@backstage/plugin-auth-backend 0.17.5-next.2 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @backstage/plugin-auth-backend
 
+## 0.18.0
+
+### Minor Changes
+
+- db10b6ef65: Added a Bitbucket Server Auth Provider and added its API to the app defaults
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.18.2
+  - @backstage/catalog-model@1.2.0
+  - @backstage/catalog-client@1.3.1
+  - @backstage/config@1.0.6
+  - @backstage/errors@1.1.4
+  - @backstage/types@1.0.2
+  - @backstage/plugin-auth-node@0.2.11
+
 ## 0.17.5-next.2
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -2755,11 +2755,178 @@ const saml = createAuthProviderIntegration({
   }
 });
 
+class BitbucketServerAuthProvider {
+  constructor(options) {
+    this.signInResolver = options.signInResolver;
+    this.authHandler = options.authHandler;
+    this.resolverContext = options.resolverContext;
+    this.strategy = new OAuth2Strategy.Strategy(
+      {
+        authorizationURL: options.authorizationUrl,
+        tokenURL: options.tokenUrl,
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, { fullProfile, params, accessToken }, { refreshToken });
+      }
+    );
+    this.host = options.host;
+  }
+  async start(req) {
+    return await executeRedirectStrategy(req, this.strategy, {
+      accessType: "offline",
+      prompt: "consent",
+      scope: req.scope,
+      state: encodeState(req.state)
+    });
+  }
+  async handler(req) {
+    const { result, privateInfo } = await executeFrameHandlerStrategy(req, this.strategy);
+    return {
+      response: await this.handleResult(result),
+      refreshToken: privateInfo.refreshToken
+    };
+  }
+  async refresh(req) {
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this.strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this.strategy,
+      accessToken
+    );
+    return {
+      response: await this.handleResult({
+        fullProfile,
+        params,
+        accessToken
+      }),
+      refreshToken
+    };
+  }
+  async handleResult(result) {
+    result.fullProfile = await this.fetchProfile(result);
+    const { profile } = await this.authHandler(result, this.resolverContext);
+    let backstageIdentity = void 0;
+    if (this.signInResolver) {
+      backstageIdentity = await this.signInResolver(
+        { result, profile },
+        this.resolverContext
+      );
+    }
+    return {
+      providerInfo: {
+        accessToken: result.accessToken,
+        scope: result.params.scope,
+        expiresInSeconds: result.params.expires_in
+      },
+      profile,
+      backstageIdentity
+    };
+  }
+  async fetchProfile(result) {
+    let whoAmIResponse;
+    try {
+      whoAmIResponse = await fetch__default["default"](
+        `https://${this.host}/plugins/servlet/applinks/whoami`,
+        {
+          headers: {
+            Authorization: `Bearer ${result.accessToken}`
+          }
+        }
+      );
+    } catch (e) {
+      throw new Error(`Failed to retrieve the username of the logged in user`);
+    }
+    const username = whoAmIResponse.headers.get("X-Ausername");
+    if (!username) {
+      throw new Error(`Failed to retrieve the username of the logged in user`);
+    }
+    let userResponse;
+    try {
+      userResponse = await fetch__default["default"](
+        `https://${this.host}/rest/api/latest/users/${username}?avatarSize=256`,
+        {
+          headers: {
+            Authorization: `Bearer ${result.accessToken}`
+          }
+        }
+      );
+    } catch (e) {
+      throw new Error(`Failed to retrieve the user '${username}'`);
+    }
+    if (!userResponse.ok) {
+      throw new Error(`Failed to retrieve the user '${username}'`);
+    }
+    const user = await userResponse.json();
+    const passportProfile = {
+      provider: "bitbucketServer",
+      id: user.id.toString(),
+      displayName: user.displayName,
+      username: user.name,
+      emails: [
+        {
+          value: user.emailAddress
+        }
+      ]
+    };
+    if (user.avatarUrl) {
+      passportProfile.photos = [
+        { value: `https://${this.host}${user.avatarUrl}` }
+      ];
+    }
+    return passportProfile;
+  }
+}
+const bitbucketServer = createAuthProviderIntegration({
+  create(options) {
+    return ({ providerId, globalConfig, config, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
+      var _a;
+      const clientId = envConfig.getString("clientId");
+      const clientSecret = envConfig.getString("clientSecret");
+      const host = envConfig.getString("host");
+      const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+      const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+      const authorizationUrl = `https://${host}/rest/oauth2/latest/authorize`;
+      const tokenUrl = `https://${host}/rest/oauth2/latest/token`;
+      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
+        profile: makeProfileInfo(fullProfile)
+      });
+      const provider = new BitbucketServerAuthProvider({
+        callbackUrl,
+        clientId,
+        clientSecret,
+        host,
+        authorizationUrl,
+        tokenUrl,
+        authHandler,
+        signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver,
+        resolverContext
+      });
+      return OAuthAdapter.fromConfig(globalConfig, provider, {
+        providerId,
+        callbackUrl
+      });
+    });
+  },
+  resolvers: {
+    /**
+     * Looks up the user by matching their email to the entity email.
+     */
+    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver
+  }
+});
+
 const providers = Object.freeze({
   atlassian,
   auth0,
   awsAlb,
   bitbucket,
+  bitbucketServer,
   cfAccess,
   gcpIap,
   github,
@@ -2786,6 +2953,7 @@ const defaultAuthProviderFactories = {
   onelogin: onelogin.create(),
   awsalb: awsAlb.create(),
   bitbucket: bitbucket.create(),
+  bitbucketServer: bitbucketServer.create(),
   atlassian: atlassian.create()
 };