@backstage/plugin-auth-backend 0.7.0-next.0 → 0.9.0-next.1

package/dist/index.cjs.js

@@ -149,6 +149,16 @@ const verifyNonce = (req, providerId) => {
     throw new Error("Invalid nonce");
   }
 };
+const getCookieConfig = (authUrl, providerId) => {
+  const { hostname: cookieDomain, pathname, protocol } = authUrl;
+  const secure = protocol === "https:";
+  const cookiePath = pathname.endsWith(`${providerId}/handler/frame`) ? pathname.slice(0, -"/handler/frame".length) : `${pathname}/${providerId}`;
+  return {
+    cookieDomain,
+    cookiePath,
+    secure
+  };
+};
 
 class OAuthEnvironmentHandler {
   constructor(handlers) {
@@ -245,6 +255,10 @@ function parseJwtPayload(token) {
 }
 function prepareBackstageIdentityResponse(result) {
   const { sub, ent } = parseJwtPayload(result.token);
+  const userEntityRef = catalogModel.stringifyEntityRef(catalogModel.parseEntityRef(sub, {
+    defaultKind: "user",
+    defaultNamespace: catalogModel.ENTITY_DEFAULT_NAMESPACE
+  }));
   return {
     ...{
       idToken: result.token,
@@ -252,7 +266,7 @@ function prepareBackstageIdentityResponse(result) {
     },
     identity: {
       type: "user",
-      userEntityRef: sub,
+      userEntityRef,
       ownershipEntityRefs: ent != null ? ent : []
     }
   };
@@ -267,56 +281,48 @@ class OAuthAdapter {
     this.setNonceCookie = (res, nonce) => {
       res.cookie(`${this.options.providerId}-nonce`, nonce, {
         maxAge: TEN_MINUTES_MS,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: `${this.options.cookiePath}/handler`,
-        httpOnly: true
+        ...this.baseCookieOptions,
+        path: `${this.options.cookiePath}/handler`
       });
     };
-    this.setScopesCookie = (res, scope) => {
-      res.cookie(`${this.options.providerId}-scope`, scope, {
-        maxAge: TEN_MINUTES_MS,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: `${this.options.cookiePath}/handler`,
-        httpOnly: true
+    this.setGrantedScopeCookie = (res, scope) => {
+      res.cookie(`${this.options.providerId}-granted-scope`, scope, {
+        maxAge: THOUSAND_DAYS_MS,
+        ...this.baseCookieOptions
       });
     };
-    this.getScopesFromCookie = (req, providerId) => {
-      return req.cookies[`${providerId}-scope`];
+    this.getGrantedScopeFromCookie = (req) => {
+      return req.cookies[`${this.options.providerId}-granted-scope`];
     };
     this.setRefreshTokenCookie = (res, refreshToken) => {
       res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
         maxAge: THOUSAND_DAYS_MS,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: this.options.cookiePath,
-        httpOnly: true
+        ...this.baseCookieOptions
       });
     };
     this.removeRefreshTokenCookie = (res) => {
       res.cookie(`${this.options.providerId}-refresh-token`, "", {
         maxAge: 0,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: this.options.cookiePath,
-        httpOnly: true
+        ...this.baseCookieOptions
       });
     };
+    this.baseCookieOptions = {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: this.options.secure,
+      path: this.options.cookiePath,
+      domain: this.options.cookieDomain
+    };
   }
   static fromConfig(config, handlers, options) {
+    var _a;
     const { origin: appOrigin } = new url.URL(config.appUrl);
-    const secure = config.baseUrl.startsWith("https://");
-    const url$1 = new url.URL(config.baseUrl);
-    const cookiePath = `${url$1.pathname}/${options.providerId}`;
+    const authUrl = new url.URL((_a = options.callbackUrl) != null ? _a : config.baseUrl);
+    const { cookieDomain, cookiePath, secure } = getCookieConfig(authUrl, options.providerId);
     return new OAuthAdapter(handlers, {
       ...options,
       appOrigin,
-      cookieDomain: url$1.hostname,
+      cookieDomain,
       cookiePath,
       secure,
       isOriginAllowed: config.isOriginAllowed
@@ -330,12 +336,12 @@ class OAuthAdapter {
     if (!env) {
       throw new errors.InputError("No env provided in request query parameters");
     }
-    if (this.options.persistScopes) {
-      this.setScopesCookie(res, scope);
-    }
     const nonce = crypto__default["default"].randomBytes(16).toString("base64");
     this.setNonceCookie(res, nonce);
     const state = { nonce, env, origin };
+    if (this.options.persistScopes) {
+      state.scope = scope;
+    }
     const forwardReq = Object.assign(req, { scope, state });
     const { url, status } = await this.handlers.start(forwardReq);
     res.statusCode = status || 302;
@@ -360,9 +366,9 @@ class OAuthAdapter {
       }
       verifyNonce(req, this.options.providerId);
       const { response, refreshToken } = await this.handlers.handler(req);
-      if (this.options.persistScopes) {
-        const grantedScopes = this.getScopesFromCookie(req, this.options.providerId);
-        response.providerInfo.scope = grantedScopes;
+      if (this.options.persistScopes && state.scope) {
+        this.setGrantedScopeCookie(res, state.scope);
+        response.providerInfo.scope = state.scope;
       }
       if (refreshToken && !this.options.disableRefresh) {
         this.setRefreshTokenCookie(res, refreshToken);
@@ -400,7 +406,10 @@ class OAuthAdapter {
       if (!refreshToken) {
         throw new errors.InputError("Missing session cookie");
       }
-      const scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
+      let scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
+      if (this.options.persistScopes) {
+        scope = this.getGrantedScopeFromCookie(req);
+      }
       const forwardReq = Object.assign(req, { scope, refreshToken });
       const { response, refreshToken: newRefreshToken } = await this.handlers.refresh(forwardReq);
       const backstageIdentity = await this.populateIdentity(response.backstageIdentity);
@@ -546,7 +555,7 @@ const executeFetchUserProfileStrategy = async (providerStrategy, accessToken) =>
 class CatalogIdentityClient {
   constructor(options) {
     this.catalogApi = options.catalogApi;
-    this.tokenIssuer = options.tokenIssuer;
+    this.tokenManager = options.tokenManager;
   }
   async findUser(query) {
     const filter = {
@@ -555,9 +564,7 @@ class CatalogIdentityClient {
     for (const [key, value] of Object.entries(query.annotations)) {
       filter[`metadata.annotations.${key}`] = value;
     }
-    const token = await this.tokenIssuer.issueToken({
-      claims: { sub: "backstage.io/auth-backend" }
-    });
+    const { token } = await this.tokenManager.getToken();
     const { items } = await this.catalogApi.getEntities({ filter }, { token });
     if (items.length !== 1) {
       if (items.length > 1) {
@@ -587,7 +594,8 @@ class CatalogIdentityClient {
       "metadata.namespace": ref.namespace,
       "metadata.name": ref.name
     }));
-    const entities = await this.catalogApi.getEntities({ filter }).then((r) => r.items);
+    const { token } = await this.tokenManager.getToken();
+    const entities = await this.catalogApi.getEntities({ filter }, { token }).then((r) => r.items);
     if (entityRefs.length !== entities.length) {
       const foundEntityNames = entities.map(catalogModel.stringifyEntityRef);
       const missingEntityNames = resolvedEntityRefs.map(catalogModel.stringifyEntityRef).filter((s) => !foundEntityNames.includes(s));
@@ -697,6 +705,7 @@ const createAtlassianProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -707,7 +716,7 @@ const createAtlassianProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (_a = options == null ? void 0 : options.authHandler) != null ? _a : atlassianDefaultAuthHandler;
     const provider = new AtlassianAuthProvider({
@@ -832,6 +841,7 @@ const createAuth0Provider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -842,7 +852,7 @@ const createAuth0Provider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -970,7 +980,7 @@ class AwsAlbAuthProvider {
   }
 }
 const createAwsAlbProvider = (options) => {
-  return ({ config, tokenIssuer, catalogApi, logger }) => {
+  return ({ config, tokenIssuer, catalogApi, logger, tokenManager }) => {
     const region = config.getString("region");
     const issuer = config.getOptionalString("iss");
     if ((options == null ? void 0 : options.signIn.resolver) === void 0) {
@@ -978,7 +988,7 @@ const createAwsAlbProvider = (options) => {
     }
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
       profile: makeProfileInfo(fullProfile)
@@ -1106,6 +1116,7 @@ const createBitbucketProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1115,7 +1126,7 @@ const createBitbucketProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -1138,6 +1149,8 @@ const createBitbucketProvider = (options) => {
   });
 };
 
+const ACCESS_TOKEN_PREFIX = "access-token.";
+const BACKSTAGE_SESSION_EXPIRATION = 3600;
 class GithubAuthProvider {
   constructor(options) {
     this.signInResolver = options.signInResolver;
@@ -1165,21 +1178,43 @@ class GithubAuthProvider {
   }
   async handler(req) {
     const { result, privateInfo } = await executeFrameHandlerStrategy(req, this._strategy);
+    let refreshToken = privateInfo.refreshToken;
+    if (!refreshToken && !result.params.expires_in) {
+      refreshToken = ACCESS_TOKEN_PREFIX + result.accessToken;
+    }
     return {
       response: await this.handleResult(result),
-      refreshToken: privateInfo.refreshToken
+      refreshToken
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { scope, refreshToken } = req;
+    if (refreshToken == null ? void 0 : refreshToken.startsWith(ACCESS_TOKEN_PREFIX)) {
+      const accessToken = refreshToken.slice(ACCESS_TOKEN_PREFIX.length);
+      const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken).catch((error) => {
+        var _a;
+        if (((_a = error.oauthError) == null ? void 0 : _a.statusCode) === 401) {
+          throw new Error("Invalid access token");
+        }
+        throw error;
+      });
+      return {
+        response: await this.handleResult({
+          fullProfile,
+          params: { scope },
+          accessToken
+        }),
+        refreshToken
+      };
+    }
+    const result = await executeRefreshTokenStrategy(this._strategy, refreshToken, scope);
     return {
       response: await this.handleResult({
-        fullProfile,
-        params,
-        accessToken
+        fullProfile: await executeFetchUserProfileStrategy(this._strategy, result.accessToken),
+        params: { ...result.params, scope },
+        accessToken: result.accessToken
       }),
-      refreshToken
+      refreshToken: result.refreshToken
     };
   }
   async handleResult(result) {
@@ -1190,28 +1225,38 @@ class GithubAuthProvider {
     };
     const { profile } = await this.authHandler(result, context);
     const expiresInStr = result.params.expires_in;
-    const response = {
+    let expiresInSeconds = expiresInStr === void 0 ? void 0 : Number(expiresInStr);
+    let backstageIdentity = void 0;
+    if (this.signInResolver) {
+      backstageIdentity = await this.signInResolver({
+        result,
+        profile
+      }, context);
+      if (expiresInSeconds) {
+        expiresInSeconds = Math.min(expiresInSeconds, BACKSTAGE_SESSION_EXPIRATION);
+      } else {
+        expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION;
+      }
+    }
+    return {
+      backstageIdentity,
       providerInfo: {
         accessToken: result.accessToken,
         scope: result.params.scope,
-        expiresInSeconds: expiresInStr === void 0 ? void 0 : Number(expiresInStr)
+        expiresInSeconds
       },
       profile
     };
-    if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, context);
-    }
-    return response;
   }
 }
 const githubDefaultSignInResolver = async (info, ctx) => {
   const { fullProfile } = info.result;
   const userId = fullProfile.username || fullProfile.id;
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`]
+    }
   });
   return { id: userId, token };
 };
@@ -1221,6 +1266,7 @@ const createGithubProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1235,7 +1281,7 @@ const createGithubProvider = (options) => {
     const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
       profile: makeProfileInfo(fullProfile)
@@ -1266,7 +1312,8 @@ const createGithubProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       persistScopes: true,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1278,7 +1325,7 @@ const gitlabDefaultSignInResolver = async (info, ctx) => {
     id = profile.email.split("@")[0];
   }
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: id, ent: [`user:default/${id}`] }
+    claims: { sub: `user:default/${id}`, ent: [`user:default/${id}`] }
   });
   return { id, token };
 };
@@ -1362,6 +1409,7 @@ const createGitlabProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1373,7 +1421,7 @@ const createGitlabProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (_a = options == null ? void 0 : options.authHandler) != null ? _a : gitlabDefaultAuthHandler;
     const signInResolverFn = (_c = (_b = options == null ? void 0 : options.signIn) == null ? void 0 : _b.resolver) != null ? _c : gitlabDefaultSignInResolver;
@@ -1508,7 +1556,7 @@ const googleDefaultSignInResolver = async (info, ctx) => {
     userId = profile.email.split("@")[0];
   }
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }
   });
   return { id: userId, token };
 };
@@ -1518,6 +1566,7 @@ const createGoogleProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1527,7 +1576,7 @@ const createGoogleProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -1662,7 +1711,10 @@ const microsoftDefaultSignInResolver = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`]
+    }
   });
   return { id: userId, token };
 };
@@ -1672,6 +1724,7 @@ const createMicrosoftProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1684,7 +1737,7 @@ const createMicrosoftProvider = (options) => {
     const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -1807,7 +1860,7 @@ const oAuth2DefaultSignInResolver$1 = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }
   });
   return { id: userId, token };
 };
@@ -1817,6 +1870,7 @@ const createOAuth2Provider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1831,7 +1885,7 @@ const createOAuth2Provider = (options) => {
     const disableRefresh = (_a = envConfig.getOptionalBoolean("disableRefresh")) != null ? _a : false;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -2262,12 +2316,12 @@ class Oauth2ProxyAuthProvider {
     };
   }
 }
-const createOauth2ProxyProvider = (options) => ({ catalogApi, logger, tokenIssuer }) => {
+const createOauth2ProxyProvider = (options) => ({ catalogApi, logger, tokenIssuer, tokenManager }) => {
   const signInResolver = options.signIn.resolver;
   const authHandler = options.authHandler;
   const catalogIdentityClient = new CatalogIdentityClient({
     catalogApi,
-    tokenIssuer
+    tokenManager
   });
   return new Oauth2ProxyAuthProvider({
     logger,
@@ -2378,7 +2432,10 @@ const oAuth2DefaultSignInResolver = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`]
+    }
   });
   return { id: userId, token };
 };
@@ -2388,6 +2445,7 @@ const createOidcProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -2401,7 +2459,7 @@ const createOidcProvider = (options) => {
     const prompt = envConfig.getOptionalString("prompt");
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ userinfo }) => ({
       profile: {
@@ -2545,7 +2603,7 @@ const oktaDefaultSignInResolver = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }
   });
   return { id: userId, token };
 };
@@ -2555,6 +2613,7 @@ const createOktaProvider = (_options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -2568,7 +2627,7 @@ const createOktaProvider = (_options) => {
     }
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (_options == null ? void 0 : _options.authHandler) ? _options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -2688,6 +2747,7 @@ const createOneLoginProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -2698,7 +2758,7 @@ const createOneLoginProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -2788,13 +2848,14 @@ const createSamlProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => {
     var _a, _b;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
       profile: {
@@ -2902,7 +2963,7 @@ class GcpIapProvider {
   }
 }
 function createGcpIapProvider(options) {
-  return ({ config, tokenIssuer, catalogApi, logger }) => {
+  return ({ config, tokenIssuer, catalogApi, logger, tokenManager }) => {
     var _a;
     const audience = config.getString("audience");
     const authHandler = (_a = options.authHandler) != null ? _a : defaultAuthHandler;
@@ -2910,7 +2971,7 @@ function createGcpIapProvider(options) {
     const tokenValidator = createTokenValidator(audience);
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     return new GcpIapProvider({
       authHandler,
@@ -2940,7 +3001,14 @@ const factories = {
 };
 
 async function createRouter(options) {
-  const { logger, config, discovery, database, providerFactories } = options;
+  const {
+    logger,
+    config,
+    discovery,
+    database,
+    tokenManager,
+    providerFactories
+  } = options;
   const router = Router__default["default"]();
   const appUrl = config.getString("app.baseUrl");
   const authUrl = await discovery.getExternalBaseUrl("auth");
@@ -2986,6 +3054,7 @@ async function createRouter(options) {
           globalConfig: { baseUrl: authUrl, appUrl, isOriginAllowed },
           config: providersConfig.getConfig(providerId),
           logger,
+          tokenManager,
           tokenIssuer,
           discovery,
           catalogApi