@backstage/plugin-proxy-backend 0.5.0-next.3 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @backstage/plugin-proxy-backend
 
+## 0.5.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.23.1
+  - @backstage/backend-plugin-api@0.6.20
+  - @backstage/config@1.2.0
+  - @backstage/types@1.1.1
+
+## 0.5.0
+
+### Minor Changes
+
+- 88480e4: **BREAKING**: The proxy backend plugin is now protected by Backstage auth, by
+  default. Unless specifically configured (see below), all proxy endpoints will
+  reject requests immediately unless a valid Backstage user or service token is
+  passed along with the request. This aligns the proxy with how other Backstage
+  backends behave out of the box, and serves to protect your upstreams from
+  unauthorized access.
+
+  A proxy configuration section can now look as follows:
+
+  ```yaml
+  proxy:
+    endpoints:
+      '/pagerduty':
+        target: https://api.pagerduty.com
+        credentials: require # NEW!
+        headers:
+          Authorization: Token token=${PAGERDUTY_TOKEN}
+  ```
+
+  There are three possible `credentials` settings at this point:
+
+  - `require`: Callers must provide Backstage user or service credentials with
+    each request. The credentials are not forwarded to the proxy target.
+  - `forward`: Callers must provide Backstage user or service credentials with
+    each request, and those credentials are forwarded to the proxy target.
+  - `dangerously-allow-unauthenticated`: No Backstage credentials are required to
+    access this proxy target. The target can still apply its own credentials
+    checks, but the proxy will not help block non-Backstage-blessed callers. If
+    you also add `allowedHeaders: ['Authorization']` to an endpoint configuration,
+    then the Backstage token (if provided) WILL be forwarded.
+
+  The value `dangerously-allow-unauthenticated` was the old default.
+
+  The value `require` is the new default, so requests that were previously
+  permitted may now start resulting in `401 Unauthorized` responses. If you have
+  `backend.auth.dangerouslyDisableDefaultAuthPolicy` set to `true`, this does not
+  apply; the proxy will behave as if all endpoints were set to
+  `dangerously-allow-unauthenticated`.
+
+  If you have proxy endpoints that require unauthenticated access still, please
+  add `credentials: dangerously-allow-unauthenticated` to their declarations in
+  your app-config.
+
+### Patch Changes
+
+- 8869b8e: Updated local development setup.
+- 78a0b08: Internal refactor to handle `BackendFeature` contract change.
+- d44a20a: Added additional plugin metadata to `package.json`.
+- Updated dependencies
+  - @backstage/backend-common@0.23.0
+  - @backstage/backend-plugin-api@0.6.19
+  - @backstage/config@1.2.0
+  - @backstage/types@1.1.1
+
 ## 0.5.0-next.3
 
 ### Patch Changes

package/alpha/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "@backstage/plugin-proxy-backend",
-  "version": "0.5.0-next.3",
+  "name": "@backstage/plugin-proxy-backend__alpha",
+  "version": "0.5.1",
   "main": "../dist/alpha.cjs.js",
   "types": "../dist/alpha.d.ts"
 }

package/dist/alpha.d.ts

@@ -5,6 +5,6 @@ import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
  *
  * @alpha
  */
-declare const _default: () => _backstage_backend_plugin_api.BackendFeature;
+declare const _default: _backstage_backend_plugin_api.BackendFeatureCompat;
 
 export { _default as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-proxy-backend",
-  "version": "0.5.0-next.3",
+  "version": "0.5.1",
   "description": "A Backstage backend plugin that helps you set up proxy endpoints in the backend",
   "backstage": {
     "role": "backend-plugin",
@@ -52,8 +52,8 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.23.0-next.3",
-    "@backstage/backend-plugin-api": "^0.6.19-next.3",
+    "@backstage/backend-common": "^0.23.1",
+    "@backstage/backend-plugin-api": "^0.6.20",
     "@backstage/config": "^1.2.0",
     "@backstage/types": "^1.1.1",
     "@types/express": "^4.17.6",
@@ -68,11 +68,11 @@
     "yup": "^1.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-app-api": "^0.7.6-next.3",
-    "@backstage/backend-defaults": "^0.3.0-next.3",
-    "@backstage/backend-test-utils": "^0.4.0-next.3",
-    "@backstage/cli": "^0.26.7-next.3",
-    "@backstage/config-loader": "^1.8.1-next.0",
+    "@backstage/backend-app-api": "^0.7.7",
+    "@backstage/backend-defaults": "^0.3.1",
+    "@backstage/backend-test-utils": "^0.4.1",
+    "@backstage/cli": "^0.26.8",
+    "@backstage/config-loader": "^1.8.1",
     "@backstage/errors": "^1.2.4",
     "@types/http-proxy-middleware": "^1.0.0",
     "@types/uuid": "^9.0.0",