@backstage/plugin-auth-backend 0.23.0-next.1 → 0.23.0-next.2

package/dist/index.cjs.js

@@ -9,11 +9,7 @@ var express = require('express');
 var Router = require('express-promise-router');
 var cookieParser = require('cookie-parser');
 var pluginAuthBackendModuleAtlassianProvider = require('@backstage/plugin-auth-backend-module-atlassian-provider');
-var Auth0InternalStrategy = require('passport-auth0');
-var crypto = require('crypto');
-var url = require('url');
-var errors = require('@backstage/errors');
-var jose = require('jose');
+var pluginAuthBackendModuleAuth0Provider = require('@backstage/plugin-auth-backend-module-auth0-provider');
 var pluginAuthBackendModuleAwsAlbProvider = require('@backstage/plugin-auth-backend-module-aws-alb-provider');
 var pluginAuthBackendModuleBitbucketProvider = require('@backstage/plugin-auth-backend-module-bitbucket-provider');
 var pluginAuthBackendModuleCloudflareAccessProvider = require('@backstage/plugin-auth-backend-module-cloudflare-access-provider');
@@ -28,8 +24,10 @@ var pluginAuthBackendModuleOidcProvider = require('@backstage/plugin-auth-backen
 var pluginAuthBackendModuleOktaProvider = require('@backstage/plugin-auth-backend-module-okta-provider');
 var pluginAuthBackendModuleOneloginProvider = require('@backstage/plugin-auth-backend-module-onelogin-provider');
 var passportSaml = require('@node-saml/passport-saml');
-var passportOauth2 = require('passport-oauth2');
-var fetch = require('node-fetch');
+var jose = require('jose');
+var crypto = require('crypto');
+var errors = require('@backstage/errors');
+var pluginAuthBackendModuleBitbucketServerProvider = require('@backstage/plugin-auth-backend-module-bitbucket-server-provider');
 var pluginAuthBackendModuleAzureEasyauthProvider = require('@backstage/plugin-auth-backend-module-azure-easyauth-provider');
 var catalogClient = require('@backstage/catalog-client');
 var minimatch = require('minimatch');
@@ -42,665 +40,105 @@ var firestore = require('@google-cloud/firestore');
 var fs = require('fs');
 var session = require('express-session');
 var connectSessionKnex = require('connect-session-knex');
-var passport = require('passport');
-var config = require('@backstage/config');
-var types = require('@backstage/types');
-
-function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
-
-var express__default = /*#__PURE__*/_interopDefaultCompat(express);
-var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
-var cookieParser__default = /*#__PURE__*/_interopDefaultCompat(cookieParser);
-var Auth0InternalStrategy__default = /*#__PURE__*/_interopDefaultCompat(Auth0InternalStrategy);
-var crypto__default = /*#__PURE__*/_interopDefaultCompat(crypto);
-var fetch__default = /*#__PURE__*/_interopDefaultCompat(fetch);
-var session__default = /*#__PURE__*/_interopDefaultCompat(session);
-var connectSessionKnex__default = /*#__PURE__*/_interopDefaultCompat(connectSessionKnex);
-var passport__default = /*#__PURE__*/_interopDefaultCompat(passport);
-
-function adaptLegacyOAuthHandler(authHandler) {
-  return authHandler && (async (result, ctx) => authHandler(
-    {
-      fullProfile: result.fullProfile,
-      accessToken: result.session.accessToken,
-      params: {
-        scope: result.session.scope,
-        id_token: result.session.idToken,
-        token_type: result.session.tokenType,
-        expires_in: result.session.expiresInSeconds
-      }
-    },
-    ctx
-  ));
-}
-
-function adaptLegacyOAuthSignInResolver(signInResolver) {
-  return signInResolver && (async (input, ctx) => signInResolver(
-    {
-      profile: input.profile,
-      result: {
-        fullProfile: input.result.fullProfile,
-        accessToken: input.result.session.accessToken,
-        refreshToken: input.result.session.refreshToken,
-        params: {
-          scope: input.result.session.scope,
-          id_token: input.result.session.idToken,
-          token_type: input.result.session.tokenType,
-          expires_in: input.result.session.expiresInSeconds
-        }
-      }
-    },
-    ctx
-  ));
-}
-
-function adaptOAuthSignInResolverToLegacy(resolvers) {
-  const legacyResolvers = {};
-  for (const name of Object.keys(resolvers)) {
-    const resolver = resolvers[name];
-    legacyResolvers[name] = () => async (input, ctx) => resolver(
-      {
-        profile: input.profile,
-        result: {
-          fullProfile: input.result.fullProfile,
-          session: {
-            accessToken: input.result.accessToken,
-            expiresInSeconds: input.result.params.expires_in,
-            scope: input.result.params.scope,
-            idToken: input.result.params.id_token,
-            tokenType: input.result.params.token_type ?? "bearer",
-            refreshToken: input.result.refreshToken
-          }
-        }
-      },
-      ctx
-    );
-  }
-  return legacyResolvers;
-}
-
-function createAuthProviderIntegration(config) {
-  return Object.freeze({
-    ...config,
-    resolvers: Object.freeze(config.resolvers ?? {})
-  });
-}
-
-const atlassian = createAuthProviderIntegration({
-  create(options) {
-    return pluginAuthNode.createOAuthProviderFactory({
-      authenticator: pluginAuthBackendModuleAtlassianProvider.atlassianAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
-    });
-  }
-});
-
-class Auth0Strategy extends Auth0InternalStrategy__default.default {
-  constructor(options, verify) {
-    const optionsWithURLs = {
-      ...options,
-      authorizationURL: `https://${options.domain}/authorize`,
-      tokenURL: `https://${options.domain}/oauth/token`,
-      userInfoURL: `https://${options.domain}/userinfo`,
-      apiUrl: `https://${options.domain}/api`
-    };
-    super(optionsWithURLs, verify);
-  }
-}
-
-const OAuthEnvironmentHandler = pluginAuthNode.OAuthEnvironmentHandler;
-
-const readState = pluginAuthNode.decodeOAuthState;
-const encodeState = pluginAuthNode.encodeOAuthState;
-const verifyNonce = (req, providerId) => {
-  const cookieNonce = req.cookies[`${providerId}-nonce`];
-  const state = readState(req.query.state?.toString() ?? "");
-  const stateNonce = state.nonce;
-  if (!cookieNonce) {
-    throw new Error("Auth response is missing cookie nonce");
-  }
-  if (stateNonce.length === 0) {
-    throw new Error("Auth response is missing state nonce");
-  }
-  if (cookieNonce !== stateNonce) {
-    throw new Error("Invalid nonce");
-  }
-};
-const defaultCookieConfigurer = ({
-  callbackUrl,
-  providerId,
-  appOrigin
-}) => {
-  const { hostname: domain, pathname, protocol } = new URL(callbackUrl);
-  const secure = protocol === "https:";
-  let sameSite = "lax";
-  if (new URL(appOrigin).hostname !== domain && secure) {
-    sameSite = "none";
-  }
-  const path = pathname.endsWith(`${providerId}/handler/frame`) ? pathname.slice(0, -"/handler/frame".length) : `${pathname}/${providerId}`;
-  return { domain, path, secure, sameSite };
-};
-
-const safelyEncodeURIComponent = (value) => {
-  return encodeURIComponent(value).replace(/'/g, "%27");
-};
-const postMessageResponse = (res, appOrigin, response) => {
-  const jsonData = JSON.stringify(response);
-  const base64Data = safelyEncodeURIComponent(jsonData);
-  const base64Origin = safelyEncodeURIComponent(appOrigin);
-  const script = `
-    var authResponse = decodeURIComponent('${base64Data}');
-    var origin = decodeURIComponent('${base64Origin}');
-    var originInfo = {'type': 'config_info', 'targetOrigin': origin};
-    (window.opener || window.parent).postMessage(originInfo, '*');
-    (window.opener || window.parent).postMessage(JSON.parse(authResponse), origin);
-    setTimeout(() => {
-      window.close();
-    }, 100); // same as the interval of the core-app-api lib/loginPopup.ts (to address race conditions)
-  `;
-  const hash = crypto__default.default.createHash("sha256").update(script).digest("base64");
-  res.setHeader("Content-Type", "text/html");
-  res.setHeader("X-Frame-Options", "sameorigin");
-  res.setHeader("Content-Security-Policy", `script-src 'sha256-${hash}'`);
-  res.end(`<html><body><script>${script}<\/script></body></html>`);
-};
-const ensuresXRequestedWith = (req) => {
-  const requiredHeader = req.header("X-Requested-With");
-  if (!requiredHeader || requiredHeader !== "XMLHttpRequest") {
-    return false;
-  }
-  return true;
-};
-
-const prepareBackstageIdentityResponse = pluginAuthNode.prepareBackstageIdentityResponse;
-
-const THOUSAND_DAYS_MS = 1e3 * 24 * 60 * 60 * 1e3;
-const TEN_MINUTES_MS = 600 * 1e3;
-class OAuthAdapter {
-  constructor(handlers, options) {
-    this.handlers = handlers;
-    this.options = options;
-    this.baseCookieOptions = {
-      httpOnly: true,
-      sameSite: "lax"
-    };
-  }
-  static fromConfig(config, handlers, options) {
-    const { appUrl, baseUrl, isOriginAllowed } = config;
-    const { origin: appOrigin } = new url.URL(appUrl);
-    const cookieConfigurer = config.cookieConfigurer ?? defaultCookieConfigurer;
-    return new OAuthAdapter(handlers, {
-      ...options,
-      appOrigin,
-      baseUrl,
-      cookieConfigurer,
-      isOriginAllowed
-    });
-  }
-  baseCookieOptions;
-  async start(req, res) {
-    const scope = req.query.scope?.toString() ?? "";
-    const env = req.query.env?.toString();
-    const origin = req.query.origin?.toString();
-    const redirectUrl = req.query.redirectUrl?.toString();
-    const flow = req.query.flow?.toString();
-    if (!env) {
-      throw new errors.InputError("No env provided in request query parameters");
-    }
-    const cookieConfig = this.getCookieConfig(origin);
-    const nonce = crypto__default.default.randomBytes(16).toString("base64");
-    this.setNonceCookie(res, nonce, cookieConfig);
-    const state = { nonce, env, origin, redirectUrl, flow };
-    if (this.options.persistScopes) {
-      state.scope = scope;
-    }
-    const forwardReq = Object.assign(req, { scope, state });
-    const { url, status } = await this.handlers.start(
-      forwardReq
-    );
-    res.statusCode = status || 302;
-    res.setHeader("Location", url);
-    res.setHeader("Content-Length", "0");
-    res.end();
-  }
-  async frameHandler(req, res) {
-    let appOrigin = this.options.appOrigin;
-    try {
-      const state = readState(req.query.state?.toString() ?? "");
-      if (state.origin) {
-        try {
-          appOrigin = new url.URL(state.origin).origin;
-        } catch {
-          throw new errors.NotAllowedError("App origin is invalid, failed to parse");
-        }
-        if (!this.options.isOriginAllowed(appOrigin)) {
-          throw new errors.NotAllowedError(`Origin '${appOrigin}' is not allowed`);
-        }
-      }
-      verifyNonce(req, this.options.providerId);
-      const { response, refreshToken } = await this.handlers.handler(req);
-      const cookieConfig = this.getCookieConfig(appOrigin);
-      if (this.options.persistScopes && state.scope) {
-        this.setGrantedScopeCookie(res, state.scope, cookieConfig);
-        response.providerInfo.scope = state.scope;
-      }
-      if (refreshToken) {
-        this.setRefreshTokenCookie(res, refreshToken, cookieConfig);
-      }
-      const identity = await this.populateIdentity(response.backstageIdentity);
-      const responseObj = {
-        type: "authorization_response",
-        response: { ...response, backstageIdentity: identity }
-      };
-      if (state.flow === "redirect") {
-        if (!state.redirectUrl) {
-          throw new errors.InputError(
-            "No redirectUrl provided in request query parameters"
-          );
-        }
-        res.redirect(state.redirectUrl);
-        return void 0;
-      }
-      return postMessageResponse(res, appOrigin, responseObj);
-    } catch (error) {
-      const { name, message } = errors.isError(error) ? error : new Error("Encountered invalid error");
-      return postMessageResponse(res, appOrigin, {
-        type: "authorization_response",
-        error: { name, message }
-      });
-    }
-  }
-  async logout(req, res) {
-    if (!ensuresXRequestedWith(req)) {
-      throw new errors.AuthenticationError("Invalid X-Requested-With header");
-    }
-    if (this.handlers.logout) {
-      const refreshToken = this.getRefreshTokenFromCookie(req);
-      const revokeRequest = Object.assign(req, {
-        refreshToken
-      });
-      await this.handlers.logout(revokeRequest);
-    }
-    const origin = req.get("origin");
-    const cookieConfig = this.getCookieConfig(origin);
-    this.removeRefreshTokenCookie(res, cookieConfig);
-    res.status(200).end();
-  }
-  async refresh(req, res) {
-    if (!ensuresXRequestedWith(req)) {
-      throw new errors.AuthenticationError("Invalid X-Requested-With header");
-    }
-    if (!this.handlers.refresh) {
-      throw new errors.InputError(
-        `Refresh token is not supported for provider ${this.options.providerId}`
-      );
-    }
-    try {
-      const refreshToken = this.getRefreshTokenFromCookie(req);
-      if (!refreshToken) {
-        throw new errors.InputError("Missing session cookie");
-      }
-      let scope = req.query.scope?.toString() ?? "";
-      if (this.options.persistScopes) {
-        scope = this.getGrantedScopeFromCookie(req);
-      }
-      const forwardReq = Object.assign(req, { scope, refreshToken });
-      const { response, refreshToken: newRefreshToken } = await this.handlers.refresh(forwardReq);
-      const backstageIdentity = await this.populateIdentity(
-        response.backstageIdentity
-      );
-      if (newRefreshToken && newRefreshToken !== refreshToken) {
-        const origin = req.get("origin");
-        const cookieConfig = this.getCookieConfig(origin);
-        this.setRefreshTokenCookie(res, newRefreshToken, cookieConfig);
-      }
-      res.status(200).json({ ...response, backstageIdentity });
-    } catch (error) {
-      throw new errors.AuthenticationError("Refresh failed", error);
-    }
-  }
-  /**
-   * If the response from the OAuth provider includes a Backstage identity, we
-   * make sure it's populated with all the information we can derive from the user ID.
-   */
-  async populateIdentity(identity) {
-    if (!identity) {
-      return void 0;
-    }
-    if (!identity.token) {
-      throw new errors.InputError(`Identity response must return a token`);
-    }
-    return prepareBackstageIdentityResponse(identity);
-  }
-  setNonceCookie = (res, nonce, cookieConfig) => {
-    res.cookie(`${this.options.providerId}-nonce`, nonce, {
-      maxAge: TEN_MINUTES_MS,
-      ...this.baseCookieOptions,
-      ...cookieConfig,
-      path: `${cookieConfig.path}/handler`
-    });
-  };
-  setGrantedScopeCookie = (res, scope, cookieConfig) => {
-    res.cookie(`${this.options.providerId}-granted-scope`, scope, {
-      maxAge: THOUSAND_DAYS_MS,
-      ...this.baseCookieOptions,
-      ...cookieConfig
-    });
-  };
-  getRefreshTokenFromCookie = (req) => {
-    return req.cookies[`${this.options.providerId}-refresh-token`];
-  };
-  getGrantedScopeFromCookie = (req) => {
-    return req.cookies[`${this.options.providerId}-granted-scope`];
-  };
-  setRefreshTokenCookie = (res, refreshToken, cookieConfig) => {
-    res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
-      maxAge: THOUSAND_DAYS_MS,
-      ...this.baseCookieOptions,
-      ...cookieConfig
-    });
-  };
-  removeRefreshTokenCookie = (res, cookieConfig) => {
-    res.cookie(`${this.options.providerId}-refresh-token`, "", {
-      maxAge: 0,
-      ...this.baseCookieOptions,
-      ...cookieConfig
-    });
-  };
-  getCookieConfig = (origin) => {
-    return this.options.cookieConfigurer({
-      providerId: this.options.providerId,
-      baseUrl: this.options.baseUrl,
-      callbackUrl: this.options.callbackUrl,
-      appOrigin: origin ?? this.options.appOrigin
-    });
-  };
-}
-
-const makeProfileInfo = (profile, idToken) => {
-  let email = void 0;
-  if (profile.emails && profile.emails.length > 0) {
-    const [firstEmail] = profile.emails;
-    email = firstEmail.value;
-  }
-  let picture = void 0;
-  if (profile.avatarUrl) {
-    picture = profile.avatarUrl;
-  } else if (profile.photos && profile.photos.length > 0) {
-    const [firstPhoto] = profile.photos;
-    picture = firstPhoto.value;
-  }
-  let displayName = profile.displayName ?? profile.username ?? profile.id;
-  if ((!email || !picture || !displayName) && idToken) {
-    try {
-      const decoded = jose.decodeJwt(idToken);
-      if (!email && decoded.email) {
-        email = decoded.email;
-      }
-      if (!picture && decoded.picture) {
-        picture = decoded.picture;
-      }
-      if (!displayName && decoded.name) {
-        displayName = decoded.name;
-      }
-    } catch (e) {
-      throw new Error(`Failed to parse id token and get profile info, ${e}`);
-    }
-  }
-  return {
-    email,
-    picture,
-    displayName
-  };
-};
-const executeRedirectStrategy = async (req, providerStrategy, options) => {
-  return new Promise((resolve) => {
-    const strategy = Object.create(providerStrategy);
-    strategy.redirect = (url, status) => {
-      resolve({ url, status: status ?? void 0 });
-    };
-    strategy.authenticate(req, { ...options });
-  });
-};
-const executeFrameHandlerStrategy = async (req, providerStrategy, options) => {
-  return new Promise(
-    (resolve, reject) => {
-      const strategy = Object.create(providerStrategy);
-      strategy.success = (result, privateInfo) => {
-        resolve({ result, privateInfo });
-      };
-      strategy.fail = (info) => {
-        reject(new Error(`Authentication rejected, ${info.message ?? ""}`));
-      };
-      strategy.error = (error) => {
-        let message = `Authentication failed, ${error.message}`;
-        if (error.oauthError?.data) {
-          try {
-            const errorData = JSON.parse(error.oauthError.data);
-            if (errorData.message) {
-              message += ` - ${errorData.message}`;
-            }
-          } catch (parseError) {
-            message += ` - ${error.oauthError}`;
-          }
-        }
-        reject(new Error(message));
-      };
-      strategy.redirect = () => {
-        reject(new Error("Unexpected redirect"));
-      };
-      strategy.authenticate(req, { ...options ?? {} });
-    }
-  );
-};
-const executeRefreshTokenStrategy = async (providerStrategy, refreshToken, scope) => {
-  return new Promise((resolve, reject) => {
-    const anyStrategy = providerStrategy;
-    const OAuth2 = anyStrategy._oauth2.constructor;
-    const oauth2 = new OAuth2(
-      anyStrategy._oauth2._clientId,
-      anyStrategy._oauth2._clientSecret,
-      anyStrategy._oauth2._baseSite,
-      anyStrategy._oauth2._authorizeUrl,
-      anyStrategy._refreshURL || anyStrategy._oauth2._accessTokenUrl,
-      anyStrategy._oauth2._customHeaders
-    );
-    oauth2.getOAuthAccessToken(
-      refreshToken,
-      {
-        scope,
-        grant_type: "refresh_token"
-      },
-      (err, accessToken, newRefreshToken, params) => {
-        if (err) {
-          reject(new Error(`Failed to refresh access token ${err.toString()}`));
-        }
-        if (!accessToken) {
-          reject(
-            new Error(
-              `Failed to refresh access token, no access token received`
-            )
-          );
-        }
-        resolve({
-          accessToken,
-          refreshToken: newRefreshToken,
-          params
-        });
+var passport = require('passport');
+var config = require('@backstage/config');
+var types = require('@backstage/types');
+var url = require('url');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var express__default = /*#__PURE__*/_interopDefaultCompat(express);
+var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
+var cookieParser__default = /*#__PURE__*/_interopDefaultCompat(cookieParser);
+var crypto__default = /*#__PURE__*/_interopDefaultCompat(crypto);
+var session__default = /*#__PURE__*/_interopDefaultCompat(session);
+var connectSessionKnex__default = /*#__PURE__*/_interopDefaultCompat(connectSessionKnex);
+var passport__default = /*#__PURE__*/_interopDefaultCompat(passport);
+
+function adaptLegacyOAuthHandler(authHandler) {
+  return authHandler && (async (result, ctx) => authHandler(
+    {
+      fullProfile: result.fullProfile,
+      accessToken: result.session.accessToken,
+      params: {
+        scope: result.session.scope,
+        id_token: result.session.idToken,
+        token_type: result.session.tokenType,
+        expires_in: result.session.expiresInSeconds
       }
-    );
-  });
-};
-const executeFetchUserProfileStrategy = async (providerStrategy, accessToken) => {
-  return new Promise((resolve, reject) => {
-    const anyStrategy = providerStrategy;
-    anyStrategy.userProfile(
-      accessToken,
-      (error, rawProfile) => {
-        if (error) {
-          reject(error);
-        } else {
-          resolve(rawProfile);
+    },
+    ctx
+  ));
+}
+
+function adaptLegacyOAuthSignInResolver(signInResolver) {
+  return signInResolver && (async (input, ctx) => signInResolver(
+    {
+      profile: input.profile,
+      result: {
+        fullProfile: input.result.fullProfile,
+        accessToken: input.result.session.accessToken,
+        refreshToken: input.result.session.refreshToken,
+        params: {
+          scope: input.result.session.scope,
+          id_token: input.result.session.idToken,
+          token_type: input.result.session.tokenType,
+          expires_in: input.result.session.expiresInSeconds
         }
       }
-    );
-  });
-};
-
-class Auth0AuthProvider {
-  _strategy;
-  signInResolver;
-  authHandler;
-  resolverContext;
-  audience;
-  connection;
-  connectionScope;
-  /**
-   * Due to passport-auth0 forcing options.state = true,
-   * passport-oauth2 requires express-session to be installed
-   * so that the 'state' parameter of the oauth2 flow can be stored.
-   * This implementation of StateStore matches the NullStore found within
-   * passport-oauth2, which is the StateStore implementation used when options.state = false,
-   * allowing us to avoid using express-session in order to integrate with auth0.
-   */
-  store = {
-    store(_req, cb) {
-      cb(null, null);
     },
-    verify(_req, _state, cb) {
-      cb(null, true);
-    }
-  };
-  constructor(options) {
-    this.signInResolver = options.signInResolver;
-    this.authHandler = options.authHandler;
-    this.resolverContext = options.resolverContext;
-    this.audience = options.audience;
-    this.connection = options.connection;
-    this.connectionScope = options.connectionScope;
-    this._strategy = new Auth0Strategy(
+    ctx
+  ));
+}
+
+function adaptOAuthSignInResolverToLegacy(resolvers) {
+  const legacyResolvers = {};
+  for (const name of Object.keys(resolvers)) {
+    const resolver = resolvers[name];
+    legacyResolvers[name] = () => async (input, ctx) => resolver(
       {
-        clientID: options.clientId,
-        clientSecret: options.clientSecret,
-        callbackURL: options.callbackUrl,
-        domain: options.domain,
-        // We need passReqToCallback set to false to get params, but there's
-        // no matching type signature for that, so instead behold this beauty
-        passReqToCallback: false,
-        store: this.store
-      },
-      (accessToken, refreshToken, params, fullProfile, done) => {
-        done(
-          void 0,
-          {
-            fullProfile,
-            accessToken,
-            refreshToken,
-            params
-          },
-          {
-            refreshToken
+        profile: input.profile,
+        result: {
+          fullProfile: input.result.fullProfile,
+          session: {
+            accessToken: input.result.accessToken,
+            expiresInSeconds: input.result.params.expires_in,
+            scope: input.result.params.scope,
+            idToken: input.result.params.id_token,
+            tokenType: input.result.params.token_type ?? "bearer",
+            refreshToken: input.result.refreshToken
           }
-        );
-      }
+        }
+      },
+      ctx
     );
   }
-  async start(req) {
-    return await executeRedirectStrategy(req, this._strategy, {
-      accessType: "offline",
-      prompt: "consent",
-      scope: req.scope,
-      state: encodeState(req.state),
-      ...this.audience ? { audience: this.audience } : {},
-      ...this.connection ? { connection: this.connection } : {},
-      ...this.connectionScope ? { connection_scope: this.connectionScope } : {}
-    });
-  }
-  async handler(req) {
-    const { result, privateInfo } = await executeFrameHandlerStrategy(req, this._strategy, {
-      ...this.audience ? { audience: this.audience } : {},
-      ...this.connection ? { connection: this.connection } : {},
-      ...this.connectionScope ? { connection_scope: this.connectionScope } : {}
+  return legacyResolvers;
+}
+
+function createAuthProviderIntegration(config) {
+  return Object.freeze({
+    ...config,
+    resolvers: Object.freeze(config.resolvers ?? {})
+  });
+}
+
+const atlassian = createAuthProviderIntegration({
+  create(options) {
+    return pluginAuthNode.createOAuthProviderFactory({
+      authenticator: pluginAuthBackendModuleAtlassianProvider.atlassianAuthenticator,
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
-    return {
-      response: await this.handleResult(result),
-      refreshToken: privateInfo.refreshToken
-    };
-  }
-  async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
-      this._strategy,
-      req.refreshToken,
-      req.scope
-    );
-    const fullProfile = await executeFetchUserProfileStrategy(
-      this._strategy,
-      accessToken
-    );
-    return {
-      response: await this.handleResult({
-        fullProfile,
-        params,
-        accessToken
-      }),
-      refreshToken
-    };
-  }
-  async handleResult(result) {
-    const { profile } = await this.authHandler(result, this.resolverContext);
-    const response = {
-      providerInfo: {
-        idToken: result.params.id_token,
-        accessToken: result.accessToken,
-        scope: result.params.scope,
-        expiresInSeconds: result.params.expires_in
-      },
-      profile
-    };
-    if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver(
-        {
-          result,
-          profile
-        },
-        this.resolverContext
-      );
-    }
-    return response;
   }
-}
+});
+
 const auth0 = createAuthProviderIntegration({
   create(options) {
-    return ({ providerId, globalConfig, config, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
-      const clientId = envConfig.getString("clientId");
-      const clientSecret = envConfig.getString("clientSecret");
-      const domain = envConfig.getString("domain");
-      const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
-      const audience = envConfig.getOptionalString("audience");
-      const connection = envConfig.getOptionalString("connection");
-      const connectionScope = envConfig.getOptionalString("connectionScope");
-      const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
-      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile, params }) => ({
-        profile: makeProfileInfo(fullProfile, params.id_token)
-      });
-      const signInResolver = options?.signIn?.resolver;
-      const provider = new Auth0AuthProvider({
-        clientId,
-        clientSecret,
-        callbackUrl,
-        domain,
-        authHandler,
-        signInResolver,
-        resolverContext,
-        audience,
-        connection,
-        connectionScope
-      });
-      return OAuthAdapter.fromConfig(globalConfig, provider, {
-        providerId,
-        callbackUrl
-      });
+    return pluginAuthNode.createOAuthProviderFactory({
+      authenticator: pluginAuthBackendModuleAuth0Provider.auth0Authenticator,
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   }
 });
@@ -963,6 +401,80 @@ const onelogin = createAuthProviderIntegration({
   }
 });
 
+const executeRedirectStrategy = async (req, providerStrategy, options) => {
+  return new Promise((resolve) => {
+    const strategy = Object.create(providerStrategy);
+    strategy.redirect = (url, status) => {
+      resolve({ url, status: status ?? void 0 });
+    };
+    strategy.authenticate(req, { ...options });
+  });
+};
+const executeFrameHandlerStrategy = async (req, providerStrategy, options) => {
+  return new Promise(
+    (resolve, reject) => {
+      const strategy = Object.create(providerStrategy);
+      strategy.success = (result, privateInfo) => {
+        resolve({ result, privateInfo });
+      };
+      strategy.fail = (info) => {
+        reject(new Error(`Authentication rejected, ${info.message ?? ""}`));
+      };
+      strategy.error = (error) => {
+        let message = `Authentication failed, ${error.message}`;
+        if (error.oauthError?.data) {
+          try {
+            const errorData = JSON.parse(error.oauthError.data);
+            if (errorData.message) {
+              message += ` - ${errorData.message}`;
+            }
+          } catch (parseError) {
+            message += ` - ${error.oauthError}`;
+          }
+        }
+        reject(new Error(message));
+      };
+      strategy.redirect = () => {
+        reject(new Error("Unexpected redirect"));
+      };
+      strategy.authenticate(req, { ...{} });
+    }
+  );
+};
+
+const safelyEncodeURIComponent = (value) => {
+  return encodeURIComponent(value).replace(/'/g, "%27");
+};
+const postMessageResponse = (res, appOrigin, response) => {
+  const jsonData = JSON.stringify(response);
+  const base64Data = safelyEncodeURIComponent(jsonData);
+  const base64Origin = safelyEncodeURIComponent(appOrigin);
+  const script = `
+    var authResponse = decodeURIComponent('${base64Data}');
+    var origin = decodeURIComponent('${base64Origin}');
+    var originInfo = {'type': 'config_info', 'targetOrigin': origin};
+    (window.opener || window.parent).postMessage(originInfo, '*');
+    (window.opener || window.parent).postMessage(JSON.parse(authResponse), origin);
+    setTimeout(() => {
+      window.close();
+    }, 100); // same as the interval of the core-app-api lib/loginPopup.ts (to address race conditions)
+  `;
+  const hash = crypto__default.default.createHash("sha256").update(script).digest("base64");
+  res.setHeader("Content-Type", "text/html");
+  res.setHeader("X-Frame-Options", "sameorigin");
+  res.setHeader("Content-Security-Policy", `script-src 'sha256-${hash}'`);
+  res.end(`<html><body><script>${script}<\/script></body></html>`);
+};
+const ensuresXRequestedWith = (req) => {
+  const requiredHeader = req.header("X-Requested-With");
+  if (!requiredHeader || requiredHeader !== "XMLHttpRequest") {
+    return false;
+  }
+  return true;
+};
+
+const prepareBackstageIdentityResponse = pluginAuthNode.prepareBackstageIdentityResponse;
+
 class SamlAuthProvider {
   strategy;
   signInResolver;
@@ -1035,7 +547,7 @@ const saml = createAuthProviderIntegration({
         logoutUrl: config.getOptionalString("logoutUrl"),
         audience: config.getString("audience"),
         issuer: config.getString("issuer"),
-        cert: config.getString("cert"),
+        idpCert: config.getString("cert"),
         privateKey: config.getOptionalString("privateKey"),
         authnContext: config.getOptionalStringArray("authnContext"),
         identifierFormat: config.getOptionalString("identifierFormat"),
@@ -1070,175 +582,41 @@ const saml = createAuthProviderIntegration({
       };
     }
   }
-});
-
-class BitbucketServerAuthProvider {
-  signInResolver;
-  authHandler;
-  resolverContext;
-  strategy;
-  host;
-  constructor(options) {
-    this.signInResolver = options.signInResolver;
-    this.authHandler = options.authHandler;
-    this.resolverContext = options.resolverContext;
-    this.strategy = new passportOauth2.Strategy(
-      {
-        authorizationURL: options.authorizationUrl,
-        tokenURL: options.tokenUrl,
-        clientID: options.clientId,
-        clientSecret: options.clientSecret,
-        callbackURL: options.callbackUrl
-      },
-      (accessToken, refreshToken, params, fullProfile, done) => {
-        done(void 0, { fullProfile, params, accessToken }, { refreshToken });
-      }
-    );
-    this.host = options.host;
-  }
-  async start(req) {
-    return await executeRedirectStrategy(req, this.strategy, {
-      accessType: "offline",
-      prompt: "consent",
-      scope: req.scope,
-      state: encodeState(req.state)
-    });
-  }
-  async handler(req) {
-    const { result, privateInfo } = await executeFrameHandlerStrategy(req, this.strategy);
-    return {
-      response: await this.handleResult(result),
-      refreshToken: privateInfo.refreshToken
-    };
-  }
-  async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
-      this.strategy,
-      req.refreshToken,
-      req.scope
-    );
-    const fullProfile = await executeFetchUserProfileStrategy(
-      this.strategy,
-      accessToken
-    );
-    return {
-      response: await this.handleResult({
-        fullProfile,
-        params,
-        accessToken
-      }),
-      refreshToken
-    };
-  }
-  async handleResult(result) {
-    result.fullProfile = await this.fetchProfile(result);
-    const { profile } = await this.authHandler(result, this.resolverContext);
-    let backstageIdentity = void 0;
-    if (this.signInResolver) {
-      backstageIdentity = await this.signInResolver(
-        { result, profile },
-        this.resolverContext
-      );
-    }
-    return {
-      providerInfo: {
-        accessToken: result.accessToken,
-        scope: result.params.scope,
-        expiresInSeconds: result.params.expires_in
-      },
-      profile,
-      backstageIdentity
-    };
-  }
-  async fetchProfile(result) {
-    let whoAmIResponse;
-    try {
-      whoAmIResponse = await fetch__default.default(
-        `https://${this.host}/plugins/servlet/applinks/whoami`,
-        {
-          headers: {
-            Authorization: `Bearer ${result.accessToken}`
-          }
-        }
-      );
-    } catch (e) {
-      throw new Error(`Failed to retrieve the username of the logged in user`);
-    }
-    const username = whoAmIResponse.headers.get("X-Ausername");
-    if (!username) {
-      throw new Error(`Failed to retrieve the username of the logged in user`);
-    }
-    let userResponse;
-    try {
-      userResponse = await fetch__default.default(
-        `https://${this.host}/rest/api/latest/users/${username}?avatarSize=256`,
-        {
-          headers: {
-            Authorization: `Bearer ${result.accessToken}`
-          }
-        }
-      );
-    } catch (e) {
-      throw new Error(`Failed to retrieve the user '${username}'`);
-    }
-    if (!userResponse.ok) {
-      throw new Error(`Failed to retrieve the user '${username}'`);
-    }
-    const user = await userResponse.json();
-    const passportProfile = {
-      provider: "bitbucketServer",
-      id: user.id.toString(),
-      displayName: user.displayName,
-      username: user.name,
-      emails: [
-        {
-          value: user.emailAddress
-        }
-      ]
-    };
-    if (user.avatarUrl) {
-      passportProfile.photos = [
-        { value: `https://${this.host}${user.avatarUrl}` }
-      ];
-    }
-    return passportProfile;
-  }
-}
+});
+
 const bitbucketServer = createAuthProviderIntegration({
   create(options) {
-    return ({ providerId, globalConfig, config, resolverContext }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
-      const clientId = envConfig.getString("clientId");
-      const clientSecret = envConfig.getString("clientSecret");
-      const host = envConfig.getString("host");
-      const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
-      const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
-      const authorizationUrl = `https://${host}/rest/oauth2/latest/authorize`;
-      const tokenUrl = `https://${host}/rest/oauth2/latest/token`;
-      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile }) => ({
-        profile: makeProfileInfo(fullProfile)
-      });
-      const provider = new BitbucketServerAuthProvider({
-        callbackUrl,
-        clientId,
-        clientSecret,
-        host,
-        authorizationUrl,
-        tokenUrl,
-        authHandler,
-        signInResolver: options?.signIn?.resolver,
-        resolverContext
-      });
-      return OAuthAdapter.fromConfig(globalConfig, provider, {
-        providerId,
-        callbackUrl
-      });
+    return pluginAuthNode.createOAuthProviderFactory({
+      authenticator: pluginAuthBackendModuleBitbucketServerProvider.bitbucketServerAuthenticator,
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver)
     });
   },
   resolvers: {
     /**
      * Looks up the user by matching their email to the entity email.
      */
-    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver
+    emailMatchingUserEntityProfileEmail: () => {
+      const resolver = pluginAuthBackendModuleBitbucketServerProvider.bitbucketServerSignInResolvers.emailMatchingUserEntityProfileEmail();
+      return async (info, ctx) => {
+        return resolver(
+          {
+            profile: info.profile,
+            result: {
+              fullProfile: info.result.fullProfile,
+              session: {
+                accessToken: info.result.accessToken,
+                tokenType: info.result.params.token_type ?? "bearer",
+                scope: info.result.params.scope,
+                expiresInSeconds: info.result.params.expires_in,
+                refreshToken: info.result.refreshToken
+              }
+            }
+          },
+          ctx
+        );
+      };
+    }
   }
 });
 
@@ -2353,6 +1731,242 @@ const authPlugin = backendPluginApi.createBackendPlugin({
   }
 });
 
+const OAuthEnvironmentHandler = pluginAuthNode.OAuthEnvironmentHandler;
+
+const readState = pluginAuthNode.decodeOAuthState;
+const encodeState = pluginAuthNode.encodeOAuthState;
+const verifyNonce = (req, providerId) => {
+  const cookieNonce = req.cookies[`${providerId}-nonce`];
+  const state = readState(req.query.state?.toString() ?? "");
+  const stateNonce = state.nonce;
+  if (!cookieNonce) {
+    throw new Error("Auth response is missing cookie nonce");
+  }
+  if (stateNonce.length === 0) {
+    throw new Error("Auth response is missing state nonce");
+  }
+  if (cookieNonce !== stateNonce) {
+    throw new Error("Invalid nonce");
+  }
+};
+const defaultCookieConfigurer = ({
+  callbackUrl,
+  providerId,
+  appOrigin
+}) => {
+  const { hostname: domain, pathname, protocol } = new URL(callbackUrl);
+  const secure = protocol === "https:";
+  let sameSite = "lax";
+  if (new URL(appOrigin).hostname !== domain && secure) {
+    sameSite = "none";
+  }
+  const path = pathname.endsWith(`${providerId}/handler/frame`) ? pathname.slice(0, -"/handler/frame".length) : `${pathname}/${providerId}`;
+  return { domain, path, secure, sameSite };
+};
+
+const THOUSAND_DAYS_MS = 1e3 * 24 * 60 * 60 * 1e3;
+const TEN_MINUTES_MS = 600 * 1e3;
+class OAuthAdapter {
+  constructor(handlers, options) {
+    this.handlers = handlers;
+    this.options = options;
+    this.baseCookieOptions = {
+      httpOnly: true,
+      sameSite: "lax"
+    };
+  }
+  static fromConfig(config, handlers, options) {
+    const { appUrl, baseUrl, isOriginAllowed } = config;
+    const { origin: appOrigin } = new url.URL(appUrl);
+    const cookieConfigurer = config.cookieConfigurer ?? defaultCookieConfigurer;
+    return new OAuthAdapter(handlers, {
+      ...options,
+      appOrigin,
+      baseUrl,
+      cookieConfigurer,
+      isOriginAllowed
+    });
+  }
+  baseCookieOptions;
+  async start(req, res) {
+    const scope = req.query.scope?.toString() ?? "";
+    const env = req.query.env?.toString();
+    const origin = req.query.origin?.toString();
+    const redirectUrl = req.query.redirectUrl?.toString();
+    const flow = req.query.flow?.toString();
+    if (!env) {
+      throw new errors.InputError("No env provided in request query parameters");
+    }
+    const cookieConfig = this.getCookieConfig(origin);
+    const nonce = crypto__default.default.randomBytes(16).toString("base64");
+    this.setNonceCookie(res, nonce, cookieConfig);
+    const state = { nonce, env, origin, redirectUrl, flow };
+    if (this.options.persistScopes) {
+      state.scope = scope;
+    }
+    const forwardReq = Object.assign(req, { scope, state });
+    const { url, status } = await this.handlers.start(
+      forwardReq
+    );
+    res.statusCode = status || 302;
+    res.setHeader("Location", url);
+    res.setHeader("Content-Length", "0");
+    res.end();
+  }
+  async frameHandler(req, res) {
+    let appOrigin = this.options.appOrigin;
+    try {
+      const state = readState(req.query.state?.toString() ?? "");
+      if (state.origin) {
+        try {
+          appOrigin = new url.URL(state.origin).origin;
+        } catch {
+          throw new errors.NotAllowedError("App origin is invalid, failed to parse");
+        }
+        if (!this.options.isOriginAllowed(appOrigin)) {
+          throw new errors.NotAllowedError(`Origin '${appOrigin}' is not allowed`);
+        }
+      }
+      verifyNonce(req, this.options.providerId);
+      const { response, refreshToken } = await this.handlers.handler(req);
+      const cookieConfig = this.getCookieConfig(appOrigin);
+      if (this.options.persistScopes && state.scope) {
+        this.setGrantedScopeCookie(res, state.scope, cookieConfig);
+        response.providerInfo.scope = state.scope;
+      }
+      if (refreshToken) {
+        this.setRefreshTokenCookie(res, refreshToken, cookieConfig);
+      }
+      const identity = await this.populateIdentity(response.backstageIdentity);
+      const responseObj = {
+        type: "authorization_response",
+        response: { ...response, backstageIdentity: identity }
+      };
+      if (state.flow === "redirect") {
+        if (!state.redirectUrl) {
+          throw new errors.InputError(
+            "No redirectUrl provided in request query parameters"
+          );
+        }
+        res.redirect(state.redirectUrl);
+        return void 0;
+      }
+      return postMessageResponse(res, appOrigin, responseObj);
+    } catch (error) {
+      const { name, message } = errors.isError(error) ? error : new Error("Encountered invalid error");
+      return postMessageResponse(res, appOrigin, {
+        type: "authorization_response",
+        error: { name, message }
+      });
+    }
+  }
+  async logout(req, res) {
+    if (!ensuresXRequestedWith(req)) {
+      throw new errors.AuthenticationError("Invalid X-Requested-With header");
+    }
+    if (this.handlers.logout) {
+      const refreshToken = this.getRefreshTokenFromCookie(req);
+      const revokeRequest = Object.assign(req, {
+        refreshToken
+      });
+      await this.handlers.logout(revokeRequest);
+    }
+    const origin = req.get("origin");
+    const cookieConfig = this.getCookieConfig(origin);
+    this.removeRefreshTokenCookie(res, cookieConfig);
+    res.status(200).end();
+  }
+  async refresh(req, res) {
+    if (!ensuresXRequestedWith(req)) {
+      throw new errors.AuthenticationError("Invalid X-Requested-With header");
+    }
+    if (!this.handlers.refresh) {
+      throw new errors.InputError(
+        `Refresh token is not supported for provider ${this.options.providerId}`
+      );
+    }
+    try {
+      const refreshToken = this.getRefreshTokenFromCookie(req);
+      if (!refreshToken) {
+        throw new errors.InputError("Missing session cookie");
+      }
+      let scope = req.query.scope?.toString() ?? "";
+      if (this.options.persistScopes) {
+        scope = this.getGrantedScopeFromCookie(req);
+      }
+      const forwardReq = Object.assign(req, { scope, refreshToken });
+      const { response, refreshToken: newRefreshToken } = await this.handlers.refresh(forwardReq);
+      const backstageIdentity = await this.populateIdentity(
+        response.backstageIdentity
+      );
+      if (newRefreshToken && newRefreshToken !== refreshToken) {
+        const origin = req.get("origin");
+        const cookieConfig = this.getCookieConfig(origin);
+        this.setRefreshTokenCookie(res, newRefreshToken, cookieConfig);
+      }
+      res.status(200).json({ ...response, backstageIdentity });
+    } catch (error) {
+      throw new errors.AuthenticationError("Refresh failed", error);
+    }
+  }
+  /**
+   * If the response from the OAuth provider includes a Backstage identity, we
+   * make sure it's populated with all the information we can derive from the user ID.
+   */
+  async populateIdentity(identity) {
+    if (!identity) {
+      return void 0;
+    }
+    if (!identity.token) {
+      throw new errors.InputError(`Identity response must return a token`);
+    }
+    return prepareBackstageIdentityResponse(identity);
+  }
+  setNonceCookie = (res, nonce, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-nonce`, nonce, {
+      maxAge: TEN_MINUTES_MS,
+      ...this.baseCookieOptions,
+      ...cookieConfig,
+      path: `${cookieConfig.path}/handler`
+    });
+  };
+  setGrantedScopeCookie = (res, scope, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-granted-scope`, scope, {
+      maxAge: THOUSAND_DAYS_MS,
+      ...this.baseCookieOptions,
+      ...cookieConfig
+    });
+  };
+  getRefreshTokenFromCookie = (req) => {
+    return req.cookies[`${this.options.providerId}-refresh-token`];
+  };
+  getGrantedScopeFromCookie = (req) => {
+    return req.cookies[`${this.options.providerId}-granted-scope`];
+  };
+  setRefreshTokenCookie = (res, refreshToken, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
+      maxAge: THOUSAND_DAYS_MS,
+      ...this.baseCookieOptions,
+      ...cookieConfig
+    });
+  };
+  removeRefreshTokenCookie = (res, cookieConfig) => {
+    res.cookie(`${this.options.providerId}-refresh-token`, "", {
+      maxAge: 0,
+      ...this.baseCookieOptions,
+      ...cookieConfig
+    });
+  };
+  getCookieConfig = (origin) => {
+    return this.options.cookieConfigurer({
+      providerId: this.options.providerId,
+      baseUrl: this.options.baseUrl,
+      callbackUrl: this.options.callbackUrl,
+      appOrigin: origin ?? this.options.appOrigin
+    });
+  };
+}
+
 exports.CatalogIdentityClient = CatalogIdentityClient;
 exports.OAuthAdapter = OAuthAdapter;
 exports.OAuthEnvironmentHandler = OAuthEnvironmentHandler;