@backstage/plugin-auth-backend 0.23.1-next.0 → 0.23.1-next.1

package/dist/providers/saml/provider.cjs.js

@@ -0,0 +1,121 @@
+'use strict';
+
+var passportSaml = require('@node-saml/passport-saml');
+var PassportStrategyHelper = require('../../lib/passport/PassportStrategyHelper.cjs.js');
+var authFlowHelpers = require('../../lib/flow/authFlowHelpers.cjs.js');
+var createAuthProviderIntegration = require('../createAuthProviderIntegration.cjs.js');
+var errors = require('@backstage/errors');
+var prepareBackstageIdentityResponse = require('../prepareBackstageIdentityResponse.cjs.js');
+
+class SamlAuthProvider {
+  strategy;
+  signInResolver;
+  authHandler;
+  resolverContext;
+  appUrl;
+  constructor(options) {
+    this.appUrl = options.appUrl;
+    this.signInResolver = options.signInResolver;
+    this.authHandler = options.authHandler;
+    this.resolverContext = options.resolverContext;
+    const verifier = (profile, done) => {
+      done(null, { fullProfile: profile });
+    };
+    this.strategy = new passportSaml.Strategy(options, verifier, verifier);
+  }
+  async start(req, res) {
+    const { url } = await PassportStrategyHelper.executeRedirectStrategy(req, this.strategy, {});
+    res.redirect(url);
+  }
+  async frameHandler(req, res) {
+    try {
+      const { result } = await PassportStrategyHelper.executeFrameHandlerStrategy(
+        req,
+        this.strategy
+      );
+      const { profile } = await this.authHandler(result, this.resolverContext);
+      const response = {
+        profile,
+        providerInfo: {}
+      };
+      if (this.signInResolver) {
+        const signInResponse = await this.signInResolver(
+          {
+            result,
+            profile
+          },
+          this.resolverContext
+        );
+        response.backstageIdentity = prepareBackstageIdentityResponse.prepareBackstageIdentityResponse(signInResponse);
+      }
+      return authFlowHelpers.postMessageResponse(res, this.appUrl, {
+        type: "authorization_response",
+        response
+      });
+    } catch (error) {
+      const { name, message } = errors.isError(error) ? error : new Error("Encountered invalid error");
+      return authFlowHelpers.postMessageResponse(res, this.appUrl, {
+        type: "authorization_response",
+        error: { name, message }
+      });
+    }
+  }
+  async logout(_req, res) {
+    res.end();
+  }
+}
+const saml = createAuthProviderIntegration.createAuthProviderIntegration({
+  create(options) {
+    return ({ providerId, globalConfig, config, resolverContext }) => {
+      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile }) => ({
+        profile: {
+          email: fullProfile.email,
+          displayName: fullProfile.displayName
+        }
+      });
+      return new SamlAuthProvider({
+        callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
+        entryPoint: config.getString("entryPoint"),
+        logoutUrl: config.getOptionalString("logoutUrl"),
+        audience: config.getString("audience"),
+        issuer: config.getString("issuer"),
+        idpCert: config.getString("cert"),
+        privateKey: config.getOptionalString("privateKey"),
+        authnContext: config.getOptionalStringArray("authnContext"),
+        identifierFormat: config.getOptionalString("identifierFormat"),
+        decryptionPvk: config.getOptionalString("decryptionPvk"),
+        signatureAlgorithm: config.getOptionalString("signatureAlgorithm"),
+        digestAlgorithm: config.getOptionalString("digestAlgorithm"),
+        acceptedClockSkewMs: config.getOptionalNumber("acceptedClockSkewMs"),
+        wantAuthnResponseSigned: config.getOptionalBoolean(
+          "wantAuthnResponseSigned"
+        ),
+        wantAssertionsSigned: config.getOptionalBoolean("wantAssertionsSigned"),
+        appUrl: globalConfig.appUrl,
+        authHandler,
+        signInResolver: options?.signIn?.resolver,
+        resolverContext
+      });
+    };
+  },
+  resolvers: {
+    /**
+     * Looks up the user by matching their nameID to the entity name.
+     */
+    nameIdMatchingUserEntityName() {
+      return async (info, ctx) => {
+        const id = info.result.fullProfile.nameID;
+        if (!id) {
+          throw new errors.AuthenticationError("No nameID found in SAML response");
+        }
+        return ctx.signInWithCatalogUser({
+          entityRef: { name: id }
+        });
+      };
+    }
+  }
+});
+
+exports.SamlAuthProvider = SamlAuthProvider;
+exports.saml = saml;
+//# sourceMappingURL=provider.cjs.js.map

package/dist/providers/saml/provider.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/saml/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport { SamlConfig, VerifiedCallback } from '@node-saml/passport-saml';\nimport {\n  Strategy as SamlStrategy,\n  Profile as SamlProfile,\n  VerifyWithoutRequest,\n} from '@node-saml/passport-saml';\nimport {\n  executeFrameHandlerStrategy,\n  executeRedirectStrategy,\n} from '../../lib/passport';\nimport { AuthHandler } from '../types';\nimport { postMessageResponse } from '../../lib/flow';\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport { AuthenticationError, isError } from '@backstage/errors';\nimport { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';\nimport {\n  AuthProviderRouteHandlers,\n  AuthResolverContext,\n  ClientAuthResponse,\n  SignInResolver,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport type SamlAuthResult = {\n  fullProfile: any;\n};\n\ntype Options = SamlConfig & {\n  signInResolver?: SignInResolver<SamlAuthResult>;\n  authHandler: AuthHandler<SamlAuthResult>;\n  resolverContext: AuthResolverContext;\n  appUrl: string;\n};\n\nexport class SamlAuthProvider implements AuthProviderRouteHandlers {\n  private readonly strategy: SamlStrategy;\n  private readonly signInResolver?: SignInResolver<SamlAuthResult>;\n  private readonly authHandler: AuthHandler<SamlAuthResult>;\n  private readonly resolverContext: AuthResolverContext;\n  private readonly appUrl: string;\n\n  constructor(options: Options) {\n    this.appUrl = options.appUrl;\n    this.signInResolver = options.signInResolver;\n    this.authHandler = options.authHandler;\n    this.resolverContext = options.resolverContext;\n\n    const verifier: VerifyWithoutRequest = (\n      profile: SamlProfile | null,\n      done: VerifiedCallback,\n    ) => {\n      // TODO: There's plenty more validation and profile handling to do here,\n      //       this provider is currently only intended to validate the provider pattern\n      //       for non-oauth auth flows.\n      // TODO: This flow doesn't issue an identity token that can be used to validate\n      //       the identity of the user in other backends, which we need in some form.\n      done(null, { fullProfile: profile });\n    };\n    this.strategy = new SamlStrategy(options, verifier, verifier);\n  }\n\n  async start(req: express.Request, res: express.Response): Promise<void> {\n    const { url } = await executeRedirectStrategy(req, this.strategy, {});\n    res.redirect(url);\n  }\n\n  async frameHandler(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    try {\n      const { result } = await executeFrameHandlerStrategy<SamlAuthResult>(\n        req,\n        this.strategy,\n      );\n\n      const { profile } = await this.authHandler(result, this.resolverContext);\n\n      const response: ClientAuthResponse<{}> = {\n        profile,\n        providerInfo: {},\n      };\n\n      if (this.signInResolver) {\n        const signInResponse = await this.signInResolver(\n          {\n            result,\n            profile,\n          },\n          this.resolverContext,\n        );\n\n        response.backstageIdentity =\n          prepareBackstageIdentityResponse(signInResponse);\n      }\n\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        response,\n      });\n    } catch (error) {\n      const { name, message } = isError(error)\n        ? error\n        : new Error('Encountered invalid error'); // Being a bit safe and not forwarding the bad value\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        error: { name, message },\n      });\n    }\n  }\n\n  async logout(_req: express.Request, res: express.Response): Promise<void> {\n    res.end();\n  }\n}\n\ntype SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';\n\n/**\n * Auth provider integration for SAML auth\n *\n * @public\n */\nexport const saml = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<SamlAuthResult>;\n\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      /**\n       * Maps an auth result to a Backstage identity for the user.\n       */\n      resolver: SignInResolver<SamlAuthResult>;\n    };\n  }) {\n    return ({ providerId, globalConfig, config, resolverContext }) => {\n      const authHandler: AuthHandler<SamlAuthResult> = options?.authHandler\n        ? options.authHandler\n        : async ({ fullProfile }) => ({\n            profile: {\n              email: fullProfile.email,\n              displayName: fullProfile.displayName,\n            },\n          });\n\n      return new SamlAuthProvider({\n        callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,\n        entryPoint: config.getString('entryPoint'),\n        logoutUrl: config.getOptionalString('logoutUrl'),\n        audience: config.getString('audience'),\n        issuer: config.getString('issuer'),\n        idpCert: config.getString('cert'),\n        privateKey: config.getOptionalString('privateKey'),\n        authnContext: config.getOptionalStringArray('authnContext'),\n        identifierFormat: config.getOptionalString('identifierFormat'),\n        decryptionPvk: config.getOptionalString('decryptionPvk'),\n        signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as\n          | SignatureAlgorithm\n          | undefined,\n        digestAlgorithm: config.getOptionalString('digestAlgorithm'),\n        acceptedClockSkewMs: config.getOptionalNumber('acceptedClockSkewMs'),\n        wantAuthnResponseSigned: config.getOptionalBoolean(\n          'wantAuthnResponseSigned',\n        ),\n        wantAssertionsSigned: config.getOptionalBoolean('wantAssertionsSigned'),\n        appUrl: globalConfig.appUrl,\n        authHandler,\n        signInResolver: options?.signIn?.resolver,\n        resolverContext,\n      });\n    };\n  },\n  resolvers: {\n    /**\n     * Looks up the user by matching their nameID to the entity name.\n     */\n    nameIdMatchingUserEntityName(): SignInResolver<SamlAuthResult> {\n      return async (info, ctx) => {\n        const id = info.result.fullProfile.nameID;\n\n        if (!id) {\n          throw new AuthenticationError('No nameID found in SAML response');\n        }\n\n        return ctx.signInWithCatalogUser({\n          entityRef: { name: id },\n        });\n      };\n    },\n  },\n});\n"],"names":["SamlStrategy","executeRedirectStrategy","executeFrameHandlerStrategy","prepareBackstageIdentityResponse","postMessageResponse","isError","createAuthProviderIntegration","AuthenticationError"],"mappings":";;;;;;;;;AAmDO,MAAM,gBAAsD,CAAA;AAAA,EAChD,QAAA,CAAA;AAAA,EACA,cAAA,CAAA;AAAA,EACA,WAAA,CAAA;AAAA,EACA,eAAA,CAAA;AAAA,EACA,MAAA,CAAA;AAAA,EAEjB,YAAY,OAAkB,EAAA;AAC5B,IAAA,IAAA,CAAK,SAAS,OAAQ,CAAA,MAAA,CAAA;AACtB,IAAA,IAAA,CAAK,iBAAiB,OAAQ,CAAA,cAAA,CAAA;AAC9B,IAAA,IAAA,CAAK,cAAc,OAAQ,CAAA,WAAA,CAAA;AAC3B,IAAA,IAAA,CAAK,kBAAkB,OAAQ,CAAA,eAAA,CAAA;AAE/B,IAAM,MAAA,QAAA,GAAiC,CACrC,OAAA,EACA,IACG,KAAA;AAMH,MAAA,IAAA,CAAK,IAAM,EAAA,EAAE,WAAa,EAAA,OAAA,EAAS,CAAA,CAAA;AAAA,KACrC,CAAA;AACA,IAAA,IAAA,CAAK,QAAW,GAAA,IAAIA,qBAAa,CAAA,OAAA,EAAS,UAAU,QAAQ,CAAA,CAAA;AAAA,GAC9D;AAAA,EAEA,MAAM,KAAM,CAAA,GAAA,EAAsB,GAAsC,EAAA;AACtE,IAAM,MAAA,EAAE,KAAQ,GAAA,MAAMC,+CAAwB,GAAK,EAAA,IAAA,CAAK,QAAU,EAAA,EAAE,CAAA,CAAA;AACpE,IAAA,GAAA,CAAI,SAAS,GAAG,CAAA,CAAA;AAAA,GAClB;AAAA,EAEA,MAAM,YACJ,CAAA,GAAA,EACA,GACe,EAAA;AACf,IAAI,IAAA;AACF,MAAM,MAAA,EAAE,MAAO,EAAA,GAAI,MAAMC,kDAAA;AAAA,QACvB,GAAA;AAAA,QACA,IAAK,CAAA,QAAA;AAAA,OACP,CAAA;AAEA,MAAM,MAAA,EAAE,SAAY,GAAA,MAAM,KAAK,WAAY,CAAA,MAAA,EAAQ,KAAK,eAAe,CAAA,CAAA;AAEvE,MAAA,MAAM,QAAmC,GAAA;AAAA,QACvC,OAAA;AAAA,QACA,cAAc,EAAC;AAAA,OACjB,CAAA;AAEA,MAAA,IAAI,KAAK,cAAgB,EAAA;AACvB,QAAM,MAAA,cAAA,GAAiB,MAAM,IAAK,CAAA,cAAA;AAAA,UAChC;AAAA,YACE,MAAA;AAAA,YACA,OAAA;AAAA,WACF;AAAA,UACA,IAAK,CAAA,eAAA;AAAA,SACP,CAAA;AAEA,QAAS,QAAA,CAAA,iBAAA,GACPC,kEAAiC,cAAc,CAAA,CAAA;AAAA,OACnD;AAEA,MAAO,OAAAC,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN,QAAA;AAAA,OACD,CAAA,CAAA;AAAA,aACM,KAAO,EAAA;AACd,MAAM,MAAA,EAAE,IAAM,EAAA,OAAA,EAAY,GAAAC,cAAA,CAAQ,KAAK,CACnC,GAAA,KAAA,GACA,IAAI,KAAA,CAAM,2BAA2B,CAAA,CAAA;AACzC,MAAO,OAAAD,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN,KAAA,EAAO,EAAE,IAAA,EAAM,OAAQ,EAAA;AAAA,OACxB,CAAA,CAAA;AAAA,KACH;AAAA,GACF;AAAA,EAEA,MAAM,MAAO,CAAA,IAAA,EAAuB,GAAsC,EAAA;AACxE,IAAA,GAAA,CAAI,GAAI,EAAA,CAAA;AAAA,GACV;AACF,CAAA;AASO,MAAM,OAAOE,2DAA8B,CAAA;AAAA,EAChD,OAAO,OAgBJ,EAAA;AACD,IAAA,OAAO,CAAC,EAAE,UAAA,EAAY,YAAc,EAAA,MAAA,EAAQ,iBAAsB,KAAA;AAChE,MAAM,MAAA,WAAA,GAA2C,SAAS,WACtD,GAAA,OAAA,CAAQ,cACR,OAAO,EAAE,aAAmB,MAAA;AAAA,QAC1B,OAAS,EAAA;AAAA,UACP,OAAO,WAAY,CAAA,KAAA;AAAA,UACnB,aAAa,WAAY,CAAA,WAAA;AAAA,SAC3B;AAAA,OACF,CAAA,CAAA;AAEJ,MAAA,OAAO,IAAI,gBAAiB,CAAA;AAAA,QAC1B,WAAa,EAAA,CAAA,EAAG,YAAa,CAAA,OAAO,IAAI,UAAU,CAAA,cAAA,CAAA;AAAA,QAClD,UAAA,EAAY,MAAO,CAAA,SAAA,CAAU,YAAY,CAAA;AAAA,QACzC,SAAA,EAAW,MAAO,CAAA,iBAAA,CAAkB,WAAW,CAAA;AAAA,QAC/C,QAAA,EAAU,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,QACrC,MAAA,EAAQ,MAAO,CAAA,SAAA,CAAU,QAAQ,CAAA;AAAA,QACjC,OAAA,EAAS,MAAO,CAAA,SAAA,CAAU,MAAM,CAAA;AAAA,QAChC,UAAA,EAAY,MAAO,CAAA,iBAAA,CAAkB,YAAY,CAAA;AAAA,QACjD,YAAA,EAAc,MAAO,CAAA,sBAAA,CAAuB,cAAc,CAAA;AAAA,QAC1D,gBAAA,EAAkB,MAAO,CAAA,iBAAA,CAAkB,kBAAkB,CAAA;AAAA,QAC7D,aAAA,EAAe,MAAO,CAAA,iBAAA,CAAkB,eAAe,CAAA;AAAA,QACvD,kBAAA,EAAoB,MAAO,CAAA,iBAAA,CAAkB,oBAAoB,CAAA;AAAA,QAGjE,eAAA,EAAiB,MAAO,CAAA,iBAAA,CAAkB,iBAAiB,CAAA;AAAA,QAC3D,mBAAA,EAAqB,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACnE,yBAAyB,MAAO,CAAA,kBAAA;AAAA,UAC9B,yBAAA;AAAA,SACF;AAAA,QACA,oBAAA,EAAsB,MAAO,CAAA,kBAAA,CAAmB,sBAAsB,CAAA;AAAA,QACtE,QAAQ,YAAa,CAAA,MAAA;AAAA,QACrB,WAAA;AAAA,QACA,cAAA,EAAgB,SAAS,MAAQ,EAAA,QAAA;AAAA,QACjC,eAAA;AAAA,OACD,CAAA,CAAA;AAAA,KACH,CAAA;AAAA,GACF;AAAA,EACA,SAAW,EAAA;AAAA;AAAA;AAAA;AAAA,IAIT,4BAA+D,GAAA;AAC7D,MAAO,OAAA,OAAO,MAAM,GAAQ,KAAA;AAC1B,QAAM,MAAA,EAAA,GAAK,IAAK,CAAA,MAAA,CAAO,WAAY,CAAA,MAAA,CAAA;AAEnC,QAAA,IAAI,CAAC,EAAI,EAAA;AACP,UAAM,MAAA,IAAIC,2BAAoB,kCAAkC,CAAA,CAAA;AAAA,SAClE;AAEA,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,EAAG,EAAA;AAAA,SACvB,CAAA,CAAA;AAAA,OACH,CAAA;AAAA,KACF;AAAA,GACF;AACF,CAAC;;;;;"}

package/dist/service/readBackstageTokenExpiration.cjs.js

@@ -0,0 +1,27 @@
+'use strict';
+
+var config = require('@backstage/config');
+var types = require('@backstage/types');
+
+const TOKEN_EXP_DEFAULT_S = 3600;
+const TOKEN_EXP_MIN_S = 600;
+const TOKEN_EXP_MAX_S = 86400;
+function readBackstageTokenExpiration(config$1) {
+  const processingIntervalKey = "auth.backstageTokenExpiration";
+  if (!config$1.has(processingIntervalKey)) {
+    return TOKEN_EXP_DEFAULT_S;
+  }
+  const duration = config.readDurationFromConfig(config$1, {
+    key: processingIntervalKey
+  });
+  const durationS = Math.round(types.durationToMilliseconds(duration) / 1e3);
+  if (durationS < TOKEN_EXP_MIN_S) {
+    return TOKEN_EXP_MIN_S;
+  } else if (durationS > TOKEN_EXP_MAX_S) {
+    return TOKEN_EXP_MAX_S;
+  }
+  return durationS;
+}
+
+exports.readBackstageTokenExpiration = readBackstageTokenExpiration;
+//# sourceMappingURL=readBackstageTokenExpiration.cjs.js.map

package/dist/service/readBackstageTokenExpiration.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readBackstageTokenExpiration.cjs.js","sources":["../../src/service/readBackstageTokenExpiration.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { RootConfigService } from '@backstage/backend-plugin-api';\nimport { readDurationFromConfig } from '@backstage/config';\nimport { durationToMilliseconds } from '@backstage/types';\n\nconst TOKEN_EXP_DEFAULT_S = 3600;\nconst TOKEN_EXP_MIN_S = 600;\nconst TOKEN_EXP_MAX_S = 86400;\n\nexport function readBackstageTokenExpiration(config: RootConfigService) {\n  const processingIntervalKey = 'auth.backstageTokenExpiration';\n\n  if (!config.has(processingIntervalKey)) {\n    return TOKEN_EXP_DEFAULT_S;\n  }\n\n  const duration = readDurationFromConfig(config, {\n    key: processingIntervalKey,\n  });\n\n  const durationS = Math.round(durationToMilliseconds(duration) / 1000);\n\n  if (durationS < TOKEN_EXP_MIN_S) {\n    return TOKEN_EXP_MIN_S;\n  } else if (durationS > TOKEN_EXP_MAX_S) {\n    return TOKEN_EXP_MAX_S;\n  }\n  return durationS;\n}\n"],"names":["config","readDurationFromConfig","durationToMilliseconds"],"mappings":";;;;;AAoBA,MAAM,mBAAsB,GAAA,IAAA,CAAA;AAC5B,MAAM,eAAkB,GAAA,GAAA,CAAA;AACxB,MAAM,eAAkB,GAAA,KAAA,CAAA;AAEjB,SAAS,6BAA6BA,QAA2B,EAAA;AACtE,EAAA,MAAM,qBAAwB,GAAA,+BAAA,CAAA;AAE9B,EAAA,IAAI,CAACA,QAAA,CAAO,GAAI,CAAA,qBAAqB,CAAG,EAAA;AACtC,IAAO,OAAA,mBAAA,CAAA;AAAA,GACT;AAEA,EAAM,MAAA,QAAA,GAAWC,8BAAuBD,QAAQ,EAAA;AAAA,IAC9C,GAAK,EAAA,qBAAA;AAAA,GACN,CAAA,CAAA;AAED,EAAA,MAAM,YAAY,IAAK,CAAA,KAAA,CAAME,4BAAuB,CAAA,QAAQ,IAAI,GAAI,CAAA,CAAA;AAEpE,EAAA,IAAI,YAAY,eAAiB,EAAA;AAC/B,IAAO,OAAA,eAAA,CAAA;AAAA,GACT,MAAA,IAAW,YAAY,eAAiB,EAAA;AACtC,IAAO,OAAA,eAAA,CAAA;AAAA,GACT;AACA,EAAO,OAAA,SAAA,CAAA;AACT;;;;"}

package/dist/service/router.cjs.js

@@ -0,0 +1,127 @@
+'use strict';
+
+var express = require('express');
+var Router = require('express-promise-router');
+var cookieParser = require('cookie-parser');
+var providers = require('../providers/providers.cjs.js');
+var router = require('../providers/router.cjs.js');
+require('@backstage/plugin-auth-node');
+var backendCommon = require('@backstage/backend-common');
+var errors = require('@backstage/errors');
+var router$1 = require('../identity/router.cjs.js');
+var TokenFactory = require('../identity/TokenFactory.cjs.js');
+require('luxon');
+require('@google-cloud/firestore');
+var KeyStores = require('../identity/KeyStores.cjs.js');
+var UserInfoDatabaseHandler = require('../identity/UserInfoDatabaseHandler.cjs.js');
+var session = require('express-session');
+var connectSessionKnex = require('connect-session-knex');
+var passport = require('passport');
+var AuthDatabase = require('../database/AuthDatabase.cjs.js');
+var readBackstageTokenExpiration = require('./readBackstageTokenExpiration.cjs.js');
+var StaticTokenIssuer = require('../identity/StaticTokenIssuer.cjs.js');
+var StaticKeyStore = require('../identity/StaticKeyStore.cjs.js');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var express__default = /*#__PURE__*/_interopDefaultCompat(express);
+var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
+var cookieParser__default = /*#__PURE__*/_interopDefaultCompat(cookieParser);
+var session__default = /*#__PURE__*/_interopDefaultCompat(session);
+var connectSessionKnex__default = /*#__PURE__*/_interopDefaultCompat(connectSessionKnex);
+var passport__default = /*#__PURE__*/_interopDefaultCompat(passport);
+
+async function createRouter(options) {
+  const {
+    logger,
+    config,
+    discovery,
+    database,
+    tokenFactoryAlgorithm,
+    providerFactories = {}
+  } = options;
+  const { auth, httpAuth } = backendCommon.createLegacyAuthAdapters(options);
+  const router$2 = Router__default.default();
+  const appUrl = config.getString("app.baseUrl");
+  const authUrl = await discovery.getExternalBaseUrl("auth");
+  const backstageTokenExpiration = readBackstageTokenExpiration.readBackstageTokenExpiration(config);
+  const authDb = AuthDatabase.AuthDatabase.create(database);
+  const keyStore = await KeyStores.KeyStores.fromConfig(config, {
+    logger,
+    database: authDb
+  });
+  const userInfoDatabaseHandler = new UserInfoDatabaseHandler.UserInfoDatabaseHandler(
+    await authDb.get()
+  );
+  let tokenIssuer;
+  if (keyStore instanceof StaticKeyStore.StaticKeyStore) {
+    tokenIssuer = new StaticTokenIssuer.StaticTokenIssuer(
+      {
+        logger: logger.child({ component: "token-factory" }),
+        issuer: authUrl,
+        sessionExpirationSeconds: backstageTokenExpiration
+      },
+      keyStore
+    );
+  } else {
+    tokenIssuer = new TokenFactory.TokenFactory({
+      issuer: authUrl,
+      keyStore,
+      keyDurationSeconds: backstageTokenExpiration,
+      logger: logger.child({ component: "token-factory" }),
+      algorithm: tokenFactoryAlgorithm ?? config.getOptionalString("auth.identityTokenAlgorithm"),
+      userInfoDatabaseHandler
+    });
+  }
+  const secret = config.getOptionalString("auth.session.secret");
+  if (secret) {
+    router$2.use(cookieParser__default.default(secret));
+    const enforceCookieSSL = authUrl.startsWith("https");
+    const KnexSessionStore = connectSessionKnex__default.default(session__default.default);
+    router$2.use(
+      session__default.default({
+        secret,
+        saveUninitialized: false,
+        resave: false,
+        cookie: { secure: enforceCookieSSL ? "auto" : false },
+        store: new KnexSessionStore({
+          createtable: false,
+          knex: await authDb.get()
+        })
+      })
+    );
+    router$2.use(passport__default.default.initialize());
+    router$2.use(passport__default.default.session());
+  } else {
+    router$2.use(cookieParser__default.default());
+  }
+  router$2.use(express__default.default.urlencoded({ extended: false }));
+  router$2.use(express__default.default.json());
+  const providers$1 = options.disableDefaultProviderFactories ? providerFactories : {
+    ...providers.defaultAuthProviderFactories,
+    ...providerFactories
+  };
+  router.bindProviderRouters(router$2, {
+    providers: providers$1,
+    appUrl,
+    baseUrl: authUrl,
+    tokenIssuer,
+    ...options,
+    auth,
+    httpAuth
+  });
+  router$1.bindOidcRouter(router$2, {
+    auth,
+    tokenIssuer,
+    baseUrl: authUrl,
+    userInfoDatabaseHandler
+  });
+  router$2.use("/:provider/", (req) => {
+    const { provider } = req.params;
+    throw new errors.NotFoundError(`Unknown auth provider '${provider}'`);
+  });
+  return router$2;
+}
+
+exports.createRouter = createRouter;
+//# sourceMappingURL=router.cjs.js.map

package/dist/service/router.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cookieParser from 'cookie-parser';\nimport {\n  AuthService,\n  DatabaseService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { defaultAuthProviderFactories } from '../providers';\nimport { AuthOwnershipResolver } from '@backstage/plugin-auth-node';\nimport {\n  TokenManager,\n  createLegacyAuthAdapters,\n} from '@backstage/backend-common';\nimport { NotFoundError } from '@backstage/errors';\nimport { CatalogApi } from '@backstage/catalog-client';\nimport {\n  bindOidcRouter,\n  KeyStores,\n  TokenFactory,\n  UserInfoDatabaseHandler,\n} from '../identity';\nimport session from 'express-session';\nimport connectSessionKnex from 'connect-session-knex';\nimport passport from 'passport';\nimport { AuthDatabase } from '../database/AuthDatabase';\nimport { readBackstageTokenExpiration } from './readBackstageTokenExpiration';\nimport { TokenIssuer } from '../identity/types';\nimport { StaticTokenIssuer } from '../identity/StaticTokenIssuer';\nimport { StaticKeyStore } from '../identity/StaticKeyStore';\nimport { bindProviderRouters, ProviderFactories } from '../providers/router';\n\n/**\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  database: DatabaseService;\n  config: RootConfigService;\n  discovery: DiscoveryService;\n  tokenManager?: TokenManager;\n  auth?: AuthService;\n  httpAuth?: HttpAuthService;\n  tokenFactoryAlgorithm?: string;\n  providerFactories?: ProviderFactories;\n  disableDefaultProviderFactories?: boolean;\n  catalogApi?: CatalogApi;\n  ownershipResolver?: AuthOwnershipResolver;\n}\n\n/**\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    logger,\n    config,\n    discovery,\n    database,\n    tokenFactoryAlgorithm,\n    providerFactories = {},\n  } = options;\n\n  const { auth, httpAuth } = createLegacyAuthAdapters(options);\n\n  const router = Router();\n\n  const appUrl = config.getString('app.baseUrl');\n  const authUrl = await discovery.getExternalBaseUrl('auth');\n  const backstageTokenExpiration = readBackstageTokenExpiration(config);\n  const authDb = AuthDatabase.create(database);\n\n  const keyStore = await KeyStores.fromConfig(config, {\n    logger,\n    database: authDb,\n  });\n\n  const userInfoDatabaseHandler = new UserInfoDatabaseHandler(\n    await authDb.get(),\n  );\n\n  let tokenIssuer: TokenIssuer;\n  if (keyStore instanceof StaticKeyStore) {\n    tokenIssuer = new StaticTokenIssuer(\n      {\n        logger: logger.child({ component: 'token-factory' }),\n        issuer: authUrl,\n        sessionExpirationSeconds: backstageTokenExpiration,\n      },\n      keyStore as StaticKeyStore,\n    );\n  } else {\n    tokenIssuer = new TokenFactory({\n      issuer: authUrl,\n      keyStore,\n      keyDurationSeconds: backstageTokenExpiration,\n      logger: logger.child({ component: 'token-factory' }),\n      algorithm:\n        tokenFactoryAlgorithm ??\n        config.getOptionalString('auth.identityTokenAlgorithm'),\n      userInfoDatabaseHandler,\n    });\n  }\n\n  const secret = config.getOptionalString('auth.session.secret');\n  if (secret) {\n    router.use(cookieParser(secret));\n    const enforceCookieSSL = authUrl.startsWith('https');\n    const KnexSessionStore = connectSessionKnex(session);\n    router.use(\n      session({\n        secret,\n        saveUninitialized: false,\n        resave: false,\n        cookie: { secure: enforceCookieSSL ? 'auto' : false },\n        store: new KnexSessionStore({\n          createtable: false,\n          knex: await authDb.get(),\n        }),\n      }),\n    );\n    router.use(passport.initialize());\n    router.use(passport.session());\n  } else {\n    router.use(cookieParser());\n  }\n\n  router.use(express.urlencoded({ extended: false }));\n  router.use(express.json());\n\n  const providers = options.disableDefaultProviderFactories\n    ? providerFactories\n    : {\n        ...defaultAuthProviderFactories,\n        ...providerFactories,\n      };\n\n  bindProviderRouters(router, {\n    providers,\n    appUrl,\n    baseUrl: authUrl,\n    tokenIssuer,\n    ...options,\n    auth,\n    httpAuth,\n  });\n\n  bindOidcRouter(router, {\n    auth,\n    tokenIssuer,\n    baseUrl: authUrl,\n    userInfoDatabaseHandler,\n  });\n\n  // Gives a more helpful error message than a plain 404\n  router.use('/:provider/', req => {\n    const { provider } = req.params;\n    throw new NotFoundError(`Unknown auth provider '${provider}'`);\n  });\n\n  return router;\n}\n"],"names":["createLegacyAuthAdapters","router","Router","readBackstageTokenExpiration","AuthDatabase","KeyStores","UserInfoDatabaseHandler","StaticKeyStore","StaticTokenIssuer","TokenFactory","cookieParser","connectSessionKnex","session","passport","express","providers","defaultAuthProviderFactories","bindProviderRouters","bindOidcRouter","NotFoundError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAM,MAAA;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,qBAAA;AAAA,IACA,oBAAoB,EAAC;AAAA,GACnB,GAAA,OAAA,CAAA;AAEJ,EAAA,MAAM,EAAE,IAAA,EAAM,QAAS,EAAA,GAAIA,uCAAyB,OAAO,CAAA,CAAA;AAE3D,EAAA,MAAMC,WAASC,uBAAO,EAAA,CAAA;AAEtB,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA,CAAA;AAC7C,EAAA,MAAM,OAAU,GAAA,MAAM,SAAU,CAAA,kBAAA,CAAmB,MAAM,CAAA,CAAA;AACzD,EAAM,MAAA,wBAAA,GAA2BC,0DAA6B,MAAM,CAAA,CAAA;AACpE,EAAM,MAAA,MAAA,GAASC,yBAAa,CAAA,MAAA,CAAO,QAAQ,CAAA,CAAA;AAE3C,EAAA,MAAM,QAAW,GAAA,MAAMC,mBAAU,CAAA,UAAA,CAAW,MAAQ,EAAA;AAAA,IAClD,MAAA;AAAA,IACA,QAAU,EAAA,MAAA;AAAA,GACX,CAAA,CAAA;AAED,EAAA,MAAM,0BAA0B,IAAIC,+CAAA;AAAA,IAClC,MAAM,OAAO,GAAI,EAAA;AAAA,GACnB,CAAA;AAEA,EAAI,IAAA,WAAA,CAAA;AACJ,EAAA,IAAI,oBAAoBC,6BAAgB,EAAA;AACtC,IAAA,WAAA,GAAc,IAAIC,mCAAA;AAAA,MAChB;AAAA,QACE,QAAQ,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,QACnD,MAAQ,EAAA,OAAA;AAAA,QACR,wBAA0B,EAAA,wBAAA;AAAA,OAC5B;AAAA,MACA,QAAA;AAAA,KACF,CAAA;AAAA,GACK,MAAA;AACL,IAAA,WAAA,GAAc,IAAIC,yBAAa,CAAA;AAAA,MAC7B,MAAQ,EAAA,OAAA;AAAA,MACR,QAAA;AAAA,MACA,kBAAoB,EAAA,wBAAA;AAAA,MACpB,QAAQ,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACnD,SACE,EAAA,qBAAA,IACA,MAAO,CAAA,iBAAA,CAAkB,6BAA6B,CAAA;AAAA,MACxD,uBAAA;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AAEA,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA,CAAA;AAC7D,EAAA,IAAI,MAAQ,EAAA;AACV,IAAOR,QAAA,CAAA,GAAA,CAAIS,6BAAa,CAAA,MAAM,CAAC,CAAA,CAAA;AAC/B,IAAM,MAAA,gBAAA,GAAmB,OAAQ,CAAA,UAAA,CAAW,OAAO,CAAA,CAAA;AACnD,IAAM,MAAA,gBAAA,GAAmBC,oCAAmBC,wBAAO,CAAA,CAAA;AACnD,IAAOX,QAAA,CAAA,GAAA;AAAA,MACLW,wBAAQ,CAAA;AAAA,QACN,MAAA;AAAA,QACA,iBAAmB,EAAA,KAAA;AAAA,QACnB,MAAQ,EAAA,KAAA;AAAA,QACR,MAAQ,EAAA,EAAE,MAAQ,EAAA,gBAAA,GAAmB,SAAS,KAAM,EAAA;AAAA,QACpD,KAAA,EAAO,IAAI,gBAAiB,CAAA;AAAA,UAC1B,WAAa,EAAA,KAAA;AAAA,UACb,IAAA,EAAM,MAAM,MAAA,CAAO,GAAI,EAAA;AAAA,SACxB,CAAA;AAAA,OACF,CAAA;AAAA,KACH,CAAA;AACA,IAAOX,QAAA,CAAA,GAAA,CAAIY,yBAAS,CAAA,UAAA,EAAY,CAAA,CAAA;AAChC,IAAOZ,QAAA,CAAA,GAAA,CAAIY,yBAAS,CAAA,OAAA,EAAS,CAAA,CAAA;AAAA,GACxB,MAAA;AACL,IAAOZ,QAAA,CAAA,GAAA,CAAIS,+BAAc,CAAA,CAAA;AAAA,GAC3B;AAEA,EAAAT,QAAA,CAAO,IAAIa,wBAAQ,CAAA,UAAA,CAAW,EAAE,QAAU,EAAA,KAAA,EAAO,CAAC,CAAA,CAAA;AAClD,EAAOb,QAAA,CAAA,GAAA,CAAIa,wBAAQ,CAAA,IAAA,EAAM,CAAA,CAAA;AAEzB,EAAM,MAAAC,WAAA,GAAY,OAAQ,CAAA,+BAAA,GACtB,iBACA,GAAA;AAAA,IACE,GAAGC,sCAAA;AAAA,IACH,GAAG,iBAAA;AAAA,GACL,CAAA;AAEJ,EAAAC,0BAAA,CAAoBhB,QAAQ,EAAA;AAAA,eAC1Bc,WAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAS,EAAA,OAAA;AAAA,IACT,WAAA;AAAA,IACA,GAAG,OAAA;AAAA,IACH,IAAA;AAAA,IACA,QAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAAG,uBAAA,CAAejB,QAAQ,EAAA;AAAA,IACrB,IAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAS,EAAA,OAAA;AAAA,IACT,uBAAA;AAAA,GACD,CAAA,CAAA;AAGD,EAAOA,QAAA,CAAA,GAAA,CAAI,eAAe,CAAO,GAAA,KAAA;AAC/B,IAAM,MAAA,EAAE,QAAS,EAAA,GAAI,GAAI,CAAA,MAAA,CAAA;AACzB,IAAA,MAAM,IAAIkB,oBAAA,CAAc,CAA0B,uBAAA,EAAA,QAAQ,CAAG,CAAA,CAAA,CAAA,CAAA;AAAA,GAC9D,CAAA,CAAA;AAED,EAAO,OAAAlB,QAAA,CAAA;AACT;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend",
-  "version": "0.23.1-next.0",
+  "version": "0.23.1-next.1",
   "description": "A Backstage backend plugin that handles authentication",
   "backstage": {
     "role": "backend-plugin",
@@ -44,31 +44,31 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.25.0",
-    "@backstage/backend-plugin-api": "^1.0.1-next.0",
-    "@backstage/catalog-client": "^1.7.0",
-    "@backstage/catalog-model": "^1.7.0",
-    "@backstage/config": "^1.2.0",
-    "@backstage/errors": "^1.2.4",
-    "@backstage/plugin-auth-backend-module-atlassian-provider": "^0.3.1-next.0",
-    "@backstage/plugin-auth-backend-module-auth0-provider": "^0.1.1-next.0",
-    "@backstage/plugin-auth-backend-module-aws-alb-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-azure-easyauth-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-bitbucket-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-bitbucket-server-provider": "^0.1.1-next.0",
-    "@backstage/plugin-auth-backend-module-cloudflare-access-provider": "^0.3.1-next.0",
-    "@backstage/plugin-auth-backend-module-gcp-iap-provider": "^0.3.1-next.0",
-    "@backstage/plugin-auth-backend-module-github-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-gitlab-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-google-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-microsoft-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-oauth2-provider": "^0.3.1-next.0",
-    "@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-backend-module-oidc-provider": "^0.3.1-next.0",
-    "@backstage/plugin-auth-backend-module-okta-provider": "^0.1.1-next.0",
-    "@backstage/plugin-auth-backend-module-onelogin-provider": "^0.2.1-next.0",
-    "@backstage/plugin-auth-node": "^0.5.3-next.0",
-    "@backstage/plugin-catalog-node": "^1.13.1-next.0",
-    "@backstage/types": "^1.1.1",
+    "@backstage/backend-plugin-api": "1.0.1-next.1",
+    "@backstage/catalog-client": "1.7.1-next.0",
+    "@backstage/catalog-model": "1.7.0",
+    "@backstage/config": "1.2.0",
+    "@backstage/errors": "1.2.4",
+    "@backstage/plugin-auth-backend-module-atlassian-provider": "0.3.1-next.1",
+    "@backstage/plugin-auth-backend-module-auth0-provider": "0.1.1-next.1",
+    "@backstage/plugin-auth-backend-module-aws-alb-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-azure-easyauth-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-bitbucket-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-bitbucket-server-provider": "0.1.1-next.1",
+    "@backstage/plugin-auth-backend-module-cloudflare-access-provider": "0.3.1-next.1",
+    "@backstage/plugin-auth-backend-module-gcp-iap-provider": "0.3.1-next.1",
+    "@backstage/plugin-auth-backend-module-github-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-gitlab-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-google-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-microsoft-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-oauth2-provider": "0.3.1-next.1",
+    "@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-backend-module-oidc-provider": "0.3.1-next.1",
+    "@backstage/plugin-auth-backend-module-okta-provider": "0.1.1-next.1",
+    "@backstage/plugin-auth-backend-module-onelogin-provider": "0.2.1-next.1",
+    "@backstage/plugin-auth-node": "0.5.3-next.1",
+    "@backstage/plugin-catalog-node": "1.13.1-next.1",
+    "@backstage/types": "1.1.1",
     "@google-cloud/firestore": "^7.0.0",
     "@node-saml/passport-saml": "^5.0.0",
     "@types/express": "^4.17.6",
@@ -103,9 +103,9 @@
     "yn": "^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.5.1-next.0",
-    "@backstage/backend-test-utils": "^1.0.1-next.0",
-    "@backstage/cli": "^0.28.0-next.0",
+    "@backstage/backend-defaults": "0.5.1-next.2",
+    "@backstage/backend-test-utils": "1.0.1-next.2",
+    "@backstage/cli": "0.28.0-next.2",
     "@types/body-parser": "^1.19.0",
     "@types/cookie-parser": "^1.4.2",
     "@types/express-session": "^1.17.2",