@backstage/plugin-auth-node 0.2.5-next.1 → 0.2.5-next.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @backstage/plugin-auth-node
 
+## 0.2.5-next.2
+
+### Patch Changes
+
+- 2cbd533426: `IdentityClient` is now deprecated. Please migrate to `IdentityApi` and `DefaultIdentityClient` instead. The authenticate function on `DefaultIdentityClient` is also deprecated. Please use `getIdentity` instead.
+- 667d917488: Updated dependency `msw` to `^0.47.0`.
+- 87ec2ba4d6: Updated dependency `msw` to `^0.46.0`.
+- Updated dependencies
+  - @backstage/backend-common@0.15.1-next.2
+
 ## 0.2.5-next.1
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -14,16 +14,27 @@ function getBearerTokenFromAuthorizationHeader(authorizationHeader) {
 }
 
 const CLOCK_MARGIN_S = 10;
-class IdentityClient {
+class DefaultIdentityClient {
   constructor(options) {
     this.keyStoreUpdated = 0;
-    var _a;
     this.discovery = options.discovery;
     this.issuer = options.issuer;
-    this.algorithms = (_a = options.algorithms) != null ? _a : ["ES256"];
+    this.algorithms = options.hasOwnProperty("algorithms") ? options.algorithms : ["ES256"];
   }
   static create(options) {
-    return new IdentityClient(options);
+    return new DefaultIdentityClient(options);
+  }
+  async getIdentity({ request }) {
+    if (!request.headers.authorization) {
+      return void 0;
+    }
+    try {
+      return await this.authenticate(
+        getBearerTokenFromAuthorizationHeader(request.headers.authorization)
+      );
+    } catch (e) {
+      throw new errors.NotAllowedError(e.message);
+    }
   }
   async authenticate(token) {
     if (!token) {
@@ -76,6 +87,19 @@ class IdentityClient {
   }
 }
 
+class IdentityClient {
+  static create(options) {
+    return new IdentityClient(DefaultIdentityClient.create(options));
+  }
+  constructor(defaultIdentityClient) {
+    this.defaultIdentityClient = defaultIdentityClient;
+  }
+  async authenticate(token) {
+    return await this.defaultIdentityClient.authenticate(token);
+  }
+}
+
+exports.DefaultIdentityClient = DefaultIdentityClient;
 exports.IdentityClient = IdentityClient;
 exports.getBearerTokenFromAuthorizationHeader = getBearerTokenFromAuthorizationHeader;
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/getBearerTokenFromAuthorizationHeader.ts","../src/IdentityClient.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Parses the given authorization header and returns the bearer token, or\n * undefined if no bearer token is given.\n *\n * @remarks\n *\n * This function is explicitly built to tolerate bad inputs safely, so you may\n * call it directly with e.g. the output of `req.header('authorization')`\n * without first checking that it exists.\n *\n * @public\n */\nexport function getBearerTokenFromAuthorizationHeader(\n  authorizationHeader: unknown,\n): string | undefined {\n  if (typeof authorizationHeader !== 'string') {\n    return undefined;\n  }\n  const matches = authorizationHeader.match(/^Bearer[ ]+(\\S+)$/i);\n  return matches?.[1];\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport { AuthenticationError } from '@backstage/errors';\nimport {\n  createRemoteJWKSet,\n  decodeJwt,\n  decodeProtectedHeader,\n  FlattenedJWSInput,\n  JWSHeaderParameters,\n  jwtVerify,\n} from 'jose';\nimport { GetKeyFunction } from 'jose/dist/types/types';\n\nimport { BackstageIdentityResponse } from './types';\n\nconst CLOCK_MARGIN_S = 10;\n\n/**\n * An identity client options object which allows extra configurations\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport type IdentityClientOptions = {\n  discovery: PluginEndpointDiscovery;\n  issuer: string;\n\n  /** JWS \"alg\" (Algorithm) Header Parameter values. Defaults to an array containing just ES256.\n   * More info on supported algorithms: https://github.com/panva/jose */\n  algorithms?: string[];\n};\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport class IdentityClient {\n  private readonly discovery: PluginEndpointDiscovery;\n  private readonly issuer: string;\n  private readonly algorithms: string[];\n  private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;\n  private keyStoreUpdated: number = 0;\n\n  /**\n   * Create a new {@link IdentityClient} instance.\n   */\n  static create(options: IdentityClientOptions): IdentityClient {\n    return new IdentityClient(options);\n  }\n\n  private constructor(options: IdentityClientOptions) {\n    this.discovery = options.discovery;\n    this.issuer = options.issuer;\n    this.algorithms = options.algorithms ?? ['ES256'];\n  }\n\n  /**\n   * Verifies the given backstage identity token\n   * Returns a BackstageIdentity (user) matching the token.\n   * The method throws an error if verification fails.\n   */\n  async authenticate(\n    token: string | undefined,\n  ): Promise<BackstageIdentityResponse> {\n    // Extract token from header\n    if (!token) {\n      throw new AuthenticationError('No token specified');\n    }\n\n    // Verify token claims and signature\n    // Note: Claims must match those set by TokenFactory when issuing tokens\n    // Note: verify throws if verification fails\n    // Check if the keystore needs to be updated\n    await this.refreshKeyStore(token);\n    if (!this.keyStore) {\n      throw new AuthenticationError('No keystore exists');\n    }\n    const decoded = await jwtVerify(token, this.keyStore, {\n      algorithms: this.algorithms,\n      audience: 'backstage',\n      issuer: this.issuer,\n    });\n    // Verified, return the matching user as BackstageIdentity\n    // TODO: Settle internal user format/properties\n    if (!decoded.payload.sub) {\n      throw new AuthenticationError('No user sub found in token');\n    }\n\n    const user: BackstageIdentityResponse = {\n      token,\n      identity: {\n        type: 'user',\n        userEntityRef: decoded.payload.sub,\n        ownershipEntityRefs: decoded.payload.ent\n          ? (decoded.payload.ent as string[])\n          : [],\n      },\n    };\n    return user;\n  }\n\n  /**\n   * If the last keystore refresh is stale, update the keystore URL to the latest\n   */\n  private async refreshKeyStore(rawJwtToken: string): Promise<void> {\n    const payload = await decodeJwt(rawJwtToken);\n    const header = await decodeProtectedHeader(rawJwtToken);\n\n    // Refresh public keys if needed\n    let keyStoreHasKey;\n    try {\n      if (this.keyStore) {\n        // Check if the key is present in the keystore\n        const [_, rawPayload, rawSignature] = rawJwtToken.split('.');\n        keyStoreHasKey = await this.keyStore(header, {\n          payload: rawPayload,\n          signature: rawSignature,\n        });\n      }\n    } catch (error) {\n      keyStoreHasKey = false;\n    }\n    // Refresh public key URL if needed\n    // Add a small margin in case clocks are out of sync\n    const issuedAfterLastRefresh =\n      payload?.iat && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;\n    if (!this.keyStore || (!keyStoreHasKey && issuedAfterLastRefresh)) {\n      const url = await this.discovery.getBaseUrl('auth');\n      const endpoint = new URL(`${url}/.well-known/jwks.json`);\n      this.keyStore = createRemoteJWKSet(endpoint);\n      this.keyStoreUpdated = Date.now() / 1000;\n    }\n  }\n}\n"],"names":["AuthenticationError","jwtVerify","decodeJwt","decodeProtectedHeader","createRemoteJWKSet"],"mappings":";;;;;;;AA4BO,SAAS,sCACd,mBACoB,EAAA;AACpB,EAAI,IAAA,OAAO,wBAAwB,QAAU,EAAA;AAC3C,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AACA,EAAM,MAAA,OAAA,GAAU,mBAAoB,CAAA,KAAA,CAAM,oBAAoB,CAAA,CAAA;AAC9D,EAAA,OAAO,OAAU,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,OAAA,CAAA,CAAA,CAAA,CAAA;AACnB;;ACPA,MAAM,cAAiB,GAAA,EAAA,CAAA;AAwBhB,MAAM,cAAe,CAAA;AAAA,EAclB,YAAY,OAAgC,EAAA;AATpD,IAAA,IAAA,CAAQ,eAA0B,GAAA,CAAA,CAAA;AA1DpC,IAAA,IAAA,EAAA,CAAA;AAoEI,IAAA,IAAA,CAAK,YAAY,OAAQ,CAAA,SAAA,CAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAQ,CAAA,MAAA,CAAA;AACtB,IAAA,IAAA,CAAK,UAAa,GAAA,CAAA,EAAA,GAAA,OAAA,CAAQ,UAAR,KAAA,IAAA,GAAA,EAAA,GAAsB,CAAC,OAAO,CAAA,CAAA;AAAA,GAClD;AAAA,EARA,OAAO,OAAO,OAAgD,EAAA;AAC5D,IAAO,OAAA,IAAI,eAAe,OAAO,CAAA,CAAA;AAAA,GACnC;AAAA,EAaA,MAAM,aACJ,KACoC,EAAA;AAEpC,IAAA,IAAI,CAAC,KAAO,EAAA;AACV,MAAM,MAAA,IAAIA,2BAAoB,oBAAoB,CAAA,CAAA;AAAA,KACpD;AAMA,IAAM,MAAA,IAAA,CAAK,gBAAgB,KAAK,CAAA,CAAA;AAChC,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAM,MAAA,IAAIA,2BAAoB,oBAAoB,CAAA,CAAA;AAAA,KACpD;AACA,IAAA,MAAM,OAAU,GAAA,MAAMC,cAAU,CAAA,KAAA,EAAO,KAAK,QAAU,EAAA;AAAA,MACpD,YAAY,IAAK,CAAA,UAAA;AAAA,MACjB,QAAU,EAAA,WAAA;AAAA,MACV,QAAQ,IAAK,CAAA,MAAA;AAAA,KACd,CAAA,CAAA;AAGD,IAAI,IAAA,CAAC,OAAQ,CAAA,OAAA,CAAQ,GAAK,EAAA;AACxB,MAAM,MAAA,IAAID,2BAAoB,4BAA4B,CAAA,CAAA;AAAA,KAC5D;AAEA,IAAA,MAAM,IAAkC,GAAA;AAAA,MACtC,KAAA;AAAA,MACA,QAAU,EAAA;AAAA,QACR,IAAM,EAAA,MAAA;AAAA,QACN,aAAA,EAAe,QAAQ,OAAQ,CAAA,GAAA;AAAA,QAC/B,qBAAqB,OAAQ,CAAA,OAAA,CAAQ,MAChC,OAAQ,CAAA,OAAA,CAAQ,MACjB,EAAC;AAAA,OACP;AAAA,KACF,CAAA;AACA,IAAO,OAAA,IAAA,CAAA;AAAA,GACT;AAAA,EAKA,MAAc,gBAAgB,WAAoC,EAAA;AAChE,IAAM,MAAA,OAAA,GAAU,MAAME,cAAA,CAAU,WAAW,CAAA,CAAA;AAC3C,IAAM,MAAA,MAAA,GAAS,MAAMC,0BAAA,CAAsB,WAAW,CAAA,CAAA;AAGtD,IAAI,IAAA,cAAA,CAAA;AACJ,IAAI,IAAA;AACF,MAAA,IAAI,KAAK,QAAU,EAAA;AAEjB,QAAA,MAAM,CAAC,CAAG,EAAA,UAAA,EAAY,YAAY,CAAI,GAAA,WAAA,CAAY,MAAM,GAAG,CAAA,CAAA;AAC3D,QAAiB,cAAA,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,MAAQ,EAAA;AAAA,UAC3C,OAAS,EAAA,UAAA;AAAA,UACT,SAAW,EAAA,YAAA;AAAA,SACZ,CAAA,CAAA;AAAA,OACH;AAAA,aACO,KAAP,EAAA;AACA,MAAiB,cAAA,GAAA,KAAA,CAAA;AAAA,KACnB;AAGA,IAAA,MAAM,0BACJ,OAAS,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,OAAA,CAAA,GAAA,KAAO,OAAQ,CAAA,GAAA,GAAM,KAAK,eAAkB,GAAA,cAAA,CAAA;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,QAAa,IAAA,CAAC,kBAAkB,sBAAyB,EAAA;AACjE,MAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,MAAM,CAAA,CAAA;AAClD,MAAA,MAAM,QAAW,GAAA,IAAI,GAAI,CAAA,CAAA,EAAG,GAA2B,CAAA,sBAAA,CAAA,CAAA,CAAA;AACvD,MAAK,IAAA,CAAA,QAAA,GAAWC,wBAAmB,QAAQ,CAAA,CAAA;AAC3C,MAAK,IAAA,CAAA,eAAA,GAAkB,IAAK,CAAA,GAAA,EAAQ,GAAA,GAAA,CAAA;AAAA,KACtC;AAAA,GACF;AACF;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/getBearerTokenFromAuthorizationHeader.ts","../src/DefaultIdentityClient.ts","../src/IdentityClient.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Parses the given authorization header and returns the bearer token, or\n * undefined if no bearer token is given.\n *\n * @remarks\n *\n * This function is explicitly built to tolerate bad inputs safely, so you may\n * call it directly with e.g. the output of `req.header('authorization')`\n * without first checking that it exists.\n *\n * @public\n */\nexport function getBearerTokenFromAuthorizationHeader(\n  authorizationHeader: unknown,\n): string | undefined {\n  if (typeof authorizationHeader !== 'string') {\n    return undefined;\n  }\n  const matches = authorizationHeader.match(/^Bearer[ ]+(\\S+)$/i);\n  return matches?.[1];\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { PluginEndpointDiscovery } from '@backstage/backend-common';\nimport { AuthenticationError, NotAllowedError } from '@backstage/errors';\nimport {\n  createRemoteJWKSet,\n  decodeJwt,\n  decodeProtectedHeader,\n  FlattenedJWSInput,\n  JWSHeaderParameters,\n  jwtVerify,\n} from 'jose';\nimport { GetKeyFunction } from 'jose/dist/types/types';\n\nimport {\n  BackstageIdentityResponse,\n  IdentityApiGetIdentityRequest,\n} from './types';\nimport { getBearerTokenFromAuthorizationHeader, IdentityApi } from '.';\n\nconst CLOCK_MARGIN_S = 10;\n\n/**\n * An identity client options object which allows extra configurations\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport type IdentityClientOptions = {\n  discovery: PluginEndpointDiscovery;\n  issuer?: string;\n\n  /** JWS \"alg\" (Algorithm) Header Parameter values. Defaults to an array containing just ES256.\n   * More info on supported algorithms: https://github.com/panva/jose */\n  algorithms?: string[];\n};\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @experimental This is not a stable API yet\n * @public\n */\nexport class DefaultIdentityClient implements IdentityApi {\n  private readonly discovery: PluginEndpointDiscovery;\n  private readonly issuer?: string;\n  private readonly algorithms?: string[];\n  private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;\n  private keyStoreUpdated: number = 0;\n\n  /**\n   * Create a new {@link DefaultIdentityClient} instance.\n   */\n  static create(options: IdentityClientOptions): DefaultIdentityClient {\n    return new DefaultIdentityClient(options);\n  }\n\n  private constructor(options: IdentityClientOptions) {\n    this.discovery = options.discovery;\n    this.issuer = options.issuer;\n    this.algorithms = options.hasOwnProperty('algorithms')\n      ? options.algorithms\n      : ['ES256'];\n  }\n\n  async getIdentity({ request }: IdentityApiGetIdentityRequest) {\n    if (!request.headers.authorization) {\n      return undefined;\n    }\n    try {\n      return await this.authenticate(\n        getBearerTokenFromAuthorizationHeader(request.headers.authorization),\n      );\n    } catch (e) {\n      throw new NotAllowedError(e.message);\n    }\n  }\n\n  /**\n   * Verifies the given backstage identity token\n   * Returns a BackstageIdentity (user) matching the token.\n   * The method throws an error if verification fails.\n   *\n   * @deprecated You should start to use getIdentity instead of authenticate to retrieve the user\n   * identity.\n   */\n  async authenticate(\n    token: string | undefined,\n  ): Promise<BackstageIdentityResponse> {\n    // Extract token from header\n    if (!token) {\n      throw new AuthenticationError('No token specified');\n    }\n\n    // Verify token claims and signature\n    // Note: Claims must match those set by TokenFactory when issuing tokens\n    // Note: verify throws if verification fails\n    // Check if the keystore needs to be updated\n    await this.refreshKeyStore(token);\n    if (!this.keyStore) {\n      throw new AuthenticationError('No keystore exists');\n    }\n    const decoded = await jwtVerify(token, this.keyStore, {\n      algorithms: this.algorithms,\n      audience: 'backstage',\n      issuer: this.issuer,\n    });\n    // Verified, return the matching user as BackstageIdentity\n    // TODO: Settle internal user format/properties\n    if (!decoded.payload.sub) {\n      throw new AuthenticationError('No user sub found in token');\n    }\n\n    const user: BackstageIdentityResponse = {\n      token,\n      identity: {\n        type: 'user',\n        userEntityRef: decoded.payload.sub,\n        ownershipEntityRefs: decoded.payload.ent\n          ? (decoded.payload.ent as string[])\n          : [],\n      },\n    };\n    return user;\n  }\n\n  /**\n   * If the last keystore refresh is stale, update the keystore URL to the latest\n   */\n  private async refreshKeyStore(rawJwtToken: string): Promise<void> {\n    const payload = await decodeJwt(rawJwtToken);\n    const header = await decodeProtectedHeader(rawJwtToken);\n\n    // Refresh public keys if needed\n    let keyStoreHasKey;\n    try {\n      if (this.keyStore) {\n        // Check if the key is present in the keystore\n        const [_, rawPayload, rawSignature] = rawJwtToken.split('.');\n        keyStoreHasKey = await this.keyStore(header, {\n          payload: rawPayload,\n          signature: rawSignature,\n        });\n      }\n    } catch (error) {\n      keyStoreHasKey = false;\n    }\n    // Refresh public key URL if needed\n    // Add a small margin in case clocks are out of sync\n    const issuedAfterLastRefresh =\n      payload?.iat && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;\n    if (!this.keyStore || (!keyStoreHasKey && issuedAfterLastRefresh)) {\n      const url = await this.discovery.getBaseUrl('auth');\n      const endpoint = new URL(`${url}/.well-known/jwks.json`);\n      this.keyStore = createRemoteJWKSet(endpoint);\n      this.keyStoreUpdated = Date.now() / 1000;\n    }\n  }\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DefaultIdentityClient,\n  IdentityClientOptions,\n} from './DefaultIdentityClient';\nimport { BackstageIdentityResponse } from './types';\n\n/**\n * An identity client to interact with auth-backend and authenticate Backstage\n * tokens\n *\n * @public\n * @experimental This is not a stable API yet\n * @deprecated Please migrate to the DefaultIdentityClient.\n */\nexport class IdentityClient {\n  private readonly defaultIdentityClient: DefaultIdentityClient;\n  static create(options: IdentityClientOptions): IdentityClient {\n    return new IdentityClient(DefaultIdentityClient.create(options));\n  }\n\n  private constructor(defaultIdentityClient: DefaultIdentityClient) {\n    this.defaultIdentityClient = defaultIdentityClient;\n  }\n\n  /**\n   * Verifies the given backstage identity token\n   * Returns a BackstageIdentity (user) matching the token.\n   * The method throws an error if verification fails.\n   *\n   * @deprecated You should start to use IdentityApi#getIdentity instead of authenticate\n   * to retrieve the user identity.\n   */\n  async authenticate(\n    token: string | undefined,\n  ): Promise<BackstageIdentityResponse> {\n    return await this.defaultIdentityClient.authenticate(token);\n  }\n}\n"],"names":["NotAllowedError","AuthenticationError","jwtVerify","decodeJwt","decodeProtectedHeader","createRemoteJWKSet"],"mappings":";;;;;;;AA4BO,SAAS,sCACd,mBACoB,EAAA;AACpB,EAAI,IAAA,OAAO,wBAAwB,QAAU,EAAA;AAC3C,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AACA,EAAM,MAAA,OAAA,GAAU,mBAAoB,CAAA,KAAA,CAAM,oBAAoB,CAAA,CAAA;AAC9D,EAAA,OAAO,OAAU,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,OAAA,CAAA,CAAA,CAAA,CAAA;AACnB;;ACHA,MAAM,cAAiB,GAAA,EAAA,CAAA;AAwBhB,MAAM,qBAA6C,CAAA;AAAA,EAchD,YAAY,OAAgC,EAAA;AATpD,IAAA,IAAA,CAAQ,eAA0B,GAAA,CAAA,CAAA;AAUhC,IAAA,IAAA,CAAK,YAAY,OAAQ,CAAA,SAAA,CAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAQ,CAAA,MAAA,CAAA;AACtB,IAAK,IAAA,CAAA,UAAA,GAAa,QAAQ,cAAe,CAAA,YAAY,IACjD,OAAQ,CAAA,UAAA,GACR,CAAC,OAAO,CAAA,CAAA;AAAA,GACd;AAAA,EAVA,OAAO,OAAO,OAAuD,EAAA;AACnE,IAAO,OAAA,IAAI,sBAAsB,OAAO,CAAA,CAAA;AAAA,GAC1C;AAAA,EAUA,MAAM,WAAA,CAAY,EAAE,OAAA,EAA0C,EAAA;AAC5D,IAAI,IAAA,CAAC,OAAQ,CAAA,OAAA,CAAQ,aAAe,EAAA;AAClC,MAAO,OAAA,KAAA,CAAA,CAAA;AAAA,KACT;AACA,IAAI,IAAA;AACF,MAAA,OAAO,MAAM,IAAK,CAAA,YAAA;AAAA,QAChB,qCAAA,CAAsC,OAAQ,CAAA,OAAA,CAAQ,aAAa,CAAA;AAAA,OACrE,CAAA;AAAA,aACO,CAAP,EAAA;AACA,MAAM,MAAA,IAAIA,sBAAgB,CAAA,CAAA,CAAE,OAAO,CAAA,CAAA;AAAA,KACrC;AAAA,GACF;AAAA,EAUA,MAAM,aACJ,KACoC,EAAA;AAEpC,IAAA,IAAI,CAAC,KAAO,EAAA;AACV,MAAM,MAAA,IAAIC,2BAAoB,oBAAoB,CAAA,CAAA;AAAA,KACpD;AAMA,IAAM,MAAA,IAAA,CAAK,gBAAgB,KAAK,CAAA,CAAA;AAChC,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAM,MAAA,IAAIA,2BAAoB,oBAAoB,CAAA,CAAA;AAAA,KACpD;AACA,IAAA,MAAM,OAAU,GAAA,MAAMC,cAAU,CAAA,KAAA,EAAO,KAAK,QAAU,EAAA;AAAA,MACpD,YAAY,IAAK,CAAA,UAAA;AAAA,MACjB,QAAU,EAAA,WAAA;AAAA,MACV,QAAQ,IAAK,CAAA,MAAA;AAAA,KACd,CAAA,CAAA;AAGD,IAAI,IAAA,CAAC,OAAQ,CAAA,OAAA,CAAQ,GAAK,EAAA;AACxB,MAAM,MAAA,IAAID,2BAAoB,4BAA4B,CAAA,CAAA;AAAA,KAC5D;AAEA,IAAA,MAAM,IAAkC,GAAA;AAAA,MACtC,KAAA;AAAA,MACA,QAAU,EAAA;AAAA,QACR,IAAM,EAAA,MAAA;AAAA,QACN,aAAA,EAAe,QAAQ,OAAQ,CAAA,GAAA;AAAA,QAC/B,qBAAqB,OAAQ,CAAA,OAAA,CAAQ,MAChC,OAAQ,CAAA,OAAA,CAAQ,MACjB,EAAC;AAAA,OACP;AAAA,KACF,CAAA;AACA,IAAO,OAAA,IAAA,CAAA;AAAA,GACT;AAAA,EAKA,MAAc,gBAAgB,WAAoC,EAAA;AAChE,IAAM,MAAA,OAAA,GAAU,MAAME,cAAA,CAAU,WAAW,CAAA,CAAA;AAC3C,IAAM,MAAA,MAAA,GAAS,MAAMC,0BAAA,CAAsB,WAAW,CAAA,CAAA;AAGtD,IAAI,IAAA,cAAA,CAAA;AACJ,IAAI,IAAA;AACF,MAAA,IAAI,KAAK,QAAU,EAAA;AAEjB,QAAA,MAAM,CAAC,CAAG,EAAA,UAAA,EAAY,YAAY,CAAI,GAAA,WAAA,CAAY,MAAM,GAAG,CAAA,CAAA;AAC3D,QAAiB,cAAA,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,MAAQ,EAAA;AAAA,UAC3C,OAAS,EAAA,UAAA;AAAA,UACT,SAAW,EAAA,YAAA;AAAA,SACZ,CAAA,CAAA;AAAA,OACH;AAAA,aACO,KAAP,EAAA;AACA,MAAiB,cAAA,GAAA,KAAA,CAAA;AAAA,KACnB;AAGA,IAAA,MAAM,0BACJ,OAAS,IAAA,IAAA,GAAA,KAAA,CAAA,GAAA,OAAA,CAAA,GAAA,KAAO,OAAQ,CAAA,GAAA,GAAM,KAAK,eAAkB,GAAA,cAAA,CAAA;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,QAAa,IAAA,CAAC,kBAAkB,sBAAyB,EAAA;AACjE,MAAA,MAAM,GAAM,GAAA,MAAM,IAAK,CAAA,SAAA,CAAU,WAAW,MAAM,CAAA,CAAA;AAClD,MAAA,MAAM,QAAW,GAAA,IAAI,GAAI,CAAA,CAAA,EAAG,GAA2B,CAAA,sBAAA,CAAA,CAAA,CAAA;AACvD,MAAK,IAAA,CAAA,QAAA,GAAWC,wBAAmB,QAAQ,CAAA,CAAA;AAC3C,MAAK,IAAA,CAAA,eAAA,GAAkB,IAAK,CAAA,GAAA,EAAQ,GAAA,GAAA,CAAA;AAAA,KACtC;AAAA,GACF;AACF;;AC9IO,MAAM,cAAe,CAAA;AAAA,EAE1B,OAAO,OAAO,OAAgD,EAAA;AAC5D,IAAA,OAAO,IAAI,cAAA,CAAe,qBAAsB,CAAA,MAAA,CAAO,OAAO,CAAC,CAAA,CAAA;AAAA,GACjE;AAAA,EAEQ,YAAY,qBAA8C,EAAA;AAChE,IAAA,IAAA,CAAK,qBAAwB,GAAA,qBAAA,CAAA;AAAA,GAC/B;AAAA,EAUA,MAAM,aACJ,KACoC,EAAA;AACpC,IAAA,OAAO,MAAM,IAAA,CAAK,qBAAsB,CAAA,YAAA,CAAa,KAAK,CAAA,CAAA;AAAA,GAC5D;AACF;;;;;;"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
+import { Request } from 'express';
 
 /**
  * Parses the given authorization header and returns the bearer token, or
@@ -28,6 +29,14 @@ interface BackstageSignInResult {
      */
     token: string;
 }
+/**
+ * Options to request the identity from a Backstage backend request
+ *
+ * @public
+ */
+declare type IdentityApiGetIdentityRequest = {
+    request: Request<unknown>;
+};
 /**
  * Response object containing the {@link BackstageUserIdentity} and the token
  * from the authentication provider.
@@ -70,7 +79,7 @@ declare type BackstageUserIdentity = {
  */
 declare type IdentityClientOptions = {
     discovery: PluginEndpointDiscovery;
-    issuer: string;
+    issuer?: string;
     /** JWS "alg" (Algorithm) Header Parameter values. Defaults to an array containing just ES256.
      * More info on supported algorithms: https://github.com/panva/jose */
     algorithms?: string[];
@@ -82,21 +91,25 @@ declare type IdentityClientOptions = {
  * @experimental This is not a stable API yet
  * @public
  */
-declare class IdentityClient {
+declare class DefaultIdentityClient implements IdentityApi {
     private readonly discovery;
-    private readonly issuer;
-    private readonly algorithms;
+    private readonly issuer?;
+    private readonly algorithms?;
     private keyStore?;
     private keyStoreUpdated;
     /**
-     * Create a new {@link IdentityClient} instance.
+     * Create a new {@link DefaultIdentityClient} instance.
      */
-    static create(options: IdentityClientOptions): IdentityClient;
+    static create(options: IdentityClientOptions): DefaultIdentityClient;
     private constructor();
+    getIdentity({ request }: IdentityApiGetIdentityRequest): Promise<BackstageIdentityResponse | undefined>;
     /**
      * Verifies the given backstage identity token
      * Returns a BackstageIdentity (user) matching the token.
      * The method throws an error if verification fails.
+     *
+     * @deprecated You should start to use getIdentity instead of authenticate to retrieve the user
+     * identity.
      */
     authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
     /**
@@ -105,4 +118,43 @@ declare class IdentityClient {
     private refreshKeyStore;
 }
 
-export { BackstageIdentityResponse, BackstageSignInResult, BackstageUserIdentity, IdentityClient, IdentityClientOptions, getBearerTokenFromAuthorizationHeader };
+/**
+ * An identity client to interact with auth-backend and authenticate Backstage
+ * tokens
+ *
+ * @public
+ * @experimental This is not a stable API yet
+ * @deprecated Please migrate to the DefaultIdentityClient.
+ */
+declare class IdentityClient {
+    private readonly defaultIdentityClient;
+    static create(options: IdentityClientOptions): IdentityClient;
+    private constructor();
+    /**
+     * Verifies the given backstage identity token
+     * Returns a BackstageIdentity (user) matching the token.
+     * The method throws an error if verification fails.
+     *
+     * @deprecated You should start to use IdentityApi#getIdentity instead of authenticate
+     * to retrieve the user identity.
+     */
+    authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
+}
+
+/**
+ * An identity client api to authenticate Backstage
+ * tokens
+ *
+ * @experimental This is not a stable API yet
+ * @public
+ */
+interface IdentityApi {
+    /**
+     * Verifies the given backstage identity token
+     * Returns a BackstageIdentity (user) matching the token.
+     * The method throws an error if verification fails.
+     */
+    getIdentity(options: IdentityApiGetIdentityRequest): Promise<BackstageIdentityResponse | undefined>;
+}
+
+export { BackstageIdentityResponse, BackstageSignInResult, BackstageUserIdentity, DefaultIdentityClient, IdentityApi, IdentityApiGetIdentityRequest, IdentityClient, IdentityClientOptions, getBearerTokenFromAuthorizationHeader };

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@backstage/plugin-auth-node",
-  "version": "0.2.5-next.1",
+  "version": "0.2.5-next.2",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",
-  "private": false,
   "publishConfig": {
     "access": "public",
     "main": "dist/index.cjs.js",
@@ -23,22 +22,24 @@
     "start": "backstage-cli package start"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.15.1-next.1",
+    "@backstage/backend-common": "^0.15.1-next.2",
     "@backstage/config": "^1.0.1",
     "@backstage/errors": "^1.1.0",
+    "@types/express": "*",
+    "express": "^4.17.1",
     "jose": "^4.6.0",
     "node-fetch": "^2.6.7",
     "winston": "^3.2.1"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "^0.1.28-next.1",
-    "@backstage/cli": "^0.19.0-next.1",
+    "@backstage/backend-test-utils": "^0.1.28-next.2",
+    "@backstage/cli": "^0.19.0-next.2",
     "lodash": "^4.17.21",
-    "msw": "^0.45.0",
+    "msw": "^0.47.0",
     "uuid": "^8.0.0"
   },
   "files": [
     "dist"
   ],
-  "gitHead": "64f2e93089b61902a3302933dfec197deb10506c"
+  "gitHead": "24f889f173370f060725fcf9404081e40769beb4"
 }