@backstage/plugin-auth-node 0.6.9 → 0.6.10-next.1

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @backstage/plugin-auth-node
 
+## 0.6.10-next.1
+
+### Patch Changes
+
+- de96a60: chore(deps): bump `express` from 4.21.2 to 4.22.0
+- e9dd634: fix flawed cookie removal logic with chunked tokens
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.6.0-next.1
+  - @backstage/catalog-client@1.12.1
+  - @backstage/catalog-model@1.7.6
+  - @backstage/config@1.3.6
+  - @backstage/errors@1.2.7
+  - @backstage/types@1.2.2
+
+## 0.6.10-next.0
+
+### Patch Changes
+
+- 2389358: remove leading dot in auth cookie cleanup call
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.5.1-next.0
+  - @backstage/config@1.3.6
+  - @backstage/catalog-client@1.12.1
+  - @backstage/catalog-model@1.7.6
+  - @backstage/errors@1.2.7
+  - @backstage/types@1.2.2
+
 ## 0.6.9
 
 ### Patch Changes

package/dist/index.d.ts

@@ -827,4 +827,5 @@ interface ProxyAuthRouteHandlersOptions<TResult> {
 /** @public */
 declare function createProxyAuthRouteHandlers<TResult>(options: ProxyAuthRouteHandlersOptions<TResult>): AuthProviderRouteHandlers;
 
-export { type AuthOwnershipResolutionExtensionPoint, type AuthOwnershipResolver, type AuthProviderConfig, type AuthProviderFactory, type AuthProviderRegistrationOptions, type AuthProviderRouteHandlers, type AuthProvidersExtensionPoint, type AuthResolverCatalogUserQuery, type AuthResolverContext, type BackstageIdentityResponse, type BackstageSignInResult, type BackstageUserIdentity, type ClientAuthResponse, type CookieConfigurer, DefaultIdentityClient, type IdentityApi, type IdentityApiGetIdentityRequest, IdentityClient, type IdentityClientOptions, type OAuthAuthenticator, type OAuthAuthenticatorAuthenticateInput, type OAuthAuthenticatorLogoutInput, type OAuthAuthenticatorRefreshInput, type OAuthAuthenticatorResult, type OAuthAuthenticatorScopeOptions, type OAuthAuthenticatorStartInput, OAuthEnvironmentHandler, type OAuthRouteHandlersOptions, type OAuthSession, type OAuthState, type OAuthStateTransform, type PassportDoneCallback, PassportHelpers, PassportOAuthAuthenticatorHelper, type PassportOAuthDoneCallback, type PassportOAuthPrivateInfo, type PassportOAuthResult, type PassportProfile, type ProfileInfo, type ProfileTransform, type ProxyAuthRouteHandlersOptions, type ProxyAuthenticator, type ReadDeclarativeSignInResolverOptions, type SignInInfo, type SignInResolver, type SignInResolverFactory, type SignInResolverFactoryOptions, type TokenParams, type WebMessageResponse, authOwnershipResolutionExtensionPoint, authProvidersExtensionPoint, commonSignInResolvers, createOAuthAuthenticator, createOAuthProviderFactory, createOAuthRouteHandlers, createProxyAuthProviderFactory, createProxyAuthRouteHandlers, createProxyAuthenticator, createSignInResolverFactory, decodeOAuthState, encodeOAuthState, getBearerTokenFromAuthorizationHeader, prepareBackstageIdentityResponse, readDeclarativeSignInResolver, sendWebMessageResponse, tokenTypes };
+export { DefaultIdentityClient, IdentityClient, OAuthEnvironmentHandler, PassportHelpers, PassportOAuthAuthenticatorHelper, authOwnershipResolutionExtensionPoint, authProvidersExtensionPoint, commonSignInResolvers, createOAuthAuthenticator, createOAuthProviderFactory, createOAuthRouteHandlers, createProxyAuthProviderFactory, createProxyAuthRouteHandlers, createProxyAuthenticator, createSignInResolverFactory, decodeOAuthState, encodeOAuthState, getBearerTokenFromAuthorizationHeader, prepareBackstageIdentityResponse, readDeclarativeSignInResolver, sendWebMessageResponse, tokenTypes };
+export type { AuthOwnershipResolutionExtensionPoint, AuthOwnershipResolver, AuthProviderConfig, AuthProviderFactory, AuthProviderRegistrationOptions, AuthProviderRouteHandlers, AuthProvidersExtensionPoint, AuthResolverCatalogUserQuery, AuthResolverContext, BackstageIdentityResponse, BackstageSignInResult, BackstageUserIdentity, ClientAuthResponse, CookieConfigurer, IdentityApi, IdentityApiGetIdentityRequest, IdentityClientOptions, OAuthAuthenticator, OAuthAuthenticatorAuthenticateInput, OAuthAuthenticatorLogoutInput, OAuthAuthenticatorRefreshInput, OAuthAuthenticatorResult, OAuthAuthenticatorScopeOptions, OAuthAuthenticatorStartInput, OAuthRouteHandlersOptions, OAuthSession, OAuthState, OAuthStateTransform, PassportDoneCallback, PassportOAuthDoneCallback, PassportOAuthPrivateInfo, PassportOAuthResult, PassportProfile, ProfileInfo, ProfileTransform, ProxyAuthRouteHandlersOptions, ProxyAuthenticator, ReadDeclarativeSignInResolverOptions, SignInInfo, SignInResolver, SignInResolverFactory, SignInResolverFactoryOptions, TokenParams, WebMessageResponse };

package/dist/oauth/OAuthCookieManager.cjs.js

@@ -91,6 +91,30 @@ class OAuthCookieManager {
     };
     const req = res.req;
     let output = res;
+    const chunkedFormatExists = OAuthCookieManager.chunkedCookieExists(
+      req,
+      name
+    );
+    if (this.cookieConfigurer === defaultCookieConfigurer) {
+      const { hostname: domain } = new URL(this.options.callbackUrl);
+      output = output.cookie(name, "", {
+        ...this.getRemoveCookieOptions(),
+        domain
+      });
+      if (chunkedFormatExists) {
+        for (let chunkNumber = 0; ; chunkNumber++) {
+          const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);
+          const exists = !!req.cookies[key];
+          if (!exists) {
+            break;
+          }
+          output = output.cookie(key, "", {
+            ...this.getRemoveCookieOptions(),
+            domain
+          });
+        }
+      }
+    }
     if (val.length > MAX_COOKIE_SIZE_CHARACTERS) {
       const nonChunkedFormatExists = !!req.cookies[name];
       if (nonChunkedFormatExists) {
@@ -106,10 +130,6 @@ class OAuthCookieManager {
       });
       return output;
     }
-    const chunkedFormatExists = OAuthCookieManager.chunkedCookieExists(
-      req,
-      name
-    );
     if (chunkedFormatExists) {
       for (let chunkNumber = 0; ; chunkNumber++) {
         const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);
@@ -120,13 +140,6 @@ class OAuthCookieManager {
         output = output.cookie(key, "", this.getRemoveCookieOptions());
       }
     }
-    if (this.cookieConfigurer === defaultCookieConfigurer) {
-      const { hostname: domain } = new URL(this.options.callbackUrl);
-      output = output.cookie(name, "", {
-        ...this.getRemoveCookieOptions(),
-        domain: `.${domain}`
-      });
-    }
     return output.cookie(name, val, options);
   }
   getCookie(req, name) {

package/dist/oauth/OAuthCookieManager.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthCookieManager.cjs.js","sources":["../../src/oauth/OAuthCookieManager.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { CookieOptions, Request, Response } from 'express';\nimport { CookieConfigurer } from '../types';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\n\nconst THOUSAND_DAYS_MS = 1000 * 24 * 60 * 60 * 1000;\nconst TEN_MINUTES_MS = 600 * 1000;\n\nconst MAX_COOKIE_SIZE_CHARACTERS = 4000;\n\nconst defaultCookieConfigurer: CookieConfigurer = ({\n  callbackUrl,\n  providerId,\n  appOrigin,\n}) => {\n  const { hostname: domain, pathname, protocol } = new URL(callbackUrl);\n  const secure = protocol === 'https:';\n\n  // For situations where the auth-backend is running on a\n  // different domain than the app, we set the SameSite attribute\n  // to 'none' to allow third-party access to the cookie, but\n  // only if it's in a secure context (https).\n  let sameSite: ReturnType<CookieConfigurer>['sameSite'] = 'lax';\n  if (new URL(appOrigin).hostname !== domain && secure) {\n    sameSite = 'none';\n  }\n\n  // If the provider supports callbackUrls, the pathname will\n  // contain the complete path to the frame handler so we need\n  // to slice off the trailing part of the path.\n  const path = pathname.endsWith(`${providerId}/handler/frame`)\n    ? pathname.slice(0, -'/handler/frame'.length)\n    : `${pathname}/${providerId}`;\n\n  return { path, secure, sameSite };\n};\n\n/** @internal */\nexport class OAuthCookieManager {\n  private readonly cookieConfigurer: CookieConfigurer;\n  private readonly nonceCookie: string;\n  private readonly refreshTokenCookie: string;\n  private readonly grantedScopeCookie: string;\n  private readonly maxAge: number;\n\n  constructor(\n    private readonly options: {\n      providerId: string;\n      defaultAppOrigin: string;\n      baseUrl: string;\n      callbackUrl: string;\n      cookieConfigurer?: CookieConfigurer;\n      sessionDuration?: HumanDuration;\n    },\n  ) {\n    this.cookieConfigurer = options.cookieConfigurer ?? defaultCookieConfigurer;\n\n    this.nonceCookie = `${options.providerId}-nonce`;\n    this.refreshTokenCookie = `${options.providerId}-refresh-token`;\n    this.grantedScopeCookie = `${options.providerId}-granted-scope`;\n    this.maxAge = options.sessionDuration\n      ? durationToMilliseconds(options.sessionDuration)\n      : THOUSAND_DAYS_MS;\n  }\n\n  private getConfig(origin?: string, pathSuffix: string = '') {\n    const cookieConfig = this.cookieConfigurer({\n      providerId: this.options.providerId,\n      baseUrl: this.options.baseUrl,\n      callbackUrl: this.options.callbackUrl,\n      appOrigin: origin ?? this.options.defaultAppOrigin,\n    });\n    return {\n      httpOnly: true,\n      sameSite: 'lax' as const,\n      ...cookieConfig,\n      path: cookieConfig.path + pathSuffix,\n    };\n  }\n\n  setNonce(res: Response, nonce: string, origin?: string): void {\n    this.setCookie(\n      res,\n      this.nonceCookie,\n      nonce,\n      TEN_MINUTES_MS,\n      origin,\n      '/handler',\n    );\n  }\n\n  setRefreshToken(res: Response, refreshToken: string, origin?: string): void {\n    this.setCookie(\n      res,\n      this.refreshTokenCookie,\n      refreshToken,\n      this.maxAge,\n      origin,\n    );\n  }\n\n  removeRefreshToken(res: Response, origin?: string): void {\n    this.removeCookie(res, this.refreshTokenCookie, origin);\n  }\n\n  removeGrantedScopes(res: Response, origin?: string): void {\n    this.removeCookie(res, this.grantedScopeCookie, origin);\n  }\n\n  setGrantedScopes(res: Response, scope: string, origin?: string): void {\n    this.setCookie(res, this.grantedScopeCookie, scope, this.maxAge, origin);\n  }\n\n  getNonce(req: Request): string | undefined {\n    return this.getCookie(req, this.nonceCookie);\n  }\n\n  getRefreshToken(req: Request): string | undefined {\n    return this.getCookie(req, this.refreshTokenCookie);\n  }\n\n  getGrantedScopes(req: Request): string | undefined {\n    return this.getCookie(req, this.grantedScopeCookie);\n  }\n\n  private setCookie(\n    res: Response,\n    name: string,\n    val: string,\n    maxAge: number,\n    origin?: string,\n    pathSuffix: string = '',\n  ): Response {\n    const options = {\n      maxAge,\n      ...this.getConfig(origin, pathSuffix),\n    };\n    const req = res.req;\n    let output = res;\n    if (val.length > MAX_COOKIE_SIZE_CHARACTERS) {\n      const nonChunkedFormatExists = !!req.cookies[name];\n      if (nonChunkedFormatExists) {\n        output = output.cookie(name, '', this.getRemoveCookieOptions());\n      }\n\n      const chunked = this.splitCookieToChunks(val, MAX_COOKIE_SIZE_CHARACTERS);\n      chunked.forEach((value, chunkNumber) => {\n        output = output.cookie(\n          OAuthCookieManager.getCookieChunkName(name, chunkNumber),\n          value,\n          options,\n        );\n      });\n      return output;\n    }\n\n    const chunkedFormatExists = OAuthCookieManager.chunkedCookieExists(\n      req,\n      name,\n    );\n    if (chunkedFormatExists) {\n      for (let chunkNumber = 0; ; chunkNumber++) {\n        const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);\n        const exists = !!req.cookies[key];\n        if (!exists) {\n          break;\n        }\n        output = output.cookie(key, '', this.getRemoveCookieOptions());\n      }\n    }\n\n    // If using the default cookieConfigurer, delete old cookie with domain set to the callbackUrl's domain (legacy behavior)\n    if (this.cookieConfigurer === defaultCookieConfigurer) {\n      const { hostname: domain } = new URL(this.options.callbackUrl);\n      output = output.cookie(name, '', {\n        ...this.getRemoveCookieOptions(),\n        domain: `.${domain}`,\n      });\n    }\n\n    return output.cookie(name, val, options);\n  }\n\n  private getCookie(req: Request, name: string): string | undefined {\n    const isChunked = OAuthCookieManager.chunkedCookieExists(req, name);\n    if (isChunked) {\n      const chunks: string[] = [];\n      let chunkNumber = 0;\n      let chunk =\n        req.cookies[OAuthCookieManager.getCookieChunkName(name, chunkNumber)];\n      while (chunk) {\n        chunks.push(chunk);\n        chunkNumber++;\n        chunk =\n          req.cookies[OAuthCookieManager.getCookieChunkName(name, chunkNumber)];\n      }\n      return chunks.join('');\n    }\n    return req.cookies[name];\n  }\n\n  private removeCookie(res: Response, name: string, origin?: string): Response {\n    const req = res.req;\n    const options = this.getRemoveCookieOptions(origin);\n    const isChunked = OAuthCookieManager.chunkedCookieExists(req, name);\n    if (isChunked) {\n      const nonChunkedFormatExists = !!req.cookies[name];\n      let output: Response = nonChunkedFormatExists\n        ? res.cookie(name, '', options)\n        : res;\n      for (let chunkNumber = 0; ; chunkNumber++) {\n        const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);\n        const exists = !!req.cookies[key];\n        if (!exists) {\n          break;\n        }\n        output = output.cookie(key, '', options);\n      }\n      return output;\n    }\n    return res.cookie(name, '', options);\n  }\n\n  private splitCookieToChunks(val: string, chunkSize: number): string[] {\n    const numChunks = Math.ceil(val.length / chunkSize);\n    const chunks: string[] = Array<string>(numChunks);\n\n    let offset: number = 0;\n    for (let i = 0; i < numChunks; i++) {\n      chunks[i] = val.substring(offset, offset + chunkSize);\n      offset += chunkSize;\n    }\n    return chunks;\n  }\n\n  private static chunkedCookieExists(req: Request, name: string): boolean {\n    return !!req.cookies[OAuthCookieManager.getCookieChunkName(name, 0)];\n  }\n\n  private static getCookieChunkName(name: string, chunkIndex: number): string {\n    return `${name}-${chunkIndex}`;\n  }\n\n  private getRemoveCookieOptions(origin?: string): CookieOptions {\n    return {\n      maxAge: 0,\n      ...this.getConfig(origin),\n    };\n  }\n}\n"],"names":["durationToMilliseconds"],"mappings":";;;;AAoBA,MAAM,gBAAA,GAAmB,GAAA,GAAO,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAC/C,MAAM,iBAAiB,GAAA,GAAM,GAAA;AAE7B,MAAM,0BAAA,GAA6B,GAAA;AAEnC,MAAM,0BAA4C,CAAC;AAAA,EACjD,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,EAAE,UAAU,MAAA,EAAQ,QAAA,EAAU,UAAS,GAAI,IAAI,IAAI,WAAW,CAAA;AACpE,EAAA,MAAM,SAAS,QAAA,KAAa,QAAA;AAM5B,EAAA,IAAI,QAAA,GAAqD,KAAA;AACzD,EAAA,IAAI,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,QAAA,KAAa,UAAU,MAAA,EAAQ;AACpD,IAAA,QAAA,GAAW,MAAA;AAAA,EACb;AAKA,EAAA,MAAM,OAAO,QAAA,CAAS,QAAA,CAAS,CAAA,EAAG,UAAU,gBAAgB,CAAA,GACxD,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,gBAAA,CAAiB,MAAM,IAC1C,CAAA,EAAG,QAAQ,IAAI,UAAU,CAAA,CAAA;AAE7B,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAS;AAClC,CAAA;AAGO,MAAM,kBAAA,CAAmB;AAAA,EAO9B,YACmB,OAAA,EAQjB;AARiB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AASjB,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,uBAAA;AAEpD,IAAA,IAAA,CAAK,WAAA,GAAc,CAAA,EAAG,OAAA,CAAQ,UAAU,CAAA,MAAA,CAAA;AACxC,IAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA,EAAG,OAAA,CAAQ,UAAU,CAAA,cAAA,CAAA;AAC/C,IAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA,EAAG,OAAA,CAAQ,UAAU,CAAA,cAAA,CAAA;AAC/C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,eAAA,GAClBA,4BAAA,CAAuB,OAAA,CAAQ,eAAe,CAAA,GAC9C,gBAAA;AAAA,EACN;AAAA,EAxBiB,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,MAAA;AAAA,EAsBT,SAAA,CAAU,MAAA,EAAiB,UAAA,GAAqB,EAAA,EAAI;AAC1D,IAAA,MAAM,YAAA,GAAe,KAAK,gBAAA,CAAiB;AAAA,MACzC,UAAA,EAAY,KAAK,OAAA,CAAQ,UAAA;AAAA,MACzB,OAAA,EAAS,KAAK,OAAA,CAAQ,OAAA;AAAA,MACtB,WAAA,EAAa,KAAK,OAAA,CAAQ,WAAA;AAAA,MAC1B,SAAA,EAAW,MAAA,IAAU,IAAA,CAAK,OAAA,CAAQ;AAAA,KACnC,CAAA;AACD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,KAAA;AAAA,MACV,GAAG,YAAA;AAAA,MACH,IAAA,EAAM,aAAa,IAAA,GAAO;AAAA,KAC5B;AAAA,EACF;AAAA,EAEA,QAAA,CAAS,GAAA,EAAe,KAAA,EAAe,MAAA,EAAuB;AAC5D,IAAA,IAAA,CAAK,SAAA;AAAA,MACH,GAAA;AAAA,MACA,IAAA,CAAK,WAAA;AAAA,MACL,KAAA;AAAA,MACA,cAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,eAAA,CAAgB,GAAA,EAAe,YAAA,EAAsB,MAAA,EAAuB;AAC1E,IAAA,IAAA,CAAK,SAAA;AAAA,MACH,GAAA;AAAA,MACA,IAAA,CAAK,kBAAA;AAAA,MACL,YAAA;AAAA,MACA,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,KACF;AAAA,EACF;AAAA,EAEA,kBAAA,CAAmB,KAAe,MAAA,EAAuB;AACvD,IAAA,IAAA,CAAK,YAAA,CAAa,GAAA,EAAK,IAAA,CAAK,kBAAA,EAAoB,MAAM,CAAA;AAAA,EACxD;AAAA,EAEA,mBAAA,CAAoB,KAAe,MAAA,EAAuB;AACxD,IAAA,IAAA,CAAK,YAAA,CAAa,GAAA,EAAK,IAAA,CAAK,kBAAA,EAAoB,MAAM,CAAA;AAAA,EACxD;AAAA,EAEA,gBAAA,CAAiB,GAAA,EAAe,KAAA,EAAe,MAAA,EAAuB;AACpE,IAAA,IAAA,CAAK,UAAU,GAAA,EAAK,IAAA,CAAK,oBAAoB,KAAA,EAAO,IAAA,CAAK,QAAQ,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,SAAS,GAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,WAAW,CAAA;AAAA,EAC7C;AAAA,EAEA,gBAAgB,GAAA,EAAkC;AAChD,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,EACpD;AAAA,EAEA,iBAAiB,GAAA,EAAkC;AACjD,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,EACpD;AAAA,EAEQ,UACN,GAAA,EACA,IAAA,EACA,KACA,MAAA,EACA,MAAA,EACA,aAAqB,EAAA,EACX;AACV,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,MAAA;AAAA,MACA,GAAG,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,UAAU;AAAA,KACtC;AACA,IAAA,MAAM,MAAM,GAAA,CAAI,GAAA;AAChB,IAAA,IAAI,MAAA,GAAS,GAAA;AACb,IAAA,IAAI,GAAA,CAAI,SAAS,0BAAA,EAA4B;AAC3C,MAAA,MAAM,sBAAA,GAAyB,CAAC,CAAC,GAAA,CAAI,QAAQ,IAAI,CAAA;AACjD,MAAA,IAAI,sBAAA,EAAwB;AAC1B,QAAA,MAAA,GAAS,OAAO,MAAA,CAAO,IAAA,EAAM,EAAA,EAAI,IAAA,CAAK,wBAAwB,CAAA;AAAA,MAChE;AAEA,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,mBAAA,CAAoB,GAAA,EAAK,0BAA0B,CAAA;AACxE,MAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,WAAA,KAAgB;AACtC,QAAA,MAAA,GAAS,MAAA,CAAO,MAAA;AAAA,UACd,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AAAA,UACvD,KAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AACD,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,sBAAsB,kBAAA,CAAmB,mBAAA;AAAA,MAC7C,GAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,mBAAA,EAAqB;AACvB,MAAA,KAAA,IAAS,WAAA,GAAc,KAAK,WAAA,EAAA,EAAe;AACzC,QAAA,MAAM,GAAA,GAAM,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AACnE,QAAA,MAAM,MAAA,GAAS,CAAC,CAAC,GAAA,CAAI,QAAQ,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA;AAAA,QACF;AACA,QAAA,MAAA,GAAS,OAAO,MAAA,CAAO,GAAA,EAAK,EAAA,EAAI,IAAA,CAAK,wBAAwB,CAAA;AAAA,MAC/D;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,qBAAqB,uBAAA,EAAyB;AACrD,MAAA,MAAM,EAAE,UAAU,MAAA,EAAO,GAAI,IAAI,GAAA,CAAI,IAAA,CAAK,QAAQ,WAAW,CAAA;AAC7D,MAAA,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,EAAA,EAAI;AAAA,QAC/B,GAAG,KAAK,sBAAA,EAAuB;AAAA,QAC/B,MAAA,EAAQ,IAAI,MAAM,CAAA;AAAA,OACnB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AAAA,EACzC;AAAA,EAEQ,SAAA,CAAU,KAAc,IAAA,EAAkC;AAChE,IAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,mBAAA,CAAoB,GAAA,EAAK,IAAI,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,IAAI,WAAA,GAAc,CAAA;AAClB,MAAA,IAAI,QACF,GAAA,CAAI,OAAA,CAAQ,mBAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAC,CAAA;AACtE,MAAA,OAAO,KAAA,EAAO;AACZ,QAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,QAAA,WAAA,EAAA;AACA,QAAA,KAAA,GACE,IAAI,OAAA,CAAQ,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAC,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACvB;AACA,IAAA,OAAO,GAAA,CAAI,QAAQ,IAAI,CAAA;AAAA,EACzB;AAAA,EAEQ,YAAA,CAAa,GAAA,EAAe,IAAA,EAAc,MAAA,EAA2B;AAC3E,IAAA,MAAM,MAAM,GAAA,CAAI,GAAA;AAChB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,sBAAA,CAAuB,MAAM,CAAA;AAClD,IAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,mBAAA,CAAoB,GAAA,EAAK,IAAI,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,sBAAA,GAAyB,CAAC,CAAC,GAAA,CAAI,QAAQ,IAAI,CAAA;AACjD,MAAA,IAAI,SAAmB,sBAAA,GACnB,GAAA,CAAI,OAAO,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,GAC5B,GAAA;AACJ,MAAA,KAAA,IAAS,WAAA,GAAc,KAAK,WAAA,EAAA,EAAe;AACzC,QAAA,MAAM,GAAA,GAAM,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AACnE,QAAA,MAAM,MAAA,GAAS,CAAC,CAAC,GAAA,CAAI,QAAQ,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA;AAAA,QACF;AACA,QAAA,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,EAAA,EAAI,OAAO,CAAA;AAAA,MACzC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA;AAAA,EACrC;AAAA,EAEQ,mBAAA,CAAoB,KAAa,SAAA,EAA6B;AACpE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,SAAS,SAAS,CAAA;AAClD,IAAA,MAAM,MAAA,GAAmB,MAAc,SAAS,CAAA;AAEhD,IAAA,IAAI,MAAA,GAAiB,CAAA;AACrB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,EAAW,CAAA,EAAA,EAAK;AAClC,MAAA,MAAA,CAAO,CAAC,CAAA,GAAI,GAAA,CAAI,SAAA,CAAU,MAAA,EAAQ,SAAS,SAAS,CAAA;AACpD,MAAA,MAAA,IAAU,SAAA;AAAA,IACZ;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,OAAe,mBAAA,CAAoB,GAAA,EAAc,IAAA,EAAuB;AACtE,IAAA,OAAO,CAAC,CAAC,GAAA,CAAI,OAAA,CAAQ,mBAAmB,kBAAA,CAAmB,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,EACrE;AAAA,EAEA,OAAe,kBAAA,CAAmB,IAAA,EAAc,UAAA,EAA4B;AAC1E,IAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,EAC9B;AAAA,EAEQ,uBAAuB,MAAA,EAAgC;AAC7D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,CAAA;AAAA,MACR,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM;AAAA,KAC1B;AAAA,EACF;AACF;;;;"}
+{"version":3,"file":"OAuthCookieManager.cjs.js","sources":["../../src/oauth/OAuthCookieManager.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { CookieOptions, Request, Response } from 'express';\nimport { CookieConfigurer } from '../types';\nimport { HumanDuration, durationToMilliseconds } from '@backstage/types';\n\nconst THOUSAND_DAYS_MS = 1000 * 24 * 60 * 60 * 1000;\nconst TEN_MINUTES_MS = 600 * 1000;\n\nconst MAX_COOKIE_SIZE_CHARACTERS = 4000;\n\nconst defaultCookieConfigurer: CookieConfigurer = ({\n  callbackUrl,\n  providerId,\n  appOrigin,\n}) => {\n  const { hostname: domain, pathname, protocol } = new URL(callbackUrl);\n  const secure = protocol === 'https:';\n\n  // For situations where the auth-backend is running on a\n  // different domain than the app, we set the SameSite attribute\n  // to 'none' to allow third-party access to the cookie, but\n  // only if it's in a secure context (https).\n  let sameSite: ReturnType<CookieConfigurer>['sameSite'] = 'lax';\n  if (new URL(appOrigin).hostname !== domain && secure) {\n    sameSite = 'none';\n  }\n\n  // If the provider supports callbackUrls, the pathname will\n  // contain the complete path to the frame handler so we need\n  // to slice off the trailing part of the path.\n  const path = pathname.endsWith(`${providerId}/handler/frame`)\n    ? pathname.slice(0, -'/handler/frame'.length)\n    : `${pathname}/${providerId}`;\n\n  return { path, secure, sameSite };\n};\n\n/** @internal */\nexport class OAuthCookieManager {\n  private readonly cookieConfigurer: CookieConfigurer;\n  private readonly nonceCookie: string;\n  private readonly refreshTokenCookie: string;\n  private readonly grantedScopeCookie: string;\n  private readonly maxAge: number;\n\n  constructor(\n    private readonly options: {\n      providerId: string;\n      defaultAppOrigin: string;\n      baseUrl: string;\n      callbackUrl: string;\n      cookieConfigurer?: CookieConfigurer;\n      sessionDuration?: HumanDuration;\n    },\n  ) {\n    this.cookieConfigurer = options.cookieConfigurer ?? defaultCookieConfigurer;\n\n    this.nonceCookie = `${options.providerId}-nonce`;\n    this.refreshTokenCookie = `${options.providerId}-refresh-token`;\n    this.grantedScopeCookie = `${options.providerId}-granted-scope`;\n    this.maxAge = options.sessionDuration\n      ? durationToMilliseconds(options.sessionDuration)\n      : THOUSAND_DAYS_MS;\n  }\n\n  private getConfig(origin?: string, pathSuffix: string = '') {\n    const cookieConfig = this.cookieConfigurer({\n      providerId: this.options.providerId,\n      baseUrl: this.options.baseUrl,\n      callbackUrl: this.options.callbackUrl,\n      appOrigin: origin ?? this.options.defaultAppOrigin,\n    });\n    return {\n      httpOnly: true,\n      sameSite: 'lax' as const,\n      ...cookieConfig,\n      path: cookieConfig.path + pathSuffix,\n    };\n  }\n\n  setNonce(res: Response, nonce: string, origin?: string): void {\n    this.setCookie(\n      res,\n      this.nonceCookie,\n      nonce,\n      TEN_MINUTES_MS,\n      origin,\n      '/handler',\n    );\n  }\n\n  setRefreshToken(res: Response, refreshToken: string, origin?: string): void {\n    this.setCookie(\n      res,\n      this.refreshTokenCookie,\n      refreshToken,\n      this.maxAge,\n      origin,\n    );\n  }\n\n  removeRefreshToken(res: Response, origin?: string): void {\n    this.removeCookie(res, this.refreshTokenCookie, origin);\n  }\n\n  removeGrantedScopes(res: Response, origin?: string): void {\n    this.removeCookie(res, this.grantedScopeCookie, origin);\n  }\n\n  setGrantedScopes(res: Response, scope: string, origin?: string): void {\n    this.setCookie(res, this.grantedScopeCookie, scope, this.maxAge, origin);\n  }\n\n  getNonce(req: Request): string | undefined {\n    return this.getCookie(req, this.nonceCookie);\n  }\n\n  getRefreshToken(req: Request): string | undefined {\n    return this.getCookie(req, this.refreshTokenCookie);\n  }\n\n  getGrantedScopes(req: Request): string | undefined {\n    return this.getCookie(req, this.grantedScopeCookie);\n  }\n\n  private setCookie(\n    res: Response,\n    name: string,\n    val: string,\n    maxAge: number,\n    origin?: string,\n    pathSuffix: string = '',\n  ): Response {\n    const options = {\n      maxAge,\n      ...this.getConfig(origin, pathSuffix),\n    };\n    const req = res.req;\n    let output = res;\n\n    const chunkedFormatExists = OAuthCookieManager.chunkedCookieExists(\n      req,\n      name,\n    );\n\n    // If using the default cookieConfigurer, delete old cookie with domain\n    // explicitly set to the callbackUrl's domain (legacy behavior)\n    if (this.cookieConfigurer === defaultCookieConfigurer) {\n      const { hostname: domain } = new URL(this.options.callbackUrl);\n      output = output.cookie(name, '', {\n        ...this.getRemoveCookieOptions(),\n        domain: domain,\n      });\n\n      if (chunkedFormatExists) {\n        for (let chunkNumber = 0; ; chunkNumber++) {\n          const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);\n          const exists = !!req.cookies[key];\n          if (!exists) {\n            break;\n          }\n          output = output.cookie(key, '', {\n            ...this.getRemoveCookieOptions(),\n            domain: domain,\n          });\n        }\n      }\n    }\n\n    if (val.length > MAX_COOKIE_SIZE_CHARACTERS) {\n      const nonChunkedFormatExists = !!req.cookies[name];\n      if (nonChunkedFormatExists) {\n        output = output.cookie(name, '', this.getRemoveCookieOptions());\n      }\n\n      const chunked = this.splitCookieToChunks(val, MAX_COOKIE_SIZE_CHARACTERS);\n      chunked.forEach((value, chunkNumber) => {\n        output = output.cookie(\n          OAuthCookieManager.getCookieChunkName(name, chunkNumber),\n          value,\n          options,\n        );\n      });\n      return output;\n    }\n\n    if (chunkedFormatExists) {\n      for (let chunkNumber = 0; ; chunkNumber++) {\n        const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);\n        const exists = !!req.cookies[key];\n        if (!exists) {\n          break;\n        }\n        output = output.cookie(key, '', this.getRemoveCookieOptions());\n      }\n    }\n\n    return output.cookie(name, val, options);\n  }\n\n  private getCookie(req: Request, name: string): string | undefined {\n    const isChunked = OAuthCookieManager.chunkedCookieExists(req, name);\n    if (isChunked) {\n      const chunks: string[] = [];\n      let chunkNumber = 0;\n      let chunk =\n        req.cookies[OAuthCookieManager.getCookieChunkName(name, chunkNumber)];\n      while (chunk) {\n        chunks.push(chunk);\n        chunkNumber++;\n        chunk =\n          req.cookies[OAuthCookieManager.getCookieChunkName(name, chunkNumber)];\n      }\n      return chunks.join('');\n    }\n    return req.cookies[name];\n  }\n\n  private removeCookie(res: Response, name: string, origin?: string): Response {\n    const req = res.req;\n    const options = this.getRemoveCookieOptions(origin);\n    const isChunked = OAuthCookieManager.chunkedCookieExists(req, name);\n    if (isChunked) {\n      const nonChunkedFormatExists = !!req.cookies[name];\n      let output: Response = nonChunkedFormatExists\n        ? res.cookie(name, '', options)\n        : res;\n      for (let chunkNumber = 0; ; chunkNumber++) {\n        const key = OAuthCookieManager.getCookieChunkName(name, chunkNumber);\n        const exists = !!req.cookies[key];\n        if (!exists) {\n          break;\n        }\n        output = output.cookie(key, '', options);\n      }\n      return output;\n    }\n    return res.cookie(name, '', options);\n  }\n\n  private splitCookieToChunks(val: string, chunkSize: number): string[] {\n    const numChunks = Math.ceil(val.length / chunkSize);\n    const chunks: string[] = Array<string>(numChunks);\n\n    let offset: number = 0;\n    for (let i = 0; i < numChunks; i++) {\n      chunks[i] = val.substring(offset, offset + chunkSize);\n      offset += chunkSize;\n    }\n    return chunks;\n  }\n\n  private static chunkedCookieExists(req: Request, name: string): boolean {\n    return !!req.cookies[OAuthCookieManager.getCookieChunkName(name, 0)];\n  }\n\n  private static getCookieChunkName(name: string, chunkIndex: number): string {\n    return `${name}-${chunkIndex}`;\n  }\n\n  private getRemoveCookieOptions(origin?: string): CookieOptions {\n    return {\n      maxAge: 0,\n      ...this.getConfig(origin),\n    };\n  }\n}\n"],"names":["durationToMilliseconds"],"mappings":";;;;AAoBA,MAAM,gBAAA,GAAmB,GAAA,GAAO,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAC/C,MAAM,iBAAiB,GAAA,GAAM,GAAA;AAE7B,MAAM,0BAAA,GAA6B,GAAA;AAEnC,MAAM,0BAA4C,CAAC;AAAA,EACjD,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,KAAM;AACJ,EAAA,MAAM,EAAE,UAAU,MAAA,EAAQ,QAAA,EAAU,UAAS,GAAI,IAAI,IAAI,WAAW,CAAA;AACpE,EAAA,MAAM,SAAS,QAAA,KAAa,QAAA;AAM5B,EAAA,IAAI,QAAA,GAAqD,KAAA;AACzD,EAAA,IAAI,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,QAAA,KAAa,UAAU,MAAA,EAAQ;AACpD,IAAA,QAAA,GAAW,MAAA;AAAA,EACb;AAKA,EAAA,MAAM,OAAO,QAAA,CAAS,QAAA,CAAS,CAAA,EAAG,UAAU,gBAAgB,CAAA,GACxD,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,gBAAA,CAAiB,MAAM,IAC1C,CAAA,EAAG,QAAQ,IAAI,UAAU,CAAA,CAAA;AAE7B,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAS;AAClC,CAAA;AAGO,MAAM,kBAAA,CAAmB;AAAA,EAO9B,YACmB,OAAA,EAQjB;AARiB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AASjB,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,uBAAA;AAEpD,IAAA,IAAA,CAAK,WAAA,GAAc,CAAA,EAAG,OAAA,CAAQ,UAAU,CAAA,MAAA,CAAA;AACxC,IAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA,EAAG,OAAA,CAAQ,UAAU,CAAA,cAAA,CAAA;AAC/C,IAAA,IAAA,CAAK,kBAAA,GAAqB,CAAA,EAAG,OAAA,CAAQ,UAAU,CAAA,cAAA,CAAA;AAC/C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,eAAA,GAClBA,4BAAA,CAAuB,OAAA,CAAQ,eAAe,CAAA,GAC9C,gBAAA;AAAA,EACN;AAAA,EAxBiB,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,MAAA;AAAA,EAsBT,SAAA,CAAU,MAAA,EAAiB,UAAA,GAAqB,EAAA,EAAI;AAC1D,IAAA,MAAM,YAAA,GAAe,KAAK,gBAAA,CAAiB;AAAA,MACzC,UAAA,EAAY,KAAK,OAAA,CAAQ,UAAA;AAAA,MACzB,OAAA,EAAS,KAAK,OAAA,CAAQ,OAAA;AAAA,MACtB,WAAA,EAAa,KAAK,OAAA,CAAQ,WAAA;AAAA,MAC1B,SAAA,EAAW,MAAA,IAAU,IAAA,CAAK,OAAA,CAAQ;AAAA,KACnC,CAAA;AACD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,KAAA;AAAA,MACV,GAAG,YAAA;AAAA,MACH,IAAA,EAAM,aAAa,IAAA,GAAO;AAAA,KAC5B;AAAA,EACF;AAAA,EAEA,QAAA,CAAS,GAAA,EAAe,KAAA,EAAe,MAAA,EAAuB;AAC5D,IAAA,IAAA,CAAK,SAAA;AAAA,MACH,GAAA;AAAA,MACA,IAAA,CAAK,WAAA;AAAA,MACL,KAAA;AAAA,MACA,cAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,eAAA,CAAgB,GAAA,EAAe,YAAA,EAAsB,MAAA,EAAuB;AAC1E,IAAA,IAAA,CAAK,SAAA;AAAA,MACH,GAAA;AAAA,MACA,IAAA,CAAK,kBAAA;AAAA,MACL,YAAA;AAAA,MACA,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,KACF;AAAA,EACF;AAAA,EAEA,kBAAA,CAAmB,KAAe,MAAA,EAAuB;AACvD,IAAA,IAAA,CAAK,YAAA,CAAa,GAAA,EAAK,IAAA,CAAK,kBAAA,EAAoB,MAAM,CAAA;AAAA,EACxD;AAAA,EAEA,mBAAA,CAAoB,KAAe,MAAA,EAAuB;AACxD,IAAA,IAAA,CAAK,YAAA,CAAa,GAAA,EAAK,IAAA,CAAK,kBAAA,EAAoB,MAAM,CAAA;AAAA,EACxD;AAAA,EAEA,gBAAA,CAAiB,GAAA,EAAe,KAAA,EAAe,MAAA,EAAuB;AACpE,IAAA,IAAA,CAAK,UAAU,GAAA,EAAK,IAAA,CAAK,oBAAoB,KAAA,EAAO,IAAA,CAAK,QAAQ,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,SAAS,GAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,WAAW,CAAA;AAAA,EAC7C;AAAA,EAEA,gBAAgB,GAAA,EAAkC;AAChD,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,EACpD;AAAA,EAEA,iBAAiB,GAAA,EAAkC;AACjD,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,kBAAkB,CAAA;AAAA,EACpD;AAAA,EAEQ,UACN,GAAA,EACA,IAAA,EACA,KACA,MAAA,EACA,MAAA,EACA,aAAqB,EAAA,EACX;AACV,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,MAAA;AAAA,MACA,GAAG,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,UAAU;AAAA,KACtC;AACA,IAAA,MAAM,MAAM,GAAA,CAAI,GAAA;AAChB,IAAA,IAAI,MAAA,GAAS,GAAA;AAEb,IAAA,MAAM,sBAAsB,kBAAA,CAAmB,mBAAA;AAAA,MAC7C,GAAA;AAAA,MACA;AAAA,KACF;AAIA,IAAA,IAAI,IAAA,CAAK,qBAAqB,uBAAA,EAAyB;AACrD,MAAA,MAAM,EAAE,UAAU,MAAA,EAAO,GAAI,IAAI,GAAA,CAAI,IAAA,CAAK,QAAQ,WAAW,CAAA;AAC7D,MAAA,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,EAAA,EAAI;AAAA,QAC/B,GAAG,KAAK,sBAAA,EAAuB;AAAA,QAC/B;AAAA,OACD,CAAA;AAED,MAAA,IAAI,mBAAA,EAAqB;AACvB,QAAA,KAAA,IAAS,WAAA,GAAc,KAAK,WAAA,EAAA,EAAe;AACzC,UAAA,MAAM,GAAA,GAAM,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AACnE,UAAA,MAAM,MAAA,GAAS,CAAC,CAAC,GAAA,CAAI,QAAQ,GAAG,CAAA;AAChC,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA;AAAA,UACF;AACA,UAAA,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,EAAA,EAAI;AAAA,YAC9B,GAAG,KAAK,sBAAA,EAAuB;AAAA,YAC/B;AAAA,WACD,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,SAAS,0BAAA,EAA4B;AAC3C,MAAA,MAAM,sBAAA,GAAyB,CAAC,CAAC,GAAA,CAAI,QAAQ,IAAI,CAAA;AACjD,MAAA,IAAI,sBAAA,EAAwB;AAC1B,QAAA,MAAA,GAAS,OAAO,MAAA,CAAO,IAAA,EAAM,EAAA,EAAI,IAAA,CAAK,wBAAwB,CAAA;AAAA,MAChE;AAEA,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,mBAAA,CAAoB,GAAA,EAAK,0BAA0B,CAAA;AACxE,MAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,WAAA,KAAgB;AACtC,QAAA,MAAA,GAAS,MAAA,CAAO,MAAA;AAAA,UACd,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AAAA,UACvD,KAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,CAAC,CAAA;AACD,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,mBAAA,EAAqB;AACvB,MAAA,KAAA,IAAS,WAAA,GAAc,KAAK,WAAA,EAAA,EAAe;AACzC,QAAA,MAAM,GAAA,GAAM,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AACnE,QAAA,MAAM,MAAA,GAAS,CAAC,CAAC,GAAA,CAAI,QAAQ,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA;AAAA,QACF;AACA,QAAA,MAAA,GAAS,OAAO,MAAA,CAAO,GAAA,EAAK,EAAA,EAAI,IAAA,CAAK,wBAAwB,CAAA;AAAA,MAC/D;AAAA,IACF;AAEA,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AAAA,EACzC;AAAA,EAEQ,SAAA,CAAU,KAAc,IAAA,EAAkC;AAChE,IAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,mBAAA,CAAoB,GAAA,EAAK,IAAI,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,IAAI,WAAA,GAAc,CAAA;AAClB,MAAA,IAAI,QACF,GAAA,CAAI,OAAA,CAAQ,mBAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAC,CAAA;AACtE,MAAA,OAAO,KAAA,EAAO;AACZ,QAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,QAAA,WAAA,EAAA;AACA,QAAA,KAAA,GACE,IAAI,OAAA,CAAQ,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAC,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACvB;AACA,IAAA,OAAO,GAAA,CAAI,QAAQ,IAAI,CAAA;AAAA,EACzB;AAAA,EAEQ,YAAA,CAAa,GAAA,EAAe,IAAA,EAAc,MAAA,EAA2B;AAC3E,IAAA,MAAM,MAAM,GAAA,CAAI,GAAA;AAChB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,sBAAA,CAAuB,MAAM,CAAA;AAClD,IAAA,MAAM,SAAA,GAAY,kBAAA,CAAmB,mBAAA,CAAoB,GAAA,EAAK,IAAI,CAAA;AAClE,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,sBAAA,GAAyB,CAAC,CAAC,GAAA,CAAI,QAAQ,IAAI,CAAA;AACjD,MAAA,IAAI,SAAmB,sBAAA,GACnB,GAAA,CAAI,OAAO,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,GAC5B,GAAA;AACJ,MAAA,KAAA,IAAS,WAAA,GAAc,KAAK,WAAA,EAAA,EAAe;AACzC,QAAA,MAAM,GAAA,GAAM,kBAAA,CAAmB,kBAAA,CAAmB,IAAA,EAAM,WAAW,CAAA;AACnE,QAAA,MAAM,MAAA,GAAS,CAAC,CAAC,GAAA,CAAI,QAAQ,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA;AAAA,QACF;AACA,QAAA,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,EAAA,EAAI,OAAO,CAAA;AAAA,MACzC;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA;AAAA,EACrC;AAAA,EAEQ,mBAAA,CAAoB,KAAa,SAAA,EAA6B;AACpE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,SAAS,SAAS,CAAA;AAClD,IAAA,MAAM,MAAA,GAAmB,MAAc,SAAS,CAAA;AAEhD,IAAA,IAAI,MAAA,GAAiB,CAAA;AACrB,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,EAAW,CAAA,EAAA,EAAK;AAClC,MAAA,MAAA,CAAO,CAAC,CAAA,GAAI,GAAA,CAAI,SAAA,CAAU,MAAA,EAAQ,SAAS,SAAS,CAAA;AACpD,MAAA,MAAA,IAAU,SAAA;AAAA,IACZ;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,OAAe,mBAAA,CAAoB,GAAA,EAAc,IAAA,EAAuB;AACtE,IAAA,OAAO,CAAC,CAAC,GAAA,CAAI,OAAA,CAAQ,mBAAmB,kBAAA,CAAmB,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,EACrE;AAAA,EAEA,OAAe,kBAAA,CAAmB,IAAA,EAAc,UAAA,EAA4B;AAC1E,IAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,EAC9B;AAAA,EAEQ,uBAAuB,MAAA,EAAgC;AAC7D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,CAAA;AAAA,MACR,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM;AAAA,KAC1B;AAAA,EACF;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-node",
-  "version": "0.6.9",
+  "version": "0.6.10-next.1",
   "backstage": {
     "role": "node-library",
     "pluginId": "auth",
@@ -38,15 +38,15 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.5.0",
-    "@backstage/catalog-client": "^1.12.1",
-    "@backstage/catalog-model": "^1.7.6",
-    "@backstage/config": "^1.3.6",
-    "@backstage/errors": "^1.2.7",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-plugin-api": "1.6.0-next.1",
+    "@backstage/catalog-client": "1.12.1",
+    "@backstage/catalog-model": "1.7.6",
+    "@backstage/config": "1.3.6",
+    "@backstage/errors": "1.2.7",
+    "@backstage/types": "1.2.2",
     "@types/express": "^4.17.6",
     "@types/passport": "^1.0.3",
-    "express": "^4.17.1",
+    "express": "^4.22.0",
     "jose": "^5.0.0",
     "lodash": "^4.17.21",
     "passport": "^0.7.0",
@@ -55,9 +55,9 @@
     "zod-validation-error": "^3.4.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.13.1",
-    "@backstage/backend-test-utils": "^1.10.0",
-    "@backstage/cli": "^0.34.5",
+    "@backstage/backend-defaults": "0.14.0-next.1",
+    "@backstage/backend-test-utils": "1.10.2-next.1",
+    "@backstage/cli": "0.35.0-next.2",
     "cookie-parser": "^1.4.6",
     "express-promise-router": "^4.1.1",
     "lodash": "^4.17.21",