@backstage/plugin-auth-backend 0.19.3 → 0.20.0-next.0

package/dist/index.cjs.js

@@ -22,7 +22,7 @@ var pluginAuthBackendModuleGcpIapProvider = require('@backstage/plugin-auth-back
 var pluginAuthBackendModuleGithubProvider = require('@backstage/plugin-auth-backend-module-github-provider');
 var pluginAuthBackendModuleGitlabProvider = require('@backstage/plugin-auth-backend-module-gitlab-provider');
 var pluginAuthBackendModuleGoogleProvider = require('@backstage/plugin-auth-backend-module-google-provider');
-var pluginAuthBackendModuleMicrosoftProvider = require('@backstage/plugin-auth-backend-module-microsoft-provider');
+var passportMicrosoft = require('passport-microsoft');
 var pluginAuthBackendModuleOauth2Provider = require('@backstage/plugin-auth-backend-module-oauth2-provider');
 var openidClient = require('openid-client');
 var passportOktaOauth = require('@davidzemon/passport-okta-oauth');
@@ -34,6 +34,7 @@ var luxon = require('luxon');
 var uuid = require('uuid');
 var firestore = require('@google-cloud/firestore');
 var lodash = require('lodash');
+var fs = require('fs');
 var session = require('express-session');
 var connectSessionKnex = require('connect-session-knex');
 var passport = require('passport');
@@ -75,10 +76,10 @@ var session__default = /*#__PURE__*/_interopDefaultLegacy(session);
 var connectSessionKnex__default = /*#__PURE__*/_interopDefaultLegacy(connectSessionKnex);
 var passport__default = /*#__PURE__*/_interopDefaultLegacy(passport);
 
-var __defProp$g = Object.defineProperty;
-var __defNormalProp$g = (obj, key, value) => key in obj ? __defProp$g(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$g = (obj, key, value) => {
-  __defNormalProp$g(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$j = Object.defineProperty;
+var __defNormalProp$j = (obj, key, value) => key in obj ? __defProp$j(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$j = (obj, key, value) => {
+  __defNormalProp$j(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const defaultScopes = ["offline_access", "read:me"];
@@ -95,7 +96,7 @@ class AtlassianStrategy extends OAuth2Strategy__default["default"] {
       scope: Array.from(/* @__PURE__ */ new Set([...defaultScopes, ...scopes]))
     };
     super(optionsWithURLs, verify);
-    __publicField$g(this, "profileURL");
+    __publicField$j(this, "profileURL");
     this.profileURL = "https://api.atlassian.com/me";
     this.name = "atlassian";
     this._oauth2.useAuthorizationHeaderforGET(true);
@@ -210,10 +211,10 @@ const ensuresXRequestedWith = (req) => {
 
 const prepareBackstageIdentityResponse = pluginAuthNode.prepareBackstageIdentityResponse;
 
-var __defProp$f = Object.defineProperty;
-var __defNormalProp$f = (obj, key, value) => key in obj ? __defProp$f(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$f = (obj, key, value) => {
-  __defNormalProp$f(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$i = Object.defineProperty;
+var __defNormalProp$i = (obj, key, value) => key in obj ? __defProp$i(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$i = (obj, key, value) => {
+  __defNormalProp$i(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const THOUSAND_DAYS_MS = 1e3 * 24 * 60 * 60 * 1e3;
@@ -222,8 +223,8 @@ class OAuthAdapter {
   constructor(handlers, options) {
     this.handlers = handlers;
     this.options = options;
-    __publicField$f(this, "baseCookieOptions");
-    __publicField$f(this, "setNonceCookie", (res, nonce, cookieConfig) => {
+    __publicField$i(this, "baseCookieOptions");
+    __publicField$i(this, "setNonceCookie", (res, nonce, cookieConfig) => {
       res.cookie(`${this.options.providerId}-nonce`, nonce, {
         maxAge: TEN_MINUTES_MS,
         ...this.baseCookieOptions,
@@ -231,34 +232,34 @@ class OAuthAdapter {
         path: `${cookieConfig.path}/handler`
       });
     });
-    __publicField$f(this, "setGrantedScopeCookie", (res, scope, cookieConfig) => {
+    __publicField$i(this, "setGrantedScopeCookie", (res, scope, cookieConfig) => {
       res.cookie(`${this.options.providerId}-granted-scope`, scope, {
         maxAge: THOUSAND_DAYS_MS,
         ...this.baseCookieOptions,
         ...cookieConfig
       });
     });
-    __publicField$f(this, "getRefreshTokenFromCookie", (req) => {
+    __publicField$i(this, "getRefreshTokenFromCookie", (req) => {
       return req.cookies[`${this.options.providerId}-refresh-token`];
     });
-    __publicField$f(this, "getGrantedScopeFromCookie", (req) => {
+    __publicField$i(this, "getGrantedScopeFromCookie", (req) => {
       return req.cookies[`${this.options.providerId}-granted-scope`];
     });
-    __publicField$f(this, "setRefreshTokenCookie", (res, refreshToken, cookieConfig) => {
+    __publicField$i(this, "setRefreshTokenCookie", (res, refreshToken, cookieConfig) => {
       res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
         maxAge: THOUSAND_DAYS_MS,
         ...this.baseCookieOptions,
         ...cookieConfig
       });
     });
-    __publicField$f(this, "removeRefreshTokenCookie", (res, cookieConfig) => {
+    __publicField$i(this, "removeRefreshTokenCookie", (res, cookieConfig) => {
       res.cookie(`${this.options.providerId}-refresh-token`, "", {
         maxAge: 0,
         ...this.baseCookieOptions,
         ...cookieConfig
       });
     });
-    __publicField$f(this, "getCookieConfig", (origin) => {
+    __publicField$i(this, "getCookieConfig", (origin) => {
       return this.options.cookieConfigurer({
         providerId: this.options.providerId,
         baseUrl: this.options.baseUrl,
@@ -564,10 +565,10 @@ function createAuthProviderIntegration(config) {
   });
 }
 
-var __defProp$e = Object.defineProperty;
-var __defNormalProp$e = (obj, key, value) => key in obj ? __defProp$e(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$e = (obj, key, value) => {
-  __defNormalProp$e(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$h = Object.defineProperty;
+var __defNormalProp$h = (obj, key, value) => key in obj ? __defProp$h(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$h = (obj, key, value) => {
+  __defNormalProp$h(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const atlassianDefaultAuthHandler = async ({
@@ -578,10 +579,10 @@ const atlassianDefaultAuthHandler = async ({
 });
 class AtlassianAuthProvider {
   constructor(options) {
-    __publicField$e(this, "_strategy");
-    __publicField$e(this, "signInResolver");
-    __publicField$e(this, "authHandler");
-    __publicField$e(this, "resolverContext");
+    __publicField$h(this, "_strategy");
+    __publicField$h(this, "signInResolver");
+    __publicField$h(this, "authHandler");
+    __publicField$h(this, "resolverContext");
     this.resolverContext = options.resolverContext;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
@@ -699,21 +700,21 @@ class Auth0Strategy extends Auth0InternalStrategy__default["default"] {
   }
 }
 
-var __defProp$d = Object.defineProperty;
-var __defNormalProp$d = (obj, key, value) => key in obj ? __defProp$d(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$d = (obj, key, value) => {
-  __defNormalProp$d(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$g = Object.defineProperty;
+var __defNormalProp$g = (obj, key, value) => key in obj ? __defProp$g(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$g = (obj, key, value) => {
+  __defNormalProp$g(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class Auth0AuthProvider {
   constructor(options) {
-    __publicField$d(this, "_strategy");
-    __publicField$d(this, "signInResolver");
-    __publicField$d(this, "authHandler");
-    __publicField$d(this, "resolverContext");
-    __publicField$d(this, "audience");
-    __publicField$d(this, "connection");
-    __publicField$d(this, "connectionScope");
+    __publicField$g(this, "_strategy");
+    __publicField$g(this, "signInResolver");
+    __publicField$g(this, "authHandler");
+    __publicField$g(this, "resolverContext");
+    __publicField$g(this, "audience");
+    __publicField$g(this, "connection");
+    __publicField$g(this, "connectionScope");
     /**
      * Due to passport-auth0 forcing options.state = true,
      * passport-oauth2 requires express-session to be installed
@@ -722,7 +723,7 @@ class Auth0AuthProvider {
      * passport-oauth2, which is the StateStore implementation used when options.state = false,
      * allowing us to avoid using express-session in order to integrate with auth0.
      */
-    __publicField$d(this, "store", {
+    __publicField$g(this, "store", {
       store(_req, cb) {
         cb(null, null);
       },
@@ -863,23 +864,23 @@ const auth0 = createAuthProviderIntegration({
   }
 });
 
-var __defProp$c = Object.defineProperty;
-var __defNormalProp$c = (obj, key, value) => key in obj ? __defProp$c(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$c = (obj, key, value) => {
-  __defNormalProp$c(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$f = Object.defineProperty;
+var __defNormalProp$f = (obj, key, value) => key in obj ? __defProp$f(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$f = (obj, key, value) => {
+  __defNormalProp$f(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const ALB_JWT_HEADER = "x-amzn-oidc-data";
 const ALB_ACCESS_TOKEN_HEADER = "x-amzn-oidc-accesstoken";
 class AwsAlbAuthProvider {
   constructor(options) {
-    __publicField$c(this, "region");
-    __publicField$c(this, "issuer");
-    __publicField$c(this, "resolverContext");
-    __publicField$c(this, "keyCache");
-    __publicField$c(this, "authHandler");
-    __publicField$c(this, "signInResolver");
-    __publicField$c(this, "getKey", async (header) => {
+    __publicField$f(this, "region");
+    __publicField$f(this, "issuer");
+    __publicField$f(this, "resolverContext");
+    __publicField$f(this, "keyCache");
+    __publicField$f(this, "authHandler");
+    __publicField$f(this, "signInResolver");
+    __publicField$f(this, "getKey", async (header) => {
       if (!header.kid) {
         throw new errors.AuthenticationError("No key id was specified in header");
       }
@@ -1007,18 +1008,18 @@ const awsAlb = createAuthProviderIntegration({
   }
 });
 
-var __defProp$b = Object.defineProperty;
-var __defNormalProp$b = (obj, key, value) => key in obj ? __defProp$b(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$b = (obj, key, value) => {
-  __defNormalProp$b(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$e = Object.defineProperty;
+var __defNormalProp$e = (obj, key, value) => key in obj ? __defProp$e(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$e = (obj, key, value) => {
+  __defNormalProp$e(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class BitbucketAuthProvider {
   constructor(options) {
-    __publicField$b(this, "_strategy");
-    __publicField$b(this, "signInResolver");
-    __publicField$b(this, "authHandler");
-    __publicField$b(this, "resolverContext");
+    __publicField$e(this, "_strategy");
+    __publicField$e(this, "signInResolver");
+    __publicField$e(this, "authHandler");
+    __publicField$e(this, "resolverContext");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -1186,10 +1187,10 @@ const commonByEmailResolver = async (info, ctx) => {
   });
 };
 
-var __defProp$a = Object.defineProperty;
-var __defNormalProp$a = (obj, key, value) => key in obj ? __defProp$a(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$a = (obj, key, value) => {
-  __defNormalProp$a(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$d = Object.defineProperty;
+var __defNormalProp$d = (obj, key, value) => key in obj ? __defProp$d(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$d = (obj, key, value) => {
+  __defNormalProp$d(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const CF_JWT_HEADER = "cf-access-jwt-assertion";
@@ -1197,12 +1198,12 @@ const COOKIE_AUTH_NAME = "CF_Authorization";
 const CACHE_PREFIX = "providers/cloudflare-access/profile-v1";
 class CloudflareAccessAuthProvider {
   constructor(options) {
-    __publicField$a(this, "teamName");
-    __publicField$a(this, "resolverContext");
-    __publicField$a(this, "authHandler");
-    __publicField$a(this, "signInResolver");
-    __publicField$a(this, "jwtKeySet");
-    __publicField$a(this, "cache");
+    __publicField$d(this, "teamName");
+    __publicField$d(this, "resolverContext");
+    __publicField$d(this, "authHandler");
+    __publicField$d(this, "signInResolver");
+    __publicField$d(this, "jwtKeySet");
+    __publicField$d(this, "cache");
     this.teamName = options.teamName;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
@@ -1496,20 +1497,184 @@ const google = createAuthProviderIntegration({
   })
 });
 
+const BACKSTAGE_SESSION_EXPIRATION = 3600;
+
+var __defProp$c = Object.defineProperty;
+var __defNormalProp$c = (obj, key, value) => key in obj ? __defProp$c(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$c = (obj, key, value) => {
+  __defNormalProp$c(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
+class MicrosoftAuthProvider {
+  constructor(options) {
+    __publicField$c(this, "_strategy");
+    __publicField$c(this, "signInResolver");
+    __publicField$c(this, "authHandler");
+    __publicField$c(this, "logger");
+    __publicField$c(this, "resolverContext");
+    __publicField$c(this, "skipUserProfile", (accessToken) => {
+      const { aud, scp } = jose.decodeJwt(accessToken);
+      const hasGraphReadScope = aud === "00000003-0000-0000-c000-000000000000" && scp.split(" ").map((s) => s.toLowerCase()).includes("user.read");
+      return !hasGraphReadScope;
+    });
+    this.signInResolver = options.signInResolver;
+    this.authHandler = options.authHandler;
+    this.logger = options.logger;
+    this.resolverContext = options.resolverContext;
+    this._strategy = new passportMicrosoft.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        authorizationURL: options.authorizationUrl,
+        tokenURL: options.tokenUrl,
+        passReqToCallback: false,
+        skipUserProfile: (accessToken, done) => {
+          done(null, this.skipUserProfile(accessToken));
+        }
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, { fullProfile, accessToken, params }, { refreshToken });
+      }
+    );
+  }
+  async start(req) {
+    return await executeRedirectStrategy(req, this._strategy, {
+      scope: req.scope,
+      state: encodeState(req.state)
+    });
+  }
+  async handler(req) {
+    const { result, privateInfo } = await executeFrameHandlerStrategy(req, this._strategy);
+    return {
+      response: await this.handleResult(result),
+      refreshToken: privateInfo.refreshToken
+    };
+  }
+  async refresh(req) {
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    return {
+      response: await this.handleResult({
+        params,
+        accessToken,
+        ...!this.skipUserProfile(accessToken) && {
+          fullProfile: await executeFetchUserProfileStrategy(
+            this._strategy,
+            accessToken
+          )
+        }
+      }),
+      refreshToken
+    };
+  }
+  async handleResult(result) {
+    let profile = {};
+    if (result.fullProfile) {
+      const photo = await this.getUserPhoto(result.accessToken);
+      result.fullProfile.photos = photo ? [{ value: photo }] : void 0;
+      ({ profile } = await this.authHandler(
+        result,
+        this.resolverContext
+      ));
+    }
+    const expiresInSeconds = result.params.expires_in === void 0 ? BACKSTAGE_SESSION_EXPIRATION : Math.min(result.params.expires_in, BACKSTAGE_SESSION_EXPIRATION);
+    return {
+      providerInfo: {
+        accessToken: result.accessToken,
+        scope: result.params.scope,
+        expiresInSeconds,
+        ...{ idToken: result.params.id_token }
+      },
+      profile,
+      ...result.fullProfile && this.signInResolver && {
+        backstageIdentity: await this.signInResolver(
+          { result, profile },
+          this.resolverContext
+        )
+      }
+    };
+  }
+  async getUserPhoto(accessToken) {
+    try {
+      const res = await fetch__default["default"](
+        "https://graph.microsoft.com/v1.0/me/photos/48x48/$value",
+        {
+          headers: {
+            Authorization: `Bearer ${accessToken}`
+          }
+        }
+      );
+      const data = await res.buffer();
+      return `data:image/jpeg;base64,${data.toString("base64")}`;
+    } catch (error) {
+      this.logger.warn(
+        `Could not retrieve user profile photo from Microsoft Graph API: ${error}`
+      );
+      return void 0;
+    }
+  }
+}
 const microsoft = createAuthProviderIntegration({
   create(options) {
-    var _a;
-    return pluginAuthNode.createOAuthProviderFactory({
-      authenticator: pluginAuthBackendModuleMicrosoftProvider.microsoftAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+    return ({ providerId, globalConfig, config, logger, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
+      var _a;
+      const clientId = envConfig.getString("clientId");
+      const clientSecret = envConfig.getString("clientSecret");
+      const tenantId = envConfig.getString("tenantId");
+      const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+      const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+      const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
+      const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
+      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
+        profile: makeProfileInfo(fullProfile != null ? fullProfile : {}, params.id_token)
+      });
+      const provider = new MicrosoftAuthProvider({
+        clientId,
+        clientSecret,
+        callbackUrl,
+        authorizationUrl,
+        tokenUrl,
+        authHandler,
+        signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver,
+        logger,
+        resolverContext
+      });
+      return OAuthAdapter.fromConfig(globalConfig, provider, {
+        providerId,
+        callbackUrl
+      });
     });
   },
-  resolvers: adaptOAuthSignInResolverToLegacy({
-    emailLocalPartMatchingUserEntityName: pluginAuthNode.commonSignInResolvers.emailLocalPartMatchingUserEntityName(),
-    emailMatchingUserEntityProfileEmail: pluginAuthNode.commonSignInResolvers.emailMatchingUserEntityProfileEmail(),
-    emailMatchingUserEntityAnnotation: pluginAuthBackendModuleMicrosoftProvider.microsoftSignInResolvers.emailMatchingUserEntityAnnotation()
-  })
+  resolvers: {
+    /**
+     * Looks up the user by matching their email local part to the entity name.
+     */
+    emailLocalPartMatchingUserEntityName: () => commonByEmailLocalPartResolver,
+    /**
+     * Looks up the user by matching their email to the entity email.
+     */
+    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver,
+    /**
+     * Looks up the user by matching their email to the `microsoft.com/email` annotation.
+     */
+    emailMatchingUserEntityAnnotation() {
+      return async (info, ctx) => {
+        const { profile } = info;
+        if (!profile.email) {
+          throw new Error("Microsoft profile contained no email");
+        }
+        return ctx.signInWithCatalogUser({
+          annotations: {
+            "microsoft.com/email": profile.email
+          }
+        });
+      };
+    }
+  }
 });
 
 const oauth2 = createAuthProviderIntegration({
@@ -1523,18 +1688,18 @@ const oauth2 = createAuthProviderIntegration({
   }
 });
 
-var __defProp$9 = Object.defineProperty;
-var __defNormalProp$9 = (obj, key, value) => key in obj ? __defProp$9(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$9 = (obj, key, value) => {
-  __defNormalProp$9(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$b = Object.defineProperty;
+var __defNormalProp$b = (obj, key, value) => key in obj ? __defProp$b(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$b = (obj, key, value) => {
+  __defNormalProp$b(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const OAUTH2_PROXY_JWT_HEADER = "X-OAUTH2-PROXY-ID-TOKEN";
 class Oauth2ProxyAuthProvider {
   constructor(options) {
-    __publicField$9(this, "resolverContext");
-    __publicField$9(this, "signInResolver");
-    __publicField$9(this, "authHandler");
+    __publicField$b(this, "resolverContext");
+    __publicField$b(this, "signInResolver");
+    __publicField$b(this, "authHandler");
     this.resolverContext = options.resolverContext;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
@@ -1609,22 +1774,20 @@ const oauth2Proxy = createAuthProviderIntegration({
   }
 });
 
-const BACKSTAGE_SESSION_EXPIRATION = 3600;
-
-var __defProp$8 = Object.defineProperty;
-var __defNormalProp$8 = (obj, key, value) => key in obj ? __defProp$8(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$8 = (obj, key, value) => {
-  __defNormalProp$8(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$a = Object.defineProperty;
+var __defNormalProp$a = (obj, key, value) => key in obj ? __defProp$a(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$a = (obj, key, value) => {
+  __defNormalProp$a(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class OidcAuthProvider {
   constructor(options) {
-    __publicField$8(this, "implementation");
-    __publicField$8(this, "scope");
-    __publicField$8(this, "prompt");
-    __publicField$8(this, "signInResolver");
-    __publicField$8(this, "authHandler");
-    __publicField$8(this, "resolverContext");
+    __publicField$a(this, "implementation");
+    __publicField$a(this, "scope");
+    __publicField$a(this, "prompt");
+    __publicField$a(this, "signInResolver");
+    __publicField$a(this, "authHandler");
+    __publicField$a(this, "resolverContext");
     this.implementation = this.setupStrategy(options);
     this.scope = options.scope;
     this.prompt = options.prompt;
@@ -1785,18 +1948,18 @@ const oidc = createAuthProviderIntegration({
   }
 });
 
-var __defProp$7 = Object.defineProperty;
-var __defNormalProp$7 = (obj, key, value) => key in obj ? __defProp$7(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$7 = (obj, key, value) => {
-  __defNormalProp$7(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$9 = Object.defineProperty;
+var __defNormalProp$9 = (obj, key, value) => key in obj ? __defProp$9(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$9 = (obj, key, value) => {
+  __defNormalProp$9(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class OktaAuthProvider {
   constructor(options) {
-    __publicField$7(this, "strategy");
-    __publicField$7(this, "signInResolver");
-    __publicField$7(this, "authHandler");
-    __publicField$7(this, "resolverContext");
+    __publicField$9(this, "strategy");
+    __publicField$9(this, "signInResolver");
+    __publicField$9(this, "authHandler");
+    __publicField$9(this, "resolverContext");
     /**
      * Due to passport-okta-oauth forcing options.state = true,
      * passport-oauth2 requires express-session to be installed
@@ -1805,7 +1968,7 @@ class OktaAuthProvider {
      * passport-oauth2, which is the StateStore implementation used when options.state = false,
      * allowing us to avoid using express-session in order to integrate with Okta.
      */
-    __publicField$7(this, "store", {
+    __publicField$9(this, "store", {
       store(_req, cb) {
         cb(null, null);
       },
@@ -1963,18 +2126,18 @@ const okta = createAuthProviderIntegration({
   }
 });
 
-var __defProp$6 = Object.defineProperty;
-var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$6 = (obj, key, value) => {
-  __defNormalProp$6(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$8 = Object.defineProperty;
+var __defNormalProp$8 = (obj, key, value) => key in obj ? __defProp$8(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$8 = (obj, key, value) => {
+  __defNormalProp$8(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class OneLoginProvider {
   constructor(options) {
-    __publicField$6(this, "_strategy");
-    __publicField$6(this, "signInResolver");
-    __publicField$6(this, "authHandler");
-    __publicField$6(this, "resolverContext");
+    __publicField$8(this, "_strategy");
+    __publicField$8(this, "signInResolver");
+    __publicField$8(this, "authHandler");
+    __publicField$8(this, "resolverContext");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -2088,19 +2251,19 @@ const onelogin = createAuthProviderIntegration({
   }
 });
 
-var __defProp$5 = Object.defineProperty;
-var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$5 = (obj, key, value) => {
-  __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$7 = Object.defineProperty;
+var __defNormalProp$7 = (obj, key, value) => key in obj ? __defProp$7(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$7 = (obj, key, value) => {
+  __defNormalProp$7(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class SamlAuthProvider {
   constructor(options) {
-    __publicField$5(this, "strategy");
-    __publicField$5(this, "signInResolver");
-    __publicField$5(this, "authHandler");
-    __publicField$5(this, "resolverContext");
-    __publicField$5(this, "appUrl");
+    __publicField$7(this, "strategy");
+    __publicField$7(this, "signInResolver");
+    __publicField$7(this, "authHandler");
+    __publicField$7(this, "resolverContext");
+    __publicField$7(this, "appUrl");
     this.appUrl = options.appUrl;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
@@ -2199,19 +2362,19 @@ const saml = createAuthProviderIntegration({
   }
 });
 
-var __defProp$4 = Object.defineProperty;
-var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$4 = (obj, key, value) => {
-  __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$6 = Object.defineProperty;
+var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$6 = (obj, key, value) => {
+  __defNormalProp$6(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class BitbucketServerAuthProvider {
   constructor(options) {
-    __publicField$4(this, "signInResolver");
-    __publicField$4(this, "authHandler");
-    __publicField$4(this, "resolverContext");
-    __publicField$4(this, "strategy");
-    __publicField$4(this, "host");
+    __publicField$6(this, "signInResolver");
+    __publicField$6(this, "authHandler");
+    __publicField$6(this, "resolverContext");
+    __publicField$6(this, "strategy");
+    __publicField$6(this, "host");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -2376,19 +2539,19 @@ const bitbucketServer = createAuthProviderIntegration({
   }
 });
 
-var __defProp$3 = Object.defineProperty;
-var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$3 = (obj, key, value) => {
-  __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$5 = Object.defineProperty;
+var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$5 = (obj, key, value) => {
+  __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 const ID_TOKEN_HEADER = "x-ms-token-aad-id-token";
 const ACCESS_TOKEN_HEADER = "x-ms-token-aad-access-token";
 class EasyAuthAuthProvider {
   constructor(options) {
-    __publicField$3(this, "resolverContext");
-    __publicField$3(this, "authHandler");
-    __publicField$3(this, "signInResolver");
+    __publicField$5(this, "resolverContext");
+    __publicField$5(this, "authHandler");
+    __publicField$5(this, "signInResolver");
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
     this.resolverContext = options.resolverContext;
@@ -2553,22 +2716,22 @@ function createOidcRouter(options) {
   return router;
 }
 
-var __defProp$2 = Object.defineProperty;
-var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$2 = (obj, key, value) => {
-  __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$4 = Object.defineProperty;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$4 = (obj, key, value) => {
+  __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
-const MS_IN_S = 1e3;
+const MS_IN_S$1 = 1e3;
 class TokenFactory {
   constructor(options) {
-    __publicField$2(this, "issuer");
-    __publicField$2(this, "logger");
-    __publicField$2(this, "keyStore");
-    __publicField$2(this, "keyDurationSeconds");
-    __publicField$2(this, "algorithm");
-    __publicField$2(this, "keyExpiry");
-    __publicField$2(this, "privateKeyPromise");
+    __publicField$4(this, "issuer");
+    __publicField$4(this, "logger");
+    __publicField$4(this, "keyStore");
+    __publicField$4(this, "keyDurationSeconds");
+    __publicField$4(this, "algorithm");
+    __publicField$4(this, "keyExpiry");
+    __publicField$4(this, "privateKeyPromise");
     var _a;
     this.issuer = options.issuer;
     this.logger = options.logger;
@@ -2581,7 +2744,7 @@ class TokenFactory {
     const iss = this.issuer;
     const { sub, ent, ...additionalClaims } = params.claims;
     const aud = "backstage";
-    const iat = Math.floor(Date.now() / MS_IN_S);
+    const iat = Math.floor(Date.now() / MS_IN_S$1);
     const exp = iat + this.keyDurationSeconds;
     try {
       catalogModel.parseEntityRef(sub);
@@ -2689,15 +2852,15 @@ class DatabaseKeyStore {
   }
 }
 
-var __defProp$1 = Object.defineProperty;
-var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$1 = (obj, key, value) => {
-  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$3 = Object.defineProperty;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$3 = (obj, key, value) => {
+  __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class MemoryKeyStore {
   constructor() {
-    __publicField$1(this, "keys", /* @__PURE__ */ new Map());
+    __publicField$3(this, "keys", /* @__PURE__ */ new Map());
   }
   async addKey(key) {
     this.keys.set(key.kid, {
@@ -2802,6 +2965,97 @@ class FirestoreKeyStore {
   }
 }
 
+var __defProp$2 = Object.defineProperty;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$2 = (obj, key, value) => {
+  __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
+const DEFAULT_ALGORITHM = "ES256";
+class StaticKeyStore {
+  constructor(keyPairs) {
+    __publicField$2(this, "keyPairs");
+    __publicField$2(this, "createdAt");
+    if (keyPairs.length === 0) {
+      throw new Error("Should provide at least one key pair");
+    }
+    this.keyPairs = keyPairs;
+    this.createdAt = /* @__PURE__ */ new Date();
+  }
+  static async fromConfig(config) {
+    const keyConfigs = config.getConfigArray("auth.keyStore.static.keys").map((c) => {
+      var _a;
+      const staticKeyConfig = {
+        publicKeyFile: c.getString("publicKeyFile"),
+        privateKeyFile: c.getString("privateKeyFile"),
+        keyId: c.getString("keyId"),
+        algorithm: (_a = c.getOptionalString("algorithm")) != null ? _a : DEFAULT_ALGORITHM
+      };
+      return staticKeyConfig;
+    });
+    const keyPairs = await Promise.all(
+      keyConfigs.map(async (k) => await this.loadKeyPair(k))
+    );
+    return new StaticKeyStore(keyPairs);
+  }
+  addKey(_key) {
+    throw new Error("Cannot add keys to the static key store");
+  }
+  listKeys() {
+    const keys = this.keyPairs.map((k) => this.keyPairToStoredKey(k));
+    return Promise.resolve({ items: keys });
+  }
+  getPrivateKey(keyId) {
+    const keyPair = this.keyPairs.find((k) => k.publicKey.kid === keyId);
+    if (keyPair === void 0) {
+      throw new Error(`Could not find key with keyId: ${keyId}`);
+    }
+    return keyPair.privateKey;
+  }
+  removeKeys(_kids) {
+    throw new Error("Cannot remove keys from the static key store");
+  }
+  keyPairToStoredKey(keyPair) {
+    const publicKey = {
+      ...keyPair.publicKey,
+      use: "sig"
+    };
+    return {
+      key: publicKey,
+      createdAt: this.createdAt
+    };
+  }
+  static async loadKeyPair(options) {
+    const algorithm = options.algorithm;
+    const keyId = options.keyId;
+    const publicKey = await this.loadPublicKeyFromFile(
+      options.publicKeyFile,
+      keyId,
+      algorithm
+    );
+    const privateKey = await this.loadPrivateKeyFromFile(
+      options.privateKeyFile,
+      keyId,
+      algorithm
+    );
+    return { publicKey, privateKey };
+  }
+  static async loadPublicKeyFromFile(path, keyId, algorithm) {
+    return this.loadKeyFromFile(path, keyId, algorithm, jose.importSPKI);
+  }
+  static async loadPrivateKeyFromFile(path, keyId, algorithm) {
+    return this.loadKeyFromFile(path, keyId, algorithm, jose.importPKCS8);
+  }
+  static async loadKeyFromFile(path, keyId, algorithm, importer) {
+    const content = await fs.promises.readFile(path, { encoding: "utf8", flag: "r" });
+    const key = await importer(content, algorithm);
+    const jwk = await jose.exportJWK(key);
+    jwk.kid = keyId;
+    jwk.alg = algorithm;
+    return jwk;
+  }
+}
+
 class KeyStores {
   /**
    * Looks at the `auth.keyStore` section in the application configuration
@@ -2840,20 +3094,23 @@ class KeyStores {
       await FirestoreKeyStore.verifyConnection(keyStore, logger);
       return keyStore;
     }
+    if (provider === "static") {
+      await StaticKeyStore.fromConfig(config);
+    }
     throw new Error(`Unknown KeyStore provider: ${provider}`);
   }
 }
 
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => {
-  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$1 = Object.defineProperty;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$1 = (obj, key, value) => {
+  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class CatalogIdentityClient {
   constructor(options) {
-    __publicField(this, "catalogApi");
-    __publicField(this, "tokenManager");
+    __publicField$1(this, "catalogApi");
+    __publicField$1(this, "tokenManager");
     this.catalogApi = options.catalogApi;
     this.tokenManager = options.tokenManager;
   }
@@ -3077,6 +3334,57 @@ _database = new WeakMap();
 _promise = new WeakMap();
 let AuthDatabase = _AuthDatabase;
 
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => {
+  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
+const MS_IN_S = 1e3;
+class StaticTokenIssuer {
+  constructor(options, keyStore) {
+    __publicField(this, "issuer");
+    __publicField(this, "logger");
+    __publicField(this, "keyStore");
+    __publicField(this, "sessionExpirationSeconds");
+    this.issuer = options.issuer;
+    this.logger = options.logger;
+    this.sessionExpirationSeconds = options.sessionExpirationSeconds;
+    this.keyStore = keyStore;
+  }
+  async issueToken(params) {
+    const key = await this.getSigningKey();
+    const iss = this.issuer;
+    const { sub, ent, ...additionalClaims } = params.claims;
+    const aud = "backstage";
+    const iat = Math.floor(Date.now() / MS_IN_S);
+    const exp = iat + this.sessionExpirationSeconds;
+    try {
+      catalogModel.parseEntityRef(sub);
+    } catch (error) {
+      throw new Error(
+        '"sub" claim provided by the auth resolver is not a valid EntityRef.'
+      );
+    }
+    this.logger.info(`Issuing token for ${sub}, with entities ${ent != null ? ent : []}`);
+    if (!key.alg) {
+      throw new errors.AuthenticationError("No algorithm was provided in the key");
+    }
+    return new jose.SignJWT({ ...additionalClaims, iss, sub, ent, aud, iat, exp }).setProtectedHeader({ alg: key.alg, kid: key.kid }).setIssuer(iss).setAudience(aud).setSubject(sub).setIssuedAt(iat).setExpirationTime(exp).sign(await jose.importJWK(key));
+  }
+  async getSigningKey() {
+    const { items: keys } = await this.keyStore.listKeys();
+    if (keys.length >= 1) {
+      return this.keyStore.getPrivateKey(keys[0].key.kid);
+    }
+    throw new Error("Keystore should hold at least 1 key");
+  }
+  async listPublicKeys() {
+    const { items: keys } = await this.keyStore.listKeys();
+    return { keys: keys.map(({ key }) => key) };
+  }
+}
+
 async function createRouter(options) {
   const {
     logger,
@@ -3092,18 +3400,30 @@ async function createRouter(options) {
   const appUrl = config.getString("app.baseUrl");
   const authUrl = await discovery.getExternalBaseUrl("auth");
   const authDb = AuthDatabase.create(database);
+  const sessionExpirationSeconds = BACKSTAGE_SESSION_EXPIRATION;
   const keyStore = await KeyStores.fromConfig(config, {
     logger,
     database: authDb
   });
-  const keyDurationSeconds = BACKSTAGE_SESSION_EXPIRATION;
-  const tokenIssuer = new TokenFactory({
-    issuer: authUrl,
-    keyStore,
-    keyDurationSeconds,
-    logger: logger.child({ component: "token-factory" }),
-    algorithm: tokenFactoryAlgorithm != null ? tokenFactoryAlgorithm : config.getOptionalString("auth.identityTokenAlgorithm")
-  });
+  let tokenIssuer;
+  if (keyStore instanceof StaticKeyStore) {
+    tokenIssuer = new StaticTokenIssuer(
+      {
+        logger: logger.child({ component: "token-factory" }),
+        issuer: authUrl,
+        sessionExpirationSeconds
+      },
+      keyStore
+    );
+  } else {
+    tokenIssuer = new TokenFactory({
+      issuer: authUrl,
+      keyStore,
+      keyDurationSeconds: sessionExpirationSeconds,
+      logger: logger.child({ component: "token-factory" }),
+      algorithm: tokenFactoryAlgorithm != null ? tokenFactoryAlgorithm : config.getOptionalString("auth.identityTokenAlgorithm")
+    });
+  }
   const secret = config.getOptionalString("auth.session.secret");
   if (secret) {
     router.use(cookieParser__default["default"](secret));