@backstage/plugin-kubernetes-backend 0.21.6 → 0.22.0-next.1

package/dist/service/KubernetesRouter.cjs.js

@@ -12,9 +12,11 @@ require('@azure/identity');
 require('@google-cloud/container');
 var DispatchStrategy = require('../auth/DispatchStrategy.cjs.js');
 require('fs-extra');
+var errors = require('@backstage/errors');
 var resourcesRoutes = require('../routes/resourcesRoutes.cjs.js');
 var KubernetesProxy = require('./KubernetesProxy.cjs.js');
 var requirePermission = require('../auth/requirePermission.cjs.js');
+var catalogModel = require('@backstage/catalog-model');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -91,11 +93,13 @@ class KubernetesRouter {
       clusterSupplier,
       authStrategy,
       discovery,
-      httpAuth
+      httpAuth,
+      auditor: this.env.auditor
     });
   }
   buildDefaultRouter(objectsProvider, clusterSupplier, catalog, proxy, permissionApi, httpAuth, authStrategyMap) {
     const logger = this.env.logger;
+    const auditor = this.env.auditor;
     const router = Router__default.default();
     router.use("/proxy", proxy.createRequestHandler({ permissionApi }));
     router.use(express__default.default.json());
@@ -105,67 +109,112 @@ class KubernetesRouter {
       })
     );
     router.post("/services/:serviceId", async (req, res) => {
-      await requirePermission.requirePermission(
-        permissionApi,
-        pluginKubernetesCommon.kubernetesResourcesReadPermission,
-        httpAuth,
-        req
-      );
       const serviceId = req.params.serviceId;
       const requestBody = req.body;
+      let entityRef;
+      if (requestBody?.entity) {
+        try {
+          entityRef = catalogModel.stringifyEntityRef(requestBody.entity);
+        } catch {
+          entityRef = void 0;
+        }
+      }
+      const auditorEvent = await auditor.createEvent({
+        eventId: "resource-fetch",
+        request: req,
+        meta: { queryType: "services", entityRef, serviceId }
+      });
       try {
+        await requirePermission.requirePermission(
+          permissionApi,
+          pluginKubernetesCommon.kubernetesResourcesReadPermission,
+          httpAuth,
+          req
+        );
         const response = await objectsProvider.getKubernetesObjectsByEntity(
           {
-            entity: requestBody.entity,
-            auth: requestBody.auth || {}
+            entity: requestBody?.entity,
+            auth: requestBody?.auth || {}
           },
           { credentials: await httpAuth.credentials(req) }
         );
         res.json(response);
+        auditorEvent.success().catch(
+          (error) => logger.error(
+            "Failed to emit audit event resource-fetch (services)",
+            error
+          )
+        );
       } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        await auditorEvent.fail({ error: err });
+        if (e instanceof errors.NotAllowedError) {
+          throw e;
+        }
         logger.error(
-          `action=retrieveObjectsByServiceId service=${serviceId}, error=${e}`
+          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`
         );
-        res.status(500).json({ error: e.message });
+        if (!res.headersSent) {
+          res.status(500).json({ error: err.message });
+        }
       }
     });
     router.get("/clusters", async (req, res) => {
-      await requirePermission.requirePermission(
-        permissionApi,
-        pluginKubernetesCommon.kubernetesClustersReadPermission,
-        httpAuth,
-        req
-      );
-      const credentials = await httpAuth.credentials(req);
-      const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {
-        credentials
-      });
-      res.json({
-        items: clusterDetails.map((cd) => {
-          const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
-          const authProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
-          const strategy = authStrategyMap[authProvider];
-          let auth = {};
-          if (strategy) {
-            auth = strategy.presentAuthMetadata(cd.authMetadata);
-          }
-          return {
-            name: cd.name,
-            title: cd.title,
-            dashboardUrl: cd.dashboardUrl,
-            authProvider,
-            ...oidcTokenProvider && { oidcTokenProvider },
-            ...auth && Object.keys(auth).length !== 0 && { auth }
-          };
-        })
+      const auditorEvent = await auditor.createEvent({
+        eventId: "cluster-fetch",
+        request: req,
+        meta: { queryType: "list" }
       });
+      try {
+        await requirePermission.requirePermission(
+          permissionApi,
+          pluginKubernetesCommon.kubernetesClustersReadPermission,
+          httpAuth,
+          req
+        );
+        const credentials = await httpAuth.credentials(req);
+        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {
+          credentials
+        });
+        res.json({
+          items: clusterDetails.map((cd) => {
+            const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
+            const authProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
+            const strategy = authStrategyMap[authProvider];
+            let auth = {};
+            if (strategy) {
+              auth = strategy.presentAuthMetadata(cd.authMetadata);
+            }
+            return {
+              name: cd.name,
+              title: cd.title,
+              dashboardUrl: cd.dashboardUrl,
+              authProvider,
+              ...oidcTokenProvider && { oidcTokenProvider },
+              ...auth && Object.keys(auth).length !== 0 && { auth }
+            };
+          })
+        });
+        auditorEvent.success().catch(
+          (error) => logger.error(
+            "Failed to emit audit event cluster-fetch (list)",
+            error
+          )
+        );
+      } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        await auditorEvent.fail({ error: err });
+        throw e;
+      }
     });
     resourcesRoutes.addResourceRoutesToRouter(
       router,
       catalog,
       objectsProvider,
       httpAuth,
-      permissionApi
+      permissionApi,
+      auditor,
+      logger
     );
     return router;
   }

package/dist/service/KubernetesRouter.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesRouter.cjs.js","sources":["../../src/service/KubernetesRouter.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,\n  kubernetesClustersReadPermission,\n  kubernetesPermissions,\n  kubernetesResourcesReadPermission,\n} from '@backstage/plugin-kubernetes-common';\nimport { PermissionEvaluator } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\n\nimport { DispatchStrategy } from '../auth';\n\nimport {\n  AuthService,\n  BackstageCredentials,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport {\n  AuthenticationStrategy,\n  AuthMetadata,\n  KubernetesClustersSupplier,\n  KubernetesFetcher,\n  KubernetesObjectsProvider,\n  KubernetesRouterFactory,\n  KubernetesServiceLocator,\n} from '@backstage/plugin-kubernetes-node';\nimport { addResourceRoutesToRouter } from '../routes/resourcesRoutes';\nimport { ObjectsByEntityRequest } from '../types/types';\nimport { KubernetesProxy } from './KubernetesProxy';\nimport { requirePermission } from '../auth/requirePermission';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\n\nexport interface KubernetesEnvironment {\n  logger: LoggerService;\n  config: Config;\n  catalog: CatalogService;\n  discovery: DiscoveryService;\n  permissions: PermissionEvaluator;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  authStrategyMap: { [key: string]: AuthenticationStrategy };\n  fetcher: KubernetesFetcher;\n  clusterSupplier: KubernetesClustersSupplier;\n  serviceLocator: KubernetesServiceLocator;\n  objectsProvider: KubernetesObjectsProvider;\n  customRouter?: KubernetesRouterFactory;\n}\n\nexport class KubernetesRouter {\n  static create(env: KubernetesEnvironment) {\n    return new KubernetesRouter(env);\n  }\n\n  protected readonly env: KubernetesEnvironment;\n\n  constructor(env: KubernetesEnvironment) {\n    this.env = env;\n  }\n\n  public async getRouter() {\n    const {\n      logger,\n      config,\n      permissions,\n      authStrategyMap,\n      clusterSupplier,\n      objectsProvider,\n      catalog,\n      discovery,\n      httpAuth,\n      customRouter,\n    } = this.env;\n\n    logger.info('Initializing Kubernetes backend');\n\n    if (!config.has('kubernetes')) {\n      if (process.env.NODE_ENV !== 'development') {\n        throw new Error('Kubernetes configuration is missing');\n      }\n      logger.warn(\n        'Failed to initialize kubernetes backend: kubernetes config is missing',\n      );\n      return Router();\n    }\n\n    const proxy = this.buildProxy(\n      logger,\n      clusterSupplier,\n      discovery,\n      httpAuth,\n      authStrategyMap,\n    );\n\n    return (\n      customRouter?.({\n        getDefault: () =>\n          this.buildDefaultRouter(\n            objectsProvider,\n            clusterSupplier,\n            catalog,\n            proxy,\n            permissions,\n            httpAuth,\n            authStrategyMap,\n          ),\n        objectsProvider,\n        clusterSupplier,\n        authStrategyMap,\n      }) ??\n      this.buildDefaultRouter(\n        objectsProvider,\n        clusterSupplier,\n        catalog,\n        proxy,\n        permissions,\n        httpAuth,\n        authStrategyMap,\n      )\n    );\n  }\n\n  private buildProxy(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n    discovery: DiscoveryService,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): KubernetesProxy {\n    const authStrategy = new DispatchStrategy({\n      authStrategyMap,\n    });\n    return new KubernetesProxy({\n      logger,\n      clusterSupplier,\n      authStrategy,\n      discovery,\n      httpAuth,\n    });\n  }\n\n  private buildDefaultRouter(\n    objectsProvider: KubernetesObjectsProvider,\n    clusterSupplier: KubernetesClustersSupplier,\n    catalog: CatalogService,\n    proxy: KubernetesProxy,\n    permissionApi: PermissionEvaluator,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): express.Router {\n    const logger = this.env.logger;\n    const router = Router();\n    router.use('/proxy', proxy.createRequestHandler({ permissionApi }));\n    router.use(express.json());\n    router.use(\n      createPermissionIntegrationRouter({\n        permissions: kubernetesPermissions,\n      }),\n    );\n\n    // @deprecated\n    router.post('/services/:serviceId', async (req, res) => {\n      await requirePermission(\n        permissionApi,\n        kubernetesResourcesReadPermission,\n        httpAuth,\n        req,\n      );\n      const serviceId = req.params.serviceId;\n      const requestBody: ObjectsByEntityRequest = req.body;\n      try {\n        const response = await objectsProvider.getKubernetesObjectsByEntity(\n          {\n            entity: requestBody.entity,\n            auth: requestBody.auth || {},\n          },\n          { credentials: await httpAuth.credentials(req) },\n        );\n        res.json(response);\n      } catch (e) {\n        logger.error(\n          `action=retrieveObjectsByServiceId service=${serviceId}, error=${e}`,\n        );\n        res.status(500).json({ error: e.message });\n      }\n    });\n\n    router.get('/clusters', async (req, res) => {\n      await requirePermission(\n        permissionApi,\n        kubernetesClustersReadPermission,\n        httpAuth,\n        req,\n      );\n      const credentials = await httpAuth.credentials(req);\n      const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {\n        credentials,\n      });\n      res.json({\n        items: clusterDetails.map(cd => {\n          const oidcTokenProvider =\n            cd.authMetadata[ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];\n          const authProvider =\n            cd.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n          const strategy = authStrategyMap[authProvider];\n          let auth: AuthMetadata = {};\n          if (strategy) {\n            auth = strategy.presentAuthMetadata(cd.authMetadata);\n          }\n\n          return {\n            name: cd.name,\n            title: cd.title,\n            dashboardUrl: cd.dashboardUrl,\n            authProvider,\n            ...(oidcTokenProvider && { oidcTokenProvider }),\n            ...(auth && Object.keys(auth).length !== 0 && { auth }),\n          };\n        }),\n      });\n    });\n\n    addResourceRoutesToRouter(\n      router,\n      catalog,\n      objectsProvider,\n      httpAuth,\n      permissionApi,\n    );\n\n    return router;\n  }\n\n  private async fetchClusterDetails(\n    clusterSupplier: KubernetesClustersSupplier,\n    options: { credentials: BackstageCredentials },\n  ) {\n    const clusterDetails = await clusterSupplier.getClusters(options);\n\n    this.env.logger.debug(\n      `action=loadClusterDetails numOfClustersLoaded=${clusterDetails.length}`,\n    );\n\n    return clusterDetails;\n  }\n}\n"],"names":["Router","DispatchStrategy","KubernetesProxy","express","createPermissionIntegrationRouter","kubernetesPermissions","requirePermission","kubernetesResourcesReadPermission","kubernetesClustersReadPermission","ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER","ANNOTATION_KUBERNETES_AUTH_PROVIDER","addResourceRoutesToRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoEO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,GAAA,EAA4B;AACxC,IAAA,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAAA,EACjC;AAAA,EAEmB,GAAA;AAAA,EAEnB,YAAY,GAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,MAAa,SAAA,GAAY;AACvB,IAAA,MAAM;AAAA,MACJ,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,QACE,IAAA,CAAK,GAAA;AAET,IAAA,MAAA,CAAO,KAAK,iCAAiC,CAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA,EAAe;AAC1C,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,OAAOA,uBAAA,EAAO;AAAA,IAChB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AAAA,MACjB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OACE,YAAA,GAAe;AAAA,MACb,UAAA,EAAY,MACV,IAAA,CAAK,kBAAA;AAAA,QACH,eAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA,WAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,MACF,eAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACD,KACD,IAAA,CAAK,kBAAA;AAAA,MACH,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EAEJ;AAAA,EAEQ,UAAA,CACN,MAAA,EACA,eAAA,EACA,SAAA,EACA,UACA,eAAA,EACiB;AACjB,IAAA,MAAM,YAAA,GAAe,IAAIC,iCAAA,CAAiB;AAAA,MACxC;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAIC,+BAAA,CAAgB;AAAA,MACzB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEQ,mBACN,eAAA,EACA,eAAA,EACA,SACA,KAAA,EACA,aAAA,EACA,UACA,eAAA,EACgB;AAChB,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,MAAA;AACxB,IAAA,MAAM,SAASF,uBAAA,EAAO;AACtB,IAAA,MAAA,CAAO,IAAI,QAAA,EAAU,KAAA,CAAM,qBAAqB,EAAE,aAAA,EAAe,CAAC,CAAA;AAClE,IAAA,MAAA,CAAO,GAAA,CAAIG,wBAAA,CAAQ,IAAA,EAAM,CAAA;AACzB,IAAA,MAAA,CAAO,GAAA;AAAA,MACLC,sDAAA,CAAkC;AAAA,QAChC,WAAA,EAAaC;AAAA,OACd;AAAA,KACH;AAGA,IAAA,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACtD,MAAA,MAAMC,mCAAA;AAAA,QACJ,aAAA;AAAA,QACAC,wDAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,SAAA;AAC7B,MAAA,MAAM,cAAsC,GAAA,CAAI,IAAA;AAChD,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,4BAAA;AAAA,UACrC;AAAA,YACE,QAAQ,WAAA,CAAY,MAAA;AAAA,YACpB,IAAA,EAAM,WAAA,CAAY,IAAA,IAAQ;AAAC,WAC7B;AAAA,UACA,EAAE,WAAA,EAAa,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,SACjD;AACA,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,MACnB,SAAS,CAAA,EAAG;AACV,QAAA,MAAA,CAAO,KAAA;AAAA,UACL,CAAA,0CAAA,EAA6C,SAAS,CAAA,QAAA,EAAW,CAAC,CAAA;AAAA,SACpE;AACA,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,CAAE,SAAS,CAAA;AAAA,MAC3C;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,MAAMD,mCAAA;AAAA,QACJ,aAAA;AAAA,QACAE,uDAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA,CAAoB,eAAA,EAAiB;AAAA,QACrE;AAAA,OACD,CAAA;AACD,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,KAAA,EAAO,cAAA,CAAe,GAAA,CAAI,CAAA,EAAA,KAAM;AAC9B,UAAA,MAAM,iBAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,gEAAyC,CAAA;AAC3D,UAAA,MAAM,YAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,0DAAmC,CAAA;AACrD,UAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAC7C,UAAA,IAAI,OAAqB,EAAC;AAC1B,UAAA,IAAI,QAAA,EAAU;AACZ,YAAA,IAAA,GAAO,QAAA,CAAS,mBAAA,CAAoB,EAAA,CAAG,YAAY,CAAA;AAAA,UACrD;AAEA,UAAA,OAAO;AAAA,YACL,MAAM,EAAA,CAAG,IAAA;AAAA,YACT,OAAO,EAAA,CAAG,KAAA;AAAA,YACV,cAAc,EAAA,CAAG,YAAA;AAAA,YACjB,YAAA;AAAA,YACA,GAAI,iBAAA,IAAqB,EAAE,iBAAA,EAAkB;AAAA,YAC7C,GAAI,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,EAAE,IAAA;AAAK,WACvD;AAAA,QACF,CAAC;AAAA,OACF,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAAC,yCAAA;AAAA,MACE,MAAA;AAAA,MACA,OAAA;AAAA,MACA,eAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,mBAAA,CACZ,eAAA,EACA,OAAA,EACA;AACA,IAAA,MAAM,cAAA,GAAiB,MAAM,eAAA,CAAgB,WAAA,CAAY,OAAO,CAAA;AAEhE,IAAA,IAAA,CAAK,IAAI,MAAA,CAAO,KAAA;AAAA,MACd,CAAA,8CAAA,EAAiD,eAAe,MAAM,CAAA;AAAA,KACxE;AAEA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"KubernetesRouter.cjs.js","sources":["../../src/service/KubernetesRouter.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Config } from '@backstage/config';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,\n  kubernetesClustersReadPermission,\n  kubernetesPermissions,\n  kubernetesResourcesReadPermission,\n} from '@backstage/plugin-kubernetes-common';\nimport { PermissionEvaluator } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport express from 'express';\nimport Router from 'express-promise-router';\n\nimport { DispatchStrategy } from '../auth';\nimport { NotAllowedError } from '@backstage/errors';\n\nimport {\n  AuthService,\n  AuditorService,\n  BackstageCredentials,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n} from '@backstage/backend-plugin-api';\nimport {\n  AuthenticationStrategy,\n  AuthMetadata,\n  KubernetesClustersSupplier,\n  KubernetesFetcher,\n  KubernetesObjectsProvider,\n  KubernetesRouterFactory,\n  KubernetesServiceLocator,\n} from '@backstage/plugin-kubernetes-node';\nimport { addResourceRoutesToRouter } from '../routes/resourcesRoutes';\nimport { ObjectsByEntityRequest } from '../types/types';\nimport { KubernetesProxy } from './KubernetesProxy';\nimport { requirePermission } from '../auth/requirePermission';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { stringifyEntityRef } from '@backstage/catalog-model';\n\nexport interface KubernetesEnvironment {\n  logger: LoggerService;\n  config: Config;\n  catalog: CatalogService;\n  discovery: DiscoveryService;\n  permissions: PermissionEvaluator;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  auditor: AuditorService;\n  authStrategyMap: { [key: string]: AuthenticationStrategy };\n  fetcher: KubernetesFetcher;\n  clusterSupplier: KubernetesClustersSupplier;\n  serviceLocator: KubernetesServiceLocator;\n  objectsProvider: KubernetesObjectsProvider;\n  customRouter?: KubernetesRouterFactory;\n}\n\nexport class KubernetesRouter {\n  static create(env: KubernetesEnvironment) {\n    return new KubernetesRouter(env);\n  }\n\n  protected readonly env: KubernetesEnvironment;\n\n  constructor(env: KubernetesEnvironment) {\n    this.env = env;\n  }\n\n  public async getRouter() {\n    const {\n      logger,\n      config,\n      permissions,\n      authStrategyMap,\n      clusterSupplier,\n      objectsProvider,\n      catalog,\n      discovery,\n      httpAuth,\n      customRouter,\n    } = this.env;\n\n    logger.info('Initializing Kubernetes backend');\n\n    if (!config.has('kubernetes')) {\n      if (process.env.NODE_ENV !== 'development') {\n        throw new Error('Kubernetes configuration is missing');\n      }\n      logger.warn(\n        'Failed to initialize kubernetes backend: kubernetes config is missing',\n      );\n      return Router();\n    }\n\n    const proxy = this.buildProxy(\n      logger,\n      clusterSupplier,\n      discovery,\n      httpAuth,\n      authStrategyMap,\n    );\n\n    return (\n      customRouter?.({\n        getDefault: () =>\n          this.buildDefaultRouter(\n            objectsProvider,\n            clusterSupplier,\n            catalog,\n            proxy,\n            permissions,\n            httpAuth,\n            authStrategyMap,\n          ),\n        objectsProvider,\n        clusterSupplier,\n        authStrategyMap,\n      }) ??\n      this.buildDefaultRouter(\n        objectsProvider,\n        clusterSupplier,\n        catalog,\n        proxy,\n        permissions,\n        httpAuth,\n        authStrategyMap,\n      )\n    );\n  }\n\n  private buildProxy(\n    logger: LoggerService,\n    clusterSupplier: KubernetesClustersSupplier,\n    discovery: DiscoveryService,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): KubernetesProxy {\n    const authStrategy = new DispatchStrategy({\n      authStrategyMap,\n    });\n    return new KubernetesProxy({\n      logger,\n      clusterSupplier,\n      authStrategy,\n      discovery,\n      httpAuth,\n      auditor: this.env.auditor,\n    });\n  }\n\n  private buildDefaultRouter(\n    objectsProvider: KubernetesObjectsProvider,\n    clusterSupplier: KubernetesClustersSupplier,\n    catalog: CatalogService,\n    proxy: KubernetesProxy,\n    permissionApi: PermissionEvaluator,\n    httpAuth: HttpAuthService,\n    authStrategyMap: { [key: string]: AuthenticationStrategy },\n  ): express.Router {\n    const logger = this.env.logger;\n    const auditor = this.env.auditor;\n    const router = Router();\n    router.use('/proxy', proxy.createRequestHandler({ permissionApi }));\n    router.use(express.json());\n    router.use(\n      createPermissionIntegrationRouter({\n        permissions: kubernetesPermissions,\n      }),\n    );\n\n    // @deprecated\n    router.post('/services/:serviceId', async (req, res) => {\n      const serviceId = req.params.serviceId;\n      const requestBody: ObjectsByEntityRequest = req.body;\n      let entityRef: string | undefined;\n      if (requestBody?.entity) {\n        try {\n          entityRef = stringifyEntityRef(requestBody.entity);\n        } catch {\n          entityRef = undefined;\n        }\n      }\n\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'resource-fetch',\n        request: req,\n        meta: { queryType: 'services', entityRef, serviceId },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesResourcesReadPermission,\n          httpAuth,\n          req,\n        );\n        const response = await objectsProvider.getKubernetesObjectsByEntity(\n          {\n            entity: requestBody?.entity,\n            auth: requestBody?.auth || {},\n          },\n          { credentials: await httpAuth.credentials(req) },\n        );\n        res.json(response);\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event resource-fetch (services)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        if (e instanceof NotAllowedError) {\n          throw e;\n        }\n        logger.error(\n          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`,\n        );\n        if (!res.headersSent) {\n          res.status(500).json({ error: err.message });\n        }\n      }\n    });\n\n    router.get('/clusters', async (req, res) => {\n      const auditorEvent = await auditor.createEvent({\n        eventId: 'cluster-fetch',\n        request: req,\n        meta: { queryType: 'list' },\n      });\n\n      try {\n        await requirePermission(\n          permissionApi,\n          kubernetesClustersReadPermission,\n          httpAuth,\n          req,\n        );\n        const credentials = await httpAuth.credentials(req);\n        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {\n          credentials,\n        });\n        res.json({\n          items: clusterDetails.map(cd => {\n            const oidcTokenProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];\n            const authProvider =\n              cd.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n            const strategy = authStrategyMap[authProvider];\n            let auth: AuthMetadata = {};\n            if (strategy) {\n              auth = strategy.presentAuthMetadata(cd.authMetadata);\n            }\n\n            return {\n              name: cd.name,\n              title: cd.title,\n              dashboardUrl: cd.dashboardUrl,\n              authProvider,\n              ...(oidcTokenProvider && { oidcTokenProvider }),\n              ...(auth && Object.keys(auth).length !== 0 && { auth }),\n            };\n          }),\n        });\n        auditorEvent\n          .success()\n          .catch(error =>\n            logger.error(\n              'Failed to emit audit event cluster-fetch (list)',\n              error,\n            ),\n          );\n      } catch (e) {\n        const err = e instanceof Error ? e : new Error(String(e));\n        await auditorEvent.fail({ error: err });\n        throw e;\n      }\n    });\n\n    addResourceRoutesToRouter(\n      router,\n      catalog,\n      objectsProvider,\n      httpAuth,\n      permissionApi,\n      auditor,\n      logger,\n    );\n\n    return router;\n  }\n\n  private async fetchClusterDetails(\n    clusterSupplier: KubernetesClustersSupplier,\n    options: { credentials: BackstageCredentials },\n  ) {\n    const clusterDetails = await clusterSupplier.getClusters(options);\n\n    this.env.logger.debug(\n      `action=loadClusterDetails numOfClustersLoaded=${clusterDetails.length}`,\n    );\n\n    return clusterDetails;\n  }\n}\n"],"names":["Router","DispatchStrategy","KubernetesProxy","express","createPermissionIntegrationRouter","kubernetesPermissions","stringifyEntityRef","requirePermission","kubernetesResourcesReadPermission","NotAllowedError","kubernetesClustersReadPermission","ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER","ANNOTATION_KUBERNETES_AUTH_PROVIDER","addResourceRoutesToRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwEO,MAAM,gBAAA,CAAiB;AAAA,EAC5B,OAAO,OAAO,GAAA,EAA4B;AACxC,IAAA,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAAA,EACjC;AAAA,EAEmB,GAAA;AAAA,EAEnB,YAAY,GAAA,EAA4B;AACtC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,MAAa,SAAA,GAAY;AACvB,IAAA,MAAM;AAAA,MACJ,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,QACE,IAAA,CAAK,GAAA;AAET,IAAA,MAAA,CAAO,KAAK,iCAAiC,CAAA;AAE7C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,YAAY,CAAA,EAAG;AAC7B,MAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA,EAAe;AAC1C,QAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,MACvD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,OAAOA,uBAAA,EAAO;AAAA,IAChB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AAAA,MACjB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OACE,YAAA,GAAe;AAAA,MACb,UAAA,EAAY,MACV,IAAA,CAAK,kBAAA;AAAA,QACH,eAAA;AAAA,QACA,eAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA,WAAA;AAAA,QACA,QAAA;AAAA,QACA;AAAA,OACF;AAAA,MACF,eAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACD,KACD,IAAA,CAAK,kBAAA;AAAA,MACH,eAAA;AAAA,MACA,eAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EAEJ;AAAA,EAEQ,UAAA,CACN,MAAA,EACA,eAAA,EACA,SAAA,EACA,UACA,eAAA,EACiB;AACjB,IAAA,MAAM,YAAA,GAAe,IAAIC,iCAAA,CAAiB;AAAA,MACxC;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAIC,+BAAA,CAAgB;AAAA,MACzB,MAAA;AAAA,MACA,eAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA,OAAA,EAAS,KAAK,GAAA,CAAI;AAAA,KACnB,CAAA;AAAA,EACH;AAAA,EAEQ,mBACN,eAAA,EACA,eAAA,EACA,SACA,KAAA,EACA,aAAA,EACA,UACA,eAAA,EACgB;AAChB,IAAA,MAAM,MAAA,GAAS,KAAK,GAAA,CAAI,MAAA;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,OAAA;AACzB,IAAA,MAAM,SAASF,uBAAA,EAAO;AACtB,IAAA,MAAA,CAAO,IAAI,QAAA,EAAU,KAAA,CAAM,qBAAqB,EAAE,aAAA,EAAe,CAAC,CAAA;AAClE,IAAA,MAAA,CAAO,GAAA,CAAIG,wBAAA,CAAQ,IAAA,EAAM,CAAA;AACzB,IAAA,MAAA,CAAO,GAAA;AAAA,MACLC,sDAAA,CAAkC;AAAA,QAChC,WAAA,EAAaC;AAAA,OACd;AAAA,KACH;AAGA,IAAA,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACtD,MAAA,MAAM,SAAA,GAAY,IAAI,MAAA,CAAO,SAAA;AAC7B,MAAA,MAAM,cAAsC,GAAA,CAAI,IAAA;AAChD,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,QAAA,IAAI;AACF,UAAA,SAAA,GAAYC,+BAAA,CAAmB,YAAY,MAAM,CAAA;AAAA,QACnD,CAAA,CAAA,MAAQ;AACN,UAAA,SAAA,GAAY,MAAA;AAAA,QACd;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,gBAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,UAAA,EAAY,WAAW,SAAA;AAAU,OACrD,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMC,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAC,wDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,4BAAA;AAAA,UACrC;AAAA,YACE,QAAQ,WAAA,EAAa,MAAA;AAAA,YACrB,IAAA,EAAM,WAAA,EAAa,IAAA,IAAQ;AAAC,WAC9B;AAAA,UACA,EAAE,WAAA,EAAa,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,SACjD;AACA,QAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AACjB,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,sDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,IAAI,aAAaC,sBAAA,EAAiB;AAChC,UAAA,MAAM,CAAA;AAAA,QACR;AACA,QAAA,MAAA,CAAO,KAAA;AAAA,UACL,CAAA,0CAAA,EAA6C,SAAS,CAAA,SAAA,EAAY,GAAG,CAAA;AAAA,SACvE;AACA,QAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,SAAS,CAAA;AAAA,QAC7C;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC1C,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,WAAA,CAAY;AAAA,QAC7C,OAAA,EAAS,eAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,SAAA,EAAW,MAAA;AAAO,OAC3B,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAMF,mCAAA;AAAA,UACJ,aAAA;AAAA,UACAG,uDAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,mBAAA,CAAoB,eAAA,EAAiB;AAAA,UACrE;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,KAAA,EAAO,cAAA,CAAe,GAAA,CAAI,CAAA,EAAA,KAAM;AAC9B,YAAA,MAAM,iBAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,gEAAyC,CAAA;AAC3D,YAAA,MAAM,YAAA,GACJ,EAAA,CAAG,YAAA,CAAaC,0DAAmC,CAAA;AACrD,YAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAC7C,YAAA,IAAI,OAAqB,EAAC;AAC1B,YAAA,IAAI,QAAA,EAAU;AACZ,cAAA,IAAA,GAAO,QAAA,CAAS,mBAAA,CAAoB,EAAA,CAAG,YAAY,CAAA;AAAA,YACrD;AAEA,YAAA,OAAO;AAAA,cACL,MAAM,EAAA,CAAG,IAAA;AAAA,cACT,OAAO,EAAA,CAAG,KAAA;AAAA,cACV,cAAc,EAAA,CAAG,YAAA;AAAA,cACjB,YAAA;AAAA,cACA,GAAI,iBAAA,IAAqB,EAAE,iBAAA,EAAkB;AAAA,cAC7C,GAAI,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,IAAK,EAAE,IAAA;AAAK,aACvD;AAAA,UACF,CAAC;AAAA,SACF,CAAA;AACD,QAAA,YAAA,CACG,SAAQ,CACR,KAAA;AAAA,UAAM,WACL,MAAA,CAAO,KAAA;AAAA,YACL,iDAAA;AAAA,YACA;AAAA;AACF,SACF;AAAA,MACJ,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,GAAA,GAAM,aAAa,KAAA,GAAQ,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AACxD,QAAA,MAAM,YAAA,CAAa,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACtC,QAAA,MAAM,CAAA;AAAA,MACR;AAAA,IACF,CAAC,CAAA;AAED,IAAAC,yCAAA;AAAA,MACE,MAAA;AAAA,MACA,OAAA;AAAA,MACA,eAAA;AAAA,MACA,QAAA;AAAA,MACA,aAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,mBAAA,CACZ,eAAA,EACA,OAAA,EACA;AACA,IAAA,MAAM,cAAA,GAAiB,MAAM,eAAA,CAAgB,WAAA,CAAY,OAAO,CAAA;AAEhE,IAAA,IAAA,CAAK,IAAI,MAAA,CAAO,KAAA;AAAA,MACd,CAAA,8CAAA,EAAiD,eAAe,MAAM,CAAA;AAAA,KACxE;AAEA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-kubernetes-backend",
-  "version": "0.21.6",
+  "version": "0.22.0-next.1",
   "description": "A Backstage backend plugin that integrates towards Kubernetes",
   "backstage": {
     "role": "backend-plugin",
@@ -49,18 +49,18 @@
     "@aws-crypto/sha256-js": "^5.0.0",
     "@aws-sdk/credential-providers": "^3.350.0",
     "@azure/identity": "^4.0.0",
-    "@backstage/backend-plugin-api": "^1.9.3",
-    "@backstage/catalog-client": "^1.16.1",
-    "@backstage/catalog-model": "^1.9.0",
-    "@backstage/config": "^1.3.8",
-    "@backstage/errors": "^1.3.1",
-    "@backstage/integration-aws-node": "^0.2.0",
-    "@backstage/plugin-catalog-node": "^2.2.3",
-    "@backstage/plugin-kubernetes-common": "^0.9.12",
-    "@backstage/plugin-kubernetes-node": "^0.4.6",
-    "@backstage/plugin-permission-common": "^0.9.9",
-    "@backstage/plugin-permission-node": "^0.11.2",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-plugin-api": "1.10.0-next.0",
+    "@backstage/catalog-client": "1.16.1",
+    "@backstage/catalog-model": "1.9.0",
+    "@backstage/config": "1.3.8",
+    "@backstage/errors": "1.3.1",
+    "@backstage/integration-aws-node": "0.2.0",
+    "@backstage/plugin-catalog-node": "2.2.4-next.0",
+    "@backstage/plugin-kubernetes-common": "0.9.12",
+    "@backstage/plugin-kubernetes-node": "0.4.7-next.0",
+    "@backstage/plugin-permission-common": "0.9.9",
+    "@backstage/plugin-permission-node": "0.11.3-next.0",
+    "@backstage/types": "1.2.2",
     "@google-cloud/container": "^5.0.0",
     "@jest-mock/express": "^2.0.1",
     "@kubernetes/client-node": "1.4.0",
@@ -75,11 +75,11 @@
     "node-fetch": "^2.7.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.17.5",
-    "@backstage/backend-test-utils": "^1.11.5",
-    "@backstage/cli": "^0.36.4",
-    "@backstage/plugin-permission-backend": "^0.7.14",
-    "@backstage/plugin-permission-backend-module-allow-all-policy": "^0.2.21",
+    "@backstage/backend-defaults": "0.17.6-next.1",
+    "@backstage/backend-test-utils": "1.11.6-next.0",
+    "@backstage/cli": "0.36.5-next.0",
+    "@backstage/plugin-permission-backend": "0.7.15-next.0",
+    "@backstage/plugin-permission-backend-module-allow-all-policy": "0.2.22-next.0",
     "@types/express": "^4.17.6",
     "msw": "^1.0.0",
     "supertest": "^7.0.0",