@backstage/plugin-auth-node 0.2.0 → 0.2.1-next.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/dist/index.cjs.js +30 -44
- package/dist/index.cjs.js.map +1 -1
- package/dist/index.d.ts +2 -11
- package/package.json +6 -5
package/CHANGELOG.md
CHANGED
package/dist/index.cjs.js
CHANGED
|
@@ -4,11 +4,6 @@ Object.defineProperty(exports, '__esModule', { value: true });
|
|
|
4
4
|
|
|
5
5
|
var errors = require('@backstage/errors');
|
|
6
6
|
var jose = require('jose');
|
|
7
|
-
var fetch = require('node-fetch');
|
|
8
|
-
|
|
9
|
-
function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
|
|
10
|
-
|
|
11
|
-
var fetch__default = /*#__PURE__*/_interopDefaultLegacy(fetch);
|
|
12
7
|
|
|
13
8
|
function getBearerTokenFromAuthorizationHeader(authorizationHeader) {
|
|
14
9
|
if (typeof authorizationHeader !== "string") {
|
|
@@ -20,71 +15,62 @@ function getBearerTokenFromAuthorizationHeader(authorizationHeader) {
|
|
|
20
15
|
|
|
21
16
|
const CLOCK_MARGIN_S = 10;
|
|
22
17
|
class IdentityClient {
|
|
23
|
-
static create(options) {
|
|
24
|
-
return new IdentityClient(options);
|
|
25
|
-
}
|
|
26
18
|
constructor(options) {
|
|
19
|
+
this.keyStoreUpdated = 0;
|
|
27
20
|
this.discovery = options.discovery;
|
|
28
21
|
this.issuer = options.issuer;
|
|
29
|
-
|
|
30
|
-
|
|
22
|
+
}
|
|
23
|
+
static create(options) {
|
|
24
|
+
return new IdentityClient(options);
|
|
31
25
|
}
|
|
32
26
|
async authenticate(token) {
|
|
33
|
-
var _a;
|
|
34
27
|
if (!token) {
|
|
35
28
|
throw new errors.AuthenticationError("No token specified");
|
|
36
29
|
}
|
|
37
|
-
|
|
38
|
-
if (!
|
|
39
|
-
throw new errors.AuthenticationError("No
|
|
30
|
+
await this.refreshKeyStore(token);
|
|
31
|
+
if (!this.keyStore) {
|
|
32
|
+
throw new errors.AuthenticationError("No keystore exists");
|
|
40
33
|
}
|
|
41
|
-
const decoded = jose.
|
|
34
|
+
const decoded = await jose.jwtVerify(token, this.keyStore, {
|
|
42
35
|
algorithms: ["ES256"],
|
|
43
36
|
audience: "backstage",
|
|
44
37
|
issuer: this.issuer
|
|
45
38
|
});
|
|
46
|
-
if (!decoded.sub) {
|
|
39
|
+
if (!decoded.payload.sub) {
|
|
47
40
|
throw new errors.AuthenticationError("No user sub found in token");
|
|
48
41
|
}
|
|
49
42
|
const user = {
|
|
50
43
|
token,
|
|
51
44
|
identity: {
|
|
52
45
|
type: "user",
|
|
53
|
-
userEntityRef: decoded.sub,
|
|
54
|
-
ownershipEntityRefs:
|
|
46
|
+
userEntityRef: decoded.payload.sub,
|
|
47
|
+
ownershipEntityRefs: decoded.payload.ent ? decoded.payload.ent : []
|
|
55
48
|
}
|
|
56
49
|
};
|
|
57
50
|
return user;
|
|
58
51
|
}
|
|
59
|
-
async
|
|
60
|
-
const
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
52
|
+
async refreshKeyStore(rawJwtToken) {
|
|
53
|
+
const payload = await jose.decodeJwt(rawJwtToken);
|
|
54
|
+
const header = await jose.decodeProtectedHeader(rawJwtToken);
|
|
55
|
+
let keyStoreHasKey;
|
|
56
|
+
try {
|
|
57
|
+
if (this.keyStore) {
|
|
58
|
+
const [_, rawPayload, rawSignature] = rawJwtToken.split(".");
|
|
59
|
+
keyStoreHasKey = await this.keyStore(header, {
|
|
60
|
+
payload: rawPayload,
|
|
61
|
+
signature: rawSignature
|
|
62
|
+
});
|
|
63
|
+
}
|
|
64
|
+
} catch (error) {
|
|
65
|
+
keyStoreHasKey = false;
|
|
66
|
+
}
|
|
64
67
|
const issuedAfterLastRefresh = (payload == null ? void 0 : payload.iat) && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;
|
|
65
68
|
if (!keyStoreHasKey && issuedAfterLastRefresh) {
|
|
66
|
-
await this.
|
|
69
|
+
const url = await this.discovery.getBaseUrl("auth");
|
|
70
|
+
const endpoint = new URL(`${url}/.well-known/jwks.json`);
|
|
71
|
+
this.keyStore = jose.createRemoteJWKSet(endpoint);
|
|
72
|
+
this.keyStoreUpdated = Date.now() / 1e3;
|
|
67
73
|
}
|
|
68
|
-
return this.keyStore.get({ kid: header.kid });
|
|
69
|
-
}
|
|
70
|
-
async listPublicKeys() {
|
|
71
|
-
const url = `${await this.discovery.getBaseUrl("auth")}/.well-known/jwks.json`;
|
|
72
|
-
const response = await fetch__default["default"](url);
|
|
73
|
-
if (!response.ok) {
|
|
74
|
-
const payload = await response.text();
|
|
75
|
-
const message = `Request failed with ${response.status} ${response.statusText}, ${payload}`;
|
|
76
|
-
throw new Error(message);
|
|
77
|
-
}
|
|
78
|
-
const publicKeys = await response.json();
|
|
79
|
-
return publicKeys;
|
|
80
|
-
}
|
|
81
|
-
async refreshKeyStore() {
|
|
82
|
-
const now = Date.now() / 1e3;
|
|
83
|
-
const publicKeys = await this.listPublicKeys();
|
|
84
|
-
this.keyStore = jose.JWKS.asKeyStore({
|
|
85
|
-
keys: publicKeys.keys.map((key) => key)
|
|
86
|
-
});
|
|
87
|
-
this.keyStoreUpdated = now;
|
|
88
74
|
}
|
|
89
75
|
}
|
|
90
76
|
|
package/dist/index.cjs.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.cjs.js","sources":["../src/getBearerTokenFromAuthorizationHeader.ts","../src/IdentityClient.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Parses the given authorization header and returns the bearer token, or\n * undefined if no bearer token is given.\n *\n * @remarks\n *\n * This function is explicitly built to tolerate bad inputs safely, so you may\n * call it directly with e.g. the output of `req.header('authorization')`\n * without first checking that it exists.\n *\n * @public\n */\nexport function getBearerTokenFromAuthorizationHeader(\n authorizationHeader: unknown,\n): string | undefined {\n if (typeof authorizationHeader !== 'string') {\n return undefined;\n }\n const matches = authorizationHeader.match(/^Bearer[ ]+(\\S+)$/i);\n return matches?.[1];\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport { AuthenticationError } from '@backstage/errors';\nimport {
|
|
1
|
+
{"version":3,"file":"index.cjs.js","sources":["../src/getBearerTokenFromAuthorizationHeader.ts","../src/IdentityClient.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Parses the given authorization header and returns the bearer token, or\n * undefined if no bearer token is given.\n *\n * @remarks\n *\n * This function is explicitly built to tolerate bad inputs safely, so you may\n * call it directly with e.g. the output of `req.header('authorization')`\n * without first checking that it exists.\n *\n * @public\n */\nexport function getBearerTokenFromAuthorizationHeader(\n authorizationHeader: unknown,\n): string | undefined {\n if (typeof authorizationHeader !== 'string') {\n return undefined;\n }\n const matches = authorizationHeader.match(/^Bearer[ ]+(\\S+)$/i);\n return matches?.[1];\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport { AuthenticationError } from '@backstage/errors';\nimport {\n createRemoteJWKSet,\n decodeJwt,\n jwtVerify,\n FlattenedJWSInput,\n JWSHeaderParameters,\n decodeProtectedHeader,\n} from 'jose';\nimport { GetKeyFunction } from 'jose/dist/types/types';\nimport { BackstageIdentityResponse } from './types';\n\nconst CLOCK_MARGIN_S = 10;\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport class IdentityClient {\n private readonly discovery: PluginEndpointDiscovery;\n private readonly issuer: string;\n private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;\n private keyStoreUpdated: number = 0;\n\n /**\n * Create a new {@link IdentityClient} instance.\n */\n static create(options: {\n discovery: PluginEndpointDiscovery;\n issuer: string;\n }): IdentityClient {\n return new IdentityClient(options);\n }\n\n private constructor(options: {\n discovery: PluginEndpointDiscovery;\n issuer: string;\n }) {\n this.discovery = options.discovery;\n this.issuer = options.issuer;\n }\n\n /**\n * Verifies the given backstage identity token\n * Returns a BackstageIdentity (user) matching the token.\n * The method throws an error if verification fails.\n */\n async authenticate(\n token: string | undefined,\n ): Promise<BackstageIdentityResponse> {\n // Extract token from header\n if (!token) {\n throw new AuthenticationError('No token specified');\n }\n\n // Verify token claims and signature\n // Note: Claims must match those set by TokenFactory when issuing tokens\n // Note: verify throws if verification fails\n // Check if the keystore needs to be updated\n await this.refreshKeyStore(token);\n if (!this.keyStore) {\n throw new AuthenticationError('No keystore exists');\n }\n const decoded = await jwtVerify(token, this.keyStore, {\n algorithms: ['ES256'],\n audience: 'backstage',\n issuer: this.issuer,\n });\n // Verified, return the matching user as BackstageIdentity\n // TODO: Settle internal user format/properties\n if (!decoded.payload.sub) {\n throw new AuthenticationError('No user sub found in token');\n }\n\n const user: BackstageIdentityResponse = {\n token,\n identity: {\n type: 'user',\n userEntityRef: decoded.payload.sub,\n ownershipEntityRefs: decoded.payload.ent\n ? (decoded.payload.ent as string[])\n : [],\n },\n };\n return user;\n }\n\n /**\n * If the last keystore refresh is stale, update the keystore URL to the latest\n */\n private async refreshKeyStore(rawJwtToken: string): Promise<void> {\n const payload = await decodeJwt(rawJwtToken);\n const header = await decodeProtectedHeader(rawJwtToken);\n\n // Refresh public keys if needed\n let keyStoreHasKey;\n try {\n if (this.keyStore) {\n // Check if the key is present in the keystore\n const [_, rawPayload, rawSignature] = rawJwtToken.split('.');\n keyStoreHasKey = await this.keyStore(header, {\n payload: rawPayload,\n signature: rawSignature,\n });\n }\n } catch (error) {\n keyStoreHasKey = false;\n }\n // Refresh public key URL if needed\n // Add a small margin in case clocks are out of sync\n const issuedAfterLastRefresh =\n payload?.iat && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;\n if (!keyStoreHasKey && issuedAfterLastRefresh) {\n const url = await this.discovery.getBaseUrl('auth');\n const endpoint = new URL(`${url}/.well-known/jwks.json`);\n this.keyStore = createRemoteJWKSet(endpoint);\n this.keyStoreUpdated = Date.now() / 1000;\n }\n }\n}\n"],"names":["AuthenticationError","jwtVerify","decodeJwt","decodeProtectedHeader","createRemoteJWKSet"],"mappings":";;;;;;;AAAO,SAAS,qCAAqC,CAAC,mBAAmB,EAAE;AAC3E,EAAE,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE;AAC/C,IAAI,OAAO,KAAK,CAAC,CAAC;AAClB,GAAG;AACH,EAAE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAClE,EAAE,OAAO,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/C;;ACCA,MAAM,cAAc,GAAG,EAAE,CAAC;AACnB,MAAM,cAAc,CAAC;AAC5B,EAAE,WAAW,CAAC,OAAO,EAAE;AACvB,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;AAC7B,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AACvC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACjC,GAAG;AACH,EAAE,OAAO,MAAM,CAAC,OAAO,EAAE;AACzB,IAAI,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACvC,GAAG;AACH,EAAE,MAAM,YAAY,CAAC,KAAK,EAAE;AAC5B,IAAI,IAAI,CAAC,KAAK,EAAE;AAChB,MAAM,MAAM,IAAIA,0BAAmB,CAAC,oBAAoB,CAAC,CAAC;AAC1D,KAAK;AACL,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACtC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;AACxB,MAAM,MAAM,IAAIA,0BAAmB,CAAC,oBAAoB,CAAC,CAAC;AAC1D,KAAK;AACL,IAAI,MAAM,OAAO,GAAG,MAAMC,cAAS,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;AAC1D,MAAM,UAAU,EAAE,CAAC,OAAO,CAAC;AAC3B,MAAM,QAAQ,EAAE,WAAW;AAC3B,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM;AACzB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;AAC9B,MAAM,MAAM,IAAID,0BAAmB,CAAC,4BAA4B,CAAC,CAAC;AAClE,KAAK;AACL,IAAI,MAAM,IAAI,GAAG;AACjB,MAAM,KAAK;AACX,MAAM,QAAQ,EAAE;AAChB,QAAQ,IAAI,EAAE,MAAM;AACpB,QAAQ,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;AAC1C,QAAQ,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE;AAC3E,OAAO;AACP,KAAK,CAAC;AACN,IAAI,OAAO,IAAI,CAAC;AAChB,GAAG;AACH,EAAE,MAAM,eAAe,CAAC,WAAW,EAAE;AACrC,IAAI,MAAM,OAAO,GAAG,MAAME,cAAS,CAAC,WAAW,CAAC,CAAC;AACjD,IAAI,MAAM,MAAM,GAAG,MAAMC,0BAAqB,CAAC,WAAW,CAAC,CAAC;AAC5D,IAAI,IAAI,cAAc,CAAC;AACvB,IAAI,IAAI;AACR,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE;AACzB,QAAQ,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrE,QAAQ,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;AACrD,UAAU,OAAO,EAAE,UAAU;AAC7B,UAAU,SAAS,EAAE,YAAY;AACjC,SAAS,CAAC,CAAC;AACX,OAAO;AACP,KAAK,CAAC,OAAO,KAAK,EAAE;AACpB,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,KAAK;AACL,IAAI,MAAM,sBAAsB,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;AACnI,IAAI,IAAI,CAAC,cAAc,IAAI,sBAAsB,EAAE;AACnD,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC/D,MAAM,IAAI,CAAC,QAAQ,GAAGC,uBAAkB,CAAC,QAAQ,CAAC,CAAC;AACnD,MAAM,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;AAC9C,KAAK;AACL,GAAG;AACH;;;;;"}
|
package/dist/index.d.ts
CHANGED
|
@@ -72,7 +72,7 @@ declare type BackstageUserIdentity = {
|
|
|
72
72
|
declare class IdentityClient {
|
|
73
73
|
private readonly discovery;
|
|
74
74
|
private readonly issuer;
|
|
75
|
-
private keyStore
|
|
75
|
+
private keyStore?;
|
|
76
76
|
private keyStoreUpdated;
|
|
77
77
|
/**
|
|
78
78
|
* Create a new {@link IdentityClient} instance.
|
|
@@ -89,16 +89,7 @@ declare class IdentityClient {
|
|
|
89
89
|
*/
|
|
90
90
|
authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
|
|
91
91
|
/**
|
|
92
|
-
*
|
|
93
|
-
* or null if no matching key was found
|
|
94
|
-
*/
|
|
95
|
-
private getKey;
|
|
96
|
-
/**
|
|
97
|
-
* Lists public part of keys used to sign Backstage Identity tokens
|
|
98
|
-
*/
|
|
99
|
-
private listPublicKeys;
|
|
100
|
-
/**
|
|
101
|
-
* Fetches public keys and caches them locally
|
|
92
|
+
* If the last keystore refresh is stale, update the keystore URL to the latest
|
|
102
93
|
*/
|
|
103
94
|
private refreshKeyStore;
|
|
104
95
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@backstage/plugin-auth-node",
|
|
3
|
-
"version": "0.2.0",
|
|
3
|
+
"version": "0.2.1-next.0",
|
|
4
4
|
"main": "dist/index.cjs.js",
|
|
5
5
|
"types": "dist/index.d.ts",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -23,20 +23,21 @@
|
|
|
23
23
|
"start": "backstage-cli package start"
|
|
24
24
|
},
|
|
25
25
|
"dependencies": {
|
|
26
|
-
"@backstage/backend-common": "^0.13.
|
|
26
|
+
"@backstage/backend-common": "^0.13.3-next.0",
|
|
27
27
|
"@backstage/config": "^1.0.0",
|
|
28
28
|
"@backstage/errors": "^1.0.0",
|
|
29
|
-
"jose": "^
|
|
29
|
+
"jose": "^4.6.0",
|
|
30
30
|
"node-fetch": "^2.6.7",
|
|
31
31
|
"winston": "^3.2.1"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
|
-
"@backstage/cli": "^0.17.0",
|
|
34
|
+
"@backstage/cli": "^0.17.1-next.0",
|
|
35
|
+
"lodash": "^4.17.21",
|
|
35
36
|
"msw": "^0.35.0",
|
|
36
37
|
"uuid": "^8.0.0"
|
|
37
38
|
},
|
|
38
39
|
"files": [
|
|
39
40
|
"dist"
|
|
40
41
|
],
|
|
41
|
-
"gitHead": "
|
|
42
|
+
"gitHead": "88ee375f5ee44b7a7917297785ddf88691fe3381"
|
|
42
43
|
}
|