@backstage/plugin-auth-backend 0.18.5-next.0 → 0.18.5

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @backstage/plugin-auth-backend
 
+## 0.18.5
+
+### Patch Changes
+
+- c27ae5004fc2: Support for Token Endpoint Auth Method for OIDC Provider
+- Updated dependencies
+  - @backstage/errors@1.2.1
+  - @backstage/backend-common@0.19.1
+  - @backstage/catalog-client@1.4.3
+  - @backstage/catalog-model@1.4.1
+  - @backstage/config@1.0.8
+  - @backstage/types@1.1.0
+  - @backstage/plugin-auth-node@0.2.16
+
+## 0.18.5-next.1
+
+### Patch Changes
+
+- c27ae5004fc2: Support for Token Endpoint Auth Method for OIDC Provider
+- Updated dependencies
+  - @backstage/config@1.0.8
+
 ## 0.18.5-next.0
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -74,6 +74,12 @@ var session__default = /*#__PURE__*/_interopDefaultLegacy(session);
 var connectSessionKnex__default = /*#__PURE__*/_interopDefaultLegacy(connectSessionKnex);
 var passport__default = /*#__PURE__*/_interopDefaultLegacy(passport);
 
+var __defProp$m = Object.defineProperty;
+var __defNormalProp$m = (obj, key, value) => key in obj ? __defProp$m(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$m = (obj, key, value) => {
+  __defNormalProp$m(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const defaultScopes = ["offline_access", "read:me"];
 class AtlassianStrategy extends OAuth2Strategy__default["default"] {
   constructor(options, verify) {
@@ -88,6 +94,7 @@ class AtlassianStrategy extends OAuth2Strategy__default["default"] {
       scope: Array.from(/* @__PURE__ */ new Set([...defaultScopes, ...scopes]))
     };
     super(optionsWithURLs, verify);
+    __publicField$m(this, "profileURL");
     this.profileURL = "https://api.atlassian.com/me";
     this.name = "atlassian";
     this._oauth2.useAuthorizationHeaderforGET(true);
@@ -288,55 +295,62 @@ function prepareBackstageIdentityResponse(result) {
   };
 }
 
+var __defProp$l = Object.defineProperty;
+var __defNormalProp$l = (obj, key, value) => key in obj ? __defProp$l(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$l = (obj, key, value) => {
+  __defNormalProp$l(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const THOUSAND_DAYS_MS = 1e3 * 24 * 60 * 60 * 1e3;
 const TEN_MINUTES_MS = 600 * 1e3;
 class OAuthAdapter {
   constructor(handlers, options) {
     this.handlers = handlers;
     this.options = options;
-    this.setNonceCookie = (res, nonce, cookieConfig) => {
+    __publicField$l(this, "baseCookieOptions");
+    __publicField$l(this, "setNonceCookie", (res, nonce, cookieConfig) => {
       res.cookie(`${this.options.providerId}-nonce`, nonce, {
         maxAge: TEN_MINUTES_MS,
         ...this.baseCookieOptions,
         ...cookieConfig,
         path: `${cookieConfig.path}/handler`
       });
-    };
-    this.setGrantedScopeCookie = (res, scope, cookieConfig) => {
+    });
+    __publicField$l(this, "setGrantedScopeCookie", (res, scope, cookieConfig) => {
       res.cookie(`${this.options.providerId}-granted-scope`, scope, {
         maxAge: THOUSAND_DAYS_MS,
         ...this.baseCookieOptions,
         ...cookieConfig
       });
-    };
-    this.getRefreshTokenFromCookie = (req) => {
+    });
+    __publicField$l(this, "getRefreshTokenFromCookie", (req) => {
       return req.cookies[`${this.options.providerId}-refresh-token`];
-    };
-    this.getGrantedScopeFromCookie = (req) => {
+    });
+    __publicField$l(this, "getGrantedScopeFromCookie", (req) => {
       return req.cookies[`${this.options.providerId}-granted-scope`];
-    };
-    this.setRefreshTokenCookie = (res, refreshToken, cookieConfig) => {
+    });
+    __publicField$l(this, "setRefreshTokenCookie", (res, refreshToken, cookieConfig) => {
       res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
         maxAge: THOUSAND_DAYS_MS,
         ...this.baseCookieOptions,
         ...cookieConfig
       });
-    };
-    this.removeRefreshTokenCookie = (res, cookieConfig) => {
+    });
+    __publicField$l(this, "removeRefreshTokenCookie", (res, cookieConfig) => {
       res.cookie(`${this.options.providerId}-refresh-token`, "", {
         maxAge: 0,
         ...this.baseCookieOptions,
         ...cookieConfig
       });
-    };
-    this.getCookieConfig = (origin) => {
+    });
+    __publicField$l(this, "getCookieConfig", (origin) => {
       return this.options.cookieConfigurer({
         providerId: this.options.providerId,
         baseUrl: this.options.baseUrl,
         callbackUrl: this.options.callbackUrl,
         appOrigin: origin != null ? origin : this.options.appOrigin
       });
-    };
+    });
     this.baseCookieOptions = {
       httpOnly: true,
       sameSite: "lax"
@@ -634,6 +648,12 @@ function createAuthProviderIntegration(config) {
   });
 }
 
+var __defProp$k = Object.defineProperty;
+var __defNormalProp$k = (obj, key, value) => key in obj ? __defProp$k(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$k = (obj, key, value) => {
+  __defNormalProp$k(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const atlassianDefaultAuthHandler = async ({
   fullProfile,
   params
@@ -642,6 +662,10 @@ const atlassianDefaultAuthHandler = async ({
 });
 class AtlassianAuthProvider {
   constructor(options) {
+    __publicField$k(this, "_strategy");
+    __publicField$k(this, "signInResolver");
+    __publicField$k(this, "authHandler");
+    __publicField$k(this, "resolverContext");
     this.resolverContext = options.resolverContext;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
@@ -759,8 +783,21 @@ class Auth0Strategy extends Auth0InternalStrategy__default["default"] {
   }
 }
 
+var __defProp$j = Object.defineProperty;
+var __defNormalProp$j = (obj, key, value) => key in obj ? __defProp$j(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$j = (obj, key, value) => {
+  __defNormalProp$j(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class Auth0AuthProvider {
   constructor(options) {
+    __publicField$j(this, "_strategy");
+    __publicField$j(this, "signInResolver");
+    __publicField$j(this, "authHandler");
+    __publicField$j(this, "resolverContext");
+    __publicField$j(this, "audience");
+    __publicField$j(this, "connection");
+    __publicField$j(this, "connectionScope");
     /**
      * Due to passport-auth0 forcing options.state = true,
      * passport-oauth2 requires express-session to be installed
@@ -769,14 +806,14 @@ class Auth0AuthProvider {
      * passport-oauth2, which is the StateStore implementation used when options.state = false,
      * allowing us to avoid using express-session in order to integrate with auth0.
      */
-    this.store = {
+    __publicField$j(this, "store", {
       store(_req, cb) {
         cb(null, null);
       },
       verify(_req, _state, cb) {
         cb(null, true);
       }
-    };
+    });
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -910,11 +947,23 @@ const auth0 = createAuthProviderIntegration({
   }
 });
 
+var __defProp$i = Object.defineProperty;
+var __defNormalProp$i = (obj, key, value) => key in obj ? __defProp$i(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$i = (obj, key, value) => {
+  __defNormalProp$i(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const ALB_JWT_HEADER = "x-amzn-oidc-data";
 const ALB_ACCESS_TOKEN_HEADER = "x-amzn-oidc-accesstoken";
 class AwsAlbAuthProvider {
   constructor(options) {
-    this.getKey = async (header) => {
+    __publicField$i(this, "region");
+    __publicField$i(this, "issuer");
+    __publicField$i(this, "resolverContext");
+    __publicField$i(this, "keyCache");
+    __publicField$i(this, "authHandler");
+    __publicField$i(this, "signInResolver");
+    __publicField$i(this, "getKey", async (header) => {
       if (!header.kid) {
         throw new errors.AuthenticationError("No key id was specified in header");
       }
@@ -933,7 +982,7 @@ class AwsAlbAuthProvider {
         keyValue.export({ format: "pem", type: "spki" })
       );
       return keyValue;
-    };
+    });
     this.region = options.region;
     this.issuer = options.issuer;
     this.authHandler = options.authHandler;
@@ -1042,8 +1091,18 @@ const awsAlb = createAuthProviderIntegration({
   }
 });
 
+var __defProp$h = Object.defineProperty;
+var __defNormalProp$h = (obj, key, value) => key in obj ? __defProp$h(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$h = (obj, key, value) => {
+  __defNormalProp$h(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class BitbucketAuthProvider {
   constructor(options) {
+    __publicField$h(this, "_strategy");
+    __publicField$h(this, "signInResolver");
+    __publicField$h(this, "authHandler");
+    __publicField$h(this, "resolverContext");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -1211,11 +1270,23 @@ const commonByEmailResolver = async (info, ctx) => {
   });
 };
 
+var __defProp$g = Object.defineProperty;
+var __defNormalProp$g = (obj, key, value) => key in obj ? __defProp$g(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$g = (obj, key, value) => {
+  __defNormalProp$g(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const CF_JWT_HEADER = "cf-access-jwt-assertion";
 const COOKIE_AUTH_NAME = "CF_Authorization";
 const CACHE_PREFIX = "providers/cloudflare-access/profile-v1";
 class CloudflareAccessAuthProvider {
   constructor(options) {
+    __publicField$g(this, "teamName");
+    __publicField$g(this, "resolverContext");
+    __publicField$g(this, "authHandler");
+    __publicField$g(this, "signInResolver");
+    __publicField$g(this, "jwtKeySet");
+    __publicField$g(this, "cache");
     this.teamName = options.teamName;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
@@ -1399,8 +1470,19 @@ const defaultAuthHandler$1 = async ({
 
 const DEFAULT_IAP_JWT_HEADER = "x-goog-iap-jwt-assertion";
 
+var __defProp$f = Object.defineProperty;
+var __defNormalProp$f = (obj, key, value) => key in obj ? __defProp$f(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$f = (obj, key, value) => {
+  __defNormalProp$f(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class GcpIapProvider {
   constructor(options) {
+    __publicField$f(this, "authHandler");
+    __publicField$f(this, "signInResolver");
+    __publicField$f(this, "tokenValidator");
+    __publicField$f(this, "resolverContext");
+    __publicField$f(this, "jwtHeader");
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
     this.tokenValidator = options.tokenValidator;
@@ -1451,9 +1533,20 @@ const gcpIap = createAuthProviderIntegration({
 
 const BACKSTAGE_SESSION_EXPIRATION = 3600;
 
+var __defProp$e = Object.defineProperty;
+var __defNormalProp$e = (obj, key, value) => key in obj ? __defProp$e(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$e = (obj, key, value) => {
+  __defNormalProp$e(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const ACCESS_TOKEN_PREFIX = "access-token.";
 class GithubAuthProvider {
   constructor(options) {
+    __publicField$e(this, "_strategy");
+    __publicField$e(this, "signInResolver");
+    __publicField$e(this, "authHandler");
+    __publicField$e(this, "resolverContext");
+    __publicField$e(this, "stateEncoder");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.stateEncoder = options.stateEncoder;
@@ -1616,6 +1709,12 @@ const github = createAuthProviderIntegration({
   }
 });
 
+var __defProp$d = Object.defineProperty;
+var __defNormalProp$d = (obj, key, value) => key in obj ? __defProp$d(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$d = (obj, key, value) => {
+  __defNormalProp$d(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const gitlabDefaultAuthHandler = async ({
   fullProfile,
   params
@@ -1624,6 +1723,10 @@ const gitlabDefaultAuthHandler = async ({
 });
 class GitlabAuthProvider {
   constructor(options) {
+    __publicField$d(this, "_strategy");
+    __publicField$d(this, "signInResolver");
+    __publicField$d(this, "authHandler");
+    __publicField$d(this, "resolverContext");
     this.resolverContext = options.resolverContext;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
@@ -1731,8 +1834,18 @@ const gitlab = createAuthProviderIntegration({
   }
 });
 
+var __defProp$c = Object.defineProperty;
+var __defNormalProp$c = (obj, key, value) => key in obj ? __defProp$c(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$c = (obj, key, value) => {
+  __defNormalProp$c(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class GoogleAuthProvider {
   constructor(options) {
+    __publicField$c(this, "strategy");
+    __publicField$c(this, "signInResolver");
+    __publicField$c(this, "authHandler");
+    __publicField$c(this, "resolverContext");
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
     this.resolverContext = options.resolverContext;
@@ -1873,13 +1986,24 @@ const google = createAuthProviderIntegration({
   }
 });
 
+var __defProp$b = Object.defineProperty;
+var __defNormalProp$b = (obj, key, value) => key in obj ? __defProp$b(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$b = (obj, key, value) => {
+  __defNormalProp$b(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class MicrosoftAuthProvider {
   constructor(options) {
-    this.skipUserProfile = (accessToken) => {
+    __publicField$b(this, "_strategy");
+    __publicField$b(this, "signInResolver");
+    __publicField$b(this, "authHandler");
+    __publicField$b(this, "logger");
+    __publicField$b(this, "resolverContext");
+    __publicField$b(this, "skipUserProfile", (accessToken) => {
       const { aud, scp } = jose.decodeJwt(accessToken);
       const hasGraphReadScope = aud === "00000003-0000-0000-c000-000000000000" && scp.split(" ").map((s) => s.toLowerCase()).includes("user.read");
       return !hasGraphReadScope;
-    };
+    });
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.logger = options.logger;
@@ -2040,8 +2164,19 @@ const microsoft = createAuthProviderIntegration({
   }
 });
 
+var __defProp$a = Object.defineProperty;
+var __defNormalProp$a = (obj, key, value) => key in obj ? __defProp$a(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$a = (obj, key, value) => {
+  __defNormalProp$a(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class OAuth2AuthProvider {
   constructor(options) {
+    __publicField$a(this, "_strategy");
+    __publicField$a(this, "signInResolver");
+    __publicField$a(this, "authHandler");
+    __publicField$a(this, "resolverContext");
+    __publicField$a(this, "disableRefresh");
     var _a;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
@@ -2180,9 +2315,18 @@ const oauth2 = createAuthProviderIntegration({
   }
 });
 
+var __defProp$9 = Object.defineProperty;
+var __defNormalProp$9 = (obj, key, value) => key in obj ? __defProp$9(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$9 = (obj, key, value) => {
+  __defNormalProp$9(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const OAUTH2_PROXY_JWT_HEADER = "X-OAUTH2-PROXY-ID-TOKEN";
 class Oauth2ProxyAuthProvider {
   constructor(options) {
+    __publicField$9(this, "resolverContext");
+    __publicField$9(this, "signInResolver");
+    __publicField$9(this, "authHandler");
     this.resolverContext = options.resolverContext;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
@@ -2257,8 +2401,20 @@ const oauth2Proxy = createAuthProviderIntegration({
   }
 });
 
+var __defProp$8 = Object.defineProperty;
+var __defNormalProp$8 = (obj, key, value) => key in obj ? __defProp$8(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$8 = (obj, key, value) => {
+  __defNormalProp$8(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class OidcAuthProvider {
   constructor(options) {
+    __publicField$8(this, "implementation");
+    __publicField$8(this, "scope");
+    __publicField$8(this, "prompt");
+    __publicField$8(this, "signInResolver");
+    __publicField$8(this, "authHandler");
+    __publicField$8(this, "resolverContext");
     this.implementation = this.setupStrategy(options);
     this.scope = options.scope;
     this.prompt = options.prompt;
@@ -2307,6 +2463,7 @@ class OidcAuthProvider {
       client_secret: options.clientSecret,
       redirect_uris: [options.callbackUrl],
       response_types: ["code"],
+      token_endpoint_auth_method: options.tokenEndpointAuthMethod || "client_secret_basic",
       id_token_signed_response_alg: options.tokenSignedResponseAlg || "RS256",
       scope: options.scope || ""
     });
@@ -2369,6 +2526,9 @@ const oidc = createAuthProviderIntegration({
       const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       const metadataUrl = envConfig.getString("metadataUrl");
+      const tokenEndpointAuthMethod = envConfig.getOptionalString(
+        "tokenEndpointAuthMethod"
+      );
       const tokenSignedResponseAlg = envConfig.getOptionalString(
         "tokenSignedResponseAlg"
       );
@@ -2385,6 +2545,7 @@ const oidc = createAuthProviderIntegration({
         clientId,
         clientSecret,
         callbackUrl,
+        tokenEndpointAuthMethod,
         tokenSignedResponseAlg,
         metadataUrl,
         scope,
@@ -2411,8 +2572,18 @@ const oidc = createAuthProviderIntegration({
   }
 });
 
+var __defProp$7 = Object.defineProperty;
+var __defNormalProp$7 = (obj, key, value) => key in obj ? __defProp$7(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$7 = (obj, key, value) => {
+  __defNormalProp$7(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class OktaAuthProvider {
   constructor(options) {
+    __publicField$7(this, "strategy");
+    __publicField$7(this, "signInResolver");
+    __publicField$7(this, "authHandler");
+    __publicField$7(this, "resolverContext");
     /**
      * Due to passport-okta-oauth forcing options.state = true,
      * passport-oauth2 requires express-session to be installed
@@ -2421,14 +2592,14 @@ class OktaAuthProvider {
      * passport-oauth2, which is the StateStore implementation used when options.state = false,
      * allowing us to avoid using express-session in order to integrate with Okta.
      */
-    this.store = {
+    __publicField$7(this, "store", {
       store(_req, cb) {
         cb(null, null);
       },
       verify(_req, _state, cb) {
         cb(null, true);
       }
-    };
+    });
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -2579,8 +2750,18 @@ const okta = createAuthProviderIntegration({
   }
 });
 
+var __defProp$6 = Object.defineProperty;
+var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$6 = (obj, key, value) => {
+  __defNormalProp$6(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class OneLoginProvider {
   constructor(options) {
+    __publicField$6(this, "_strategy");
+    __publicField$6(this, "signInResolver");
+    __publicField$6(this, "authHandler");
+    __publicField$6(this, "resolverContext");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -2694,8 +2875,19 @@ const onelogin = createAuthProviderIntegration({
   }
 });
 
+var __defProp$5 = Object.defineProperty;
+var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$5 = (obj, key, value) => {
+  __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class SamlAuthProvider {
   constructor(options) {
+    __publicField$5(this, "strategy");
+    __publicField$5(this, "signInResolver");
+    __publicField$5(this, "authHandler");
+    __publicField$5(this, "resolverContext");
+    __publicField$5(this, "appUrl");
     this.appUrl = options.appUrl;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
@@ -2794,8 +2986,19 @@ const saml = createAuthProviderIntegration({
   }
 });
 
+var __defProp$4 = Object.defineProperty;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$4 = (obj, key, value) => {
+  __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class BitbucketServerAuthProvider {
   constructor(options) {
+    __publicField$4(this, "signInResolver");
+    __publicField$4(this, "authHandler");
+    __publicField$4(this, "resolverContext");
+    __publicField$4(this, "strategy");
+    __publicField$4(this, "host");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -2960,10 +3163,19 @@ const bitbucketServer = createAuthProviderIntegration({
   }
 });
 
+var __defProp$3 = Object.defineProperty;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$3 = (obj, key, value) => {
+  __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const ID_TOKEN_HEADER = "x-ms-token-aad-id-token";
 const ACCESS_TOKEN_HEADER = "x-ms-token-aad-access-token";
 class EasyAuthAuthProvider {
   constructor(options) {
+    __publicField$3(this, "resolverContext");
+    __publicField$3(this, "authHandler");
+    __publicField$3(this, "signInResolver");
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
     this.resolverContext = options.resolverContext;
@@ -3128,9 +3340,22 @@ function createOidcRouter(options) {
   return router;
 }
 
+var __defProp$2 = Object.defineProperty;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$2 = (obj, key, value) => {
+  __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 const MS_IN_S = 1e3;
 class TokenFactory {
   constructor(options) {
+    __publicField$2(this, "issuer");
+    __publicField$2(this, "logger");
+    __publicField$2(this, "keyStore");
+    __publicField$2(this, "keyDurationSeconds");
+    __publicField$2(this, "algorithm");
+    __publicField$2(this, "keyExpiry");
+    __publicField$2(this, "privateKeyPromise");
     var _a;
     this.issuer = options.issuer;
     this.logger = options.logger;
@@ -3251,9 +3476,15 @@ class DatabaseKeyStore {
   }
 }
 
+var __defProp$1 = Object.defineProperty;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$1 = (obj, key, value) => {
+  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class MemoryKeyStore {
   constructor() {
-    this.keys = /* @__PURE__ */ new Map();
+    __publicField$1(this, "keys", /* @__PURE__ */ new Map());
   }
   async addKey(key) {
     this.keys.set(key.kid, {
@@ -3400,8 +3631,16 @@ class KeyStores {
   }
 }
 
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => {
+  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
 class CatalogIdentityClient {
   constructor(options) {
+    __publicField(this, "catalogApi");
+    __publicField(this, "tokenManager");
     this.catalogApi = options.catalogApi;
     this.tokenManager = options.tokenManager;
   }
@@ -3581,7 +3820,7 @@ const migrationsDir = backendCommon.resolvePackagePath(
   "@backstage/plugin-auth-backend",
   "migrations"
 );
-const _AuthDatabase = class {
+const _AuthDatabase = class _AuthDatabase {
   constructor(database) {
     __privateAdd(this, _database, void 0);
     __privateAdd(this, _promise, void 0);
@@ -3621,9 +3860,9 @@ const _AuthDatabase = class {
     return __privateGet(this, _promise);
   }
 };
-let AuthDatabase = _AuthDatabase;
 _database = new WeakMap();
 _promise = new WeakMap();
+let AuthDatabase = _AuthDatabase;
 
 async function createRouter(options) {
   const {