@backstage/plugin-auth-backend 0.24.0-next.1 → 0.24.0

package/dist/providers/okta/provider.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/okta/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthHandler } from '../types';\nimport { OAuthResult } from '../../lib/oauth';\n\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport {\n  SignInResolver,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport {\n  adaptLegacyOAuthHandler,\n  adaptLegacyOAuthSignInResolver,\n} from '../../lib/legacy';\nimport { oktaAuthenticator } from '@backstage/plugin-auth-backend-module-okta-provider';\nimport {\n  commonByEmailLocalPartResolver,\n  commonByEmailResolver,\n} from '../resolvers';\n\n/**\n * Auth provider integration for Okta auth\n *\n * @public\n */\nexport const okta = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<OAuthResult>;\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      resolver: SignInResolver<OAuthResult>;\n    };\n  }) {\n    return createOAuthProviderFactory({\n      authenticator: oktaAuthenticator,\n      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),\n      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),\n    });\n  },\n  resolvers: {\n    /**\n     * Looks up the user by matching their email local part to the entity name.\n     */\n    emailLocalPartMatchingUserEntityName: () => commonByEmailLocalPartResolver,\n    /**\n     * Looks up the user by matching their email to the entity email.\n     */\n    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver,\n    /**\n     * Looks up the user by matching their email to the `okta.com/email` annotation.\n     */\n    emailMatchingUserEntityAnnotation(): SignInResolver<OAuthResult> {\n      return async (info, ctx) => {\n        const { profile } = info;\n\n        if (!profile.email) {\n          throw new Error('Okta profile contained no email');\n        }\n\n        return ctx.signInWithCatalogUser({\n          annotations: {\n            'okta.com/email': profile.email,\n          },\n        });\n      };\n    },\n  },\n});\n"],"names":["createAuthProviderIntegration","createOAuthProviderFactory","oktaAuthenticator","adaptLegacyOAuthHandler","adaptLegacyOAuthSignInResolver","commonByEmailLocalPartResolver","commonByEmailResolver"],"mappings":";;;;;;;;;AAuCO,MAAM,OAAOA,2DAA8B,CAAA;AAAA,EAChD,OAAO,OAYJ,EAAA;AACD,IAAA,OAAOC,yCAA2B,CAAA;AAAA,MAChC,aAAe,EAAAC,qDAAA;AAAA,MACf,gBAAA,EAAkBC,+CAAwB,CAAA,OAAA,EAAS,WAAW,CAAA;AAAA,MAC9D,cAAgB,EAAAC,6DAAA,CAA+B,OAAS,EAAA,MAAA,EAAQ,QAAQ,CAAA;AAAA,KACzE,CAAA,CAAA;AAAA,GACH;AAAA,EACA,SAAW,EAAA;AAAA;AAAA;AAAA;AAAA,IAIT,sCAAsC,MAAMC,wCAAA;AAAA;AAAA;AAAA;AAAA,IAI5C,qCAAqC,MAAMC,+BAAA;AAAA;AAAA;AAAA;AAAA,IAI3C,iCAAiE,GAAA;AAC/D,MAAO,OAAA,OAAO,MAAM,GAAQ,KAAA;AAC1B,QAAM,MAAA,EAAE,SAAY,GAAA,IAAA,CAAA;AAEpB,QAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,UAAM,MAAA,IAAI,MAAM,iCAAiC,CAAA,CAAA;AAAA,SACnD;AAEA,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,WAAa,EAAA;AAAA,YACX,kBAAkB,OAAQ,CAAA,KAAA;AAAA,WAC5B;AAAA,SACD,CAAA,CAAA;AAAA,OACH,CAAA;AAAA,KACF;AAAA,GACF;AACF,CAAC;;;;"}
+{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/okta/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthHandler } from '../types';\nimport { OAuthResult } from '../../lib/oauth';\n\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport {\n  SignInResolver,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport {\n  adaptLegacyOAuthHandler,\n  adaptLegacyOAuthSignInResolver,\n} from '../../lib/legacy';\nimport { oktaAuthenticator } from '@backstage/plugin-auth-backend-module-okta-provider';\nimport {\n  commonByEmailLocalPartResolver,\n  commonByEmailResolver,\n} from '../resolvers';\n\n/**\n * Auth provider integration for Okta auth\n *\n * @public\n */\nexport const okta = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<OAuthResult>;\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      resolver: SignInResolver<OAuthResult>;\n    };\n  }) {\n    return createOAuthProviderFactory({\n      authenticator: oktaAuthenticator,\n      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),\n      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),\n    });\n  },\n  resolvers: {\n    /**\n     * Looks up the user by matching their email local part to the entity name.\n     */\n    emailLocalPartMatchingUserEntityName: () => commonByEmailLocalPartResolver,\n    /**\n     * Looks up the user by matching their email to the entity email.\n     */\n    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver,\n    /**\n     * Looks up the user by matching their email to the `okta.com/email` annotation.\n     */\n    emailMatchingUserEntityAnnotation(): SignInResolver<OAuthResult> {\n      return async (info, ctx) => {\n        const { profile } = info;\n\n        if (!profile.email) {\n          throw new Error('Okta profile contained no email');\n        }\n\n        return ctx.signInWithCatalogUser({\n          annotations: {\n            'okta.com/email': profile.email,\n          },\n        });\n      };\n    },\n  },\n});\n"],"names":["createAuthProviderIntegration","createOAuthProviderFactory","oktaAuthenticator","adaptLegacyOAuthHandler","adaptLegacyOAuthSignInResolver","commonByEmailLocalPartResolver","commonByEmailResolver"],"mappings":";;;;;;;;;AAuCO,MAAM,OAAOA,2DAA8B,CAAA;AAAA,EAChD,OAAO,OAYJ,EAAA;AACD,IAAA,OAAOC,yCAA2B,CAAA;AAAA,MAChC,aAAe,EAAAC,qDAAA;AAAA,MACf,gBAAA,EAAkBC,+CAAwB,CAAA,OAAA,EAAS,WAAW,CAAA;AAAA,MAC9D,cAAgB,EAAAC,6DAAA,CAA+B,OAAS,EAAA,MAAA,EAAQ,QAAQ;AAAA,KACzE,CAAA;AAAA,GACH;AAAA,EACA,SAAW,EAAA;AAAA;AAAA;AAAA;AAAA,IAIT,sCAAsC,MAAMC,wCAAA;AAAA;AAAA;AAAA;AAAA,IAI5C,qCAAqC,MAAMC,+BAAA;AAAA;AAAA;AAAA;AAAA,IAI3C,iCAAiE,GAAA;AAC/D,MAAO,OAAA,OAAO,MAAM,GAAQ,KAAA;AAC1B,QAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,QAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,UAAM,MAAA,IAAI,MAAM,iCAAiC,CAAA;AAAA;AAGnD,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,WAAa,EAAA;AAAA,YACX,kBAAkB,OAAQ,CAAA;AAAA;AAC5B,SACD,CAAA;AAAA,OACH;AAAA;AACF;AAEJ,CAAC;;;;"}

package/dist/providers/onelogin/provider.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/onelogin/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { oneLoginAuthenticator } from '@backstage/plugin-auth-backend-module-onelogin-provider';\nimport {\n  SignInResolver,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport {\n  adaptLegacyOAuthHandler,\n  adaptLegacyOAuthSignInResolver,\n} from '../../lib/legacy';\nimport { OAuthResult } from '../../lib/oauth';\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport { AuthHandler } from '../types';\n\n/**\n * Auth provider integration for OneLogin auth\n *\n * @public\n */\nexport const onelogin = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<OAuthResult>;\n\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      /**\n       * Maps an auth result to a Backstage identity for the user.\n       */\n      resolver: SignInResolver<OAuthResult>;\n    };\n  }) {\n    return createOAuthProviderFactory({\n      authenticator: oneLoginAuthenticator,\n      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),\n      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),\n    });\n  },\n});\n"],"names":["createAuthProviderIntegration","createOAuthProviderFactory","oneLoginAuthenticator","adaptLegacyOAuthHandler","adaptLegacyOAuthSignInResolver"],"mappings":";;;;;;;;AAkCO,MAAM,WAAWA,2DAA8B,CAAA;AAAA,EACpD,OAAO,OAgBJ,EAAA;AACD,IAAA,OAAOC,yCAA2B,CAAA;AAAA,MAChC,aAAe,EAAAC,6DAAA;AAAA,MACf,gBAAA,EAAkBC,+CAAwB,CAAA,OAAA,EAAS,WAAW,CAAA;AAAA,MAC9D,cAAgB,EAAAC,6DAAA,CAA+B,OAAS,EAAA,MAAA,EAAQ,QAAQ,CAAA;AAAA,KACzE,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;"}
+{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/onelogin/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { oneLoginAuthenticator } from '@backstage/plugin-auth-backend-module-onelogin-provider';\nimport {\n  SignInResolver,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport {\n  adaptLegacyOAuthHandler,\n  adaptLegacyOAuthSignInResolver,\n} from '../../lib/legacy';\nimport { OAuthResult } from '../../lib/oauth';\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport { AuthHandler } from '../types';\n\n/**\n * Auth provider integration for OneLogin auth\n *\n * @public\n */\nexport const onelogin = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<OAuthResult>;\n\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      /**\n       * Maps an auth result to a Backstage identity for the user.\n       */\n      resolver: SignInResolver<OAuthResult>;\n    };\n  }) {\n    return createOAuthProviderFactory({\n      authenticator: oneLoginAuthenticator,\n      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),\n      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),\n    });\n  },\n});\n"],"names":["createAuthProviderIntegration","createOAuthProviderFactory","oneLoginAuthenticator","adaptLegacyOAuthHandler","adaptLegacyOAuthSignInResolver"],"mappings":";;;;;;;;AAkCO,MAAM,WAAWA,2DAA8B,CAAA;AAAA,EACpD,OAAO,OAgBJ,EAAA;AACD,IAAA,OAAOC,yCAA2B,CAAA;AAAA,MAChC,aAAe,EAAAC,6DAAA;AAAA,MACf,gBAAA,EAAkBC,+CAAwB,CAAA,OAAA,EAAS,WAAW,CAAA;AAAA,MAC9D,cAAgB,EAAAC,6DAAA,CAA+B,OAAS,EAAA,MAAA,EAAQ,QAAQ;AAAA,KACzE,CAAA;AAAA;AAEL,CAAC;;;;"}

package/dist/providers/providers.cjs.js

@@ -1,60 +1,60 @@
 'use strict';
 
-var provider$e = require('./atlassian/provider.cjs.js');
-var provider$5 = require('./auth0/provider.cjs.js');
-var provider$b = require('./aws-alb/provider.cjs.js');
-var provider$c = require('./bitbucket/provider.cjs.js');
-var provider$f = require('./cloudflare-access/provider.cjs.js');
+var provider = require('./atlassian/provider.cjs.js');
+var provider$9 = require('./auth0/provider.cjs.js');
+var provider$3 = require('./aws-alb/provider.cjs.js');
+var provider$2 = require('./bitbucket/provider.cjs.js');
+var provider$h = require('./cloudflare-access/provider.cjs.js');
 var provider$g = require('./gcp-iap/provider.cjs.js');
-var provider$1 = require('./github/provider.cjs.js');
-var provider$2 = require('./gitlab/provider.cjs.js');
-var provider = require('./google/provider.cjs.js');
-var provider$6 = require('./microsoft/provider.cjs.js');
-var provider$8 = require('./oauth2/provider.cjs.js');
-var provider$h = require('./oauth2-proxy/provider.cjs.js');
-var provider$9 = require('./oidc/provider.cjs.js');
-var provider$4 = require('./okta/provider.cjs.js');
-var provider$a = require('./onelogin/provider.cjs.js');
-var provider$3 = require('./saml/provider.cjs.js');
-var provider$d = require('./bitbucketServer/provider.cjs.js');
+var provider$d = require('./github/provider.cjs.js');
+var provider$c = require('./gitlab/provider.cjs.js');
+var provider$e = require('./google/provider.cjs.js');
+var provider$8 = require('./microsoft/provider.cjs.js');
+var provider$6 = require('./oauth2/provider.cjs.js');
+var provider$f = require('./oauth2-proxy/provider.cjs.js');
+var provider$5 = require('./oidc/provider.cjs.js');
+var provider$a = require('./okta/provider.cjs.js');
+var provider$4 = require('./onelogin/provider.cjs.js');
+var provider$b = require('./saml/provider.cjs.js');
+var provider$1 = require('./bitbucketServer/provider.cjs.js');
 var provider$7 = require('./azure-easyauth/provider.cjs.js');
 
 const providers = Object.freeze({
-  atlassian: provider$e.atlassian,
-  auth0: provider$5.auth0,
-  awsAlb: provider$b.awsAlb,
-  bitbucket: provider$c.bitbucket,
-  bitbucketServer: provider$d.bitbucketServer,
-  cfAccess: provider$f.cfAccess,
+  atlassian: provider.atlassian,
+  auth0: provider$9.auth0,
+  awsAlb: provider$3.awsAlb,
+  bitbucket: provider$2.bitbucket,
+  bitbucketServer: provider$1.bitbucketServer,
+  cfAccess: provider$h.cfAccess,
   gcpIap: provider$g.gcpIap,
-  github: provider$1.github,
-  gitlab: provider$2.gitlab,
-  google: provider.google,
-  microsoft: provider$6.microsoft,
-  oauth2: provider$8.oauth2,
-  oauth2Proxy: provider$h.oauth2Proxy,
-  oidc: provider$9.oidc,
-  okta: provider$4.okta,
-  onelogin: provider$a.onelogin,
-  saml: provider$3.saml,
+  github: provider$d.github,
+  gitlab: provider$c.gitlab,
+  google: provider$e.google,
+  microsoft: provider$8.microsoft,
+  oauth2: provider$6.oauth2,
+  oauth2Proxy: provider$f.oauth2Proxy,
+  oidc: provider$5.oidc,
+  okta: provider$a.okta,
+  onelogin: provider$4.onelogin,
+  saml: provider$b.saml,
   easyAuth: provider$7.easyAuth
 });
 const defaultAuthProviderFactories = {
-  google: provider.google.create(),
-  github: provider$1.github.create(),
-  gitlab: provider$2.gitlab.create(),
-  saml: provider$3.saml.create(),
-  okta: provider$4.okta.create(),
-  auth0: provider$5.auth0.create(),
-  microsoft: provider$6.microsoft.create(),
+  google: provider$e.google.create(),
+  github: provider$d.github.create(),
+  gitlab: provider$c.gitlab.create(),
+  saml: provider$b.saml.create(),
+  okta: provider$a.okta.create(),
+  auth0: provider$9.auth0.create(),
+  microsoft: provider$8.microsoft.create(),
   easyAuth: provider$7.easyAuth.create(),
-  oauth2: provider$8.oauth2.create(),
-  oidc: provider$9.oidc.create(),
-  onelogin: provider$a.onelogin.create(),
-  awsalb: provider$b.awsAlb.create(),
-  bitbucket: provider$c.bitbucket.create(),
-  bitbucketServer: provider$d.bitbucketServer.create(),
-  atlassian: provider$e.atlassian.create()
+  oauth2: provider$6.oauth2.create(),
+  oidc: provider$5.oidc.create(),
+  onelogin: provider$4.onelogin.create(),
+  awsalb: provider$3.awsAlb.create(),
+  bitbucket: provider$2.bitbucket.create(),
+  bitbucketServer: provider$1.bitbucketServer.create(),
+  atlassian: provider.atlassian.create()
 };
 
 exports.defaultAuthProviderFactories = defaultAuthProviderFactories;

package/dist/providers/providers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"providers.cjs.js","sources":["../../src/providers/providers.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { atlassian } from './atlassian';\nimport { auth0 } from './auth0';\nimport { awsAlb } from './aws-alb';\nimport { bitbucket } from './bitbucket';\nimport { cfAccess } from './cloudflare-access';\nimport { gcpIap } from './gcp-iap';\nimport { github } from './github';\nimport { gitlab } from './gitlab';\nimport { google } from './google';\nimport { microsoft } from './microsoft';\nimport { oauth2 } from './oauth2';\nimport { oauth2Proxy } from './oauth2-proxy';\nimport { oidc } from './oidc';\nimport { okta } from './okta';\nimport { onelogin } from './onelogin';\nimport { saml } from './saml';\nimport { bitbucketServer } from './bitbucketServer';\nimport { easyAuth } from './azure-easyauth';\nimport { AuthProviderFactory } from '@backstage/plugin-auth-node';\n\n/**\n * All built-in auth provider integrations.\n *\n * @public\n */\nexport const providers = Object.freeze({\n  atlassian,\n  auth0,\n  awsAlb,\n  bitbucket,\n  bitbucketServer,\n  cfAccess,\n  gcpIap,\n  github,\n  gitlab,\n  google,\n  microsoft,\n  oauth2,\n  oauth2Proxy,\n  oidc,\n  okta,\n  onelogin,\n  saml,\n  easyAuth,\n});\n\n/**\n * All auth provider factories that are installed by default.\n *\n * @public\n */\nexport const defaultAuthProviderFactories: {\n  [providerId: string]: AuthProviderFactory;\n} = {\n  google: google.create(),\n  github: github.create(),\n  gitlab: gitlab.create(),\n  saml: saml.create(),\n  okta: okta.create(),\n  auth0: auth0.create(),\n  microsoft: microsoft.create(),\n  easyAuth: easyAuth.create(),\n  oauth2: oauth2.create(),\n  oidc: oidc.create(),\n  onelogin: onelogin.create(),\n  awsalb: awsAlb.create(),\n  bitbucket: bitbucket.create(),\n  bitbucketServer: bitbucketServer.create(),\n  atlassian: atlassian.create(),\n};\n"],"names":["atlassian","auth0","awsAlb","bitbucket","bitbucketServer","cfAccess","gcpIap","github","gitlab","google","microsoft","oauth2","oauth2Proxy","oidc","okta","onelogin","saml","easyAuth"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyCa,MAAA,SAAA,GAAY,OAAO,MAAO,CAAA;AAAA,aACrCA,oBAAA;AAAA,SACAC,gBAAA;AAAA,UACAC,iBAAA;AAAA,aACAC,oBAAA;AAAA,mBACAC,0BAAA;AAAA,YACAC,mBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,eAAA;AAAA,aACAC,oBAAA;AAAA,UACAC,iBAAA;AAAA,eACAC,sBAAA;AAAA,QACAC,eAAA;AAAA,QACAC,eAAA;AAAA,YACAC,mBAAA;AAAA,QACAC,eAAA;AAAA,YACAC,mBAAA;AACF,CAAC,EAAA;AAOM,MAAM,4BAET,GAAA;AAAA,EACF,MAAA,EAAQR,gBAAO,MAAO,EAAA;AAAA,EACtB,MAAA,EAAQF,kBAAO,MAAO,EAAA;AAAA,EACtB,MAAA,EAAQC,kBAAO,MAAO,EAAA;AAAA,EACtB,IAAA,EAAMQ,gBAAK,MAAO,EAAA;AAAA,EAClB,IAAA,EAAMF,gBAAK,MAAO,EAAA;AAAA,EAClB,KAAA,EAAOb,iBAAM,MAAO,EAAA;AAAA,EACpB,SAAA,EAAWS,qBAAU,MAAO,EAAA;AAAA,EAC5B,QAAA,EAAUO,oBAAS,MAAO,EAAA;AAAA,EAC1B,MAAA,EAAQN,kBAAO,MAAO,EAAA;AAAA,EACtB,IAAA,EAAME,gBAAK,MAAO,EAAA;AAAA,EAClB,QAAA,EAAUE,oBAAS,MAAO,EAAA;AAAA,EAC1B,MAAA,EAAQb,kBAAO,MAAO,EAAA;AAAA,EACtB,SAAA,EAAWC,qBAAU,MAAO,EAAA;AAAA,EAC5B,eAAA,EAAiBC,2BAAgB,MAAO,EAAA;AAAA,EACxC,SAAA,EAAWJ,qBAAU,MAAO,EAAA;AAC9B;;;;;"}
+{"version":3,"file":"providers.cjs.js","sources":["../../src/providers/providers.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { atlassian } from './atlassian';\nimport { auth0 } from './auth0';\nimport { awsAlb } from './aws-alb';\nimport { bitbucket } from './bitbucket';\nimport { cfAccess } from './cloudflare-access';\nimport { gcpIap } from './gcp-iap';\nimport { github } from './github';\nimport { gitlab } from './gitlab';\nimport { google } from './google';\nimport { microsoft } from './microsoft';\nimport { oauth2 } from './oauth2';\nimport { oauth2Proxy } from './oauth2-proxy';\nimport { oidc } from './oidc';\nimport { okta } from './okta';\nimport { onelogin } from './onelogin';\nimport { saml } from './saml';\nimport { bitbucketServer } from './bitbucketServer';\nimport { easyAuth } from './azure-easyauth';\nimport { AuthProviderFactory } from '@backstage/plugin-auth-node';\n\n/**\n * All built-in auth provider integrations.\n *\n * @public\n */\nexport const providers = Object.freeze({\n  atlassian,\n  auth0,\n  awsAlb,\n  bitbucket,\n  bitbucketServer,\n  cfAccess,\n  gcpIap,\n  github,\n  gitlab,\n  google,\n  microsoft,\n  oauth2,\n  oauth2Proxy,\n  oidc,\n  okta,\n  onelogin,\n  saml,\n  easyAuth,\n});\n\n/**\n * All auth provider factories that are installed by default.\n *\n * @public\n */\nexport const defaultAuthProviderFactories: {\n  [providerId: string]: AuthProviderFactory;\n} = {\n  google: google.create(),\n  github: github.create(),\n  gitlab: gitlab.create(),\n  saml: saml.create(),\n  okta: okta.create(),\n  auth0: auth0.create(),\n  microsoft: microsoft.create(),\n  easyAuth: easyAuth.create(),\n  oauth2: oauth2.create(),\n  oidc: oidc.create(),\n  onelogin: onelogin.create(),\n  awsalb: awsAlb.create(),\n  bitbucket: bitbucket.create(),\n  bitbucketServer: bitbucketServer.create(),\n  atlassian: atlassian.create(),\n};\n"],"names":["atlassian","auth0","awsAlb","bitbucket","bitbucketServer","cfAccess","gcpIap","github","gitlab","google","microsoft","oauth2","oauth2Proxy","oidc","okta","onelogin","saml","easyAuth"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyCa,MAAA,SAAA,GAAY,OAAO,MAAO,CAAA;AAAA,aACrCA,kBAAA;AAAA,SACAC,gBAAA;AAAA,UACAC,iBAAA;AAAA,aACAC,oBAAA;AAAA,mBACAC,0BAAA;AAAA,YACAC,mBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,aACAC,oBAAA;AAAA,UACAC,iBAAA;AAAA,eACAC,sBAAA;AAAA,QACAC,eAAA;AAAA,QACAC,eAAA;AAAA,YACAC,mBAAA;AAAA,QACAC,eAAA;AAAA,YACAC;AACF,CAAC;AAOM,MAAM,4BAET,GAAA;AAAA,EACF,MAAA,EAAQR,kBAAO,MAAO,EAAA;AAAA,EACtB,MAAA,EAAQF,kBAAO,MAAO,EAAA;AAAA,EACtB,MAAA,EAAQC,kBAAO,MAAO,EAAA;AAAA,EACtB,IAAA,EAAMQ,gBAAK,MAAO,EAAA;AAAA,EAClB,IAAA,EAAMF,gBAAK,MAAO,EAAA;AAAA,EAClB,KAAA,EAAOb,iBAAM,MAAO,EAAA;AAAA,EACpB,SAAA,EAAWS,qBAAU,MAAO,EAAA;AAAA,EAC5B,QAAA,EAAUO,oBAAS,MAAO,EAAA;AAAA,EAC1B,MAAA,EAAQN,kBAAO,MAAO,EAAA;AAAA,EACtB,IAAA,EAAME,gBAAK,MAAO,EAAA;AAAA,EAClB,QAAA,EAAUE,oBAAS,MAAO,EAAA;AAAA,EAC1B,MAAA,EAAQb,kBAAO,MAAO,EAAA;AAAA,EACtB,SAAA,EAAWC,qBAAU,MAAO,EAAA;AAAA,EAC5B,eAAA,EAAiBC,2BAAgB,MAAO,EAAA;AAAA,EACxC,SAAA,EAAWJ,mBAAU,MAAO;AAC9B;;;;;"}

package/dist/providers/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../../src/providers/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SignInResolver } from '@backstage/plugin-auth-node';\n\n/**\n * A common sign-in resolver that looks up the user using the local part of\n * their email address as the entity name.\n */\nexport const commonByEmailLocalPartResolver: SignInResolver<unknown> = async (\n  info,\n  ctx,\n) => {\n  const { profile } = info;\n\n  if (!profile.email) {\n    throw new Error('Login failed, user profile does not contain an email');\n  }\n  const [localPart] = profile.email.split('@');\n\n  return ctx.signInWithCatalogUser({\n    entityRef: { name: localPart },\n  });\n};\n\n/**\n * A common sign-in resolver that looks up the user using their email address\n * as email of the entity.\n */\nexport const commonByEmailResolver: SignInResolver<unknown> = async (\n  info,\n  ctx,\n) => {\n  const { profile } = info;\n\n  if (!profile.email) {\n    throw new Error('Login failed, user profile does not contain an email');\n  }\n\n  return ctx.signInWithCatalogUser({\n    filter: {\n      'spec.profile.email': profile.email,\n    },\n  });\n};\n"],"names":[],"mappings":";;AAsBa,MAAA,8BAAA,GAA0D,OACrE,IAAA,EACA,GACG,KAAA;AACH,EAAM,MAAA,EAAE,SAAY,GAAA,IAAA,CAAA;AAEpB,EAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,IAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA,CAAA;AAAA,GACxE;AACA,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,OAAQ,CAAA,KAAA,CAAM,MAAM,GAAG,CAAA,CAAA;AAE3C,EAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,IAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,SAAU,EAAA;AAAA,GAC9B,CAAA,CAAA;AACH,EAAA;AAMa,MAAA,qBAAA,GAAiD,OAC5D,IAAA,EACA,GACG,KAAA;AACH,EAAM,MAAA,EAAE,SAAY,GAAA,IAAA,CAAA;AAEpB,EAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,IAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA,CAAA;AAAA,GACxE;AAEA,EAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,IAC/B,MAAQ,EAAA;AAAA,MACN,sBAAsB,OAAQ,CAAA,KAAA;AAAA,KAChC;AAAA,GACD,CAAA,CAAA;AACH;;;;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../../src/providers/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SignInResolver } from '@backstage/plugin-auth-node';\n\n/**\n * A common sign-in resolver that looks up the user using the local part of\n * their email address as the entity name.\n */\nexport const commonByEmailLocalPartResolver: SignInResolver<unknown> = async (\n  info,\n  ctx,\n) => {\n  const { profile } = info;\n\n  if (!profile.email) {\n    throw new Error('Login failed, user profile does not contain an email');\n  }\n  const [localPart] = profile.email.split('@');\n\n  return ctx.signInWithCatalogUser({\n    entityRef: { name: localPart },\n  });\n};\n\n/**\n * A common sign-in resolver that looks up the user using their email address\n * as email of the entity.\n */\nexport const commonByEmailResolver: SignInResolver<unknown> = async (\n  info,\n  ctx,\n) => {\n  const { profile } = info;\n\n  if (!profile.email) {\n    throw new Error('Login failed, user profile does not contain an email');\n  }\n\n  return ctx.signInWithCatalogUser({\n    filter: {\n      'spec.profile.email': profile.email,\n    },\n  });\n};\n"],"names":[],"mappings":";;AAsBa,MAAA,8BAAA,GAA0D,OACrE,IAAA,EACA,GACG,KAAA;AACH,EAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,EAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,IAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA;AAAA;AAExE,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,OAAQ,CAAA,KAAA,CAAM,MAAM,GAAG,CAAA;AAE3C,EAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,IAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,SAAU;AAAA,GAC9B,CAAA;AACH;AAMa,MAAA,qBAAA,GAAiD,OAC5D,IAAA,EACA,GACG,KAAA;AACH,EAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,EAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,IAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA;AAAA;AAGxE,EAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,IAC/B,MAAQ,EAAA;AAAA,MACN,sBAAsB,OAAQ,CAAA;AAAA;AAChC,GACD,CAAA;AACH;;;;;"}

package/dist/providers/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../../src/providers/router.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  PluginEndpointDiscovery,\n  TokenManager,\n} from '@backstage/backend-common';\nimport {\n  AuthService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport { CatalogApi, CatalogClient } from '@backstage/catalog-client';\nimport { Config } from '@backstage/config';\nimport { assertError, NotFoundError } from '@backstage/errors';\nimport {\n  AuthOwnershipResolver,\n  AuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Minimatch } from 'minimatch';\nimport { CatalogAuthResolverContext } from '../lib/resolvers/CatalogAuthResolverContext';\nimport { TokenIssuer } from '../identity/types';\n\n/** @public */\nexport type ProviderFactories = { [s: string]: AuthProviderFactory };\n\nexport function bindProviderRouters(\n  targetRouter: express.Router,\n  options: {\n    providers: ProviderFactories;\n    appUrl: string;\n    baseUrl: string;\n    config: Config;\n    logger: LoggerService;\n    discovery: PluginEndpointDiscovery;\n    auth: AuthService;\n    httpAuth: HttpAuthService;\n    tokenManager?: TokenManager;\n    tokenIssuer: TokenIssuer;\n    ownershipResolver?: AuthOwnershipResolver;\n    catalogApi?: CatalogApi;\n  },\n) {\n  const {\n    providers,\n    appUrl,\n    baseUrl,\n    config,\n    logger,\n    discovery,\n    auth,\n    httpAuth,\n    tokenManager,\n    tokenIssuer,\n    catalogApi,\n    ownershipResolver,\n  } = options;\n\n  const providersConfig = config.getOptionalConfig('auth.providers');\n\n  const isOriginAllowed = createOriginFilter(config);\n\n  for (const [providerId, providerFactory] of Object.entries(providers)) {\n    if (providersConfig?.has(providerId)) {\n      logger.info(`Configuring auth provider: ${providerId}`);\n      try {\n        const provider = providerFactory({\n          providerId,\n          appUrl,\n          baseUrl,\n          isOriginAllowed,\n          globalConfig: {\n            baseUrl,\n            appUrl,\n            isOriginAllowed,\n          },\n          config: providersConfig.getConfig(providerId),\n          logger,\n          resolverContext: CatalogAuthResolverContext.create({\n            logger,\n            catalogApi:\n              catalogApi ?? new CatalogClient({ discoveryApi: discovery }),\n            tokenIssuer,\n            tokenManager,\n            discovery,\n            auth,\n            httpAuth,\n            ownershipResolver,\n          }),\n        });\n\n        const r = Router();\n\n        r.get('/start', provider.start.bind(provider));\n        r.get('/handler/frame', provider.frameHandler.bind(provider));\n        r.post('/handler/frame', provider.frameHandler.bind(provider));\n        if (provider.logout) {\n          r.post('/logout', provider.logout.bind(provider));\n        }\n        if (provider.refresh) {\n          r.get('/refresh', provider.refresh.bind(provider));\n          r.post('/refresh', provider.refresh.bind(provider));\n        }\n\n        targetRouter.use(`/${providerId}`, r);\n      } catch (e) {\n        assertError(e);\n        if (process.env.NODE_ENV !== 'development') {\n          throw new Error(\n            `Failed to initialize ${providerId} auth provider, ${e.message}`,\n          );\n        }\n\n        logger.warn(`Skipping ${providerId} auth provider, ${e.message}`);\n\n        targetRouter.use(`/${providerId}`, () => {\n          // If the user added the provider under auth.providers but the clientId and clientSecret etc. were not found.\n          throw new NotFoundError(\n            `Auth provider registered for '${providerId}' is misconfigured. This could mean the configs under ` +\n              `auth.providers.${providerId} are missing or the environment variables used are not defined. ` +\n              `Check the auth backend plugin logs when the backend starts to see more details.`,\n          );\n        });\n      }\n    } else {\n      targetRouter.use(`/${providerId}`, () => {\n        throw new NotFoundError(\n          `No auth provider registered for '${providerId}'`,\n        );\n      });\n    }\n  }\n}\n\n/** @public */\nexport function createOriginFilter(\n  config: Config,\n): (origin: string) => boolean {\n  const appUrl = config.getString('app.baseUrl');\n  const { origin: appOrigin } = new URL(appUrl);\n\n  const allowedOrigins = config.getOptionalStringArray(\n    'auth.experimentalExtraAllowedOrigins',\n  );\n\n  const allowedOriginPatterns =\n    allowedOrigins?.map(\n      pattern => new Minimatch(pattern, { nocase: true, noglobstar: true }),\n    ) ?? [];\n\n  return origin => {\n    if (origin === appOrigin) {\n      return true;\n    }\n    return allowedOriginPatterns.some(pattern => pattern.match(origin));\n  };\n}\n"],"names":["CatalogAuthResolverContext","CatalogClient","Router","assertError","NotFoundError","Minimatch"],"mappings":";;;;;;;;;;;;AAyCgB,SAAA,mBAAA,CACd,cACA,OAcA,EAAA;AACA,EAAM,MAAA;AAAA,IACJ,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,YAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,iBAAA;AAAA,GACE,GAAA,OAAA,CAAA;AAEJ,EAAM,MAAA,eAAA,GAAkB,MAAO,CAAA,iBAAA,CAAkB,gBAAgB,CAAA,CAAA;AAEjE,EAAM,MAAA,eAAA,GAAkB,mBAAmB,MAAM,CAAA,CAAA;AAEjD,EAAA,KAAA,MAAW,CAAC,UAAY,EAAA,eAAe,KAAK,MAAO,CAAA,OAAA,CAAQ,SAAS,CAAG,EAAA;AACrE,IAAI,IAAA,eAAA,EAAiB,GAAI,CAAA,UAAU,CAAG,EAAA;AACpC,MAAO,MAAA,CAAA,IAAA,CAAK,CAA8B,2BAAA,EAAA,UAAU,CAAE,CAAA,CAAA,CAAA;AACtD,MAAI,IAAA;AACF,QAAA,MAAM,WAAW,eAAgB,CAAA;AAAA,UAC/B,UAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAA;AAAA,UACA,eAAA;AAAA,UACA,YAAc,EAAA;AAAA,YACZ,OAAA;AAAA,YACA,MAAA;AAAA,YACA,eAAA;AAAA,WACF;AAAA,UACA,MAAA,EAAQ,eAAgB,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,UAC5C,MAAA;AAAA,UACA,eAAA,EAAiBA,sDAA2B,MAAO,CAAA;AAAA,YACjD,MAAA;AAAA,YACA,YACE,UAAc,IAAA,IAAIC,4BAAc,EAAE,YAAA,EAAc,WAAW,CAAA;AAAA,YAC7D,WAAA;AAAA,YACA,YAAA;AAAA,YACA,SAAA;AAAA,YACA,IAAA;AAAA,YACA,QAAA;AAAA,YACA,iBAAA;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAED,QAAA,MAAM,IAAIC,uBAAO,EAAA,CAAA;AAEjB,QAAA,CAAA,CAAE,IAAI,QAAU,EAAA,QAAA,CAAS,KAAM,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAA;AAC7C,QAAA,CAAA,CAAE,IAAI,gBAAkB,EAAA,QAAA,CAAS,YAAa,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAA;AAC5D,QAAA,CAAA,CAAE,KAAK,gBAAkB,EAAA,QAAA,CAAS,YAAa,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAA;AAC7D,QAAA,IAAI,SAAS,MAAQ,EAAA;AACnB,UAAA,CAAA,CAAE,KAAK,SAAW,EAAA,QAAA,CAAS,MAAO,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAA;AAAA,SAClD;AACA,QAAA,IAAI,SAAS,OAAS,EAAA;AACpB,UAAA,CAAA,CAAE,IAAI,UAAY,EAAA,QAAA,CAAS,OAAQ,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAA;AACjD,UAAA,CAAA,CAAE,KAAK,UAAY,EAAA,QAAA,CAAS,OAAQ,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA,CAAA;AAAA,SACpD;AAEA,QAAA,YAAA,CAAa,GAAI,CAAA,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAAA,eAC7B,CAAG,EAAA;AACV,QAAAC,kBAAA,CAAY,CAAC,CAAA,CAAA;AACb,QAAI,IAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,aAAe,EAAA;AAC1C,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAwB,qBAAA,EAAA,UAAU,CAAmB,gBAAA,EAAA,CAAA,CAAE,OAAO,CAAA,CAAA;AAAA,WAChE,CAAA;AAAA,SACF;AAEA,QAAA,MAAA,CAAO,KAAK,CAAY,SAAA,EAAA,UAAU,CAAmB,gBAAA,EAAA,CAAA,CAAE,OAAO,CAAE,CAAA,CAAA,CAAA;AAEhE,QAAA,YAAA,CAAa,GAAI,CAAA,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,MAAM;AAEvC,UAAA,MAAM,IAAIC,oBAAA;AAAA,YACR,CAAA,8BAAA,EAAiC,UAAU,CAAA,qEAAA,EACvB,UAAU,CAAA,+IAAA,CAAA;AAAA,WAEhC,CAAA;AAAA,SACD,CAAA,CAAA;AAAA,OACH;AAAA,KACK,MAAA;AACL,MAAA,YAAA,CAAa,GAAI,CAAA,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,MAAM;AACvC,QAAA,MAAM,IAAIA,oBAAA;AAAA,UACR,oCAAoC,UAAU,CAAA,CAAA,CAAA;AAAA,SAChD,CAAA;AAAA,OACD,CAAA,CAAA;AAAA,KACH;AAAA,GACF;AACF,CAAA;AAGO,SAAS,mBACd,MAC6B,EAAA;AAC7B,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA,CAAA;AAC7C,EAAA,MAAM,EAAE,MAAQ,EAAA,SAAA,EAAc,GAAA,IAAI,IAAI,MAAM,CAAA,CAAA;AAE5C,EAAA,MAAM,iBAAiB,MAAO,CAAA,sBAAA;AAAA,IAC5B,sCAAA;AAAA,GACF,CAAA;AAEA,EAAA,MAAM,wBACJ,cAAgB,EAAA,GAAA;AAAA,IACd,CAAA,OAAA,KAAW,IAAIC,mBAAU,CAAA,OAAA,EAAS,EAAE,MAAQ,EAAA,IAAA,EAAM,UAAY,EAAA,IAAA,EAAM,CAAA;AAAA,OACjE,EAAC,CAAA;AAER,EAAA,OAAO,CAAU,MAAA,KAAA;AACf,IAAA,IAAI,WAAW,SAAW,EAAA;AACxB,MAAO,OAAA,IAAA,CAAA;AAAA,KACT;AACA,IAAA,OAAO,sBAAsB,IAAK,CAAA,CAAA,OAAA,KAAW,OAAQ,CAAA,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA;AAAA,GACpE,CAAA;AACF;;;;;"}
+{"version":3,"file":"router.cjs.js","sources":["../../src/providers/router.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  PluginEndpointDiscovery,\n  TokenManager,\n} from '@backstage/backend-common';\nimport {\n  AuthService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport { CatalogApi, CatalogClient } from '@backstage/catalog-client';\nimport { Config } from '@backstage/config';\nimport { assertError, NotFoundError } from '@backstage/errors';\nimport {\n  AuthOwnershipResolver,\n  AuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Minimatch } from 'minimatch';\nimport { CatalogAuthResolverContext } from '../lib/resolvers/CatalogAuthResolverContext';\nimport { TokenIssuer } from '../identity/types';\n\n/** @public */\nexport type ProviderFactories = { [s: string]: AuthProviderFactory };\n\nexport function bindProviderRouters(\n  targetRouter: express.Router,\n  options: {\n    providers: ProviderFactories;\n    appUrl: string;\n    baseUrl: string;\n    config: Config;\n    logger: LoggerService;\n    discovery: PluginEndpointDiscovery;\n    auth: AuthService;\n    httpAuth: HttpAuthService;\n    tokenManager?: TokenManager;\n    tokenIssuer: TokenIssuer;\n    ownershipResolver?: AuthOwnershipResolver;\n    catalogApi?: CatalogApi;\n  },\n) {\n  const {\n    providers,\n    appUrl,\n    baseUrl,\n    config,\n    logger,\n    discovery,\n    auth,\n    httpAuth,\n    tokenManager,\n    tokenIssuer,\n    catalogApi,\n    ownershipResolver,\n  } = options;\n\n  const providersConfig = config.getOptionalConfig('auth.providers');\n\n  const isOriginAllowed = createOriginFilter(config);\n\n  for (const [providerId, providerFactory] of Object.entries(providers)) {\n    if (providersConfig?.has(providerId)) {\n      logger.info(`Configuring auth provider: ${providerId}`);\n      try {\n        const provider = providerFactory({\n          providerId,\n          appUrl,\n          baseUrl,\n          isOriginAllowed,\n          globalConfig: {\n            baseUrl,\n            appUrl,\n            isOriginAllowed,\n          },\n          config: providersConfig.getConfig(providerId),\n          logger,\n          resolverContext: CatalogAuthResolverContext.create({\n            logger,\n            catalogApi:\n              catalogApi ?? new CatalogClient({ discoveryApi: discovery }),\n            tokenIssuer,\n            tokenManager,\n            discovery,\n            auth,\n            httpAuth,\n            ownershipResolver,\n          }),\n        });\n\n        const r = Router();\n\n        r.get('/start', provider.start.bind(provider));\n        r.get('/handler/frame', provider.frameHandler.bind(provider));\n        r.post('/handler/frame', provider.frameHandler.bind(provider));\n        if (provider.logout) {\n          r.post('/logout', provider.logout.bind(provider));\n        }\n        if (provider.refresh) {\n          r.get('/refresh', provider.refresh.bind(provider));\n          r.post('/refresh', provider.refresh.bind(provider));\n        }\n\n        targetRouter.use(`/${providerId}`, r);\n      } catch (e) {\n        assertError(e);\n        if (process.env.NODE_ENV !== 'development') {\n          throw new Error(\n            `Failed to initialize ${providerId} auth provider, ${e.message}`,\n          );\n        }\n\n        logger.warn(`Skipping ${providerId} auth provider, ${e.message}`);\n\n        targetRouter.use(`/${providerId}`, () => {\n          // If the user added the provider under auth.providers but the clientId and clientSecret etc. were not found.\n          throw new NotFoundError(\n            `Auth provider registered for '${providerId}' is misconfigured. This could mean the configs under ` +\n              `auth.providers.${providerId} are missing or the environment variables used are not defined. ` +\n              `Check the auth backend plugin logs when the backend starts to see more details.`,\n          );\n        });\n      }\n    } else {\n      targetRouter.use(`/${providerId}`, () => {\n        throw new NotFoundError(\n          `No auth provider registered for '${providerId}'`,\n        );\n      });\n    }\n  }\n}\n\n/** @public */\nexport function createOriginFilter(\n  config: Config,\n): (origin: string) => boolean {\n  const appUrl = config.getString('app.baseUrl');\n  const { origin: appOrigin } = new URL(appUrl);\n\n  const allowedOrigins = config.getOptionalStringArray(\n    'auth.experimentalExtraAllowedOrigins',\n  );\n\n  const allowedOriginPatterns =\n    allowedOrigins?.map(\n      pattern => new Minimatch(pattern, { nocase: true, noglobstar: true }),\n    ) ?? [];\n\n  return origin => {\n    if (origin === appOrigin) {\n      return true;\n    }\n    return allowedOriginPatterns.some(pattern => pattern.match(origin));\n  };\n}\n"],"names":["CatalogAuthResolverContext","CatalogClient","Router","assertError","NotFoundError","Minimatch"],"mappings":";;;;;;;;;;;;AAyCgB,SAAA,mBAAA,CACd,cACA,OAcA,EAAA;AACA,EAAM,MAAA;AAAA,IACJ,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,YAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACE,GAAA,OAAA;AAEJ,EAAM,MAAA,eAAA,GAAkB,MAAO,CAAA,iBAAA,CAAkB,gBAAgB,CAAA;AAEjE,EAAM,MAAA,eAAA,GAAkB,mBAAmB,MAAM,CAAA;AAEjD,EAAA,KAAA,MAAW,CAAC,UAAY,EAAA,eAAe,KAAK,MAAO,CAAA,OAAA,CAAQ,SAAS,CAAG,EAAA;AACrE,IAAI,IAAA,eAAA,EAAiB,GAAI,CAAA,UAAU,CAAG,EAAA;AACpC,MAAO,MAAA,CAAA,IAAA,CAAK,CAA8B,2BAAA,EAAA,UAAU,CAAE,CAAA,CAAA;AACtD,MAAI,IAAA;AACF,QAAA,MAAM,WAAW,eAAgB,CAAA;AAAA,UAC/B,UAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAA;AAAA,UACA,eAAA;AAAA,UACA,YAAc,EAAA;AAAA,YACZ,OAAA;AAAA,YACA,MAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,MAAA,EAAQ,eAAgB,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,UAC5C,MAAA;AAAA,UACA,eAAA,EAAiBA,sDAA2B,MAAO,CAAA;AAAA,YACjD,MAAA;AAAA,YACA,YACE,UAAc,IAAA,IAAIC,4BAAc,EAAE,YAAA,EAAc,WAAW,CAAA;AAAA,YAC7D,WAAA;AAAA,YACA,YAAA;AAAA,YACA,SAAA;AAAA,YACA,IAAA;AAAA,YACA,QAAA;AAAA,YACA;AAAA,WACD;AAAA,SACF,CAAA;AAED,QAAA,MAAM,IAAIC,uBAAO,EAAA;AAEjB,QAAA,CAAA,CAAE,IAAI,QAAU,EAAA,QAAA,CAAS,KAAM,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC7C,QAAA,CAAA,CAAE,IAAI,gBAAkB,EAAA,QAAA,CAAS,YAAa,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC5D,QAAA,CAAA,CAAE,KAAK,gBAAkB,EAAA,QAAA,CAAS,YAAa,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC7D,QAAA,IAAI,SAAS,MAAQ,EAAA;AACnB,UAAA,CAAA,CAAE,KAAK,SAAW,EAAA,QAAA,CAAS,MAAO,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA;AAAA;AAElD,QAAA,IAAI,SAAS,OAAS,EAAA;AACpB,UAAA,CAAA,CAAE,IAAI,UAAY,EAAA,QAAA,CAAS,OAAQ,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA;AACjD,UAAA,CAAA,CAAE,KAAK,UAAY,EAAA,QAAA,CAAS,OAAQ,CAAA,IAAA,CAAK,QAAQ,CAAC,CAAA;AAAA;AAGpD,QAAA,YAAA,CAAa,GAAI,CAAA,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,CAAC,CAAA;AAAA,eAC7B,CAAG,EAAA;AACV,QAAAC,kBAAA,CAAY,CAAC,CAAA;AACb,QAAI,IAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,aAAe,EAAA;AAC1C,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAwB,qBAAA,EAAA,UAAU,CAAmB,gBAAA,EAAA,CAAA,CAAE,OAAO,CAAA;AAAA,WAChE;AAAA;AAGF,QAAA,MAAA,CAAO,KAAK,CAAY,SAAA,EAAA,UAAU,CAAmB,gBAAA,EAAA,CAAA,CAAE,OAAO,CAAE,CAAA,CAAA;AAEhE,QAAA,YAAA,CAAa,GAAI,CAAA,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,MAAM;AAEvC,UAAA,MAAM,IAAIC,oBAAA;AAAA,YACR,CAAA,8BAAA,EAAiC,UAAU,CAAA,qEAAA,EACvB,UAAU,CAAA,+IAAA;AAAA,WAEhC;AAAA,SACD,CAAA;AAAA;AACH,KACK,MAAA;AACL,MAAA,YAAA,CAAa,GAAI,CAAA,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,EAAI,MAAM;AACvC,QAAA,MAAM,IAAIA,oBAAA;AAAA,UACR,oCAAoC,UAAU,CAAA,CAAA;AAAA,SAChD;AAAA,OACD,CAAA;AAAA;AACH;AAEJ;AAGO,SAAS,mBACd,MAC6B,EAAA;AAC7B,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA;AAC7C,EAAA,MAAM,EAAE,MAAQ,EAAA,SAAA,EAAc,GAAA,IAAI,IAAI,MAAM,CAAA;AAE5C,EAAA,MAAM,iBAAiB,MAAO,CAAA,sBAAA;AAAA,IAC5B;AAAA,GACF;AAEA,EAAA,MAAM,wBACJ,cAAgB,EAAA,GAAA;AAAA,IACd,CAAA,OAAA,KAAW,IAAIC,mBAAU,CAAA,OAAA,EAAS,EAAE,MAAQ,EAAA,IAAA,EAAM,UAAY,EAAA,IAAA,EAAM;AAAA,OACjE,EAAC;AAER,EAAA,OAAO,CAAU,MAAA,KAAA;AACf,IAAA,IAAI,WAAW,SAAW,EAAA;AACxB,MAAO,OAAA,IAAA;AAAA;AAET,IAAA,OAAO,sBAAsB,IAAK,CAAA,CAAA,OAAA,KAAW,OAAQ,CAAA,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,GACpE;AACF;;;;;"}

package/dist/providers/saml/provider.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/saml/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport { SamlConfig, VerifiedCallback } from '@node-saml/passport-saml';\nimport {\n  Strategy as SamlStrategy,\n  Profile as SamlProfile,\n  VerifyWithoutRequest,\n} from '@node-saml/passport-saml';\nimport {\n  executeFrameHandlerStrategy,\n  executeRedirectStrategy,\n} from '../../lib/passport';\nimport { AuthHandler } from '../types';\nimport { postMessageResponse } from '../../lib/flow';\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport { AuthenticationError, isError } from '@backstage/errors';\nimport { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';\nimport {\n  AuthProviderRouteHandlers,\n  AuthResolverContext,\n  ClientAuthResponse,\n  SignInResolver,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport type SamlAuthResult = {\n  fullProfile: any;\n};\n\ntype Options = SamlConfig & {\n  signInResolver?: SignInResolver<SamlAuthResult>;\n  authHandler: AuthHandler<SamlAuthResult>;\n  resolverContext: AuthResolverContext;\n  appUrl: string;\n};\n\nexport class SamlAuthProvider implements AuthProviderRouteHandlers {\n  private readonly strategy: SamlStrategy;\n  private readonly signInResolver?: SignInResolver<SamlAuthResult>;\n  private readonly authHandler: AuthHandler<SamlAuthResult>;\n  private readonly resolverContext: AuthResolverContext;\n  private readonly appUrl: string;\n\n  constructor(options: Options) {\n    this.appUrl = options.appUrl;\n    this.signInResolver = options.signInResolver;\n    this.authHandler = options.authHandler;\n    this.resolverContext = options.resolverContext;\n\n    const verifier: VerifyWithoutRequest = (\n      profile: SamlProfile | null,\n      done: VerifiedCallback,\n    ) => {\n      // TODO: There's plenty more validation and profile handling to do here,\n      //       this provider is currently only intended to validate the provider pattern\n      //       for non-oauth auth flows.\n      // TODO: This flow doesn't issue an identity token that can be used to validate\n      //       the identity of the user in other backends, which we need in some form.\n      done(null, { fullProfile: profile });\n    };\n    this.strategy = new SamlStrategy(options, verifier, verifier);\n  }\n\n  async start(req: express.Request, res: express.Response): Promise<void> {\n    const { url } = await executeRedirectStrategy(req, this.strategy, {});\n    res.redirect(url);\n  }\n\n  async frameHandler(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    try {\n      const { result } = await executeFrameHandlerStrategy<SamlAuthResult>(\n        req,\n        this.strategy,\n      );\n\n      const { profile } = await this.authHandler(result, this.resolverContext);\n\n      const response: ClientAuthResponse<{}> = {\n        profile,\n        providerInfo: {},\n      };\n\n      if (this.signInResolver) {\n        const signInResponse = await this.signInResolver(\n          {\n            result,\n            profile,\n          },\n          this.resolverContext,\n        );\n\n        response.backstageIdentity =\n          prepareBackstageIdentityResponse(signInResponse);\n      }\n\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        response,\n      });\n    } catch (error) {\n      const { name, message } = isError(error)\n        ? error\n        : new Error('Encountered invalid error'); // Being a bit safe and not forwarding the bad value\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        error: { name, message },\n      });\n    }\n  }\n\n  async logout(_req: express.Request, res: express.Response): Promise<void> {\n    res.end();\n  }\n}\n\ntype SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';\n\n/**\n * Auth provider integration for SAML auth\n *\n * @public\n */\nexport const saml = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<SamlAuthResult>;\n\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      /**\n       * Maps an auth result to a Backstage identity for the user.\n       */\n      resolver: SignInResolver<SamlAuthResult>;\n    };\n  }) {\n    return ({ providerId, globalConfig, config, resolverContext }) => {\n      const authHandler: AuthHandler<SamlAuthResult> = options?.authHandler\n        ? options.authHandler\n        : async ({ fullProfile }) => ({\n            profile: {\n              email: fullProfile.email,\n              displayName: fullProfile.displayName,\n            },\n          });\n\n      return new SamlAuthProvider({\n        callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,\n        entryPoint: config.getString('entryPoint'),\n        logoutUrl: config.getOptionalString('logoutUrl'),\n        audience: config.getString('audience'),\n        issuer: config.getString('issuer'),\n        idpCert: config.getString('cert'),\n        privateKey: config.getOptionalString('privateKey'),\n        authnContext: config.getOptionalStringArray('authnContext'),\n        identifierFormat: config.getOptionalString('identifierFormat'),\n        decryptionPvk: config.getOptionalString('decryptionPvk'),\n        signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as\n          | SignatureAlgorithm\n          | undefined,\n        digestAlgorithm: config.getOptionalString('digestAlgorithm'),\n        acceptedClockSkewMs: config.getOptionalNumber('acceptedClockSkewMs'),\n        wantAuthnResponseSigned: config.getOptionalBoolean(\n          'wantAuthnResponseSigned',\n        ),\n        wantAssertionsSigned: config.getOptionalBoolean('wantAssertionsSigned'),\n        appUrl: globalConfig.appUrl,\n        authHandler,\n        signInResolver: options?.signIn?.resolver,\n        resolverContext,\n      });\n    };\n  },\n  resolvers: {\n    /**\n     * Looks up the user by matching their nameID to the entity name.\n     */\n    nameIdMatchingUserEntityName(): SignInResolver<SamlAuthResult> {\n      return async (info, ctx) => {\n        const id = info.result.fullProfile.nameID;\n\n        if (!id) {\n          throw new AuthenticationError('No nameID found in SAML response');\n        }\n\n        return ctx.signInWithCatalogUser({\n          entityRef: { name: id },\n        });\n      };\n    },\n  },\n});\n"],"names":["SamlStrategy","executeRedirectStrategy","executeFrameHandlerStrategy","prepareBackstageIdentityResponse","postMessageResponse","isError","createAuthProviderIntegration","AuthenticationError"],"mappings":";;;;;;;;;AAmDO,MAAM,gBAAsD,CAAA;AAAA,EAChD,QAAA,CAAA;AAAA,EACA,cAAA,CAAA;AAAA,EACA,WAAA,CAAA;AAAA,EACA,eAAA,CAAA;AAAA,EACA,MAAA,CAAA;AAAA,EAEjB,YAAY,OAAkB,EAAA;AAC5B,IAAA,IAAA,CAAK,SAAS,OAAQ,CAAA,MAAA,CAAA;AACtB,IAAA,IAAA,CAAK,iBAAiB,OAAQ,CAAA,cAAA,CAAA;AAC9B,IAAA,IAAA,CAAK,cAAc,OAAQ,CAAA,WAAA,CAAA;AAC3B,IAAA,IAAA,CAAK,kBAAkB,OAAQ,CAAA,eAAA,CAAA;AAE/B,IAAM,MAAA,QAAA,GAAiC,CACrC,OAAA,EACA,IACG,KAAA;AAMH,MAAA,IAAA,CAAK,IAAM,EAAA,EAAE,WAAa,EAAA,OAAA,EAAS,CAAA,CAAA;AAAA,KACrC,CAAA;AACA,IAAA,IAAA,CAAK,QAAW,GAAA,IAAIA,qBAAa,CAAA,OAAA,EAAS,UAAU,QAAQ,CAAA,CAAA;AAAA,GAC9D;AAAA,EAEA,MAAM,KAAM,CAAA,GAAA,EAAsB,GAAsC,EAAA;AACtE,IAAM,MAAA,EAAE,KAAQ,GAAA,MAAMC,+CAAwB,GAAK,EAAA,IAAA,CAAK,QAAU,EAAA,EAAE,CAAA,CAAA;AACpE,IAAA,GAAA,CAAI,SAAS,GAAG,CAAA,CAAA;AAAA,GAClB;AAAA,EAEA,MAAM,YACJ,CAAA,GAAA,EACA,GACe,EAAA;AACf,IAAI,IAAA;AACF,MAAM,MAAA,EAAE,MAAO,EAAA,GAAI,MAAMC,kDAAA;AAAA,QACvB,GAAA;AAAA,QACA,IAAK,CAAA,QAAA;AAAA,OACP,CAAA;AAEA,MAAM,MAAA,EAAE,SAAY,GAAA,MAAM,KAAK,WAAY,CAAA,MAAA,EAAQ,KAAK,eAAe,CAAA,CAAA;AAEvE,MAAA,MAAM,QAAmC,GAAA;AAAA,QACvC,OAAA;AAAA,QACA,cAAc,EAAC;AAAA,OACjB,CAAA;AAEA,MAAA,IAAI,KAAK,cAAgB,EAAA;AACvB,QAAM,MAAA,cAAA,GAAiB,MAAM,IAAK,CAAA,cAAA;AAAA,UAChC;AAAA,YACE,MAAA;AAAA,YACA,OAAA;AAAA,WACF;AAAA,UACA,IAAK,CAAA,eAAA;AAAA,SACP,CAAA;AAEA,QAAS,QAAA,CAAA,iBAAA,GACPC,kEAAiC,cAAc,CAAA,CAAA;AAAA,OACnD;AAEA,MAAO,OAAAC,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN,QAAA;AAAA,OACD,CAAA,CAAA;AAAA,aACM,KAAO,EAAA;AACd,MAAM,MAAA,EAAE,IAAM,EAAA,OAAA,EAAY,GAAAC,cAAA,CAAQ,KAAK,CACnC,GAAA,KAAA,GACA,IAAI,KAAA,CAAM,2BAA2B,CAAA,CAAA;AACzC,MAAO,OAAAD,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN,KAAA,EAAO,EAAE,IAAA,EAAM,OAAQ,EAAA;AAAA,OACxB,CAAA,CAAA;AAAA,KACH;AAAA,GACF;AAAA,EAEA,MAAM,MAAO,CAAA,IAAA,EAAuB,GAAsC,EAAA;AACxE,IAAA,GAAA,CAAI,GAAI,EAAA,CAAA;AAAA,GACV;AACF,CAAA;AASO,MAAM,OAAOE,2DAA8B,CAAA;AAAA,EAChD,OAAO,OAgBJ,EAAA;AACD,IAAA,OAAO,CAAC,EAAE,UAAA,EAAY,YAAc,EAAA,MAAA,EAAQ,iBAAsB,KAAA;AAChE,MAAM,MAAA,WAAA,GAA2C,SAAS,WACtD,GAAA,OAAA,CAAQ,cACR,OAAO,EAAE,aAAmB,MAAA;AAAA,QAC1B,OAAS,EAAA;AAAA,UACP,OAAO,WAAY,CAAA,KAAA;AAAA,UACnB,aAAa,WAAY,CAAA,WAAA;AAAA,SAC3B;AAAA,OACF,CAAA,CAAA;AAEJ,MAAA,OAAO,IAAI,gBAAiB,CAAA;AAAA,QAC1B,WAAa,EAAA,CAAA,EAAG,YAAa,CAAA,OAAO,IAAI,UAAU,CAAA,cAAA,CAAA;AAAA,QAClD,UAAA,EAAY,MAAO,CAAA,SAAA,CAAU,YAAY,CAAA;AAAA,QACzC,SAAA,EAAW,MAAO,CAAA,iBAAA,CAAkB,WAAW,CAAA;AAAA,QAC/C,QAAA,EAAU,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,QACrC,MAAA,EAAQ,MAAO,CAAA,SAAA,CAAU,QAAQ,CAAA;AAAA,QACjC,OAAA,EAAS,MAAO,CAAA,SAAA,CAAU,MAAM,CAAA;AAAA,QAChC,UAAA,EAAY,MAAO,CAAA,iBAAA,CAAkB,YAAY,CAAA;AAAA,QACjD,YAAA,EAAc,MAAO,CAAA,sBAAA,CAAuB,cAAc,CAAA;AAAA,QAC1D,gBAAA,EAAkB,MAAO,CAAA,iBAAA,CAAkB,kBAAkB,CAAA;AAAA,QAC7D,aAAA,EAAe,MAAO,CAAA,iBAAA,CAAkB,eAAe,CAAA;AAAA,QACvD,kBAAA,EAAoB,MAAO,CAAA,iBAAA,CAAkB,oBAAoB,CAAA;AAAA,QAGjE,eAAA,EAAiB,MAAO,CAAA,iBAAA,CAAkB,iBAAiB,CAAA;AAAA,QAC3D,mBAAA,EAAqB,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACnE,yBAAyB,MAAO,CAAA,kBAAA;AAAA,UAC9B,yBAAA;AAAA,SACF;AAAA,QACA,oBAAA,EAAsB,MAAO,CAAA,kBAAA,CAAmB,sBAAsB,CAAA;AAAA,QACtE,QAAQ,YAAa,CAAA,MAAA;AAAA,QACrB,WAAA;AAAA,QACA,cAAA,EAAgB,SAAS,MAAQ,EAAA,QAAA;AAAA,QACjC,eAAA;AAAA,OACD,CAAA,CAAA;AAAA,KACH,CAAA;AAAA,GACF;AAAA,EACA,SAAW,EAAA;AAAA;AAAA;AAAA;AAAA,IAIT,4BAA+D,GAAA;AAC7D,MAAO,OAAA,OAAO,MAAM,GAAQ,KAAA;AAC1B,QAAM,MAAA,EAAA,GAAK,IAAK,CAAA,MAAA,CAAO,WAAY,CAAA,MAAA,CAAA;AAEnC,QAAA,IAAI,CAAC,EAAI,EAAA;AACP,UAAM,MAAA,IAAIC,2BAAoB,kCAAkC,CAAA,CAAA;AAAA,SAClE;AAEA,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,EAAG,EAAA;AAAA,SACvB,CAAA,CAAA;AAAA,OACH,CAAA;AAAA,KACF;AAAA,GACF;AACF,CAAC;;;;;"}
+{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/saml/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport { SamlConfig, VerifiedCallback } from '@node-saml/passport-saml';\nimport {\n  Strategy as SamlStrategy,\n  Profile as SamlProfile,\n  VerifyWithoutRequest,\n} from '@node-saml/passport-saml';\nimport {\n  executeFrameHandlerStrategy,\n  executeRedirectStrategy,\n} from '../../lib/passport';\nimport { AuthHandler } from '../types';\nimport { postMessageResponse } from '../../lib/flow';\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport { AuthenticationError, isError } from '@backstage/errors';\nimport { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';\nimport {\n  AuthProviderRouteHandlers,\n  AuthResolverContext,\n  ClientAuthResponse,\n  SignInResolver,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport type SamlAuthResult = {\n  fullProfile: any;\n};\n\ntype Options = SamlConfig & {\n  signInResolver?: SignInResolver<SamlAuthResult>;\n  authHandler: AuthHandler<SamlAuthResult>;\n  resolverContext: AuthResolverContext;\n  appUrl: string;\n};\n\nexport class SamlAuthProvider implements AuthProviderRouteHandlers {\n  private readonly strategy: SamlStrategy;\n  private readonly signInResolver?: SignInResolver<SamlAuthResult>;\n  private readonly authHandler: AuthHandler<SamlAuthResult>;\n  private readonly resolverContext: AuthResolverContext;\n  private readonly appUrl: string;\n\n  constructor(options: Options) {\n    this.appUrl = options.appUrl;\n    this.signInResolver = options.signInResolver;\n    this.authHandler = options.authHandler;\n    this.resolverContext = options.resolverContext;\n\n    const verifier: VerifyWithoutRequest = (\n      profile: SamlProfile | null,\n      done: VerifiedCallback,\n    ) => {\n      // TODO: There's plenty more validation and profile handling to do here,\n      //       this provider is currently only intended to validate the provider pattern\n      //       for non-oauth auth flows.\n      // TODO: This flow doesn't issue an identity token that can be used to validate\n      //       the identity of the user in other backends, which we need in some form.\n      done(null, { fullProfile: profile });\n    };\n    this.strategy = new SamlStrategy(options, verifier, verifier);\n  }\n\n  async start(req: express.Request, res: express.Response): Promise<void> {\n    const { url } = await executeRedirectStrategy(req, this.strategy, {});\n    res.redirect(url);\n  }\n\n  async frameHandler(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    try {\n      const { result } = await executeFrameHandlerStrategy<SamlAuthResult>(\n        req,\n        this.strategy,\n      );\n\n      const { profile } = await this.authHandler(result, this.resolverContext);\n\n      const response: ClientAuthResponse<{}> = {\n        profile,\n        providerInfo: {},\n      };\n\n      if (this.signInResolver) {\n        const signInResponse = await this.signInResolver(\n          {\n            result,\n            profile,\n          },\n          this.resolverContext,\n        );\n\n        response.backstageIdentity =\n          prepareBackstageIdentityResponse(signInResponse);\n      }\n\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        response,\n      });\n    } catch (error) {\n      const { name, message } = isError(error)\n        ? error\n        : new Error('Encountered invalid error'); // Being a bit safe and not forwarding the bad value\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        error: { name, message },\n      });\n    }\n  }\n\n  async logout(_req: express.Request, res: express.Response): Promise<void> {\n    res.end();\n  }\n}\n\ntype SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';\n\n/**\n * Auth provider integration for SAML auth\n *\n * @public\n */\nexport const saml = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<SamlAuthResult>;\n\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      /**\n       * Maps an auth result to a Backstage identity for the user.\n       */\n      resolver: SignInResolver<SamlAuthResult>;\n    };\n  }) {\n    return ({ providerId, globalConfig, config, resolverContext }) => {\n      const authHandler: AuthHandler<SamlAuthResult> = options?.authHandler\n        ? options.authHandler\n        : async ({ fullProfile }) => ({\n            profile: {\n              email: fullProfile.email,\n              displayName: fullProfile.displayName,\n            },\n          });\n\n      return new SamlAuthProvider({\n        callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,\n        entryPoint: config.getString('entryPoint'),\n        logoutUrl: config.getOptionalString('logoutUrl'),\n        audience: config.getString('audience'),\n        issuer: config.getString('issuer'),\n        idpCert: config.getString('cert'),\n        privateKey: config.getOptionalString('privateKey'),\n        authnContext: config.getOptionalStringArray('authnContext'),\n        identifierFormat: config.getOptionalString('identifierFormat'),\n        decryptionPvk: config.getOptionalString('decryptionPvk'),\n        signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as\n          | SignatureAlgorithm\n          | undefined,\n        digestAlgorithm: config.getOptionalString('digestAlgorithm'),\n        acceptedClockSkewMs: config.getOptionalNumber('acceptedClockSkewMs'),\n        wantAuthnResponseSigned: config.getOptionalBoolean(\n          'wantAuthnResponseSigned',\n        ),\n        wantAssertionsSigned: config.getOptionalBoolean('wantAssertionsSigned'),\n        appUrl: globalConfig.appUrl,\n        authHandler,\n        signInResolver: options?.signIn?.resolver,\n        resolverContext,\n      });\n    };\n  },\n  resolvers: {\n    /**\n     * Looks up the user by matching their nameID to the entity name.\n     */\n    nameIdMatchingUserEntityName(): SignInResolver<SamlAuthResult> {\n      return async (info, ctx) => {\n        const id = info.result.fullProfile.nameID;\n\n        if (!id) {\n          throw new AuthenticationError('No nameID found in SAML response');\n        }\n\n        return ctx.signInWithCatalogUser({\n          entityRef: { name: id },\n        });\n      };\n    },\n  },\n});\n"],"names":["SamlStrategy","executeRedirectStrategy","executeFrameHandlerStrategy","prepareBackstageIdentityResponse","postMessageResponse","isError","createAuthProviderIntegration","AuthenticationError"],"mappings":";;;;;;;;;AAmDO,MAAM,gBAAsD,CAAA;AAAA,EAChD,QAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,MAAA;AAAA,EAEjB,YAAY,OAAkB,EAAA;AAC5B,IAAA,IAAA,CAAK,SAAS,OAAQ,CAAA,MAAA;AACtB,IAAA,IAAA,CAAK,iBAAiB,OAAQ,CAAA,cAAA;AAC9B,IAAA,IAAA,CAAK,cAAc,OAAQ,CAAA,WAAA;AAC3B,IAAA,IAAA,CAAK,kBAAkB,OAAQ,CAAA,eAAA;AAE/B,IAAM,MAAA,QAAA,GAAiC,CACrC,OAAA,EACA,IACG,KAAA;AAMH,MAAA,IAAA,CAAK,IAAM,EAAA,EAAE,WAAa,EAAA,OAAA,EAAS,CAAA;AAAA,KACrC;AACA,IAAA,IAAA,CAAK,QAAW,GAAA,IAAIA,qBAAa,CAAA,OAAA,EAAS,UAAU,QAAQ,CAAA;AAAA;AAC9D,EAEA,MAAM,KAAM,CAAA,GAAA,EAAsB,GAAsC,EAAA;AACtE,IAAM,MAAA,EAAE,KAAQ,GAAA,MAAMC,+CAAwB,GAAK,EAAA,IAAA,CAAK,QAAU,EAAA,EAAE,CAAA;AACpE,IAAA,GAAA,CAAI,SAAS,GAAG,CAAA;AAAA;AAClB,EAEA,MAAM,YACJ,CAAA,GAAA,EACA,GACe,EAAA;AACf,IAAI,IAAA;AACF,MAAM,MAAA,EAAE,MAAO,EAAA,GAAI,MAAMC,kDAAA;AAAA,QACvB,GAAA;AAAA,QACA,IAAK,CAAA;AAAA,OACP;AAEA,MAAM,MAAA,EAAE,SAAY,GAAA,MAAM,KAAK,WAAY,CAAA,MAAA,EAAQ,KAAK,eAAe,CAAA;AAEvE,MAAA,MAAM,QAAmC,GAAA;AAAA,QACvC,OAAA;AAAA,QACA,cAAc;AAAC,OACjB;AAEA,MAAA,IAAI,KAAK,cAAgB,EAAA;AACvB,QAAM,MAAA,cAAA,GAAiB,MAAM,IAAK,CAAA,cAAA;AAAA,UAChC;AAAA,YACE,MAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,IAAK,CAAA;AAAA,SACP;AAEA,QAAS,QAAA,CAAA,iBAAA,GACPC,kEAAiC,cAAc,CAAA;AAAA;AAGnD,MAAO,OAAAC,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN;AAAA,OACD,CAAA;AAAA,aACM,KAAO,EAAA;AACd,MAAM,MAAA,EAAE,IAAM,EAAA,OAAA,EAAY,GAAAC,cAAA,CAAQ,KAAK,CACnC,GAAA,KAAA,GACA,IAAI,KAAA,CAAM,2BAA2B,CAAA;AACzC,MAAO,OAAAD,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN,KAAA,EAAO,EAAE,IAAA,EAAM,OAAQ;AAAA,OACxB,CAAA;AAAA;AACH;AACF,EAEA,MAAM,MAAO,CAAA,IAAA,EAAuB,GAAsC,EAAA;AACxE,IAAA,GAAA,CAAI,GAAI,EAAA;AAAA;AAEZ;AASO,MAAM,OAAOE,2DAA8B,CAAA;AAAA,EAChD,OAAO,OAgBJ,EAAA;AACD,IAAA,OAAO,CAAC,EAAE,UAAA,EAAY,YAAc,EAAA,MAAA,EAAQ,iBAAsB,KAAA;AAChE,MAAM,MAAA,WAAA,GAA2C,SAAS,WACtD,GAAA,OAAA,CAAQ,cACR,OAAO,EAAE,aAAmB,MAAA;AAAA,QAC1B,OAAS,EAAA;AAAA,UACP,OAAO,WAAY,CAAA,KAAA;AAAA,UACnB,aAAa,WAAY,CAAA;AAAA;AAC3B,OACF,CAAA;AAEJ,MAAA,OAAO,IAAI,gBAAiB,CAAA;AAAA,QAC1B,WAAa,EAAA,CAAA,EAAG,YAAa,CAAA,OAAO,IAAI,UAAU,CAAA,cAAA,CAAA;AAAA,QAClD,UAAA,EAAY,MAAO,CAAA,SAAA,CAAU,YAAY,CAAA;AAAA,QACzC,SAAA,EAAW,MAAO,CAAA,iBAAA,CAAkB,WAAW,CAAA;AAAA,QAC/C,QAAA,EAAU,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,QACrC,MAAA,EAAQ,MAAO,CAAA,SAAA,CAAU,QAAQ,CAAA;AAAA,QACjC,OAAA,EAAS,MAAO,CAAA,SAAA,CAAU,MAAM,CAAA;AAAA,QAChC,UAAA,EAAY,MAAO,CAAA,iBAAA,CAAkB,YAAY,CAAA;AAAA,QACjD,YAAA,EAAc,MAAO,CAAA,sBAAA,CAAuB,cAAc,CAAA;AAAA,QAC1D,gBAAA,EAAkB,MAAO,CAAA,iBAAA,CAAkB,kBAAkB,CAAA;AAAA,QAC7D,aAAA,EAAe,MAAO,CAAA,iBAAA,CAAkB,eAAe,CAAA;AAAA,QACvD,kBAAA,EAAoB,MAAO,CAAA,iBAAA,CAAkB,oBAAoB,CAAA;AAAA,QAGjE,eAAA,EAAiB,MAAO,CAAA,iBAAA,CAAkB,iBAAiB,CAAA;AAAA,QAC3D,mBAAA,EAAqB,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACnE,yBAAyB,MAAO,CAAA,kBAAA;AAAA,UAC9B;AAAA,SACF;AAAA,QACA,oBAAA,EAAsB,MAAO,CAAA,kBAAA,CAAmB,sBAAsB,CAAA;AAAA,QACtE,QAAQ,YAAa,CAAA,MAAA;AAAA,QACrB,WAAA;AAAA,QACA,cAAA,EAAgB,SAAS,MAAQ,EAAA,QAAA;AAAA,QACjC;AAAA,OACD,CAAA;AAAA,KACH;AAAA,GACF;AAAA,EACA,SAAW,EAAA;AAAA;AAAA;AAAA;AAAA,IAIT,4BAA+D,GAAA;AAC7D,MAAO,OAAA,OAAO,MAAM,GAAQ,KAAA;AAC1B,QAAM,MAAA,EAAA,GAAK,IAAK,CAAA,MAAA,CAAO,WAAY,CAAA,MAAA;AAEnC,QAAA,IAAI,CAAC,EAAI,EAAA;AACP,UAAM,MAAA,IAAIC,2BAAoB,kCAAkC,CAAA;AAAA;AAGlE,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,EAAG;AAAA,SACvB,CAAA;AAAA,OACH;AAAA;AACF;AAEJ,CAAC;;;;;"}

package/dist/service/readBackstageTokenExpiration.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"readBackstageTokenExpiration.cjs.js","sources":["../../src/service/readBackstageTokenExpiration.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { RootConfigService } from '@backstage/backend-plugin-api';\nimport { readDurationFromConfig } from '@backstage/config';\nimport { durationToMilliseconds } from '@backstage/types';\n\nconst TOKEN_EXP_DEFAULT_S = 3600;\nconst TOKEN_EXP_MIN_S = 600;\nconst TOKEN_EXP_MAX_S = 86400;\n\nexport function readBackstageTokenExpiration(config: RootConfigService) {\n  const processingIntervalKey = 'auth.backstageTokenExpiration';\n\n  if (!config.has(processingIntervalKey)) {\n    return TOKEN_EXP_DEFAULT_S;\n  }\n\n  const duration = readDurationFromConfig(config, {\n    key: processingIntervalKey,\n  });\n\n  const durationS = Math.round(durationToMilliseconds(duration) / 1000);\n\n  if (durationS < TOKEN_EXP_MIN_S) {\n    return TOKEN_EXP_MIN_S;\n  } else if (durationS > TOKEN_EXP_MAX_S) {\n    return TOKEN_EXP_MAX_S;\n  }\n  return durationS;\n}\n"],"names":["config","readDurationFromConfig","durationToMilliseconds"],"mappings":";;;;;AAoBA,MAAM,mBAAsB,GAAA,IAAA,CAAA;AAC5B,MAAM,eAAkB,GAAA,GAAA,CAAA;AACxB,MAAM,eAAkB,GAAA,KAAA,CAAA;AAEjB,SAAS,6BAA6BA,QAA2B,EAAA;AACtE,EAAA,MAAM,qBAAwB,GAAA,+BAAA,CAAA;AAE9B,EAAA,IAAI,CAACA,QAAA,CAAO,GAAI,CAAA,qBAAqB,CAAG,EAAA;AACtC,IAAO,OAAA,mBAAA,CAAA;AAAA,GACT;AAEA,EAAM,MAAA,QAAA,GAAWC,8BAAuBD,QAAQ,EAAA;AAAA,IAC9C,GAAK,EAAA,qBAAA;AAAA,GACN,CAAA,CAAA;AAED,EAAA,MAAM,YAAY,IAAK,CAAA,KAAA,CAAME,4BAAuB,CAAA,QAAQ,IAAI,GAAI,CAAA,CAAA;AAEpE,EAAA,IAAI,YAAY,eAAiB,EAAA;AAC/B,IAAO,OAAA,eAAA,CAAA;AAAA,GACT,MAAA,IAAW,YAAY,eAAiB,EAAA;AACtC,IAAO,OAAA,eAAA,CAAA;AAAA,GACT;AACA,EAAO,OAAA,SAAA,CAAA;AACT;;;;"}
+{"version":3,"file":"readBackstageTokenExpiration.cjs.js","sources":["../../src/service/readBackstageTokenExpiration.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { RootConfigService } from '@backstage/backend-plugin-api';\nimport { readDurationFromConfig } from '@backstage/config';\nimport { durationToMilliseconds } from '@backstage/types';\n\nconst TOKEN_EXP_DEFAULT_S = 3600;\nconst TOKEN_EXP_MIN_S = 600;\nconst TOKEN_EXP_MAX_S = 86400;\n\nexport function readBackstageTokenExpiration(config: RootConfigService) {\n  const processingIntervalKey = 'auth.backstageTokenExpiration';\n\n  if (!config.has(processingIntervalKey)) {\n    return TOKEN_EXP_DEFAULT_S;\n  }\n\n  const duration = readDurationFromConfig(config, {\n    key: processingIntervalKey,\n  });\n\n  const durationS = Math.round(durationToMilliseconds(duration) / 1000);\n\n  if (durationS < TOKEN_EXP_MIN_S) {\n    return TOKEN_EXP_MIN_S;\n  } else if (durationS > TOKEN_EXP_MAX_S) {\n    return TOKEN_EXP_MAX_S;\n  }\n  return durationS;\n}\n"],"names":["config","readDurationFromConfig","durationToMilliseconds"],"mappings":";;;;;AAoBA,MAAM,mBAAsB,GAAA,IAAA;AAC5B,MAAM,eAAkB,GAAA,GAAA;AACxB,MAAM,eAAkB,GAAA,KAAA;AAEjB,SAAS,6BAA6BA,QAA2B,EAAA;AACtE,EAAA,MAAM,qBAAwB,GAAA,+BAAA;AAE9B,EAAA,IAAI,CAACA,QAAA,CAAO,GAAI,CAAA,qBAAqB,CAAG,EAAA;AACtC,IAAO,OAAA,mBAAA;AAAA;AAGT,EAAM,MAAA,QAAA,GAAWC,8BAAuBD,QAAQ,EAAA;AAAA,IAC9C,GAAK,EAAA;AAAA,GACN,CAAA;AAED,EAAA,MAAM,YAAY,IAAK,CAAA,KAAA,CAAME,4BAAuB,CAAA,QAAQ,IAAI,GAAI,CAAA;AAEpE,EAAA,IAAI,YAAY,eAAiB,EAAA;AAC/B,IAAO,OAAA,eAAA;AAAA,GACT,MAAA,IAAW,YAAY,eAAiB,EAAA;AACtC,IAAO,OAAA,eAAA;AAAA;AAET,EAAO,OAAA,SAAA;AACT;;;;"}

package/dist/service/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cookieParser from 'cookie-parser';\nimport {\n  AuthService,\n  DatabaseService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { defaultAuthProviderFactories } from '../providers';\nimport { AuthOwnershipResolver } from '@backstage/plugin-auth-node';\nimport {\n  TokenManager,\n  createLegacyAuthAdapters,\n} from '@backstage/backend-common';\nimport { NotFoundError } from '@backstage/errors';\nimport { CatalogApi } from '@backstage/catalog-client';\nimport {\n  bindOidcRouter,\n  KeyStores,\n  TokenFactory,\n  UserInfoDatabaseHandler,\n} from '../identity';\nimport session from 'express-session';\nimport connectSessionKnex from 'connect-session-knex';\nimport passport from 'passport';\nimport { AuthDatabase } from '../database/AuthDatabase';\nimport { readBackstageTokenExpiration } from './readBackstageTokenExpiration';\nimport { TokenIssuer } from '../identity/types';\nimport { StaticTokenIssuer } from '../identity/StaticTokenIssuer';\nimport { StaticKeyStore } from '../identity/StaticKeyStore';\nimport { bindProviderRouters, ProviderFactories } from '../providers/router';\n\n/**\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  database: DatabaseService;\n  config: RootConfigService;\n  discovery: DiscoveryService;\n  tokenManager?: TokenManager;\n  auth?: AuthService;\n  httpAuth?: HttpAuthService;\n  tokenFactoryAlgorithm?: string;\n  providerFactories?: ProviderFactories;\n  disableDefaultProviderFactories?: boolean;\n  catalogApi?: CatalogApi;\n  ownershipResolver?: AuthOwnershipResolver;\n}\n\n/**\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    logger,\n    config,\n    discovery,\n    database,\n    tokenFactoryAlgorithm,\n    providerFactories = {},\n  } = options;\n\n  const { auth, httpAuth } = createLegacyAuthAdapters(options);\n\n  const router = Router();\n\n  const appUrl = config.getString('app.baseUrl');\n  const authUrl = await discovery.getExternalBaseUrl('auth');\n  const backstageTokenExpiration = readBackstageTokenExpiration(config);\n  const authDb = AuthDatabase.create(database);\n\n  const keyStore = await KeyStores.fromConfig(config, {\n    logger,\n    database: authDb,\n  });\n\n  const userInfoDatabaseHandler = new UserInfoDatabaseHandler(\n    await authDb.get(),\n  );\n\n  let tokenIssuer: TokenIssuer;\n  if (keyStore instanceof StaticKeyStore) {\n    tokenIssuer = new StaticTokenIssuer(\n      {\n        logger: logger.child({ component: 'token-factory' }),\n        issuer: authUrl,\n        sessionExpirationSeconds: backstageTokenExpiration,\n      },\n      keyStore as StaticKeyStore,\n    );\n  } else {\n    tokenIssuer = new TokenFactory({\n      issuer: authUrl,\n      keyStore,\n      keyDurationSeconds: backstageTokenExpiration,\n      logger: logger.child({ component: 'token-factory' }),\n      algorithm:\n        tokenFactoryAlgorithm ??\n        config.getOptionalString('auth.identityTokenAlgorithm'),\n      userInfoDatabaseHandler,\n    });\n  }\n\n  const secret = config.getOptionalString('auth.session.secret');\n  if (secret) {\n    router.use(cookieParser(secret));\n    const enforceCookieSSL = authUrl.startsWith('https');\n    const KnexSessionStore = connectSessionKnex(session);\n    router.use(\n      session({\n        secret,\n        saveUninitialized: false,\n        resave: false,\n        cookie: { secure: enforceCookieSSL ? 'auto' : false },\n        store: new KnexSessionStore({\n          createtable: false,\n          knex: await authDb.get(),\n        }),\n      }),\n    );\n    router.use(passport.initialize());\n    router.use(passport.session());\n  } else {\n    router.use(cookieParser());\n  }\n\n  router.use(express.urlencoded({ extended: false }));\n  router.use(express.json());\n\n  const providers = options.disableDefaultProviderFactories\n    ? providerFactories\n    : {\n        ...defaultAuthProviderFactories,\n        ...providerFactories,\n      };\n\n  bindProviderRouters(router, {\n    providers,\n    appUrl,\n    baseUrl: authUrl,\n    tokenIssuer,\n    ...options,\n    auth,\n    httpAuth,\n  });\n\n  bindOidcRouter(router, {\n    auth,\n    tokenIssuer,\n    baseUrl: authUrl,\n    userInfoDatabaseHandler,\n  });\n\n  // Gives a more helpful error message than a plain 404\n  router.use('/:provider/', req => {\n    const { provider } = req.params;\n    throw new NotFoundError(`Unknown auth provider '${provider}'`);\n  });\n\n  return router;\n}\n"],"names":["createLegacyAuthAdapters","router","Router","readBackstageTokenExpiration","AuthDatabase","KeyStores","UserInfoDatabaseHandler","StaticKeyStore","StaticTokenIssuer","TokenFactory","cookieParser","connectSessionKnex","session","passport","express","providers","defaultAuthProviderFactories","bindProviderRouters","bindOidcRouter","NotFoundError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAM,MAAA;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,qBAAA;AAAA,IACA,oBAAoB,EAAC;AAAA,GACnB,GAAA,OAAA,CAAA;AAEJ,EAAA,MAAM,EAAE,IAAA,EAAM,QAAS,EAAA,GAAIA,uCAAyB,OAAO,CAAA,CAAA;AAE3D,EAAA,MAAMC,WAASC,uBAAO,EAAA,CAAA;AAEtB,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA,CAAA;AAC7C,EAAA,MAAM,OAAU,GAAA,MAAM,SAAU,CAAA,kBAAA,CAAmB,MAAM,CAAA,CAAA;AACzD,EAAM,MAAA,wBAAA,GAA2BC,0DAA6B,MAAM,CAAA,CAAA;AACpE,EAAM,MAAA,MAAA,GAASC,yBAAa,CAAA,MAAA,CAAO,QAAQ,CAAA,CAAA;AAE3C,EAAA,MAAM,QAAW,GAAA,MAAMC,mBAAU,CAAA,UAAA,CAAW,MAAQ,EAAA;AAAA,IAClD,MAAA;AAAA,IACA,QAAU,EAAA,MAAA;AAAA,GACX,CAAA,CAAA;AAED,EAAA,MAAM,0BAA0B,IAAIC,+CAAA;AAAA,IAClC,MAAM,OAAO,GAAI,EAAA;AAAA,GACnB,CAAA;AAEA,EAAI,IAAA,WAAA,CAAA;AACJ,EAAA,IAAI,oBAAoBC,6BAAgB,EAAA;AACtC,IAAA,WAAA,GAAc,IAAIC,mCAAA;AAAA,MAChB;AAAA,QACE,QAAQ,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,QACnD,MAAQ,EAAA,OAAA;AAAA,QACR,wBAA0B,EAAA,wBAAA;AAAA,OAC5B;AAAA,MACA,QAAA;AAAA,KACF,CAAA;AAAA,GACK,MAAA;AACL,IAAA,WAAA,GAAc,IAAIC,yBAAa,CAAA;AAAA,MAC7B,MAAQ,EAAA,OAAA;AAAA,MACR,QAAA;AAAA,MACA,kBAAoB,EAAA,wBAAA;AAAA,MACpB,QAAQ,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACnD,SACE,EAAA,qBAAA,IACA,MAAO,CAAA,iBAAA,CAAkB,6BAA6B,CAAA;AAAA,MACxD,uBAAA;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AAEA,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA,CAAA;AAC7D,EAAA,IAAI,MAAQ,EAAA;AACV,IAAOR,QAAA,CAAA,GAAA,CAAIS,6BAAa,CAAA,MAAM,CAAC,CAAA,CAAA;AAC/B,IAAM,MAAA,gBAAA,GAAmB,OAAQ,CAAA,UAAA,CAAW,OAAO,CAAA,CAAA;AACnD,IAAM,MAAA,gBAAA,GAAmBC,oCAAmBC,wBAAO,CAAA,CAAA;AACnD,IAAOX,QAAA,CAAA,GAAA;AAAA,MACLW,wBAAQ,CAAA;AAAA,QACN,MAAA;AAAA,QACA,iBAAmB,EAAA,KAAA;AAAA,QACnB,MAAQ,EAAA,KAAA;AAAA,QACR,MAAQ,EAAA,EAAE,MAAQ,EAAA,gBAAA,GAAmB,SAAS,KAAM,EAAA;AAAA,QACpD,KAAA,EAAO,IAAI,gBAAiB,CAAA;AAAA,UAC1B,WAAa,EAAA,KAAA;AAAA,UACb,IAAA,EAAM,MAAM,MAAA,CAAO,GAAI,EAAA;AAAA,SACxB,CAAA;AAAA,OACF,CAAA;AAAA,KACH,CAAA;AACA,IAAOX,QAAA,CAAA,GAAA,CAAIY,yBAAS,CAAA,UAAA,EAAY,CAAA,CAAA;AAChC,IAAOZ,QAAA,CAAA,GAAA,CAAIY,yBAAS,CAAA,OAAA,EAAS,CAAA,CAAA;AAAA,GACxB,MAAA;AACL,IAAOZ,QAAA,CAAA,GAAA,CAAIS,+BAAc,CAAA,CAAA;AAAA,GAC3B;AAEA,EAAAT,QAAA,CAAO,IAAIa,wBAAQ,CAAA,UAAA,CAAW,EAAE,QAAU,EAAA,KAAA,EAAO,CAAC,CAAA,CAAA;AAClD,EAAOb,QAAA,CAAA,GAAA,CAAIa,wBAAQ,CAAA,IAAA,EAAM,CAAA,CAAA;AAEzB,EAAM,MAAAC,WAAA,GAAY,OAAQ,CAAA,+BAAA,GACtB,iBACA,GAAA;AAAA,IACE,GAAGC,sCAAA;AAAA,IACH,GAAG,iBAAA;AAAA,GACL,CAAA;AAEJ,EAAAC,0BAAA,CAAoBhB,QAAQ,EAAA;AAAA,eAC1Bc,WAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAS,EAAA,OAAA;AAAA,IACT,WAAA;AAAA,IACA,GAAG,OAAA;AAAA,IACH,IAAA;AAAA,IACA,QAAA;AAAA,GACD,CAAA,CAAA;AAED,EAAAG,uBAAA,CAAejB,QAAQ,EAAA;AAAA,IACrB,IAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAS,EAAA,OAAA;AAAA,IACT,uBAAA;AAAA,GACD,CAAA,CAAA;AAGD,EAAOA,QAAA,CAAA,GAAA,CAAI,eAAe,CAAO,GAAA,KAAA;AAC/B,IAAM,MAAA,EAAE,QAAS,EAAA,GAAI,GAAI,CAAA,MAAA,CAAA;AACzB,IAAA,MAAM,IAAIkB,oBAAA,CAAc,CAA0B,uBAAA,EAAA,QAAQ,CAAG,CAAA,CAAA,CAAA,CAAA;AAAA,GAC9D,CAAA,CAAA;AAED,EAAO,OAAAlB,QAAA,CAAA;AACT;;;;"}
+{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cookieParser from 'cookie-parser';\nimport {\n  AuthService,\n  DatabaseService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { defaultAuthProviderFactories } from '../providers';\nimport { AuthOwnershipResolver } from '@backstage/plugin-auth-node';\nimport {\n  TokenManager,\n  createLegacyAuthAdapters,\n} from '@backstage/backend-common';\nimport { NotFoundError } from '@backstage/errors';\nimport { CatalogApi } from '@backstage/catalog-client';\nimport {\n  bindOidcRouter,\n  KeyStores,\n  TokenFactory,\n  UserInfoDatabaseHandler,\n} from '../identity';\nimport session from 'express-session';\nimport connectSessionKnex from 'connect-session-knex';\nimport passport from 'passport';\nimport { AuthDatabase } from '../database/AuthDatabase';\nimport { readBackstageTokenExpiration } from './readBackstageTokenExpiration';\nimport { TokenIssuer } from '../identity/types';\nimport { StaticTokenIssuer } from '../identity/StaticTokenIssuer';\nimport { StaticKeyStore } from '../identity/StaticKeyStore';\nimport { bindProviderRouters, ProviderFactories } from '../providers/router';\n\n/**\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  database: DatabaseService;\n  config: RootConfigService;\n  discovery: DiscoveryService;\n  tokenManager?: TokenManager;\n  auth?: AuthService;\n  httpAuth?: HttpAuthService;\n  tokenFactoryAlgorithm?: string;\n  providerFactories?: ProviderFactories;\n  disableDefaultProviderFactories?: boolean;\n  catalogApi?: CatalogApi;\n  ownershipResolver?: AuthOwnershipResolver;\n}\n\n/**\n * @public\n * @deprecated Please migrate to the new backend system as this will be removed in the future.\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    logger,\n    config,\n    discovery,\n    database,\n    tokenFactoryAlgorithm,\n    providerFactories = {},\n  } = options;\n\n  const { auth, httpAuth } = createLegacyAuthAdapters(options);\n\n  const router = Router();\n\n  const appUrl = config.getString('app.baseUrl');\n  const authUrl = await discovery.getExternalBaseUrl('auth');\n  const backstageTokenExpiration = readBackstageTokenExpiration(config);\n  const authDb = AuthDatabase.create(database);\n\n  const keyStore = await KeyStores.fromConfig(config, {\n    logger,\n    database: authDb,\n  });\n\n  const userInfoDatabaseHandler = new UserInfoDatabaseHandler(\n    await authDb.get(),\n  );\n\n  let tokenIssuer: TokenIssuer;\n  if (keyStore instanceof StaticKeyStore) {\n    tokenIssuer = new StaticTokenIssuer(\n      {\n        logger: logger.child({ component: 'token-factory' }),\n        issuer: authUrl,\n        sessionExpirationSeconds: backstageTokenExpiration,\n      },\n      keyStore as StaticKeyStore,\n    );\n  } else {\n    tokenIssuer = new TokenFactory({\n      issuer: authUrl,\n      keyStore,\n      keyDurationSeconds: backstageTokenExpiration,\n      logger: logger.child({ component: 'token-factory' }),\n      algorithm:\n        tokenFactoryAlgorithm ??\n        config.getOptionalString('auth.identityTokenAlgorithm'),\n      userInfoDatabaseHandler,\n    });\n  }\n\n  const secret = config.getOptionalString('auth.session.secret');\n  if (secret) {\n    router.use(cookieParser(secret));\n    const enforceCookieSSL = authUrl.startsWith('https');\n    const KnexSessionStore = connectSessionKnex(session);\n    router.use(\n      session({\n        secret,\n        saveUninitialized: false,\n        resave: false,\n        cookie: { secure: enforceCookieSSL ? 'auto' : false },\n        store: new KnexSessionStore({\n          createtable: false,\n          knex: await authDb.get(),\n        }),\n      }),\n    );\n    router.use(passport.initialize());\n    router.use(passport.session());\n  } else {\n    router.use(cookieParser());\n  }\n\n  router.use(express.urlencoded({ extended: false }));\n  router.use(express.json());\n\n  const providers = options.disableDefaultProviderFactories\n    ? providerFactories\n    : {\n        ...defaultAuthProviderFactories,\n        ...providerFactories,\n      };\n\n  bindProviderRouters(router, {\n    providers,\n    appUrl,\n    baseUrl: authUrl,\n    tokenIssuer,\n    ...options,\n    auth,\n    httpAuth,\n  });\n\n  bindOidcRouter(router, {\n    auth,\n    tokenIssuer,\n    baseUrl: authUrl,\n    userInfoDatabaseHandler,\n  });\n\n  // Gives a more helpful error message than a plain 404\n  router.use('/:provider/', req => {\n    const { provider } = req.params;\n    throw new NotFoundError(`Unknown auth provider '${provider}'`);\n  });\n\n  return router;\n}\n"],"names":["createLegacyAuthAdapters","router","Router","readBackstageTokenExpiration","AuthDatabase","KeyStores","UserInfoDatabaseHandler","StaticKeyStore","StaticTokenIssuer","TokenFactory","cookieParser","connectSessionKnex","session","passport","express","providers","defaultAuthProviderFactories","bindProviderRouters","bindOidcRouter","NotFoundError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,aACpB,OACyB,EAAA;AACzB,EAAM,MAAA;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,qBAAA;AAAA,IACA,oBAAoB;AAAC,GACnB,GAAA,OAAA;AAEJ,EAAA,MAAM,EAAE,IAAA,EAAM,QAAS,EAAA,GAAIA,uCAAyB,OAAO,CAAA;AAE3D,EAAA,MAAMC,WAASC,uBAAO,EAAA;AAEtB,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,SAAA,CAAU,aAAa,CAAA;AAC7C,EAAA,MAAM,OAAU,GAAA,MAAM,SAAU,CAAA,kBAAA,CAAmB,MAAM,CAAA;AACzD,EAAM,MAAA,wBAAA,GAA2BC,0DAA6B,MAAM,CAAA;AACpE,EAAM,MAAA,MAAA,GAASC,yBAAa,CAAA,MAAA,CAAO,QAAQ,CAAA;AAE3C,EAAA,MAAM,QAAW,GAAA,MAAMC,mBAAU,CAAA,UAAA,CAAW,MAAQ,EAAA;AAAA,IAClD,MAAA;AAAA,IACA,QAAU,EAAA;AAAA,GACX,CAAA;AAED,EAAA,MAAM,0BAA0B,IAAIC,+CAAA;AAAA,IAClC,MAAM,OAAO,GAAI;AAAA,GACnB;AAEA,EAAI,IAAA,WAAA;AACJ,EAAA,IAAI,oBAAoBC,6BAAgB,EAAA;AACtC,IAAA,WAAA,GAAc,IAAIC,mCAAA;AAAA,MAChB;AAAA,QACE,QAAQ,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,QACnD,MAAQ,EAAA,OAAA;AAAA,QACR,wBAA0B,EAAA;AAAA,OAC5B;AAAA,MACA;AAAA,KACF;AAAA,GACK,MAAA;AACL,IAAA,WAAA,GAAc,IAAIC,yBAAa,CAAA;AAAA,MAC7B,MAAQ,EAAA,OAAA;AAAA,MACR,QAAA;AAAA,MACA,kBAAoB,EAAA,wBAAA;AAAA,MACpB,QAAQ,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACnD,SACE,EAAA,qBAAA,IACA,MAAO,CAAA,iBAAA,CAAkB,6BAA6B,CAAA;AAAA,MACxD;AAAA,KACD,CAAA;AAAA;AAGH,EAAM,MAAA,MAAA,GAAS,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA;AAC7D,EAAA,IAAI,MAAQ,EAAA;AACV,IAAOR,QAAA,CAAA,GAAA,CAAIS,6BAAa,CAAA,MAAM,CAAC,CAAA;AAC/B,IAAM,MAAA,gBAAA,GAAmB,OAAQ,CAAA,UAAA,CAAW,OAAO,CAAA;AACnD,IAAM,MAAA,gBAAA,GAAmBC,oCAAmBC,wBAAO,CAAA;AACnD,IAAOX,QAAA,CAAA,GAAA;AAAA,MACLW,wBAAQ,CAAA;AAAA,QACN,MAAA;AAAA,QACA,iBAAmB,EAAA,KAAA;AAAA,QACnB,MAAQ,EAAA,KAAA;AAAA,QACR,MAAQ,EAAA,EAAE,MAAQ,EAAA,gBAAA,GAAmB,SAAS,KAAM,EAAA;AAAA,QACpD,KAAA,EAAO,IAAI,gBAAiB,CAAA;AAAA,UAC1B,WAAa,EAAA,KAAA;AAAA,UACb,IAAA,EAAM,MAAM,MAAA,CAAO,GAAI;AAAA,SACxB;AAAA,OACF;AAAA,KACH;AACA,IAAOX,QAAA,CAAA,GAAA,CAAIY,yBAAS,CAAA,UAAA,EAAY,CAAA;AAChC,IAAOZ,QAAA,CAAA,GAAA,CAAIY,yBAAS,CAAA,OAAA,EAAS,CAAA;AAAA,GACxB,MAAA;AACL,IAAOZ,QAAA,CAAA,GAAA,CAAIS,+BAAc,CAAA;AAAA;AAG3B,EAAAT,QAAA,CAAO,IAAIa,wBAAQ,CAAA,UAAA,CAAW,EAAE,QAAU,EAAA,KAAA,EAAO,CAAC,CAAA;AAClD,EAAOb,QAAA,CAAA,GAAA,CAAIa,wBAAQ,CAAA,IAAA,EAAM,CAAA;AAEzB,EAAM,MAAAC,WAAA,GAAY,OAAQ,CAAA,+BAAA,GACtB,iBACA,GAAA;AAAA,IACE,GAAGC,sCAAA;AAAA,IACH,GAAG;AAAA,GACL;AAEJ,EAAAC,0BAAA,CAAoBhB,QAAQ,EAAA;AAAA,eAC1Bc,WAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAS,EAAA,OAAA;AAAA,IACT,WAAA;AAAA,IACA,GAAG,OAAA;AAAA,IACH,IAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAAG,uBAAA,CAAejB,QAAQ,EAAA;AAAA,IACrB,IAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAS,EAAA,OAAA;AAAA,IACT;AAAA,GACD,CAAA;AAGD,EAAOA,QAAA,CAAA,GAAA,CAAI,eAAe,CAAO,GAAA,KAAA;AAC/B,IAAM,MAAA,EAAE,QAAS,EAAA,GAAI,GAAI,CAAA,MAAA;AACzB,IAAA,MAAM,IAAIkB,oBAAA,CAAc,CAA0B,uBAAA,EAAA,QAAQ,CAAG,CAAA,CAAA,CAAA;AAAA,GAC9D,CAAA;AAED,EAAO,OAAAlB,QAAA;AACT;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend",
-  "version": "0.24.0-next.1",
+  "version": "0.24.0",
   "description": "A Backstage backend plugin that handles authentication",
   "backstage": {
     "role": "backend-plugin",
@@ -44,31 +44,31 @@
   },
   "dependencies": {
     "@backstage/backend-common": "^0.25.0",
-    "@backstage/backend-plugin-api": "1.0.2-next.1",
-    "@backstage/catalog-client": "1.8.0-next.0",
-    "@backstage/catalog-model": "1.7.0",
-    "@backstage/config": "1.2.0",
-    "@backstage/errors": "1.2.4",
-    "@backstage/plugin-auth-backend-module-atlassian-provider": "0.3.2-next.1",
-    "@backstage/plugin-auth-backend-module-auth0-provider": "0.1.2-next.1",
-    "@backstage/plugin-auth-backend-module-aws-alb-provider": "0.3.0-next.1",
-    "@backstage/plugin-auth-backend-module-azure-easyauth-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-bitbucket-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-bitbucket-server-provider": "0.1.2-next.1",
-    "@backstage/plugin-auth-backend-module-cloudflare-access-provider": "0.3.2-next.1",
-    "@backstage/plugin-auth-backend-module-gcp-iap-provider": "0.3.2-next.1",
-    "@backstage/plugin-auth-backend-module-github-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-gitlab-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-google-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-microsoft-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-oauth2-provider": "0.3.2-next.1",
-    "@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-backend-module-oidc-provider": "0.3.2-next.1",
-    "@backstage/plugin-auth-backend-module-okta-provider": "0.1.2-next.1",
-    "@backstage/plugin-auth-backend-module-onelogin-provider": "0.2.2-next.1",
-    "@backstage/plugin-auth-node": "0.5.4-next.1",
-    "@backstage/plugin-catalog-node": "1.14.0-next.1",
-    "@backstage/types": "1.1.1",
+    "@backstage/backend-plugin-api": "^1.0.2",
+    "@backstage/catalog-client": "^1.8.0",
+    "@backstage/catalog-model": "^1.7.1",
+    "@backstage/config": "^1.3.0",
+    "@backstage/errors": "^1.2.5",
+    "@backstage/plugin-auth-backend-module-atlassian-provider": "^0.3.2",
+    "@backstage/plugin-auth-backend-module-auth0-provider": "^0.1.2",
+    "@backstage/plugin-auth-backend-module-aws-alb-provider": "^0.3.0",
+    "@backstage/plugin-auth-backend-module-azure-easyauth-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-bitbucket-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-bitbucket-server-provider": "^0.1.2",
+    "@backstage/plugin-auth-backend-module-cloudflare-access-provider": "^0.3.2",
+    "@backstage/plugin-auth-backend-module-gcp-iap-provider": "^0.3.2",
+    "@backstage/plugin-auth-backend-module-github-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-gitlab-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-google-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-microsoft-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-oauth2-provider": "^0.3.2",
+    "@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "^0.2.2",
+    "@backstage/plugin-auth-backend-module-oidc-provider": "^0.3.2",
+    "@backstage/plugin-auth-backend-module-okta-provider": "^0.1.2",
+    "@backstage/plugin-auth-backend-module-onelogin-provider": "^0.2.2",
+    "@backstage/plugin-auth-node": "^0.5.4",
+    "@backstage/plugin-catalog-node": "^1.14.0",
+    "@backstage/types": "^1.2.0",
     "@google-cloud/firestore": "^7.0.0",
     "@node-saml/passport-saml": "^5.0.0",
     "@types/express": "^4.17.6",
@@ -98,14 +98,14 @@
     "passport-microsoft": "^1.0.0",
     "passport-oauth2": "^1.6.1",
     "passport-onelogin-oauth": "^0.0.1",
-    "uuid": "^9.0.0",
+    "uuid": "^11.0.0",
     "winston": "^3.2.1",
     "yn": "^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.5.3-next.1",
-    "@backstage/backend-test-utils": "1.0.3-next.1",
-    "@backstage/cli": "0.29.0-next.1",
+    "@backstage/backend-defaults": "^0.5.3",
+    "@backstage/backend-test-utils": "^1.1.0",
+    "@backstage/cli": "^0.29.0",
     "@types/body-parser": "^1.19.0",
     "@types/cookie-parser": "^1.4.2",
     "@types/express-session": "^1.17.2",
@@ -119,5 +119,12 @@
     "msw": "^1.0.0",
     "supertest": "^7.0.0"
   },
-  "configSchema": "config.d.ts"
+  "configSchema": "config.d.ts",
+  "typesVersions": {
+    "*": {
+      "index": [
+        "dist/index.d.ts"
+      ]
+    }
+  }
 }