@backstage/plugin-auth-backend 0.22.0-next.2 → 0.22.1

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # @backstage/plugin-auth-backend
 
+## 0.22.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-catalog-node@1.9.0
+  - @backstage/plugin-auth-backend-module-atlassian-provider@0.1.6
+  - @backstage/plugin-auth-backend-module-aws-alb-provider@0.1.6
+  - @backstage/plugin-auth-backend-module-github-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-gitlab-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-google-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-microsoft-provider@0.1.9
+  - @backstage/plugin-auth-backend-module-oauth2-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-oidc-provider@0.1.5
+  - @backstage/plugin-auth-backend-module-okta-provider@0.0.7
+
+## 0.22.0
+
+### Minor Changes
+
+- 293c835: Add support for Service Tokens to Cloudflare Access auth provider
+- 492fe83: **BREAKING**: The `CatalogIdentityClient` constructor now also requires the `discovery` service to be forwarded from the plugin environment. This is part of the migration to support the new auth services, which has also been done for the `createRouter` function.
+
+### Patch Changes
+
+- 999224f: Bump dependency `minimatch` to v9
+- 7c29e7f: Fixed refresh scope to match start method in OneLogin provider.
+- 2af5354: Bump dependency `jose` to v5
+- 38af71a: Updated dependency `google-auth-library` to `^9.0.0`.
+- 0fb419b: Updated dependency `uuid` to `^9.0.0`.
+  Updated dependency `@types/uuid` to `^9.0.0`.
+- fa7ea3f: Internal refactor to break out how the router is constructed
+- Updated dependencies
+  - @backstage/backend-common@0.21.4
+  - @backstage/plugin-auth-node@0.4.9
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/backend-plugin-api@0.6.14
+  - @backstage/plugin-auth-backend-module-oidc-provider@0.1.4
+  - @backstage/plugin-auth-backend-module-oauth2-proxy-provider@0.1.7
+  - @backstage/plugin-auth-backend-module-microsoft-provider@0.1.9
+  - @backstage/plugin-auth-backend-module-aws-alb-provider@0.1.5
+  - @backstage/plugin-catalog-node@1.8.0
+  - @backstage/catalog-client@1.6.1
+  - @backstage/plugin-auth-backend-module-gcp-iap-provider@0.2.9
+  - @backstage/plugin-auth-backend-module-google-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-atlassian-provider@0.1.6
+  - @backstage/plugin-auth-backend-module-github-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-gitlab-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-oauth2-provider@0.1.11
+  - @backstage/plugin-auth-backend-module-okta-provider@0.0.7
+  - @backstage/catalog-model@1.4.5
+  - @backstage/types@1.1.1
+
 ## 0.22.0-next.2
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -44,25 +44,17 @@ var passport = require('passport');
 var config = require('@backstage/config');
 var types = require('@backstage/types');
 
-function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
-var express__default = /*#__PURE__*/_interopDefaultLegacy(express);
-var Router__default = /*#__PURE__*/_interopDefaultLegacy(Router);
-var cookieParser__default = /*#__PURE__*/_interopDefaultLegacy(cookieParser);
-var Auth0InternalStrategy__default = /*#__PURE__*/_interopDefaultLegacy(Auth0InternalStrategy);
-var crypto__default = /*#__PURE__*/_interopDefaultLegacy(crypto);
-var fetch__default = /*#__PURE__*/_interopDefaultLegacy(fetch);
-var session__default = /*#__PURE__*/_interopDefaultLegacy(session);
-var connectSessionKnex__default = /*#__PURE__*/_interopDefaultLegacy(connectSessionKnex);
-var passport__default = /*#__PURE__*/_interopDefaultLegacy(passport);
-
-function createAuthProviderIntegration(config) {
-  var _a;
-  return Object.freeze({
-    ...config,
-    resolvers: Object.freeze((_a = config.resolvers) != null ? _a : {})
-  });
-}
+var express__default = /*#__PURE__*/_interopDefaultCompat(express);
+var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
+var cookieParser__default = /*#__PURE__*/_interopDefaultCompat(cookieParser);
+var Auth0InternalStrategy__default = /*#__PURE__*/_interopDefaultCompat(Auth0InternalStrategy);
+var crypto__default = /*#__PURE__*/_interopDefaultCompat(crypto);
+var fetch__default = /*#__PURE__*/_interopDefaultCompat(fetch);
+var session__default = /*#__PURE__*/_interopDefaultCompat(session);
+var connectSessionKnex__default = /*#__PURE__*/_interopDefaultCompat(connectSessionKnex);
+var passport__default = /*#__PURE__*/_interopDefaultCompat(passport);
 
 function adaptLegacyOAuthHandler(authHandler) {
   return authHandler && (async (result, ctx) => authHandler(
@@ -128,6 +120,14 @@ function adaptOAuthSignInResolverToLegacy(resolvers) {
   return legacyResolvers;
 }
 
+function createAuthProviderIntegration(config) {
+  var _a;
+  return Object.freeze({
+    ...config,
+    resolvers: Object.freeze((_a = config.resolvers) != null ? _a : {})
+  });
+}
+
 const atlassian = createAuthProviderIntegration({
   create(options) {
     var _a;
@@ -139,7 +139,7 @@ const atlassian = createAuthProviderIntegration({
   }
 });
 
-class Auth0Strategy extends Auth0InternalStrategy__default["default"] {
+class Auth0Strategy extends Auth0InternalStrategy__default.default {
   constructor(options, verify) {
     const optionsWithURLs = {
       ...options,
@@ -203,7 +203,7 @@ const postMessageResponse = (res, appOrigin, response) => {
       window.close();
     }, 100); // same as the interval of the core-app-api lib/loginPopup.ts (to address race conditions)
   `;
-  const hash = crypto__default["default"].createHash("sha256").update(script).digest("base64");
+  const hash = crypto__default.default.createHash("sha256").update(script).digest("base64");
   res.setHeader("Content-Type", "text/html");
   res.setHeader("X-Frame-Options", "sameorigin");
   res.setHeader("Content-Security-Policy", `script-src 'sha256-${hash}'`);
@@ -304,7 +304,7 @@ class OAuthAdapter {
       throw new errors.InputError("No env provided in request query parameters");
     }
     const cookieConfig = this.getCookieConfig(origin);
-    const nonce = crypto__default["default"].randomBytes(16).toString("base64");
+    const nonce = crypto__default.default.randomBytes(16).toString("base64");
     this.setNonceCookie(res, nonce, cookieConfig);
     const state = { nonce, env, origin, redirectUrl, flow };
     if (this.options.persistScopes) {
@@ -965,7 +965,7 @@ class CloudflareAccessAuthProvider {
     headers.set(CF_JWT_HEADER, jwt);
     headers.set("cookie", `${COOKIE_AUTH_NAME}=${jwt}`);
     try {
-      const res = await fetch__default["default"](
+      const res = await fetch__default.default(
         `https://${this.teamName}.cloudflareaccess.com/cdn-cgi/access/get-identity`,
         { headers }
       );
@@ -1360,7 +1360,7 @@ class OneLoginProvider {
     const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
       this._strategy,
       req.refreshToken,
-      req.scope
+      "openid"
     );
     const fullProfile = await executeFetchUserProfileStrategy(
       this._strategy,
@@ -1630,7 +1630,7 @@ class BitbucketServerAuthProvider {
   async fetchProfile(result) {
     let whoAmIResponse;
     try {
-      whoAmIResponse = await fetch__default["default"](
+      whoAmIResponse = await fetch__default.default(
         `https://${this.host}/plugins/servlet/applinks/whoami`,
         {
           headers: {
@@ -1647,7 +1647,7 @@ class BitbucketServerAuthProvider {
     }
     let userResponse;
     try {
-      userResponse = await fetch__default["default"](
+      userResponse = await fetch__default.default(
         `https://${this.host}/rest/api/latest/users/${username}?avatarSize=256`,
         {
           headers: {
@@ -2091,7 +2091,7 @@ function bindProviderRouters(targetRouter, options) {
             httpAuth
           })
         });
-        const r = Router__default["default"]();
+        const r = Router__default.default();
         r.get("/start", provider.start.bind(provider));
         r.get("/handler/frame", provider.frameHandler.bind(provider));
         r.post("/handler/frame", provider.frameHandler.bind(provider));
@@ -2146,7 +2146,7 @@ function createOriginFilter(config) {
 
 function bindOidcRouter(targetRouter, options) {
   const { baseUrl, tokenIssuer } = options;
-  const router = Router__default["default"]();
+  const router = Router__default.default();
   targetRouter.use(router);
   const config = {
     issuer: baseUrl,
@@ -2730,7 +2730,7 @@ async function createRouter(options) {
     providerFactories = {}
   } = options;
   const { auth, httpAuth } = backendCommon.createLegacyAuthAdapters(options);
-  const router = Router__default["default"]();
+  const router = Router__default.default();
   const appUrl = config.getString("app.baseUrl");
   const authUrl = await discovery.getExternalBaseUrl("auth");
   const backstageTokenExpiration = readBackstageTokenExpiration(config);
@@ -2760,11 +2760,11 @@ async function createRouter(options) {
   }
   const secret = config.getOptionalString("auth.session.secret");
   if (secret) {
-    router.use(cookieParser__default["default"](secret));
+    router.use(cookieParser__default.default(secret));
     const enforceCookieSSL = authUrl.startsWith("https");
-    const KnexSessionStore = connectSessionKnex__default["default"](session__default["default"]);
+    const KnexSessionStore = connectSessionKnex__default.default(session__default.default);
     router.use(
-      session__default["default"]({
+      session__default.default({
         secret,
         saveUninitialized: false,
         resave: false,
@@ -2775,13 +2775,13 @@ async function createRouter(options) {
         })
       })
     );
-    router.use(passport__default["default"].initialize());
-    router.use(passport__default["default"].session());
+    router.use(passport__default.default.initialize());
+    router.use(passport__default.default.session());
   } else {
-    router.use(cookieParser__default["default"]());
+    router.use(cookieParser__default.default());
   }
-  router.use(express__default["default"].urlencoded({ extended: false }));
-  router.use(express__default["default"].json());
+  router.use(express__default.default.urlencoded({ extended: false }));
+  router.use(express__default.default.json());
   const providers = options.disableDefaultProviderFactories ? providerFactories : {
     ...defaultAuthProviderFactories,
     ...providerFactories
@@ -2865,7 +2865,7 @@ exports.OAuthEnvironmentHandler = OAuthEnvironmentHandler;
 exports.createAuthProviderIntegration = createAuthProviderIntegration;
 exports.createOriginFilter = createOriginFilter;
 exports.createRouter = createRouter;
-exports["default"] = authPlugin;
+exports.default = authPlugin;
 exports.defaultAuthProviderFactories = defaultAuthProviderFactories;
 exports.encodeState = encodeState;
 exports.ensuresXRequestedWith = ensuresXRequestedWith;