@backstage/plugin-auth-backend 0.26.1-next.0 → 0.27.0

package/dist/service/OfflineAccessService.cjs.js

@@ -0,0 +1,177 @@
+'use strict';
+
+var errors = require('@backstage/errors');
+var config = require('@backstage/config');
+var types = require('@backstage/types');
+var uuid = require('uuid');
+var OfflineSessionDatabase = require('../database/OfflineSessionDatabase.cjs.js');
+var refreshToken = require('../lib/refreshToken.cjs.js');
+
+class OfflineAccessService {
+  #offlineSessionDb;
+  #logger;
+  static async create(options) {
+    const { config: config$1, database, logger, lifecycle } = options;
+    const tokenLifetime = config$1.has(
+      "auth.experimentalRefreshToken.tokenLifetime"
+    ) ? config.readDurationFromConfig(config$1, {
+      key: "auth.experimentalRefreshToken.tokenLifetime"
+    }) : { days: 30 };
+    const maxRotationLifetime = config$1.has(
+      "auth.experimentalRefreshToken.maxRotationLifetime"
+    ) ? config.readDurationFromConfig(config$1, {
+      key: "auth.experimentalRefreshToken.maxRotationLifetime"
+    }) : { years: 1 };
+    const tokenLifetimeSeconds = Math.floor(
+      types.durationToMilliseconds(tokenLifetime) / 1e3
+    );
+    const maxRotationLifetimeSeconds = Math.floor(
+      types.durationToMilliseconds(maxRotationLifetime) / 1e3
+    );
+    if (tokenLifetimeSeconds <= 0) {
+      throw new Error(
+        "auth.experimentalRefreshToken.tokenLifetime must be a positive duration"
+      );
+    }
+    if (maxRotationLifetimeSeconds <= 0) {
+      throw new Error(
+        "auth.experimentalRefreshToken.maxRotationLifetime must be a positive duration"
+      );
+    }
+    if (maxRotationLifetimeSeconds <= tokenLifetimeSeconds) {
+      throw new Error(
+        "auth.experimentalRefreshToken.maxRotationLifetime must be greater than tokenLifetime"
+      );
+    }
+    const maxTokensPerUser = config$1.getOptionalNumber(
+      "auth.experimentalRefreshToken.maxTokensPerUser"
+    ) ?? 20;
+    if (maxTokensPerUser <= 0) {
+      throw new Error(
+        "auth.experimentalRefreshToken.maxTokensPerUser must be a positive number"
+      );
+    }
+    const knex = await database.getClient();
+    if (knex.client.config.client.includes("sqlite") || knex.client.config.client.includes("better-sqlite")) {
+      logger.warn(
+        "Refresh tokens are enabled with SQLite, which does not support row-level locking. Concurrent token rotation may not be fully protected against race conditions. Use PostgreSQL for production deployments."
+      );
+    }
+    const offlineSessionDb = OfflineSessionDatabase.OfflineSessionDatabase.create({
+      knex,
+      tokenLifetimeSeconds,
+      maxRotationLifetimeSeconds,
+      maxTokensPerUser
+    });
+    const cleanupIntervalMs = 60 * 60 * 1e3;
+    const cleanupInterval = setInterval(async () => {
+      try {
+        const deleted = await offlineSessionDb.cleanupExpiredSessions();
+        if (deleted > 0) {
+          logger.info(`Cleaned up ${deleted} expired offline sessions`);
+        }
+      } catch (error) {
+        logger.error("Failed to cleanup expired offline sessions", error);
+      }
+    }, cleanupIntervalMs);
+    cleanupInterval.unref();
+    lifecycle.addShutdownHook(() => {
+      clearInterval(cleanupInterval);
+    });
+    return new OfflineAccessService(offlineSessionDb, logger);
+  }
+  constructor(offlineSessionDb, logger) {
+    this.#offlineSessionDb = offlineSessionDb;
+    this.#logger = logger;
+  }
+  /**
+   * Issue a new refresh token for a user
+   */
+  async issueRefreshToken(options) {
+    const { userEntityRef, oidcClientId } = options;
+    const sessionId = uuid.v4();
+    const { token, hash } = await refreshToken.generateRefreshToken(sessionId);
+    await this.#offlineSessionDb.createSession({
+      id: sessionId,
+      userEntityRef,
+      oidcClientId,
+      tokenHash: hash
+    });
+    this.#logger.debug(
+      `Issued refresh token for user ${userEntityRef} with session ${sessionId}`
+    );
+    return token;
+  }
+  /**
+   * Refresh an access token using a refresh token
+   */
+  async refreshAccessToken(options) {
+    const { refreshToken: refreshToken$1, tokenIssuer, clientId } = options;
+    let sessionId;
+    try {
+      sessionId = refreshToken.getRefreshTokenId(refreshToken$1);
+    } catch (error) {
+      this.#logger.debug("Failed to extract refresh token ID", error);
+      throw new errors.AuthenticationError("Invalid refresh token format");
+    }
+    const session = await this.#offlineSessionDb.getSessionById(sessionId);
+    if (!session) {
+      throw new errors.AuthenticationError("Invalid refresh token");
+    }
+    if (this.#offlineSessionDb.isSessionExpired(session)) {
+      await this.#offlineSessionDb.deleteSession(sessionId);
+      throw new errors.AuthenticationError("Invalid refresh token");
+    }
+    if (clientId && session.oidcClientId && clientId !== session.oidcClientId) {
+      throw new errors.AuthenticationError(
+        "Refresh token was not issued to this client"
+      );
+    }
+    const isValid = await refreshToken.verifyRefreshToken(refreshToken$1, session.tokenHash);
+    if (!isValid) {
+      throw new errors.AuthenticationError("Invalid refresh token");
+    }
+    const { token: newRefreshToken, hash: newHash } = await refreshToken.generateRefreshToken(sessionId);
+    const rotatedSession = await this.#offlineSessionDb.getAndRotateToken(
+      sessionId,
+      session.tokenHash,
+      newHash
+    );
+    if (!rotatedSession) {
+      throw new errors.AuthenticationError("Invalid refresh token");
+    }
+    const { token: accessToken } = await tokenIssuer.issueToken({
+      claims: {
+        sub: rotatedSession.userEntityRef
+      }
+    });
+    this.#logger.debug(
+      `Refreshed access token for user ${session.userEntityRef} with session ${sessionId}`
+    );
+    return { accessToken, refreshToken: newRefreshToken };
+  }
+  /**
+   * Revoke a refresh token
+   */
+  async revokeRefreshToken(refreshToken$1) {
+    try {
+      const sessionId = refreshToken.getRefreshTokenId(refreshToken$1);
+      await this.#offlineSessionDb.deleteSession(sessionId);
+      this.#logger.debug(`Revoked refresh token with session ${sessionId}`);
+    } catch (error) {
+      this.#logger.debug("Failed to revoke refresh token", error);
+    }
+  }
+  /**
+   * Revoke all refresh tokens for a user
+   */
+  async revokeRefreshTokensByUserEntityRef(userEntityRef) {
+    const deletedCount = await this.#offlineSessionDb.deleteSessionsByUserEntityRef(userEntityRef);
+    this.#logger.debug(
+      `Revoked ${deletedCount} refresh tokens for user ${userEntityRef}`
+    );
+  }
+}
+
+exports.OfflineAccessService = OfflineAccessService;
+//# sourceMappingURL=OfflineAccessService.cjs.js.map

package/dist/service/OfflineAccessService.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OfflineAccessService.cjs.js","sources":["../../src/service/OfflineAccessService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LifecycleService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { readDurationFromConfig } from '@backstage/config';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { v4 as uuid } from 'uuid';\nimport { OfflineSessionDatabase } from '../database/OfflineSessionDatabase';\nimport {\n  generateRefreshToken,\n  getRefreshTokenId,\n  verifyRefreshToken,\n} from '../lib/refreshToken';\nimport { TokenIssuer } from '../identity/types';\n\n/**\n * Service for managing offline access (refresh tokens)\n * @internal\n */\nexport class OfflineAccessService {\n  readonly #offlineSessionDb: OfflineSessionDatabase;\n  readonly #logger: LoggerService;\n\n  static async create(options: {\n    config: RootConfigService;\n    database: DatabaseService;\n    logger: LoggerService;\n    lifecycle: LifecycleService;\n  }): Promise<OfflineAccessService> {\n    const { config, database, logger, lifecycle } = options;\n\n    const tokenLifetime = config.has(\n      'auth.experimentalRefreshToken.tokenLifetime',\n    )\n      ? readDurationFromConfig(config, {\n          key: 'auth.experimentalRefreshToken.tokenLifetime',\n        })\n      : { days: 30 };\n\n    const maxRotationLifetime = config.has(\n      'auth.experimentalRefreshToken.maxRotationLifetime',\n    )\n      ? readDurationFromConfig(config, {\n          key: 'auth.experimentalRefreshToken.maxRotationLifetime',\n        })\n      : { years: 1 };\n\n    const tokenLifetimeSeconds = Math.floor(\n      durationToMilliseconds(tokenLifetime) / 1000,\n    );\n    const maxRotationLifetimeSeconds = Math.floor(\n      durationToMilliseconds(maxRotationLifetime) / 1000,\n    );\n\n    if (tokenLifetimeSeconds <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.tokenLifetime must be a positive duration',\n      );\n    }\n    if (maxRotationLifetimeSeconds <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxRotationLifetime must be a positive duration',\n      );\n    }\n    if (maxRotationLifetimeSeconds <= tokenLifetimeSeconds) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxRotationLifetime must be greater than tokenLifetime',\n      );\n    }\n\n    const maxTokensPerUser =\n      config.getOptionalNumber(\n        'auth.experimentalRefreshToken.maxTokensPerUser',\n      ) ?? 20;\n\n    if (maxTokensPerUser <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxTokensPerUser must be a positive number',\n      );\n    }\n\n    const knex = await database.getClient();\n\n    if (\n      knex.client.config.client.includes('sqlite') ||\n      knex.client.config.client.includes('better-sqlite')\n    ) {\n      logger.warn(\n        'Refresh tokens are enabled with SQLite, which does not support row-level locking. ' +\n          'Concurrent token rotation may not be fully protected against race conditions. ' +\n          'Use PostgreSQL for production deployments.',\n      );\n    }\n\n    const offlineSessionDb = OfflineSessionDatabase.create({\n      knex,\n      tokenLifetimeSeconds,\n      maxRotationLifetimeSeconds,\n      maxTokensPerUser,\n    });\n\n    const cleanupIntervalMs = 60 * 60 * 1000;\n    const cleanupInterval = setInterval(async () => {\n      try {\n        const deleted = await offlineSessionDb.cleanupExpiredSessions();\n        if (deleted > 0) {\n          logger.info(`Cleaned up ${deleted} expired offline sessions`);\n        }\n      } catch (error) {\n        logger.error('Failed to cleanup expired offline sessions', error);\n      }\n    }, cleanupIntervalMs);\n    cleanupInterval.unref();\n\n    lifecycle.addShutdownHook(() => {\n      clearInterval(cleanupInterval);\n    });\n\n    return new OfflineAccessService(offlineSessionDb, logger);\n  }\n\n  private constructor(\n    offlineSessionDb: OfflineSessionDatabase,\n    logger: LoggerService,\n  ) {\n    this.#offlineSessionDb = offlineSessionDb;\n    this.#logger = logger;\n  }\n\n  /**\n   * Issue a new refresh token for a user\n   */\n  async issueRefreshToken(options: {\n    userEntityRef: string;\n    oidcClientId?: string;\n  }): Promise<string> {\n    const { userEntityRef, oidcClientId } = options;\n\n    const sessionId = uuid();\n    const { token, hash } = await generateRefreshToken(sessionId);\n\n    await this.#offlineSessionDb.createSession({\n      id: sessionId,\n      userEntityRef,\n      oidcClientId,\n      tokenHash: hash,\n    });\n\n    this.#logger.debug(\n      `Issued refresh token for user ${userEntityRef} with session ${sessionId}`,\n    );\n\n    return token;\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshAccessToken(options: {\n    refreshToken: string;\n    tokenIssuer: TokenIssuer;\n    clientId?: string;\n  }): Promise<{ accessToken: string; refreshToken: string }> {\n    const { refreshToken, tokenIssuer, clientId } = options;\n\n    let sessionId: string;\n    try {\n      sessionId = getRefreshTokenId(refreshToken);\n    } catch (error) {\n      this.#logger.debug('Failed to extract refresh token ID', error);\n      throw new AuthenticationError('Invalid refresh token format');\n    }\n\n    const session = await this.#offlineSessionDb.getSessionById(sessionId);\n    if (!session) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (this.#offlineSessionDb.isSessionExpired(session)) {\n      await this.#offlineSessionDb.deleteSession(sessionId);\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (clientId && session.oidcClientId && clientId !== session.oidcClientId) {\n      throw new AuthenticationError(\n        'Refresh token was not issued to this client',\n      );\n    }\n\n    // Verify the caller actually holds a valid token, not just the session ID\n    const isValid = await verifyRefreshToken(refreshToken, session.tokenHash);\n    if (!isValid) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    const { token: newRefreshToken, hash: newHash } =\n      await generateRefreshToken(sessionId);\n\n    // Atomically swap the hash so a concurrent request with the same token fails\n    const rotatedSession = await this.#offlineSessionDb.getAndRotateToken(\n      sessionId,\n      session.tokenHash,\n      newHash,\n    );\n\n    if (!rotatedSession) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    const { token: accessToken } = await tokenIssuer.issueToken({\n      claims: {\n        sub: rotatedSession.userEntityRef,\n      },\n    });\n\n    this.#logger.debug(\n      `Refreshed access token for user ${session.userEntityRef} with session ${sessionId}`,\n    );\n\n    return { accessToken, refreshToken: newRefreshToken };\n  }\n\n  /**\n   * Revoke a refresh token\n   */\n  async revokeRefreshToken(refreshToken: string): Promise<void> {\n    try {\n      const sessionId = getRefreshTokenId(refreshToken);\n      await this.#offlineSessionDb.deleteSession(sessionId);\n      this.#logger.debug(`Revoked refresh token with session ${sessionId}`);\n    } catch (error) {\n      // Ignore errors when revoking - token may already be invalid\n      this.#logger.debug('Failed to revoke refresh token', error);\n    }\n  }\n\n  /**\n   * Revoke all refresh tokens for a user\n   */\n  async revokeRefreshTokensByUserEntityRef(\n    userEntityRef: string,\n  ): Promise<void> {\n    const deletedCount =\n      await this.#offlineSessionDb.deleteSessionsByUserEntityRef(userEntityRef);\n    this.#logger.debug(\n      `Revoked ${deletedCount} refresh tokens for user ${userEntityRef}`,\n    );\n  }\n}\n"],"names":["config","readDurationFromConfig","durationToMilliseconds","OfflineSessionDatabase","uuid","generateRefreshToken","refreshToken","getRefreshTokenId","AuthenticationError","verifyRefreshToken"],"mappings":";;;;;;;;;AAsCO,MAAM,oBAAA,CAAqB;AAAA,EACvB,iBAAA;AAAA,EACA,OAAA;AAAA,EAET,aAAa,OAAO,OAAA,EAKc;AAChC,IAAA,MAAM,UAAEA,QAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,WAAU,GAAI,OAAA;AAEhD,IAAA,MAAM,gBAAgBA,QAAA,CAAO,GAAA;AAAA,MAC3B;AAAA,KACF,GACIC,8BAAuBD,QAAA,EAAQ;AAAA,MAC7B,GAAA,EAAK;AAAA,KACN,CAAA,GACD,EAAE,IAAA,EAAM,EAAA,EAAG;AAEf,IAAA,MAAM,sBAAsBA,QAAA,CAAO,GAAA;AAAA,MACjC;AAAA,KACF,GACIC,8BAAuBD,QAAA,EAAQ;AAAA,MAC7B,GAAA,EAAK;AAAA,KACN,CAAA,GACD,EAAE,KAAA,EAAO,CAAA,EAAE;AAEf,IAAA,MAAM,uBAAuB,IAAA,CAAK,KAAA;AAAA,MAChCE,4BAAA,CAAuB,aAAa,CAAA,GAAI;AAAA,KAC1C;AACA,IAAA,MAAM,6BAA6B,IAAA,CAAK,KAAA;AAAA,MACtCA,4BAAA,CAAuB,mBAAmB,CAAA,GAAI;AAAA,KAChD;AAEA,IAAA,IAAI,wBAAwB,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,8BAA8B,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,8BAA8B,oBAAA,EAAsB;AACtD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBACJF,QAAA,CAAO,iBAAA;AAAA,MACL;AAAA,KACF,IAAK,EAAA;AAEP,IAAA,IAAI,oBAAoB,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,SAAA,EAAU;AAEtC,IAAA,IACE,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAC3C,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,eAAe,CAAA,EAClD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OAGF;AAAA,IACF;AAEA,IAAA,MAAM,gBAAA,GAAmBG,8CAAuB,MAAA,CAAO;AAAA,MACrD,IAAA;AAAA,MACA,oBAAA;AAAA,MACA,0BAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,iBAAA,GAAoB,KAAK,EAAA,GAAK,GAAA;AACpC,IAAA,MAAM,eAAA,GAAkB,YAAY,YAAY;AAC9C,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,sBAAA,EAAuB;AAC9D,QAAA,IAAI,UAAU,CAAA,EAAG;AACf,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,WAAA,EAAc,OAAO,CAAA,yBAAA,CAA2B,CAAA;AAAA,QAC9D;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,MAAA,CAAO,KAAA,CAAM,8CAA8C,KAAK,CAAA;AAAA,MAClE;AAAA,IACF,GAAG,iBAAiB,CAAA;AACpB,IAAA,eAAA,CAAgB,KAAA,EAAM;AAEtB,IAAA,SAAA,CAAU,gBAAgB,MAAM;AAC9B,MAAA,aAAA,CAAc,eAAe,CAAA;AAAA,IAC/B,CAAC,CAAA;AAED,IAAA,OAAO,IAAI,oBAAA,CAAqB,gBAAA,EAAkB,MAAM,CAAA;AAAA,EAC1D;AAAA,EAEQ,WAAA,CACN,kBACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,iBAAA,GAAoB,gBAAA;AACzB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,OAAA,EAGJ;AAClB,IAAA,MAAM,EAAE,aAAA,EAAe,YAAA,EAAa,GAAI,OAAA;AAExC,IAAA,MAAM,YAAYC,OAAA,EAAK;AACvB,IAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAMC,kCAAqB,SAAS,CAAA;AAE5D,IAAA,MAAM,IAAA,CAAK,kBAAkB,aAAA,CAAc;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,aAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,8BAAA,EAAiC,aAAa,CAAA,cAAA,EAAiB,SAAS,CAAA;AAAA,KAC1E;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,OAAA,EAIkC;AACzD,IAAA,MAAM,gBAAEC,cAAA,EAAc,WAAA,EAAa,QAAA,EAAS,GAAI,OAAA;AAEhD,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAYC,+BAAkBD,cAAY,CAAA;AAAA,IAC5C,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,oCAAA,EAAsC,KAAK,CAAA;AAC9D,MAAA,MAAM,IAAIE,2BAAoB,8BAA8B,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,eAAe,SAAS,CAAA;AACrE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,gBAAA,CAAiB,OAAO,CAAA,EAAG;AACpD,MAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,MAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,YAAA,IAAgB,QAAA,KAAa,QAAQ,YAAA,EAAc;AACzE,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,MAAMC,+BAAA,CAAmBH,cAAA,EAAc,QAAQ,SAAS,CAAA;AACxE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIE,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,OAAO,eAAA,EAAiB,IAAA,EAAM,SAAQ,GAC5C,MAAMH,kCAAqB,SAAS,CAAA;AAGtC,IAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,iBAAA;AAAA,MAClD,SAAA;AAAA,MACA,OAAA,CAAQ,SAAA;AAAA,MACR;AAAA,KACF;AAEA,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAIG,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAY,GAAI,MAAM,YAAY,UAAA,CAAW;AAAA,MAC1D,MAAA,EAAQ;AAAA,QACN,KAAK,cAAA,CAAe;AAAA;AACtB,KACD,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,gCAAA,EAAmC,OAAA,CAAQ,aAAa,CAAA,cAAA,EAAiB,SAAS,CAAA;AAAA,KACpF;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,eAAA,EAAgB;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmBF,cAAA,EAAqC;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYC,+BAAkBD,cAAY,CAAA;AAChD,MAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,CAAA,mCAAA,EAAsC,SAAS,CAAA,CAAE,CAAA;AAAA,IACtE,SAAS,KAAA,EAAO;AAEd,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,KAAK,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mCACJ,aAAA,EACe;AACf,IAAA,MAAM,YAAA,GACJ,MAAM,IAAA,CAAK,iBAAA,CAAkB,8BAA8B,aAAa,CAAA;AAC1E,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,QAAA,EAAW,YAAY,CAAA,yBAAA,EAA4B,aAAa,CAAA;AAAA,KAClE;AAAA,EACF;AACF;;;;"}

package/dist/service/OidcError.cjs.js

@@ -0,0 +1,57 @@
+'use strict';
+
+var errors = require('@backstage/errors');
+
+class OidcError extends errors.CustomErrorBase {
+  name = "OidcError";
+  body;
+  statusCode;
+  constructor(errorCode, errorDescription, statusCode, cause) {
+    super(`${errorCode}, ${errorDescription}`, cause);
+    this.statusCode = statusCode;
+    this.body = {
+      error: errorCode,
+      error_description: errorDescription
+    };
+  }
+  static isOidcError(error) {
+    return errors.isError(error) && error.name === "OidcError";
+  }
+  static fromError(error) {
+    if (OidcError.isOidcError(error)) {
+      return error;
+    }
+    if (!errors.isError(error)) {
+      return new OidcError("server_error", "Unknown error", 500, error);
+    }
+    const errorMessage = error.message || "Unknown error";
+    switch (error.name) {
+      case "InputError":
+        return new OidcError("invalid_request", errorMessage, 400, error);
+      case "AuthenticationError":
+        return new OidcError("invalid_client", errorMessage, 401, error);
+      case "NotAllowedError":
+        return new OidcError("access_denied", errorMessage, 403, error);
+      case "NotFoundError":
+        return new OidcError("invalid_request", errorMessage, 400, error);
+      default:
+        return new OidcError("server_error", errorMessage, 500, error);
+    }
+  }
+  static middleware(logger) {
+    return (err, _req, res, next) => {
+      if (OidcError.isOidcError(err)) {
+        logger[err.statusCode >= 500 ? "error" : "info"](
+          `OIDC Request failed with status ${err.statusCode}: ${err.body.error} - ${err.body.error_description}`,
+          err.cause
+        );
+        res.status(err.statusCode).json(err.body);
+        return;
+      }
+      next(err);
+    };
+  }
+}
+
+exports.OidcError = OidcError;
+//# sourceMappingURL=OidcError.cjs.js.map

package/dist/service/OidcError.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcError.cjs.js","sources":["../../src/service/OidcError.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { CustomErrorBase, isError } from '@backstage/errors';\nimport { Request, Response, NextFunction } from 'express';\nimport { LoggerService } from '@backstage/backend-plugin-api';\n\nexport class OidcError extends CustomErrorBase {\n  name = 'OidcError';\n\n  readonly body: { error: string; error_description: string };\n  readonly statusCode: number;\n\n  constructor(\n    errorCode: string,\n    errorDescription: string,\n    statusCode: number,\n    cause?: Error | unknown,\n  ) {\n    super(`${errorCode}, ${errorDescription}`, cause);\n    this.statusCode = statusCode;\n    this.body = {\n      error: errorCode,\n      error_description: errorDescription,\n    };\n  }\n\n  static isOidcError(error: unknown): error is OidcError {\n    return isError(error) && error.name === 'OidcError';\n  }\n\n  static fromError(error: unknown): OidcError {\n    if (OidcError.isOidcError(error)) {\n      return error;\n    }\n\n    if (!isError(error)) {\n      return new OidcError('server_error', 'Unknown error', 500, error);\n    }\n\n    const errorMessage = error.message || 'Unknown error';\n\n    switch (error.name) {\n      case 'InputError':\n        return new OidcError('invalid_request', errorMessage, 400, error);\n      case 'AuthenticationError':\n        return new OidcError('invalid_client', errorMessage, 401, error);\n      case 'NotAllowedError':\n        return new OidcError('access_denied', errorMessage, 403, error);\n      case 'NotFoundError':\n        return new OidcError('invalid_request', errorMessage, 400, error);\n      default:\n        return new OidcError('server_error', errorMessage, 500, error);\n    }\n  }\n\n  static middleware(\n    logger: LoggerService,\n  ): (err: unknown, _req: Request, res: Response, next: NextFunction) => void {\n    return (\n      err: unknown,\n      _req: Request,\n      res: Response,\n      next: NextFunction,\n    ): void => {\n      if (OidcError.isOidcError(err)) {\n        logger[err.statusCode >= 500 ? 'error' : 'info'](\n          `OIDC Request failed with status ${err.statusCode}: ${err.body.error} - ${err.body.error_description}`,\n          err.cause,\n        );\n        res.status(err.statusCode).json(err.body);\n        return;\n      }\n      next(err);\n    };\n  }\n}\n"],"names":["CustomErrorBase","isError"],"mappings":";;;;AAmBO,MAAM,kBAAkBA,sBAAA,CAAgB;AAAA,EAC7C,IAAA,GAAO,WAAA;AAAA,EAEE,IAAA;AAAA,EACA,UAAA;AAAA,EAET,WAAA,CACE,SAAA,EACA,gBAAA,EACA,UAAA,EACA,KAAA,EACA;AACA,IAAA,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,EAAA,EAAK,gBAAgB,IAAI,KAAK,CAAA;AAChD,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,KAAA,EAAO,SAAA;AAAA,MACP,iBAAA,EAAmB;AAAA,KACrB;AAAA,EACF;AAAA,EAEA,OAAO,YAAY,KAAA,EAAoC;AACrD,IAAA,OAAOC,cAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,WAAA;AAAA,EAC1C;AAAA,EAEA,OAAO,UAAU,KAAA,EAA2B;AAC1C,IAAA,IAAI,SAAA,CAAU,WAAA,CAAY,KAAK,CAAA,EAAG;AAChC,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAACA,cAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,MAAA,OAAO,IAAI,SAAA,CAAU,cAAA,EAAgB,eAAA,EAAiB,KAAK,KAAK,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,IAAW,eAAA;AAEtC,IAAA,QAAQ,MAAM,IAAA;AAAM,MAClB,KAAK,YAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,iBAAA,EAAmB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MAClE,KAAK,qBAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,gBAAA,EAAkB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MACjE,KAAK,iBAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,eAAA,EAAiB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MAChE,KAAK,eAAA;AACH,QAAA,OAAO,IAAI,SAAA,CAAU,iBAAA,EAAmB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA,MAClE;AACE,QAAA,OAAO,IAAI,SAAA,CAAU,cAAA,EAAgB,YAAA,EAAc,KAAK,KAAK,CAAA;AAAA;AACjE,EACF;AAAA,EAEA,OAAO,WACL,MAAA,EAC0E;AAC1E,IAAA,OAAO,CACL,GAAA,EACA,IAAA,EACA,GAAA,EACA,IAAA,KACS;AACT,MAAA,IAAI,SAAA,CAAU,WAAA,CAAY,GAAG,CAAA,EAAG;AAC9B,QAAA,MAAA,CAAO,GAAA,CAAI,UAAA,IAAc,GAAA,GAAM,OAAA,GAAU,MAAM,CAAA;AAAA,UAC7C,CAAA,gCAAA,EAAmC,GAAA,CAAI,UAAU,CAAA,EAAA,EAAK,GAAA,CAAI,KAAK,KAAK,CAAA,GAAA,EAAM,GAAA,CAAI,IAAA,CAAK,iBAAiB,CAAA,CAAA;AAAA,UACpG,GAAA,CAAI;AAAA,SACN;AACA,QAAA,GAAA,CAAI,OAAO,GAAA,CAAI,UAAU,CAAA,CAAE,IAAA,CAAK,IAAI,IAAI,CAAA;AACxC,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV,CAAA;AAAA,EACF;AACF;;;;"}