clientSecret}`).toString("base64");
+}
+
+exports.vmwareCloudAuthenticator = vmwareCloudAuthenticator;
+//# sourceMappingURL=authenticator.cjs.js.map

package/dist/authenticator.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  createOAuthAuthenticator,\n  decodeOAuthState,\n  encodeOAuthState,\n  OAuthState,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { decodeJwt } from 'jose';\nimport {\n  Metadata,\n  StateStoreStoreCallback,\n  StateStoreVerifyCallback,\n  Strategy as OAuth2Strategy,\n} from 'passport-oauth2';\n\n/** @public */\nexport interface VMwareCloudAuthenticatorContext {\n  organizationId?: string;\n  providerStrategy: OAuth2Strategy;\n  helper: PassportOAuthAuthenticatorHelper;\n}\n\n/** @public */\nexport type VMwarePassportProfile = PassportProfile & {\n  organizationId?: string;\n};\n\n/**\n * VMware Cloud Authenticator to be used by `createOAuthProviderFactory`\n *\n * @public\n */\nexport const vmwareCloudAuthenticator = createOAuthAuthenticator<\n  VMwareCloudAuthenticatorContext,\n  VMwarePassportProfile\n>({\n  defaultProfileTransform: async input => {\n    if (!input.session.idToken) {\n      throw new Error(\n        `Failed to parse id token and get profile info, missing token from session`,\n      );\n    }\n\n    const vmwareClaims = ['email', 'given_name', 'family_name', 'context_name'];\n\n    const identity = decodeJwt(input.session.idToken);\n    const missingClaims = vmwareClaims.filter(key => !(key in identity));\n\n    if (missingClaims.length > 0) {\n      throw new Error(\n        `ID token missing required claims: ${missingClaims.join(', ')}`,\n      );\n    }\n\n    const typeMismatchClaims = vmwareClaims.filter(\n      key => typeof identity[key] !== 'string',\n    );\n\n    if (typeMismatchClaims.length > 0) {\n      throw new Error(\n        `ID token claims type mismatch: ${typeMismatchClaims.join(', ')}`,\n      );\n    }\n\n    // These claims were checked for presence & type\n    const { email, given_name, family_name, context_name } = identity as Record<\n      string,\n      string\n    >;\n\n    if (context_name !== input.fullProfile.organizationId) {\n      throw new Error(`ID token organizationId mismatch`);\n    }\n\n    return {\n      profile: {\n        displayName: `${given_name} ${family_name}`,\n        email,\n      },\n    };\n  },\n  scopes: {\n    required: ['openid', 'offline_access'],\n  },\n  initialize({ callbackUrl, config }) {\n    const consoleEndpoint =\n      config.getOptionalString('consoleEndpoint') ??\n      'https://console.cloud.vmware.com';\n    const organizationId = config.getString('organizationId');\n\n    const clientId = config.getString('clientId');\n    const clientSecret = '';\n    const authorizationUrl = `${consoleEndpoint}/csp/gateway/discovery`;\n    const tokenUrl = `${consoleEndpoint}/csp/gateway/am/api/auth/token`;\n\n    if (config.has('scope')) {\n      throw new Error(\n        'The vmware-cloud provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n\n    const providerStrategy = new OAuth2Strategy(\n      {\n        clientID: clientId,\n        clientSecret: clientSecret,\n        callbackURL: callbackUrl,\n        authorizationURL: authorizationUrl,\n        tokenURL: tokenUrl,\n        passReqToCallback: false,\n        pkce: true,\n        state: true,\n        customHeaders: {\n          Authorization: `Basic ${encodeClientCredentials(\n            clientId,\n            clientSecret,\n          )}`,\n        },\n      },\n      (\n        accessToken: any,\n        refreshToken: any,\n        params: any,\n        fullProfile: PassportProfile,\n        done: PassportOAuthDoneCallback,\n      ) => {\n        done(undefined, { fullProfile, params, accessToken }, { refreshToken });\n      },\n    );\n\n    // Both VMware & OAuth2Strategy fight over control of the state when PKCE is on, thus this hack\n    const pkceSessionStore = Object.create(\n      (providerStrategy as any)._stateStore,\n    );\n    (providerStrategy as any)._stateStore = {\n      verify(req: Request, state: string, callback: StateStoreVerifyCallback) {\n        pkceSessionStore.verify(\n          req,\n          (decodeOAuthState(state) as any).handle,\n          callback,\n        );\n      },\n      store(\n        req: Request & {\n          scope: string;\n          state: OAuthState;\n        },\n        verifier: string,\n        state: any,\n        meta: Metadata,\n        callback: StateStoreStoreCallback,\n      ) {\n        pkceSessionStore.store(\n          req,\n          verifier,\n          state,\n          meta,\n          (err: Error, handle: string) => {\n            callback(\n              err,\n              encodeOAuthState({\n                handle,\n                ...state,\n                ...req.state,\n              } as OAuthState),\n            );\n          },\n        );\n      },\n    };\n\n    return {\n      organizationId,\n      providerStrategy,\n      helper: PassportOAuthAuthenticatorHelper.from(providerStrategy),\n    };\n  },\n\n  async start(input, ctx) {\n    return new Promise((resolve, reject) => {\n      const strategy: OAuth2Strategy = Object.create(ctx.providerStrategy);\n\n      strategy.redirect = (url: string, status?: number) => {\n        const parsed = new URL(url);\n        if (ctx.organizationId) {\n          parsed.searchParams.set('orgId', ctx.organizationId);\n        }\n        resolve({ url: parsed.toString(), status: status ?? undefined });\n      };\n      strategy.error = (error: Error) => {\n        reject(error);\n      };\n      strategy.authenticate(input.req, {\n        scope: input.scope,\n        state: decodeOAuthState(input.state),\n        accessType: 'offline',\n        prompt: 'consent',\n      });\n    });\n  },\n\n  async authenticate(input, ctx) {\n    return ctx.helper.authenticate(input).then(result => ({\n      ...result,\n      fullProfile: {\n        ...result.fullProfile,\n        organizationId: ctx.organizationId,\n      } as VMwarePassportProfile,\n    }));\n  },\n\n  async refresh(input, ctx) {\n    return ctx.helper.refresh(input).then(result => ({\n      ...result,\n      fullProfile: {\n        ...result.fullProfile,\n        organizationId: ctx.organizationId,\n      } as VMwarePassportProfile,\n    }));\n  },\n});\n\n/** @private */\nfunction encodeClientCredentials(\n  clientID: string,\n  clientSecret: string,\n): string {\n  return Buffer.from(`${clientID}:${clientSecret}`).toString('base64');\n}\n"],"names":["createOAuthAuthenticator","decodeJwt","OAuth2Strategy","decodeOAuthState","encodeOAuthState","PassportOAuthAuthenticatorHelper"],"mappings":";;;;;;AAiDO,MAAM,2BAA2BA,uCAGtC,CAAA;AAAA,EACA,uBAAA,EAAyB,OAAM,KAAS,KAAA;AACtC,IAAI,IAAA,CAAC,KAAM,CAAA,OAAA,CAAQ,OAAS,EAAA;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,yEAAA,CAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,YAAe,GAAA,CAAC,OAAS,EAAA,YAAA,EAAc,eAAe,cAAc,CAAA,CAAA;AAE1E,IAAA,MAAM,QAAW,GAAAC,cAAA,CAAU,KAAM,CAAA,OAAA,CAAQ,OAAO,CAAA,CAAA;AAChD,IAAA,MAAM,gBAAgB,YAAa,CAAA,MAAA,CAAO,CAAO,GAAA,KAAA,EAAE,OAAO,QAAS,CAAA,CAAA,CAAA;AAEnE,IAAI,IAAA,aAAA,CAAc,SAAS,CAAG,EAAA;AAC5B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAqC,kCAAA,EAAA,aAAA,CAAc,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,OAC/D,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,qBAAqB,YAAa,CAAA,MAAA;AAAA,MACtC,CAAO,GAAA,KAAA,OAAO,QAAS,CAAA,GAAG,CAAM,KAAA,QAAA;AAAA,KAClC,CAAA;AAEA,IAAI,IAAA,kBAAA,CAAmB,SAAS,CAAG,EAAA;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAkC,+BAAA,EAAA,kBAAA,CAAmB,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,OACjE,CAAA;AAAA,KACF;AAGA,IAAA,MAAM,EAAE,KAAA,EAAO,UAAY,EAAA,WAAA,EAAa,cAAiB,GAAA,QAAA,CAAA;AAKzD,IAAI,IAAA,YAAA,KAAiB,KAAM,CAAA,WAAA,CAAY,cAAgB,EAAA;AACrD,MAAM,MAAA,IAAI,MAAM,CAAkC,gCAAA,CAAA,CAAA,CAAA;AAAA,KACpD;AAEA,IAAO,OAAA;AAAA,MACL,OAAS,EAAA;AAAA,QACP,WAAa,EAAA,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,QACzC,KAAA;AAAA,OACF;AAAA,KACF,CAAA;AAAA,GACF;AAAA,EACA,MAAQ,EAAA;AAAA,IACN,QAAA,EAAU,CAAC,QAAA,EAAU,gBAAgB,CAAA;AAAA,GACvC;AAAA,EACA,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAA,MAAM,eACJ,GAAA,MAAA,CAAO,iBAAkB,CAAA,iBAAiB,CAC1C,IAAA,kCAAA,CAAA;AACF,IAAM,MAAA,cAAA,GAAiB,MAAO,CAAA,SAAA,CAAU,gBAAgB,CAAA,CAAA;AAExD,IAAM,MAAA,QAAA,GAAW,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA,CAAA;AAC5C,IAAA,MAAM,YAAe,GAAA,EAAA,CAAA;AACrB,IAAM,MAAA,gBAAA,GAAmB,GAAG,eAAe,CAAA,sBAAA,CAAA,CAAA;AAC3C,IAAM,MAAA,QAAA,GAAW,GAAG,eAAe,CAAA,8BAAA,CAAA,CAAA;AAEnC,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,OAAO,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,kIAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,mBAAmB,IAAIC,uBAAA;AAAA,MAC3B;AAAA,QACE,QAAU,EAAA,QAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAa,EAAA,WAAA;AAAA,QACb,gBAAkB,EAAA,gBAAA;AAAA,QAClB,QAAU,EAAA,QAAA;AAAA,QACV,iBAAmB,EAAA,KAAA;AAAA,QACnB,IAAM,EAAA,IAAA;AAAA,QACN,KAAO,EAAA,IAAA;AAAA,QACP,aAAe,EAAA;AAAA,UACb,eAAe,CAAS,MAAA,EAAA,uBAAA;AAAA,YACtB,QAAA;AAAA,YACA,YAAA;AAAA,WACD,CAAA,CAAA;AAAA,SACH;AAAA,OACF;AAAA,MACA,CACE,WAAA,EACA,YACA,EAAA,MAAA,EACA,aACA,IACG,KAAA;AACH,QAAK,IAAA,CAAA,KAAA,CAAA,EAAW,EAAE,WAAa,EAAA,MAAA,EAAQ,aAAe,EAAA,EAAE,cAAc,CAAA,CAAA;AAAA,OACxE;AAAA,KACF,CAAA;AAGA,IAAA,MAAM,mBAAmB,MAAO,CAAA,MAAA;AAAA,MAC7B,gBAAyB,CAAA,WAAA;AAAA,KAC5B,CAAA;AACA,IAAC,iBAAyB,WAAc,GAAA;AAAA,MACtC,MAAA,CAAO,GAAc,EAAA,KAAA,EAAe,QAAoC,EAAA;AACtE,QAAiB,gBAAA,CAAA,MAAA;AAAA,UACf,GAAA;AAAA,UACCC,+BAAA,CAAiB,KAAK,CAAU,CAAA,MAAA;AAAA,UACjC,QAAA;AAAA,SACF,CAAA;AAAA,OACF;AAAA,MACA,KACE,CAAA,GAAA,EAIA,QACA,EAAA,KAAA,EACA,MACA,QACA,EAAA;AACA,QAAiB,gBAAA,CAAA,KAAA;AAAA,UACf,GAAA;AAAA,UACA,QAAA;AAAA,UACA,KAAA;AAAA,UACA,IAAA;AAAA,UACA,CAAC,KAAY,MAAmB,KAAA;AAC9B,YAAA,QAAA;AAAA,cACE,GAAA;AAAA,cACAC,+BAAiB,CAAA;AAAA,gBACf,MAAA;AAAA,gBACA,GAAG,KAAA;AAAA,gBACH,GAAG,GAAI,CAAA,KAAA;AAAA,eACM,CAAA;AAAA,aACjB,CAAA;AAAA,WACF;AAAA,SACF,CAAA;AAAA,OACF;AAAA,KACF,CAAA;AAEA,IAAO,OAAA;AAAA,MACL,cAAA;AAAA,MACA,gBAAA;AAAA,MACA,MAAA,EAAQC,+CAAiC,CAAA,IAAA,CAAK,gBAAgB,CAAA;AAAA,KAChE,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,KAAM,CAAA,KAAA,EAAO,GAAK,EAAA;AACtB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAA,MAAM,QAA2B,GAAA,MAAA,CAAO,MAAO,CAAA,GAAA,CAAI,gBAAgB,CAAA,CAAA;AAEnE,MAAS,QAAA,CAAA,QAAA,GAAW,CAAC,GAAA,EAAa,MAAoB,KAAA;AACpD,QAAM,MAAA,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA,CAAA;AAC1B,QAAA,IAAI,IAAI,cAAgB,EAAA;AACtB,UAAA,MAAA,CAAO,YAAa,CAAA,GAAA,CAAI,OAAS,EAAA,GAAA,CAAI,cAAc,CAAA,CAAA;AAAA,SACrD;AACA,QAAQ,OAAA,CAAA,EAAE,KAAK,MAAO,CAAA,QAAA,IAAY,MAAQ,EAAA,MAAA,IAAU,QAAW,CAAA,CAAA;AAAA,OACjE,CAAA;AACA,MAAS,QAAA,CAAA,KAAA,GAAQ,CAAC,KAAiB,KAAA;AACjC,QAAA,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,OACd,CAAA;AACA,MAAS,QAAA,CAAA,YAAA,CAAa,MAAM,GAAK,EAAA;AAAA,QAC/B,OAAO,KAAM,CAAA,KAAA;AAAA,QACb,KAAA,EAAOF,+BAAiB,CAAA,KAAA,CAAM,KAAK,CAAA;AAAA,QACnC,UAAY,EAAA,SAAA;AAAA,QACZ,MAAQ,EAAA,SAAA;AAAA,OACT,CAAA,CAAA;AAAA,KACF,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAa,CAAA,KAAA,EAAO,GAAK,EAAA;AAC7B,IAAA,OAAO,IAAI,MAAO,CAAA,YAAA,CAAa,KAAK,CAAA,CAAE,KAAK,CAAW,MAAA,MAAA;AAAA,MACpD,GAAG,MAAA;AAAA,MACH,WAAa,EAAA;AAAA,QACX,GAAG,MAAO,CAAA,WAAA;AAAA,QACV,gBAAgB,GAAI,CAAA,cAAA;AAAA,OACtB;AAAA,KACA,CAAA,CAAA,CAAA;AAAA,GACJ;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,GAAK,EAAA;AACxB,IAAA,OAAO,IAAI,MAAO,CAAA,OAAA,CAAQ,KAAK,CAAA,CAAE,KAAK,CAAW,MAAA,MAAA;AAAA,MAC/C,GAAG,MAAA;AAAA,MACH,WAAa,EAAA;AAAA,QACX,GAAG,MAAO,CAAA,WAAA;AAAA,QACV,gBAAgB,GAAI,CAAA,cAAA;AAAA,OACtB;AAAA,KACA,CAAA,CAAA,CAAA;AAAA,GACJ;AACF,CAAC,EAAA;AAGD,SAAS,uBAAA,CACP,UACA,YACQ,EAAA;AACR,EAAO,OAAA,MAAA,CAAO,KAAK,CAAG,EAAA,QAAQ,IAAI,YAAY,CAAA,CAAE,CAAE,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAA;AACrE;;;;"}

package/dist/index.cjs.js

@@ -2,221 +2,11 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var pluginAuthNode = require('@backstage/plugin-auth-node');
-var jose = require('jose');
-var passportOauth2 = require('passport-oauth2');
-var backendPluginApi = require('@backstage/backend-plugin-api');
-var catalogModel = require('@backstage/catalog-model');
+var authenticator = require('./authenticator.cjs.js');
+var module$1 = require('./module.cjs.js');
 
-const vmwareCloudAuthenticator = pluginAuthNode.createOAuthAuthenticator({
-  defaultProfileTransform: async (input) => {
-    if (!input.session.idToken) {
-      throw new Error(
-        `Failed to parse id token and get profile info, missing token from session`
-      );
-    }
-    const vmwareClaims = ["email", "given_name", "family_name", "context_name"];
-    const identity = jose.decodeJwt(input.session.idToken);
-    const missingClaims = vmwareClaims.filter((key) => !(key in identity));
-    if (missingClaims.length > 0) {
-      throw new Error(
-        `ID token missing required claims: ${missingClaims.join(", ")}`
-      );
-    }
-    const typeMismatchClaims = vmwareClaims.filter(
-      (key) => typeof identity[key] !== "string"
-    );
-    if (typeMismatchClaims.length > 0) {
-      throw new Error(
-        `ID token claims type mismatch: ${typeMismatchClaims.join(", ")}`
-      );
-    }
-    const { email, given_name, family_name, context_name } = identity;
-    if (context_name !== input.fullProfile.organizationId) {
-      throw new Error(`ID token organizationId mismatch`);
-    }
-    return {
-      profile: {
-        displayName: `${given_name} ${family_name}`,
-        email
-      }
-    };
-  },
-  scopes: {
-    required: ["openid", "offline_access"]
-  },
-  initialize({ callbackUrl, config }) {
-    const consoleEndpoint = config.getOptionalString("consoleEndpoint") ?? "https://console.cloud.vmware.com";
-    const organizationId = config.getString("organizationId");
-    const clientId = config.getString("clientId");
-    const clientSecret = "";
-    const authorizationUrl = `${consoleEndpoint}/csp/gateway/discovery`;
-    const tokenUrl = `${consoleEndpoint}/csp/gateway/am/api/auth/token`;
-    if (config.has("scope")) {
-      throw new Error(
-        'The vmware-cloud provider no longer supports the "scope" configuration option. Please use the "additionalScopes" option instead.'
-      );
-    }
-    const providerStrategy = new passportOauth2.Strategy(
-      {
-        clientID: clientId,
-        clientSecret,
-        callbackURL: callbackUrl,
-        authorizationURL: authorizationUrl,
-        tokenURL: tokenUrl,
-        passReqToCallback: false,
-        pkce: true,
-        state: true,
-        customHeaders: {
-          Authorization: `Basic ${encodeClientCredentials(
-            clientId,
-            clientSecret
-          )}`
-        }
-      },
-      (accessToken, refreshToken, params, fullProfile, done) => {
-        done(void 0, { fullProfile, params, accessToken }, { refreshToken });
-      }
-    );
-    const pkceSessionStore = Object.create(
-      providerStrategy._stateStore
-    );
-    providerStrategy._stateStore = {
-      verify(req, state, callback) {
-        pkceSessionStore.verify(
-          req,
-          pluginAuthNode.decodeOAuthState(state).handle,
-          callback
-        );
-      },
-      store(req, verifier, state, meta, callback) {
-        pkceSessionStore.store(
-          req,
-          verifier,
-          state,
-          meta,
-          (err, handle) => {
-            callback(
-              err,
-              pluginAuthNode.encodeOAuthState({
-                handle,
-                ...state,
-                ...req.state
-              })
-            );
-          }
-        );
-      }
-    };
-    return {
-      organizationId,
-      providerStrategy,
-      helper: pluginAuthNode.PassportOAuthAuthenticatorHelper.from(providerStrategy)
-    };
-  },
-  async start(input, ctx) {
-    return new Promise((resolve, reject) => {
-      const strategy = Object.create(ctx.providerStrategy);
-      strategy.redirect = (url, status) => {
-        const parsed = new URL(url);
-        if (ctx.organizationId) {
-          parsed.searchParams.set("orgId", ctx.organizationId);
-        }
-        resolve({ url: parsed.toString(), status: status ?? void 0 });
-      };
-      strategy.error = (error) => {
-        reject(error);
-      };
-      strategy.authenticate(input.req, {
-        scope: input.scope,
-        state: pluginAuthNode.decodeOAuthState(input.state),
-        accessType: "offline",
-        prompt: "consent"
-      });
-    });
-  },
-  async authenticate(input, ctx) {
-    return ctx.helper.authenticate(input).then((result) => ({
-      ...result,
-      fullProfile: {
-        ...result.fullProfile,
-        organizationId: ctx.organizationId
-      }
-    }));
-  },
-  async refresh(input, ctx) {
-    return ctx.helper.refresh(input).then((result) => ({
-      ...result,
-      fullProfile: {
-        ...result.fullProfile,
-        organizationId: ctx.organizationId
-      }
-    }));
-  }
-});
-function encodeClientCredentials(clientID, clientSecret) {
-  return Buffer.from(`${clientID}:${clientSecret}`).toString("base64");
-}
 
-exports.vmwareCloudSignInResolvers = void 0;
-((vmwareCloudSignInResolvers2) => {
-  vmwareCloudSignInResolvers2.profileEmailMatchingUserEntityEmail = pluginAuthNode.createSignInResolverFactory({
-    create() {
-      return async (info, ctx) => {
-        const email = info.profile.email;
-        if (!email) {
-          throw new Error(
-            "VMware login failed, user profile does not contain an email"
-          );
-        }
-        const userEntityRef = catalogModel.stringifyEntityRef({
-          kind: "User",
-          name: email
-        });
-        try {
-          return await ctx.signInWithCatalogUser({
-            filter: {
-              "spec.profile.email": email
-            }
-          });
-        } catch (e) {
-          if (e.name !== "NotFoundError") {
-            throw e;
-          }
-          return ctx.issueToken({
-            claims: {
-              sub: userEntityRef,
-              ent: [userEntityRef]
-            }
-          });
-        }
-      };
-    }
-  });
-})(exports.vmwareCloudSignInResolvers || (exports.vmwareCloudSignInResolvers = {}));
 
-const authModuleVmwareCloudProvider = backendPluginApi.createBackendModule({
-  pluginId: "auth",
-  moduleId: "vmware-cloud-provider",
-  register(reg) {
-    reg.registerInit({
-      deps: { providers: pluginAuthNode.authProvidersExtensionPoint },
-      async init({ providers }) {
-        providers.registerProvider({
-          providerId: "vmwareCloudServices",
-          factory: pluginAuthNode.createOAuthProviderFactory({
-            authenticator: vmwareCloudAuthenticator,
-            signInResolverFactories: {
-              ...exports.vmwareCloudSignInResolvers,
-              ...pluginAuthNode.commonSignInResolvers
-            }
-          })
-        });
-      }
-    });
-  }
-});
-
-exports.default = authModuleVmwareCloudProvider;
-exports.vmwareCloudAuthenticator = vmwareCloudAuthenticator;
+exports.vmwareCloudAuthenticator = authenticator.vmwareCloudAuthenticator;
+exports.default = module$1.authModuleVmwareCloudProvider;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/authenticator.ts","../src/resolvers.ts","../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  createOAuthAuthenticator,\n  decodeOAuthState,\n  encodeOAuthState,\n  OAuthState,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { decodeJwt } from 'jose';\nimport {\n  Metadata,\n  StateStoreStoreCallback,\n  StateStoreVerifyCallback,\n  Strategy as OAuth2Strategy,\n} from 'passport-oauth2';\n\n/** @public */\nexport interface VMwareCloudAuthenticatorContext {\n  organizationId?: string;\n  providerStrategy: OAuth2Strategy;\n  helper: PassportOAuthAuthenticatorHelper;\n}\n\n/** @public */\nexport type VMwarePassportProfile = PassportProfile & {\n  organizationId?: string;\n};\n\n/**\n * VMware Cloud Authenticator to be used by `createOAuthProviderFactory`\n *\n * @public\n */\nexport const vmwareCloudAuthenticator = createOAuthAuthenticator<\n  VMwareCloudAuthenticatorContext,\n  VMwarePassportProfile\n>({\n  defaultProfileTransform: async input => {\n    if (!input.session.idToken) {\n      throw new Error(\n        `Failed to parse id token and get profile info, missing token from session`,\n      );\n    }\n\n    const vmwareClaims = ['email', 'given_name', 'family_name', 'context_name'];\n\n    const identity = decodeJwt(input.session.idToken);\n    const missingClaims = vmwareClaims.filter(key => !(key in identity));\n\n    if (missingClaims.length > 0) {\n      throw new Error(\n        `ID token missing required claims: ${missingClaims.join(', ')}`,\n      );\n    }\n\n    const typeMismatchClaims = vmwareClaims.filter(\n      key => typeof identity[key] !== 'string',\n    );\n\n    if (typeMismatchClaims.length > 0) {\n      throw new Error(\n        `ID token claims type mismatch: ${typeMismatchClaims.join(', ')}`,\n      );\n    }\n\n    // These claims were checked for presence & type\n    const { email, given_name, family_name, context_name } = identity as Record<\n      string,\n      string\n    >;\n\n    if (context_name !== input.fullProfile.organizationId) {\n      throw new Error(`ID token organizationId mismatch`);\n    }\n\n    return {\n      profile: {\n        displayName: `${given_name} ${family_name}`,\n        email,\n      },\n    };\n  },\n  scopes: {\n    required: ['openid', 'offline_access'],\n  },\n  initialize({ callbackUrl, config }) {\n    const consoleEndpoint =\n      config.getOptionalString('consoleEndpoint') ??\n      'https://console.cloud.vmware.com';\n    const organizationId = config.getString('organizationId');\n\n    const clientId = config.getString('clientId');\n    const clientSecret = '';\n    const authorizationUrl = `${consoleEndpoint}/csp/gateway/discovery`;\n    const tokenUrl = `${consoleEndpoint}/csp/gateway/am/api/auth/token`;\n\n    if (config.has('scope')) {\n      throw new Error(\n        'The vmware-cloud provider no longer supports the \"scope\" configuration option. Please use the \"additionalScopes\" option instead.',\n      );\n    }\n\n    const providerStrategy = new OAuth2Strategy(\n      {\n        clientID: clientId,\n        clientSecret: clientSecret,\n        callbackURL: callbackUrl,\n        authorizationURL: authorizationUrl,\n        tokenURL: tokenUrl,\n        passReqToCallback: false,\n        pkce: true,\n        state: true,\n        customHeaders: {\n          Authorization: `Basic ${encodeClientCredentials(\n            clientId,\n            clientSecret,\n          )}`,\n        },\n      },\n      (\n        accessToken: any,\n        refreshToken: any,\n        params: any,\n        fullProfile: PassportProfile,\n        done: PassportOAuthDoneCallback,\n      ) => {\n        done(undefined, { fullProfile, params, accessToken }, { refreshToken });\n      },\n    );\n\n    // Both VMware & OAuth2Strategy fight over control of the state when PKCE is on, thus this hack\n    const pkceSessionStore = Object.create(\n      (providerStrategy as any)._stateStore,\n    );\n    (providerStrategy as any)._stateStore = {\n      verify(req: Request, state: string, callback: StateStoreVerifyCallback) {\n        pkceSessionStore.verify(\n          req,\n          (decodeOAuthState(state) as any).handle,\n          callback,\n        );\n      },\n      store(\n        req: Request & {\n          scope: string;\n          state: OAuthState;\n        },\n        verifier: string,\n        state: any,\n        meta: Metadata,\n        callback: StateStoreStoreCallback,\n      ) {\n        pkceSessionStore.store(\n          req,\n          verifier,\n          state,\n          meta,\n          (err: Error, handle: string) => {\n            callback(\n              err,\n              encodeOAuthState({\n                handle,\n                ...state,\n                ...req.state,\n              } as OAuthState),\n            );\n          },\n        );\n      },\n    };\n\n    return {\n      organizationId,\n      providerStrategy,\n      helper: PassportOAuthAuthenticatorHelper.from(providerStrategy),\n    };\n  },\n\n  async start(input, ctx) {\n    return new Promise((resolve, reject) => {\n      const strategy: OAuth2Strategy = Object.create(ctx.providerStrategy);\n\n      strategy.redirect = (url: string, status?: number) => {\n        const parsed = new URL(url);\n        if (ctx.organizationId) {\n          parsed.searchParams.set('orgId', ctx.organizationId);\n        }\n        resolve({ url: parsed.toString(), status: status ?? undefined });\n      };\n      strategy.error = (error: Error) => {\n        reject(error);\n      };\n      strategy.authenticate(input.req, {\n        scope: input.scope,\n        state: decodeOAuthState(input.state),\n        accessType: 'offline',\n        prompt: 'consent',\n      });\n    });\n  },\n\n  async authenticate(input, ctx) {\n    return ctx.helper.authenticate(input).then(result => ({\n      ...result,\n      fullProfile: {\n        ...result.fullProfile,\n        organizationId: ctx.organizationId,\n      } as VMwarePassportProfile,\n    }));\n  },\n\n  async refresh(input, ctx) {\n    return ctx.helper.refresh(input).then(result => ({\n      ...result,\n      fullProfile: {\n        ...result.fullProfile,\n        organizationId: ctx.organizationId,\n      } as VMwarePassportProfile,\n    }));\n  },\n});\n\n/** @private */\nfunction encodeClientCredentials(\n  clientID: string,\n  clientSecret: string,\n): string {\n  return Buffer.from(`${clientID}:${clientSecret}`).toString('base64');\n}\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { stringifyEntityRef } from '@backstage/catalog-model';\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\n\n/**\n * Available sign-in resolvers for the VMware Cloud auth provider.\n *\n * @public\n */\nexport namespace vmwareCloudSignInResolvers {\n  /**\n   * Looks up the user by matching their profile email to the entity's profile email.\n   * If that fails, sign in the user without associating with a catalog user.\n   */\n  export const profileEmailMatchingUserEntityEmail =\n    createSignInResolverFactory({\n      create() {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n          ctx,\n        ) => {\n          const email = info.profile.email;\n\n          if (!email) {\n            throw new Error(\n              'VMware login failed, user profile does not contain an email',\n            );\n          }\n\n          const userEntityRef = stringifyEntityRef({\n            kind: 'User',\n            name: email,\n          });\n\n          try {\n            // we await here so that signInWithCatalogUser throws in the current `try`\n            return await ctx.signInWithCatalogUser({\n              filter: {\n                'spec.profile.email': email,\n              },\n            });\n          } catch (e) {\n            if (e.name !== 'NotFoundError') {\n              throw e;\n            }\n            return ctx.issueToken({\n              claims: {\n                sub: userEntityRef,\n                ent: [userEntityRef],\n              },\n            });\n          }\n        };\n      },\n    });\n}\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\n\nimport { vmwareCloudAuthenticator } from './authenticator';\nimport { vmwareCloudSignInResolvers } from './resolvers';\n\n/**\n * VMware Cloud Provider backend module for the auth plugin\n *\n * @public\n */\nexport const authModuleVmwareCloudProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'vmware-cloud-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: { providers: authProvidersExtensionPoint },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'vmwareCloudServices',\n          factory: createOAuthProviderFactory({\n            authenticator: vmwareCloudAuthenticator,\n            signInResolverFactories: {\n              ...vmwareCloudSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createOAuthAuthenticator","decodeJwt","OAuth2Strategy","decodeOAuthState","encodeOAuthState","PassportOAuthAuthenticatorHelper","vmwareCloudSignInResolvers","createSignInResolverFactory","stringifyEntityRef","createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","commonSignInResolvers"],"mappings":";;;;;;;;;;AAiDO,MAAM,2BAA2BA,uCAGtC,CAAA;AAAA,EACA,uBAAA,EAAyB,OAAM,KAAS,KAAA;AACtC,IAAI,IAAA,CAAC,KAAM,CAAA,OAAA,CAAQ,OAAS,EAAA;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,yEAAA,CAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,YAAe,GAAA,CAAC,OAAS,EAAA,YAAA,EAAc,eAAe,cAAc,CAAA,CAAA;AAE1E,IAAA,MAAM,QAAW,GAAAC,cAAA,CAAU,KAAM,CAAA,OAAA,CAAQ,OAAO,CAAA,CAAA;AAChD,IAAA,MAAM,gBAAgB,YAAa,CAAA,MAAA,CAAO,CAAO,GAAA,KAAA,EAAE,OAAO,QAAS,CAAA,CAAA,CAAA;AAEnE,IAAI,IAAA,aAAA,CAAc,SAAS,CAAG,EAAA;AAC5B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAqC,kCAAA,EAAA,aAAA,CAAc,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,OAC/D,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,qBAAqB,YAAa,CAAA,MAAA;AAAA,MACtC,CAAO,GAAA,KAAA,OAAO,QAAS,CAAA,GAAG,CAAM,KAAA,QAAA;AAAA,KAClC,CAAA;AAEA,IAAI,IAAA,kBAAA,CAAmB,SAAS,CAAG,EAAA;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAkC,+BAAA,EAAA,kBAAA,CAAmB,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA;AAAA,OACjE,CAAA;AAAA,KACF;AAGA,IAAA,MAAM,EAAE,KAAA,EAAO,UAAY,EAAA,WAAA,EAAa,cAAiB,GAAA,QAAA,CAAA;AAKzD,IAAI,IAAA,YAAA,KAAiB,KAAM,CAAA,WAAA,CAAY,cAAgB,EAAA;AACrD,MAAM,MAAA,IAAI,MAAM,CAAkC,gCAAA,CAAA,CAAA,CAAA;AAAA,KACpD;AAEA,IAAO,OAAA;AAAA,MACL,OAAS,EAAA;AAAA,QACP,WAAa,EAAA,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,QACzC,KAAA;AAAA,OACF;AAAA,KACF,CAAA;AAAA,GACF;AAAA,EACA,MAAQ,EAAA;AAAA,IACN,QAAA,EAAU,CAAC,QAAA,EAAU,gBAAgB,CAAA;AAAA,GACvC;AAAA,EACA,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAA,MAAM,eACJ,GAAA,MAAA,CAAO,iBAAkB,CAAA,iBAAiB,CAC1C,IAAA,kCAAA,CAAA;AACF,IAAM,MAAA,cAAA,GAAiB,MAAO,CAAA,SAAA,CAAU,gBAAgB,CAAA,CAAA;AAExD,IAAM,MAAA,QAAA,GAAW,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA,CAAA;AAC5C,IAAA,MAAM,YAAe,GAAA,EAAA,CAAA;AACrB,IAAM,MAAA,gBAAA,GAAmB,GAAG,eAAe,CAAA,sBAAA,CAAA,CAAA;AAC3C,IAAM,MAAA,QAAA,GAAW,GAAG,eAAe,CAAA,8BAAA,CAAA,CAAA;AAEnC,IAAI,IAAA,MAAA,CAAO,GAAI,CAAA,OAAO,CAAG,EAAA;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,kIAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,mBAAmB,IAAIC,uBAAA;AAAA,MAC3B;AAAA,QACE,QAAU,EAAA,QAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAa,EAAA,WAAA;AAAA,QACb,gBAAkB,EAAA,gBAAA;AAAA,QAClB,QAAU,EAAA,QAAA;AAAA,QACV,iBAAmB,EAAA,KAAA;AAAA,QACnB,IAAM,EAAA,IAAA;AAAA,QACN,KAAO,EAAA,IAAA;AAAA,QACP,aAAe,EAAA;AAAA,UACb,eAAe,CAAS,MAAA,EAAA,uBAAA;AAAA,YACtB,QAAA;AAAA,YACA,YAAA;AAAA,WACD,CAAA,CAAA;AAAA,SACH;AAAA,OACF;AAAA,MACA,CACE,WAAA,EACA,YACA,EAAA,MAAA,EACA,aACA,IACG,KAAA;AACH,QAAK,IAAA,CAAA,KAAA,CAAA,EAAW,EAAE,WAAa,EAAA,MAAA,EAAQ,aAAe,EAAA,EAAE,cAAc,CAAA,CAAA;AAAA,OACxE;AAAA,KACF,CAAA;AAGA,IAAA,MAAM,mBAAmB,MAAO,CAAA,MAAA;AAAA,MAC7B,gBAAyB,CAAA,WAAA;AAAA,KAC5B,CAAA;AACA,IAAC,iBAAyB,WAAc,GAAA;AAAA,MACtC,MAAA,CAAO,GAAc,EAAA,KAAA,EAAe,QAAoC,EAAA;AACtE,QAAiB,gBAAA,CAAA,MAAA;AAAA,UACf,GAAA;AAAA,UACCC,+BAAA,CAAiB,KAAK,CAAU,CAAA,MAAA;AAAA,UACjC,QAAA;AAAA,SACF,CAAA;AAAA,OACF;AAAA,MACA,KACE,CAAA,GAAA,EAIA,QACA,EAAA,KAAA,EACA,MACA,QACA,EAAA;AACA,QAAiB,gBAAA,CAAA,KAAA;AAAA,UACf,GAAA;AAAA,UACA,QAAA;AAAA,UACA,KAAA;AAAA,UACA,IAAA;AAAA,UACA,CAAC,KAAY,MAAmB,KAAA;AAC9B,YAAA,QAAA;AAAA,cACE,GAAA;AAAA,cACAC,+BAAiB,CAAA;AAAA,gBACf,MAAA;AAAA,gBACA,GAAG,KAAA;AAAA,gBACH,GAAG,GAAI,CAAA,KAAA;AAAA,eACM,CAAA;AAAA,aACjB,CAAA;AAAA,WACF;AAAA,SACF,CAAA;AAAA,OACF;AAAA,KACF,CAAA;AAEA,IAAO,OAAA;AAAA,MACL,cAAA;AAAA,MACA,gBAAA;AAAA,MACA,MAAA,EAAQC,+CAAiC,CAAA,IAAA,CAAK,gBAAgB,CAAA;AAAA,KAChE,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,KAAM,CAAA,KAAA,EAAO,GAAK,EAAA;AACtB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAW,KAAA;AACtC,MAAA,MAAM,QAA2B,GAAA,MAAA,CAAO,MAAO,CAAA,GAAA,CAAI,gBAAgB,CAAA,CAAA;AAEnE,MAAS,QAAA,CAAA,QAAA,GAAW,CAAC,GAAA,EAAa,MAAoB,KAAA;AACpD,QAAM,MAAA,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA,CAAA;AAC1B,QAAA,IAAI,IAAI,cAAgB,EAAA;AACtB,UAAA,MAAA,CAAO,YAAa,CAAA,GAAA,CAAI,OAAS,EAAA,GAAA,CAAI,cAAc,CAAA,CAAA;AAAA,SACrD;AACA,QAAQ,OAAA,CAAA,EAAE,KAAK,MAAO,CAAA,QAAA,IAAY,MAAQ,EAAA,MAAA,IAAU,QAAW,CAAA,CAAA;AAAA,OACjE,CAAA;AACA,MAAS,QAAA,CAAA,KAAA,GAAQ,CAAC,KAAiB,KAAA;AACjC,QAAA,MAAA,CAAO,KAAK,CAAA,CAAA;AAAA,OACd,CAAA;AACA,MAAS,QAAA,CAAA,YAAA,CAAa,MAAM,GAAK,EAAA;AAAA,QAC/B,OAAO,KAAM,CAAA,KAAA;AAAA,QACb,KAAA,EAAOF,+BAAiB,CAAA,KAAA,CAAM,KAAK,CAAA;AAAA,QACnC,UAAY,EAAA,SAAA;AAAA,QACZ,MAAQ,EAAA,SAAA;AAAA,OACT,CAAA,CAAA;AAAA,KACF,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAa,CAAA,KAAA,EAAO,GAAK,EAAA;AAC7B,IAAA,OAAO,IAAI,MAAO,CAAA,YAAA,CAAa,KAAK,CAAA,CAAE,KAAK,CAAW,MAAA,MAAA;AAAA,MACpD,GAAG,MAAA;AAAA,MACH,WAAa,EAAA;AAAA,QACX,GAAG,MAAO,CAAA,WAAA;AAAA,QACV,gBAAgB,GAAI,CAAA,cAAA;AAAA,OACtB;AAAA,KACA,CAAA,CAAA,CAAA;AAAA,GACJ;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,GAAK,EAAA;AACxB,IAAA,OAAO,IAAI,MAAO,CAAA,OAAA,CAAQ,KAAK,CAAA,CAAE,KAAK,CAAW,MAAA,MAAA;AAAA,MAC/C,GAAG,MAAA;AAAA,MACH,WAAa,EAAA;AAAA,QACX,GAAG,MAAO,CAAA,WAAA;AAAA,QACV,gBAAgB,GAAI,CAAA,cAAA;AAAA,OACtB;AAAA,KACA,CAAA,CAAA,CAAA;AAAA,GACJ;AACF,CAAC,EAAA;AAGD,SAAS,uBAAA,CACP,UACA,YACQ,EAAA;AACR,EAAO,OAAA,MAAA,CAAO,KAAK,CAAG,EAAA,QAAQ,IAAI,YAAY,CAAA,CAAE,CAAE,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAA;AACrE;;ACxNiBG,4CAAA;AAAA,CAAV,CAAUA,2BAAV,KAAA;AAKE,EAAMA,2BAAAA,CAAA,sCACXC,0CAA4B,CAAA;AAAA,IAC1B,MAAS,GAAA;AACP,MAAO,OAAA,OACL,MACA,GACG,KAAA;AACH,QAAM,MAAA,KAAA,GAAQ,KAAK,OAAQ,CAAA,KAAA,CAAA;AAE3B,QAAA,IAAI,CAAC,KAAO,EAAA;AACV,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,6DAAA;AAAA,WACF,CAAA;AAAA,SACF;AAEA,QAAA,MAAM,gBAAgBC,+BAAmB,CAAA;AAAA,UACvC,IAAM,EAAA,MAAA;AAAA,UACN,IAAM,EAAA,KAAA;AAAA,SACP,CAAA,CAAA;AAED,QAAI,IAAA;AAEF,UAAO,OAAA,MAAM,IAAI,qBAAsB,CAAA;AAAA,YACrC,MAAQ,EAAA;AAAA,cACN,oBAAsB,EAAA,KAAA;AAAA,aACxB;AAAA,WACD,CAAA,CAAA;AAAA,iBACM,CAAG,EAAA;AACV,UAAI,IAAA,CAAA,CAAE,SAAS,eAAiB,EAAA;AAC9B,YAAM,MAAA,CAAA,CAAA;AAAA,WACR;AACA,UAAA,OAAO,IAAI,UAAW,CAAA;AAAA,YACpB,MAAQ,EAAA;AAAA,cACN,GAAK,EAAA,aAAA;AAAA,cACL,GAAA,EAAK,CAAC,aAAa,CAAA;AAAA,aACrB;AAAA,WACD,CAAA,CAAA;AAAA,SACH;AAAA,OACF,CAAA;AAAA,KACF;AAAA,GACD,CAAA,CAAA;AAAA,CA7CY,EAAAF,kCAAA,KAAAA,kCAAA,GAAA,EAAA,CAAA,CAAA;;ACEV,MAAM,gCAAgCG,oCAAoB,CAAA;AAAA,EAC/D,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,uBAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAA,EAAM,EAAE,SAAA,EAAWC,0CAA4B,EAAA;AAAA,MAC/C,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,qBAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAA,wBAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGL,kCAAA;AAAA,cACH,GAAGM,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _backstage_plugin_auth_node from '@backstage/plugin-auth-node';
-import { PassportOAuthAuthenticatorHelper, PassportProfile, OAuthAuthenticatorResult } from '@backstage/plugin-auth-node';
+import { PassportOAuthAuthenticatorHelper, PassportProfile } from '@backstage/plugin-auth-node';
 import { Strategy } from 'passport-oauth2';
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
 
@@ -27,17 +27,4 @@ declare const vmwareCloudAuthenticator: _backstage_plugin_auth_node.OAuthAuthent
  */
 declare const authModuleVmwareCloudProvider: _backstage_backend_plugin_api.BackendFeature;
 
-/**
- * Available sign-in resolvers for the VMware Cloud auth provider.
- *
- * @public
- */
-declare namespace vmwareCloudSignInResolvers {
-    /**
-     * Looks up the user by matching their profile email to the entity's profile email.
-     * If that fails, sign in the user without associating with a catalog user.
-     */
-    const profileEmailMatchingUserEntityEmail: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, unknown>;
-}
-
-export { type VMwareCloudAuthenticatorContext, type VMwarePassportProfile, authModuleVmwareCloudProvider as default, vmwareCloudAuthenticator, vmwareCloudSignInResolvers };
+export { type VMwareCloudAuthenticatorContext, type VMwarePassportProfile, authModuleVmwareCloudProvider as default, vmwareCloudAuthenticator };

package/dist/module.cjs.js

@@ -0,0 +1,29 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var authenticator = require('./authenticator.cjs.js');
+
+const authModuleVmwareCloudProvider = backendPluginApi.createBackendModule({
+  pluginId: "auth",
+  moduleId: "vmware-cloud-provider",
+  register(reg) {
+    reg.registerInit({
+      deps: { providers: pluginAuthNode.authProvidersExtensionPoint },
+      async init({ providers }) {
+        providers.registerProvider({
+          providerId: "vmwareCloudServices",
+          factory: pluginAuthNode.createOAuthProviderFactory({
+            authenticator: authenticator.vmwareCloudAuthenticator,
+            signInResolverFactories: {
+              ...pluginAuthNode.commonSignInResolvers
+            }
+          })
+        });
+      }
+    });
+  }
+});
+
+exports.authModuleVmwareCloudProvider = authModuleVmwareCloudProvider;
+//# sourceMappingURL=module.cjs.js.map

package/dist/module.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\n\nimport { vmwareCloudAuthenticator } from './authenticator';\n\n/**\n * VMware Cloud Provider backend module for the auth plugin\n *\n * @public\n */\nexport const authModuleVmwareCloudProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'vmware-cloud-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: { providers: authProvidersExtensionPoint },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'vmwareCloudServices',\n          factory: createOAuthProviderFactory({\n            authenticator: vmwareCloudAuthenticator,\n            signInResolverFactories: {\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","vmwareCloudAuthenticator","commonSignInResolvers"],"mappings":";;;;;;AA6BO,MAAM,gCAAgCA,oCAAoB,CAAA;AAAA,EAC/D,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,uBAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAA,EAAM,EAAE,SAAA,EAAWC,0CAA4B,EAAA;AAAA,MAC/C,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,qBAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAAC,sCAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGC,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-vmware-cloud-provider",
-  "version": "0.3.0",
+  "version": "0.4.0-next.1",
   "description": "The vmware-cloud-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -33,20 +33,20 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.0.0",
-    "@backstage/catalog-model": "^1.7.0",
-    "@backstage/plugin-auth-node": "^0.5.2",
+    "@backstage/backend-plugin-api": "1.0.1-next.1",
+    "@backstage/catalog-model": "1.7.0",
+    "@backstage/plugin-auth-node": "0.5.3-next.1",
     "@types/passport-oauth2": "^1.4.15",
     "jose": "^5.0.0",
     "passport-oauth2": "^1.6.1"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.5.0",
-    "@backstage/backend-test-utils": "^1.0.0",
-    "@backstage/cli": "^0.27.1",
-    "@backstage/config": "^1.2.0",
-    "@backstage/errors": "^1.2.4",
-    "@backstage/plugin-auth-backend": "^0.23.0",
+    "@backstage/backend-defaults": "0.5.1-next.2",
+    "@backstage/backend-test-utils": "1.0.1-next.2",
+    "@backstage/cli": "0.28.0-next.2",
+    "@backstage/config": "1.2.0",
+    "@backstage/errors": "1.2.4",
+    "@backstage/plugin-auth-backend": "0.23.1-next.1",
     "msw": "^2.0.8",
     "supertest": "^7.0.0"
   }