@backstage/plugin-auth-backend 0.22.5 → 0.22.6-next.0

package/dist/index.cjs.js

@@ -98,45 +98,40 @@ function adaptOAuthSignInResolverToLegacy(resolvers) {
   const legacyResolvers = {};
   for (const name of Object.keys(resolvers)) {
     const resolver = resolvers[name];
-    legacyResolvers[name] = () => async (input, ctx) => {
-      var _a;
-      return resolver(
-        {
-          profile: input.profile,
-          result: {
-            fullProfile: input.result.fullProfile,
-            session: {
-              accessToken: input.result.accessToken,
-              expiresInSeconds: input.result.params.expires_in,
-              scope: input.result.params.scope,
-              idToken: input.result.params.id_token,
-              tokenType: (_a = input.result.params.token_type) != null ? _a : "bearer",
-              refreshToken: input.result.refreshToken
-            }
+    legacyResolvers[name] = () => async (input, ctx) => resolver(
+      {
+        profile: input.profile,
+        result: {
+          fullProfile: input.result.fullProfile,
+          session: {
+            accessToken: input.result.accessToken,
+            expiresInSeconds: input.result.params.expires_in,
+            scope: input.result.params.scope,
+            idToken: input.result.params.id_token,
+            tokenType: input.result.params.token_type ?? "bearer",
+            refreshToken: input.result.refreshToken
           }
-        },
-        ctx
-      );
-    };
+        }
+      },
+      ctx
+    );
   }
   return legacyResolvers;
 }
 
 function createAuthProviderIntegration(config) {
-  var _a;
   return Object.freeze({
     ...config,
-    resolvers: Object.freeze((_a = config.resolvers) != null ? _a : {})
+    resolvers: Object.freeze(config.resolvers ?? {})
   });
 }
 
 const atlassian = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleAtlassianProvider.atlassianAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   }
 });
@@ -159,9 +154,8 @@ const OAuthEnvironmentHandler = pluginAuthNode.OAuthEnvironmentHandler;
 const readState = pluginAuthNode.decodeOAuthState;
 const encodeState = pluginAuthNode.encodeOAuthState;
 const verifyNonce = (req, providerId) => {
-  var _a, _b;
   const cookieNonce = req.cookies[`${providerId}-nonce`];
-  const state = readState((_b = (_a = req.query.state) == null ? void 0 : _a.toString()) != null ? _b : "");
+  const state = readState(req.query.state?.toString() ?? "");
   const stateNonce = state.nonce;
   if (!cookieNonce) {
     throw new Error("Auth response is missing cookie nonce");
@@ -221,72 +215,21 @@ const ensuresXRequestedWith = (req) => {
 
 const prepareBackstageIdentityResponse = pluginAuthNode.prepareBackstageIdentityResponse;
 
-var __defProp$9 = Object.defineProperty;
-var __defNormalProp$9 = (obj, key, value) => key in obj ? __defProp$9(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$9 = (obj, key, value) => {
-  __defNormalProp$9(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 const THOUSAND_DAYS_MS = 1e3 * 24 * 60 * 60 * 1e3;
 const TEN_MINUTES_MS = 600 * 1e3;
 class OAuthAdapter {
   constructor(handlers, options) {
     this.handlers = handlers;
     this.options = options;
-    __publicField$9(this, "baseCookieOptions");
-    __publicField$9(this, "setNonceCookie", (res, nonce, cookieConfig) => {
-      res.cookie(`${this.options.providerId}-nonce`, nonce, {
-        maxAge: TEN_MINUTES_MS,
-        ...this.baseCookieOptions,
-        ...cookieConfig,
-        path: `${cookieConfig.path}/handler`
-      });
-    });
-    __publicField$9(this, "setGrantedScopeCookie", (res, scope, cookieConfig) => {
-      res.cookie(`${this.options.providerId}-granted-scope`, scope, {
-        maxAge: THOUSAND_DAYS_MS,
-        ...this.baseCookieOptions,
-        ...cookieConfig
-      });
-    });
-    __publicField$9(this, "getRefreshTokenFromCookie", (req) => {
-      return req.cookies[`${this.options.providerId}-refresh-token`];
-    });
-    __publicField$9(this, "getGrantedScopeFromCookie", (req) => {
-      return req.cookies[`${this.options.providerId}-granted-scope`];
-    });
-    __publicField$9(this, "setRefreshTokenCookie", (res, refreshToken, cookieConfig) => {
-      res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
-        maxAge: THOUSAND_DAYS_MS,
-        ...this.baseCookieOptions,
-        ...cookieConfig
-      });
-    });
-    __publicField$9(this, "removeRefreshTokenCookie", (res, cookieConfig) => {
-      res.cookie(`${this.options.providerId}-refresh-token`, "", {
-        maxAge: 0,
-        ...this.baseCookieOptions,
-        ...cookieConfig
-      });
-    });
-    __publicField$9(this, "getCookieConfig", (origin) => {
-      return this.options.cookieConfigurer({
-        providerId: this.options.providerId,
-        baseUrl: this.options.baseUrl,
-        callbackUrl: this.options.callbackUrl,
-        appOrigin: origin != null ? origin : this.options.appOrigin
-      });
-    });
     this.baseCookieOptions = {
       httpOnly: true,
       sameSite: "lax"
     };
   }
   static fromConfig(config, handlers, options) {
-    var _a;
     const { appUrl, baseUrl, isOriginAllowed } = config;
     const { origin: appOrigin } = new url.URL(appUrl);
-    const cookieConfigurer = (_a = config.cookieConfigurer) != null ? _a : defaultCookieConfigurer;
+    const cookieConfigurer = config.cookieConfigurer ?? defaultCookieConfigurer;
     return new OAuthAdapter(handlers, {
       ...options,
       appOrigin,
@@ -295,13 +238,13 @@ class OAuthAdapter {
       isOriginAllowed
     });
   }
+  baseCookieOptions;
   async start(req, res) {
-    var _a, _b, _c, _d, _e, _f;
-    const scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
-    const env = (_c = req.query.env) == null ? void 0 : _c.toString();
-    const origin = (_d = req.query.origin) == null ? void 0 : _d.toString();
-    const redirectUrl = (_e = req.query.redirectUrl) == null ? void 0 : _e.toString();
-    const flow = (_f = req.query.flow) == null ? void 0 : _f.toString();
+    const scope = req.query.scope?.toString() ?? "";
+    const env = req.query.env?.toString();
+    const origin = req.query.origin?.toString();
+    const redirectUrl = req.query.redirectUrl?.toString();
+    const flow = req.query.flow?.toString();
     if (!env) {
       throw new errors.InputError("No env provided in request query parameters");
     }
@@ -322,10 +265,9 @@ class OAuthAdapter {
     res.end();
   }
   async frameHandler(req, res) {
-    var _a, _b;
     let appOrigin = this.options.appOrigin;
     try {
-      const state = readState((_b = (_a = req.query.state) == null ? void 0 : _a.toString()) != null ? _b : "");
+      const state = readState(req.query.state?.toString() ?? "");
       if (state.origin) {
         try {
           appOrigin = new url.URL(state.origin).origin;
@@ -386,7 +328,6 @@ class OAuthAdapter {
     res.status(200).end();
   }
   async refresh(req, res) {
-    var _a, _b;
     if (!ensuresXRequestedWith(req)) {
       throw new errors.AuthenticationError("Invalid X-Requested-With header");
     }
@@ -400,7 +341,7 @@ class OAuthAdapter {
       if (!refreshToken) {
         throw new errors.InputError("Missing session cookie");
       }
-      let scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
+      let scope = req.query.scope?.toString() ?? "";
       if (this.options.persistScopes) {
         scope = this.getGrantedScopeFromCookie(req);
       }
@@ -432,10 +373,52 @@ class OAuthAdapter {
     }
     return prepareBackstageIdentityResponse(identity);
   }
+  setNonceCookie = (res, nonce, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-nonce`, nonce, {
+      maxAge: TEN_MINUTES_MS,
+      ...this.baseCookieOptions,
+      ...cookieConfig,
+      path: `${cookieConfig.path}/handler`
+    });
+  };
+  setGrantedScopeCookie = (res, scope, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-granted-scope`, scope, {
+      maxAge: THOUSAND_DAYS_MS,
+      ...this.baseCookieOptions,
+      ...cookieConfig
+    });
+  };
+  getRefreshTokenFromCookie = (req) => {
+    return req.cookies[`${this.options.providerId}-refresh-token`];
+  };
+  getGrantedScopeFromCookie = (req) => {
+    return req.cookies[`${this.options.providerId}-granted-scope`];
+  };
+  setRefreshTokenCookie = (res, refreshToken, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
+      maxAge: THOUSAND_DAYS_MS,
+      ...this.baseCookieOptions,
+      ...cookieConfig
+    });
+  };
+  removeRefreshTokenCookie = (res, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-refresh-token`, "", {
+      maxAge: 0,
+      ...this.baseCookieOptions,
+      ...cookieConfig
+    });
+  };
+  getCookieConfig = (origin) => {
+    return this.options.cookieConfigurer({
+      providerId: this.options.providerId,
+      baseUrl: this.options.baseUrl,
+      callbackUrl: this.options.callbackUrl,
+      appOrigin: origin ?? this.options.appOrigin
+    });
+  };
 }
 
 const makeProfileInfo = (profile, idToken) => {
-  var _a, _b;
   let email = void 0;
   if (profile.emails && profile.emails.length > 0) {
     const [firstEmail] = profile.emails;
@@ -448,7 +431,7 @@ const makeProfileInfo = (profile, idToken) => {
     const [firstPhoto] = profile.photos;
     picture = firstPhoto.value;
   }
-  let displayName = (_b = (_a = profile.displayName) != null ? _a : profile.username) != null ? _b : profile.id;
+  let displayName = profile.displayName ?? profile.username ?? profile.id;
   if ((!email || !picture || !displayName) && idToken) {
     try {
       const decoded = jose.decodeJwt(idToken);
@@ -475,7 +458,7 @@ const executeRedirectStrategy = async (req, providerStrategy, options) => {
   return new Promise((resolve) => {
     const strategy = Object.create(providerStrategy);
     strategy.redirect = (url, status) => {
-      resolve({ url, status: status != null ? status : void 0 });
+      resolve({ url, status: status ?? void 0 });
     };
     strategy.authenticate(req, { ...options });
   });
@@ -488,13 +471,11 @@ const executeFrameHandlerStrategy = async (req, providerStrategy, options) => {
         resolve({ result, privateInfo });
       };
       strategy.fail = (info) => {
-        var _a;
-        reject(new Error(`Authentication rejected, ${(_a = info.message) != null ? _a : ""}`));
+        reject(new Error(`Authentication rejected, ${info.message ?? ""}`));
       };
       strategy.error = (error) => {
-        var _a;
         let message = `Authentication failed, ${error.message}`;
-        if ((_a = error.oauthError) == null ? void 0 : _a.data) {
+        if (error.oauthError?.data) {
           try {
             const errorData = JSON.parse(error.oauthError.data);
             if (errorData.message) {
@@ -509,7 +490,7 @@ const executeFrameHandlerStrategy = async (req, providerStrategy, options) => {
       strategy.redirect = () => {
         reject(new Error("Unexpected redirect"));
       };
-      strategy.authenticate(req, { ...options != null ? options : {} });
+      strategy.authenticate(req, { ...options ?? {} });
     }
   );
 };
@@ -567,37 +548,31 @@ const executeFetchUserProfileStrategy = async (providerStrategy, accessToken) =>
   });
 };
 
-var __defProp$8 = Object.defineProperty;
-var __defNormalProp$8 = (obj, key, value) => key in obj ? __defProp$8(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$8 = (obj, key, value) => {
-  __defNormalProp$8(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class Auth0AuthProvider {
+  _strategy;
+  signInResolver;
+  authHandler;
+  resolverContext;
+  audience;
+  connection;
+  connectionScope;
+  /**
+   * Due to passport-auth0 forcing options.state = true,
+   * passport-oauth2 requires express-session to be installed
+   * so that the 'state' parameter of the oauth2 flow can be stored.
+   * This implementation of StateStore matches the NullStore found within
+   * passport-oauth2, which is the StateStore implementation used when options.state = false,
+   * allowing us to avoid using express-session in order to integrate with auth0.
+   */
+  store = {
+    store(_req, cb) {
+      cb(null, null);
+    },
+    verify(_req, _state, cb) {
+      cb(null, true);
+    }
+  };
   constructor(options) {
-    __publicField$8(this, "_strategy");
-    __publicField$8(this, "signInResolver");
-    __publicField$8(this, "authHandler");
-    __publicField$8(this, "resolverContext");
-    __publicField$8(this, "audience");
-    __publicField$8(this, "connection");
-    __publicField$8(this, "connectionScope");
-    /**
-     * Due to passport-auth0 forcing options.state = true,
-     * passport-oauth2 requires express-session to be installed
-     * so that the 'state' parameter of the oauth2 flow can be stored.
-     * This implementation of StateStore matches the NullStore found within
-     * passport-oauth2, which is the StateStore implementation used when options.state = false,
-     * allowing us to avoid using express-session in order to integrate with auth0.
-     */
-    __publicField$8(this, "store", {
-      store(_req, cb) {
-        cb(null, null);
-      },
-      verify(_req, _state, cb) {
-        cb(null, true);
-      }
-    });
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -698,7 +673,6 @@ class Auth0AuthProvider {
 const auth0 = createAuthProviderIntegration({
   create(options) {
     return ({ providerId, globalConfig, config, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
-      var _a;
       const clientId = envConfig.getString("clientId");
       const clientSecret = envConfig.getString("clientSecret");
       const domain = envConfig.getString("domain");
@@ -707,10 +681,10 @@ const auth0 = createAuthProviderIntegration({
       const connection = envConfig.getOptionalString("connection");
       const connectionScope = envConfig.getOptionalString("connectionScope");
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
-      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
+      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile, params }) => ({
         profile: makeProfileInfo(fullProfile, params.id_token)
       });
-      const signInResolver = (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver;
+      const signInResolver = options?.signIn?.resolver;
       const provider = new Auth0AuthProvider({
         clientId,
         clientSecret,
@@ -733,22 +707,20 @@ const auth0 = createAuthProviderIntegration({
 
 const awsAlb = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createProxyAuthProviderFactory({
       authenticator: pluginAuthBackendModuleAwsAlbProvider.awsAlbAuthenticator,
-      profileTransform: options == null ? void 0 : options.authHandler,
-      signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver
+      profileTransform: options?.authHandler,
+      signInResolver: options?.signIn?.resolver
     });
   }
 });
 
 const bitbucket = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleBitbucketProvider.bitbucketAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   },
   resolvers: adaptOAuthSignInResolverToLegacy({
@@ -759,13 +731,12 @@ const bitbucket = createAuthProviderIntegration({
 
 const cfAccess = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createProxyAuthProviderFactory({
       authenticator: pluginAuthBackendModuleCloudflareAccessProvider.createCloudflareAccessAuthenticator({
         cache: options.cache
       }),
-      profileTransform: options == null ? void 0 : options.authHandler,
-      signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver,
+      profileTransform: options?.authHandler,
+      signInResolver: options?.signIn?.resolver,
       signInResolverFactories: pluginAuthBackendModuleCloudflareAccessProvider.cloudflareAccessSignInResolvers
     });
   },
@@ -774,20 +745,18 @@ const cfAccess = createAuthProviderIntegration({
 
 const gcpIap = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createProxyAuthProviderFactory({
       authenticator: pluginAuthBackendModuleGcpIapProvider.gcpIapAuthenticator,
-      profileTransform: options == null ? void 0 : options.authHandler,
-      signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver
+      profileTransform: options?.authHandler,
+      signInResolver: options?.signIn?.resolver
     });
   }
 });
 
 const github = createAuthProviderIntegration({
   create(options) {
-    var _a;
-    const authHandler = options == null ? void 0 : options.authHandler;
-    const signInResolver = (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver;
+    const authHandler = options?.authHandler;
+    const signInResolver = options?.signIn?.resolver;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleGithubProvider.githubAuthenticator,
       profileTransform: authHandler && (async (result, ctx) => authHandler(
@@ -839,22 +808,20 @@ const github = createAuthProviderIntegration({
 
 const gitlab = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleGitlabProvider.gitlabAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   }
 });
 
 const google = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleGoogleProvider.googleAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   },
   resolvers: adaptOAuthSignInResolverToLegacy({
@@ -866,11 +833,10 @@ const google = createAuthProviderIntegration({
 
 const microsoft = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleMicrosoftProvider.microsoftAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   },
   resolvers: adaptOAuthSignInResolverToLegacy({
@@ -882,22 +848,20 @@ const microsoft = createAuthProviderIntegration({
 
 const oauth2 = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleOauth2Provider.oauth2Authenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   }
 });
 
 const oauth2Proxy = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createProxyAuthProviderFactory({
       authenticator: pluginAuthBackendModuleOauth2ProxyProvider.oauth2ProxyAuthenticator,
-      profileTransform: options == null ? void 0 : options.authHandler,
-      signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver
+      profileTransform: options?.authHandler,
+      signInResolver: options?.signIn?.resolver
     });
   }
 });
@@ -926,9 +890,8 @@ const commonByEmailResolver = async (info, ctx) => {
 
 const oidc = createAuthProviderIntegration({
   create(options) {
-    var _a;
-    const authHandler = options == null ? void 0 : options.authHandler;
-    const signInResolver = (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver;
+    const authHandler = options?.authHandler;
+    const signInResolver = options?.signIn?.resolver;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleOidcProvider.oidcAuthenticator,
       profileTransform: authHandler && ((result, context) => authHandler(result.fullProfile, context)),
@@ -955,11 +918,10 @@ const oidc = createAuthProviderIntegration({
 
 const okta = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createOAuthProviderFactory({
       authenticator: pluginAuthBackendModuleOktaProvider.oktaAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options == null ? void 0 : options.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver((_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver)
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   },
   resolvers: {
@@ -990,18 +952,12 @@ const okta = createAuthProviderIntegration({
   }
 });
 
-var __defProp$7 = Object.defineProperty;
-var __defNormalProp$7 = (obj, key, value) => key in obj ? __defProp$7(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$7 = (obj, key, value) => {
-  __defNormalProp$7(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class OneLoginProvider {
+  _strategy;
+  signInResolver;
+  authHandler;
+  resolverContext;
   constructor(options) {
-    __publicField$7(this, "_strategy");
-    __publicField$7(this, "signInResolver");
-    __publicField$7(this, "authHandler");
-    __publicField$7(this, "resolverContext");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -1089,13 +1045,12 @@ class OneLoginProvider {
 const onelogin = createAuthProviderIntegration({
   create(options) {
     return ({ providerId, globalConfig, config, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
-      var _a;
       const clientId = envConfig.getString("clientId");
       const clientSecret = envConfig.getString("clientSecret");
       const issuer = envConfig.getString("issuer");
       const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
-      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
+      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile, params }) => ({
         profile: makeProfileInfo(fullProfile, params.id_token)
       });
       const provider = new OneLoginProvider({
@@ -1104,7 +1059,7 @@ const onelogin = createAuthProviderIntegration({
         callbackUrl,
         issuer,
         authHandler,
-        signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver,
+        signInResolver: options?.signIn?.resolver,
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
@@ -1115,19 +1070,13 @@ const onelogin = createAuthProviderIntegration({
   }
 });
 
-var __defProp$6 = Object.defineProperty;
-var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$6 = (obj, key, value) => {
-  __defNormalProp$6(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class SamlAuthProvider {
+  strategy;
+  signInResolver;
+  authHandler;
+  resolverContext;
+  appUrl;
   constructor(options) {
-    __publicField$6(this, "strategy");
-    __publicField$6(this, "signInResolver");
-    __publicField$6(this, "authHandler");
-    __publicField$6(this, "resolverContext");
-    __publicField$6(this, "appUrl");
     this.appUrl = options.appUrl;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
@@ -1181,8 +1130,7 @@ class SamlAuthProvider {
 const saml = createAuthProviderIntegration({
   create(options) {
     return ({ providerId, globalConfig, config, resolverContext }) => {
-      var _a;
-      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
+      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile }) => ({
         profile: {
           email: fullProfile.email,
           displayName: fullProfile.displayName
@@ -1208,7 +1156,7 @@ const saml = createAuthProviderIntegration({
         wantAssertionsSigned: config.getOptionalBoolean("wantAssertionsSigned"),
         appUrl: globalConfig.appUrl,
         authHandler,
-        signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver,
+        signInResolver: options?.signIn?.resolver,
         resolverContext
       });
     };
@@ -1231,19 +1179,13 @@ const saml = createAuthProviderIntegration({
   }
 });
 
-var __defProp$5 = Object.defineProperty;
-var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$5 = (obj, key, value) => {
-  __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class BitbucketServerAuthProvider {
+  signInResolver;
+  authHandler;
+  resolverContext;
+  strategy;
+  host;
   constructor(options) {
-    __publicField$5(this, "signInResolver");
-    __publicField$5(this, "authHandler");
-    __publicField$5(this, "resolverContext");
-    __publicField$5(this, "strategy");
-    __publicField$5(this, "host");
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
@@ -1372,7 +1314,6 @@ class BitbucketServerAuthProvider {
 const bitbucketServer = createAuthProviderIntegration({
   create(options) {
     return ({ providerId, globalConfig, config, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
-      var _a;
       const clientId = envConfig.getString("clientId");
       const clientSecret = envConfig.getString("clientSecret");
       const host = envConfig.getString("host");
@@ -1380,7 +1321,7 @@ const bitbucketServer = createAuthProviderIntegration({
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       const authorizationUrl = `https://${host}/rest/oauth2/latest/authorize`;
       const tokenUrl = `https://${host}/rest/oauth2/latest/token`;
-      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
+      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile }) => ({
         profile: makeProfileInfo(fullProfile)
       });
       const provider = new BitbucketServerAuthProvider({
@@ -1391,7 +1332,7 @@ const bitbucketServer = createAuthProviderIntegration({
         authorizationUrl,
         tokenUrl,
         authHandler,
-        signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver,
+        signInResolver: options?.signIn?.resolver,
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
@@ -1410,11 +1351,10 @@ const bitbucketServer = createAuthProviderIntegration({
 
 const easyAuth = createAuthProviderIntegration({
   create(options) {
-    var _a;
     return pluginAuthNode.createProxyAuthProviderFactory({
       authenticator: pluginAuthBackendModuleAzureEasyauthProvider.azureEasyAuthAuthenticator,
-      profileTransform: options == null ? void 0 : options.authHandler,
-      signInResolver: (_a = options == null ? void 0 : options.signIn) == null ? void 0 : _a.resolver
+      profileTransform: options?.authHandler,
+      signInResolver: options?.signIn?.resolver
     });
   }
 });
@@ -1457,16 +1397,10 @@ const defaultAuthProviderFactories = {
   atlassian: atlassian.create()
 };
 
-var __defProp$4 = Object.defineProperty;
-var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$4 = (obj, key, value) => {
-  __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class CatalogIdentityClient {
+  catalogApi;
+  auth;
   constructor(options) {
-    __publicField$4(this, "catalogApi");
-    __publicField$4(this, "auth");
     this.catalogApi = options.catalogApi;
     const { auth } = backendCommon.createLegacyAuthAdapters({
       auth: options.auth,
@@ -1519,7 +1453,7 @@ class CatalogIdentityClient {
         });
         return parsedRef;
       } catch {
-        logger == null ? void 0 : logger.warn(`Failed to parse entityRef from ${ref}, ignoring`);
+        logger?.warn(`Failed to parse entityRef from ${ref}, ignoring`);
         return null;
       }
     }).filter((ref) => ref !== null);
@@ -1536,27 +1470,23 @@ class CatalogIdentityClient {
     if (entityRefs.length !== entities.length) {
       const foundEntityNames = entities.map(catalogModel.stringifyEntityRef);
       const missingEntityNames = resolvedEntityRefs.map(catalogModel.stringifyEntityRef).filter((s) => !foundEntityNames.includes(s));
-      logger == null ? void 0 : logger.debug(`Entities not found for refs ${missingEntityNames.join()}`);
+      logger?.debug(`Entities not found for refs ${missingEntityNames.join()}`);
     }
     const memberOf = entities.flatMap(
-      (e) => {
-        var _a, _b;
-        return (_b = (_a = e.relations) == null ? void 0 : _a.filter((r) => r.type === catalogModel.RELATION_MEMBER_OF).map((r) => r.targetRef)) != null ? _b : [];
-      }
+      (e) => e.relations?.filter((r) => r.type === catalogModel.RELATION_MEMBER_OF).map((r) => r.targetRef) ?? []
     );
     const newEntityRefs = [
       ...new Set(resolvedEntityRefs.map(catalogModel.stringifyEntityRef).concat(memberOf))
     ];
-    logger == null ? void 0 : logger.debug(`Found catalog membership: ${newEntityRefs.join()}`);
+    logger?.debug(`Found catalog membership: ${newEntityRefs.join()}`);
     return newEntityRefs;
   }
 }
 
 function getDefaultOwnershipEntityRefs(entity) {
-  var _a, _b;
-  const membershipRefs = (_b = (_a = entity.relations) == null ? void 0 : _a.filter(
+  const membershipRefs = entity.relations?.filter(
     (r) => r.type === catalogModel.RELATION_MEMBER_OF && r.targetRef.startsWith("group:")
-  ).map((r) => r.targetRef)) != null ? _b : [];
+  ).map((r) => r.targetRef) ?? [];
   return Array.from(/* @__PURE__ */ new Set([catalogModel.stringifyEntityRef(entity), ...membershipRefs]));
 }
 class CatalogAuthResolverContext {
@@ -1678,7 +1608,7 @@ function bindProviderRouters(targetRouter, options) {
   const providersConfig = config.getOptionalConfig("auth.providers");
   const isOriginAllowed = createOriginFilter(config);
   for (const [providerId, providerFactory] of Object.entries(providers)) {
-    if (providersConfig == null ? void 0 : providersConfig.has(providerId)) {
+    if (providersConfig?.has(providerId)) {
       logger.info(`Configuring auth provider: ${providerId}`);
       try {
         const provider = providerFactory({
@@ -1695,7 +1625,7 @@ function bindProviderRouters(targetRouter, options) {
           logger,
           resolverContext: CatalogAuthResolverContext.create({
             logger,
-            catalogApi: catalogApi != null ? catalogApi : new catalogClient.CatalogClient({ discoveryApi: discovery }),
+            catalogApi: catalogApi ?? new catalogClient.CatalogClient({ discoveryApi: discovery }),
             tokenIssuer,
             tokenManager,
             discovery,
@@ -1740,15 +1670,14 @@ function bindProviderRouters(targetRouter, options) {
   }
 }
 function createOriginFilter(config) {
-  var _a;
   const appUrl = config.getString("app.baseUrl");
   const { origin: appOrigin } = new URL(appUrl);
   const allowedOrigins = config.getOptionalStringArray(
     "auth.experimentalExtraAllowedOrigins"
   );
-  const allowedOriginPatterns = (_a = allowedOrigins == null ? void 0 : allowedOrigins.map(
+  const allowedOriginPatterns = allowedOrigins?.map(
     (pattern) => new minimatch.Minimatch(pattern, { nocase: true, noglobstar: true })
-  )) != null ? _a : [];
+  ) ?? [];
   return (origin) => {
     if (origin === appOrigin) {
       return true;
@@ -1796,9 +1725,8 @@ function bindOidcRouter(targetRouter, options) {
     res.status(501).send("Not Implemented");
   });
   router.get("/v1/userinfo", async (req, res) => {
-    var _a;
-    const matches = (_a = req.headers.authorization) == null ? void 0 : _a.match(/^Bearer[ ]+(\S+)$/i);
-    const token = matches == null ? void 0 : matches[1];
+    const matches = req.headers.authorization?.match(/^Bearer[ ]+(\S+)$/i);
+    const token = matches?.[1];
     if (!token) {
       throw new errors.AuthenticationError("No token provided");
     }
@@ -1823,29 +1751,22 @@ function bindOidcRouter(targetRouter, options) {
   });
 }
 
-var __defProp$3 = Object.defineProperty;
-var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$3 = (obj, key, value) => {
-  __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 const MS_IN_S$1 = 1e3;
 const MAX_TOKEN_LENGTH = 32768;
 class TokenFactory {
+  issuer;
+  logger;
+  keyStore;
+  keyDurationSeconds;
+  algorithm;
+  keyExpiry;
+  privateKeyPromise;
   constructor(options) {
-    __publicField$3(this, "issuer");
-    __publicField$3(this, "logger");
-    __publicField$3(this, "keyStore");
-    __publicField$3(this, "keyDurationSeconds");
-    __publicField$3(this, "algorithm");
-    __publicField$3(this, "keyExpiry");
-    __publicField$3(this, "privateKeyPromise");
-    var _a;
     this.issuer = options.issuer;
     this.logger = options.logger;
     this.keyStore = options.keyStore;
     this.keyDurationSeconds = options.keyDurationSeconds;
-    this.algorithm = (_a = options.algorithm) != null ? _a : "ES256";
+    this.algorithm = options.algorithm ?? "ES256";
   }
   async issueToken(params) {
     const key = await this.getKey();
@@ -2012,16 +1933,8 @@ class DatabaseKeyStore {
   }
 }
 
-var __defProp$2 = Object.defineProperty;
-var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$2 = (obj, key, value) => {
-  __defNormalProp$2(obj, key + "" , value);
-  return value;
-};
 class MemoryKeyStore {
-  constructor() {
-    __publicField$2(this, "keys", /* @__PURE__ */ new Map());
-  }
+  keys = /* @__PURE__ */ new Map();
   async addKey(key) {
     this.keys.set(key.kid, {
       createdAt: luxon.DateTime.utc().toJSDate(),
@@ -2052,12 +1965,12 @@ class FirestoreKeyStore {
     this.timeout = timeout;
   }
   static async create(settings) {
-    const { path, timeout, ...firestoreSettings } = settings != null ? settings : {};
+    const { path, timeout, ...firestoreSettings } = settings ?? {};
     const database = new firestore.Firestore(firestoreSettings);
     return new FirestoreKeyStore(
       database,
-      path != null ? path : DEFAULT_DOCUMENT_PATH,
-      timeout != null ? timeout : DEFAULT_TIMEOUT_MS
+      path ?? DEFAULT_DOCUMENT_PATH,
+      timeout ?? DEFAULT_TIMEOUT_MS
     );
   }
   static async verifyConnection(keyStore, logger) {
@@ -2069,7 +1982,7 @@ class FirestoreKeyStore {
           `Failed to connect to database: ${error.message}`
         );
       }
-      logger == null ? void 0 : logger.warn(
+      logger?.warn(
         `Failed to connect to database: ${error.message}`
       );
     }
@@ -2125,17 +2038,11 @@ class FirestoreKeyStore {
   }
 }
 
-var __defProp$1 = Object.defineProperty;
-var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$1 = (obj, key, value) => {
-  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 const DEFAULT_ALGORITHM = "ES256";
 class StaticKeyStore {
+  keyPairs;
+  createdAt;
   constructor(keyPairs) {
-    __publicField$1(this, "keyPairs");
-    __publicField$1(this, "createdAt");
     if (keyPairs.length === 0) {
       throw new Error("Should provide at least one key pair");
     }
@@ -2144,12 +2051,11 @@ class StaticKeyStore {
   }
   static async fromConfig(config) {
     const keyConfigs = config.getConfigArray("auth.keyStore.static.keys").map((c) => {
-      var _a;
       const staticKeyConfig = {
         publicKeyFile: c.getString("publicKeyFile"),
         privateKeyFile: c.getString("privateKeyFile"),
         keyId: c.getString("keyId"),
-        algorithm: (_a = c.getOptionalString("algorithm")) != null ? _a : DEFAULT_ALGORITHM
+        algorithm: c.getOptionalString("algorithm") ?? DEFAULT_ALGORITHM
       };
       return staticKeyConfig;
     });
@@ -2224,10 +2130,9 @@ class KeyStores {
    * @returns a KeyStore store
    */
   static async fromConfig(config, options) {
-    var _a;
     const { logger, database } = options;
     const ks = config.getOptionalConfig("auth.keyStore");
-    const provider = (_a = ks == null ? void 0 : ks.getOptionalString("provider")) != null ? _a : "database";
+    const provider = ks?.getOptionalString("provider") ?? "database";
     logger.info(`Configuring "${provider}" as KeyStore provider`);
     if (provider === "database") {
       return new DatabaseKeyStore(await database.get());
@@ -2236,17 +2141,17 @@ class KeyStores {
       return new MemoryKeyStore();
     }
     if (provider === "firestore") {
-      const settings = ks == null ? void 0 : ks.getConfig(provider);
+      const settings = ks?.getConfig(provider);
       const keyStore = await FirestoreKeyStore.create(
         lodash.pickBy(
           {
-            projectId: settings == null ? void 0 : settings.getOptionalString("projectId"),
-            keyFilename: settings == null ? void 0 : settings.getOptionalString("keyFilename"),
-            host: settings == null ? void 0 : settings.getOptionalString("host"),
-            port: settings == null ? void 0 : settings.getOptionalNumber("port"),
-            ssl: settings == null ? void 0 : settings.getOptionalBoolean("ssl"),
-            path: settings == null ? void 0 : settings.getOptionalString("path"),
-            timeout: settings == null ? void 0 : settings.getOptionalNumber("timeout")
+            projectId: settings?.getOptionalString("projectId"),
+            keyFilename: settings?.getOptionalString("keyFilename"),
+            host: settings?.getOptionalString("host"),
+            port: settings?.getOptionalNumber("port"),
+            ssl: settings?.getOptionalBoolean("ssl"),
+            path: settings?.getOptionalString("path"),
+            timeout: settings?.getOptionalNumber("timeout")
           },
           (value) => value !== void 0
         )
@@ -2261,37 +2166,15 @@ class KeyStores {
   }
 }
 
-var __accessCheck = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet = (obj, member, getter) => {
-  __accessCheck(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet = (obj, member, value, setter) => {
-  __accessCheck(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _database, _promise;
 const migrationsDir = backendPluginApi.resolvePackagePath(
   "@backstage/plugin-auth-backend",
   "migrations"
 );
-const _AuthDatabase = class _AuthDatabase {
-  constructor(database) {
-    __privateAdd(this, _database, void 0);
-    __privateAdd(this, _promise, void 0);
-    __privateSet(this, _database, database);
-  }
+class AuthDatabase {
+  #database;
+  #promise;
   static create(database) {
-    return new _AuthDatabase(database);
+    return new AuthDatabase(database);
   }
   /** @internal */
   static forTesting() {
@@ -2305,28 +2188,26 @@ const _AuthDatabase = class _AuthDatabase {
       }
     });
     const database = backendCommon.DatabaseManager.fromConfig(config$1).forPlugin("auth");
-    return new _AuthDatabase(database);
+    return new AuthDatabase(database);
   }
   static async runMigrations(knex) {
     await knex.migrate.latest({
       directory: migrationsDir
     });
   }
+  constructor(database) {
+    this.#database = database;
+  }
   get() {
-    var _a;
-    (_a = __privateGet(this, _promise)) != null ? _a : __privateSet(this, _promise, __privateGet(this, _database).getClient().then(async (client) => {
-      var _a2;
-      if (!((_a2 = __privateGet(this, _database).migrations) == null ? void 0 : _a2.skip)) {
-        await _AuthDatabase.runMigrations(client);
+    this.#promise ??= this.#database.getClient().then(async (client) => {
+      if (!this.#database.migrations?.skip) {
+        await AuthDatabase.runMigrations(client);
       }
       return client;
-    }));
-    return __privateGet(this, _promise);
+    });
+    return this.#promise;
   }
-};
-_database = new WeakMap();
-_promise = new WeakMap();
-let AuthDatabase = _AuthDatabase;
+}
 
 const TOKEN_EXP_DEFAULT_S = 3600;
 const TOKEN_EXP_MIN_S = 600;
@@ -2348,19 +2229,13 @@ function readBackstageTokenExpiration(config$1) {
   return durationS;
 }
 
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => {
-  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 const MS_IN_S = 1e3;
 class StaticTokenIssuer {
+  issuer;
+  logger;
+  keyStore;
+  sessionExpirationSeconds;
   constructor(options, keyStore) {
-    __publicField(this, "issuer");
-    __publicField(this, "logger");
-    __publicField(this, "keyStore");
-    __publicField(this, "sessionExpirationSeconds");
     this.issuer = options.issuer;
     this.logger = options.logger;
     this.sessionExpirationSeconds = options.sessionExpirationSeconds;
@@ -2380,7 +2255,7 @@ class StaticTokenIssuer {
         '"sub" claim provided by the auth resolver is not a valid EntityRef.'
       );
     }
-    this.logger.info(`Issuing token for ${sub}, with entities ${ent != null ? ent : []}`);
+    this.logger.info(`Issuing token for ${sub}, with entities ${ent ?? []}`);
     if (!key.alg) {
       throw new errors.AuthenticationError("No algorithm was provided in the key");
     }
@@ -2434,7 +2309,7 @@ async function createRouter(options) {
       keyStore,
       keyDurationSeconds: backstageTokenExpiration,
       logger: logger.child({ component: "token-factory" }),
-      algorithm: tokenFactoryAlgorithm != null ? tokenFactoryAlgorithm : config.getOptionalString("auth.identityTokenAlgorithm")
+      algorithm: tokenFactoryAlgorithm ?? config.getOptionalString("auth.identityTokenAlgorithm")
     });
   }
   const secret = config.getOptionalString("auth.session.secret");