@backstage/plugin-auth-backend 0.24.5 → 0.25.0-next.1

package/dist/identity/issueUserToken.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issueUserToken.cjs.js","sources":["../../src/identity/issueUserToken.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { parseEntityRef } from '@backstage/catalog-model';\nimport { AuthenticationError } from '@backstage/errors';\nimport {\n  BackstageSignInResult,\n  TokenParams,\n  tokenTypes,\n} from '@backstage/plugin-auth-node';\nimport { omit } from 'lodash';\nimport { UserInfoDatabaseHandler } from './UserInfoDatabaseHandler';\nimport { LoggerService } from '@backstage/backend-plugin-api';\nimport { GeneralSign, importJWK, JWK, KeyLike, SignJWT } from 'jose';\nimport { BackstageTokenPayload } from './TokenFactory';\n\nconst MS_IN_S = 1000;\nconst MAX_TOKEN_LENGTH = 32768; // At 64 bytes per entity ref this still leaves room for about 500 entities\n\nexport async function issueUserToken({\n  issuer,\n  key,\n  keyDurationSeconds,\n  logger,\n  omitClaimsFromToken,\n  params,\n  userInfoDatabaseHandler,\n}: {\n  issuer: string;\n  key: JWK;\n  keyDurationSeconds: number;\n  logger: LoggerService;\n  omitClaimsFromToken?: string[];\n  params: TokenParams;\n  userInfoDatabaseHandler: UserInfoDatabaseHandler;\n}): Promise<BackstageSignInResult> {\n  const { sub, ent = [sub], ...additionalClaims } = params.claims;\n  const aud = tokenTypes.user.audClaim;\n  const iat = Math.floor(Date.now() / MS_IN_S);\n  const exp = iat + keyDurationSeconds;\n\n  try {\n    // The subject must be a valid entity ref\n    parseEntityRef(sub);\n  } catch (error) {\n    throw new Error(\n      '\"sub\" claim provided by the auth resolver is not a valid EntityRef.',\n    );\n  }\n\n  if (!key.alg) {\n    throw new AuthenticationError('No algorithm was provided in the key');\n  }\n\n  logger.info(`Issuing token for ${sub}, with entities ${ent}`);\n\n  const signingKey = await importJWK(key);\n\n  const uip = await createUserIdentityClaim({\n    header: {\n      typ: tokenTypes.limitedUser.typParam,\n      alg: key.alg,\n      kid: key.kid,\n    },\n    payload: { sub, iat, exp },\n    key: signingKey,\n  });\n\n  const claims: BackstageTokenPayload = {\n    ...additionalClaims,\n    iss: issuer,\n    sub,\n    ent,\n    aud,\n    iat,\n    exp,\n    uip,\n  };\n\n  const tokenClaims = omitClaimsFromToken\n    ? omit(claims, omitClaimsFromToken)\n    : claims;\n  const token = await new SignJWT(tokenClaims)\n    .setProtectedHeader({\n      typ: tokenTypes.user.typParam,\n      alg: key.alg,\n      kid: key.kid,\n    })\n    .sign(signingKey);\n\n  if (token.length > MAX_TOKEN_LENGTH) {\n    throw new Error(\n      `Failed to issue a new user token. The resulting token is excessively large, with either too many ownership claims or too large custom claims. You likely have a bug either in the sign-in resolver or catalog data. The following claims were requested: '${JSON.stringify(\n        tokenClaims,\n      )}'`,\n    );\n  }\n\n  // Store the user info in the database upon successful token\n  // issuance so that it can be retrieved later by limited user tokens\n  await userInfoDatabaseHandler.addUserInfo({\n    claims: omit(claims, ['aud', 'iat', 'iss', 'uip']),\n  });\n\n  return {\n    token,\n    identity: {\n      type: 'user',\n      userEntityRef: sub,\n      ownershipEntityRefs: ent,\n    },\n  };\n}\n\n/**\n * The payload contents of a valid Backstage user identity claim token\n *\n * @internal\n */\ninterface BackstageUserIdentityProofPayload {\n  /**\n   * The entity ref of the user\n   */\n  sub: string;\n\n  /**\n   * Standard expiry in epoch seconds\n   */\n  exp: number;\n\n  /**\n   * Standard issue time in epoch seconds\n   */\n  iat: number;\n}\n\n/**\n * Creates a string claim that can be used as part of reconstructing a limited\n * user token. The output of this function is only the signature part of a JWS.\n */\nasync function createUserIdentityClaim(options: {\n  header: {\n    typ: string;\n    alg: string;\n    kid?: string;\n  };\n  payload: BackstageUserIdentityProofPayload;\n  key: KeyLike | Uint8Array;\n}): Promise<string> {\n  // NOTE: We reconstruct the header and payload structures carefully to\n  // perfectly guarantee ordering. The reason for this is that we store only\n  // the signature part of these to reduce duplication within the Backstage\n  // token. Anyone who wants to make an actual JWT based on all this must be\n  // able to do the EXACT reconstruction of the header and payload parts, to\n  // then append the signature.\n\n  const header = {\n    typ: options.header.typ,\n    alg: options.header.alg,\n    ...(options.header.kid ? { kid: options.header.kid } : {}),\n  };\n\n  const payload = {\n    sub: options.payload.sub,\n    iat: options.payload.iat,\n    exp: options.payload.exp,\n  };\n\n  const jws = await new GeneralSign(\n    new TextEncoder().encode(JSON.stringify(payload)),\n  )\n    .addSignature(options.key)\n    .setProtectedHeader(header)\n    .done()\n    .sign();\n\n  return jws.signatures[0].signature;\n}\n"],"names":["tokenTypes","parseEntityRef","AuthenticationError","importJWK","omit","SignJWT","GeneralSign"],"mappings":";;;;;;;;AA6BA,MAAM,OAAU,GAAA,GAAA;AAChB,MAAM,gBAAmB,GAAA,KAAA;AAEzB,eAAsB,cAAe,CAAA;AAAA,EACnC,MAAA;AAAA,EACA,GAAA;AAAA,EACA,kBAAA;AAAA,EACA,MAAA;AAAA,EACA,mBAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAQmC,EAAA;AACjC,EAAM,MAAA,EAAE,KAAK,GAAM,GAAA,CAAC,GAAG,CAAG,EAAA,GAAG,gBAAiB,EAAA,GAAI,MAAO,CAAA,MAAA;AACzD,EAAM,MAAA,GAAA,GAAMA,0BAAW,IAAK,CAAA,QAAA;AAC5B,EAAA,MAAM,MAAM,IAAK,CAAA,KAAA,CAAM,IAAK,CAAA,GAAA,KAAQ,OAAO,CAAA;AAC3C,EAAA,MAAM,MAAM,GAAM,GAAA,kBAAA;AAElB,EAAI,IAAA;AAEF,IAAAC,2BAAA,CAAe,GAAG,CAAA;AAAA,WACX,KAAO,EAAA;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA;AAGF,EAAI,IAAA,CAAC,IAAI,GAAK,EAAA;AACZ,IAAM,MAAA,IAAIC,2BAAoB,sCAAsC,CAAA;AAAA;AAGtE,EAAA,MAAA,CAAO,IAAK,CAAA,CAAA,kBAAA,EAAqB,GAAG,CAAA,gBAAA,EAAmB,GAAG,CAAE,CAAA,CAAA;AAE5D,EAAM,MAAA,UAAA,GAAa,MAAMC,cAAA,CAAU,GAAG,CAAA;AAEtC,EAAM,MAAA,GAAA,GAAM,MAAM,uBAAwB,CAAA;AAAA,IACxC,MAAQ,EAAA;AAAA,MACN,GAAA,EAAKH,0BAAW,WAAY,CAAA,QAAA;AAAA,MAC5B,KAAK,GAAI,CAAA,GAAA;AAAA,MACT,KAAK,GAAI,CAAA;AAAA,KACX;AAAA,IACA,OAAS,EAAA,EAAE,GAAK,EAAA,GAAA,EAAK,GAAI,EAAA;AAAA,IACzB,GAAK,EAAA;AAAA,GACN,CAAA;AAED,EAAA,MAAM,MAAgC,GAAA;AAAA,IACpC,GAAG,gBAAA;AAAA,IACH,GAAK,EAAA,MAAA;AAAA,IACL,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,WAAc,GAAA,mBAAA,GAChBI,WAAK,CAAA,MAAA,EAAQ,mBAAmB,CAChC,GAAA,MAAA;AACJ,EAAA,MAAM,QAAQ,MAAM,IAAIC,YAAQ,CAAA,WAAW,EACxC,kBAAmB,CAAA;AAAA,IAClB,GAAA,EAAKL,0BAAW,IAAK,CAAA,QAAA;AAAA,IACrB,KAAK,GAAI,CAAA,GAAA;AAAA,IACT,KAAK,GAAI,CAAA;AAAA,GACV,CACA,CAAA,IAAA,CAAK,UAAU,CAAA;AAElB,EAAI,IAAA,KAAA,CAAM,SAAS,gBAAkB,EAAA;AACnC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,6PAA6P,IAAK,CAAA,SAAA;AAAA,QAChQ;AAAA,OACD,CAAA,CAAA;AAAA,KACH;AAAA;AAKF,EAAA,MAAM,wBAAwB,WAAY,CAAA;AAAA,IACxC,MAAA,EAAQI,YAAK,MAAQ,EAAA,CAAC,OAAO,KAAO,EAAA,KAAA,EAAO,KAAK,CAAC;AAAA,GAClD,CAAA;AAED,EAAO,OAAA;AAAA,IACL,KAAA;AAAA,IACA,QAAU,EAAA;AAAA,MACR,IAAM,EAAA,MAAA;AAAA,MACN,aAAe,EAAA,GAAA;AAAA,MACf,mBAAqB,EAAA;AAAA;AACvB,GACF;AACF;AA4BA,eAAe,wBAAwB,OAQnB,EAAA;AAQlB,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,GAAA,EAAK,QAAQ,MAAO,CAAA,GAAA;AAAA,IACpB,GAAA,EAAK,QAAQ,MAAO,CAAA,GAAA;AAAA,IACpB,GAAI,OAAQ,CAAA,MAAA,CAAO,GAAM,GAAA,EAAE,KAAK,OAAQ,CAAA,MAAA,CAAO,GAAI,EAAA,GAAI;AAAC,GAC1D;AAEA,EAAA,MAAM,OAAU,GAAA;AAAA,IACd,GAAA,EAAK,QAAQ,OAAQ,CAAA,GAAA;AAAA,IACrB,GAAA,EAAK,QAAQ,OAAQ,CAAA,GAAA;AAAA,IACrB,GAAA,EAAK,QAAQ,OAAQ,CAAA;AAAA,GACvB;AAEA,EAAM,MAAA,GAAA,GAAM,MAAM,IAAIE,gBAAA;AAAA,IACpB,IAAI,WAAY,EAAA,CAAE,OAAO,IAAK,CAAA,SAAA,CAAU,OAAO,CAAC;AAAA,GAClD,CACG,YAAa,CAAA,OAAA,CAAQ,GAAG,CAAA,CACxB,mBAAmB,MAAM,CAAA,CACzB,IAAK,EAAA,CACL,IAAK,EAAA;AAER,EAAO,OAAA,GAAA,CAAI,UAAW,CAAA,CAAC,CAAE,CAAA,SAAA;AAC3B;;;;"}

package/dist/index.cjs.js

@@ -3,34 +3,8 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var authPlugin = require('./authPlugin.cjs.js');
-var router = require('./service/router.cjs.js');
-var providers = require('./providers/providers.cjs.js');
-var router$1 = require('./providers/router.cjs.js');
-var createAuthProviderIntegration = require('./providers/createAuthProviderIntegration.cjs.js');
-var prepareBackstageIdentityResponse = require('./providers/prepareBackstageIdentityResponse.cjs.js');
-var authFlowHelpers = require('./lib/flow/authFlowHelpers.cjs.js');
-var OAuthEnvironmentHandler = require('./lib/oauth/OAuthEnvironmentHandler.cjs.js');
-var OAuthAdapter = require('./lib/oauth/OAuthAdapter.cjs.js');
-var helpers = require('./lib/oauth/helpers.cjs.js');
-var CatalogIdentityClient = require('./lib/catalog/CatalogIdentityClient.cjs.js');
-var CatalogAuthResolverContext = require('./lib/resolvers/CatalogAuthResolverContext.cjs.js');
 
 
 
 exports.default = authPlugin.authPlugin;
-exports.createRouter = router.createRouter;
-exports.defaultAuthProviderFactories = providers.defaultAuthProviderFactories;
-exports.providers = providers.providers;
-exports.createOriginFilter = router$1.createOriginFilter;
-exports.createAuthProviderIntegration = createAuthProviderIntegration.createAuthProviderIntegration;
-exports.prepareBackstageIdentityResponse = prepareBackstageIdentityResponse.prepareBackstageIdentityResponse;
-exports.ensuresXRequestedWith = authFlowHelpers.ensuresXRequestedWith;
-exports.postMessageResponse = authFlowHelpers.postMessageResponse;
-exports.OAuthEnvironmentHandler = OAuthEnvironmentHandler.OAuthEnvironmentHandler;
-exports.OAuthAdapter = OAuthAdapter.OAuthAdapter;
-exports.encodeState = helpers.encodeState;
-exports.readState = helpers.readState;
-exports.verifyNonce = helpers.verifyNonce;
-exports.CatalogIdentityClient = CatalogIdentityClient.CatalogIdentityClient;
-exports.getDefaultOwnershipEntityRefs = CatalogAuthResolverContext.getDefaultOwnershipEntityRefs;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;"}