@backstage/plugin-auth-backend 0.26.1-next.0 → 0.27.0-next.1

package/dist/service/OidcService.cjs.js

@@ -5,6 +5,7 @@ var jose = require('jose');
 var crypto = require('node:crypto');
 var luxon = require('luxon');
 var matcher = require('matcher');
+var readTokenExpiration = require('./readTokenExpiration.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -18,13 +19,15 @@ class OidcService {
   userInfo;
   oidc;
   config;
-  constructor(auth, tokenIssuer, baseUrl, userInfo, oidc, config) {
+  offlineAccess;
+  constructor(auth, tokenIssuer, baseUrl, userInfo, oidc, config, offlineAccess) {
     this.auth = auth;
     this.tokenIssuer = tokenIssuer;
     this.baseUrl = baseUrl;
     this.userInfo = userInfo;
     this.oidc = oidc;
     this.config = config;
+    this.offlineAccess = offlineAccess;
   }
   static create(options) {
     return new OidcService(
@@ -33,10 +36,14 @@ class OidcService {
       options.baseUrl,
       options.userInfo,
       options.oidc,
-      options.config
+      options.config,
+      options.offlineAccess
     );
   }
   getConfiguration() {
+    const dcrEnabled = this.config.getOptionalBoolean(
+      "auth.experimentalDynamicClientRegistration.enabled"
+    );
     return {
       issuer: this.baseUrl,
       token_endpoint: `${this.baseUrl}/v1/token`,
@@ -56,16 +63,25 @@ class OidcService {
         "PS512",
         "EdDSA"
       ],
-      scopes_supported: ["openid"],
+      scopes_supported: [
+        "openid",
+        ...this.offlineAccess ? ["offline_access"] : []
+      ],
       token_endpoint_auth_methods_supported: [
         "client_secret_basic",
         "client_secret_post"
       ],
       claims_supported: ["sub", "ent"],
-      grant_types_supported: ["authorization_code"],
+      grant_types_supported: [
+        "authorization_code",
+        ...this.offlineAccess ? ["refresh_token"] : []
+      ],
       authorization_endpoint: `${this.baseUrl}/v1/authorize`,
-      registration_endpoint: `${this.baseUrl}/v1/register`,
-      code_challenge_methods_supported: ["S256", "plain"]
+      code_challenge_methods_supported: ["S256", "plain"],
+      ...dcrEnabled && {
+        registration_endpoint: `${this.baseUrl}/v1/register`,
+        revocation_endpoint: `${this.baseUrl}/v1/revoke`
+      }
     };
   }
   async listPublicKeys() {
@@ -123,13 +139,7 @@ class OidcService {
     if (responseType !== "code") {
       throw new errors.InputError("Only authorization code flow is supported");
     }
-    const client = await this.oidc.getClient({ clientId });
-    if (!client) {
-      throw new errors.InputError("Invalid client_id");
-    }
-    if (!client.redirectUris.includes(redirectUri)) {
-      throw new errors.InputError("Invalid redirect_uri");
-    }
+    const client = await this.resolveClient(clientId, redirectUri);
     if (codeChallenge) {
       if (!codeChallengeMethod || !["S256", "plain"].includes(codeChallengeMethod)) {
         throw new errors.InputError("Invalid code_challenge_method");
@@ -156,6 +166,26 @@ class OidcService {
       redirectUri
     };
   }
+  async getClientName(clientId) {
+    const client = await this.oidc.getClient({ clientId });
+    if (!client) {
+      throw new errors.InputError("Invalid client_id");
+    }
+    return client.clientName;
+  }
+  async resolveClient(clientId, redirectUri) {
+    const client = await this.oidc.getClient({ clientId });
+    if (!client) {
+      throw new errors.InputError("Invalid client_id");
+    }
+    if (!client.redirectUris.includes(redirectUri)) {
+      throw new errors.InputError("Invalid redirect_uri");
+    }
+    return {
+      clientName: client.clientName,
+      redirectUris: client.redirectUris
+    };
+  }
   async approveAuthorizationSession(opts) {
     const { sessionId, userEntityRef } = opts;
     const session = await this.oidc.getAuthorizationSession({
@@ -204,14 +234,11 @@ class OidcService {
     if (session.status !== "pending") {
       throw new errors.NotFoundError("Authorization session not found or expired");
     }
-    const client = await this.oidc.getClient({ clientId: session.clientId });
-    if (!client) {
-      throw new errors.InputError("Invalid client_id");
-    }
+    const clientName = await this.getClientName(session.clientId);
     return {
       id: session.id,
       clientId: session.clientId,
-      clientName: client.clientName,
+      clientName,
       redirectUri: session.redirectUri,
       scope: session.scope,
       state: session.state,
@@ -294,14 +321,65 @@ class OidcService {
         sub: session.userEntityRef
       }
     });
+    let refreshToken;
+    const scopes = session.scope?.split(" ") ?? [];
+    if (scopes.includes("offline_access") && this.offlineAccess) {
+      refreshToken = await this.offlineAccess.issueRefreshToken({
+        userEntityRef: session.userEntityRef,
+        oidcClientId: session.clientId
+      });
+    }
     return {
       accessToken: token,
       tokenType: "Bearer",
       expiresIn,
       idToken: token,
-      scope: session.scope || "openid"
+      scope: session.scope || "openid",
+      refreshToken
+    };
+  }
+  async refreshAccessToken(params) {
+    if (!this.offlineAccess) {
+      throw new errors.InputError("Refresh tokens are not enabled");
+    }
+    const { accessToken, refreshToken } = await this.offlineAccess.refreshAccessToken({
+      refreshToken: params.refreshToken,
+      tokenIssuer: this.tokenIssuer,
+      clientId: params.clientId
+    });
+    const expiresIn = readTokenExpiration.readDcrTokenExpiration(this.config);
+    return {
+      accessToken,
+      tokenType: "Bearer",
+      expiresIn,
+      refreshToken
     };
   }
+  /**
+   * Verifies client credentials against the registered OIDC clients
+   */
+  async verifyClientCredentials(options) {
+    const { clientId, clientSecret } = options;
+    const client = await this.oidc.getClient({ clientId });
+    if (!client?.clientSecret) {
+      return false;
+    }
+    const expected = Buffer.from(client.clientSecret, "utf8");
+    const provided = Buffer.from(clientSecret, "utf8");
+    if (expected.length !== provided.length) {
+      return false;
+    }
+    return crypto__default.default.timingSafeEqual(expected, provided);
+  }
+  /**
+   * Revoke a refresh token if offline access is enabled
+   */
+  async revokeRefreshToken(token) {
+    if (!this.offlineAccess) {
+      return;
+    }
+    await this.offlineAccess.revokeRefreshToken(token);
+  }
   verifyPkce(codeChallenge, codeVerifier, method) {
     if (!method || method === "plain") {
       return codeChallenge === codeVerifier;

package/dist/service/OidcService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"OidcService.cjs.js","sources":["../../src/service/OidcService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { AuthService, RootConfigService } from '@backstage/backend-plugin-api';\nimport { TokenIssuer } from '../identity/types';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport {\n  AuthenticationError,\n  InputError,\n  NotFoundError,\n} from '@backstage/errors';\nimport { decodeJwt } from 'jose';\nimport crypto from 'node:crypto';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { DateTime } from 'luxon';\nimport matcher from 'matcher';\n\nexport class OidcService {\n  private readonly auth: AuthService;\n  private readonly tokenIssuer: TokenIssuer;\n  private readonly baseUrl: string;\n  private readonly userInfo: UserInfoDatabase;\n  private readonly oidc: OidcDatabase;\n  private readonly config: RootConfigService;\n\n  private constructor(\n    auth: AuthService,\n    tokenIssuer: TokenIssuer,\n    baseUrl: string,\n    userInfo: UserInfoDatabase,\n    oidc: OidcDatabase,\n    config: RootConfigService,\n  ) {\n    this.auth = auth;\n    this.tokenIssuer = tokenIssuer;\n    this.baseUrl = baseUrl;\n    this.userInfo = userInfo;\n    this.oidc = oidc;\n    this.config = config;\n  }\n\n  static create(options: {\n    auth: AuthService;\n    tokenIssuer: TokenIssuer;\n    baseUrl: string;\n    userInfo: UserInfoDatabase;\n    oidc: OidcDatabase;\n    config: RootConfigService;\n  }) {\n    return new OidcService(\n      options.auth,\n      options.tokenIssuer,\n      options.baseUrl,\n      options.userInfo,\n      options.oidc,\n      options.config,\n    );\n  }\n\n  public getConfiguration() {\n    return {\n      issuer: this.baseUrl,\n      token_endpoint: `${this.baseUrl}/v1/token`,\n      userinfo_endpoint: `${this.baseUrl}/v1/userinfo`,\n      jwks_uri: `${this.baseUrl}/.well-known/jwks.json`,\n      response_types_supported: ['code', 'id_token'],\n      subject_types_supported: ['public'],\n      id_token_signing_alg_values_supported: [\n        'RS256',\n        'RS384',\n        'RS512',\n        'ES256',\n        'ES384',\n        'ES512',\n        'PS256',\n        'PS384',\n        'PS512',\n        'EdDSA',\n      ],\n      scopes_supported: ['openid'],\n      token_endpoint_auth_methods_supported: [\n        'client_secret_basic',\n        'client_secret_post',\n      ],\n      claims_supported: ['sub', 'ent'],\n      grant_types_supported: ['authorization_code'],\n      authorization_endpoint: `${this.baseUrl}/v1/authorize`,\n      registration_endpoint: `${this.baseUrl}/v1/register`,\n      code_challenge_methods_supported: ['S256', 'plain'],\n    };\n  }\n\n  public async listPublicKeys() {\n    return await this.tokenIssuer.listPublicKeys();\n  }\n\n  public async getUserInfo({ token }: { token: string }) {\n    const credentials = await this.auth.authenticate(token, {\n      allowLimitedAccess: true,\n    });\n    if (!this.auth.isPrincipal(credentials, 'user')) {\n      throw new InputError(\n        'Userinfo endpoint must be called with a token that represents a user principal',\n      );\n    }\n\n    const { sub: userEntityRef } = decodeJwt(token);\n\n    if (typeof userEntityRef !== 'string') {\n      throw new Error('Invalid user token, user entity ref must be a string');\n    }\n    return await this.userInfo.getUserInfo(userEntityRef);\n  }\n\n  public async registerClient(opts: {\n    responseTypes?: string[];\n    grantTypes?: string[];\n    clientName: string;\n    redirectUris?: string[];\n    scope?: string;\n  }) {\n    const generatedClientId = crypto.randomUUID();\n    const generatedClientSecret = crypto.randomUUID();\n\n    const allowedRedirectUriPatterns = this.config.getOptionalStringArray(\n      'auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns',\n    ) ?? ['*'];\n\n    for (const redirectUri of opts.redirectUris ?? []) {\n      if (\n        !allowedRedirectUriPatterns.some(pattern =>\n          matcher.isMatch(redirectUri, pattern),\n        )\n      ) {\n        throw new InputError('Invalid redirect_uri');\n      }\n    }\n\n    return await this.oidc.createClient({\n      clientId: generatedClientId,\n      clientName: opts.clientName,\n      clientSecret: generatedClientSecret,\n      redirectUris: opts.redirectUris ?? [],\n      responseTypes: opts.responseTypes ?? ['code'],\n      grantTypes: opts.grantTypes ?? ['authorization_code'],\n      scope: opts.scope,\n    });\n  }\n\n  public async createAuthorizationSession(opts: {\n    clientId: string;\n    redirectUri: string;\n    responseType: string;\n    scope?: string;\n    state?: string;\n    nonce?: string;\n    codeChallenge?: string;\n    codeChallengeMethod?: string;\n  }) {\n    const {\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      nonce,\n      codeChallenge,\n      codeChallengeMethod,\n    } = opts;\n\n    if (responseType !== 'code') {\n      throw new InputError('Only authorization code flow is supported');\n    }\n\n    const client = await this.oidc.getClient({ clientId });\n    if (!client) {\n      throw new InputError('Invalid client_id');\n    }\n\n    if (!client.redirectUris.includes(redirectUri)) {\n      throw new InputError('Invalid redirect_uri');\n    }\n\n    if (codeChallenge) {\n      if (\n        !codeChallengeMethod ||\n        !['S256', 'plain'].includes(codeChallengeMethod)\n      ) {\n        throw new InputError('Invalid code_challenge_method');\n      }\n    }\n\n    const sessionId = crypto.randomUUID();\n    const sessionExpiresAt = DateTime.now().plus({ hours: 1 }).toJSDate();\n\n    await this.oidc.createAuthorizationSession({\n      id: sessionId,\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      nonce,\n      expiresAt: sessionExpiresAt,\n    });\n\n    return {\n      id: sessionId,\n      clientName: client.clientName,\n      scope,\n      redirectUri,\n    };\n  }\n\n  public async approveAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      userEntityRef,\n      status: 'approved',\n    });\n\n    const authorizationCode = crypto.randomBytes(32).toString('base64url');\n    const codeExpiresAt = DateTime.now().plus({ minutes: 10 }).toJSDate();\n\n    await this.oidc.createAuthorizationCode({\n      code: authorizationCode,\n      sessionId: session.id,\n      expiresAt: codeExpiresAt,\n    });\n\n    const redirectUrl = new URL(session.redirectUri);\n\n    redirectUrl.searchParams.append('code', authorizationCode);\n    if (session.state) {\n      redirectUrl.searchParams.append('state', session.state);\n    }\n\n    return {\n      redirectUrl: redirectUrl.toString(),\n    };\n  }\n\n  public async getAuthorizationSession(opts: { sessionId: string }) {\n    const session = await this.oidc.getAuthorizationSession({\n      id: opts.sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    const client = await this.oidc.getClient({ clientId: session.clientId });\n    if (!client) {\n      throw new InputError('Invalid client_id');\n    }\n\n    return {\n      id: session.id,\n      clientId: session.clientId,\n      clientName: client.clientName,\n      redirectUri: session.redirectUri,\n      scope: session.scope,\n      state: session.state,\n      responseType: session.responseType,\n      codeChallenge: session.codeChallenge,\n      codeChallengeMethod: session.codeChallengeMethod,\n      nonce: session.nonce,\n      expiresAt: session.expiresAt,\n      status: session.status,\n    };\n  }\n\n  public async rejectAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      status: 'rejected',\n      userEntityRef,\n    });\n  }\n\n  public async exchangeCodeForToken(params: {\n    code: string;\n    redirectUri: string;\n    codeVerifier?: string;\n    grantType: string;\n    expiresIn: number;\n  }) {\n    const { code, redirectUri, codeVerifier, grantType, expiresIn } = params;\n\n    if (grantType !== 'authorization_code') {\n      throw new InputError('Unsupported grant type');\n    }\n\n    const authCode = await this.oidc.getAuthorizationCode({ code });\n    if (!authCode) {\n      throw new AuthenticationError('Invalid authorization code');\n    }\n\n    if (DateTime.fromJSDate(authCode.expiresAt) < DateTime.now()) {\n      throw new AuthenticationError('Authorization code expired');\n    }\n\n    if (authCode.used) {\n      throw new AuthenticationError('Authorization code already used');\n    }\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: authCode.sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (session.redirectUri !== redirectUri) {\n      throw new AuthenticationError('Redirect URI mismatch');\n    }\n\n    if (session.status !== 'approved') {\n      throw new AuthenticationError('Authorization not approved');\n    }\n\n    if (!session.userEntityRef) {\n      throw new AuthenticationError('No user associated with authorization');\n    }\n\n    if (session.codeChallenge) {\n      if (!codeVerifier) {\n        throw new AuthenticationError('Code verifier required for PKCE');\n      }\n\n      if (\n        !this.verifyPkce(\n          session.codeChallenge,\n          codeVerifier,\n          session.codeChallengeMethod,\n        )\n      ) {\n        throw new AuthenticationError('Invalid code verifier');\n      }\n    }\n\n    await this.oidc.updateAuthorizationCode({\n      code,\n      used: true,\n    });\n\n    const { token } = await this.tokenIssuer.issueToken({\n      claims: {\n        sub: session.userEntityRef,\n      },\n    });\n\n    return {\n      accessToken: token,\n      tokenType: 'Bearer',\n      expiresIn: expiresIn,\n      idToken: token,\n      scope: session.scope || 'openid',\n    };\n  }\n\n  private verifyPkce(\n    codeChallenge: string,\n    codeVerifier: string,\n    method?: string,\n  ): boolean {\n    if (!method || method === 'plain') {\n      return codeChallenge === codeVerifier;\n    }\n\n    if (method === 'S256') {\n      const hash = crypto.createHash('sha256').update(codeVerifier).digest();\n      const base64urlHash = hash.toString('base64url');\n      return codeChallenge === base64urlHash;\n    }\n\n    return false;\n  }\n}\n"],"names":["InputError","decodeJwt","crypto","matcher","DateTime","NotFoundError","AuthenticationError"],"mappings":";;;;;;;;;;;;;AA6BO,MAAM,WAAA,CAAY;AAAA,EACN,IAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EAET,YACN,IAAA,EACA,WAAA,EACA,OAAA,EACA,QAAA,EACA,MACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,OAAO,OAAO,OAAA,EAOX;AACD,IAAA,OAAO,IAAI,WAAA;AAAA,MACT,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,QAAA;AAAA,MACR,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEO,gBAAA,GAAmB;AACxB,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,OAAA;AAAA,MACb,cAAA,EAAgB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,SAAA,CAAA;AAAA,MAC/B,iBAAA,EAAmB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,MAClC,QAAA,EAAU,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACzB,wBAAA,EAA0B,CAAC,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7C,uBAAA,EAAyB,CAAC,QAAQ,CAAA;AAAA,MAClC,qCAAA,EAAuC;AAAA,QACrC,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,gBAAA,EAAkB,CAAC,QAAQ,CAAA;AAAA,MAC3B,qCAAA,EAAuC;AAAA,QACrC,qBAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,gBAAA,EAAkB,CAAC,KAAA,EAAO,KAAK,CAAA;AAAA,MAC/B,qBAAA,EAAuB,CAAC,oBAAoB,CAAA;AAAA,MAC5C,sBAAA,EAAwB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,aAAA,CAAA;AAAA,MACvC,qBAAA,EAAuB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,MACtC,gCAAA,EAAkC,CAAC,MAAA,EAAQ,OAAO;AAAA,KACpD;AAAA,EACF;AAAA,EAEA,MAAa,cAAA,GAAiB;AAC5B,IAAA,OAAO,MAAM,IAAA,CAAK,WAAA,CAAY,cAAA,EAAe;AAAA,EAC/C;AAAA,EAEA,MAAa,WAAA,CAAY,EAAE,KAAA,EAAM,EAAsB;AACrD,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAAK,aAAa,KAAA,EAAO;AAAA,MACtD,kBAAA,EAAoB;AAAA,KACrB,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,EAAE,GAAA,EAAK,aAAA,EAAc,GAAIC,eAAU,KAAK,CAAA;AAE9C,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,aAAa,CAAA;AAAA,EACtD;AAAA,EAEA,MAAa,eAAe,IAAA,EAMzB;AACD,IAAA,MAAM,iBAAA,GAAoBC,wBAAO,UAAA,EAAW;AAC5C,IAAA,MAAM,qBAAA,GAAwBA,wBAAO,UAAA,EAAW;AAEhD,IAAA,MAAM,0BAAA,GAA6B,KAAK,MAAA,CAAO,sBAAA;AAAA,MAC7C;AAAA,KACF,IAAK,CAAC,GAAG,CAAA;AAET,IAAA,KAAA,MAAW,WAAA,IAAe,IAAA,CAAK,YAAA,IAAgB,EAAC,EAAG;AACjD,MAAA,IACE,CAAC,0BAAA,CAA2B,IAAA;AAAA,QAAK,CAAA,OAAA,KAC/BC,wBAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO;AAAA,OACtC,EACA;AACA,QAAA,MAAM,IAAIH,kBAAW,sBAAsB,CAAA;AAAA,MAC7C;AAAA,IACF;AAEA,IAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa;AAAA,MAClC,QAAA,EAAU,iBAAA;AAAA,MACV,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,YAAA,EAAc,qBAAA;AAAA,MACd,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,EAAC;AAAA,MACpC,aAAA,EAAe,IAAA,CAAK,aAAA,IAAiB,CAAC,MAAM,CAAA;AAAA,MAC5C,UAAA,EAAY,IAAA,CAAK,UAAA,IAAc,CAAC,oBAAoB,CAAA;AAAA,MACpD,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,2BAA2B,IAAA,EASrC;AACD,IAAA,MAAM;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAA;AAEJ,IAAA,IAAI,iBAAiB,MAAA,EAAQ;AAC3B,MAAA,MAAM,IAAIA,kBAAW,2CAA2C,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,EAAE,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAIA,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AAEA,IAAA,IAAI,CAAC,MAAA,CAAO,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAIA,kBAAW,sBAAsB,CAAA;AAAA,IAC7C;AAEA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IACE,CAAC,uBACD,CAAC,CAAC,QAAQ,OAAO,CAAA,CAAE,QAAA,CAAS,mBAAmB,CAAA,EAC/C;AACA,QAAA,MAAM,IAAIA,kBAAW,+BAA+B,CAAA;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAYE,wBAAO,UAAA,EAAW;AACpC,IAAA,MAAM,gBAAA,GAAmBE,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,EAAG,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,KAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAa,4BAA4B,IAAA,EAGtC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AAErC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,EAAA,EAAI;AAAA,KACL,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIC,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAID,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIJ,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIK,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,aAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,MAAM,oBAAoBH,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrE,IAAA,MAAM,aAAA,GAAgBE,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,OAAA,EAAS,EAAA,EAAI,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA,EAAM,iBAAA;AAAA,MACN,WAAW,OAAA,CAAQ,EAAA;AAAA,MACnB,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAE/C,IAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,MAAA,EAAQ,iBAAiB,CAAA;AACzD,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxD;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,YAAY,QAAA;AAAS,KACpC;AAAA,EACF;AAAA,EAEA,MAAa,wBAAwB,IAAA,EAA6B;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,IAAI,IAAA,CAAK;AAAA,KACV,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIC,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAID,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIJ,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIK,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,CAAA;AACvE,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAIL,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AAEA,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,MAC7B,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,OAAA,CAAQ;AAAA,KAClB;AAAA,EACF;AAAA,EAEA,MAAa,2BAA2B,IAAA,EAGrC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AAErC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,EAAA,EAAI;AAAA,KACL,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIK,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAID,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIJ,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIK,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,MAAA,EAAQ,UAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,qBAAqB,MAAA,EAM/B;AACD,IAAA,MAAM,EAAE,IAAA,EAAM,WAAA,EAAa,YAAA,EAAc,SAAA,EAAW,WAAU,GAAI,MAAA;AAElE,IAAA,IAAI,cAAc,oBAAA,EAAsB;AACtC,MAAA,MAAM,IAAIL,kBAAW,wBAAwB,CAAA;AAAA,IAC/C;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAK,oBAAA,CAAqB,EAAE,MAAM,CAAA;AAC9D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIM,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAIF,eAAS,UAAA,CAAW,QAAA,CAAS,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC5D,MAAA,MAAM,IAAIE,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,IAAI,QAAA,CAAS;AAAA,KACd,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAID,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAI,OAAA,CAAQ,gBAAgB,WAAA,EAAa;AACvC,MAAA,MAAM,IAAIC,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,UAAA,EAAY;AACjC,MAAA,MAAM,IAAIA,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC1B,MAAA,MAAM,IAAIA,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AAEA,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,MACjE;AAEA,MAAA,IACE,CAAC,IAAA,CAAK,UAAA;AAAA,QACJ,OAAA,CAAQ,aAAA;AAAA,QACR,YAAA;AAAA,QACA,OAAA,CAAQ;AAAA,OACV,EACA;AACA,QAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,MACvD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,YAAY,UAAA,CAAW;AAAA,MAClD,MAAA,EAAQ;AAAA,QACN,KAAK,OAAA,CAAQ;AAAA;AACf,KACD,CAAA;AAED,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,KAAA;AAAA,MACb,SAAA,EAAW,QAAA;AAAA,MACX,SAAA;AAAA,MACA,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,QAAQ,KAAA,IAAS;AAAA,KAC1B;AAAA,EACF;AAAA,EAEQ,UAAA,CACN,aAAA,EACA,YAAA,EACA,MAAA,EACS;AACT,IAAA,IAAI,CAAC,MAAA,IAAU,MAAA,KAAW,OAAA,EAAS;AACjC,MAAA,OAAO,aAAA,KAAkB,YAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,MAAM,IAAA,GAAOJ,wBAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,YAAY,EAAE,MAAA,EAAO;AACrE,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA;AAC/C,MAAA,OAAO,aAAA,KAAkB,aAAA;AAAA,IAC3B;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"OidcService.cjs.js","sources":["../../src/service/OidcService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { AuthService, RootConfigService } from '@backstage/backend-plugin-api';\nimport { TokenIssuer } from '../identity/types';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport {\n  AuthenticationError,\n  InputError,\n  NotFoundError,\n} from '@backstage/errors';\nimport { decodeJwt } from 'jose';\nimport crypto from 'node:crypto';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { DateTime } from 'luxon';\nimport matcher from 'matcher';\nimport { OfflineAccessService } from './OfflineAccessService';\nimport { readDcrTokenExpiration } from './readTokenExpiration';\n\nexport class OidcService {\n  private readonly auth: AuthService;\n  private readonly tokenIssuer: TokenIssuer;\n  private readonly baseUrl: string;\n  private readonly userInfo: UserInfoDatabase;\n  private readonly oidc: OidcDatabase;\n  private readonly config: RootConfigService;\n  private readonly offlineAccess?: OfflineAccessService;\n\n  private constructor(\n    auth: AuthService,\n    tokenIssuer: TokenIssuer,\n    baseUrl: string,\n    userInfo: UserInfoDatabase,\n    oidc: OidcDatabase,\n    config: RootConfigService,\n    offlineAccess?: OfflineAccessService,\n  ) {\n    this.auth = auth;\n    this.tokenIssuer = tokenIssuer;\n    this.baseUrl = baseUrl;\n    this.userInfo = userInfo;\n    this.oidc = oidc;\n    this.config = config;\n    this.offlineAccess = offlineAccess;\n  }\n\n  static create(options: {\n    auth: AuthService;\n    tokenIssuer: TokenIssuer;\n    baseUrl: string;\n    userInfo: UserInfoDatabase;\n    oidc: OidcDatabase;\n    config: RootConfigService;\n    offlineAccess?: OfflineAccessService;\n  }) {\n    return new OidcService(\n      options.auth,\n      options.tokenIssuer,\n      options.baseUrl,\n      options.userInfo,\n      options.oidc,\n      options.config,\n      options.offlineAccess,\n    );\n  }\n\n  public getConfiguration() {\n    const dcrEnabled = this.config.getOptionalBoolean(\n      'auth.experimentalDynamicClientRegistration.enabled',\n    );\n\n    return {\n      issuer: this.baseUrl,\n      token_endpoint: `${this.baseUrl}/v1/token`,\n      userinfo_endpoint: `${this.baseUrl}/v1/userinfo`,\n      jwks_uri: `${this.baseUrl}/.well-known/jwks.json`,\n      response_types_supported: ['code', 'id_token'],\n      subject_types_supported: ['public'],\n      id_token_signing_alg_values_supported: [\n        'RS256',\n        'RS384',\n        'RS512',\n        'ES256',\n        'ES384',\n        'ES512',\n        'PS256',\n        'PS384',\n        'PS512',\n        'EdDSA',\n      ],\n      scopes_supported: [\n        'openid',\n        ...(this.offlineAccess ? ['offline_access'] : []),\n      ],\n      token_endpoint_auth_methods_supported: [\n        'client_secret_basic',\n        'client_secret_post',\n      ],\n      claims_supported: ['sub', 'ent'],\n      grant_types_supported: [\n        'authorization_code',\n        ...(this.offlineAccess ? ['refresh_token'] : []),\n      ],\n      authorization_endpoint: `${this.baseUrl}/v1/authorize`,\n      code_challenge_methods_supported: ['S256', 'plain'],\n      ...(dcrEnabled && {\n        registration_endpoint: `${this.baseUrl}/v1/register`,\n        revocation_endpoint: `${this.baseUrl}/v1/revoke`,\n      }),\n    };\n  }\n\n  public async listPublicKeys() {\n    return await this.tokenIssuer.listPublicKeys();\n  }\n\n  public async getUserInfo({ token }: { token: string }) {\n    const credentials = await this.auth.authenticate(token, {\n      allowLimitedAccess: true,\n    });\n    if (!this.auth.isPrincipal(credentials, 'user')) {\n      throw new InputError(\n        'Userinfo endpoint must be called with a token that represents a user principal',\n      );\n    }\n\n    const { sub: userEntityRef } = decodeJwt(token);\n\n    if (typeof userEntityRef !== 'string') {\n      throw new Error('Invalid user token, user entity ref must be a string');\n    }\n    return await this.userInfo.getUserInfo(userEntityRef);\n  }\n\n  public async registerClient(opts: {\n    responseTypes?: string[];\n    grantTypes?: string[];\n    clientName: string;\n    redirectUris?: string[];\n    scope?: string;\n  }) {\n    const generatedClientId = crypto.randomUUID();\n    const generatedClientSecret = crypto.randomUUID();\n\n    const allowedRedirectUriPatterns = this.config.getOptionalStringArray(\n      'auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns',\n    ) ?? ['*'];\n\n    for (const redirectUri of opts.redirectUris ?? []) {\n      if (\n        !allowedRedirectUriPatterns.some(pattern =>\n          matcher.isMatch(redirectUri, pattern),\n        )\n      ) {\n        throw new InputError('Invalid redirect_uri');\n      }\n    }\n\n    return await this.oidc.createClient({\n      clientId: generatedClientId,\n      clientName: opts.clientName,\n      clientSecret: generatedClientSecret,\n      redirectUris: opts.redirectUris ?? [],\n      responseTypes: opts.responseTypes ?? ['code'],\n      grantTypes: opts.grantTypes ?? ['authorization_code'],\n      scope: opts.scope,\n    });\n  }\n\n  public async createAuthorizationSession(opts: {\n    clientId: string;\n    redirectUri: string;\n    responseType: string;\n    scope?: string;\n    state?: string;\n    nonce?: string;\n    codeChallenge?: string;\n    codeChallengeMethod?: string;\n  }) {\n    const {\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      nonce,\n      codeChallenge,\n      codeChallengeMethod,\n    } = opts;\n\n    if (responseType !== 'code') {\n      throw new InputError('Only authorization code flow is supported');\n    }\n\n    const client = await this.resolveClient(clientId, redirectUri);\n\n    if (codeChallenge) {\n      if (\n        !codeChallengeMethod ||\n        !['S256', 'plain'].includes(codeChallengeMethod)\n      ) {\n        throw new InputError('Invalid code_challenge_method');\n      }\n    }\n\n    const sessionId = crypto.randomUUID();\n    const sessionExpiresAt = DateTime.now().plus({ hours: 1 }).toJSDate();\n\n    await this.oidc.createAuthorizationSession({\n      id: sessionId,\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      nonce,\n      expiresAt: sessionExpiresAt,\n    });\n\n    return {\n      id: sessionId,\n      clientName: client.clientName,\n      scope,\n      redirectUri,\n    };\n  }\n\n  private async getClientName(clientId: string): Promise<string> {\n    const client = await this.oidc.getClient({ clientId });\n    if (!client) {\n      throw new InputError('Invalid client_id');\n    }\n    return client.clientName;\n  }\n\n  private async resolveClient(\n    clientId: string,\n    redirectUri: string,\n  ): Promise<{ clientName: string; redirectUris: string[] }> {\n    const client = await this.oidc.getClient({ clientId });\n    if (!client) {\n      throw new InputError('Invalid client_id');\n    }\n\n    if (!client.redirectUris.includes(redirectUri)) {\n      throw new InputError('Invalid redirect_uri');\n    }\n\n    return {\n      clientName: client.clientName,\n      redirectUris: client.redirectUris,\n    };\n  }\n\n  public async approveAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      userEntityRef,\n      status: 'approved',\n    });\n\n    const authorizationCode = crypto.randomBytes(32).toString('base64url');\n    const codeExpiresAt = DateTime.now().plus({ minutes: 10 }).toJSDate();\n\n    await this.oidc.createAuthorizationCode({\n      code: authorizationCode,\n      sessionId: session.id,\n      expiresAt: codeExpiresAt,\n    });\n\n    const redirectUrl = new URL(session.redirectUri);\n\n    redirectUrl.searchParams.append('code', authorizationCode);\n    if (session.state) {\n      redirectUrl.searchParams.append('state', session.state);\n    }\n\n    return {\n      redirectUrl: redirectUrl.toString(),\n    };\n  }\n\n  public async getAuthorizationSession(opts: { sessionId: string }) {\n    const session = await this.oidc.getAuthorizationSession({\n      id: opts.sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    const clientName = await this.getClientName(session.clientId);\n\n    return {\n      id: session.id,\n      clientId: session.clientId,\n      clientName,\n      redirectUri: session.redirectUri,\n      scope: session.scope,\n      state: session.state,\n      responseType: session.responseType,\n      codeChallenge: session.codeChallenge,\n      codeChallengeMethod: session.codeChallengeMethod,\n      nonce: session.nonce,\n      expiresAt: session.expiresAt,\n      status: session.status,\n    };\n  }\n\n  public async rejectAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      status: 'rejected',\n      userEntityRef,\n    });\n  }\n\n  public async exchangeCodeForToken(params: {\n    code: string;\n    redirectUri: string;\n    codeVerifier?: string;\n    grantType: string;\n    expiresIn: number;\n  }) {\n    const { code, redirectUri, codeVerifier, grantType, expiresIn } = params;\n\n    if (grantType !== 'authorization_code') {\n      throw new InputError('Unsupported grant type');\n    }\n\n    const authCode = await this.oidc.getAuthorizationCode({ code });\n    if (!authCode) {\n      throw new AuthenticationError('Invalid authorization code');\n    }\n\n    if (DateTime.fromJSDate(authCode.expiresAt) < DateTime.now()) {\n      throw new AuthenticationError('Authorization code expired');\n    }\n\n    if (authCode.used) {\n      throw new AuthenticationError('Authorization code already used');\n    }\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: authCode.sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (session.redirectUri !== redirectUri) {\n      throw new AuthenticationError('Redirect URI mismatch');\n    }\n\n    if (session.status !== 'approved') {\n      throw new AuthenticationError('Authorization not approved');\n    }\n\n    if (!session.userEntityRef) {\n      throw new AuthenticationError('No user associated with authorization');\n    }\n\n    if (session.codeChallenge) {\n      if (!codeVerifier) {\n        throw new AuthenticationError('Code verifier required for PKCE');\n      }\n\n      if (\n        !this.verifyPkce(\n          session.codeChallenge,\n          codeVerifier,\n          session.codeChallengeMethod,\n        )\n      ) {\n        throw new AuthenticationError('Invalid code verifier');\n      }\n    }\n\n    await this.oidc.updateAuthorizationCode({\n      code,\n      used: true,\n    });\n\n    const { token } = await this.tokenIssuer.issueToken({\n      claims: {\n        sub: session.userEntityRef,\n      },\n    });\n\n    // Check if offline_access scope is requested\n    let refreshToken: string | undefined;\n    const scopes = session.scope?.split(' ') ?? [];\n    if (scopes.includes('offline_access') && this.offlineAccess) {\n      refreshToken = await this.offlineAccess.issueRefreshToken({\n        userEntityRef: session.userEntityRef,\n        oidcClientId: session.clientId,\n      });\n    }\n\n    return {\n      accessToken: token,\n      tokenType: 'Bearer',\n      expiresIn: expiresIn,\n      idToken: token,\n      scope: session.scope || 'openid',\n      refreshToken,\n    };\n  }\n\n  public async refreshAccessToken(params: {\n    refreshToken: string;\n    clientId?: string;\n  }): Promise<{\n    accessToken: string;\n    tokenType: string;\n    expiresIn: number;\n    refreshToken: string;\n  }> {\n    if (!this.offlineAccess) {\n      throw new InputError('Refresh tokens are not enabled');\n    }\n\n    const { accessToken, refreshToken } =\n      await this.offlineAccess.refreshAccessToken({\n        refreshToken: params.refreshToken,\n        tokenIssuer: this.tokenIssuer,\n        clientId: params.clientId,\n      });\n\n    const expiresIn = readDcrTokenExpiration(this.config);\n\n    return {\n      accessToken,\n      tokenType: 'Bearer',\n      expiresIn,\n      refreshToken,\n    };\n  }\n\n  /**\n   * Verifies client credentials against the registered OIDC clients\n   */\n  public async verifyClientCredentials(options: {\n    clientId: string;\n    clientSecret: string;\n  }): Promise<boolean> {\n    const { clientId, clientSecret } = options;\n    const client = await this.oidc.getClient({ clientId });\n    if (!client?.clientSecret) {\n      return false;\n    }\n    const expected = Buffer.from(client.clientSecret, 'utf8');\n    const provided = Buffer.from(clientSecret, 'utf8');\n    if (expected.length !== provided.length) {\n      return false;\n    }\n    return crypto.timingSafeEqual(expected, provided);\n  }\n\n  /**\n   * Revoke a refresh token if offline access is enabled\n   */\n  public async revokeRefreshToken(token: string): Promise<void> {\n    if (!this.offlineAccess) {\n      return;\n    }\n    await this.offlineAccess.revokeRefreshToken(token);\n  }\n\n  private verifyPkce(\n    codeChallenge: string,\n    codeVerifier: string,\n    method?: string,\n  ): boolean {\n    if (!method || method === 'plain') {\n      return codeChallenge === codeVerifier;\n    }\n\n    if (method === 'S256') {\n      const hash = crypto.createHash('sha256').update(codeVerifier).digest();\n      const base64urlHash = hash.toString('base64url');\n      return codeChallenge === base64urlHash;\n    }\n\n    return false;\n  }\n}\n"],"names":["InputError","decodeJwt","crypto","matcher","DateTime","NotFoundError","AuthenticationError","readDcrTokenExpiration"],"mappings":";;;;;;;;;;;;;;AA+BO,MAAM,WAAA,CAAY;AAAA,EACN,IAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EAET,YACN,IAAA,EACA,WAAA,EACA,SACA,QAAA,EACA,IAAA,EACA,QACA,aAAA,EACA;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AAAA,EAEA,OAAO,OAAO,OAAA,EAQX;AACD,IAAA,OAAO,IAAI,WAAA;AAAA,MACT,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,QAAA;AAAA,MACR,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEO,gBAAA,GAAmB;AACxB,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,kBAAA;AAAA,MAC7B;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,OAAA;AAAA,MACb,cAAA,EAAgB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,SAAA,CAAA;AAAA,MAC/B,iBAAA,EAAmB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,MAClC,QAAA,EAAU,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACzB,wBAAA,EAA0B,CAAC,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7C,uBAAA,EAAyB,CAAC,QAAQ,CAAA;AAAA,MAClC,qCAAA,EAAuC;AAAA,QACrC,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,gBAAA,EAAkB;AAAA,QAChB,QAAA;AAAA,QACA,GAAI,IAAA,CAAK,aAAA,GAAgB,CAAC,gBAAgB,IAAI;AAAC,OACjD;AAAA,MACA,qCAAA,EAAuC;AAAA,QACrC,qBAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,gBAAA,EAAkB,CAAC,KAAA,EAAO,KAAK,CAAA;AAAA,MAC/B,qBAAA,EAAuB;AAAA,QACrB,oBAAA;AAAA,QACA,GAAI,IAAA,CAAK,aAAA,GAAgB,CAAC,eAAe,IAAI;AAAC,OAChD;AAAA,MACA,sBAAA,EAAwB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,aAAA,CAAA;AAAA,MACvC,gCAAA,EAAkC,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MAClD,GAAI,UAAA,IAAc;AAAA,QAChB,qBAAA,EAAuB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,QACtC,mBAAA,EAAqB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,UAAA;AAAA;AACtC,KACF;AAAA,EACF;AAAA,EAEA,MAAa,cAAA,GAAiB;AAC5B,IAAA,OAAO,MAAM,IAAA,CAAK,WAAA,CAAY,cAAA,EAAe;AAAA,EAC/C;AAAA,EAEA,MAAa,WAAA,CAAY,EAAE,KAAA,EAAM,EAAsB;AACrD,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAAK,aAAa,KAAA,EAAO;AAAA,MACtD,kBAAA,EAAoB;AAAA,KACrB,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,EAAE,GAAA,EAAK,aAAA,EAAc,GAAIC,eAAU,KAAK,CAAA;AAE9C,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,aAAa,CAAA;AAAA,EACtD;AAAA,EAEA,MAAa,eAAe,IAAA,EAMzB;AACD,IAAA,MAAM,iBAAA,GAAoBC,wBAAO,UAAA,EAAW;AAC5C,IAAA,MAAM,qBAAA,GAAwBA,wBAAO,UAAA,EAAW;AAEhD,IAAA,MAAM,0BAAA,GAA6B,KAAK,MAAA,CAAO,sBAAA;AAAA,MAC7C;AAAA,KACF,IAAK,CAAC,GAAG,CAAA;AAET,IAAA,KAAA,MAAW,WAAA,IAAe,IAAA,CAAK,YAAA,IAAgB,EAAC,EAAG;AACjD,MAAA,IACE,CAAC,0BAAA,CAA2B,IAAA;AAAA,QAAK,CAAA,OAAA,KAC/BC,wBAAA,CAAQ,OAAA,CAAQ,WAAA,EAAa,OAAO;AAAA,OACtC,EACA;AACA,QAAA,MAAM,IAAIH,kBAAW,sBAAsB,CAAA;AAAA,MAC7C;AAAA,IACF;AAEA,IAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa;AAAA,MAClC,QAAA,EAAU,iBAAA;AAAA,MACV,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,YAAA,EAAc,qBAAA;AAAA,MACd,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,EAAC;AAAA,MACpC,aAAA,EAAe,IAAA,CAAK,aAAA,IAAiB,CAAC,MAAM,CAAA;AAAA,MAC5C,UAAA,EAAY,IAAA,CAAK,UAAA,IAAc,CAAC,oBAAoB,CAAA;AAAA,MACpD,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,2BAA2B,IAAA,EASrC;AACD,IAAA,MAAM;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAA;AAEJ,IAAA,IAAI,iBAAiB,MAAA,EAAQ;AAC3B,MAAA,MAAM,IAAIA,kBAAW,2CAA2C,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,CAAc,UAAU,WAAW,CAAA;AAE7D,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IACE,CAAC,uBACD,CAAC,CAAC,QAAQ,OAAO,CAAA,CAAE,QAAA,CAAS,mBAAmB,CAAA,EAC/C;AACA,QAAA,MAAM,IAAIA,kBAAW,+BAA+B,CAAA;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAYE,wBAAO,UAAA,EAAW;AACpC,IAAA,MAAM,gBAAA,GAAmBE,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,EAAG,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,KAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAc,cAAc,QAAA,EAAmC;AAC7D,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,EAAE,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAIJ,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,MAAA,CAAO,UAAA;AAAA,EAChB;AAAA,EAEA,MAAc,aAAA,CACZ,QAAA,EACA,WAAA,EACyD;AACzD,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,EAAE,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAIA,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AAEA,IAAA,IAAI,CAAC,MAAA,CAAO,YAAA,CAAa,QAAA,CAAS,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAIA,kBAAW,sBAAsB,CAAA;AAAA,IAC7C;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,cAAc,MAAA,CAAO;AAAA,KACvB;AAAA,EACF;AAAA,EAEA,MAAa,4BAA4B,IAAA,EAGtC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AAErC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,EAAA,EAAI;AAAA,KACL,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIK,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAID,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIJ,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIK,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,aAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,MAAM,oBAAoBH,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrE,IAAA,MAAM,aAAA,GAAgBE,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,OAAA,EAAS,EAAA,EAAI,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA,EAAM,iBAAA;AAAA,MACN,WAAW,OAAA,CAAQ,EAAA;AAAA,MACnB,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAE/C,IAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,MAAA,EAAQ,iBAAiB,CAAA;AACzD,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxD;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,YAAY,QAAA;AAAS,KACpC;AAAA,EACF;AAAA,EAEA,MAAa,wBAAwB,IAAA,EAA6B;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,IAAI,IAAA,CAAK;AAAA,KACV,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIC,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAID,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIJ,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIK,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,QAAQ,CAAA;AAE5D,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,UAAA;AAAA,MACA,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,MAC7B,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,OAAA,CAAQ;AAAA,KAClB;AAAA,EACF;AAAA,EAEA,MAAa,2BAA2B,IAAA,EAGrC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AAErC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,EAAA,EAAI;AAAA,KACL,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAID,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIJ,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIK,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,MAAA,EAAQ,UAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,qBAAqB,MAAA,EAM/B;AACD,IAAA,MAAM,EAAE,IAAA,EAAM,WAAA,EAAa,YAAA,EAAc,SAAA,EAAW,WAAU,GAAI,MAAA;AAElE,IAAA,IAAI,cAAc,oBAAA,EAAsB;AACtC,MAAA,MAAM,IAAIL,kBAAW,wBAAwB,CAAA;AAAA,IAC/C;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAK,oBAAA,CAAqB,EAAE,MAAM,CAAA;AAC9D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIM,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAIF,eAAS,UAAA,CAAW,QAAA,CAAS,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC5D,MAAA,MAAM,IAAIE,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,IAAI,QAAA,CAAS;AAAA,KACd,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAID,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAI,OAAA,CAAQ,gBAAgB,WAAA,EAAa;AACvC,MAAA,MAAM,IAAIC,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,UAAA,EAAY;AACjC,MAAA,MAAM,IAAIA,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC1B,MAAA,MAAM,IAAIA,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AAEA,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,MACjE;AAEA,MAAA,IACE,CAAC,IAAA,CAAK,UAAA;AAAA,QACJ,OAAA,CAAQ,aAAA;AAAA,QACR,YAAA;AAAA,QACA,OAAA,CAAQ;AAAA,OACV,EACA;AACA,QAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,MACvD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,YAAY,UAAA,CAAW;AAAA,MAClD,MAAA,EAAQ;AAAA,QACN,KAAK,OAAA,CAAQ;AAAA;AACf,KACD,CAAA;AAGD,IAAA,IAAI,YAAA;AACJ,IAAA,MAAM,SAAS,OAAA,CAAQ,KAAA,EAAO,KAAA,CAAM,GAAG,KAAK,EAAC;AAC7C,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,gBAAgB,CAAA,IAAK,KAAK,aAAA,EAAe;AAC3D,MAAA,YAAA,GAAe,MAAM,IAAA,CAAK,aAAA,CAAc,iBAAA,CAAkB;AAAA,QACxD,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,cAAc,OAAA,CAAQ;AAAA,OACvB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,KAAA;AAAA,MACb,SAAA,EAAW,QAAA;AAAA,MACX,SAAA;AAAA,MACA,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,QAAQ,KAAA,IAAS,QAAA;AAAA,MACxB;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAa,mBAAmB,MAAA,EAQ7B;AACD,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA,MAAM,IAAIN,kBAAW,gCAAgC,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,WAAA,EAAa,YAAA,KACnB,MAAM,IAAA,CAAK,cAAc,kBAAA,CAAmB;AAAA,MAC1C,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAU,MAAA,CAAO;AAAA,KAClB,CAAA;AAEH,IAAA,MAAM,SAAA,GAAYO,0CAAA,CAAuB,IAAA,CAAK,MAAM,CAAA;AAEpD,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,SAAA,EAAW,QAAA;AAAA,MACX,SAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,wBAAwB,OAAA,EAGhB;AACnB,IAAA,MAAM,EAAE,QAAA,EAAU,YAAA,EAAa,GAAI,OAAA;AACnC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,EAAE,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,cAAc,MAAM,CAAA;AACxD,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AACjD,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,QAAA,CAAS,MAAA,EAAQ;AACvC,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAOL,uBAAA,CAAO,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,mBAAmB,KAAA,EAA8B;AAC5D,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,aAAA,CAAc,kBAAA,CAAmB,KAAK,CAAA;AAAA,EACnD;AAAA,EAEQ,UAAA,CACN,aAAA,EACA,YAAA,EACA,MAAA,EACS;AACT,IAAA,IAAI,CAAC,MAAA,IAAU,MAAA,KAAW,OAAA,EAAS;AACjC,MAAA,OAAO,aAAA,KAAkB,YAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,MAAA,MAAM,IAAA,GAAOA,wBAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,YAAY,EAAE,MAAA,EAAO;AACrE,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA;AAC/C,MAAA,OAAO,aAAA,KAAkB,aAAA;AAAA,IAC3B;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;;"}

package/dist/service/router.cjs.js

@@ -125,7 +125,8 @@ async function createRouter(options) {
     oidc,
     logger,
     httpAuth,
-    config
+    config,
+    offlineAccess: options.offlineAccess
   });
   router$1.use(oidcRouter.getRouter());
   router$1.use("/:provider/", (req) => {

package/dist/service/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cookieParser from 'cookie-parser';\nimport {\n  AuthService,\n  DatabaseService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { AuthOwnershipResolver } from '@backstage/plugin-auth-node';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { NotFoundError } from '@backstage/errors';\nimport { KeyStores } from '../identity/KeyStores';\nimport { TokenFactory } from '../identity/TokenFactory';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport session from 'express-session';\nimport connectSessionKnex from 'connect-session-knex';\nimport passport from 'passport';\nimport { AuthDatabase } from '../database/AuthDatabase';\nimport {\n  readBackstageTokenExpiration,\n  readDcrTokenExpiration,\n} from './readTokenExpiration.ts';\nimport { StaticTokenIssuer } from '../identity/StaticTokenIssuer';\nimport { StaticKeyStore } from '../identity/StaticKeyStore';\nimport { bindProviderRouters, ProviderFactories } from '../providers/router';\nimport { OidcRouter } from './OidcRouter';\nimport { OidcDatabase } from '../database/OidcDatabase';\n\ninterface RouterOptions {\n  logger: LoggerService;\n  database: DatabaseService;\n  config: RootConfigService;\n  discovery: DiscoveryService;\n  auth: AuthService;\n  tokenFactoryAlgorithm?: string;\n  providerFactories?: ProviderFactories;\n  catalog: CatalogService;\n  ownershipResolver?: AuthOwnershipResolver;\n  httpAuth: HttpAuthService;\n}\n\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    logger,\n    config,\n    discovery,\n    database: db,\n    tokenFactoryAlgorithm,\n    providerFactories = {},\n    httpAuth,\n  } = options;\n\n  const router = Router();\n\n  const appUrl = config.getString('app.baseUrl');\n  const authUrl = await discovery.getExternalBaseUrl('auth');\n  const backstageTokenExpiration = readBackstageTokenExpiration(config);\n  const database = AuthDatabase.create(db);\n\n  const keyStore = await KeyStores.fromConfig(config, {\n    logger,\n    database,\n  });\n\n  const userInfo = await UserInfoDatabase.create({\n    database,\n  });\n\n  const omitClaimsFromToken = config.getOptionalBoolean(\n    'auth.omitIdentityTokenOwnershipClaim',\n  )\n    ? ['ent']\n    : [];\n\n  const createTokenIssuer = (opts: {\n    logger: LoggerService;\n    expirationSeconds: number;\n  }) => {\n    if (keyStore instanceof StaticKeyStore) {\n      return new StaticTokenIssuer(\n        {\n          logger: opts.logger,\n          issuer: authUrl,\n          sessionExpirationSeconds: opts.expirationSeconds,\n          omitClaimsFromToken,\n        },\n        keyStore as StaticKeyStore,\n      );\n    }\n    return new TokenFactory({\n      issuer: authUrl,\n      keyStore,\n      keyDurationSeconds: opts.expirationSeconds,\n      logger: opts.logger,\n      algorithm:\n        tokenFactoryAlgorithm ??\n        config.getOptionalString('auth.identityTokenAlgorithm'),\n      omitClaimsFromToken,\n    });\n  };\n\n  const tokenIssuer = createTokenIssuer({\n    logger: logger.child({ component: 'token-factory' }),\n    expirationSeconds: backstageTokenExpiration,\n  });\n\n  const secret = config.getOptionalString('auth.session.secret');\n  if (secret) {\n    router.use(cookieParser(secret));\n    const enforceCookieSSL = authUrl.startsWith('https');\n    const KnexSessionStore = connectSessionKnex(session);\n    router.use(\n      session({\n        secret,\n        saveUninitialized: false,\n        resave: false,\n        cookie: { secure: enforceCookieSSL ? 'auto' : false },\n        store: new KnexSessionStore({\n          createtable: false,\n          knex: await database.get(),\n        }),\n      }),\n    );\n    router.use(passport.initialize());\n    router.use(passport.session());\n  } else {\n    router.use(cookieParser());\n  }\n\n  router.use(express.urlencoded({ extended: false }));\n  router.use(express.json());\n\n  bindProviderRouters(router, {\n    providers: providerFactories,\n    appUrl,\n    baseUrl: authUrl,\n    tokenIssuer,\n    ...options,\n    auth: options.auth,\n    userInfo,\n  });\n\n  const dcrTokenExpiration = readDcrTokenExpiration(config);\n\n  const oidcTokenIssuer = createTokenIssuer({\n    logger: logger.child({ component: 'oidc-token-factory' }),\n    expirationSeconds: dcrTokenExpiration,\n  });\n\n  const oidc = await OidcDatabase.create({ database });\n\n  const oidcRouter = OidcRouter.create({\n    auth: options.auth,\n    tokenIssuer: oidcTokenIssuer,\n    baseUrl: authUrl,\n    appUrl,\n    userInfo,\n    oidc,\n    logger,\n    httpAuth,\n    config,\n  });\n\n  router.use(oidcRouter.getRouter());\n\n  // Gives a more helpful error message than a plain 404\n  router.use('/:provider/', req => {\n    const { provider } = req.params;\n    throw new NotFoundError(`Unknown auth provider '${provider}'`);\n  });\n\n  return router;\n}\n"],"names":["router","Router","readBackstageTokenExpiration","AuthDatabase","KeyStores","UserInfoDatabase","StaticKeyStore","StaticTokenIssuer","TokenFactory","cookieParser","connectSessionKnex","session","passport","express","bindProviderRouters","readDcrTokenExpiration","OidcDatabase","OidcRouter","NotFoundError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,eAAsB,aACpB,OAAA,EACyB;AACzB,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA,EAAU,EAAA;AAAA,IACV,qBAAA;AAAA,IACA,oBAAoB,EAAC;AAAA,IACrB;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAMA,WAASC,uBAAA,EAAO;AAEtB,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,kBAAA,CAAmB,MAAM,CAAA;AACzD,EAAA,MAAM,wBAAA,GAA2BC,iDAA6B,MAAM,CAAA;AACpE,EAAA,MAAM,QAAA,GAAWC,yBAAA,CAAa,MAAA,CAAO,EAAE,CAAA;AAEvC,EAAA,MAAM,QAAA,GAAW,MAAMC,mBAAA,CAAU,UAAA,CAAW,MAAA,EAAQ;AAAA,IAClD,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,MAAMC,iCAAA,CAAiB,MAAA,CAAO;AAAA,IAC7C;AAAA,GACD,CAAA;AAED,EAAA,MAAM,sBAAsB,MAAA,CAAO,kBAAA;AAAA,IACjC;AAAA,GACF,GACI,CAAC,KAAK,CAAA,GACN,EAAC;AAEL,EAAA,MAAM,iBAAA,GAAoB,CAAC,IAAA,KAGrB;AACJ,IAAA,IAAI,oBAAoBC,6BAAA,EAAgB;AACtC,MAAA,OAAO,IAAIC,mCAAA;AAAA,QACT;AAAA,UACE,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,MAAA,EAAQ,OAAA;AAAA,UACR,0BAA0B,IAAA,CAAK,iBAAA;AAAA,UAC/B;AAAA,SACF;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAIC,yBAAA,CAAa;AAAA,MACtB,MAAA,EAAQ,OAAA;AAAA,MACR,QAAA;AAAA,MACA,oBAAoB,IAAA,CAAK,iBAAA;AAAA,MACzB,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAA,EACE,qBAAA,IACA,MAAA,CAAO,iBAAA,CAAkB,6BAA6B,CAAA;AAAA,MACxD;AAAA,KACD,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,MAAM,cAAc,iBAAA,CAAkB;AAAA,IACpC,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,IACnD,iBAAA,EAAmB;AAAA,GACpB,CAAA;AAED,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,iBAAA,CAAkB,qBAAqB,CAAA;AAC7D,EAAA,IAAI,MAAA,EAAQ;AACV,IAAAR,QAAA,CAAO,GAAA,CAAIS,6BAAA,CAAa,MAAM,CAAC,CAAA;AAC/B,IAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA;AACnD,IAAA,MAAM,gBAAA,GAAmBC,oCAAmBC,wBAAO,CAAA;AACnD,IAAAX,QAAA,CAAO,GAAA;AAAA,MACLW,wBAAA,CAAQ;AAAA,QACN,MAAA;AAAA,QACA,iBAAA,EAAmB,KAAA;AAAA,QACnB,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,EAAE,MAAA,EAAQ,gBAAA,GAAmB,SAAS,KAAA,EAAM;AAAA,QACpD,KAAA,EAAO,IAAI,gBAAA,CAAiB;AAAA,UAC1B,WAAA,EAAa,KAAA;AAAA,UACb,IAAA,EAAM,MAAM,QAAA,CAAS,GAAA;AAAI,SAC1B;AAAA,OACF;AAAA,KACH;AACA,IAAAX,QAAA,CAAO,GAAA,CAAIY,yBAAA,CAAS,UAAA,EAAY,CAAA;AAChC,IAAAZ,QAAA,CAAO,GAAA,CAAIY,yBAAA,CAAS,OAAA,EAAS,CAAA;AAAA,EAC/B,CAAA,MAAO;AACL,IAAAZ,QAAA,CAAO,GAAA,CAAIS,+BAAc,CAAA;AAAA,EAC3B;AAEA,EAAAT,QAAA,CAAO,IAAIa,wBAAA,CAAQ,UAAA,CAAW,EAAE,QAAA,EAAU,KAAA,EAAO,CAAC,CAAA;AAClD,EAAAb,QAAA,CAAO,GAAA,CAAIa,wBAAA,CAAQ,IAAA,EAAM,CAAA;AAEzB,EAAAC,0BAAA,CAAoBd,QAAA,EAAQ;AAAA,IAC1B,SAAA,EAAW,iBAAA;AAAA,IACX,MAAA;AAAA,IACA,OAAA,EAAS,OAAA;AAAA,IACT,WAAA;AAAA,IACA,GAAG,OAAA;AAAA,IACH,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd;AAAA,GACD,CAAA;AAED,EAAA,MAAM,kBAAA,GAAqBe,2CAAuB,MAAM,CAAA;AAExD,EAAA,MAAM,kBAAkB,iBAAA,CAAkB;AAAA,IACxC,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,SAAA,EAAW,sBAAsB,CAAA;AAAA,IACxD,iBAAA,EAAmB;AAAA,GACpB,CAAA;AAED,EAAA,MAAM,OAAO,MAAMC,yBAAA,CAAa,MAAA,CAAO,EAAE,UAAU,CAAA;AAEnD,EAAA,MAAM,UAAA,GAAaC,sBAAW,MAAA,CAAO;AAAA,IACnC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,OAAA;AAAA,IACT,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAAjB,QAAA,CAAO,GAAA,CAAI,UAAA,CAAW,SAAA,EAAW,CAAA;AAGjC,EAAAA,QAAA,CAAO,GAAA,CAAI,eAAe,CAAA,GAAA,KAAO;AAC/B,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,GAAA,CAAI,MAAA;AACzB,IAAA,MAAM,IAAIkB,oBAAA,CAAc,CAAA,uBAAA,EAA0B,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/D,CAAC,CAAA;AAED,EAAA,OAAOlB,QAAA;AACT;;;;"}
+{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cookieParser from 'cookie-parser';\nimport {\n  AuthService,\n  DatabaseService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { AuthOwnershipResolver } from '@backstage/plugin-auth-node';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { NotFoundError } from '@backstage/errors';\nimport { KeyStores } from '../identity/KeyStores';\nimport { TokenFactory } from '../identity/TokenFactory';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport session from 'express-session';\nimport connectSessionKnex from 'connect-session-knex';\nimport passport from 'passport';\nimport { AuthDatabase } from '../database/AuthDatabase';\nimport {\n  readBackstageTokenExpiration,\n  readDcrTokenExpiration,\n} from './readTokenExpiration.ts';\nimport { StaticTokenIssuer } from '../identity/StaticTokenIssuer';\nimport { StaticKeyStore } from '../identity/StaticKeyStore';\nimport { bindProviderRouters, ProviderFactories } from '../providers/router';\nimport { OidcRouter } from './OidcRouter';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { OfflineAccessService } from './OfflineAccessService';\n\ninterface RouterOptions {\n  logger: LoggerService;\n  database: DatabaseService;\n  config: RootConfigService;\n  discovery: DiscoveryService;\n  auth: AuthService;\n  tokenFactoryAlgorithm?: string;\n  providerFactories?: ProviderFactories;\n  catalog: CatalogService;\n  ownershipResolver?: AuthOwnershipResolver;\n  httpAuth: HttpAuthService;\n  offlineAccess?: OfflineAccessService;\n}\n\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const {\n    logger,\n    config,\n    discovery,\n    database: db,\n    tokenFactoryAlgorithm,\n    providerFactories = {},\n    httpAuth,\n  } = options;\n\n  const router = Router();\n\n  const appUrl = config.getString('app.baseUrl');\n  const authUrl = await discovery.getExternalBaseUrl('auth');\n  const backstageTokenExpiration = readBackstageTokenExpiration(config);\n  const database = AuthDatabase.create(db);\n\n  const keyStore = await KeyStores.fromConfig(config, {\n    logger,\n    database,\n  });\n\n  const userInfo = await UserInfoDatabase.create({\n    database,\n  });\n\n  const omitClaimsFromToken = config.getOptionalBoolean(\n    'auth.omitIdentityTokenOwnershipClaim',\n  )\n    ? ['ent']\n    : [];\n\n  const createTokenIssuer = (opts: {\n    logger: LoggerService;\n    expirationSeconds: number;\n  }) => {\n    if (keyStore instanceof StaticKeyStore) {\n      return new StaticTokenIssuer(\n        {\n          logger: opts.logger,\n          issuer: authUrl,\n          sessionExpirationSeconds: opts.expirationSeconds,\n          omitClaimsFromToken,\n        },\n        keyStore as StaticKeyStore,\n      );\n    }\n    return new TokenFactory({\n      issuer: authUrl,\n      keyStore,\n      keyDurationSeconds: opts.expirationSeconds,\n      logger: opts.logger,\n      algorithm:\n        tokenFactoryAlgorithm ??\n        config.getOptionalString('auth.identityTokenAlgorithm'),\n      omitClaimsFromToken,\n    });\n  };\n\n  const tokenIssuer = createTokenIssuer({\n    logger: logger.child({ component: 'token-factory' }),\n    expirationSeconds: backstageTokenExpiration,\n  });\n\n  const secret = config.getOptionalString('auth.session.secret');\n  if (secret) {\n    router.use(cookieParser(secret));\n    const enforceCookieSSL = authUrl.startsWith('https');\n    const KnexSessionStore = connectSessionKnex(session);\n    router.use(\n      session({\n        secret,\n        saveUninitialized: false,\n        resave: false,\n        cookie: { secure: enforceCookieSSL ? 'auto' : false },\n        store: new KnexSessionStore({\n          createtable: false,\n          knex: await database.get(),\n        }),\n      }),\n    );\n    router.use(passport.initialize());\n    router.use(passport.session());\n  } else {\n    router.use(cookieParser());\n  }\n\n  router.use(express.urlencoded({ extended: false }));\n  router.use(express.json());\n\n  bindProviderRouters(router, {\n    providers: providerFactories,\n    appUrl,\n    baseUrl: authUrl,\n    tokenIssuer,\n    ...options,\n    auth: options.auth,\n    userInfo,\n  });\n\n  const dcrTokenExpiration = readDcrTokenExpiration(config);\n\n  const oidcTokenIssuer = createTokenIssuer({\n    logger: logger.child({ component: 'oidc-token-factory' }),\n    expirationSeconds: dcrTokenExpiration,\n  });\n\n  const oidc = await OidcDatabase.create({ database });\n\n  const oidcRouter = OidcRouter.create({\n    auth: options.auth,\n    tokenIssuer: oidcTokenIssuer,\n    baseUrl: authUrl,\n    appUrl,\n    userInfo,\n    oidc,\n    logger,\n    httpAuth,\n    config,\n    offlineAccess: options.offlineAccess,\n  });\n\n  router.use(oidcRouter.getRouter());\n\n  // Gives a more helpful error message than a plain 404\n  router.use('/:provider/', req => {\n    const { provider } = req.params;\n    throw new NotFoundError(`Unknown auth provider '${provider}'`);\n  });\n\n  return router;\n}\n"],"names":["router","Router","readBackstageTokenExpiration","AuthDatabase","KeyStores","UserInfoDatabase","StaticKeyStore","StaticTokenIssuer","TokenFactory","cookieParser","connectSessionKnex","session","passport","express","bindProviderRouters","readDcrTokenExpiration","OidcDatabase","OidcRouter","NotFoundError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,eAAsB,aACpB,OAAA,EACyB;AACzB,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA,EAAU,EAAA;AAAA,IACV,qBAAA;AAAA,IACA,oBAAoB,EAAC;AAAA,IACrB;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAMA,WAASC,uBAAA,EAAO;AAEtB,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,kBAAA,CAAmB,MAAM,CAAA;AACzD,EAAA,MAAM,wBAAA,GAA2BC,iDAA6B,MAAM,CAAA;AACpE,EAAA,MAAM,QAAA,GAAWC,yBAAA,CAAa,MAAA,CAAO,EAAE,CAAA;AAEvC,EAAA,MAAM,QAAA,GAAW,MAAMC,mBAAA,CAAU,UAAA,CAAW,MAAA,EAAQ;AAAA,IAClD,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,MAAMC,iCAAA,CAAiB,MAAA,CAAO;AAAA,IAC7C;AAAA,GACD,CAAA;AAED,EAAA,MAAM,sBAAsB,MAAA,CAAO,kBAAA;AAAA,IACjC;AAAA,GACF,GACI,CAAC,KAAK,CAAA,GACN,EAAC;AAEL,EAAA,MAAM,iBAAA,GAAoB,CAAC,IAAA,KAGrB;AACJ,IAAA,IAAI,oBAAoBC,6BAAA,EAAgB;AACtC,MAAA,OAAO,IAAIC,mCAAA;AAAA,QACT;AAAA,UACE,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,MAAA,EAAQ,OAAA;AAAA,UACR,0BAA0B,IAAA,CAAK,iBAAA;AAAA,UAC/B;AAAA,SACF;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAIC,yBAAA,CAAa;AAAA,MACtB,MAAA,EAAQ,OAAA;AAAA,MACR,QAAA;AAAA,MACA,oBAAoB,IAAA,CAAK,iBAAA;AAAA,MACzB,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAA,EACE,qBAAA,IACA,MAAA,CAAO,iBAAA,CAAkB,6BAA6B,CAAA;AAAA,MACxD;AAAA,KACD,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,MAAM,cAAc,iBAAA,CAAkB;AAAA,IACpC,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,SAAA,EAAW,iBAAiB,CAAA;AAAA,IACnD,iBAAA,EAAmB;AAAA,GACpB,CAAA;AAED,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,iBAAA,CAAkB,qBAAqB,CAAA;AAC7D,EAAA,IAAI,MAAA,EAAQ;AACV,IAAAR,QAAA,CAAO,GAAA,CAAIS,6BAAA,CAAa,MAAM,CAAC,CAAA;AAC/B,IAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA;AACnD,IAAA,MAAM,gBAAA,GAAmBC,oCAAmBC,wBAAO,CAAA;AACnD,IAAAX,QAAA,CAAO,GAAA;AAAA,MACLW,wBAAA,CAAQ;AAAA,QACN,MAAA;AAAA,QACA,iBAAA,EAAmB,KAAA;AAAA,QACnB,MAAA,EAAQ,KAAA;AAAA,QACR,MAAA,EAAQ,EAAE,MAAA,EAAQ,gBAAA,GAAmB,SAAS,KAAA,EAAM;AAAA,QACpD,KAAA,EAAO,IAAI,gBAAA,CAAiB;AAAA,UAC1B,WAAA,EAAa,KAAA;AAAA,UACb,IAAA,EAAM,MAAM,QAAA,CAAS,GAAA;AAAI,SAC1B;AAAA,OACF;AAAA,KACH;AACA,IAAAX,QAAA,CAAO,GAAA,CAAIY,yBAAA,CAAS,UAAA,EAAY,CAAA;AAChC,IAAAZ,QAAA,CAAO,GAAA,CAAIY,yBAAA,CAAS,OAAA,EAAS,CAAA;AAAA,EAC/B,CAAA,MAAO;AACL,IAAAZ,QAAA,CAAO,GAAA,CAAIS,+BAAc,CAAA;AAAA,EAC3B;AAEA,EAAAT,QAAA,CAAO,IAAIa,wBAAA,CAAQ,UAAA,CAAW,EAAE,QAAA,EAAU,KAAA,EAAO,CAAC,CAAA;AAClD,EAAAb,QAAA,CAAO,GAAA,CAAIa,wBAAA,CAAQ,IAAA,EAAM,CAAA;AAEzB,EAAAC,0BAAA,CAAoBd,QAAA,EAAQ;AAAA,IAC1B,SAAA,EAAW,iBAAA;AAAA,IACX,MAAA;AAAA,IACA,OAAA,EAAS,OAAA;AAAA,IACT,WAAA;AAAA,IACA,GAAG,OAAA;AAAA,IACH,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd;AAAA,GACD,CAAA;AAED,EAAA,MAAM,kBAAA,GAAqBe,2CAAuB,MAAM,CAAA;AAExD,EAAA,MAAM,kBAAkB,iBAAA,CAAkB;AAAA,IACxC,QAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,SAAA,EAAW,sBAAsB,CAAA;AAAA,IACxD,iBAAA,EAAmB;AAAA,GACpB,CAAA;AAED,EAAA,MAAM,OAAO,MAAMC,yBAAA,CAAa,MAAA,CAAO,EAAE,UAAU,CAAA;AAEnD,EAAA,MAAM,UAAA,GAAaC,sBAAW,MAAA,CAAO;AAAA,IACnC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,WAAA,EAAa,eAAA;AAAA,IACb,OAAA,EAAS,OAAA;AAAA,IACT,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,eAAe,OAAA,CAAQ;AAAA,GACxB,CAAA;AAED,EAAAjB,QAAA,CAAO,GAAA,CAAI,UAAA,CAAW,SAAA,EAAW,CAAA;AAGjC,EAAAA,QAAA,CAAO,GAAA,CAAI,eAAe,CAAA,GAAA,KAAO;AAC/B,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,GAAA,CAAI,MAAA;AACzB,IAAA,MAAM,IAAIkB,oBAAA,CAAc,CAAA,uBAAA,EAA0B,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/D,CAAC,CAAA;AAED,EAAA,OAAOlB,QAAA;AACT;;;;"}

package/migrations/20251020000000_offline_sessions.js

@@ -0,0 +1,78 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// @ts-check
+
+/**
+ * @param {import('knex').Knex} knex
+ */
+exports.up = async function up(knex) {
+  await knex.schema.createTable('offline_sessions', table => {
+    table.comment(
+      'Offline sessions for refresh tokens in dynamic client registration and device auth flows',
+    );
+
+    table
+      .string('id')
+      .primary()
+      .notNullable()
+      .comment('Persistent session ID that remains across token rotations');
+
+    table
+      .string('user_entity_ref')
+      .notNullable()
+      .comment('Backstage user entity reference');
+
+    table
+      .string('oidc_client_id')
+      .nullable()
+      .comment('OIDC client identifier (optional, for OIDC flows)');
+
+    table
+      .text('token_hash')
+      .notNullable()
+      .comment('Current refresh token hash (scrypt)');
+
+    table
+      .timestamp('created_at', { useTz: true, precision: 0 })
+      .notNullable()
+      .defaultTo(knex.fn.now())
+      .comment('Session creation timestamp');
+
+    table
+      .timestamp('last_used_at', { useTz: true, precision: 0 })
+      .notNullable()
+      .defaultTo(knex.fn.now())
+      .comment('Last token refresh timestamp');
+
+    table
+      .foreign('oidc_client_id')
+      .references('client_id')
+      .inTable('oidc_clients')
+      .onDelete('CASCADE');
+    table.index('user_entity_ref', 'offline_sessions_user_idx');
+    table.index('oidc_client_id', 'offline_sessions_oidc_client_idx');
+    table.index('created_at', 'offline_sessions_created_idx');
+    table.index('last_used_at', 'offline_sessions_last_used_idx');
+  });
+};
+
+/**
+ * @param {import('knex').Knex} knex
+ */
+exports.down = async function down(knex) {
+  await knex.schema.dropTable('offline_sessions');
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend",
-  "version": "0.26.1-next.0",
+  "version": "0.27.0-next.1",
   "description": "A Backstage backend plugin that handles authentication",
   "backstage": {
     "role": "backend-plugin",
@@ -47,12 +47,12 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.7.0-next.0",
+    "@backstage/backend-plugin-api": "1.7.0-next.1",
     "@backstage/catalog-model": "1.7.6",
     "@backstage/config": "1.3.6",
     "@backstage/errors": "1.2.7",
-    "@backstage/plugin-auth-node": "0.6.12-next.0",
-    "@backstage/plugin-catalog-node": "1.21.0-next.0",
+    "@backstage/plugin-auth-node": "0.6.13-next.1",
+    "@backstage/plugin-catalog-node": "2.0.0-next.1",
     "@backstage/types": "1.2.2",
     "@google-cloud/firestore": "^7.0.0",
     "connect-session-knex": "^4.0.0",
@@ -67,13 +67,15 @@
     "matcher": "^4.0.0",
     "minimatch": "^9.0.0",
     "passport": "^0.7.0",
-    "uuid": "^11.0.0"
+    "uuid": "^11.0.0",
+    "zod": "^4.3.5",
+    "zod-validation-error": "^5.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.15.1-next.0",
-    "@backstage/backend-test-utils": "1.10.4-next.0",
-    "@backstage/cli": "0.35.3-next.0",
-    "@backstage/plugin-auth-backend-module-google-provider": "0.3.11-next.0",
+    "@backstage/backend-defaults": "0.15.2-next.1",
+    "@backstage/backend-test-utils": "1.11.0-next.1",
+    "@backstage/cli": "0.35.4-next.2",
+    "@backstage/plugin-auth-backend-module-google-provider": "0.3.12-next.0",
     "@backstage/plugin-auth-backend-module-guest-provider": "0.2.16-next.0",
     "@types/cookie-parser": "^1.4.2",
     "@types/express": "^4.17.6",