@backstage/plugin-kubernetes-backend 0.21.7-next.0 → 0.21.7

package/dist/service/KubernetesProxy.cjs.js

@@ -5,55 +5,169 @@ var pluginKubernetesCommon = require('@backstage/plugin-kubernetes-common');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var httpProxyMiddleware = require('http-proxy-middleware');
 var fs = require('fs-extra');
+var ProxyMiddlewareCache = require('./ProxyMiddlewareCache.cjs.js');
+var ProxyAuditSession = require('./ProxyAuditSession.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
 var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
 
+const PROXY_PREPARED_TARGET = /* @__PURE__ */ Symbol("kubernetesProxyPreparedTarget");
 const HEADER_KUBERNETES_CLUSTER = "Backstage-Kubernetes-Cluster";
 const HEADER_KUBERNETES_AUTH = "Backstage-Kubernetes-Authorization";
 class KubernetesProxy {
-  middlewareForClusterName = /* @__PURE__ */ new Map();
+  middlewareCache;
   logger;
   clusterSupplier;
   authStrategy;
   httpAuth;
+  auditor;
   constructor(options) {
     this.logger = options.logger;
     this.clusterSupplier = options.clusterSupplier;
     this.authStrategy = options.authStrategy;
     this.httpAuth = options.httpAuth;
+    this.auditor = options.auditor;
+    this.middlewareCache = new ProxyMiddlewareCache.ProxyMiddlewareCache(
+      ProxyMiddlewareCache.resolveProxyMiddlewareCacheOptions(options.middlewareCache)
+    );
   }
   createRequestHandler(options) {
     const { permissionApi } = options;
     return async (req, res, next) => {
-      const authorizeResponse = await permissionApi.authorize(
-        [{ permission: pluginKubernetesCommon.kubernetesProxyPermission }],
-        {
-          credentials: await this.httpAuth.credentials(req)
+      const clusterNameHeader = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];
+      const clusterName = typeof clusterNameHeader === "string" && clusterNameHeader.length > 0 ? clusterNameHeader : "unknown";
+      const path = req.path || req.url.split("?")[0] || "";
+      let clientDisconnected = false;
+      const onSocketClose = () => {
+        clientDisconnected = true;
+      };
+      req.socket.once("close", onSocketClose);
+      let auditSession;
+      let finishListenerAttached = false;
+      try {
+        auditSession = await ProxyAuditSession.ProxyAuditSession.start(this.auditor, {
+          req,
+          clusterName,
+          method: req.method,
+          path,
+          logger: this.logger
+        });
+        finishListenerAttached = await this.authorizeAndDispatch(
+          req,
+          res,
+          next,
+          permissionApi,
+          auditSession,
+          onSocketClose,
+          () => clientDisconnected
+        );
+      } catch (error) {
+        req.socket.removeListener("close", onSocketClose);
+        const err = error instanceof Error ? error : new Error(String(error));
+        if (auditSession && !finishListenerAttached) {
+          auditSession.finalize(err);
         }
-      );
-      const auth = authorizeResponse[0];
-      if (auth.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        res.status(403).json({ error: new errors.NotAllowedError("Unauthorized") });
-        return;
-      }
-      const middleware = await this.getMiddleware(req);
-      if (req.header("connection")?.toLowerCase() === "upgrade" && req.header("upgrade")?.toLowerCase() === "websocket") {
-        middleware.upgrade(req, req.socket, void 0);
-      } else {
-        middleware(req, res, next);
+        throw error;
       }
     };
   }
+  /**
+   * Authorizes the request, resolves the target cluster, and dispatches
+   * to either the HTTP or WebSocket proxy path. Returns `true` when
+   * HTTP finish listeners have been attached.
+   */
+  async authorizeAndDispatch(req, res, next, permissionApi, auditSession, onSocketClose, isClientDisconnected) {
+    const authorizeResponse = await permissionApi.authorize(
+      [{ permission: pluginKubernetesCommon.kubernetesProxyPermission }],
+      { credentials: await this.httpAuth.credentials(req) }
+    );
+    if (authorizeResponse[0].result === pluginPermissionCommon.AuthorizeResult.DENY) {
+      req.socket.removeListener("close", onSocketClose);
+      auditSession.finalize(new errors.NotAllowedError("Unauthorized"));
+      res.status(403).json({
+        error: errors.serializeError(new errors.NotAllowedError("Unauthorized"))
+      });
+      return false;
+    }
+    if (isClientDisconnected()) {
+      auditSession.finalize(
+        new Error("Client disconnected before proxy dispatch")
+      );
+      return false;
+    }
+    const prepared = await this.prepareProxyTarget(req);
+    auditSession.setResolvedClusterName(prepared.cluster.name);
+    req[PROXY_PREPARED_TARGET] = prepared;
+    const middleware = this.getOrCreateMiddleware(prepared.cluster);
+    if (isClientDisconnected()) {
+      auditSession.finalize(
+        new Error("Client disconnected before proxy dispatch")
+      );
+      return false;
+    }
+    return KubernetesProxy.dispatchToProxy(
+      req,
+      res,
+      next,
+      middleware,
+      auditSession,
+      onSocketClose
+    );
+  }
+  /**
+   * Resolves the cluster, credentials, and target URL for a proxy request
+   * before dispatching to the middleware. This ensures all async preparation
+   * completes under the caller's try/catch, avoiding unhandled rejections
+   * from http-proxy-middleware's fire-and-forget upgrade() path.
+   */
+  async prepareProxyTarget(req) {
+    const cluster = await this.getClusterForRequest(req);
+    const url = new URL(cluster.url);
+    const { bufferFromFileOrString } = await import('@kubernetes/client-node');
+    const target = {
+      protocol: url.protocol,
+      host: url.hostname,
+      port: url.port,
+      ca: bufferFromFileOrString(cluster.caFile, cluster.caData)?.toString()
+    };
+    const authHeader = req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase("en-US")];
+    if (typeof authHeader === "string") {
+      req.headers.authorization = authHeader;
+    } else {
+      const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(
+        req.headers
+      );
+      const credential = await this.authStrategy.getCredential(
+        cluster,
+        authObj
+      );
+      if (credential.type === "bearer token") {
+        req.headers.authorization = `Bearer ${credential.token}`;
+      } else if (credential.type === "x509 client certificate") {
+        target.key = credential.key;
+        target.cert = credential.cert;
+      }
+    }
+    const requestPath = req.originalUrl || req.url || "";
+    const rewrittenPath = requestPath.replace(
+      new RegExp(
+        `^${(req.baseUrl || "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`
+      ),
+      url.pathname || ""
+    );
+    return { proxyTarget: target, rewrittenPath, cluster };
+  }
   // We create one middleware per remote cluster and hold on to them, because
   // the secure property isn't possible to decide on a per-request basis with a
-  // single middleware instance - and we don't expect it to change over time.
-  async getMiddleware(originalReq) {
-    const originalCluster = await this.getClusterForRequest(originalReq);
-    let middleware = this.middlewareForClusterName.get(originalCluster.name);
+  // single middleware instance. Target resolution and path rewriting are handled
+  // per-request via the PROXY_PREPARED_TARGET symbol stashed on each req by
+  // prepareProxyTarget. Entries are refreshed after a TTL or when cluster details
+  // change.
+  getOrCreateMiddleware(cluster) {
+    let middleware = this.middlewareCache.get(cluster);
     if (!middleware) {
-      const logger = this.logger.child({ cluster: originalCluster.name });
+      const logger = this.logger.child({ cluster: cluster.name });
       middleware = httpProxyMiddleware.createProxyMiddleware({
         logProvider: () => ({
           log: logger.info.bind(logger),
@@ -62,55 +176,27 @@ class KubernetesProxy {
           warn: logger.warn.bind(logger),
           error: logger.error.bind(logger)
         }),
-        ws: true,
-        secure: !originalCluster.skipTLSVerify,
+        // ws must be false to prevent http-proxy-middleware from auto-subscribing
+        // to the server's 'upgrade' event, which would bypass Express routing and
+        // skip audit event creation for WebSocket requests.
+        ws: false,
+        secure: !cluster.skipTLSVerify,
         changeOrigin: true,
-        pathRewrite: async (path, req) => {
-          const cluster = await this.getClusterForRequest(req);
-          const url = new URL(cluster.url);
-          return path.replace(
-            new RegExp(`^${originalReq.baseUrl}`),
-            url.pathname || ""
-          );
+        router: (req) => {
+          return req[PROXY_PREPARED_TARGET]?.proxyTarget;
         },
-        router: async (req) => {
-          const cluster = await this.getClusterForRequest(req);
-          const url = new URL(cluster.url);
-          const { bufferFromFileOrString } = await import('@kubernetes/client-node');
-          const target = {
-            protocol: url.protocol,
-            host: url.hostname,
-            port: url.port,
-            ca: bufferFromFileOrString(
-              cluster.caFile,
-              cluster.caData
-            )?.toString()
-          };
-          const authHeader = req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase("en-US")];
-          if (typeof authHeader === "string") {
-            req.headers.authorization = authHeader;
-          } else {
-            const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(
-              req.headers
-            );
-            const credential = await this.getClusterForRequest(req).then((cd) => {
-              return this.authStrategy.getCredential(cd, authObj);
-            });
-            if (credential.type === "bearer token") {
-              req.headers.authorization = `Bearer ${credential.token}`;
-            } else if (credential.type === "x509 client certificate") {
-              target.key = credential.key;
-              target.cert = credential.cert;
-            }
-          }
-          return target;
+        pathRewrite: (_path, req) => {
+          return req[PROXY_PREPARED_TARGET]?.rewrittenPath ?? _path;
         },
         onError: (error, req, res) => {
           const wrappedError = new errors.ForwardedError(
-            `Cluster '${originalCluster.name}' request error`,
+            `Cluster '${cluster.name}' request error`,
             error
           );
           logger.error("Kubernetes proxy error", wrappedError);
+          if (typeof res.status !== "function") {
+            return;
+          }
           const body = {
             error: errors.serializeError(wrappedError, {
               includeStack: process.env.NODE_ENV === "development"
@@ -119,12 +205,39 @@ class KubernetesProxy {
             response: { statusCode: 500 }
           };
           res.status(500).json(body);
-        }
+        },
+        onProxyReqWs: ProxyAuditSession.ProxyAuditSession.handleWebSocketProxyReq
       });
-      this.middlewareForClusterName.set(originalCluster.name, middleware);
+      this.middlewareCache.set(cluster, middleware);
     }
     return middleware;
   }
+  /**
+   * Branches to WebSocket upgrade or HTTP middleware dispatch and wires
+   * up the appropriate audit listeners. Returns `true` when HTTP finish
+   * listeners have been attached (used by the caller's catch block to
+   * avoid double-finalizing).
+   */
+  static dispatchToProxy(req, res, next, middleware, auditSession, onSocketClose) {
+    const isWebSocketUpgrade = (req.header("connection") ?? "").toLowerCase().split(",").some((t) => t.trim() === "upgrade") && req.header("upgrade")?.toLowerCase() === "websocket";
+    if (isWebSocketUpgrade) {
+      auditSession.prepareForWebSocketUpgrade(req, onSocketClose);
+      try {
+        middleware.upgrade(req, req.socket, void 0);
+      } catch (error) {
+        req.socket.removeListener("close", onSocketClose);
+        auditSession.finalize(
+          error instanceof Error ? error : new Error(String(error))
+        );
+        throw error;
+      }
+      return false;
+    }
+    req.socket.removeListener("close", onSocketClose);
+    auditSession.attachToHttpResponse(res);
+    middleware(req, res, next);
+    return true;
+  }
   async getClusterForRequest(req) {
     const { KubeConfig } = await import('@kubernetes/client-node');
     const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];

package/dist/service/KubernetesProxy.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"KubernetesProxy.cjs.js","sources":["../../src/service/KubernetesProxy.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  ErrorResponseBody,\n  ForwardedError,\n  NotAllowedError,\n  NotFoundError,\n  serializeError,\n} from '@backstage/errors';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  SERVICEACCOUNT_CA_PATH,\n  kubernetesProxyPermission,\n  KubernetesRequestAuth,\n} from '@backstage/plugin-kubernetes-common';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport type { Cluster } from '@kubernetes/client-node';\nimport { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';\nimport fs from 'fs-extra';\n\nimport {\n  AuthenticationStrategy,\n  ClusterDetails,\n  KubernetesClustersSupplier,\n} from '@backstage/plugin-kubernetes-node';\n\nimport type { Request } from 'express';\nimport { IncomingHttpHeaders } from 'node:http';\nimport {\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\n\n/**\n * The header that is used to specify the cluster name.\n *\n * @public\n */\nexport const HEADER_KUBERNETES_CLUSTER: string = 'Backstage-Kubernetes-Cluster';\n\n/**\n * The header that is used to specify the Authentication Authorities token.\n * e.x if using the google auth provider as your authentication authority then this field would be the google provided bearer token.\n * @public\n */\nexport const HEADER_KUBERNETES_AUTH: string =\n  'Backstage-Kubernetes-Authorization';\n\n/**\n * The options object expected to be passed as a parameter to KubernetesProxy.createRequestHandler().\n *\n * @public\n */\nexport type KubernetesProxyCreateRequestHandlerOptions = {\n  permissionApi: PermissionsService;\n};\n\n/**\n * Options accepted as a parameter by the KubernetesProxy\n *\n * @public\n */\nexport type KubernetesProxyOptions = {\n  logger: LoggerService;\n  clusterSupplier: KubernetesClustersSupplier;\n  authStrategy: AuthenticationStrategy;\n  discovery: DiscoveryService;\n  httpAuth: HttpAuthService;\n};\n\n/**\n * A proxy that routes requests to the Kubernetes API.\n *\n * @public\n */\nexport class KubernetesProxy {\n  private readonly middlewareForClusterName = new Map<string, RequestHandler>();\n  private readonly logger: LoggerService;\n  private readonly clusterSupplier: KubernetesClustersSupplier;\n  private readonly authStrategy: AuthenticationStrategy;\n  private readonly httpAuth: HttpAuthService;\n\n  constructor(options: KubernetesProxyOptions) {\n    this.logger = options.logger;\n    this.clusterSupplier = options.clusterSupplier;\n    this.authStrategy = options.authStrategy;\n    this.httpAuth = options.httpAuth;\n  }\n\n  public createRequestHandler(\n    options: KubernetesProxyCreateRequestHandlerOptions,\n  ): RequestHandler {\n    const { permissionApi } = options;\n    return async (req, res, next) => {\n      const authorizeResponse = await permissionApi.authorize(\n        [{ permission: kubernetesProxyPermission }],\n        {\n          credentials: await this.httpAuth.credentials(req),\n        },\n      );\n      const auth = authorizeResponse[0];\n\n      if (auth.result === AuthorizeResult.DENY) {\n        res.status(403).json({ error: new NotAllowedError('Unauthorized') });\n        return;\n      }\n\n      const middleware = await this.getMiddleware(req);\n\n      // If req is an upgrade handshake, use middleware upgrade instead of http request handler https://github.com/chimurai/http-proxy-middleware#external-websocket-upgrade\n      if (\n        req.header('connection')?.toLowerCase() === 'upgrade' &&\n        req.header('upgrade')?.toLowerCase() === 'websocket'\n      ) {\n        // Missing the `head`, since it's optional we pass undefined to avoid type issues\n        middleware.upgrade!(req, req.socket, undefined);\n      } else {\n        middleware(req, res, next);\n      }\n    };\n  }\n\n  // We create one middleware per remote cluster and hold on to them, because\n  // the secure property isn't possible to decide on a per-request basis with a\n  // single middleware instance - and we don't expect it to change over time.\n  private async getMiddleware(originalReq: Request): Promise<RequestHandler> {\n    const originalCluster = await this.getClusterForRequest(originalReq);\n    let middleware = this.middlewareForClusterName.get(originalCluster.name);\n    if (!middleware) {\n      const logger = this.logger.child({ cluster: originalCluster.name });\n      middleware = createProxyMiddleware({\n        logProvider: () => ({\n          log: logger.info.bind(logger),\n          debug: logger.debug.bind(logger),\n          info: logger.info.bind(logger),\n          warn: logger.warn.bind(logger),\n          error: logger.error.bind(logger),\n        }),\n        ws: true,\n        secure: !originalCluster.skipTLSVerify,\n        changeOrigin: true,\n        pathRewrite: async (path, req) => {\n          // Re-evaluate the cluster on each request, in case it has changed\n          const cluster = await this.getClusterForRequest(req);\n          const url = new URL(cluster.url);\n          return path.replace(\n            new RegExp(`^${originalReq.baseUrl}`),\n            url.pathname || '',\n          );\n        },\n        router: async req => {\n          // Re-evaluate the cluster on each request, in case it has changed\n          const cluster = await this.getClusterForRequest(req);\n          const url = new URL(cluster.url);\n\n          const { bufferFromFileOrString } = await import(\n            '@kubernetes/client-node'\n          );\n\n          const target: any = {\n            protocol: url.protocol,\n            host: url.hostname,\n            port: url.port,\n            ca: bufferFromFileOrString(\n              cluster.caFile,\n              cluster.caData,\n            )?.toString(),\n          };\n\n          const authHeader =\n            req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase('en-US')];\n          if (typeof authHeader === 'string') {\n            req.headers.authorization = authHeader;\n          } else {\n            // Map Backstage-Kubernetes-Authorization-X-X headers to a KubernetesRequestAuth object\n            const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(\n              req.headers,\n            );\n\n            const credential = await this.getClusterForRequest(req).then(cd => {\n              return this.authStrategy.getCredential(cd, authObj);\n            });\n\n            if (credential.type === 'bearer token') {\n              req.headers.authorization = `Bearer ${credential.token}`;\n            } else if (credential.type === 'x509 client certificate') {\n              target.key = credential.key;\n              target.cert = credential.cert;\n            }\n          }\n\n          return target;\n        },\n        onError: (error, req, res) => {\n          const wrappedError = new ForwardedError(\n            `Cluster '${originalCluster.name}' request error`,\n            error,\n          );\n\n          logger.error('Kubernetes proxy error', wrappedError);\n\n          const body: ErrorResponseBody = {\n            error: serializeError(wrappedError, {\n              includeStack: process.env.NODE_ENV === 'development',\n            }),\n            request: { method: req.method, url: req.originalUrl },\n            response: { statusCode: 500 },\n          };\n          res.status(500).json(body);\n        },\n      });\n      this.middlewareForClusterName.set(originalCluster.name, middleware);\n    }\n    return middleware;\n  }\n\n  private async getClusterForRequest(req: Request): Promise<ClusterDetails> {\n    const { KubeConfig } = await import('@kubernetes/client-node');\n\n    const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n    const clusters = await this.clusterSupplier.getClusters({\n      credentials: await this.httpAuth.credentials(req),\n    });\n\n    if (!clusters || clusters.length <= 0) {\n      throw new NotFoundError(`No Clusters configured`);\n    }\n\n    const hasClusterNameHeader =\n      typeof clusterName === 'string' && clusterName.length > 0;\n\n    let cluster: ClusterDetails | undefined;\n\n    if (hasClusterNameHeader) {\n      cluster = clusters.find(c => c.name === clusterName);\n    } else if (clusters.length === 1) {\n      cluster = clusters.at(0);\n    }\n\n    if (!cluster) {\n      throw new NotFoundError(`Cluster '${clusterName}' not found`);\n    }\n\n    const authProvider =\n      cluster.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n\n    if (\n      authProvider === 'serviceAccount' &&\n      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&\n      !cluster.authMetadata.serviceAccountToken\n    ) {\n      const kc = new KubeConfig();\n      kc.loadFromCluster();\n      const clusterFromKubeConfig = kc.getCurrentCluster() as Cluster;\n\n      const url = new URL(clusterFromKubeConfig.server);\n      cluster.url = clusterFromKubeConfig.server;\n      if (url.protocol === 'https:') {\n        cluster.caFile = clusterFromKubeConfig.caFile;\n      }\n    }\n\n    return cluster;\n  }\n\n  private static authHeadersToKubernetesRequestAuth(\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    return Object.keys(originalHeaders)\n      .filter(header => header.startsWith('backstage-kubernetes-authorization'))\n      .map(header =>\n        KubernetesProxy.headerToDictionary(header, originalHeaders),\n      )\n      .filter(headerAsDic => Object.keys(headerAsDic).length !== 0)\n      .reduce(KubernetesProxy.combineHeaders, {});\n  }\n\n  private static headerToDictionary(\n    header: string,\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    const obj: KubernetesRequestAuth = {};\n    const headerSplit = header.split('-');\n    if (headerSplit.length >= 4) {\n      const framework = headerSplit[3].toLowerCase();\n      if (headerSplit.length >= 5) {\n        const provider = headerSplit.slice(4).join('-').toLowerCase();\n        obj[framework] = { [provider]: originalHeaders[header] };\n      } else {\n        obj[framework] = originalHeaders[header];\n      }\n    }\n    return obj;\n  }\n\n  private static combineHeaders(\n    authObj: any,\n    header: any,\n  ): KubernetesRequestAuth {\n    const framework = Object.keys(header)[0];\n\n    if (authObj[framework]) {\n      authObj[framework] = {\n        ...authObj[framework],\n        ...header[framework],\n      };\n    } else {\n      authObj[framework] = header[framework];\n    }\n\n    return authObj;\n  }\n}\n"],"names":["kubernetesProxyPermission","AuthorizeResult","NotAllowedError","createProxyMiddleware","ForwardedError","serializeError","NotFoundError","ANNOTATION_KUBERNETES_AUTH_PROVIDER","fs","SERVICEACCOUNT_CA_PATH"],"mappings":";;;;;;;;;;;;AAqDO,MAAM,yBAAA,GAAoC;AAO1C,MAAM,sBAAA,GACX;AA6BK,MAAM,eAAA,CAAgB;AAAA,EACV,wBAAA,uBAA+B,GAAA,EAA4B;AAAA,EAC3D,MAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EAEjB,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAC/B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAAA,EAC1B;AAAA,EAEO,qBACL,OAAA,EACgB;AAChB,IAAA,MAAM,EAAE,eAAc,GAAI,OAAA;AAC1B,IAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,MAAA,MAAM,iBAAA,GAAoB,MAAM,aAAA,CAAc,SAAA;AAAA,QAC5C,CAAC,EAAE,UAAA,EAAYA,gDAAA,EAA2B,CAAA;AAAA,QAC1C;AAAA,UACE,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA;AAClD,OACF;AACA,MAAA,MAAM,IAAA,GAAO,kBAAkB,CAAC,CAAA;AAEhC,MAAA,IAAI,IAAA,CAAK,MAAA,KAAWC,sCAAA,CAAgB,IAAA,EAAM;AACxC,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,IAAIC,sBAAA,CAAgB,cAAc,CAAA,EAAG,CAAA;AACnE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,GAAG,CAAA;AAG/C,MAAA,IACE,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,EAAG,WAAA,EAAY,KAAM,SAAA,IAC5C,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,EAAG,WAAA,OAAkB,WAAA,EACzC;AAEA,QAAA,UAAA,CAAW,OAAA,CAAS,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,MAAS,CAAA;AAAA,MAChD,CAAA,MAAO;AACL,QAAA,UAAA,CAAW,GAAA,EAAK,KAAK,IAAI,CAAA;AAAA,MAC3B;AAAA,IACF,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,WAAA,EAA+C;AACzE,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,oBAAA,CAAqB,WAAW,CAAA;AACnE,IAAA,IAAI,UAAA,GAAa,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,gBAAgB,IAAI,CAAA;AACvE,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,OAAA,EAAS,eAAA,CAAgB,MAAM,CAAA;AAClE,MAAA,UAAA,GAAaC,yCAAA,CAAsB;AAAA,QACjC,aAAa,OAAO;AAAA,UAClB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC5B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,UAC/B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM;AAAA,SACjC,CAAA;AAAA,QACA,EAAA,EAAI,IAAA;AAAA,QACJ,MAAA,EAAQ,CAAC,eAAA,CAAgB,aAAA;AAAA,QACzB,YAAA,EAAc,IAAA;AAAA,QACd,WAAA,EAAa,OAAO,IAAA,EAAM,GAAA,KAAQ;AAEhC,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,UAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,UAAA,OAAO,IAAA,CAAK,OAAA;AAAA,YACV,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,WAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,YACpC,IAAI,QAAA,IAAY;AAAA,WAClB;AAAA,QACF,CAAA;AAAA,QACA,MAAA,EAAQ,OAAM,GAAA,KAAO;AAEnB,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,UAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAE/B,UAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OACvC,yBACF,CAAA;AAEA,UAAA,MAAM,MAAA,GAAc;AAAA,YAClB,UAAU,GAAA,CAAI,QAAA;AAAA,YACd,MAAM,GAAA,CAAI,QAAA;AAAA,YACV,MAAM,GAAA,CAAI,IAAA;AAAA,YACV,EAAA,EAAI,sBAAA;AAAA,cACF,OAAA,CAAQ,MAAA;AAAA,cACR,OAAA,CAAQ;AAAA,eACP,QAAA;AAAS,WACd;AAEA,UAAA,MAAM,aACJ,GAAA,CAAI,OAAA,CAAQ,sBAAA,CAAuB,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAC/D,UAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,YAAA,GAAA,CAAI,QAAQ,aAAA,GAAgB,UAAA;AAAA,UAC9B,CAAA,MAAO;AAEL,YAAA,MAAM,UAAU,eAAA,CAAgB,kCAAA;AAAA,cAC9B,GAAA,CAAI;AAAA,aACN;AAEA,YAAA,MAAM,aAAa,MAAM,IAAA,CAAK,qBAAqB,GAAG,CAAA,CAAE,KAAK,CAAA,EAAA,KAAM;AACjE,cAAA,OAAO,IAAA,CAAK,YAAA,CAAa,aAAA,CAAc,EAAA,EAAI,OAAO,CAAA;AAAA,YACpD,CAAC,CAAA;AAED,YAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,cAAA,GAAA,CAAI,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,UAAA,CAAW,KAAK,CAAA,CAAA;AAAA,YACxD,CAAA,MAAA,IAAW,UAAA,CAAW,IAAA,KAAS,yBAAA,EAA2B;AACxD,cAAA,MAAA,CAAO,MAAM,UAAA,CAAW,GAAA;AACxB,cAAA,MAAA,CAAO,OAAO,UAAA,CAAW,IAAA;AAAA,YAC3B;AAAA,UACF;AAEA,UAAA,OAAO,MAAA;AAAA,QACT,CAAA;AAAA,QACA,OAAA,EAAS,CAAC,KAAA,EAAO,GAAA,EAAK,GAAA,KAAQ;AAC5B,UAAA,MAAM,eAAe,IAAIC,qBAAA;AAAA,YACvB,CAAA,SAAA,EAAY,gBAAgB,IAAI,CAAA,eAAA,CAAA;AAAA,YAChC;AAAA,WACF;AAEA,UAAA,MAAA,CAAO,KAAA,CAAM,0BAA0B,YAAY,CAAA;AAEnD,UAAA,MAAM,IAAA,GAA0B;AAAA,YAC9B,KAAA,EAAOC,sBAAe,YAAA,EAAc;AAAA,cAClC,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa;AAAA,aACxC,CAAA;AAAA,YACD,SAAS,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY;AAAA,YACpD,QAAA,EAAU,EAAE,UAAA,EAAY,GAAA;AAAI,WAC9B;AACA,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,QAC3B;AAAA,OACD,CAAA;AACD,MAAA,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,eAAA,CAAgB,IAAA,EAAM,UAAU,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,GAAA,EAAuC;AACxE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAE7D,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACvE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY;AAAA,MACtD,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,IAAU,CAAA,EAAG;AACrC,MAAA,MAAM,IAAIC,qBAAc,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,oBAAA,GACJ,OAAO,WAAA,KAAgB,QAAA,IAAY,YAAY,MAAA,GAAS,CAAA;AAE1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,IACrD,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAA,GAAU,QAAA,CAAS,GAAG,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,oBAAA,CAAc,CAAA,SAAA,EAAY,WAAW,CAAA,WAAA,CAAa,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,YAAA,CAAaC,0DAAmC,CAAA;AAE1D,IAAA,IACE,YAAA,KAAiB,oBACjBC,mBAAA,CAAG,cAAA,CAAeC,6CAAsB,CAAA,IACxC,CAAC,OAAA,CAAQ,YAAA,CAAa,mBAAA,EACtB;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,UAAA,EAAW;AAC1B,MAAA,EAAA,CAAG,eAAA,EAAgB;AACnB,MAAA,MAAM,qBAAA,GAAwB,GAAG,iBAAA,EAAkB;AAEnD,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,qBAAA,CAAsB,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,MAAM,qBAAA,CAAsB,MAAA;AACpC,MAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,QAAA,OAAA,CAAQ,SAAS,qBAAA,CAAsB,MAAA;AAAA,MACzC;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,OAAe,mCACb,eAAA,EACuB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAC/B,MAAA,CAAO,YAAU,MAAA,CAAO,UAAA,CAAW,oCAAoC,CAAC,CAAA,CACxE,GAAA;AAAA,MAAI,CAAA,MAAA,KACH,eAAA,CAAgB,kBAAA,CAAmB,MAAA,EAAQ,eAAe;AAAA,KAC5D,CACC,MAAA,CAAO,CAAA,WAAA,KAAe,MAAA,CAAO,KAAK,WAAW,CAAA,CAAE,MAAA,KAAW,CAAC,CAAA,CAC3D,MAAA,CAAO,eAAA,CAAgB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAe,kBAAA,CACb,MAAA,EACA,eAAA,EACuB;AACvB,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAC,CAAA,CAAE,WAAA,EAAY;AAC7C,MAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAA,GAAW,YAAY,KAAA,CAAM,CAAC,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC5D,QAAA,GAAA,CAAI,SAAS,IAAI,EAAE,CAAC,QAAQ,GAAG,eAAA,CAAgB,MAAM,CAAA,EAAE;AAAA,MACzD,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,SAAS,CAAA,GAAI,eAAA,CAAgB,MAAM,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,OAAe,cAAA,CACb,OAAA,EACA,MAAA,EACuB;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI;AAAA,QACnB,GAAG,QAAQ,SAAS,CAAA;AAAA,QACpB,GAAG,OAAO,SAAS;AAAA,OACrB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;;;;"}
+{"version":3,"file":"KubernetesProxy.cjs.js","sources":["../../src/service/KubernetesProxy.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  ErrorResponseBody,\n  ForwardedError,\n  NotAllowedError,\n  NotFoundError,\n  serializeError,\n} from '@backstage/errors';\nimport {\n  ANNOTATION_KUBERNETES_AUTH_PROVIDER,\n  SERVICEACCOUNT_CA_PATH,\n  kubernetesProxyPermission,\n  KubernetesRequestAuth,\n} from '@backstage/plugin-kubernetes-common';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport type { Cluster } from '@kubernetes/client-node';\nimport { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';\nimport fs from 'fs-extra';\n\nimport {\n  AuthenticationStrategy,\n  ClusterDetails,\n  KubernetesClustersSupplier,\n} from '@backstage/plugin-kubernetes-node';\n\nimport {\n  ProxyMiddlewareCache,\n  resolveProxyMiddlewareCacheOptions,\n} from './ProxyMiddlewareCache';\n\nimport type { NextFunction, Request, Response } from 'express';\nimport { IncomingHttpHeaders } from 'node:http';\nimport {\n  AuditorService,\n  DiscoveryService,\n  HttpAuthService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport { ProxyAuditSession } from './ProxyAuditSession';\n\nconst PROXY_PREPARED_TARGET = Symbol('kubernetesProxyPreparedTarget');\n\ntype PreparedProxyTarget = {\n  proxyTarget: any;\n  rewrittenPath: string;\n  cluster: ClusterDetails;\n};\n\n/**\n * The header that is used to specify the cluster name.\n *\n * @public\n */\nexport const HEADER_KUBERNETES_CLUSTER: string = 'Backstage-Kubernetes-Cluster';\n\n/**\n * The header that is used to specify the Authentication Authorities token.\n * e.x if using the google auth provider as your authentication authority then this field would be the google provided bearer token.\n * @public\n */\nexport const HEADER_KUBERNETES_AUTH: string =\n  'Backstage-Kubernetes-Authorization';\n\n/**\n * The options object expected to be passed as a parameter to KubernetesProxy.createRequestHandler().\n *\n * @public\n */\nexport type KubernetesProxyCreateRequestHandlerOptions = {\n  permissionApi: PermissionsService;\n};\n\n/**\n * Options accepted as a parameter by the KubernetesProxy\n *\n * @public\n */\nexport type KubernetesProxyOptions = {\n  logger: LoggerService;\n  clusterSupplier: KubernetesClustersSupplier;\n  authStrategy: AuthenticationStrategy;\n  discovery: DiscoveryService;\n  httpAuth: HttpAuthService;\n  auditor?: AuditorService;\n  middlewareCache?: {\n    ttlMs?: number;\n    maxSize?: number;\n  };\n};\n\n/**\n * A proxy that routes requests to the Kubernetes API.\n *\n * @public\n */\nexport class KubernetesProxy {\n  private readonly middlewareCache: ProxyMiddlewareCache;\n  private readonly logger: LoggerService;\n  private readonly clusterSupplier: KubernetesClustersSupplier;\n  private readonly authStrategy: AuthenticationStrategy;\n  private readonly httpAuth: HttpAuthService;\n  private readonly auditor?: AuditorService;\n\n  constructor(options: KubernetesProxyOptions) {\n    this.logger = options.logger;\n    this.clusterSupplier = options.clusterSupplier;\n    this.authStrategy = options.authStrategy;\n    this.httpAuth = options.httpAuth;\n    this.auditor = options.auditor;\n    this.middlewareCache = new ProxyMiddlewareCache(\n      resolveProxyMiddlewareCacheOptions(options.middlewareCache),\n    );\n  }\n\n  public createRequestHandler(\n    options: KubernetesProxyCreateRequestHandlerOptions,\n  ): RequestHandler {\n    const { permissionApi } = options;\n    return async (req, res, next) => {\n      const clusterNameHeader =\n        req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n      const clusterName =\n        typeof clusterNameHeader === 'string' && clusterNameHeader.length > 0\n          ? clusterNameHeader\n          : 'unknown';\n      const path = req.path || req.url.split('?')[0] || '';\n\n      let clientDisconnected = false;\n      const onSocketClose = () => {\n        clientDisconnected = true;\n      };\n      req.socket.once('close', onSocketClose);\n\n      let auditSession: ProxyAuditSession | undefined;\n      let finishListenerAttached = false;\n      try {\n        auditSession = await ProxyAuditSession.start(this.auditor, {\n          req,\n          clusterName,\n          method: req.method,\n          path,\n          logger: this.logger,\n        });\n\n        finishListenerAttached = await this.authorizeAndDispatch(\n          req,\n          res,\n          next,\n          permissionApi,\n          auditSession,\n          onSocketClose,\n          () => clientDisconnected,\n        );\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        const err = error instanceof Error ? error : new Error(String(error));\n        if (auditSession && !finishListenerAttached) {\n          auditSession.finalize(err);\n        }\n        throw error;\n      }\n    };\n  }\n\n  /**\n   * Authorizes the request, resolves the target cluster, and dispatches\n   * to either the HTTP or WebSocket proxy path. Returns `true` when\n   * HTTP finish listeners have been attached.\n   */\n  private async authorizeAndDispatch(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    permissionApi: PermissionsService,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n    isClientDisconnected: () => boolean,\n  ): Promise<boolean> {\n    const authorizeResponse = await permissionApi.authorize(\n      [{ permission: kubernetesProxyPermission }],\n      { credentials: await this.httpAuth.credentials(req) },\n    );\n\n    if (authorizeResponse[0].result === AuthorizeResult.DENY) {\n      req.socket.removeListener('close', onSocketClose);\n      auditSession.finalize(new NotAllowedError('Unauthorized'));\n      res.status(403).json({\n        error: serializeError(new NotAllowedError('Unauthorized')),\n      });\n      return false;\n    }\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    const prepared = await this.prepareProxyTarget(req);\n    auditSession.setResolvedClusterName(prepared.cluster.name);\n    (req as any)[PROXY_PREPARED_TARGET] = prepared;\n    const middleware = this.getOrCreateMiddleware(prepared.cluster);\n\n    if (isClientDisconnected()) {\n      auditSession.finalize(\n        new Error('Client disconnected before proxy dispatch'),\n      );\n      return false;\n    }\n\n    return KubernetesProxy.dispatchToProxy(\n      req,\n      res,\n      next,\n      middleware,\n      auditSession,\n      onSocketClose,\n    );\n  }\n\n  /**\n   * Resolves the cluster, credentials, and target URL for a proxy request\n   * before dispatching to the middleware. This ensures all async preparation\n   * completes under the caller's try/catch, avoiding unhandled rejections\n   * from http-proxy-middleware's fire-and-forget upgrade() path.\n   */\n  private async prepareProxyTarget(req: Request): Promise<PreparedProxyTarget> {\n    const cluster = await this.getClusterForRequest(req);\n    const url = new URL(cluster.url);\n\n    const { bufferFromFileOrString } = await import('@kubernetes/client-node');\n\n    const target: any = {\n      protocol: url.protocol,\n      host: url.hostname,\n      port: url.port,\n      ca: bufferFromFileOrString(cluster.caFile, cluster.caData)?.toString(),\n    };\n\n    const authHeader =\n      req.headers[HEADER_KUBERNETES_AUTH.toLocaleLowerCase('en-US')];\n    if (typeof authHeader === 'string') {\n      req.headers.authorization = authHeader;\n    } else {\n      const authObj = KubernetesProxy.authHeadersToKubernetesRequestAuth(\n        req.headers,\n      );\n\n      const credential = await this.authStrategy.getCredential(\n        cluster,\n        authObj,\n      );\n\n      if (credential.type === 'bearer token') {\n        req.headers.authorization = `Bearer ${credential.token}`;\n      } else if (credential.type === 'x509 client certificate') {\n        target.key = credential.key;\n        target.cert = credential.cert;\n      }\n    }\n\n    const requestPath = req.originalUrl || req.url || '';\n    const rewrittenPath = requestPath.replace(\n      new RegExp(\n        `^${(req.baseUrl || '').replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}`,\n      ),\n      url.pathname || '',\n    );\n\n    return { proxyTarget: target, rewrittenPath, cluster };\n  }\n\n  // We create one middleware per remote cluster and hold on to them, because\n  // the secure property isn't possible to decide on a per-request basis with a\n  // single middleware instance. Target resolution and path rewriting are handled\n  // per-request via the PROXY_PREPARED_TARGET symbol stashed on each req by\n  // prepareProxyTarget. Entries are refreshed after a TTL or when cluster details\n  // change.\n  private getOrCreateMiddleware(cluster: ClusterDetails): RequestHandler {\n    let middleware = this.middlewareCache.get(cluster);\n    if (!middleware) {\n      const logger = this.logger.child({ cluster: cluster.name });\n      middleware = createProxyMiddleware({\n        logProvider: () => ({\n          log: logger.info.bind(logger),\n          debug: logger.debug.bind(logger),\n          info: logger.info.bind(logger),\n          warn: logger.warn.bind(logger),\n          error: logger.error.bind(logger),\n        }),\n        // ws must be false to prevent http-proxy-middleware from auto-subscribing\n        // to the server's 'upgrade' event, which would bypass Express routing and\n        // skip audit event creation for WebSocket requests.\n        ws: false,\n        secure: !cluster.skipTLSVerify,\n        changeOrigin: true,\n        router: req => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.proxyTarget;\n        },\n        pathRewrite: (_path, req) => {\n          return (req as any)[PROXY_PREPARED_TARGET]?.rewrittenPath ?? _path;\n        },\n        onError: (error, req, res) => {\n          const wrappedError = new ForwardedError(\n            `Cluster '${cluster.name}' request error`,\n            error,\n          );\n\n          logger.error('Kubernetes proxy error', wrappedError);\n\n          if (typeof (res as { status?: unknown }).status !== 'function') {\n            return;\n          }\n\n          const body: ErrorResponseBody = {\n            error: serializeError(wrappedError, {\n              includeStack: process.env.NODE_ENV === 'development',\n            }),\n            request: { method: req.method, url: req.originalUrl },\n            response: { statusCode: 500 },\n          };\n          res.status(500).json(body);\n        },\n        onProxyReqWs: ProxyAuditSession.handleWebSocketProxyReq,\n      });\n      this.middlewareCache.set(cluster, middleware);\n    }\n    return middleware;\n  }\n\n  /**\n   * Branches to WebSocket upgrade or HTTP middleware dispatch and wires\n   * up the appropriate audit listeners. Returns `true` when HTTP finish\n   * listeners have been attached (used by the caller's catch block to\n   * avoid double-finalizing).\n   */\n  private static dispatchToProxy(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    middleware: RequestHandler,\n    auditSession: ProxyAuditSession,\n    onSocketClose: () => void,\n  ): boolean {\n    const isWebSocketUpgrade =\n      (req.header('connection') ?? '')\n        .toLowerCase()\n        .split(',')\n        .some(t => t.trim() === 'upgrade') &&\n      req.header('upgrade')?.toLowerCase() === 'websocket';\n\n    if (isWebSocketUpgrade) {\n      auditSession.prepareForWebSocketUpgrade(req, onSocketClose);\n\n      try {\n        middleware.upgrade!(req, req.socket, undefined);\n      } catch (error) {\n        req.socket.removeListener('close', onSocketClose);\n        auditSession.finalize(\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        throw error;\n      }\n      return false;\n    }\n\n    // HTTP path: remove the early close listener; HTTP audit listeners\n    // on the response take over from here.\n    req.socket.removeListener('close', onSocketClose);\n    auditSession.attachToHttpResponse(res);\n    middleware(req, res, next);\n    return true;\n  }\n\n  private async getClusterForRequest(req: Request): Promise<ClusterDetails> {\n    const { KubeConfig } = await import('@kubernetes/client-node');\n\n    const clusterName = req.headers[HEADER_KUBERNETES_CLUSTER.toLowerCase()];\n    const clusters = await this.clusterSupplier.getClusters({\n      credentials: await this.httpAuth.credentials(req),\n    });\n\n    if (!clusters || clusters.length <= 0) {\n      throw new NotFoundError(`No Clusters configured`);\n    }\n\n    const hasClusterNameHeader =\n      typeof clusterName === 'string' && clusterName.length > 0;\n\n    let cluster: ClusterDetails | undefined;\n\n    if (hasClusterNameHeader) {\n      cluster = clusters.find(c => c.name === clusterName);\n    } else if (clusters.length === 1) {\n      cluster = clusters.at(0);\n    }\n\n    if (!cluster) {\n      throw new NotFoundError(`Cluster '${clusterName}' not found`);\n    }\n\n    const authProvider =\n      cluster.authMetadata[ANNOTATION_KUBERNETES_AUTH_PROVIDER];\n\n    if (\n      authProvider === 'serviceAccount' &&\n      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&\n      !cluster.authMetadata.serviceAccountToken\n    ) {\n      const kc = new KubeConfig();\n      kc.loadFromCluster();\n      const clusterFromKubeConfig = kc.getCurrentCluster() as Cluster;\n\n      const url = new URL(clusterFromKubeConfig.server);\n      cluster.url = clusterFromKubeConfig.server;\n      if (url.protocol === 'https:') {\n        cluster.caFile = clusterFromKubeConfig.caFile;\n      }\n    }\n\n    return cluster;\n  }\n\n  private static authHeadersToKubernetesRequestAuth(\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    return Object.keys(originalHeaders)\n      .filter(header => header.startsWith('backstage-kubernetes-authorization'))\n      .map(header =>\n        KubernetesProxy.headerToDictionary(header, originalHeaders),\n      )\n      .filter(headerAsDic => Object.keys(headerAsDic).length !== 0)\n      .reduce(KubernetesProxy.combineHeaders, {});\n  }\n\n  private static headerToDictionary(\n    header: string,\n    originalHeaders: IncomingHttpHeaders,\n  ): KubernetesRequestAuth {\n    const obj: KubernetesRequestAuth = {};\n    const headerSplit = header.split('-');\n    if (headerSplit.length >= 4) {\n      const framework = headerSplit[3].toLowerCase();\n      if (headerSplit.length >= 5) {\n        const provider = headerSplit.slice(4).join('-').toLowerCase();\n        obj[framework] = { [provider]: originalHeaders[header] };\n      } else {\n        obj[framework] = originalHeaders[header];\n      }\n    }\n    return obj;\n  }\n\n  private static combineHeaders(\n    authObj: any,\n    header: any,\n  ): KubernetesRequestAuth {\n    const framework = Object.keys(header)[0];\n\n    if (authObj[framework]) {\n      authObj[framework] = {\n        ...authObj[framework],\n        ...header[framework],\n      };\n    } else {\n      authObj[framework] = header[framework];\n    }\n\n    return authObj;\n  }\n}\n"],"names":["ProxyMiddlewareCache","resolveProxyMiddlewareCacheOptions","ProxyAuditSession","kubernetesProxyPermission","AuthorizeResult","NotAllowedError","serializeError","createProxyMiddleware","ForwardedError","NotFoundError","ANNOTATION_KUBERNETES_AUTH_PROVIDER","fs","SERVICEACCOUNT_CA_PATH"],"mappings":";;;;;;;;;;;;;;AAuDA,MAAM,qBAAA,0BAA+B,+BAA+B,CAAA;AAa7D,MAAM,yBAAA,GAAoC;AAO1C,MAAM,sBAAA,GACX;AAkCK,MAAM,eAAA,CAAgB;AAAA,EACV,eAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,eAAA;AAC/B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,kBAAkB,IAAIA,yCAAA;AAAA,MACzBC,uDAAA,CAAmC,QAAQ,eAAe;AAAA,KAC5D;AAAA,EACF;AAAA,EAEO,qBACL,OAAA,EACgB;AAChB,IAAA,MAAM,EAAE,eAAc,GAAI,OAAA;AAC1B,IAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,MAAA,MAAM,iBAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACrD,MAAA,MAAM,cACJ,OAAO,iBAAA,KAAsB,YAAY,iBAAA,CAAkB,MAAA,GAAS,IAChE,iBAAA,GACA,SAAA;AACN,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,IAAQ,GAAA,CAAI,IAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAElD,MAAA,IAAI,kBAAA,GAAqB,KAAA;AACzB,MAAA,MAAM,gBAAgB,MAAM;AAC1B,QAAA,kBAAA,GAAqB,IAAA;AAAA,MACvB,CAAA;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAEtC,MAAA,IAAI,YAAA;AACJ,MAAA,IAAI,sBAAA,GAAyB,KAAA;AAC7B,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAMC,mCAAA,CAAkB,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS;AAAA,UACzD,GAAA;AAAA,UACA,WAAA;AAAA,UACA,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA;AAAA,UACA,QAAQ,IAAA,CAAK;AAAA,SACd,CAAA;AAED,QAAA,sBAAA,GAAyB,MAAM,IAAA,CAAK,oBAAA;AAAA,UAClC,GAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA;AAAA,UACA,aAAA;AAAA,UACA,YAAA;AAAA,UACA,aAAA;AAAA,UACA,MAAM;AAAA,SACR;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,MAAM,GAAA,GAAM,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,QAAA,IAAI,YAAA,IAAgB,CAAC,sBAAA,EAAwB;AAC3C,UAAA,YAAA,CAAa,SAAS,GAAG,CAAA;AAAA,QAC3B;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,qBACZ,GAAA,EACA,GAAA,EACA,MACA,aAAA,EACA,YAAA,EACA,eACA,oBAAA,EACkB;AAClB,IAAA,MAAM,iBAAA,GAAoB,MAAM,aAAA,CAAc,SAAA;AAAA,MAC5C,CAAC,EAAE,UAAA,EAAYC,gDAAA,EAA2B,CAAA;AAAA,MAC1C,EAAE,WAAA,EAAa,MAAM,KAAK,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAAE,KACtD;AAEA,IAAA,IAAI,iBAAA,CAAkB,CAAC,CAAA,CAAE,MAAA,KAAWC,uCAAgB,IAAA,EAAM;AACxD,MAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,MAAA,YAAA,CAAa,QAAA,CAAS,IAAIC,sBAAA,CAAgB,cAAc,CAAC,CAAA;AACzD,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,KAAA,EAAOC,qBAAA,CAAe,IAAID,sBAAA,CAAgB,cAAc,CAAC;AAAA,OAC1D,CAAA;AACD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,kBAAA,CAAmB,GAAG,CAAA;AAClD,IAAA,YAAA,CAAa,sBAAA,CAAuB,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA;AACzD,IAAC,GAAA,CAAY,qBAAqB,CAAA,GAAI,QAAA;AACtC,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,qBAAA,CAAsB,QAAA,CAAS,OAAO,CAAA;AAE9D,IAAA,IAAI,sBAAqB,EAAG;AAC1B,MAAA,YAAA,CAAa,QAAA;AAAA,QACX,IAAI,MAAM,2CAA2C;AAAA,OACvD;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,eAAA,CAAgB,eAAA;AAAA,MACrB,GAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,mBAAmB,GAAA,EAA4C;AAC3E,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,oBAAA,CAAqB,GAAG,CAAA;AACnD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAE/B,IAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAEzE,IAAA,MAAM,MAAA,GAAc;AAAA,MAClB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd,MAAM,GAAA,CAAI,QAAA;AAAA,MACV,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,IAAI,sBAAA,CAAuB,OAAA,CAAQ,QAAQ,OAAA,CAAQ,MAAM,GAAG,QAAA;AAAS,KACvE;AAEA,IAAA,MAAM,aACJ,GAAA,CAAI,OAAA,CAAQ,sBAAA,CAAuB,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAC/D,IAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,MAAA,GAAA,CAAI,QAAQ,aAAA,GAAgB,UAAA;AAAA,IAC9B,CAAA,MAAO;AACL,MAAA,MAAM,UAAU,eAAA,CAAgB,kCAAA;AAAA,QAC9B,GAAA,CAAI;AAAA,OACN;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,aAAA;AAAA,QACzC,OAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,IAAI,UAAA,CAAW,SAAS,cAAA,EAAgB;AACtC,QAAA,GAAA,CAAI,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,UAAA,CAAW,KAAK,CAAA,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,UAAA,CAAW,IAAA,KAAS,yBAAA,EAA2B;AACxD,QAAA,MAAA,CAAO,MAAM,UAAA,CAAW,GAAA;AACxB,QAAA,MAAA,CAAO,OAAO,UAAA,CAAW,IAAA;AAAA,MAC3B;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,GAAA,IAAO,EAAA;AAClD,IAAA,MAAM,gBAAgB,WAAA,CAAY,OAAA;AAAA,MAChC,IAAI,MAAA;AAAA,QACF,KAAK,GAAA,CAAI,OAAA,IAAW,IAAI,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAC,CAAA;AAAA,OAChE;AAAA,MACA,IAAI,QAAA,IAAY;AAAA,KAClB;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAA,EAAe,OAAA,EAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,sBAAsB,OAAA,EAAyC;AACrE,IAAA,IAAI,UAAA,GAAa,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,OAAO,CAAA;AACjD,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAA;AAC1D,MAAA,UAAA,GAAaE,yCAAA,CAAsB;AAAA,QACjC,aAAa,OAAO;AAAA,UAClB,GAAA,EAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC5B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA;AAAA,UAC/B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,UAC7B,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,MAAM;AAAA,SACjC,CAAA;AAAA;AAAA;AAAA;AAAA,QAIA,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAC,OAAA,CAAQ,aAAA;AAAA,QACjB,YAAA,EAAc,IAAA;AAAA,QACd,QAAQ,CAAA,GAAA,KAAO;AACb,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,WAAA;AAAA,QAC9C,CAAA;AAAA,QACA,WAAA,EAAa,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC3B,UAAA,OAAQ,GAAA,CAAY,qBAAqB,CAAA,EAAG,aAAA,IAAiB,KAAA;AAAA,QAC/D,CAAA;AAAA,QACA,OAAA,EAAS,CAAC,KAAA,EAAO,GAAA,EAAK,GAAA,KAAQ;AAC5B,UAAA,MAAM,eAAe,IAAIC,qBAAA;AAAA,YACvB,CAAA,SAAA,EAAY,QAAQ,IAAI,CAAA,eAAA,CAAA;AAAA,YACxB;AAAA,WACF;AAEA,UAAA,MAAA,CAAO,KAAA,CAAM,0BAA0B,YAAY,CAAA;AAEnD,UAAA,IAAI,OAAQ,GAAA,CAA6B,MAAA,KAAW,UAAA,EAAY;AAC9D,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,IAAA,GAA0B;AAAA,YAC9B,KAAA,EAAOF,sBAAe,YAAA,EAAc;AAAA,cAClC,YAAA,EAAc,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa;AAAA,aACxC,CAAA;AAAA,YACD,SAAS,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,WAAA,EAAY;AAAA,YACpD,QAAA,EAAU,EAAE,UAAA,EAAY,GAAA;AAAI,WAC9B;AACA,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,QAC3B,CAAA;AAAA,QACA,cAAcJ,mCAAA,CAAkB;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,OAAA,EAAS,UAAU,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAe,eAAA,CACb,GAAA,EACA,KACA,IAAA,EACA,UAAA,EACA,cACA,aAAA,EACS;AACT,IAAA,MAAM,kBAAA,GAAA,CACH,IAAI,MAAA,CAAO,YAAY,KAAK,EAAA,EAC1B,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA,CACT,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAK,KAAM,SAAS,CAAA,IACnC,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG,WAAA,EAAY,KAAM,WAAA;AAE3C,IAAA,IAAI,kBAAA,EAAoB;AACtB,MAAA,YAAA,CAAa,0BAAA,CAA2B,KAAK,aAAa,CAAA;AAE1D,MAAA,IAAI;AACF,QAAA,UAAA,CAAW,OAAA,CAAS,GAAA,EAAK,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAS,CAAA;AAAA,MAChD,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,QAAA,YAAA,CAAa,QAAA;AAAA,UACX,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,SAC1D;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAIA,IAAA,GAAA,CAAI,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,aAAa,CAAA;AAChD,IAAA,YAAA,CAAa,qBAAqB,GAAG,CAAA;AACrC,IAAA,UAAA,CAAW,GAAA,EAAK,KAAK,IAAI,CAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,GAAA,EAAuC;AACxE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,yBAAyB,CAAA;AAE7D,IAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,yBAAA,CAA0B,aAAa,CAAA;AACvE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY;AAAA,MACtD,WAAA,EAAa,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,IAAU,CAAA,EAAG;AACrC,MAAA,MAAM,IAAIO,qBAAc,CAAA,sBAAA,CAAwB,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,oBAAA,GACJ,OAAO,WAAA,KAAgB,QAAA,IAAY,YAAY,MAAA,GAAS,CAAA;AAE1D,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAAA,IACrD,CAAA,MAAA,IAAW,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAA,GAAU,QAAA,CAAS,GAAG,CAAC,CAAA;AAAA,IACzB;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,oBAAA,CAAc,CAAA,SAAA,EAAY,WAAW,CAAA,WAAA,CAAa,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,YAAA,CAAaC,0DAAmC,CAAA;AAE1D,IAAA,IACE,YAAA,KAAiB,oBACjBC,mBAAA,CAAG,cAAA,CAAeC,6CAAsB,CAAA,IACxC,CAAC,OAAA,CAAQ,YAAA,CAAa,mBAAA,EACtB;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,UAAA,EAAW;AAC1B,MAAA,EAAA,CAAG,eAAA,EAAgB;AACnB,MAAA,MAAM,qBAAA,GAAwB,GAAG,iBAAA,EAAkB;AAEnD,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,qBAAA,CAAsB,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,MAAM,qBAAA,CAAsB,MAAA;AACpC,MAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,QAAA,OAAA,CAAQ,SAAS,qBAAA,CAAsB,MAAA;AAAA,MACzC;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,OAAe,mCACb,eAAA,EACuB;AACvB,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAC/B,MAAA,CAAO,YAAU,MAAA,CAAO,UAAA,CAAW,oCAAoC,CAAC,CAAA,CACxE,GAAA;AAAA,MAAI,CAAA,MAAA,KACH,eAAA,CAAgB,kBAAA,CAAmB,MAAA,EAAQ,eAAe;AAAA,KAC5D,CACC,MAAA,CAAO,CAAA,WAAA,KAAe,MAAA,CAAO,KAAK,WAAW,CAAA,CAAE,MAAA,KAAW,CAAC,CAAA,CAC3D,MAAA,CAAO,eAAA,CAAgB,cAAA,EAAgB,EAAE,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAe,kBAAA,CACb,MAAA,EACA,eAAA,EACuB;AACvB,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,WAAA,CAAY,CAAC,CAAA,CAAE,WAAA,EAAY;AAC7C,MAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC3B,QAAA,MAAM,QAAA,GAAW,YAAY,KAAA,CAAM,CAAC,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC5D,QAAA,GAAA,CAAI,SAAS,IAAI,EAAE,CAAC,QAAQ,GAAG,eAAA,CAAgB,MAAM,CAAA,EAAE;AAAA,MACzD,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,SAAS,CAAA,GAAI,eAAA,CAAgB,MAAM,CAAA;AAAA,MACzC;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,OAAe,cAAA,CACb,OAAA,EACA,MAAA,EACuB;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI;AAAA,QACnB,GAAG,QAAQ,SAAS,CAAA;AAAA,QACpB,GAAG,OAAO,SAAS;AAAA,OACrB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,SAAS,CAAA,GAAI,MAAA,CAAO,SAAS,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;;;;;;"}

package/dist/service/KubernetesRouter.cjs.js

@@ -12,9 +12,12 @@ require('@azure/identity');
 require('@google-cloud/container');
 var DispatchStrategy = require('../auth/DispatchStrategy.cjs.js');
 require('fs-extra');
+var errors = require('@backstage/errors');
 var resourcesRoutes = require('../routes/resourcesRoutes.cjs.js');
 var KubernetesProxy = require('./KubernetesProxy.cjs.js');
 var requirePermission = require('../auth/requirePermission.cjs.js');
+var catalogModel = require('@backstage/catalog-model');
+var ProxyMiddlewareCache = require('./ProxyMiddlewareCache.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -52,6 +55,7 @@ class KubernetesRouter {
       );
       return Router__default.default();
     }
+    await this.warnForClustersWithSkipTLSVerify(logger, clusterSupplier);
     const proxy = this.buildProxy(
       logger,
       clusterSupplier,
@@ -86,16 +90,26 @@ class KubernetesRouter {
     const authStrategy = new DispatchStrategy.DispatchStrategy({
       authStrategyMap
     });
+    const middlewareCacheConfig = this.env.config.getOptionalConfig(
+      "kubernetes.proxy.middlewareCache"
+    );
+    const { ttlMs, maxSize } = ProxyMiddlewareCache.resolveProxyMiddlewareCacheOptions({
+      ttlMs: middlewareCacheConfig?.getOptionalNumber("ttl.milliseconds"),
+      maxSize: middlewareCacheConfig?.getOptionalNumber("maxSize")
+    });
     return new KubernetesProxy.KubernetesProxy({
       logger,
       clusterSupplier,
       authStrategy,
       discovery,
-      httpAuth
+      httpAuth,
+      auditor: this.env.auditor,
+      middlewareCache: { ttlMs, maxSize }
     });
   }
   buildDefaultRouter(objectsProvider, clusterSupplier, catalog, proxy, permissionApi, httpAuth, authStrategyMap) {
     const logger = this.env.logger;
+    const auditor = this.env.auditor;
     const router = Router__default.default();
     router.use("/proxy", proxy.createRequestHandler({ permissionApi }));
     router.use(express__default.default.json());
@@ -105,67 +119,112 @@ class KubernetesRouter {
       })
     );
     router.post("/services/:serviceId", async (req, res) => {
-      await requirePermission.requirePermission(
-        permissionApi,
-        pluginKubernetesCommon.kubernetesResourcesReadPermission,
-        httpAuth,
-        req
-      );
       const serviceId = req.params.serviceId;
       const requestBody = req.body;
+      let entityRef;
+      if (requestBody?.entity) {
+        try {
+          entityRef = catalogModel.stringifyEntityRef(requestBody.entity);
+        } catch {
+          entityRef = void 0;
+        }
+      }
+      const auditorEvent = await auditor.createEvent({
+        eventId: "resource-fetch",
+        request: req,
+        meta: { queryType: "services", entityRef, serviceId }
+      });
       try {
+        await requirePermission.requirePermission(
+          permissionApi,
+          pluginKubernetesCommon.kubernetesResourcesReadPermission,
+          httpAuth,
+          req
+        );
         const response = await objectsProvider.getKubernetesObjectsByEntity(
           {
-            entity: requestBody.entity,
-            auth: requestBody.auth || {}
+            entity: requestBody?.entity,
+            auth: requestBody?.auth || {}
           },
           { credentials: await httpAuth.credentials(req) }
         );
         res.json(response);
+        auditorEvent.success().catch(
+          (error) => logger.error(
+            "Failed to emit audit event resource-fetch (services)",
+            error
+          )
+        );
       } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        await auditorEvent.fail({ error: err });
+        if (e instanceof errors.NotAllowedError) {
+          throw e;
+        }
         logger.error(
-          `action=retrieveObjectsByServiceId service=${serviceId}, error=${e}`
+          `action=retrieveObjectsByServiceId service=${serviceId}, error: ${err}`
         );
-        res.status(500).json({ error: e.message });
+        if (!res.headersSent) {
+          res.status(500).json({ error: err.message });
+        }
       }
     });
     router.get("/clusters", async (req, res) => {
-      await requirePermission.requirePermission(
-        permissionApi,
-        pluginKubernetesCommon.kubernetesClustersReadPermission,
-        httpAuth,
-        req
-      );
-      const credentials = await httpAuth.credentials(req);
-      const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {
-        credentials
-      });
-      res.json({
-        items: clusterDetails.map((cd) => {
-          const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
-          const authProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
-          const strategy = authStrategyMap[authProvider];
-          let auth = {};
-          if (strategy) {
-            auth = strategy.presentAuthMetadata(cd.authMetadata);
-          }
-          return {
-            name: cd.name,
-            title: cd.title,
-            dashboardUrl: cd.dashboardUrl,
-            authProvider,
-            ...oidcTokenProvider && { oidcTokenProvider },
-            ...auth && Object.keys(auth).length !== 0 && { auth }
-          };
-        })
+      const auditorEvent = await auditor.createEvent({
+        eventId: "cluster-fetch",
+        request: req,
+        meta: { queryType: "list" }
       });
+      try {
+        await requirePermission.requirePermission(
+          permissionApi,
+          pluginKubernetesCommon.kubernetesClustersReadPermission,
+          httpAuth,
+          req
+        );
+        const credentials = await httpAuth.credentials(req);
+        const clusterDetails = await this.fetchClusterDetails(clusterSupplier, {
+          credentials
+        });
+        res.json({
+          items: clusterDetails.map((cd) => {
+            const oidcTokenProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER];
+            const authProvider = cd.authMetadata[pluginKubernetesCommon.ANNOTATION_KUBERNETES_AUTH_PROVIDER];
+            const strategy = authStrategyMap[authProvider];
+            let auth = {};
+            if (strategy) {
+              auth = strategy.presentAuthMetadata(cd.authMetadata);
+            }
+            return {
+              name: cd.name,
+              title: cd.title,
+              dashboardUrl: cd.dashboardUrl,
+              authProvider,
+              ...oidcTokenProvider && { oidcTokenProvider },
+              ...auth && Object.keys(auth).length !== 0 && { auth }
+            };
+          })
+        });
+        auditorEvent.success().catch(
+          (error) => logger.error(
+            "Failed to emit audit event cluster-fetch (list)",
+            error
+          )
+        );
+      } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        await auditorEvent.fail({ error: err });
+        throw e;
+      }
     });
     resourcesRoutes.addResourceRoutesToRouter(
       router,
       catalog,
       objectsProvider,
       httpAuth,
-      permissionApi
+      permissionApi,
+      auditor,
+      logger
     );
     return router;
   }
@@ -176,6 +235,23 @@ class KubernetesRouter {
     );
     return clusterDetails;
   }
+  async warnForClustersWithSkipTLSVerify(logger, clusterSupplier) {
+    try {
+      const credentials = await this.env.auth.getOwnServiceCredentials();
+      const clusters = await clusterSupplier.getClusters({ credentials });
+      for (const cluster of clusters) {
+        if (cluster.skipTLSVerify) {
+          logger.warn(
+            `Cluster '${cluster.name}' is configured with skipTLSVerify: true; TLS certificate verification is disabled for Kubernetes API traffic to this cluster`
+          );
+        }
+      }
+    } catch (error) {
+      logger.warn(
+        `Failed to log skipTLSVerify warnings at startup: ${errors.toError(error).message}`
+      );
+    }
+  }
 }
 
 exports.KubernetesRouter = KubernetesRouter;