@backstage/plugin-auth-node 0.2.1-next.0 → 0.2.2-next.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -0
- package/dist/index.cjs.js +3 -1
- package/dist/index.cjs.js.map +1 -1
- package/dist/index.d.ts +16 -5
- package/package.json +5 -5
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,30 @@
|
|
|
1
1
|
# @backstage/plugin-auth-node
|
|
2
2
|
|
|
3
|
+
## 0.2.2-next.0
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 9079a78078: Added configurable algorithms array for IdentityClient
|
|
8
|
+
- Updated dependencies
|
|
9
|
+
- @backstage/backend-common@0.13.6-next.0
|
|
10
|
+
|
|
11
|
+
## 0.2.1
|
|
12
|
+
|
|
13
|
+
### Patch Changes
|
|
14
|
+
|
|
15
|
+
- 9ec4e0613e: Update to `jose` 4.6.0
|
|
16
|
+
- Updated dependencies
|
|
17
|
+
- @backstage/backend-common@0.13.3
|
|
18
|
+
- @backstage/config@1.0.1
|
|
19
|
+
|
|
20
|
+
## 0.2.1-next.1
|
|
21
|
+
|
|
22
|
+
### Patch Changes
|
|
23
|
+
|
|
24
|
+
- Updated dependencies
|
|
25
|
+
- @backstage/backend-common@0.13.3-next.2
|
|
26
|
+
- @backstage/config@1.0.1-next.0
|
|
27
|
+
|
|
3
28
|
## 0.2.1-next.0
|
|
4
29
|
|
|
5
30
|
### Patch Changes
|
package/dist/index.cjs.js
CHANGED
|
@@ -17,8 +17,10 @@ const CLOCK_MARGIN_S = 10;
|
|
|
17
17
|
class IdentityClient {
|
|
18
18
|
constructor(options) {
|
|
19
19
|
this.keyStoreUpdated = 0;
|
|
20
|
+
var _a;
|
|
20
21
|
this.discovery = options.discovery;
|
|
21
22
|
this.issuer = options.issuer;
|
|
23
|
+
this.algorithms = (_a = options.algorithms) != null ? _a : ["ES256"];
|
|
22
24
|
}
|
|
23
25
|
static create(options) {
|
|
24
26
|
return new IdentityClient(options);
|
|
@@ -32,7 +34,7 @@ class IdentityClient {
|
|
|
32
34
|
throw new errors.AuthenticationError("No keystore exists");
|
|
33
35
|
}
|
|
34
36
|
const decoded = await jose.jwtVerify(token, this.keyStore, {
|
|
35
|
-
algorithms:
|
|
37
|
+
algorithms: this.algorithms,
|
|
36
38
|
audience: "backstage",
|
|
37
39
|
issuer: this.issuer
|
|
38
40
|
});
|
package/dist/index.cjs.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.cjs.js","sources":["../src/getBearerTokenFromAuthorizationHeader.ts","../src/IdentityClient.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Parses the given authorization header and returns the bearer token, or\n * undefined if no bearer token is given.\n *\n * @remarks\n *\n * This function is explicitly built to tolerate bad inputs safely, so you may\n * call it directly with e.g. the output of `req.header('authorization')`\n * without first checking that it exists.\n *\n * @public\n */\nexport function getBearerTokenFromAuthorizationHeader(\n authorizationHeader: unknown,\n): string | undefined {\n if (typeof authorizationHeader !== 'string') {\n return undefined;\n }\n const matches = authorizationHeader.match(/^Bearer[ ]+(\\S+)$/i);\n return matches?.[1];\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\
|
|
1
|
+
{"version":3,"file":"index.cjs.js","sources":["../src/getBearerTokenFromAuthorizationHeader.ts","../src/IdentityClient.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Parses the given authorization header and returns the bearer token, or\n * undefined if no bearer token is given.\n *\n * @remarks\n *\n * This function is explicitly built to tolerate bad inputs safely, so you may\n * call it directly with e.g. the output of `req.header('authorization')`\n * without first checking that it exists.\n *\n * @public\n */\nexport function getBearerTokenFromAuthorizationHeader(\n authorizationHeader: unknown,\n): string | undefined {\n if (typeof authorizationHeader !== 'string') {\n return undefined;\n }\n const matches = authorizationHeader.match(/^Bearer[ ]+(\\S+)$/i);\n return matches?.[1];\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport { AuthenticationError } from '@backstage/errors';\nimport {\n createRemoteJWKSet,\n decodeJwt,\n decodeProtectedHeader,\n FlattenedJWSInput,\n JWSHeaderParameters,\n jwtVerify,\n} from 'jose';\nimport { GetKeyFunction } from 'jose/dist/types/types';\n\nimport { BackstageIdentityResponse } from './types';\n\nconst CLOCK_MARGIN_S = 10;\n\n/**\n * An identity client options object which allows extra configurations\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport type IdentityClientOptions = {\n discovery: PluginEndpointDiscovery;\n issuer: string;\n\n /** JWS \"alg\" (Algorithm) Header Parameter values. Defaults to an array containing just ES256.\n * More info on supported algorithms: https://github.com/panva/jose */\n algorithms?: string[];\n};\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport class IdentityClient {\n private readonly discovery: PluginEndpointDiscovery;\n private readonly issuer: string;\n private readonly algorithms: string[];\n private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;\n private keyStoreUpdated: number = 0;\n\n /**\n * Create a new {@link IdentityClient} instance.\n */\n static create(options: IdentityClientOptions): IdentityClient {\n return new IdentityClient(options);\n }\n\n private constructor(options: IdentityClientOptions) {\n this.discovery = options.discovery;\n this.issuer = options.issuer;\n this.algorithms = options.algorithms ?? ['ES256'];\n }\n\n /**\n * Verifies the given backstage identity token\n * Returns a BackstageIdentity (user) matching the token.\n * The method throws an error if verification fails.\n */\n async authenticate(\n token: string | undefined,\n ): Promise<BackstageIdentityResponse> {\n // Extract token from header\n if (!token) {\n throw new AuthenticationError('No token specified');\n }\n\n // Verify token claims and signature\n // Note: Claims must match those set by TokenFactory when issuing tokens\n // Note: verify throws if verification fails\n // Check if the keystore needs to be updated\n await this.refreshKeyStore(token);\n if (!this.keyStore) {\n throw new AuthenticationError('No keystore exists');\n }\n const decoded = await jwtVerify(token, this.keyStore, {\n algorithms: this.algorithms,\n audience: 'backstage',\n issuer: this.issuer,\n });\n // Verified, return the matching user as BackstageIdentity\n // TODO: Settle internal user format/properties\n if (!decoded.payload.sub) {\n throw new AuthenticationError('No user sub found in token');\n }\n\n const user: BackstageIdentityResponse = {\n token,\n identity: {\n type: 'user',\n userEntityRef: decoded.payload.sub,\n ownershipEntityRefs: decoded.payload.ent\n ? (decoded.payload.ent as string[])\n : [],\n },\n };\n return user;\n }\n\n /**\n * If the last keystore refresh is stale, update the keystore URL to the latest\n */\n private async refreshKeyStore(rawJwtToken: string): Promise<void> {\n const payload = await decodeJwt(rawJwtToken);\n const header = await decodeProtectedHeader(rawJwtToken);\n\n // Refresh public keys if needed\n let keyStoreHasKey;\n try {\n if (this.keyStore) {\n // Check if the key is present in the keystore\n const [_, rawPayload, rawSignature] = rawJwtToken.split('.');\n keyStoreHasKey = await this.keyStore(header, {\n payload: rawPayload,\n signature: rawSignature,\n });\n }\n } catch (error) {\n keyStoreHasKey = false;\n }\n // Refresh public key URL if needed\n // Add a small margin in case clocks are out of sync\n const issuedAfterLastRefresh =\n payload?.iat && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;\n if (!keyStoreHasKey && issuedAfterLastRefresh) {\n const url = await this.discovery.getBaseUrl('auth');\n const endpoint = new URL(`${url}/.well-known/jwks.json`);\n this.keyStore = createRemoteJWKSet(endpoint);\n this.keyStoreUpdated = Date.now() / 1000;\n }\n }\n}\n"],"names":["AuthenticationError","jwtVerify","decodeJwt","decodeProtectedHeader","createRemoteJWKSet"],"mappings":";;;;;;;AAAO,SAAS,qCAAqC,CAAC,mBAAmB,EAAE;AAC3E,EAAE,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE;AAC/C,IAAI,OAAO,KAAK,CAAC,CAAC;AAClB,GAAG;AACH,EAAE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAClE,EAAE,OAAO,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/C;;ACCA,MAAM,cAAc,GAAG,EAAE,CAAC;AACnB,MAAM,cAAc,CAAC;AAC5B,EAAE,WAAW,CAAC,OAAO,EAAE;AACvB,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;AAC7B,IAAI,IAAI,EAAE,CAAC;AACX,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AACvC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACjC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACzE,GAAG;AACH,EAAE,OAAO,MAAM,CAAC,OAAO,EAAE;AACzB,IAAI,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACvC,GAAG;AACH,EAAE,MAAM,YAAY,CAAC,KAAK,EAAE;AAC5B,IAAI,IAAI,CAAC,KAAK,EAAE;AAChB,MAAM,MAAM,IAAIA,0BAAmB,CAAC,oBAAoB,CAAC,CAAC;AAC1D,KAAK;AACL,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACtC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;AACxB,MAAM,MAAM,IAAIA,0BAAmB,CAAC,oBAAoB,CAAC,CAAC;AAC1D,KAAK;AACL,IAAI,MAAM,OAAO,GAAG,MAAMC,cAAS,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;AAC1D,MAAM,UAAU,EAAE,IAAI,CAAC,UAAU;AACjC,MAAM,QAAQ,EAAE,WAAW;AAC3B,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM;AACzB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;AAC9B,MAAM,MAAM,IAAID,0BAAmB,CAAC,4BAA4B,CAAC,CAAC;AAClE,KAAK;AACL,IAAI,MAAM,IAAI,GAAG;AACjB,MAAM,KAAK;AACX,MAAM,QAAQ,EAAE;AAChB,QAAQ,IAAI,EAAE,MAAM;AACpB,QAAQ,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;AAC1C,QAAQ,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE;AAC3E,OAAO;AACP,KAAK,CAAC;AACN,IAAI,OAAO,IAAI,CAAC;AAChB,GAAG;AACH,EAAE,MAAM,eAAe,CAAC,WAAW,EAAE;AACrC,IAAI,MAAM,OAAO,GAAG,MAAME,cAAS,CAAC,WAAW,CAAC,CAAC;AACjD,IAAI,MAAM,MAAM,GAAG,MAAMC,0BAAqB,CAAC,WAAW,CAAC,CAAC;AAC5D,IAAI,IAAI,cAAc,CAAC;AACvB,IAAI,IAAI;AACR,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE;AACzB,QAAQ,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrE,QAAQ,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;AACrD,UAAU,OAAO,EAAE,UAAU;AAC7B,UAAU,SAAS,EAAE,YAAY;AACjC,SAAS,CAAC,CAAC;AACX,OAAO;AACP,KAAK,CAAC,OAAO,KAAK,EAAE;AACpB,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,KAAK;AACL,IAAI,MAAM,sBAAsB,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;AACnI,IAAI,IAAI,CAAC,cAAc,IAAI,sBAAsB,EAAE;AACnD,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC/D,MAAM,IAAI,CAAC,QAAQ,GAAGC,uBAAkB,CAAC,QAAQ,CAAC,CAAC;AACnD,MAAM,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;AAC9C,KAAK;AACL,GAAG;AACH;;;;;"}
|
package/dist/index.d.ts
CHANGED
|
@@ -62,6 +62,19 @@ declare type BackstageUserIdentity = {
|
|
|
62
62
|
ownershipEntityRefs: string[];
|
|
63
63
|
};
|
|
64
64
|
|
|
65
|
+
/**
|
|
66
|
+
* An identity client options object which allows extra configurations
|
|
67
|
+
*
|
|
68
|
+
* @experimental This is not a stable API yet
|
|
69
|
+
* @public
|
|
70
|
+
*/
|
|
71
|
+
declare type IdentityClientOptions = {
|
|
72
|
+
discovery: PluginEndpointDiscovery;
|
|
73
|
+
issuer: string;
|
|
74
|
+
/** JWS "alg" (Algorithm) Header Parameter values. Defaults to an array containing just ES256.
|
|
75
|
+
* More info on supported algorithms: https://github.com/panva/jose */
|
|
76
|
+
algorithms?: string[];
|
|
77
|
+
};
|
|
65
78
|
/**
|
|
66
79
|
* An identity client to interact with auth-backend and authenticate Backstage
|
|
67
80
|
* tokens
|
|
@@ -72,15 +85,13 @@ declare type BackstageUserIdentity = {
|
|
|
72
85
|
declare class IdentityClient {
|
|
73
86
|
private readonly discovery;
|
|
74
87
|
private readonly issuer;
|
|
88
|
+
private readonly algorithms;
|
|
75
89
|
private keyStore?;
|
|
76
90
|
private keyStoreUpdated;
|
|
77
91
|
/**
|
|
78
92
|
* Create a new {@link IdentityClient} instance.
|
|
79
93
|
*/
|
|
80
|
-
static create(options:
|
|
81
|
-
discovery: PluginEndpointDiscovery;
|
|
82
|
-
issuer: string;
|
|
83
|
-
}): IdentityClient;
|
|
94
|
+
static create(options: IdentityClientOptions): IdentityClient;
|
|
84
95
|
private constructor();
|
|
85
96
|
/**
|
|
86
97
|
* Verifies the given backstage identity token
|
|
@@ -94,4 +105,4 @@ declare class IdentityClient {
|
|
|
94
105
|
private refreshKeyStore;
|
|
95
106
|
}
|
|
96
107
|
|
|
97
|
-
export { BackstageIdentityResponse, BackstageSignInResult, BackstageUserIdentity, IdentityClient, getBearerTokenFromAuthorizationHeader };
|
|
108
|
+
export { BackstageIdentityResponse, BackstageSignInResult, BackstageUserIdentity, IdentityClient, IdentityClientOptions, getBearerTokenFromAuthorizationHeader };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@backstage/plugin-auth-node",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.2-next.0",
|
|
4
4
|
"main": "dist/index.cjs.js",
|
|
5
5
|
"types": "dist/index.d.ts",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -23,15 +23,15 @@
|
|
|
23
23
|
"start": "backstage-cli package start"
|
|
24
24
|
},
|
|
25
25
|
"dependencies": {
|
|
26
|
-
"@backstage/backend-common": "^0.13.
|
|
27
|
-
"@backstage/config": "^1.0.
|
|
26
|
+
"@backstage/backend-common": "^0.13.6-next.0",
|
|
27
|
+
"@backstage/config": "^1.0.1",
|
|
28
28
|
"@backstage/errors": "^1.0.0",
|
|
29
29
|
"jose": "^4.6.0",
|
|
30
30
|
"node-fetch": "^2.6.7",
|
|
31
31
|
"winston": "^3.2.1"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
|
-
"@backstage/cli": "^0.17.
|
|
34
|
+
"@backstage/cli": "^0.17.2-next.0",
|
|
35
35
|
"lodash": "^4.17.21",
|
|
36
36
|
"msw": "^0.35.0",
|
|
37
37
|
"uuid": "^8.0.0"
|
|
@@ -39,5 +39,5 @@
|
|
|
39
39
|
"files": [
|
|
40
40
|
"dist"
|
|
41
41
|
],
|
|
42
|
-
"gitHead": "
|
|
42
|
+
"gitHead": "c1511c99a532aeb003a97510a5638bd939ee65ca"
|
|
43
43
|
}
|