@backstage/plugin-kubernetes-backend 0.21.6 → 0.21.7-next.1

package/dist/service/ProxyAuditSession.cjs.js

@@ -0,0 +1,128 @@
+'use strict';
+
+const PROXY_WEBSOCKET_AUDIT = /* @__PURE__ */ Symbol("kubernetesProxyWebSocketAudit");
+class ProxyAuditSession {
+  constructor(event, initialClusterName, logger) {
+    this.event = event;
+    this.initialClusterName = initialClusterName;
+    this.logger = logger;
+  }
+  resolvedClusterName;
+  finalized = false;
+  static async start(auditor, options) {
+    if (!auditor) {
+      return new ProxyAuditSession(
+        void 0,
+        options.clusterName,
+        options.logger
+      );
+    }
+    const sanitizedUrl = (options.req.originalUrl ?? options.req.url).split(
+      "?"
+    )[0];
+    const sanitizedRequest = Object.create(options.req, {
+      originalUrl: { value: sanitizedUrl, enumerable: true },
+      url: { value: sanitizedUrl, enumerable: true }
+    });
+    const event = await auditor.createEvent({
+      eventId: "cluster-fetch",
+      severityLevel: "medium",
+      request: sanitizedRequest,
+      meta: {
+        queryType: "proxy",
+        clusterName: options.clusterName,
+        method: options.method,
+        path: options.path
+      }
+    });
+    return new ProxyAuditSession(event, options.clusterName, options.logger);
+  }
+  setResolvedClusterName(name) {
+    this.resolvedClusterName = name;
+  }
+  finalize(error) {
+    if (this.finalized) {
+      return;
+    }
+    this.finalized = true;
+    if (!this.event) {
+      return;
+    }
+    const terminalMeta = this.resolvedClusterName && this.resolvedClusterName !== this.initialClusterName ? { clusterName: this.resolvedClusterName } : void 0;
+    const audit = error ? this.event.fail({
+      error,
+      ...terminalMeta && { meta: terminalMeta }
+    }) : this.event.success(terminalMeta ? { meta: terminalMeta } : void 0);
+    audit.catch(
+      (err) => this.logger.error("Failed to emit proxy audit event", err)
+    );
+  }
+  attachToHttpResponse(res) {
+    const finalizeFromResponse = () => {
+      if (!res.writableFinished) {
+        this.finalize(
+          new Error("Client disconnected before response completed")
+        );
+      } else if (res.statusCode >= 400) {
+        this.finalize(
+          new Error(`Proxy responded with status ${res.statusCode}`)
+        );
+      } else {
+        this.finalize();
+      }
+    };
+    const finalizeOnce = () => {
+      res.removeListener("finish", finalizeOnce);
+      res.removeListener("close", finalizeOnce);
+      finalizeFromResponse();
+    };
+    res.once("finish", finalizeOnce);
+    res.once("close", finalizeOnce);
+  }
+  prepareForWebSocketUpgrade(req, onSocketClose) {
+    req[PROXY_WEBSOCKET_AUDIT] = { session: this, onSocketClose };
+  }
+  static handleWebSocketProxyReq(proxyReq, req, socket) {
+    const typedReq = req;
+    const context = typedReq[PROXY_WEBSOCKET_AUDIT];
+    if (!context) {
+      return;
+    }
+    delete typedReq[PROXY_WEBSOCKET_AUDIT];
+    const { session, onSocketClose } = context;
+    const cleanups = [];
+    const finalize = (error) => {
+      session.finalize(error);
+      cleanups.forEach((fn) => fn());
+      req.socket.removeListener("close", onSocketClose);
+    };
+    const onUpgrade = () => finalize();
+    const onResponse = (proxyRes) => {
+      finalize(
+        new Error(
+          `Upstream rejected WebSocket upgrade with status ${proxyRes.statusCode}`
+        )
+      );
+    };
+    const onProxyError = (err) => finalize(err);
+    const onSocketError = (err) => finalize(err instanceof Error ? err : new Error(String(err)));
+    const onSocketClosed = () => finalize(
+      new Error("Client closed connection during WebSocket handshake")
+    );
+    proxyReq.once("upgrade", onUpgrade);
+    proxyReq.once("response", onResponse);
+    proxyReq.once("error", onProxyError);
+    socket.once("error", onSocketError);
+    socket.once("close", onSocketClosed);
+    cleanups.push(
+      () => proxyReq.removeListener("upgrade", onUpgrade),
+      () => proxyReq.removeListener("response", onResponse),
+      () => proxyReq.removeListener("error", onProxyError),
+      () => socket.removeListener("error", onSocketError),
+      () => socket.removeListener("close", onSocketClosed)
+    );
+  }
+}
+
+exports.ProxyAuditSession = ProxyAuditSession;
+//# sourceMappingURL=ProxyAuditSession.cjs.js.map

package/dist/service/ProxyAuditSession.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyAuditSession.cjs.js","sources":["../../src/service/ProxyAuditSession.ts"],"sourcesContent":["/*\n * Copyright 2026 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  AuditorService,\n  AuditorServiceEvent,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport type { Request, Response } from 'express';\n\nconst PROXY_WEBSOCKET_AUDIT = Symbol('kubernetesProxyWebSocketAudit');\n\ntype WebSocketAuditContext = {\n  session: ProxyAuditSession;\n  onSocketClose: () => void;\n};\n\n/**\n * Tracks a single proxy request through audit event creation and finalization.\n * When no auditor is configured every method is a no-op.\n */\nexport class ProxyAuditSession {\n  private resolvedClusterName?: string;\n  private finalized = false;\n\n  private constructor(\n    private readonly event: AuditorServiceEvent | undefined,\n    private readonly initialClusterName: string,\n    private readonly logger: LoggerService,\n  ) {}\n\n  static async start(\n    auditor: AuditorService | undefined,\n    options: {\n      req: Request;\n      clusterName: string;\n      method: string | undefined;\n      path: string;\n      logger: LoggerService;\n    },\n  ): Promise<ProxyAuditSession> {\n    if (!auditor) {\n      return new ProxyAuditSession(\n        undefined,\n        options.clusterName,\n        options.logger,\n      );\n    }\n\n    const sanitizedUrl = (options.req.originalUrl ?? options.req.url).split(\n      '?',\n    )[0];\n    const sanitizedRequest = Object.create(options.req, {\n      originalUrl: { value: sanitizedUrl, enumerable: true },\n      url: { value: sanitizedUrl, enumerable: true },\n    });\n\n    const event = await auditor.createEvent({\n      eventId: 'cluster-fetch',\n      severityLevel: 'medium',\n      request: sanitizedRequest,\n      meta: {\n        queryType: 'proxy',\n        clusterName: options.clusterName,\n        method: options.method,\n        path: options.path,\n      },\n    });\n\n    return new ProxyAuditSession(event, options.clusterName, options.logger);\n  }\n\n  setResolvedClusterName(name: string): void {\n    this.resolvedClusterName = name;\n  }\n\n  finalize(error?: Error): void {\n    if (this.finalized) {\n      return;\n    }\n    this.finalized = true;\n\n    if (!this.event) {\n      return;\n    }\n\n    const terminalMeta =\n      this.resolvedClusterName &&\n      this.resolvedClusterName !== this.initialClusterName\n        ? { clusterName: this.resolvedClusterName }\n        : undefined;\n\n    const audit = error\n      ? this.event.fail({\n          error,\n          ...(terminalMeta && { meta: terminalMeta }),\n        })\n      : this.event.success(terminalMeta ? { meta: terminalMeta } : undefined);\n\n    audit.catch(err =>\n      this.logger.error('Failed to emit proxy audit event', err),\n    );\n  }\n\n  attachToHttpResponse(res: Response): void {\n    const finalizeFromResponse = () => {\n      if (!res.writableFinished) {\n        this.finalize(\n          new Error('Client disconnected before response completed'),\n        );\n      } else if (res.statusCode >= 400) {\n        this.finalize(\n          new Error(`Proxy responded with status ${res.statusCode}`),\n        );\n      } else {\n        this.finalize();\n      }\n    };\n\n    const finalizeOnce = () => {\n      res.removeListener('finish', finalizeOnce);\n      res.removeListener('close', finalizeOnce);\n      finalizeFromResponse();\n    };\n\n    res.once('finish', finalizeOnce);\n    res.once('close', finalizeOnce);\n  }\n\n  prepareForWebSocketUpgrade(req: Request, onSocketClose: () => void): void {\n    (req as Request & { [PROXY_WEBSOCKET_AUDIT]?: WebSocketAuditContext })[\n      PROXY_WEBSOCKET_AUDIT\n    ] = { session: this, onSocketClose };\n  }\n\n  static handleWebSocketProxyReq(\n    proxyReq: import('http').ClientRequest,\n    req: import('http').IncomingMessage,\n    socket: import('net').Socket,\n  ): void {\n    const typedReq = req as Request & {\n      [PROXY_WEBSOCKET_AUDIT]?: WebSocketAuditContext;\n    };\n    const context = typedReq[PROXY_WEBSOCKET_AUDIT];\n    if (!context) {\n      return;\n    }\n    delete typedReq[PROXY_WEBSOCKET_AUDIT];\n\n    const { session, onSocketClose } = context;\n    const cleanups: (() => void)[] = [];\n    const finalize = (error?: Error) => {\n      session.finalize(error);\n      cleanups.forEach(fn => fn());\n      req.socket.removeListener('close', onSocketClose);\n    };\n\n    const onUpgrade = () => finalize();\n    const onResponse = (proxyRes: import('http').IncomingMessage) => {\n      finalize(\n        new Error(\n          `Upstream rejected WebSocket upgrade with status ${proxyRes.statusCode}`,\n        ),\n      );\n    };\n    const onProxyError = (err: Error) => finalize(err);\n    const onSocketError = (err: Error | unknown) =>\n      finalize(err instanceof Error ? err : new Error(String(err)));\n    const onSocketClosed = () =>\n      finalize(\n        new Error('Client closed connection during WebSocket handshake'),\n      );\n\n    proxyReq.once('upgrade', onUpgrade);\n    proxyReq.once('response', onResponse);\n    proxyReq.once('error', onProxyError);\n    socket.once('error', onSocketError);\n    socket.once('close', onSocketClosed);\n\n    cleanups.push(\n      () => proxyReq.removeListener('upgrade', onUpgrade),\n      () => proxyReq.removeListener('response', onResponse),\n      () => proxyReq.removeListener('error', onProxyError),\n      () => socket.removeListener('error', onSocketError),\n      () => socket.removeListener('close', onSocketClosed),\n    );\n  }\n}\n"],"names":[],"mappings":";;AAuBA,MAAM,qBAAA,0BAA+B,+BAA+B,CAAA;AAW7D,MAAM,iBAAA,CAAkB;AAAA,EAIrB,WAAA,CACW,KAAA,EACA,kBAAA,EACA,MAAA,EACjB;AAHiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA,EAPK,mBAAA;AAAA,EACA,SAAA,GAAY,KAAA;AAAA,EAQpB,aAAa,KAAA,CACX,OAAA,EACA,OAAA,EAO4B;AAC5B,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,IAAI,iBAAA;AAAA,QACT,MAAA;AAAA,QACA,OAAA,CAAQ,WAAA;AAAA,QACR,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAEA,IAAA,MAAM,gBAAgB,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,OAAA,CAAQ,IAAI,GAAA,EAAK,KAAA;AAAA,MAChE;AAAA,MACA,CAAC,CAAA;AACH,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK;AAAA,MAClD,WAAA,EAAa,EAAE,KAAA,EAAO,YAAA,EAAc,YAAY,IAAA,EAAK;AAAA,MACrD,GAAA,EAAK,EAAE,KAAA,EAAO,YAAA,EAAc,YAAY,IAAA;AAAK,KAC9C,CAAA;AAED,IAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,MACtC,OAAA,EAAS,eAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,gBAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,SAAA,EAAW,OAAA;AAAA,QACX,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,QAAQ,OAAA,CAAQ,MAAA;AAAA,QAChB,MAAM,OAAA,CAAQ;AAAA;AAChB,KACD,CAAA;AAED,IAAA,OAAO,IAAI,iBAAA,CAAkB,KAAA,EAAO,OAAA,CAAQ,WAAA,EAAa,QAAQ,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,uBAAuB,IAAA,EAAoB;AACzC,IAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,EAC7B;AAAA,EAEA,SAAS,KAAA,EAAqB;AAC5B,IAAA,IAAI,KAAK,SAAA,EAAW;AAClB,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AAEjB,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,YAAA,GACJ,IAAA,CAAK,mBAAA,IACL,IAAA,CAAK,mBAAA,KAAwB,IAAA,CAAK,kBAAA,GAC9B,EAAE,WAAA,EAAa,IAAA,CAAK,mBAAA,EAAoB,GACxC,MAAA;AAEN,IAAA,MAAM,KAAA,GAAQ,KAAA,GACV,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK;AAAA,MACd,KAAA;AAAA,MACA,GAAI,YAAA,IAAgB,EAAE,IAAA,EAAM,YAAA;AAAa,KAC1C,CAAA,GACD,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,eAAe,EAAE,IAAA,EAAM,YAAA,EAAa,GAAI,MAAS,CAAA;AAExE,IAAA,KAAA,CAAM,KAAA;AAAA,MAAM,CAAA,GAAA,KACV,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,oCAAoC,GAAG;AAAA,KAC3D;AAAA,EACF;AAAA,EAEA,qBAAqB,GAAA,EAAqB;AACxC,IAAA,MAAM,uBAAuB,MAAM;AACjC,MAAA,IAAI,CAAC,IAAI,gBAAA,EAAkB;AACzB,QAAA,IAAA,CAAK,QAAA;AAAA,UACH,IAAI,MAAM,+CAA+C;AAAA,SAC3D;AAAA,MACF,CAAA,MAAA,IAAW,GAAA,CAAI,UAAA,IAAc,GAAA,EAAK;AAChC,QAAA,IAAA,CAAK,QAAA;AAAA,UACH,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,GAAA,CAAI,UAAU,CAAA,CAAE;AAAA,SAC3D;AAAA,MACF,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,QAAA,EAAS;AAAA,MAChB;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,GAAA,CAAI,cAAA,CAAe,UAAU,YAAY,CAAA;AACzC,MAAA,GAAA,CAAI,cAAA,CAAe,SAAS,YAAY,CAAA;AACxC,MAAA,oBAAA,EAAqB;AAAA,IACvB,CAAA;AAEA,IAAA,GAAA,CAAI,IAAA,CAAK,UAAU,YAAY,CAAA;AAC/B,IAAA,GAAA,CAAI,IAAA,CAAK,SAAS,YAAY,CAAA;AAAA,EAChC;AAAA,EAEA,0BAAA,CAA2B,KAAc,aAAA,EAAiC;AACxE,IAAC,IACC,qBACF,CAAA,GAAI,EAAE,OAAA,EAAS,MAAM,aAAA,EAAc;AAAA,EACrC;AAAA,EAEA,OAAO,uBAAA,CACL,QAAA,EACA,GAAA,EACA,MAAA,EACM;AACN,IAAA,MAAM,QAAA,GAAW,GAAA;AAGjB,IAAA,MAAM,OAAA,GAAU,SAAS,qBAAqB,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA;AAAA,IACF;AACA,IAAA,OAAO,SAAS,qBAAqB,CAAA;AAErC,IAAA,MAAM,EAAE,OAAA,EAAS,aAAA,EAAc,GAAI,OAAA;AACnC,IAAA,MAAM,WAA2B,EAAC;AAClC,IAAA,MAAM,QAAA,GAAW,CAAC,KAAA,KAAkB;AAClC,MAAA,OAAA,CAAQ,SAAS,KAAK,CAAA;AACtB,MAAA,QAAA,CAAS,OAAA,CAAQ,CAAA,EAAA,KAAM,EAAA,EAAI,CAAA;AAC3B,MAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAAA,IAClD,CAAA;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,EAAS;AACjC,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAA6C;AAC/D,MAAA,QAAA;AAAA,QACE,IAAI,KAAA;AAAA,UACF,CAAA,gDAAA,EAAmD,SAAS,UAAU,CAAA;AAAA;AACxE,OACF;AAAA,IACF,CAAA;AACA,IAAA,MAAM,YAAA,GAAe,CAAC,GAAA,KAAe,QAAA,CAAS,GAAG,CAAA;AACjD,IAAA,MAAM,aAAA,GAAgB,CAAC,GAAA,KACrB,QAAA,CAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAC9D,IAAA,MAAM,iBAAiB,MACrB,QAAA;AAAA,MACE,IAAI,MAAM,qDAAqD;AAAA,KACjE;AAEF,IAAA,QAAA,CAAS,IAAA,CAAK,WAAW,SAAS,CAAA;AAClC,IAAA,QAAA,CAAS,IAAA,CAAK,YAAY,UAAU,CAAA;AACpC,IAAA,QAAA,CAAS,IAAA,CAAK,SAAS,YAAY,CAAA;AACnC,IAAA,MAAA,CAAO,IAAA,CAAK,SAAS,aAAa,CAAA;AAClC,IAAA,MAAA,CAAO,IAAA,CAAK,SAAS,cAAc,CAAA;AAEnC,IAAA,QAAA,CAAS,IAAA;AAAA,MACP,MAAM,QAAA,CAAS,cAAA,CAAe,SAAA,EAAW,SAAS,CAAA;AAAA,MAClD,MAAM,QAAA,CAAS,cAAA,CAAe,UAAA,EAAY,UAAU,CAAA;AAAA,MACpD,MAAM,QAAA,CAAS,cAAA,CAAe,OAAA,EAAS,YAAY,CAAA;AAAA,MACnD,MAAM,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAAA,MAClD,MAAM,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,cAAc;AAAA,KACrD;AAAA,EACF;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-kubernetes-backend",
-  "version": "0.21.6",
+  "version": "0.21.7-next.1",
   "description": "A Backstage backend plugin that integrates towards Kubernetes",
   "backstage": {
     "role": "backend-plugin",
@@ -49,18 +49,18 @@
     "@aws-crypto/sha256-js": "^5.0.0",
     "@aws-sdk/credential-providers": "^3.350.0",
     "@azure/identity": "^4.0.0",
-    "@backstage/backend-plugin-api": "^1.9.3",
-    "@backstage/catalog-client": "^1.16.1",
-    "@backstage/catalog-model": "^1.9.0",
-    "@backstage/config": "^1.3.8",
-    "@backstage/errors": "^1.3.1",
-    "@backstage/integration-aws-node": "^0.2.0",
-    "@backstage/plugin-catalog-node": "^2.2.3",
-    "@backstage/plugin-kubernetes-common": "^0.9.12",
-    "@backstage/plugin-kubernetes-node": "^0.4.6",
-    "@backstage/plugin-permission-common": "^0.9.9",
-    "@backstage/plugin-permission-node": "^0.11.2",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-plugin-api": "1.10.0-next.1",
+    "@backstage/catalog-client": "1.16.1",
+    "@backstage/catalog-model": "1.9.0",
+    "@backstage/config": "1.3.8",
+    "@backstage/errors": "1.3.1",
+    "@backstage/integration-aws-node": "0.2.0",
+    "@backstage/plugin-catalog-node": "2.2.4-next.0",
+    "@backstage/plugin-kubernetes-common": "0.9.12",
+    "@backstage/plugin-kubernetes-node": "0.4.7-next.0",
+    "@backstage/plugin-permission-common": "0.9.9",
+    "@backstage/plugin-permission-node": "0.11.3-next.0",
+    "@backstage/types": "1.2.2",
     "@google-cloud/container": "^5.0.0",
     "@jest-mock/express": "^2.0.1",
     "@kubernetes/client-node": "1.4.0",
@@ -75,11 +75,11 @@
     "node-fetch": "^2.7.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.17.5",
-    "@backstage/backend-test-utils": "^1.11.5",
-    "@backstage/cli": "^0.36.4",
-    "@backstage/plugin-permission-backend": "^0.7.14",
-    "@backstage/plugin-permission-backend-module-allow-all-policy": "^0.2.21",
+    "@backstage/backend-defaults": "0.17.7-next.2",
+    "@backstage/backend-test-utils": "1.11.6-next.1",
+    "@backstage/cli": "0.36.5-next.1",
+    "@backstage/plugin-permission-backend": "0.7.15-next.0",
+    "@backstage/plugin-permission-backend-module-allow-all-policy": "0.2.22-next.0",
     "@types/express": "^4.17.6",
     "msw": "^1.0.0",
     "supertest": "^7.0.0",