@backstage/plugin-gateway-backend 1.1.0-next.1 → 1.1.1-next.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @backstage/plugin-gateway-backend
 
+## 1.1.1-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.5.1-next.0
+
+## 1.1.0
+
+### Minor Changes
+
+- 229f63e: Added hop count tracking to prevent proxy loops. The gateway now tracks the number of proxy hops using the `backstage-gateway-hops` header and rejects requests that exceed 3 hops with a 508 Loop Detected error.
+- a17d9df: Update usage of the `instanceMetadata` service.
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.5.0
+
 ## 1.1.0-next.1
 
 ### Minor Changes

package/dist/plugin.cjs.js

@@ -18,7 +18,9 @@ const gatewayPlugin = backendPluginApi.createBackendPlugin({
           "/api/:pluginId",
           await router.createRouter({
             discovery,
-            instanceMeta})
+            instanceMeta,
+            logger
+          })
         );
       }
     });

package/dist/plugin.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { createRouter } from './router';\nimport { Handler } from 'express';\n\n/**\n * gateway backend plugin\n *\n * @public\n */\nexport const gatewayPlugin = createBackendPlugin({\n  pluginId: 'gateway',\n  register(env) {\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        rootHttpRouter: coreServices.rootHttpRouter,\n        instanceMeta: coreServices.rootInstanceMetadata,\n        discovery: coreServices.discovery,\n      },\n      async init({ logger, discovery, instanceMeta, rootHttpRouter }) {\n        rootHttpRouter.use(\n          '/api/:pluginId',\n          (await createRouter({\n            discovery,\n            instanceMeta,\n            logger,\n          })) as Handler,\n        );\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","coreServices","createRouter"],"mappings":";;;;;AA2BO,MAAM,gBAAgBA,oCAAA,CAAoB;AAAA,EAC/C,QAAA,EAAU,SAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,QAAQC,6BAAA,CAAa,MAAA;AAAA,QACrB,gBAAgBA,6BAAA,CAAa,cAAA;AAAA,QAC7B,cAAcA,6BAAA,CAAa,oBAAA;AAAA,QAC3B,WAAWA,6BAAA,CAAa;AAAA,OAC1B;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,QAAQ,SAAA,EAAW,YAAA,EAAc,gBAAe,EAAG;AAC9D,QAAA,cAAA,CAAe,GAAA;AAAA,UACb,gBAAA;AAAA,UACC,MAAMC,mBAAA,CAAa;AAAA,YAClB,SAAA;AAAA,YACA,YAEF,CAAC;AAAA,SACH;AAAA,MACF;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}
+{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { createRouter } from './router';\nimport { Handler } from 'express';\n\n/**\n * gateway backend plugin\n *\n * @public\n */\nexport const gatewayPlugin = createBackendPlugin({\n  pluginId: 'gateway',\n  register(env) {\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        rootHttpRouter: coreServices.rootHttpRouter,\n        instanceMeta: coreServices.rootInstanceMetadata,\n        discovery: coreServices.discovery,\n      },\n      async init({ logger, discovery, instanceMeta, rootHttpRouter }) {\n        rootHttpRouter.use(\n          '/api/:pluginId',\n          (await createRouter({\n            discovery,\n            instanceMeta,\n            logger,\n          })) as Handler,\n        );\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","coreServices","createRouter"],"mappings":";;;;;AA2BO,MAAM,gBAAgBA,oCAAA,CAAoB;AAAA,EAC/C,QAAA,EAAU,SAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,QAAQC,6BAAA,CAAa,MAAA;AAAA,QACrB,gBAAgBA,6BAAA,CAAa,cAAA;AAAA,QAC7B,cAAcA,6BAAA,CAAa,oBAAA;AAAA,QAC3B,WAAWA,6BAAA,CAAa;AAAA,OAC1B;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,QAAQ,SAAA,EAAW,YAAA,EAAc,gBAAe,EAAG;AAC9D,QAAA,cAAA,CAAe,GAAA;AAAA,UACb,gBAAA;AAAA,UACC,MAAMC,mBAAA,CAAa;AAAA,YAClB,SAAA;AAAA,YACA,YAAA;AAAA,YACA;AAAA,WACD;AAAA,SACH;AAAA,MACF;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}

package/dist/router.cjs.js

@@ -4,9 +4,12 @@ var httpProxyMiddleware = require('http-proxy-middleware');
 var api = require('@opentelemetry/api');
 var core = require('@opentelemetry/core');
 
+const MAX_HOPS = 3;
+const HOPS_HEADER = "backstage-gateway-hops";
 async function createRouter({
   discovery,
-  instanceMeta
+  instanceMeta,
+  logger
 }) {
   const plugins = await instanceMeta.getInstalledPlugins();
   const localPluginIds = new Set(plugins.map((f) => f.pluginId));
@@ -17,6 +20,10 @@ async function createRouter({
       return discovery.getBaseUrl(pluginId);
     },
     on: {
+      proxyReq(proxyReq, req) {
+        const currentHops = Math.max(parseInt(req.headers[HOPS_HEADER], 10), 0) || 0;
+        proxyReq.setHeader(HOPS_HEADER, currentHops + 1);
+      },
       proxyRes(proxyRes, _req, res) {
         proxyRes.on("close", () => {
           if (!res.writableEnded) {
@@ -31,6 +38,19 @@ async function createRouter({
       next();
       return;
     }
+    const currentHops = parseInt(req.headers[HOPS_HEADER], 10) || 0;
+    if (currentHops >= MAX_HOPS) {
+      logger.warn(
+        `Proxy loop detected for plugin '${req.params.pluginId}': request exceeded maximum hop count (${currentHops})`
+      );
+      res.status(508).json({
+        error: {
+          name: "LoopDetectedError",
+          message: `Maximum proxy hop count exceeded (${currentHops})`
+        }
+      });
+      return;
+    }
     const rpcMetadata = core.getRPCMetadata(api.context.active());
     if (rpcMetadata) {
       rpcMetadata.route = req.baseUrl;

package/dist/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../src/router.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  DiscoveryService,\n  RootInstanceMetadataService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport { Request, Response, NextFunction } from 'express';\nimport { createProxyMiddleware } from 'http-proxy-middleware';\nimport { context } from '@opentelemetry/api';\nimport { getRPCMetadata } from '@opentelemetry/core';\n\nexport async function createRouter({\n  discovery,\n  instanceMeta,\n}: {\n  discovery: DiscoveryService;\n  instanceMeta: RootInstanceMetadataService;\n  logger: LoggerService;\n}) {\n  const plugins = await instanceMeta.getInstalledPlugins();\n  const localPluginIds = new Set(plugins.map(f => f.pluginId));\n\n  const proxy = createProxyMiddleware({\n    changeOrigin: true,\n    router: async (req: Request<{ pluginId: string }>) => {\n      const pluginId = req.params.pluginId;\n      return discovery.getBaseUrl(pluginId);\n    },\n    on: {\n      proxyRes(proxyRes, _req, res) {\n        // https://github.com/chimurai/http-proxy-middleware/discussions/765\n        proxyRes.on('close', () => {\n          if (!res.writableEnded) {\n            res.end();\n          }\n        });\n      },\n    },\n  });\n\n  return function proxyMiddleware(\n    req: Request<{ pluginId: string }>,\n    res: Response,\n    next: NextFunction,\n  ) {\n    if (localPluginIds.has(req.params.pluginId)) {\n      next();\n      return;\n    }\n\n    const rpcMetadata = getRPCMetadata(context.active());\n    if (rpcMetadata) {\n      rpcMetadata.route = req.baseUrl;\n    }\n\n    proxy(req, res, next);\n  };\n}\n"],"names":["createProxyMiddleware","getRPCMetadata","context"],"mappings":";;;;;;AAyBA,eAAsB,YAAA,CAAa;AAAA,EACjC,SAAA;AAAA,EACA;AACF,CAAA,EAIG;AACD,EAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,mBAAA,EAAoB;AACvD,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAE3D,EAAA,MAAM,QAAQA,yCAAA,CAAsB;AAAA,IAClC,YAAA,EAAc,IAAA;AAAA,IACd,MAAA,EAAQ,OAAO,GAAA,KAAuC;AACpD,MAAA,MAAM,QAAA,GAAW,IAAI,MAAA,CAAO,QAAA;AAC5B,MAAA,OAAO,SAAA,CAAU,WAAW,QAAQ,CAAA;AAAA,IACtC,CAAA;AAAA,IACA,EAAA,EAAI;AAAA,MACF,QAAA,CAAS,QAAA,EAAU,IAAA,EAAM,GAAA,EAAK;AAE5B,QAAA,QAAA,CAAS,EAAA,CAAG,SAAS,MAAM;AACzB,UAAA,IAAI,CAAC,IAAI,aAAA,EAAe;AACtB,YAAA,GAAA,CAAI,GAAA,EAAI;AAAA,UACV;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAAA;AACF,GACD,CAAA;AAED,EAAA,OAAO,SAAS,eAAA,CACd,GAAA,EACA,GAAA,EACA,IAAA,EACA;AACA,IAAA,IAAI,cAAA,CAAe,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG;AAC3C,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAcC,mBAAA,CAAeC,WAAA,CAAQ,MAAA,EAAQ,CAAA;AACnD,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,WAAA,CAAY,QAAQ,GAAA,CAAI,OAAA;AAAA,IAC1B;AAEA,IAAA,KAAA,CAAM,GAAA,EAAK,KAAK,IAAI,CAAA;AAAA,EACtB,CAAA;AACF;;;;"}
+{"version":3,"file":"router.cjs.js","sources":["../src/router.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  DiscoveryService,\n  RootInstanceMetadataService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport { Request, Response, NextFunction } from 'express';\nimport { createProxyMiddleware } from 'http-proxy-middleware';\nimport { context } from '@opentelemetry/api';\nimport { getRPCMetadata } from '@opentelemetry/core';\n\nconst MAX_HOPS = 3;\nconst HOPS_HEADER = 'backstage-gateway-hops';\n\nexport async function createRouter({\n  discovery,\n  instanceMeta,\n  logger,\n}: {\n  discovery: DiscoveryService;\n  instanceMeta: RootInstanceMetadataService;\n  logger: LoggerService;\n}) {\n  const plugins = await instanceMeta.getInstalledPlugins();\n  const localPluginIds = new Set(plugins.map(f => f.pluginId));\n\n  const proxy = createProxyMiddleware({\n    changeOrigin: true,\n    router: async (req: Request<{ pluginId: string }>) => {\n      const pluginId = req.params.pluginId;\n      return discovery.getBaseUrl(pluginId);\n    },\n    on: {\n      proxyReq(proxyReq, req: Request<{ pluginId: string }>) {\n        const currentHops =\n          Math.max(parseInt(req.headers[HOPS_HEADER] as string, 10), 0) || 0;\n\n        proxyReq.setHeader(HOPS_HEADER, currentHops + 1);\n      },\n      proxyRes(proxyRes, _req, res) {\n        // https://github.com/chimurai/http-proxy-middleware/discussions/765\n        proxyRes.on('close', () => {\n          if (!res.writableEnded) {\n            res.end();\n          }\n        });\n      },\n    },\n  });\n\n  return function proxyMiddleware(\n    req: Request<{ pluginId: string }>,\n    res: Response,\n    next: NextFunction,\n  ) {\n    if (localPluginIds.has(req.params.pluginId)) {\n      next();\n      return;\n    }\n\n    const currentHops = parseInt(req.headers[HOPS_HEADER] as string, 10) || 0;\n    if (currentHops >= MAX_HOPS) {\n      logger.warn(\n        `Proxy loop detected for plugin '${req.params.pluginId}': request exceeded maximum hop count (${currentHops})`,\n      );\n      res.status(508).json({\n        error: {\n          name: 'LoopDetectedError',\n          message: `Maximum proxy hop count exceeded (${currentHops})`,\n        },\n      });\n      return;\n    }\n\n    const rpcMetadata = getRPCMetadata(context.active());\n    if (rpcMetadata) {\n      rpcMetadata.route = req.baseUrl;\n    }\n\n    proxy(req, res, next);\n  };\n}\n"],"names":["createProxyMiddleware","getRPCMetadata","context"],"mappings":";;;;;;AAyBA,MAAM,QAAA,GAAW,CAAA;AACjB,MAAM,WAAA,GAAc,wBAAA;AAEpB,eAAsB,YAAA,CAAa;AAAA,EACjC,SAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAA,EAIG;AACD,EAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,mBAAA,EAAoB;AACvD,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAE3D,EAAA,MAAM,QAAQA,yCAAA,CAAsB;AAAA,IAClC,YAAA,EAAc,IAAA;AAAA,IACd,MAAA,EAAQ,OAAO,GAAA,KAAuC;AACpD,MAAA,MAAM,QAAA,GAAW,IAAI,MAAA,CAAO,QAAA;AAC5B,MAAA,OAAO,SAAA,CAAU,WAAW,QAAQ,CAAA;AAAA,IACtC,CAAA;AAAA,IACA,EAAA,EAAI;AAAA,MACF,QAAA,CAAS,UAAU,GAAA,EAAoC;AACrD,QAAA,MAAM,WAAA,GACJ,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA,EAAa,EAAE,CAAA,EAAG,CAAC,CAAA,IAAK,CAAA;AAEnE,QAAA,QAAA,CAAS,SAAA,CAAU,WAAA,EAAa,WAAA,GAAc,CAAC,CAAA;AAAA,MACjD,CAAA;AAAA,MACA,QAAA,CAAS,QAAA,EAAU,IAAA,EAAM,GAAA,EAAK;AAE5B,QAAA,QAAA,CAAS,EAAA,CAAG,SAAS,MAAM;AACzB,UAAA,IAAI,CAAC,IAAI,aAAA,EAAe;AACtB,YAAA,GAAA,CAAI,GAAA,EAAI;AAAA,UACV;AAAA,QACF,CAAC,CAAA;AAAA,MACH;AAAA;AACF,GACD,CAAA;AAED,EAAA,OAAO,SAAS,eAAA,CACd,GAAA,EACA,GAAA,EACA,IAAA,EACA;AACA,IAAA,IAAI,cAAA,CAAe,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG;AAC3C,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,cAAc,QAAA,CAAS,GAAA,CAAI,QAAQ,WAAW,CAAA,EAAa,EAAE,CAAA,IAAK,CAAA;AACxE,IAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,CAAA,gCAAA,EAAmC,GAAA,CAAI,MAAA,CAAO,QAAQ,0CAA0C,WAAW,CAAA,CAAA;AAAA,OAC7G;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,mBAAA;AAAA,UACN,OAAA,EAAS,qCAAqC,WAAW,CAAA,CAAA;AAAA;AAC3D,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAcC,mBAAA,CAAeC,WAAA,CAAQ,MAAA,EAAQ,CAAA;AACnD,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,WAAA,CAAY,QAAQ,GAAA,CAAI,OAAA;AAAA,IAC1B;AAEA,IAAA,KAAA,CAAM,GAAA,EAAK,KAAK,IAAI,CAAA;AAAA,EACtB,CAAA;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-gateway-backend",
-  "version": "1.1.0-next.1",
+  "version": "1.1.1-next.0",
   "backstage": {
     "role": "backend-plugin",
     "pluginId": "gateway",
@@ -37,17 +37,17 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.5.0-next.1",
+    "@backstage/backend-plugin-api": "1.5.1-next.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^1.29.0",
     "express": "^4.17.1",
     "http-proxy-middleware": "^3.0.3"
   },
   "devDependencies": {
-    "@backstage/backend-app-api": "1.3.0-next.1",
-    "@backstage/backend-defaults": "0.13.1-next.1",
-    "@backstage/backend-test-utils": "1.10.0-next.1",
-    "@backstage/cli": "0.34.5-next.1",
+    "@backstage/backend-app-api": "1.4.0-next.0",
+    "@backstage/backend-defaults": "0.14.0-next.0",
+    "@backstage/backend-test-utils": "1.10.1-next.0",
+    "@backstage/cli": "0.34.6-next.0",
     "@types/express": "^4.17.6",
     "eventsource": "^3.0.6",
     "wait-for-expect": "^3.0.2"