@backstage/plugin-kubernetes-backend 0.21.6 → 0.21.7-next.1

package/dist/service/KubernetesProxy.cjs.js

@@ -5,11 +5,13 @@ var pluginKubernetesCommon = require('@backstage/plugin-kubernetes-common');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var httpProxyMiddleware = require('http-proxy-middleware');
 var fs = require('fs-extra');
+var ProxyAuditSession = require('./ProxyAuditSession.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
 var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
 
+const PROXY_PREPARED_TARGET = /* @__PURE__ */ Symbol("kubernetesProxyPreparedTarget");
 const HEADER_KUBERNETES_CLUSTER = "Backstage-Kubernetes-Cluster";
 const HEADER_KUBERNETES_AUTH = "Backstage-Kubernetes-Authorization";
 class KubernetesProxy {
@@ -18,42 +20,147 @@ class KubernetesProxy {
   clusterSupplier;
   authStrategy;
   httpAuth;
+  auditor;
   constructor(options) {
     this.logger = options.logger;
     this.clusterSupplier = options.clusterSupplier;
     this.authStrategy = options.authStrategy;
     this.httpAuth = options.httpAuth;
+    this.auditor = options.auditor;
   }
   createRequestHandler(options) {
     const { permissionApi } = options;
     return async (req, res, next) => {
-      const authorizeResponse = await permissionApi.authorize(
-        [{ permission: pluginKubernetesCommon.kubernetesProxyPermission }],
-        {
-          credentials: await this.httpAuth.credentials(req)
+      const clusterNameHeader = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];
+      const clusterName = typeof clusterNameHeader === "string" && clusterNameHeader.length > 0 ? clusterNameHeader : "unknown";
+      const path = req.path || req.url.split("?")[0] || "";
+      let clientDisconnected = false;
+      const onSocketClose = () => {
+        clientDisconnected = true;
+      };
+      req.socket.once("close", onSocketClose);
+      let auditSession;
+      let finishListenerAttached = false;
+      try {
+        auditSession = await ProxyAuditSession.ProxyAuditSession.start(this.auditor, {
+          req,
+          clusterName,
+          method: req.method,
+          path,
+          logger: this.logger
+        });
+        finishListenerAttached = await this.authorizeAndDispatch(
+          req,
+          res,
+          next,
+          permissionApi,
+          auditSession,
+          onSocketClose,
+          () => clientDisconnected
+        );
+      } catch (error) {
+        req.socket.removeListener("close", onSocketClose);
+        const err = error instanceof Error ? error : new Error(String(error));
+        if (auditSession && !finishListenerAttached) {
+          auditSession.finalize(err);
         }
-      );
-      const auth = authorizeResponse[0];
-      if (auth.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        res.status(403).json({ error: new errors.NotAllowedError("Unauthorized") });
-        return;
-      }
-      const middleware = await this.getMiddleware(req);
-      if (req.header("connection")?.toLowerCase() === "upgrade" && req.header("upgrade")?.toLowerCase() === "websocket") {
-        middleware.upgrade(req, req.socket, void 0);
-      } else {
-        middleware(req, res, next);
+        throw error;
       }
     };
   }
+  /**
+   * Authorizes the request, resolves the target cluster, and dispatches
+   * to either the HTTP or WebSocket proxy path. Returns `true` when
+   * HTTP finish listeners have been attached.
+   */
+  async authorizeAndDispatch(req, res, next, permissionApi, auditSession, onSocketClose, isClientDisconnected) {
+    const authorizeResponse = await permissionApi.authorize(
+      [{ permission: pluginKubernetesCommon.kubernetesProxyPermission }],
+      { credentials: await this.httpAuth.credentials(req) }
+    );
+    if (authorizeResponse[0].result === pluginPermissionCommon.AuthorizeResult.DENY) {
+      req.socket.removeListener("close", onSocketClose);
+      auditSession.finalize(new errors.NotAllowedError("Unauthorized"));
+      res.status(403).json({
+        error: errors.serializeError(new errors.NotAllowedError("Unauthorized"))
+      });
+      return false;
+    }
+    if (isClientDisconnected()) {
+      auditSession.finalize(
+        new Error("Client disconnected before proxy dispatch")
+      );
+      return false;
+    }
+    const prepared = await this.prepareProxyTarget(req);
+    auditSession.setResolvedClusterName(prepared.cluster.name);
+    req[PROXY_PREPARED_TARGET] = prepared;
+    const middleware = this.getOrCreateMiddleware(prepared.cluster);
+    if (isClientDisconnected()) {
+      auditSession.finalize(
+        new Error("Client disconnected before proxy dispatch")
+      );
+      return false;
+    }
+    return KubernetesProxy.dispatchToProxy(
+      req,
+      res,
+      next,
+      middleware,
+      auditSession,
+      onSocketClose
+    );
+  }
+  /**
+   * Resolves the cluster, credentials, and target URL for a proxy request
+   * before dispatching to the middleware. This ensures all async preparation
+   * completes under the caller's try/catch, avoiding unhandled rejections
+   * from http-proxy-middleware's fire-and-forget upgrade() path.
+   */
+  async prepareProxyTarget(req) {
+    const cluster = await this.getClusterForRequest(req);
+    const url = new URL(cluster.url);
+    const { bufferFromFileOrString } = await import('@kubernetes/client-node');
+    const target = {
+      protocol: url.protocol,
+      host: url.hostname,
+      port: url.port,
+      ca: bufferFromFileOrString(cluster.caFile, cluster.caData)?.toString()
+    };
+    const authHeader = req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase("en-US")];
+    if (typeof authHeader === "string") {
+      req.headers.authorization = authHeader;
+    } else {
+      const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(
+        req.headers
+      );
+      const credential = await this.authStrategy.getCredential(
+        cluster,
+        authObj
+      );
+      if (credential.type === "bearer token") {
+        req.headers.authorization = `Bearer ${credential.token}`;
+      } else if (credential.type === "x509 client certificate") {
+        target.key = credential.key;
+        target.cert = credential.cert;
+      }
+    }
+    const requestPath = req.originalUrl || req.url || "";
+    const rewrittenPath = requestPath.replace(
+      new RegExp(`^${req.baseUrl || ""}`),
+      url.pathname || ""
+    );
+    return { proxyTarget: target, rewrittenPath, cluster };
+  }
   // We create one middleware per remote cluster and hold on to them, because
   // the secure property isn't possible to decide on a per-request basis with a
   // single middleware instance - and we don't expect it to change over time.
-  async getMiddleware(originalReq) {
-    const originalCluster = await this.getClusterForRequest(originalReq);
-    let middleware = this.middlewareForClusterName.get(originalCluster.name);
+  // Target resolution and path rewriting are handled per-request via the
+  // PROXY_PREPARED_TARGET symbol stashed on each req by prepareProxyTarget.
+  getOrCreateMiddleware(cluster) {
+    let middleware = this.middlewareForClusterName.get(cluster.name);
     if (!middleware) {
-      const logger = this.logger.child({ cluster: originalCluster.name });
+      const logger = this.logger.child({ cluster: cluster.name });
       middleware = httpProxyMiddleware.createProxyMiddleware({
         logProvider: () => ({
           log: logger.info.bind(logger),
@@ -62,55 +169,27 @@ class KubernetesProxy {
           warn: logger.warn.bind(logger),
           error: logger.error.bind(logger)
         }),
-        ws: true,
-        secure: !originalCluster.skipTLSVerify,
+        // ws must be false to prevent http-proxy-middleware from auto-subscribing
+        // to the server's 'upgrade' event, which would bypass Express routing and
+        // skip audit event creation for WebSocket requests.
+        ws: false,
+        secure: !cluster.skipTLSVerify,
         changeOrigin: true,
-        pathRewrite: async (path, req) => {
-          const cluster = await this.getClusterForRequest(req);
-          const url = new URL(cluster.url);
-          return path.replace(
-            new RegExp(`^${originalReq.baseUrl}`),
-            url.pathname || ""
-          );
+        router: (req) => {
+          return req[PROXY_PREPARED_TARGET]?.proxyTarget;
         },
-        router: async (req) => {
-          const cluster = await this.getClusterForRequest(req);
-          const url = new URL(cluster.url);
-          const { bufferFromFileOrString } = await import('@kubernetes/client-node');
-          const target = {
-            protocol: url.protocol,
-            host: url.hostname,
-            port: url.port,
-            ca: bufferFromFileOrString(
-              cluster.caFile,
-              cluster.caData
-            )?.toString()
-          };
-          const authHeader = req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase("en-US")];
-          if (typeof authHeader === "string") {
-            req.headers.authorization = authHeader;
-          } else {
-            const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(
-              req.headers
-            );
-            const credential = await this.getClusterForRequest(req).then((cd) => {
-              return this.authStrategy.getCredential(cd, authObj);
-            });
-            if (credential.type === "bearer token") {
-              req.headers.authorization = `Bearer ${credential.token}`;
-            } else if (credential.type === "x509 client certificate") {
-              target.key = credential.key;
-              target.cert = credential.cert;
-            }
-          }
-          return target;
+        pathRewrite: (_path, req) => {
+          return req[PROXY_PREPARED_TARGET]?.rewrittenPath ?? _path;
         },
         onError: (error, req, res) => {
           const wrappedError = new errors.ForwardedError(
-            `Cluster '${originalCluster.name}' request error`,
+            `Cluster '${cluster.name}' request error`,
             error
           );
           logger.error("Kubernetes proxy error", wrappedError);
+          if (typeof res.status !== "function") {
+            return;
+          }
           const body = {
             error: errors.serializeError(wrappedError, {
               includeStack: process.env.NODE_ENV === "development"
@@ -119,12 +198,39 @@ class KubernetesProxy {
             response: { statusCode: 500 }
           };
           res.status(500).json(body);
-        }
+        },
+        onProxyReqWs: ProxyAuditSession.ProxyAuditSession.handleWebSocketProxyReq
       });
-      this.middlewareForClusterName.set(originalCluster.name, middleware);
+      this.middlewareForClusterName.set(cluster.name, middleware);
     }
     return middleware;
   }
+  /**
+   * Branches to WebSocket upgrade or HTTP middleware dispatch and wires
+   * up the appropriate audit listeners. Returns `true` when HTTP finish
+   * listeners have been attached (used by the caller's catch block to
+   * avoid double-finalizing).
+   */
+  static dispatchToProxy(req, res, next, middleware, auditSession, onSocketClose) {
+    const isWebSocketUpgrade = (req.header("connection") ?? "").toLowerCase().split(",").some((t) => t.trim() === "upgrade") && req.header("upgrade")?.toLowerCase() === "websocket";
+    if (isWebSocketUpgrade) {
+      auditSession.prepareForWebSocketUpgrade(req, onSocketClose);
+      try {
+        middleware.upgrade(req, req.socket, void 0);
+      } catch (error) {
+        req.socket.removeListener("close", onSocketClose);
+        auditSession.finalize(
+          error instanceof Error ? error : new Error(String(error))
+        );
+        throw error;
+      }
+      return false;
+    }
+    req.socket.removeListener("close", onSocketClose);
+    auditSession.attachToHttpResponse(res);
+    middleware(req, res, next);
+    return true;
+  }
   async getClusterForRequest(req) {
     const { KubeConfig } = await import('@kubernetes/client-node');
     const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];

package/dist/service/KubernetesProxy.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesProxy.cjs.js","sources":["../../src/service/KubernetesProxy.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  ErrorResponseBody,\n  ForwardedError,\n  NotAllowedError,\n  NotFoundError,\n  serializeError,\n} from '@backstage/errors';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  SERVICEACCOUNT_CA_PATH,\n  kubernetesProxyPermission,\n  KubernetesRequestAuth,\n} from '@backstage/plugin-kubernetes-common';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport type { Cluster } from '@kubernetes/client-node';\nimport { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';\nimport fs from 'fs-extra';\n\nimport {\n  AuthenticationStrategy,\n  ClusterDetails,\n  KubernetesClustersSupplier,\n} from '@backstage/plugin-kubernetes-node';\n\nimport type { Request } from 'express';\nimport { IncomingHttpHeaders } from 'node:http';\nimport {\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\n\n/**\n * The header that is used to specify the cluster name.\n *\n * @public\n */\nexport const HEADER_KUBERNETES_CLUSTER: string = 'Backstage-Kubernetes-Cluster';\n\n/**\n * The header that is used to specify the Authentication Authorities token.\n * e.x if using the google auth provider as your authentication authority then this field would be the google provided bearer token.\n * @public\n */\nexport const HEADER_KUBERNETES_AUTH: string =\n  'Backstage-Kubernetes-Authorization';\n\n/**\n * The options object expected to be passed as a parameter to KubernetesProxy.createRequestHandler().\n *\n * @public\n */\nexport type KubernetesProxyCreateRequestHandlerOptions = {\n  permissionApi: PermissionsService;\n};\n\n/**\n * Options accepted as a parameter by the KubernetesProxy\n *\n * @public\n */\nexport type KubernetesProxyOptions = {\n  logger: LoggerService;\n  clusterSupplier: KubernetesClustersSupplier;\n  authStrategy: AuthenticationStrategy;\n  discovery: DiscoveryService;\n  httpAuth: HttpAuthService;\n};\n\n/**\n * A proxy that routes requests to the Kubernetes API.\n *\n * @public\n */\nexport class KubernetesProxy {\n  private readonly middlewareForClusterName = new Map<string, RequestHandler>();\n  private readonly logger: LoggerService;\n  private readonly clusterSupplier: KubernetesClustersSupplier;\n  private readonly authStrategy: AuthenticationStrategy;\n  private readonly httpAuth: HttpAuthService;\n\n  constructor(options: KubernetesProxyOptions) {\n    this.logger = options.logger;\n    this.clusterSupplier = options.clusterSupplier;\n    this.authStrategy = options.authStrategy;\n    this.httpAuth = options.httpAuth;\n  }\n\n  public createRequestHandler(\n    options: KubernetesProxyCreateRequestHandlerOptions,\n  ): RequestHandler {\n    const { permissionApi } = options;\n    return async (req, res, next) => {\n      const authorizeResponse = await permissionApi.authorize(\n        [{ permission: kubernetesProxyPermission }],\n        {\n          credentials: await this.httpAuth.credentials(req),\n        },\n      );\n      const auth = authorizeResponse[0];\n\n      if (auth.result === AuthorizeResult.DENY) {\n        res.status(403).json({ error: new NotAllowedError('Unauthorized') });\n        return;\n      }\n\n      const middleware = await this.getMiddleware(req);\n\n      // If req is an upgrade handshake, use middleware upgrade instead of http request handler https://github.com/chimurai/http-proxy-middleware#external-websocket-upgrade\n      if (\n        req.header('connection')?.toLowerCase() === 'upgrade' &&\n        req.header('upgrade')?.toLowerCase() === 'websocket'\n      ) {\n        // Missing the `head`, since it's optional we pass undefined to avoid type issues\n        middleware.upgrade!(req, req.socket, undefined);\n      } else {\n        middleware(req, res, next);\n      }\n    };\n  }\n\n  // We create one middleware per remote cluster and hold on to them, because\n  // the secure property isn't possible to decide on a per-request basis with a\n  // single middleware instance - and we don't expect it to change over time.\n  private async getMiddleware(originalReq: Request): Promise<RequestHandler> {\n    const originalCluster = await this.getClusterForRequest(originalReq);\n    let middleware = this.middlewareForClusterName.get(originalCluster.name);\n    if (!middleware) {\n      const logger = this.logger.child({ cluster: originalCluster.name });\n      middleware = createProxyMiddleware({\n        logProvider: () => ({\n          log: logger.info.bind(logger),\n          debug: logger.debug.bind(logger),\n          info: logger.info.bind(logger),\n          warn: logger.warn.bind(logger),\n          error: logger.error.bind(logger),\n        }),\n        ws: true,\n        secure: !originalCluster.skipTLSVerify,\n        changeOrigin: true,\n        pathRewrite: async (path, req) => {\n          // Re-evaluate the cluster on each request, in case it has changed\n          const cluster = await this.getClusterForRequest(req);\n          const url = new URL(cluster.url);\n          return path.replace(\n            new RegExp(`^${originalReq.baseUrl}`),\n            url.pathname || '',\n          );\n        },\n        router: async req => {\n          // Re-evaluate the cluster on each request, in case it has changed\n          const cluster = await this.getClusterForRequest(req);\n          const url = new URL(cluster.url);\n\n          const { bufferFromFileOrString } = await import(\n            '@kubernetes/client-node'\n          );\n\n          const target: any = {\n            protocol: url.protocol,\n            host: url.hostname,\n            port: url.port,\n            ca: bufferFromFileOrString(\n              cluster.caFile,\n              cluster.caData,\n            )?.toString(),\n          };\n\n          const authHeader =\n            req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase('en-US')];\n          if (typeof authHeader === 'string') {\n            req.headers.authorization = authHeader;\n          } else {\n            // Map Backstage-Kubernetes-Authorization-X-X headers to a KubernetesRequestAuth object\n            const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(\n              req.headers,\n            );\n\n            const credential = await this.getClusterForRequest(req).then(cd => {\n              return this.authStrategy.getCredential(cd, authObj);\n            });\n\n            if (credential.type === 'bearer token') {\n              req.headers.authorization = `Bearer ${credential.token}`;\n            } else if (credential.type === 'x509 client certificate') {\n              target.key = credential.key;\n              target.cert = credential.cert;\n            }\n          }\n\n          return target;\n        },\n        onError: (error, req, res) => {\n          const wrappedError = new ForwardedError(\n            `Cluster '${originalCluster.name}' request error`,\n            error,\n          );\n\n          logger.error('Kubernetes proxy error', wrappedError);\n\n          const body: ErrorResponseBody = {\n            error: serializeError(wrappedError, {\n              includeStack: process.env.NODE_ENV === 'development',\n            }),\n            request: { method: req.method, url: req.originalUrl },\n            response: { statusCode: 500 },\n          };\n          res.status(500).json(body);\n        },\n      });\n      this.middlewareForClusterName.set(originalCluster.name, middleware);\n    }\n    return middleware;\n  }\n\n  private async getClusterForRequest(req: Request): Promise<ClusterDetails> {\n    const { KubeConfig } = await import('@kubernetes/client-node');\n\n    const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n    const clusters = await this.clusterSupplier.getClusters({\n      credentials: await this.httpAuth.credentials(req),\n    });\n\n    if (!clusters || clusters.length <= 0) {\n      throw new NotFoundError(`No Clusters configured`);\n    }\n\n    const hasClusterNameHeader =\n      typeof clusterName === 'string' && clusterName.length > 0;\n\n    let cluster: ClusterDetails | undefined;\n\n    if (hasClusterNameHeader) {\n      cluster = clusters.find(c => c.name === clusterName);\n    } else if (clusters.length === 1) {\n      cluster = clusters.at(0);\n    }\n\n    if (!cluster) {\n      throw new NotFoundError(`Cluster '${clusterName}' not found`);\n    }\n\n    const authProvider =\n      cluster.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n\n    if (\n      authProvider === 'serviceAccount' &&\n      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&\n      !cluster.authMetadata.serviceAccountToken\n    ) {\n      const kc = new KubeConfig();\n      kc.loadFromCluster();\n      const clusterFromKubeConfig = kc.getCurrentCluster() as Cluster;\n\n      const url = new URL(clusterFromKubeConfig.server);\n      cluster.url = clusterFromKubeConfig.server;\n      if (url.protocol === 'https:') {\n        cluster.caFile = clusterFromKubeConfig.caFile;\n      }\n    }\n\n    return cluster;\n  }\n\n  private static authHeadersToKubernetesRequestAuth(\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    return Object.keys(originalHeaders)\n      .filter(header => header.startsWith('backstage-kubernetes-authorization'))\n      .map(header =>\n        KubernetesProxy.headerToDictionary(header, originalHeaders),\n      )\n      .filter(headerAsDic => Object.keys(headerAsDic).length !== 0)\n      .reduce(KubernetesProxy.combineHeaders, {});\n  }\n\n  private static headerToDictionary(\n    header: string,\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    const obj: KubernetesRequestAuth = {};\n    const headerSplit = header.split('-');\n    if (headerSplit.length >= 4) {\n      const framework = headerSplit[3].toLowerCase();\n      if (headerSplit.length >= 5) {\n        const provider = headerSplit.slice(4).join('-').toLowerCase();\n        obj[framework] = { [provider]: originalHeaders[header] };\n      } else {\n        obj[framework] = originalHeaders[header];\n      }\n    }\n    return obj;\n  }\n\n  private static combineHeaders(\n    authObj: any,\n    header: any,\n  ): KubernetesRequestAuth {\n    const framework = Object.keys(header)[0];\n\n    if (authObj[framework]) {\n      authObj[framework] = {\n        ...authObj[framework],\n        ...header[framework],\n      };\n    } else {\n      authObj[framework] = header[framework];\n    }\n\n    return authObj;\n  }\n}\n"],"names":["kubernetesProxyPermission","AuthorizeResult","NotAllowedError","createProxyMiddleware","ForwardedError","serializeError","NotFoundError","ANNOTATION_KUBERNETES_AUTH_PROVIDER","fs","SERVICEACCOUNT_CA_PATH"],"mappings":";;;;;;;;;;;;AAqDO,MAAM,yBAAA,GAAoC;AAO1C,MAAM,sBAAA,GACX;AA6BK,MAAM,eAAA,CAAgB;AAAA,EACV,wBAAA,uBAA+B,GAAA,EAA4B;AAAA,EAC3D,MAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EAEjB,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAC/B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAAA,EAC1B;AAAA,EAEO,qBACL,OAAA,EACgB;AAChB,IAAA,MAAM,EAAE,eAAc,GAAI,OAAA;AAC1B,IAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,MAAA,MAAM,iBAAA,GAAoB,MAAM,aAAA,CAAc,SAAA;AAAA,QAC5C,CAAC,EAAE,UAAA,EAAYA,gDAAA,EAA2B,CAAA;AAAA,QAC1C;AAAA,UACE,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA;AAClD,OACF;AACA,MAAA,MAAM,IAAA,GAAO,kBAAkB,CAAC,CAAA;AAEhC,MAAA,IAAI,IAAA,CAAK,MAAA,KAAWC,sCAAA,CAAgB,IAAA,EAAM;AACxC,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,IAAIC,sBAAA,CAAgB,cAAc,CAAA,EAAG,CAAA;AACnE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AAG/C,MAAA,IACE,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,EAAG,WAAA,EAAY,KAAM,SAAA,IAC5C,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG,WAAA,OAAkB,WAAA,EACzC;AAEA,QAAA,UAAA,CAAW,OAAA,CAAS,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,MAAS,CAAA;AAAA,MAChD,CAAA,MAAO;AACL,QAAA,UAAA,CAAW,GAAA,EAAK,KAAK,IAAI,CAAA;AAAA,MAC3B;AAAA,IACF,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,WAAA,EAA+C;AACzE,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,oBAAA,CAAqB,WAAW,CAAA;AACnE,IAAA,IAAI,UAAA,GAAa,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,gBAAgB,IAAI,CAAA;AACvE,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,OAAA,EAAS,eAAA,CAAgB,MAAM,CAAA;AAClE,MAAA,UAAA,GAAaC,yCAAA,CAAsB;AAAA,QACjC,aAAa,OAAO;AAAA,UAClB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC5B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,UAC/B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM;AAAA,SACjC,CAAA;AAAA,QACA,EAAA,EAAI,IAAA;AAAA,QACJ,MAAA,EAAQ,CAAC,eAAA,CAAgB,aAAA;AAAA,QACzB,YAAA,EAAc,IAAA;AAAA,QACd,WAAA,EAAa,OAAO,IAAA,EAAM,GAAA,KAAQ;AAEhC,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,UAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,UAAA,OAAO,IAAA,CAAK,OAAA;AAAA,YACV,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,WAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,YACpC,IAAI,QAAA,IAAY;AAAA,WAClB;AAAA,QACF,CAAA;AAAA,QACA,MAAA,EAAQ,OAAM,GAAA,KAAO;AAEnB,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,UAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAE/B,UAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OACvC,yBACF,CAAA;AAEA,UAAA,MAAM,MAAA,GAAc;AAAA,YAClB,UAAU,GAAA,CAAI,QAAA;AAAA,YACd,MAAM,GAAA,CAAI,QAAA;AAAA,YACV,MAAM,GAAA,CAAI,IAAA;AAAA,YACV,EAAA,EAAI,sBAAA;AAAA,cACF,OAAA,CAAQ,MAAA;AAAA,cACR,OAAA,CAAQ;AAAA,eACP,QAAA;AAAS,WACd;AAEA,UAAA,MAAM,aACJ,GAAA,CAAI,OAAA,CAAQ,sBAAA,CAAuB,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAC/D,UAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,YAAA,GAAA,CAAI,QAAQ,aAAA,GAAgB,UAAA;AAAA,UAC9B,CAAA,MAAO;AAEL,YAAA,MAAM,UAAU,eAAA,CAAgB,kCAAA;AAAA,cAC9B,GAAA,CAAI;AAAA,aACN;AAEA,YAAA,MAAM,aAAa,MAAM,IAAA,CAAK,qBAAqB,GAAG,CAAA,CAAE,KAAK,CAAA,EAAA,KAAM;AACjE,cAAA,OAAO,IAAA,CAAK,YAAA,CAAa,aAAA,CAAc,EAAA,EAAI,OAAO,CAAA;AAAA,YACpD,CAAC,CAAA;AAED,YAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,cAAA,GAAA,CAAI,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,UAAA,CAAW,KAAK,CAAA,CAAA;AAAA,YACxD,CAAA,MAAA,IAAW,UAAA,CAAW,IAAA,KAAS,yBAAA,EAA2B;AACxD,cAAA,MAAA,CAAO,MAAM,UAAA,CAAW,GAAA;AACxB,cAAA,MAAA,CAAO,OAAO,UAAA,CAAW,IAAA;AAAA,YAC3B;AAAA,UACF;AAEA,UAAA,OAAO,MAAA;AAAA,QACT,CAAA;AAAA,QACA,OAAA,EAAS,CAAC,KAAA,EAAO,GAAA,EAAK,GAAA,KAAQ;AAC5B,UAAA,MAAM,eAAe,IAAIC,qBAAA;AAAA,YACvB,CAAA,SAAA,EAAY,gBAAgB,IAAI,CAAA,eAAA,CAAA;AAAA,YAChC;AAAA,WACF;AAEA,UAAA,MAAA,CAAO,KAAA,CAAM,0BAA0B,YAAY,CAAA;AAEnD,UAAA,MAAM,IAAA,GAA0B;AAAA,YAC9B,KAAA,EAAOC,sBAAe,YAAA,EAAc;AAAA,cAClC,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa;AAAA,aACxC,CAAA;AAAA,YACD,SAAS,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY;AAAA,YACpD,QAAA,EAAU,EAAE,UAAA,EAAY,GAAA;AAAI,WAC9B;AACA,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,QAC3B;AAAA,OACD,CAAA;AACD,MAAA,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,eAAA,CAAgB,IAAA,EAAM,UAAU,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,GAAA,EAAuC;AACxE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAE7D,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACvE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY;AAAA,MACtD,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,IAAU,CAAA,EAAG;AACrC,MAAA,MAAM,IAAIC,qBAAc,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,oBAAA,GACJ,OAAO,WAAA,KAAgB,QAAA,IAAY,YAAY,MAAA,GAAS,CAAA;AAE1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,IACrD,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAA,GAAU,QAAA,CAAS,GAAG,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,oBAAA,CAAc,CAAA,SAAA,EAAY,WAAW,CAAA,WAAA,CAAa,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,YAAA,CAAaC,0DAAmC,CAAA;AAE1D,IAAA,IACE,YAAA,KAAiB,oBACjBC,mBAAA,CAAG,cAAA,CAAeC,6CAAsB,CAAA,IACxC,CAAC,OAAA,CAAQ,YAAA,CAAa,mBAAA,EACtB;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,UAAA,EAAW;AAC1B,MAAA,EAAA,CAAG,eAAA,EAAgB;AACnB,MAAA,MAAM,qBAAA,GAAwB,GAAG,iBAAA,EAAkB;AAEnD,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,qBAAA,CAAsB,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,MAAM,qBAAA,CAAsB,MAAA;AACpC,MAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,QAAA,OAAA,CAAQ,SAAS,qBAAA,CAAsB,MAAA;AAAA,MACzC;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,OAAe,mCACb,eAAA,EACuB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAC/B,MAAA,CAAO,YAAU,MAAA,CAAO,UAAA,CAAW,oCAAoC,CAAC,CAAA,CACxE,GAAA;AAAA,MAAI,CAAA,MAAA,KACH,eAAA,CAAgB,kBAAA,CAAmB,MAAA,EAAQ,eAAe;AAAA,KAC5D,CACC,MAAA,CAAO,CAAA,WAAA,KAAe,MAAA,CAAO,KAAK,WAAW,CAAA,CAAE,MAAA,KAAW,CAAC,CAAA,CAC3D,MAAA,CAAO,eAAA,CAAgB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAe,kBAAA,CACb,MAAA,EACA,eAAA,EACuB;AACvB,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAC,CAAA,CAAE,WAAA,EAAY;AAC7C,MAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAA,GAAW,YAAY,KAAA,CAAM,CAAC,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC5D,QAAA,GAAA,CAAI,SAAS,IAAI,EAAE,CAAC,QAAQ,GAAG,eAAA,CAAgB,MAAM,CAAA,EAAE;AAAA,MACzD,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,SAAS,CAAA,GAAI,eAAA,CAAgB,MAAM,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,OAAe,cAAA,CACb,OAAA,EACA,MAAA,EACuB;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI;AAAA,QACnB,GAAG,QAAQ,SAAS,CAAA;AAAA,QACpB,GAAG,OAAO,SAAS;AAAA,OACrB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;;;;"}
+{"version":3,"file":"KubernetesProxy.cjs.js","sources":["../../src/service/KubernetesProxy.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  ErrorResponseBody,\n  ForwardedError,\n  NotAllowedError,\n  NotFoundError,\n  serializeError,\n} from '@backstage/errors';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  SERVICEACCOUNT_CA_PATH,\n  kubernetesProxyPermission,\n  KubernetesRequestAuth,\n} from '@backstage/plugin-kubernetes-common';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport type { Cluster } from '@kubernetes/client-node';\nimport { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';\nimport fs from 'fs-extra';\n\nimport {\n  AuthenticationStrategy,\n  ClusterDetails,\n  KubernetesClustersSupplier,\n} from '@backstage/plugin-kubernetes-node';\n\nimport type { NextFunction, Request, Response } from 'express';\nimport { IncomingHttpHeaders } from 'node:http';\nimport {\n  AuditorService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport { ProxyAuditSession } from './ProxyAuditSession';\n\nconst PROXY_PREPARED_TARGET = Symbol('kubernetesProxyPreparedTarget');\n\ntype PreparedProxyTarget = {\n  proxyTarget: any;\n  rewrittenPath: string;\n  cluster: ClusterDetails;\n};\n\n/**\n * The header that is used to specify the cluster name.\n *\n * @public\n */\nexport const HEADER_KUBERNETES_CLUSTER: string = 'Backstage-Kubernetes-Cluster';\n\n/**\n * The header that is used to specify the Authentication Authorities token.\n * e.x if using the google auth provider as your authentication authority then this field would be the google provided bearer token.\n * @public\n */\nexport const HEADER_KUBERNETES_AUTH: string =\n  'Backstage-Kubernetes-Authorization';\n\n/**\n * The options object expected to be passed as a parameter to KubernetesProxy.createRequestHandler().\n *\n * @public\n */\nexport type KubernetesProxyCreateRequestHandlerOptions = {\n  permissionApi: PermissionsService;\n};\n\n/**\n * Options accepted as a parameter by the KubernetesProxy\n *\n * @public\n */\nexport type KubernetesProxyOptions = {\n  logger: LoggerService;\n  clusterSupplier: KubernetesClustersSupplier;\n  authStrategy: AuthenticationStrategy;\n  discovery: DiscoveryService;\n  httpAuth: HttpAuthService;\n  auditor?: AuditorService;\n};\n\n/**\n * A proxy that routes requests to the Kubernetes API.\n *\n * @public\n */\nexport class KubernetesProxy {\n  private readonly middlewareForClusterName = new Map<string, RequestHandler>();\n  private readonly logger: LoggerService;\n  private readonly clusterSupplier: KubernetesClustersSupplier;\n  private readonly authStrategy: AuthenticationStrategy;\n  private readonly httpAuth: HttpAuthService;\n  private readonly auditor?: AuditorService;\n\n  constructor(options: KubernetesProxyOptions) {\n    this.logger = options.logger;\n    this.clusterSupplier = options.clusterSupplier;\n    this.authStrategy = options.authStrategy;\n    this.httpAuth = options.httpAuth;\n    this.auditor = options.auditor;\n  }\n\n  public createRequestHandler(\n    options: KubernetesProxyCreateRequestHandlerOptions,\n  ): RequestHandler {\n    const { permissionApi } = options;\n    return async (req, res, next) => {\n      const clusterNameHeader =\n        req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n      const clusterName =\n        typeof clusterNameHeader === 'string' && clusterNameHeader.length > 0\n          ? clusterNameHeader\n          : 'unknown';\n      const path = req.path || req.url.split('?')[0] || '';\n\n      let clientDisconnected = false;\n      const onSocketClose = () => {\n        clientDisconnected = true;\n      };\n      req.socket.once('close', onSocketClose);\n\n      let auditSession: ProxyAuditSession | undefined;\n      let finishListenerAttached = false;\n      try {\n        auditSession = await ProxyAuditSession.start(this.auditor, {\n          req,\n          clusterName,\n          method: req.method,\n          path,\n          logger: this.logger,\n        });\n\n        finishListenerAttached = await this.authorizeAndDispatch(\n          req,\n          res,\n          next,\n          permissionApi,\n          auditSession,\n          onSocketClose,\n          () => clientDisconnected,\n        );\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        const err = error instanceof Error ? error : new Error(String(error));\n        if (auditSession && !finishListenerAttached) {\n          auditSession.finalize(err);\n        }\n        throw error;\n      }\n    };\n  }\n\n  /**\n   * Authorizes the request, resolves the target cluster, and dispatches\n   * to either the HTTP or WebSocket proxy path. Returns `true` when\n   * HTTP finish listeners have been attached.\n   */\n  private async authorizeAndDispatch(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    permissionApi: PermissionsService,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n    isClientDisconnected: () => boolean,\n  ): Promise<boolean> {\n    const authorizeResponse = await permissionApi.authorize(\n      [{ permission: kubernetesProxyPermission }],\n      { credentials: await this.httpAuth.credentials(req) },\n    );\n\n    if (authorizeResponse[0].result === AuthorizeResult.DENY) {\n      req.socket.removeListener('close', onSocketClose);\n      auditSession.finalize(new NotAllowedError('Unauthorized'));\n      res.status(403).json({\n        error: serializeError(new NotAllowedError('Unauthorized')),\n      });\n      return false;\n    }\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    const prepared = await this.prepareProxyTarget(req);\n    auditSession.setResolvedClusterName(prepared.cluster.name);\n    (req as any)[PROXY_PREPARED_TARGET] = prepared;\n    const middleware = this.getOrCreateMiddleware(prepared.cluster);\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    return KubernetesProxy.dispatchToProxy(\n      req,\n      res,\n      next,\n      middleware,\n      auditSession,\n      onSocketClose,\n    );\n  }\n\n  /**\n   * Resolves the cluster, credentials, and target URL for a proxy request\n   * before dispatching to the middleware. This ensures all async preparation\n   * completes under the caller's try/catch, avoiding unhandled rejections\n   * from http-proxy-middleware's fire-and-forget upgrade() path.\n   */\n  private async prepareProxyTarget(req: Request): Promise<PreparedProxyTarget> {\n    const cluster = await this.getClusterForRequest(req);\n    const url = new URL(cluster.url);\n\n    const { bufferFromFileOrString } = await import('@kubernetes/client-node');\n\n    const target: any = {\n      protocol: url.protocol,\n      host: url.hostname,\n      port: url.port,\n      ca: bufferFromFileOrString(cluster.caFile, cluster.caData)?.toString(),\n    };\n\n    const authHeader =\n      req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase('en-US')];\n    if (typeof authHeader === 'string') {\n      req.headers.authorization = authHeader;\n    } else {\n      const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(\n        req.headers,\n      );\n\n      const credential = await this.authStrategy.getCredential(\n        cluster,\n        authObj,\n      );\n\n      if (credential.type === 'bearer token') {\n        req.headers.authorization = `Bearer ${credential.token}`;\n      } else if (credential.type === 'x509 client certificate') {\n        target.key = credential.key;\n        target.cert = credential.cert;\n      }\n    }\n\n    const requestPath = req.originalUrl || req.url || '';\n    const rewrittenPath = requestPath.replace(\n      new RegExp(`^${req.baseUrl || ''}`),\n      url.pathname || '',\n    );\n\n    return { proxyTarget: target, rewrittenPath, cluster };\n  }\n\n  // We create one middleware per remote cluster and hold on to them, because\n  // the secure property isn't possible to decide on a per-request basis with a\n  // single middleware instance - and we don't expect it to change over time.\n  // Target resolution and path rewriting are handled per-request via the\n  // PROXY_PREPARED_TARGET symbol stashed on each req by prepareProxyTarget.\n  private getOrCreateMiddleware(cluster: ClusterDetails): RequestHandler {\n    let middleware = this.middlewareForClusterName.get(cluster.name);\n    if (!middleware) {\n      const logger = this.logger.child({ cluster: cluster.name });\n      middleware = createProxyMiddleware({\n        logProvider: () => ({\n          log: logger.info.bind(logger),\n          debug: logger.debug.bind(logger),\n          info: logger.info.bind(logger),\n          warn: logger.warn.bind(logger),\n          error: logger.error.bind(logger),\n        }),\n        // ws must be false to prevent http-proxy-middleware from auto-subscribing\n        // to the server's 'upgrade' event, which would bypass Express routing and\n        // skip audit event creation for WebSocket requests.\n        ws: false,\n        secure: !cluster.skipTLSVerify,\n        changeOrigin: true,\n        router: req => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.proxyTarget;\n        },\n        pathRewrite: (_path, req) => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.rewrittenPath ?? _path;\n        },\n        onError: (error, req, res) => {\n          const wrappedError = new ForwardedError(\n            `Cluster '${cluster.name}' request error`,\n            error,\n          );\n\n          logger.error('Kubernetes proxy error', wrappedError);\n\n          if (typeof (res as { status?: unknown }).status !== 'function') {\n            return;\n          }\n\n          const body: ErrorResponseBody = {\n            error: serializeError(wrappedError, {\n              includeStack: process.env.NODE_ENV === 'development',\n            }),\n            request: { method: req.method, url: req.originalUrl },\n            response: { statusCode: 500 },\n          };\n          res.status(500).json(body);\n        },\n        onProxyReqWs: ProxyAuditSession.handleWebSocketProxyReq,\n      });\n      this.middlewareForClusterName.set(cluster.name, middleware);\n    }\n    return middleware;\n  }\n\n  /**\n   * Branches to WebSocket upgrade or HTTP middleware dispatch and wires\n   * up the appropriate audit listeners. Returns `true` when HTTP finish\n   * listeners have been attached (used by the caller's catch block to\n   * avoid double-finalizing).\n   */\n  private static dispatchToProxy(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    middleware: RequestHandler,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n  ): boolean {\n    const isWebSocketUpgrade =\n      (req.header('connection') ?? '')\n        .toLowerCase()\n        .split(',')\n        .some(t => t.trim() === 'upgrade') &&\n      req.header('upgrade')?.toLowerCase() === 'websocket';\n\n    if (isWebSocketUpgrade) {\n      auditSession.prepareForWebSocketUpgrade(req, onSocketClose);\n\n      try {\n        middleware.upgrade!(req, req.socket, undefined);\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        auditSession.finalize(\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        throw error;\n      }\n      return false;\n    }\n\n    // HTTP path: remove the early close listener; HTTP audit listeners\n    // on the response take over from here.\n    req.socket.removeListener('close', onSocketClose);\n    auditSession.attachToHttpResponse(res);\n    middleware(req, res, next);\n    return true;\n  }\n\n  private async getClusterForRequest(req: Request): Promise<ClusterDetails> {\n    const { KubeConfig } = await import('@kubernetes/client-node');\n\n    const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n    const clusters = await this.clusterSupplier.getClusters({\n      credentials: await this.httpAuth.credentials(req),\n    });\n\n    if (!clusters || clusters.length <= 0) {\n      throw new NotFoundError(`No Clusters configured`);\n    }\n\n    const hasClusterNameHeader =\n      typeof clusterName === 'string' && clusterName.length > 0;\n\n    let cluster: ClusterDetails | undefined;\n\n    if (hasClusterNameHeader) {\n      cluster = clusters.find(c => c.name === clusterName);\n    } else if (clusters.length === 1) {\n      cluster = clusters.at(0);\n    }\n\n    if (!cluster) {\n      throw new NotFoundError(`Cluster '${clusterName}' not found`);\n    }\n\n    const authProvider =\n      cluster.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n\n    if (\n      authProvider === 'serviceAccount' &&\n      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&\n      !cluster.authMetadata.serviceAccountToken\n    ) {\n      const kc = new KubeConfig();\n      kc.loadFromCluster();\n      const clusterFromKubeConfig = kc.getCurrentCluster() as Cluster;\n\n      const url = new URL(clusterFromKubeConfig.server);\n      cluster.url = clusterFromKubeConfig.server;\n      if (url.protocol === 'https:') {\n        cluster.caFile = clusterFromKubeConfig.caFile;\n      }\n    }\n\n    return cluster;\n  }\n\n  private static authHeadersToKubernetesRequestAuth(\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    return Object.keys(originalHeaders)\n      .filter(header => header.startsWith('backstage-kubernetes-authorization'))\n      .map(header =>\n        KubernetesProxy.headerToDictionary(header, originalHeaders),\n      )\n      .filter(headerAsDic => Object.keys(headerAsDic).length !== 0)\n      .reduce(KubernetesProxy.combineHeaders, {});\n  }\n\n  private static headerToDictionary(\n    header: string,\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    const obj: KubernetesRequestAuth = {};\n    const headerSplit = header.split('-');\n    if (headerSplit.length >= 4) {\n      const framework = headerSplit[3].toLowerCase();\n      if (headerSplit.length >= 5) {\n        const provider = headerSplit.slice(4).join('-').toLowerCase();\n        obj[framework] = { [provider]: originalHeaders[header] };\n      } else {\n        obj[framework] = originalHeaders[header];\n      }\n    }\n    return obj;\n  }\n\n  private static combineHeaders(\n    authObj: any,\n    header: any,\n  ): KubernetesRequestAuth {\n    const framework = Object.keys(header)[0];\n\n    if (authObj[framework]) {\n      authObj[framework] = {\n        ...authObj[framework],\n        ...header[framework],\n      };\n    } else {\n      authObj[framework] = header[framework];\n    }\n\n    return authObj;\n  }\n}\n"],"names":["ProxyAuditSession","kubernetesProxyPermission","AuthorizeResult","NotAllowedError","serializeError","createProxyMiddleware","ForwardedError","NotFoundError","ANNOTATION_KUBERNETES_AUTH_PROVIDER","fs","SERVICEACCOUNT_CA_PATH"],"mappings":";;;;;;;;;;;;;AAkDA,MAAM,qBAAA,0BAA+B,+BAA+B,CAAA;AAa7D,MAAM,yBAAA,GAAoC;AAO1C,MAAM,sBAAA,GACX;AA8BK,MAAM,eAAA,CAAgB;AAAA,EACV,wBAAA,uBAA+B,GAAA,EAA4B;AAAA,EAC3D,MAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAC/B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AAAA,EACzB;AAAA,EAEO,qBACL,OAAA,EACgB;AAChB,IAAA,MAAM,EAAE,eAAc,GAAI,OAAA;AAC1B,IAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,MAAA,MAAM,iBAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACrD,MAAA,MAAM,cACJ,OAAO,iBAAA,KAAsB,YAAY,iBAAA,CAAkB,MAAA,GAAS,IAChE,iBAAA,GACA,SAAA;AACN,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,IAAQ,GAAA,CAAI,IAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAElD,MAAA,IAAI,kBAAA,GAAqB,KAAA;AACzB,MAAA,MAAM,gBAAgB,MAAM;AAC1B,QAAA,kBAAA,GAAqB,IAAA;AAAA,MACvB,CAAA;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAEtC,MAAA,IAAI,YAAA;AACJ,MAAA,IAAI,sBAAA,GAAyB,KAAA;AAC7B,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAMA,mCAAA,CAAkB,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS;AAAA,UACzD,GAAA;AAAA,UACA,WAAA;AAAA,UACA,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAED,QAAA,sBAAA,GAAyB,MAAM,IAAA,CAAK,oBAAA;AAAA,UAClC,GAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA;AAAA,UACA,aAAA;AAAA,UACA,YAAA;AAAA,UACA,aAAA;AAAA,UACA,MAAM;AAAA,SACR;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,QAAA,IAAI,YAAA,IAAgB,CAAC,sBAAA,EAAwB;AAC3C,UAAA,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,QAC3B;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,qBACZ,GAAA,EACA,GAAA,EACA,MACA,aAAA,EACA,YAAA,EACA,eACA,oBAAA,EACkB;AAClB,IAAA,MAAM,iBAAA,GAAoB,MAAM,aAAA,CAAc,SAAA;AAAA,MAC5C,CAAC,EAAE,UAAA,EAAYC,gDAAA,EAA2B,CAAA;AAAA,MAC1C,EAAE,WAAA,EAAa,MAAM,KAAK,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,KACtD;AAEA,IAAA,IAAI,iBAAA,CAAkB,CAAC,CAAA,CAAE,MAAA,KAAWC,uCAAgB,IAAA,EAAM;AACxD,MAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,MAAA,YAAA,CAAa,QAAA,CAAS,IAAIC,sBAAA,CAAgB,cAAc,CAAC,CAAA;AACzD,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,KAAA,EAAOC,qBAAA,CAAe,IAAID,sBAAA,CAAgB,cAAc,CAAC;AAAA,OAC1D,CAAA;AACD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,kBAAA,CAAmB,GAAG,CAAA;AAClD,IAAA,YAAA,CAAa,sBAAA,CAAuB,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA;AACzD,IAAC,GAAA,CAAY,qBAAqB,CAAA,GAAI,QAAA;AACtC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,qBAAA,CAAsB,QAAA,CAAS,OAAO,CAAA;AAE9D,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,eAAA,CAAgB,eAAA;AAAA,MACrB,GAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,mBAAmB,GAAA,EAA4C;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAE/B,IAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAEzE,IAAA,MAAM,MAAA,GAAc;AAAA,MAClB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI,QAAA;AAAA,MACV,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,IAAI,sBAAA,CAAuB,OAAA,CAAQ,QAAQ,OAAA,CAAQ,MAAM,GAAG,QAAA;AAAS,KACvE;AAEA,IAAA,MAAM,aACJ,GAAA,CAAI,OAAA,CAAQ,sBAAA,CAAuB,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAC/D,IAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,MAAA,GAAA,CAAI,QAAQ,aAAA,GAAgB,UAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,MAAM,UAAU,eAAA,CAAgB,kCAAA;AAAA,QAC9B,GAAA,CAAI;AAAA,OACN;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,aAAA;AAAA,QACzC,OAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,QAAA,GAAA,CAAI,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,UAAA,CAAW,KAAK,CAAA,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,UAAA,CAAW,IAAA,KAAS,yBAAA,EAA2B;AACxD,QAAA,MAAA,CAAO,MAAM,UAAA,CAAW,GAAA;AACxB,QAAA,MAAA,CAAO,OAAO,UAAA,CAAW,IAAA;AAAA,MAC3B;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,GAAA,IAAO,EAAA;AAClD,IAAA,MAAM,gBAAgB,WAAA,CAAY,OAAA;AAAA,MAChC,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,CAAE,CAAA;AAAA,MAClC,IAAI,QAAA,IAAY;AAAA,KAClB;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAA,EAAe,OAAA,EAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,sBAAsB,OAAA,EAAyC;AACrE,IAAA,IAAI,UAAA,GAAa,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC/D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAA;AAC1D,MAAA,UAAA,GAAaE,yCAAA,CAAsB;AAAA,QACjC,aAAa,OAAO;AAAA,UAClB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC5B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,UAC/B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM;AAAA,SACjC,CAAA;AAAA;AAAA;AAAA;AAAA,QAIA,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAC,OAAA,CAAQ,aAAA;AAAA,QACjB,YAAA,EAAc,IAAA;AAAA,QACd,QAAQ,CAAA,GAAA,KAAO;AACb,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,WAAA;AAAA,QAC9C,CAAA;AAAA,QACA,WAAA,EAAa,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC3B,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,aAAA,IAAiB,KAAA;AAAA,QAC/D,CAAA;AAAA,QACA,OAAA,EAAS,CAAC,KAAA,EAAO,GAAA,EAAK,GAAA,KAAQ;AAC5B,UAAA,MAAM,eAAe,IAAIC,qBAAA;AAAA,YACvB,CAAA,SAAA,EAAY,QAAQ,IAAI,CAAA,eAAA,CAAA;AAAA,YACxB;AAAA,WACF;AAEA,UAAA,MAAA,CAAO,KAAA,CAAM,0BAA0B,YAAY,CAAA;AAEnD,UAAA,IAAI,OAAQ,GAAA,CAA6B,MAAA,KAAW,UAAA,EAAY;AAC9D,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,IAAA,GAA0B;AAAA,YAC9B,KAAA,EAAOF,sBAAe,YAAA,EAAc;AAAA,cAClC,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa;AAAA,aACxC,CAAA;AAAA,YACD,SAAS,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY;AAAA,YACpD,QAAA,EAAU,EAAE,UAAA,EAAY,GAAA;AAAI,WAC9B;AACA,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,QAC3B,CAAA;AAAA,QACA,cAAcJ,mCAAA,CAAkB;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,UAAU,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAe,eAAA,CACb,GAAA,EACA,KACA,IAAA,EACA,UAAA,EACA,cACA,aAAA,EACS;AACT,IAAA,MAAM,kBAAA,GAAA,CACH,IAAI,MAAA,CAAO,YAAY,KAAK,EAAA,EAC1B,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA,CACT,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAK,KAAM,SAAS,CAAA,IACnC,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG,WAAA,EAAY,KAAM,WAAA;AAE3C,IAAA,IAAI,kBAAA,EAAoB;AACtB,MAAA,YAAA,CAAa,0BAAA,CAA2B,KAAK,aAAa,CAAA;AAE1D,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,OAAA,CAAS,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAS,CAAA;AAAA,MAChD,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,YAAA,CAAa,QAAA;AAAA,UACX,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,SAC1D;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAIA,IAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,IAAA,YAAA,CAAa,qBAAqB,GAAG,CAAA;AACrC,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,GAAA,EAAuC;AACxE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAE7D,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACvE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY;AAAA,MACtD,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,IAAU,CAAA,EAAG;AACrC,MAAA,MAAM,IAAIO,qBAAc,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,oBAAA,GACJ,OAAO,WAAA,KAAgB,QAAA,IAAY,YAAY,MAAA,GAAS,CAAA;AAE1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,IACrD,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAA,GAAU,QAAA,CAAS,GAAG,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,oBAAA,CAAc,CAAA,SAAA,EAAY,WAAW,CAAA,WAAA,CAAa,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,YAAA,CAAaC,0DAAmC,CAAA;AAE1D,IAAA,IACE,YAAA,KAAiB,oBACjBC,mBAAA,CAAG,cAAA,CAAeC,6CAAsB,CAAA,IACxC,CAAC,OAAA,CAAQ,YAAA,CAAa,mBAAA,EACtB;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,UAAA,EAAW;AAC1B,MAAA,EAAA,CAAG,eAAA,EAAgB;AACnB,MAAA,MAAM,qBAAA,GAAwB,GAAG,iBAAA,EAAkB;AAEnD,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,qBAAA,CAAsB,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,MAAM,qBAAA,CAAsB,MAAA;AACpC,MAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,QAAA,OAAA,CAAQ,SAAS,qBAAA,CAAsB,MAAA;AAAA,MACzC;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,OAAe,mCACb,eAAA,EACuB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAC/B,MAAA,CAAO,YAAU,MAAA,CAAO,UAAA,CAAW,oCAAoC,CAAC,CAAA,CACxE,GAAA;AAAA,MAAI,CAAA,MAAA,KACH,eAAA,CAAgB,kBAAA,CAAmB,MAAA,EAAQ,eAAe;AAAA,KAC5D,CACC,MAAA,CAAO,CAAA,WAAA,KAAe,MAAA,CAAO,KAAK,WAAW,CAAA,CAAE,MAAA,KAAW,CAAC,CAAA,CAC3D,MAAA,CAAO,eAAA,CAAgB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAe,kBAAA,CACb,MAAA,EACA,eAAA,EACuB;AACvB,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAC,CAAA,CAAE,WAAA,EAAY;AAC7C,MAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAA,GAAW,YAAY,KAAA,CAAM,CAAC,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC5D,QAAA,GAAA,CAAI,SAAS,IAAI,EAAE,CAAC,QAAQ,GAAG,eAAA,CAAgB,MAAM,CAAA,EAAE;AAAA,MACzD,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,SAAS,CAAA,GAAI,eAAA,CAAgB,MAAM,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,OAAe,cAAA,CACb,OAAA,EACA,MAAA,EACuB;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI;AAAA,QACnB,GAAG,QAAQ,SAAS,CAAA;AAAA,QACpB,GAAG,OAAO,SAAS;AAAA,OACrB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;;;;"}

package/dist/service/KubernetesRouter.cjs.js

@@ -12,9 +12,11 @@ require('@azure/identity');
 require('@google-cloud/container');
 var DispatchStrategy = require('../auth/DispatchStrategy.cjs.js');
 require('fs-extra');
+var errors = require('@backstage/errors');
 var resourcesRoutes = require('../routes/resourcesRoutes.cjs.js');
 var KubernetesProxy = require('./KubernetesProxy.cjs.js');
 var requirePermission = require('../auth/requirePermission.cjs.js');
+var catalogModel = require('@backstage/catalog-model');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -91,11 +93,13 @@ class KubernetesRouter {
       clusterSupplier,
       authStrategy,
       discovery,
-      httpAuth
+      httpAuth,
+      auditor: this.env.auditor
     });
   }
   buildDefaultRouter(objectsProvider, clusterSupplier, catalog, proxy, permissionApi, httpAuth, authStrategyMap) {
     const logger = this.env.logger;
+    const auditor = this.env.auditor;
     const router = Router__default.default();
     router.use("/proxy", proxy.createRequestHandler({ permissionApi }));
     router.use(express__default.default.json());
@@ -105,67 +109,112 @@ class KubernetesRouter {
       })
     );
     router.post("/services/:serviceId", async (req, res) => {
-      await requirePermission.requirePermission(
-        permissionApi,
-        pluginKubernetesCommon.kubernetesResourcesReadPermission,
-        httpAuth,
-        req
-      );
       const serviceId = req.params.serviceId;
       const requestBody = req.body;
+      let entityRef;
+      if (requestBody?.entity) {
+        try {
+          entityRef = catalogModel.stringifyEntityRef(requestBody.entity);
+        } catch {
+          entityRef = void 0;
+        }
+      }
+      const auditorEvent = await auditor.createEvent({
+        eventId: "resource-fetch",
+        request: req,
+        meta: { queryType: "services", entityRef, serviceId }
+      });
       try {
+        await requirePermission.requirePermission(
+          permissionApi,
+          pluginKubernetesCommon.kubernetesResourcesReadPermission,
+          httpAuth,
+          req
+        );
         const response = await objectsProvider.getKubernetesObjectsByEntity(
           {
-            entity: requestBody.entity,
-            auth: requestBody.auth || {}
+            entity: requestBody?.entity,
+            auth: requestBody?.auth || {}
           },
           { credentials: await httpAuth.credentials(req) }
         );
         res.json(response);
+        auditorEvent.success().catch(
+          (error) => logger.error(
+            "Failed to emit audit event resource-fetch (services)",
+            error
+          )
+        );
       } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        await auditorEvent.fail({ error: err });
+        if (e instanceof errors.NotAllowedError) {
+          throw e;
+        }
         logger.error(
-          `action=retrieveObjectsByServiceId service=${serviceId}, error=${e}`
+          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`
         );
-        res.status(500).json({ error: e.message });
+        if (!res.headersSent) {
+          res.status(500).json({ error: err.message });
+        }
       }
     });
     router.get("/clusters", async (req, res) => {
-      await requirePermission.requirePermission(
-        permissionApi,
-        pluginKubernetesCommon.kubernetesClustersReadPermission,
-        httpAuth,
-        req
-      );
-      const credentials = await httpAuth.credentials(req);
-      const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {
-        credentials
-      });
-      res.json({
-        items: clusterDetails.map((cd) => {
-          const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
-          const authProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
-          const strategy = authStrategyMap[authProvider];
-          let auth = {};
-          if (strategy) {
-            auth = strategy.presentAuthMetadata(cd.authMetadata);
-          }
-          return {
-            name: cd.name,
-            title: cd.title,
-            dashboardUrl: cd.dashboardUrl,
-            authProvider,
-            ...oidcTokenProvider && { oidcTokenProvider },
-            ...auth && Object.keys(auth).length !== 0 && { auth }
-          };
-        })
+      const auditorEvent = await auditor.createEvent({
+        eventId: "cluster-fetch",
+        request: req,
+        meta: { queryType: "list" }
       });
+      try {
+        await requirePermission.requirePermission(
+          permissionApi,
+          pluginKubernetesCommon.kubernetesClustersReadPermission,
+          httpAuth,
+          req
+        );
+        const credentials = await httpAuth.credentials(req);
+        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {
+          credentials
+        });
+        res.json({
+          items: clusterDetails.map((cd) => {
+            const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
+            const authProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
+            const strategy = authStrategyMap[authProvider];
+            let auth = {};
+            if (strategy) {
+              auth = strategy.presentAuthMetadata(cd.authMetadata);
+            }
+            return {
+              name: cd.name,
+              title: cd.title,
+              dashboardUrl: cd.dashboardUrl,
+              authProvider,
+              ...oidcTokenProvider && { oidcTokenProvider },
+              ...auth && Object.keys(auth).length !== 0 && { auth }
+            };
+          })
+        });
+        auditorEvent.success().catch(
+          (error) => logger.error(
+            "Failed to emit audit event cluster-fetch (list)",
+            error
+          )
+        );
+      } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        await auditorEvent.fail({ error: err });
+        throw e;
+      }
     });
     resourcesRoutes.addResourceRoutesToRouter(
       router,
       catalog,
       objectsProvider,
       httpAuth,
-      permissionApi
+      permissionApi,
+      auditor,
+      logger
     );
     return router;
   }

package/dist/service/KubernetesRouter.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesRouter.cjs.js","sources":["../../src/service/KubernetesRouter.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,\n  kubernetesClustersReadPermission,\n  kubernetesPermissions,\n  kubernetesResourcesReadPermission,\n} from '@backstage/plugin-kubernetes-common';\nimport { PermissionEvaluator } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\n\nimport { DispatchStrategy } from '../auth';\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport {\n  AuthenticationStrategy,\n  AuthMetadata,\n  KubernetesClustersSupplier,\n  KubernetesFetcher,\n  KubernetesObjectsProvider,\n  KubernetesRouterFactory,\n  KubernetesServiceLocator,\n} from '@backstage/plugin-kubernetes-node';\nimport { addResourceRoutesToRouter } from '../routes/resourcesRoutes';\nimport { ObjectsByEntityRequest } from '../types/types';\nimport { KubernetesProxy } from './KubernetesProxy';\nimport { requirePermission } from '../auth/requirePermission';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\n\nexport interface KubernetesEnvironment {\n  logger: LoggerService;\n  config: Config;\n  catalog: CatalogService;\n  discovery: DiscoveryService;\n  permissions: PermissionEvaluator;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  authStrategyMap: { [key: string]: AuthenticationStrategy };\n  fetcher: KubernetesFetcher;\n  clusterSupplier: KubernetesClustersSupplier;\n  serviceLocator: KubernetesServiceLocator;\n  objectsProvider: KubernetesObjectsProvider;\n  customRouter?: KubernetesRouterFactory;\n}\n\nexport class KubernetesRouter {\n  static create(env: KubernetesEnvironment) {\n    return new KubernetesRouter(env);\n  }\n\n  protected readonly env: KubernetesEnvironment;\n\n  constructor(env: KubernetesEnvironment) {\n    this.env = env;\n  }\n\n  public async getRouter() {\n    const {\n      logger,\n      config,\n      permissions,\n      authStrategyMap,\n      clusterSupplier,\n      objectsProvider,\n      catalog,\n      discovery,\n      httpAuth,\n      customRouter,\n    } = this.env;\n\n    logger.info('Initializing Kubernetes backend');\n\n    if (!config.has('kubernetes')) {\n      if (process.env.NODE_ENV !== 'development') {\n        throw new Error('Kubernetes configuration is missing');\n      }\n      logger.warn(\n        'Failed to initialize kubernetes backend: kubernetes config is missing',\n      );\n      return Router();\n    }\n\n    const proxy = this.buildProxy(\n      logger,\n      clusterSupplier,\n      discovery,\n      httpAuth,\n      authStrategyMap,\n    );\n\n    return (\n      customRouter?.({\n        getDefault: () =>\n          this.buildDefaultRouter(\n            objectsProvider,\n            clusterSupplier,\n            catalog,\n            proxy,\n            permissions,\n            httpAuth,\n            authStrategyMap,\n          ),\n        objectsProvider,\n        clusterSupplier,\n        authStrategyMap,\n      }) ??\n      this.buildDefaultRouter(\n        objectsProvider,\n        clusterSupplier,\n        catalog,\n        proxy,\n        permissions,\n        httpAuth,\n        authStrategyMap,\n      )\n    );\n  }\n\n  private buildProxy(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n    discovery: DiscoveryService,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): KubernetesProxy {\n    const authStrategy = new DispatchStrategy({\n      authStrategyMap,\n    });\n    return new KubernetesProxy({\n      logger,\n      clusterSupplier,\n      authStrategy,\n      discovery,\n      httpAuth,\n    });\n  }\n\n  private buildDefaultRouter(\n    objectsProvider: KubernetesObjectsProvider,\n    clusterSupplier: KubernetesClustersSupplier,\n    catalog: CatalogService,\n    proxy: KubernetesProxy,\n    permissionApi: PermissionEvaluator,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): express.Router {\n    const logger = this.env.logger;\n    const router = Router();\n    router.use('/proxy', proxy.createRequestHandler({ permissionApi }));\n    router.use(express.json());\n    router.use(\n      createPermissionIntegrationRouter({\n        permissions: kubernetesPermissions,\n      }),\n    );\n\n    // @deprecated\n    router.post('/services/:serviceId', async (req, res) => {\n      await requirePermission(\n        permissionApi,\n        kubernetesResourcesReadPermission,\n        httpAuth,\n        req,\n      );\n      const serviceId = req.params.serviceId;\n      const requestBody: ObjectsByEntityRequest = req.body;\n      try {\n        const response = await objectsProvider.getKubernetesObjectsByEntity(\n          {\n            entity: requestBody.entity,\n            auth: requestBody.auth || {},\n          },\n          { credentials: await httpAuth.credentials(req) },\n        );\n        res.json(response);\n      } catch (e) {\n        logger.error(\n          `action=retrieveObjectsByServiceId service=${serviceId}, error=${e}`,\n        );\n        res.status(500).json({ error: e.message });\n      }\n    });\n\n    router.get('/clusters', async (req, res) => {\n      await requirePermission(\n        permissionApi,\n        kubernetesClustersReadPermission,\n        httpAuth,\n        req,\n      );\n      const credentials = await httpAuth.credentials(req);\n      const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {\n        credentials,\n      });\n      res.json({\n        items: clusterDetails.map(cd => {\n          const oidcTokenProvider =\n            cd.authMetadata[ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];\n          const authProvider =\n            cd.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n          const strategy = authStrategyMap[authProvider];\n          let auth: AuthMetadata = {};\n          if (strategy) {\n            auth = strategy.presentAuthMetadata(cd.authMetadata);\n          }\n\n          return {\n            name: cd.name,\n            title: cd.title,\n            dashboardUrl: cd.dashboardUrl,\n            authProvider,\n            ...(oidcTokenProvider && { oidcTokenProvider }),\n            ...(auth && Object.keys(auth).length !== 0 && { auth }),\n          };\n        }),\n      });\n    });\n\n    addResourceRoutesToRouter(\n      router,\n      catalog,\n      objectsProvider,\n      httpAuth,\n      permissionApi,\n    );\n\n    return router;\n  }\n\n  private async fetchClusterDetails(\n    clusterSupplier: KubernetesClustersSupplier,\n    options: { credentials: BackstageCredentials },\n  ) {\n    const clusterDetails = await clusterSupplier.getClusters(options);\n\n    this.env.logger.debug(\n      `action=loadClusterDetails numOfClustersLoaded=${clusterDetails.length}`,\n    );\n\n    return clusterDetails;\n  }\n}\n"],"names":["Router","DispatchStrategy","KubernetesProxy","express","createPermissionIntegrationRouter","kubernetesPermissions","requirePermission","kubernetesResourcesReadPermission","kubernetesClustersReadPermission","ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER","ANNOTATION_KUBERNETES_AUTH_PROVIDER","addResourceRoutesToRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoEO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,GAAA,EAA4B;AACxC,IAAA,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAAA,EACjC;AAAA,EAEmB,GAAA;AAAA,EAEnB,YAAY,GAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,MAAa,SAAA,GAAY;AACvB,IAAA,MAAM;AAAA,MACJ,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,QACE,IAAA,CAAK,GAAA;AAET,IAAA,MAAA,CAAO,KAAK,iCAAiC,CAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA,EAAe;AAC1C,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,OAAOA,uBAAA,EAAO;AAAA,IAChB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AAAA,MACjB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OACE,YAAA,GAAe;AAAA,MACb,UAAA,EAAY,MACV,IAAA,CAAK,kBAAA;AAAA,QACH,eAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA,WAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,MACF,eAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACD,KACD,IAAA,CAAK,kBAAA;AAAA,MACH,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EAEJ;AAAA,EAEQ,UAAA,CACN,MAAA,EACA,eAAA,EACA,SAAA,EACA,UACA,eAAA,EACiB;AACjB,IAAA,MAAM,YAAA,GAAe,IAAIC,iCAAA,CAAiB;AAAA,MACxC;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAIC,+BAAA,CAAgB;AAAA,MACzB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEQ,mBACN,eAAA,EACA,eAAA,EACA,SACA,KAAA,EACA,aAAA,EACA,UACA,eAAA,EACgB;AAChB,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,MAAA;AACxB,IAAA,MAAM,SAASF,uBAAA,EAAO;AACtB,IAAA,MAAA,CAAO,IAAI,QAAA,EAAU,KAAA,CAAM,qBAAqB,EAAE,aAAA,EAAe,CAAC,CAAA;AAClE,IAAA,MAAA,CAAO,GAAA,CAAIG,wBAAA,CAAQ,IAAA,EAAM,CAAA;AACzB,IAAA,MAAA,CAAO,GAAA;AAAA,MACLC,sDAAA,CAAkC;AAAA,QAChC,WAAA,EAAaC;AAAA,OACd;AAAA,KACH;AAGA,IAAA,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACtD,MAAA,MAAMC,mCAAA;AAAA,QACJ,aAAA;AAAA,QACAC,wDAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,SAAA;AAC7B,MAAA,MAAM,cAAsC,GAAA,CAAI,IAAA;AAChD,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,4BAAA;AAAA,UACrC;AAAA,YACE,QAAQ,WAAA,CAAY,MAAA;AAAA,YACpB,IAAA,EAAM,WAAA,CAAY,IAAA,IAAQ;AAAC,WAC7B;AAAA,UACA,EAAE,WAAA,EAAa,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,SACjD;AACA,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MACnB,SAAS,CAAA,EAAG;AACV,QAAA,MAAA,CAAO,KAAA;AAAA,UACL,CAAA,0CAAA,EAA6C,SAAS,CAAA,QAAA,EAAW,CAAC,CAAA;AAAA,SACpE;AACA,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,CAAE,SAAS,CAAA;AAAA,MAC3C;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,MAAMD,mCAAA;AAAA,QACJ,aAAA;AAAA,QACAE,uDAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA,CAAoB,eAAA,EAAiB;AAAA,QACrE;AAAA,OACD,CAAA;AACD,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,KAAA,EAAO,cAAA,CAAe,GAAA,CAAI,CAAA,EAAA,KAAM;AAC9B,UAAA,MAAM,iBAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,gEAAyC,CAAA;AAC3D,UAAA,MAAM,YAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,0DAAmC,CAAA;AACrD,UAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAC7C,UAAA,IAAI,OAAqB,EAAC;AAC1B,UAAA,IAAI,QAAA,EAAU;AACZ,YAAA,IAAA,GAAO,QAAA,CAAS,mBAAA,CAAoB,EAAA,CAAG,YAAY,CAAA;AAAA,UACrD;AAEA,UAAA,OAAO;AAAA,YACL,MAAM,EAAA,CAAG,IAAA;AAAA,YACT,OAAO,EAAA,CAAG,KAAA;AAAA,YACV,cAAc,EAAA,CAAG,YAAA;AAAA,YACjB,YAAA;AAAA,YACA,GAAI,iBAAA,IAAqB,EAAE,iBAAA,EAAkB;AAAA,YAC7C,GAAI,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,EAAE,IAAA;AAAK,WACvD;AAAA,QACF,CAAC;AAAA,OACF,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAAC,yCAAA;AAAA,MACE,MAAA;AAAA,MACA,OAAA;AAAA,MACA,eAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,mBAAA,CACZ,eAAA,EACA,OAAA,EACA;AACA,IAAA,MAAM,cAAA,GAAiB,MAAM,eAAA,CAAgB,WAAA,CAAY,OAAO,CAAA;AAEhE,IAAA,IAAA,CAAK,IAAI,MAAA,CAAO,KAAA;AAAA,MACd,CAAA,8CAAA,EAAiD,eAAe,MAAM,CAAA;AAAA,KACxE;AAEA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"KubernetesRouter.cjs.js","sources":["../../src/service/KubernetesRouter.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,\n  kubernetesClustersReadPermission,\n  kubernetesPermissions,\n  kubernetesResourcesReadPermission,\n} from '@backstage/plugin-kubernetes-common';\nimport { PermissionEvaluator } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\n\nimport { DispatchStrategy } from '../auth';\nimport { NotAllowedError } from '@backstage/errors';\n\nimport {\n  AuthService,\n  AuditorService,\n  BackstageCredentials,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport {\n  AuthenticationStrategy,\n  AuthMetadata,\n  KubernetesClustersSupplier,\n  KubernetesFetcher,\n  KubernetesObjectsProvider,\n  KubernetesRouterFactory,\n  KubernetesServiceLocator,\n} from '@backstage/plugin-kubernetes-node';\nimport { addResourceRoutesToRouter } from '../routes/resourcesRoutes';\nimport { ObjectsByEntityRequest } from '../types/types';\nimport { KubernetesProxy } from './KubernetesProxy';\nimport { requirePermission } from '../auth/requirePermission';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { stringifyEntityRef } from '@backstage/catalog-model';\n\nexport interface KubernetesEnvironment {\n  logger: LoggerService;\n  config: Config;\n  catalog: CatalogService;\n  discovery: DiscoveryService;\n  permissions: PermissionEvaluator;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  auditor: AuditorService;\n  authStrategyMap: { [key: string]: AuthenticationStrategy };\n  fetcher: KubernetesFetcher;\n  clusterSupplier: KubernetesClustersSupplier;\n  serviceLocator: KubernetesServiceLocator;\n  objectsProvider: KubernetesObjectsProvider;\n  customRouter?: KubernetesRouterFactory;\n}\n\nexport class KubernetesRouter {\n  static create(env: KubernetesEnvironment) {\n    return new KubernetesRouter(env);\n  }\n\n  protected readonly env: KubernetesEnvironment;\n\n  constructor(env: KubernetesEnvironment) {\n    this.env = env;\n  }\n\n  public async getRouter() {\n    const {\n      logger,\n      config,\n      permissions,\n      authStrategyMap,\n      clusterSupplier,\n      objectsProvider,\n      catalog,\n      discovery,\n      httpAuth,\n      customRouter,\n    } = this.env;\n\n    logger.info('Initializing Kubernetes backend');\n\n    if (!config.has('kubernetes')) {\n      if (process.env.NODE_ENV !== 'development') {\n        throw new Error('Kubernetes configuration is missing');\n      }\n      logger.warn(\n        'Failed to initialize kubernetes backend: kubernetes config is missing',\n      );\n      return Router();\n    }\n\n    const proxy = this.buildProxy(\n      logger,\n      clusterSupplier,\n      discovery,\n      httpAuth,\n      authStrategyMap,\n    );\n\n    return (\n      customRouter?.({\n        getDefault: () =>\n          this.buildDefaultRouter(\n            objectsProvider,\n            clusterSupplier,\n            catalog,\n            proxy,\n            permissions,\n            httpAuth,\n            authStrategyMap,\n          ),\n        objectsProvider,\n        clusterSupplier,\n        authStrategyMap,\n      }) ??\n      this.buildDefaultRouter(\n        objectsProvider,\n        clusterSupplier,\n        catalog,\n        proxy,\n        permissions,\n        httpAuth,\n        authStrategyMap,\n      )\n    );\n  }\n\n  private buildProxy(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n    discovery: DiscoveryService,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): KubernetesProxy {\n    const authStrategy = new DispatchStrategy({\n      authStrategyMap,\n    });\n    return new KubernetesProxy({\n      logger,\n      clusterSupplier,\n      authStrategy,\n      discovery,\n      httpAuth,\n      auditor: this.env.auditor,\n    });\n  }\n\n  private buildDefaultRouter(\n    objectsProvider: KubernetesObjectsProvider,\n    clusterSupplier: KubernetesClustersSupplier,\n    catalog: CatalogService,\n    proxy: KubernetesProxy,\n    permissionApi: PermissionEvaluator,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): express.Router {\n    const logger = this.env.logger;\n    const auditor = this.env.auditor;\n    const router = Router();\n    router.use('/proxy', proxy.createRequestHandler({ permissionApi }));\n    router.use(express.json());\n    router.use(\n      createPermissionIntegrationRouter({\n        permissions: kubernetesPermissions,\n      }),\n    );\n\n    // @deprecated\n    router.post('/services/:serviceId', async (req, res) => {\n      const serviceId = req.params.serviceId;\n      const requestBody: ObjectsByEntityRequest = req.body;\n      let entityRef: string | undefined;\n      if (requestBody?.entity) {\n        try {\n          entityRef = stringifyEntityRef(requestBody.entity);\n        } catch {\n          entityRef = undefined;\n        }\n      }\n\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'resource-fetch',\n        request: req,\n        meta: { queryType: 'services', entityRef, serviceId },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesResourcesReadPermission,\n          httpAuth,\n          req,\n        );\n        const response = await objectsProvider.getKubernetesObjectsByEntity(\n          {\n            entity: requestBody?.entity,\n            auth: requestBody?.auth || {},\n          },\n          { credentials: await httpAuth.credentials(req) },\n        );\n        res.json(response);\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event resource-fetch (services)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        if (e instanceof NotAllowedError) {\n          throw e;\n        }\n        logger.error(\n          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`,\n        );\n        if (!res.headersSent) {\n          res.status(500).json({ error: err.message });\n        }\n      }\n    });\n\n    router.get('/clusters', async (req, res) => {\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'cluster-fetch',\n        request: req,\n        meta: { queryType: 'list' },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesClustersReadPermission,\n          httpAuth,\n          req,\n        );\n        const credentials = await httpAuth.credentials(req);\n        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {\n          credentials,\n        });\n        res.json({\n          items: clusterDetails.map(cd => {\n            const oidcTokenProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];\n            const authProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n            const strategy = authStrategyMap[authProvider];\n            let auth: AuthMetadata = {};\n            if (strategy) {\n              auth = strategy.presentAuthMetadata(cd.authMetadata);\n            }\n\n            return {\n              name: cd.name,\n              title: cd.title,\n              dashboardUrl: cd.dashboardUrl,\n              authProvider,\n              ...(oidcTokenProvider && { oidcTokenProvider }),\n              ...(auth && Object.keys(auth).length !== 0 && { auth }),\n            };\n          }),\n        });\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event cluster-fetch (list)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        throw e;\n      }\n    });\n\n    addResourceRoutesToRouter(\n      router,\n      catalog,\n      objectsProvider,\n      httpAuth,\n      permissionApi,\n      auditor,\n      logger,\n    );\n\n    return router;\n  }\n\n  private async fetchClusterDetails(\n    clusterSupplier: KubernetesClustersSupplier,\n    options: { credentials: BackstageCredentials },\n  ) {\n    const clusterDetails = await clusterSupplier.getClusters(options);\n\n    this.env.logger.debug(\n      `action=loadClusterDetails numOfClustersLoaded=${clusterDetails.length}`,\n    );\n\n    return clusterDetails;\n  }\n}\n"],"names":["Router","DispatchStrategy","KubernetesProxy","express","createPermissionIntegrationRouter","kubernetesPermissions","stringifyEntityRef","requirePermission","kubernetesResourcesReadPermission","NotAllowedError","kubernetesClustersReadPermission","ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER","ANNOTATION_KUBERNETES_AUTH_PROVIDER","addResourceRoutesToRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwEO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,GAAA,EAA4B;AACxC,IAAA,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAAA,EACjC;AAAA,EAEmB,GAAA;AAAA,EAEnB,YAAY,GAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,MAAa,SAAA,GAAY;AACvB,IAAA,MAAM;AAAA,MACJ,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,QACE,IAAA,CAAK,GAAA;AAET,IAAA,MAAA,CAAO,KAAK,iCAAiC,CAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA,EAAe;AAC1C,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,OAAOA,uBAAA,EAAO;AAAA,IAChB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AAAA,MACjB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OACE,YAAA,GAAe;AAAA,MACb,UAAA,EAAY,MACV,IAAA,CAAK,kBAAA;AAAA,QACH,eAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA,WAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,MACF,eAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACD,KACD,IAAA,CAAK,kBAAA;AAAA,MACH,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EAEJ;AAAA,EAEQ,UAAA,CACN,MAAA,EACA,eAAA,EACA,SAAA,EACA,UACA,eAAA,EACiB;AACjB,IAAA,MAAM,YAAA,GAAe,IAAIC,iCAAA,CAAiB;AAAA,MACxC;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAIC,+BAAA,CAAgB;AAAA,MACzB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA,EAAS,KAAK,GAAA,CAAI;AAAA,KACnB,CAAA;AAAA,EACH;AAAA,EAEQ,mBACN,eAAA,EACA,eAAA,EACA,SACA,KAAA,EACA,aAAA,EACA,UACA,eAAA,EACgB;AAChB,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,MAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,OAAA;AACzB,IAAA,MAAM,SAASF,uBAAA,EAAO;AACtB,IAAA,MAAA,CAAO,IAAI,QAAA,EAAU,KAAA,CAAM,qBAAqB,EAAE,aAAA,EAAe,CAAC,CAAA;AAClE,IAAA,MAAA,CAAO,GAAA,CAAIG,wBAAA,CAAQ,IAAA,EAAM,CAAA;AACzB,IAAA,MAAA,CAAO,GAAA;AAAA,MACLC,sDAAA,CAAkC;AAAA,QAChC,WAAA,EAAaC;AAAA,OACd;AAAA,KACH;AAGA,IAAA,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACtD,MAAA,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,SAAA;AAC7B,MAAA,MAAM,cAAsC,GAAA,CAAI,IAAA;AAChD,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,QAAA,IAAI;AACF,UAAA,SAAA,GAAYC,+BAAA,CAAmB,YAAY,MAAM,CAAA;AAAA,QACnD,CAAA,CAAA,MAAQ;AACN,UAAA,SAAA,GAAY,MAAA;AAAA,QACd;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,gBAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,UAAA,EAAY,WAAW,SAAA;AAAU,OACrD,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMC,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAC,wDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,4BAAA;AAAA,UACrC;AAAA,YACE,QAAQ,WAAA,EAAa,MAAA;AAAA,YACrB,IAAA,EAAM,WAAA,EAAa,IAAA,IAAQ;AAAC,WAC9B;AAAA,UACA,EAAE,WAAA,EAAa,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,SACjD;AACA,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AACjB,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,sDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,IAAI,aAAaC,sBAAA,EAAiB;AAChC,UAAA,MAAM,CAAA;AAAA,QACR;AACA,QAAA,MAAA,CAAO,KAAA;AAAA,UACL,CAAA,0CAAA,EAA6C,SAAS,CAAA,SAAA,EAAY,GAAG,CAAA;AAAA,SACvE;AACA,QAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,SAAS,CAAA;AAAA,QAC7C;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,eAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,MAAA;AAAO,OAC3B,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMF,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAG,uDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA,CAAoB,eAAA,EAAiB;AAAA,UACrE;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,KAAA,EAAO,cAAA,CAAe,GAAA,CAAI,CAAA,EAAA,KAAM;AAC9B,YAAA,MAAM,iBAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,gEAAyC,CAAA;AAC3D,YAAA,MAAM,YAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,0DAAmC,CAAA;AACrD,YAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAC7C,YAAA,IAAI,OAAqB,EAAC;AAC1B,YAAA,IAAI,QAAA,EAAU;AACZ,cAAA,IAAA,GAAO,QAAA,CAAS,mBAAA,CAAoB,EAAA,CAAG,YAAY,CAAA;AAAA,YACrD;AAEA,YAAA,OAAO;AAAA,cACL,MAAM,EAAA,CAAG,IAAA;AAAA,cACT,OAAO,EAAA,CAAG,KAAA;AAAA,cACV,cAAc,EAAA,CAAG,YAAA;AAAA,cACjB,YAAA;AAAA,cACA,GAAI,iBAAA,IAAqB,EAAE,iBAAA,EAAkB;AAAA,cAC7C,GAAI,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,EAAE,IAAA;AAAK,aACvD;AAAA,UACF,CAAC;AAAA,SACF,CAAA;AACD,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,iDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,MAAM,CAAA;AAAA,MACR;AAAA,IACF,CAAC,CAAA;AAED,IAAAC,yCAAA;AAAA,MACE,MAAA;AAAA,MACA,OAAA;AAAA,MACA,eAAA;AAAA,MACA,QAAA;AAAA,MACA,aAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,mBAAA,CACZ,eAAA,EACA,OAAA,EACA;AACA,IAAA,MAAM,cAAA,GAAiB,MAAM,eAAA,CAAgB,WAAA,CAAY,OAAO,CAAA;AAEhE,IAAA,IAAA,CAAK,IAAI,MAAA,CAAO,KAAA;AAAA,MACd,CAAA,8CAAA,EAAiD,eAAe,MAAM,CAAA;AAAA,KACxE;AAEA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;;;;"}