@backstage/plugin-auth-backend 0.26.0 → 0.27.0-next.1

package/dist/service/OidcError.cjs.js

@@ -0,0 +1,57 @@
+'use strict';
+
+var errors = require('@backstage/errors');
+
+class OidcError extends errors.CustomErrorBase {
+  name = "OidcError";
+  body;
+  statusCode;
+  constructor(errorCode, errorDescription, statusCode, cause) {
+    super(`${errorCode}, ${errorDescription}`, cause);
+    this.statusCode = statusCode;
+    this.body = {
+      error: errorCode,
+      error_description: errorDescription
+    };
+  }
+  static isOidcError(error) {
+    return errors.isError(error) && error.name === "OidcError";
+  }
+  static fromError(error) {
+    if (OidcError.isOidcError(error)) {
+      return error;
+    }
+    if (!errors.isError(error)) {
+      return new OidcError("server_error", "Unknown error", 500, error);
+    }
+    const errorMessage = error.message || "Unknown error";
+    switch (error.name) {
+      case "InputError":
+        return new OidcError("invalid_request", errorMessage, 400, error);
+      case "AuthenticationError":
+        return new OidcError("invalid_client", errorMessage, 401, error);
+      case "NotAllowedError":
+        return new OidcError("access_denied", errorMessage, 403, error);
+      case "NotFoundError":
+        return new OidcError("invalid_request", errorMessage, 400, error);
+      default:
+        return new OidcError("server_error", errorMessage, 500, error);
+    }
+  }
+  static middleware(logger) {
+    return (err, _req, res, next) => {
+      if (OidcError.isOidcError(err)) {
+        logger[err.statusCode >= 500 ? "error" : "info"](
+          `OIDC Request failed with status ${err.statusCode}: ${err.body.error} - ${err.body.error_description}`,
+          err.cause
+        );
+        res.status(err.statusCode).json(err.body);
+        return;
+      }
+      next(err);
+    };
+  }
+}
+
+exports.OidcError = OidcError;
+//# sourceMappingURL=OidcError.cjs.js.map

package/dist/service/OidcError.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcError.cjs.js","sources":["../../src/service/OidcError.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { CustomErrorBase, isError } from '@backstage/errors';\nimport { Request, Response, NextFunction } from 'express';\nimport { LoggerService } from '@backstage/backend-plugin-api';\n\nexport class OidcError extends CustomErrorBase {\n  name = 'OidcError';\n\n  readonly body: { error: string; error_description: string };\n  readonly statusCode: number;\n\n  constructor(\n    errorCode: string,\n    errorDescription: string,\n    statusCode: number,\n    cause?: Error | unknown,\n  ) {\n    super(`${errorCode}, ${errorDescription}`, cause);\n    this.statusCode = statusCode;\n    this.body = {\n      error: errorCode,\n      error_description: errorDescription,\n    };\n  }\n\n  static isOidcError(error: unknown): error is OidcError {\n    return isError(error) && error.name === 'OidcError';\n  }\n\n  static fromError(error: unknown): OidcError {\n    if (OidcError.isOidcError(error)) {\n      return error;\n    }\n\n    if (!isError(error)) {\n      return new OidcError('server_error', 'Unknown error', 500, error);\n    }\n\n    const errorMessage = error.message || 'Unknown error';\n\n    switch (error.name) {\n      case 'InputError':\n        return new OidcError('invalid_request', errorMessage, 400, error);\n      case 'AuthenticationError':\n        return new OidcError('invalid_client', errorMessage, 401, error);\n      case 'NotAllowedError':\n        return new OidcError('access_denied', errorMessage, 403, error);\n      case 'NotFoundError':\n        return new OidcError('invalid_request', errorMessage, 400, error);\n      default:\n        return new OidcError('server_error', errorMessage, 500, error);\n    }\n  }\n\n  static middleware(\n    logger: LoggerService,\n  ): (err: unknown, _req: Request, res: Response, next: NextFunction) => void {\n    return (\n      err: unknown,\n      _req: Request,\n      res: Response,\n      next: NextFunction,\n    ): void => {\n      if (OidcError.isOidcError(err)) {\n        logger[err.statusCode >= 500 ? 'error' : 'info'](\n          `OIDC Request failed with status ${err.statusCode}: ${err.body.error} - ${err.body.error_description}`,\n          err.cause,\n        );\n        res.status(err.statusCode).json(err.body);\n        return;\n      }\n      next(err);\n    };\n  }\n}\n"],"names":["CustomErrorBase","isError"],"mappings":";;;;AAmBO,MAAM,kBAAkBA,sBAAA,CAAgB;AAAA,EAC7C,IAAA,GAAO,WAAA;AAAA,EAEE,IAAA;AAAA,EACA,UAAA;AAAA,EAET,WAAA,CACE,SAAA,EACA,gBAAA,EACA,UAAA,EACA,KAAA,EACA;AACA,IAAA,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,EAAA,EAAK,gBAAgB,IAAI,KAAK,CAAA;AAChD,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,KAAA,EAAO,SAAA;AAAA,MACP,iBAAA,EAAmB;AAAA,KACrB;AAAA,EACF;AAAA,EAEA,OAAO,YAAY,KAAA,EAAoC;AACrD,IAAA,OAAOC,cAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,WAAA;AAAA,EAC1C;AAAA,EAEA,OAAO,UAAU,KAAA,EAA2B;AAC1C,IAAA,IAAI,SAAA,CAAU,WAAA,CAAY,KAAK,CAAA,EAAG;AAChC,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAACA,cAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,MAAA,OAAO,IAAI,SAAA,CAAU,cAAA,EAAgB,eAAA,EAAiB,KAAK,KAAK,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,IAAW,eAAA;AAEtC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,YAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,iBAAA,EAAmB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MAClE,KAAK,qBAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,gBAAA,EAAkB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MACjE,KAAK,iBAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,eAAA,EAAiB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MAChE,KAAK,eAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,iBAAA,EAAmB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MAClE;AACE,QAAA,OAAO,IAAI,SAAA,CAAU,cAAA,EAAgB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA;AACjE,EACF;AAAA,EAEA,OAAO,WACL,MAAA,EAC0E;AAC1E,IAAA,OAAO,CACL,GAAA,EACA,IAAA,EACA,GAAA,EACA,IAAA,KACS;AACT,MAAA,IAAI,SAAA,CAAU,WAAA,CAAY,GAAG,CAAA,EAAG;AAC9B,QAAA,MAAA,CAAO,GAAA,CAAI,UAAA,IAAc,GAAA,GAAM,OAAA,GAAU,MAAM,CAAA;AAAA,UAC7C,CAAA,gCAAA,EAAmC,GAAA,CAAI,UAAU,CAAA,EAAA,EAAK,GAAA,CAAI,KAAK,KAAK,CAAA,GAAA,EAAM,GAAA,CAAI,IAAA,CAAK,iBAAiB,CAAA,CAAA;AAAA,UACpG,GAAA,CAAI;AAAA,SACN;AACA,QAAA,GAAA,CAAI,OAAO,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA,CAAK,IAAI,IAAI,CAAA;AACxC,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV,CAAA;AAAA,EACF;AACF;;;;"}

package/dist/service/OidcRouter.cjs.js

@@ -5,11 +5,98 @@ var OidcService = require('./OidcService.cjs.js');
 var errors = require('@backstage/errors');
 var express = require('express');
 var readTokenExpiration = require('./readTokenExpiration.cjs.js');
+var zod = require('zod');
+var zodValidationError = require('zod-validation-error');
+var OidcError = require('./OidcError.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
 var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
 
+const authorizeQuerySchema = zod.z.object({
+  client_id: zod.z.string().min(1),
+  redirect_uri: zod.z.string().url(),
+  response_type: zod.z.string().min(1),
+  scope: zod.z.string().optional(),
+  state: zod.z.string().optional(),
+  nonce: zod.z.string().optional(),
+  code_challenge: zod.z.string().optional(),
+  code_challenge_method: zod.z.string().optional()
+});
+const sessionIdParamSchema = zod.z.object({
+  sessionId: zod.z.string().min(1)
+});
+const tokenRequestBodySchema = zod.z.object({
+  grant_type: zod.z.string().min(1),
+  code: zod.z.string().optional(),
+  redirect_uri: zod.z.string().url().optional(),
+  code_verifier: zod.z.string().optional(),
+  refresh_token: zod.z.string().optional(),
+  client_id: zod.z.string().optional(),
+  client_secret: zod.z.string().optional()
+});
+const registerRequestBodySchema = zod.z.object({
+  client_name: zod.z.string().optional(),
+  redirect_uris: zod.z.array(zod.z.string().url()).min(1),
+  response_types: zod.z.array(zod.z.string()).optional(),
+  grant_types: zod.z.array(zod.z.string()).optional(),
+  scope: zod.z.string().optional()
+});
+const revokeRequestBodySchema = zod.z.object({
+  token: zod.z.string().min(1),
+  token_type_hint: zod.z.string().optional(),
+  client_id: zod.z.string().optional(),
+  client_secret: zod.z.string().optional()
+});
+function validateRequest(schema, data) {
+  const parseResult = schema.safeParse(data);
+  if (!parseResult.success) {
+    const errorMessage = zodValidationError.fromZodError(parseResult.error).message;
+    throw new OidcError.OidcError("invalid_request", errorMessage, 400);
+  }
+  return parseResult.data;
+}
+async function authenticateClient(req, oidc, bodyClientId, bodyClientSecret) {
+  let clientId;
+  let clientSecret;
+  const basicAuth = req.headers.authorization?.match(/^Basic[ ]+([^\s]+)$/i);
+  if (basicAuth) {
+    try {
+      const decoded = Buffer.from(basicAuth[1], "base64").toString("utf8");
+      const idx = decoded.indexOf(":");
+      if (idx >= 0) {
+        clientId = decoded.slice(0, idx);
+        clientSecret = decoded.slice(idx + 1);
+      }
+    } catch {
+    }
+  }
+  if (!clientId || !clientSecret) {
+    if (bodyClientId && bodyClientSecret) {
+      clientId = bodyClientId;
+      clientSecret = bodyClientSecret;
+    }
+  }
+  if (!clientId || !clientSecret) {
+    throw new OidcError.OidcError(
+      "invalid_client",
+      "Client authentication required",
+      401
+    );
+  }
+  try {
+    const ok = await oidc.verifyClientCredentials({
+      clientId,
+      clientSecret
+    });
+    if (!ok) {
+      throw new OidcError.OidcError("invalid_client", "Invalid client credentials", 401);
+    }
+  } catch (e) {
+    throw OidcError.OidcError.fromError(e);
+  }
+  return { clientId, clientSecret };
+}
 class OidcRouter {
   oidc;
   logger;
@@ -58,9 +145,10 @@ class OidcRouter {
       }
       res.json(userInfo);
     });
-    if (this.config.getOptionalBoolean(
+    const dcrEnabled = this.config.getOptionalBoolean(
       "auth.experimentalDynamicClientRegistration.enabled"
-    )) {
+    );
+    if (dcrEnabled) {
       router.get("/v1/authorize", async (req, res) => {
         const {
           client_id: clientId,
@@ -71,14 +159,7 @@ class OidcRouter {
           nonce,
           code_challenge: codeChallenge,
           code_challenge_method: codeChallengeMethod
-        } = req.query;
-        if (!clientId || !redirectUri || !responseType) {
-          this.logger.error(`Failed to authorize: Missing required parameters`);
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing required parameters: client_id, redirect_uri, response_type"
-          });
-        }
+        } = validateRequest(authorizeQuerySchema, req.query);
         try {
           const result = await this.oidc.createAuthorizationSession({
             clientId,
@@ -96,31 +177,25 @@ class OidcRouter {
           );
           return res.redirect(authSessionRedirectUrl.toString());
         } catch (error) {
-          const errorParams = new URLSearchParams();
-          errorParams.append(
-            "error",
-            errors.isError(error) ? error.name : "server_error"
-          );
-          errorParams.append(
-            "error_description",
-            errors.isError(error) ? error.message : "Unknown error"
-          );
-          if (state) {
-            errorParams.append("state", state);
+          if (OidcError.OidcError.isOidcError(error)) {
+            const errorParams = new URLSearchParams();
+            errorParams.append("error", error.body.error);
+            errorParams.append(
+              "error_description",
+              error.body.error_description
+            );
+            if (state) {
+              errorParams.append("state", state);
+            }
+            const redirectUrl = new URL(redirectUri);
+            redirectUrl.search = errorParams.toString();
+            return res.redirect(redirectUrl.toString());
           }
-          const redirectUrl = new URL(redirectUri);
-          redirectUrl.search = errorParams.toString();
-          return res.redirect(redirectUrl.toString());
+          throw error;
         }
       });
       router.get("/v1/sessions/:sessionId", async (req, res) => {
-        const { sessionId } = req.params;
-        if (!sessionId) {
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing Authorization Session ID"
-          });
-        }
+        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);
         try {
           const session = await this.oidc.getAuthorizationSession({
             sessionId
@@ -132,32 +207,19 @@ class OidcRouter {
             redirectUri: session.redirectUri
           });
         } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to get authorization session: ${description}`,
-            error
-          );
-          return res.status(404).json({
-            error: "not_found",
-            error_description: description
-          });
+          throw OidcError.OidcError.fromError(error);
         }
       });
       router.post("/v1/sessions/:sessionId/approve", async (req, res) => {
-        const { sessionId } = req.params;
-        if (!sessionId) {
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing authorization session ID"
-          });
-        }
+        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);
         try {
           const httpCredentials = await this.httpAuth.credentials(req);
           if (!this.auth.isPrincipal(httpCredentials, "user")) {
-            return res.status(401).json({
-              error: "unauthorized",
-              error_description: "Authentication required"
-            });
+            throw new OidcError.OidcError(
+              "access_denied",
+              "Authentication required",
+              403
+            );
           }
           const { userEntityRef } = httpCredentials.principal;
           const result = await this.oidc.approveAuthorizationSession({
@@ -168,31 +230,14 @@ class OidcRouter {
             redirectUrl: result.redirectUrl
           });
         } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to approve authorization session: ${description}`,
-            error
-          );
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: description
-          });
+          throw OidcError.OidcError.fromError(error);
         }
       });
       router.post("/v1/sessions/:sessionId/reject", async (req, res) => {
-        const { sessionId } = req.params;
-        if (!sessionId) {
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing authorization session ID"
-          });
-        }
+        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);
         const httpCredentials = await this.httpAuth.credentials(req);
         if (!this.auth.isPrincipal(httpCredentials, "user")) {
-          return res.status(401).json({
-            error: "unauthorized",
-            error_description: "Authentication required"
-          });
+          throw new OidcError.OidcError("access_denied", "Authentication required", 403);
         }
         const { userEntityRef } = httpCredentials.principal;
         try {
@@ -215,15 +260,7 @@ class OidcRouter {
             redirectUrl: redirectUrl.toString()
           });
         } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to reject authorization session: ${description}`,
-            error
-          );
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: description
-          });
+          throw OidcError.OidcError.fromError(error);
         }
       });
       router.post("/v1/token", async (req, res) => {
@@ -231,59 +268,83 @@ class OidcRouter {
           grant_type: grantType,
           code,
           redirect_uri: redirectUri,
-          code_verifier: codeVerifier
-        } = req.body;
-        if (!grantType || !code || !redirectUri) {
-          this.logger.error(
-            `Failed to exchange code for token: Missing required parameters`
-          );
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing required parameters"
-          });
-        }
+          code_verifier: codeVerifier,
+          refresh_token: refreshToken,
+          client_id: bodyClientId,
+          client_secret: bodyClientSecret
+        } = validateRequest(tokenRequestBodySchema, req.body);
         const expiresIn = readTokenExpiration.readDcrTokenExpiration(this.config);
         try {
-          const result = await this.oidc.exchangeCodeForToken({
-            code,
-            redirectUri,
-            codeVerifier,
-            grantType,
-            expiresIn
-          });
-          return res.json({
-            access_token: result.accessToken,
-            token_type: result.tokenType,
-            expires_in: result.expiresIn,
-            id_token: result.idToken,
-            scope: result.scope
-          });
-        } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to exchange code for token: ${description}`,
-            error
-          );
-          if (errors.isError(error)) {
-            if (error.name === "AuthenticationError") {
-              return res.status(401).json({
-                error: "invalid_client",
-                error_description: error.message
-              });
+          if (grantType === "authorization_code") {
+            if (!code || !redirectUri) {
+              throw new OidcError.OidcError(
+                "invalid_request",
+                "Missing code or redirect_uri parameters for authorization_code grant",
+                400
+              );
+            }
+            const result = await this.oidc.exchangeCodeForToken({
+              code,
+              redirectUri,
+              codeVerifier,
+              grantType,
+              expiresIn
+            });
+            return res.json({
+              access_token: result.accessToken,
+              token_type: result.tokenType,
+              expires_in: result.expiresIn,
+              id_token: result.idToken,
+              scope: result.scope,
+              ...result.refreshToken && {
+                refresh_token: result.refreshToken
+              }
+            });
+          }
+          if (grantType === "refresh_token") {
+            if (!refreshToken) {
+              throw new OidcError.OidcError(
+                "invalid_request",
+                "Missing refresh_token parameter for refresh_token grant",
+                400
+              );
             }
-            if (error.name === "InputError") {
-              return res.status(400).json({
-                error: "invalid_request",
-                error_description: error.message
-              });
+            const hasCredentials = req.headers.authorization?.match(/^Basic[ ]+([^\s]+)$/i) || bodyClientId && bodyClientSecret;
+            let authenticatedClientId;
+            if (hasCredentials) {
+              const { clientId: authedId } = await authenticateClient(
+                req,
+                this.oidc,
+                bodyClientId,
+                bodyClientSecret
+              );
+              authenticatedClientId = authedId;
             }
+            const result = await this.oidc.refreshAccessToken({
+              refreshToken,
+              clientId: authenticatedClientId
+            });
+            return res.json({
+              access_token: result.accessToken,
+              token_type: result.tokenType,
+              expires_in: result.expiresIn,
+              refresh_token: result.refreshToken
+            });
           }
-          return res.status(500).json({
-            error: "server_error",
-            error_description: description
-          });
+          throw new OidcError.OidcError(
+            "unsupported_grant_type",
+            `Grant type ${grantType} is not supported`,
+            400
+          );
+        } catch (error) {
+          if (errors.isError(error) && error.name === "AuthenticationError") {
+            throw new OidcError.OidcError("invalid_grant", error.message, 400, error);
+          }
+          throw OidcError.OidcError.fromError(error);
         }
       });
+    }
+    if (dcrEnabled) {
       router.post("/v1/register", async (req, res) => {
         const {
           client_name: clientName,
@@ -291,37 +352,49 @@ class OidcRouter {
           response_types: responseTypes,
           grant_types: grantTypes,
           scope
-        } = req.body;
-        if (!redirectUris?.length) {
-          res.status(400).json({
-            error: "invalid_request",
-            error_description: "redirect_uris is required"
-          });
-          return;
-        }
+        } = validateRequest(registerRequestBodySchema, req.body);
         try {
           const client = await this.oidc.registerClient({
-            clientName,
+            clientName: clientName ?? "Backstage CLI",
             redirectUris,
             responseTypes,
             grantTypes,
             scope
           });
-          res.status(201).json({
+          return res.status(201).json({
             client_id: client.clientId,
             redirect_uris: client.redirectUris,
             client_secret: client.clientSecret
           });
         } catch (e) {
-          const description = errors.isError(e) ? e.message : "Unknown error";
-          this.logger.error(`Failed to register client: ${description}`, e);
-          res.status(500).json({
-            error: "server_error",
-            error_description: `Failed to register client: ${description}`
-          });
+          throw OidcError.OidcError.fromError(e);
+        }
+      });
+      router.post("/v1/revoke", async (req, res) => {
+        try {
+          const {
+            token,
+            client_id: bodyClientId,
+            client_secret: bodyClientSecret
+          } = validateRequest(revokeRequestBodySchema, req.body ?? {});
+          await authenticateClient(
+            req,
+            this.oidc,
+            bodyClientId,
+            bodyClientSecret
+          );
+          try {
+            await this.oidc.revokeRefreshToken(token);
+          } catch (e) {
+            this.logger.debug("Failed to revoke token", e);
+          }
+          return res.status(200).send("");
+        } catch (e) {
+          throw OidcError.OidcError.fromError(e);
         }
       });
     }
+    router.use(OidcError.OidcError.middleware(this.logger));
     return router;
   }
 }