@backstage/plugin-auth-backend 0.9.0-next.1 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @backstage/plugin-auth-backend
 
+## 0.9.0
+
+### Minor Changes
+
+- cef64b1561: **BREAKING** Added `tokenManager` as a required property for the auth-backend `createRouter` function. This dependency is used to issue server tokens that are used by the `CatalogIdentityClient` when looking up users and their group membership during authentication.
+
+  These changes are **required** to `packages/backend/src/plugins/auth.ts`:
+
+  ```diff
+  export default async function createPlugin({
+    logger,
+    database,
+    config,
+    discovery,
+  + tokenManager,
+  }: PluginEnvironment): Promise<Router> {
+    return await createRouter({
+      logger,
+      config,
+      database,
+      discovery,
+  +   tokenManager,
+    });
+  }
+  ```
+
+  **BREAKING** The `CatalogIdentityClient` constructor now expects a `TokenManager` instead of a `TokenIssuer`. The `TokenManager` interface is used to generate a server token when [resolving a user's identity and membership through the catalog](https://backstage.io/docs/auth/identity-resolver). Using server tokens for these requests allows the auth-backend to bypass authorization checks when permissions are enabled for Backstage. This change will break apps that rely on the user tokens that were previously used by the client. Refer to the ["Backend-to-backend Authentication" tutorial](https://backstage.io/docs/tutorials/backend-to-backend-auth) for more information on server token usage.
+
+### Patch Changes
+
+- 9d75a939b6: Fixed a bug where providers that tracked the granted scopes through a cookie would not take failed authentication attempts into account.
+- 28a5f9d0b1: chore(deps): bump `passport` from 0.4.1 to 0.5.2
+- 5d09bdd1de: Added custom `callbackUrl` support for multiple providers. `v0.8.0` introduced this change for `github`, and now we're adding the same capability to the following providers: `atlassian, auth0, bitbucket, gitlab, google, microsoft, oauth2, oidc, okta, onelogin`.
+- 648606b3ac: Added support for storing static GitHub access tokens in cookies and using them to refresh the Backstage session.
+- Updated dependencies
+  - @backstage/backend-common@0.10.6
+
 ## 0.9.0-next.1
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -713,7 +713,8 @@ const createAtlassianProvider = (options) => {
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
     const scopes = envConfig.getString("scopes");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
       tokenManager
@@ -733,7 +734,8 @@ const createAtlassianProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: true,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -849,7 +851,8 @@ const createAuth0Provider = (options) => {
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
     const domain = envConfig.getString("domain");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
       tokenManager
@@ -872,7 +875,8 @@ const createAuth0Provider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: true,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1123,7 +1127,8 @@ const createBitbucketProvider = (options) => {
     var _a;
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
       tokenManager
@@ -1144,7 +1149,8 @@ const createBitbucketProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1418,7 +1424,8 @@ const createGitlabProvider = (options) => {
     const clientSecret = envConfig.getString("clientSecret");
     const audience = envConfig.getOptionalString("audience");
     const baseUrl = audience || "https://gitlab.com";
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
       tokenManager
@@ -1444,7 +1451,8 @@ const createGitlabProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1573,7 +1581,8 @@ const createGoogleProvider = (options) => {
     var _a, _b;
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
       tokenManager
@@ -1600,7 +1609,8 @@ const createGoogleProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1732,7 +1742,8 @@ const createMicrosoftProvider = (options) => {
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
     const tenantId = envConfig.getString("tenantId");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
     const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
     const catalogIdentityClient = new CatalogIdentityClient({
@@ -1763,7 +1774,8 @@ const createMicrosoftProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1877,7 +1889,8 @@ const createOAuth2Provider = (options) => {
     var _a, _b, _c;
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const authorizationUrl = envConfig.getString("authorizationUrl");
     const tokenUrl = envConfig.getString("tokenUrl");
     const scope = envConfig.getOptionalString("scope");
@@ -1913,7 +1926,8 @@ const createOAuth2Provider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -2452,7 +2466,8 @@ const createOidcProvider = (options) => {
     var _a, _b;
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const metadataUrl = envConfig.getString("metadataUrl");
     const tokenSignedResponseAlg = envConfig.getOptionalString("tokenSignedResponseAlg");
     const scope = envConfig.getOptionalString("scope");
@@ -2491,7 +2506,8 @@ const createOidcProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -2621,7 +2637,8 @@ const createOktaProvider = (_options) => {
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
     const audience = envConfig.getString("audience");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     if (!audience.startsWith("https://")) {
       throw new Error("URL for 'audience' must start with 'https://'.");
     }
@@ -2652,7 +2669,8 @@ const createOktaProvider = (_options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -2755,7 +2773,8 @@ const createOneLoginProvider = (options) => {
     const clientId = envConfig.getString("clientId");
     const clientSecret = envConfig.getString("clientSecret");
     const issuer = envConfig.getString("issuer");
-    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
+    const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
       tokenManager
@@ -2778,7 +2797,8 @@ const createOneLoginProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       disableRefresh: false,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };