@backstage/plugin-scaffolder-backend 1.22.0-next.0 → 1.22.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @backstage/plugin-scaffolder-backend
 
+## 1.22.0-next.1
+
+### Minor Changes
+
+- aa543c9: Migrate plugin to use the new auth services, add an optional service discovery to the router options and change the permissions type to be `PermissionsService`.
+
+### Patch Changes
+
+- bbd1fe1: Made "checkpoint" on scaffolder action context non-optional
+- Updated dependencies
+  - @backstage/config@1.2.0-next.1
+  - @backstage/plugin-scaffolder-node@0.4.0-next.1
+  - @backstage/plugin-scaffolder-backend-module-github@0.2.4-next.1
+  - @backstage/backend-common@0.21.4-next.1
+  - @backstage/backend-plugin-api@0.6.14-next.1
+  - @backstage/backend-tasks@0.5.19-next.1
+  - @backstage/integration@1.9.1-next.1
+  - @backstage/plugin-auth-node@0.4.9-next.1
+  - @backstage/plugin-permission-common@0.7.13-next.1
+  - @backstage/plugin-permission-node@0.7.25-next.1
+  - @backstage/plugin-scaffolder-backend-module-azure@0.1.6-next.1
+  - @backstage/plugin-scaffolder-backend-module-bitbucket@0.2.4-next.1
+  - @backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.1.4-next.1
+  - @backstage/plugin-scaffolder-backend-module-bitbucket-server@0.1.4-next.1
+  - @backstage/plugin-scaffolder-backend-module-gerrit@0.1.6-next.1
+  - @backstage/plugin-scaffolder-backend-module-gitea@0.1.4-next.1
+  - @backstage/plugin-scaffolder-backend-module-gitlab@0.2.17-next.1
+  - @backstage/catalog-client@1.6.1-next.0
+  - @backstage/catalog-model@1.4.5-next.0
+  - @backstage/errors@1.2.4-next.0
+  - @backstage/types@1.1.1
+  - @backstage/plugin-catalog-backend-module-scaffolder-entity-model@0.1.11-next.1
+  - @backstage/plugin-catalog-node@1.8.0-next.1
+  - @backstage/plugin-scaffolder-common@1.5.1-next.1
+
 ## 1.22.0-next.0
 
 ### Minor Changes

package/alpha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-scaffolder-backend",
-  "version": "1.22.0-next.0",
+  "version": "1.22.0-next.1",
   "main": "../dist/alpha.cjs.js",
   "types": "../dist/alpha.d.ts"
 }

package/dist/alpha.cjs.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var alpha = require('@backstage/plugin-scaffolder-common/alpha');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
-var router = require('./cjs/router-ae706822.cjs.js');
+var router = require('./cjs/router-1665319e.cjs.js');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var backendCommon = require('@backstage/backend-common');
 var integration = require('@backstage/integration');
@@ -98,7 +98,10 @@ const scaffolderPlugin = backendPluginApi.createBackendPlugin({
         reader: backendPluginApi.coreServices.urlReader,
         permissions: backendPluginApi.coreServices.permissions,
         database: backendPluginApi.coreServices.database,
+        auth: backendPluginApi.coreServices.auth,
+        discovery: backendPluginApi.coreServices.discovery,
         httpRouter: backendPluginApi.coreServices.httpRouter,
+        httpAuth: backendPluginApi.coreServices.httpAuth,
         catalogClient: alpha$2.catalogServiceRef
       },
       async init({
@@ -107,7 +110,10 @@ const scaffolderPlugin = backendPluginApi.createBackendPlugin({
         lifecycle,
         reader,
         database,
+        auth,
+        discovery,
         httpRouter,
+        httpAuth,
         catalogClient,
         permissions
       }) {
@@ -134,8 +140,8 @@ const scaffolderPlugin = backendPluginApi.createBackendPlugin({
           router.createDebugLogAction(),
           router.createWaitAction(),
           // todo(blam): maybe these should be a -catalog module?
-          router.createCatalogRegisterAction({ catalogClient, integrations }),
-          router.createFetchCatalogEntityAction({ catalogClient }),
+          router.createCatalogRegisterAction({ catalogClient, integrations, auth }),
+          router.createFetchCatalogEntityAction({ catalogClient, auth }),
           router.createCatalogWriteAction(),
           router.createFilesystemDeleteAction(),
           router.createFilesystemRenameAction()
@@ -155,6 +161,9 @@ const scaffolderPlugin = backendPluginApi.createBackendPlugin({
           taskBroker,
           additionalTemplateFilters,
           additionalTemplateGlobals,
+          auth,
+          httpAuth,
+          discovery,
           permissions
         });
         httpRouter.use(router$1);

package/dist/alpha.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"alpha.cjs.js","sources":["../src/service/conditionExports.ts","../src/ScaffolderPlugin.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  RESOURCE_TYPE_SCAFFOLDER_ACTION,\n} from '@backstage/plugin-scaffolder-common/alpha';\nimport { createConditionExports } from '@backstage/plugin-permission-node';\nimport { scaffolderTemplateRules, scaffolderActionRules } from './rules';\n\nconst templateConditionExports = createConditionExports({\n  pluginId: 'scaffolder',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  rules: scaffolderTemplateRules,\n});\n\nconst actionsConditionExports = createConditionExports({\n  pluginId: 'scaffolder',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,\n  rules: scaffolderActionRules,\n});\n\n/**\n * `createScaffolderTemplateConditionalDecision` can be used when authoring policies to\n * create conditional decisions. It requires a permission of type\n * `ResourcePermission<'scaffolder-template'>` to be passed as the first parameter.\n * It's recommended that you use the provided `isResourcePermission` and\n * `isPermission` helper methods to narrow the type of the permission passed to\n * the handle method as shown below.\n *\n * ```\n * // MyAuthorizationPolicy.ts\n * ...\n * import { createScaffolderPolicyDecision } from '@backstage/plugin-scaffolder-backend';\n * import { RESOURCE_TYPE_SCAFFOLDER_TEMPLATE } from '@backstage/plugin-scaffolder-common';\n *\n * class MyAuthorizationPolicy implements PermissionPolicy {\n *   async handle(request, user) {\n *    ...\n *\n *    if (isResourcePermission(request.permission, RESOURCE_TYPE_SCAFFOLDER_TEMPLATE)) {\n *      return createScaffolderConditionalDecision(\n *        request.permission,\n *        { anyOf: [...insert conditions here...] }\n *      );\n *    }\n *\n *    ...\n * }\n *\n * ```\n *\n * @alpha\n */\nexport const createScaffolderTemplateConditionalDecision =\n  templateConditionExports.createConditionalDecision;\n\n/**\n * These conditions are used when creating conditional decisions for scaffolder\n * templates that are returned by authorization policies.\n *\n * @alpha\n */\nexport const scaffolderTemplateConditions = templateConditionExports.conditions;\n\n/**\n * @alpha\n */\nexport const createScaffolderActionConditionalDecision =\n  actionsConditionExports.createConditionalDecision;\n\n/**\n *\n * These conditions are used when creating conditional decisions for scaffolder\n * actions that are returned by authorization policies.\n *\n * @alpha\n */\nexport const scaffolderActionConditions = actionsConditionExports.conditions;\n","/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createBackendPlugin,\n  coreServices,\n} from '@backstage/backend-plugin-api';\nimport { loggerToWinstonLogger } from '@backstage/backend-common';\nimport { ScmIntegrations } from '@backstage/integration';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node/alpha';\nimport {\n  TaskBroker,\n  TemplateAction,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport {\n  scaffolderActionsExtensionPoint,\n  scaffolderTaskBrokerExtensionPoint,\n  scaffolderTemplatingExtensionPoint,\n} from '@backstage/plugin-scaffolder-node/alpha';\nimport {\n  createCatalogRegisterAction,\n  createCatalogWriteAction,\n  createDebugLogAction,\n  createFetchCatalogEntityAction,\n  createFetchPlainAction,\n  createFetchPlainFileAction,\n  createFetchTemplateAction,\n  createFilesystemDeleteAction,\n  createFilesystemRenameAction,\n  createWaitAction,\n} from './scaffolder';\nimport { createRouter } from './service/router';\n\n/**\n * Scaffolder plugin\n *\n * @alpha\n */\nexport const scaffolderPlugin = createBackendPlugin({\n  pluginId: 'scaffolder',\n  register(env) {\n    const addedActions = new Array<TemplateAction<any, any>>();\n    env.registerExtensionPoint(scaffolderActionsExtensionPoint, {\n      addActions(...newActions: TemplateAction<any>[]) {\n        addedActions.push(...newActions);\n      },\n    });\n\n    let taskBroker: TaskBroker | undefined;\n    env.registerExtensionPoint(scaffolderTaskBrokerExtensionPoint, {\n      setTaskBroker(newTaskBroker) {\n        if (taskBroker) {\n          throw new Error('Task broker may only be set once');\n        }\n        taskBroker = newTaskBroker;\n      },\n    });\n\n    const additionalTemplateFilters: Record<string, TemplateFilter> = {};\n    const additionalTemplateGlobals: Record<string, TemplateGlobal> = {};\n    env.registerExtensionPoint(scaffolderTemplatingExtensionPoint, {\n      addTemplateFilters(newFilters) {\n        Object.assign(additionalTemplateFilters, newFilters);\n      },\n      addTemplateGlobals(newGlobals) {\n        Object.assign(additionalTemplateGlobals, newGlobals);\n      },\n    });\n\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        config: coreServices.rootConfig,\n        lifecycle: coreServices.rootLifecycle,\n        reader: coreServices.urlReader,\n        permissions: coreServices.permissions,\n        database: coreServices.database,\n        httpRouter: coreServices.httpRouter,\n        catalogClient: catalogServiceRef,\n      },\n      async init({\n        logger,\n        config,\n        lifecycle,\n        reader,\n        database,\n        httpRouter,\n        catalogClient,\n        permissions,\n      }) {\n        const log = loggerToWinstonLogger(logger);\n        const integrations = ScmIntegrations.fromConfig(config);\n\n        const actions = [\n          // actions provided from other modules\n          ...addedActions,\n\n          // built-in actions for the scaffolder\n          createFetchPlainAction({\n            reader,\n            integrations,\n          }),\n          createFetchPlainFileAction({\n            reader,\n            integrations,\n          }),\n          createFetchTemplateAction({\n            integrations,\n            reader,\n            additionalTemplateFilters,\n            additionalTemplateGlobals,\n          }),\n          createDebugLogAction(),\n          createWaitAction(),\n          // todo(blam): maybe these should be a -catalog module?\n          createCatalogRegisterAction({ catalogClient, integrations }),\n          createFetchCatalogEntityAction({ catalogClient }),\n          createCatalogWriteAction(),\n          createFilesystemDeleteAction(),\n          createFilesystemRenameAction(),\n        ];\n\n        const actionIds = actions.map(action => action.id).join(', ');\n\n        log.info(\n          `Starting scaffolder with the following actions enabled ${actionIds}`,\n        );\n\n        const router = await createRouter({\n          logger: log,\n          config,\n          database,\n          catalogClient,\n          reader,\n          lifecycle,\n          actions,\n          taskBroker,\n          additionalTemplateFilters,\n          additionalTemplateGlobals,\n          permissions,\n        });\n        httpRouter.use(router);\n      },\n    });\n  },\n});\n"],"names":["createConditionExports","RESOURCE_TYPE_SCAFFOLDER_TEMPLATE","scaffolderTemplateRules","RESOURCE_TYPE_SCAFFOLDER_ACTION","scaffolderActionRules","createBackendPlugin","scaffolderActionsExtensionPoint","scaffolderTaskBrokerExtensionPoint","scaffolderTemplatingExtensionPoint","coreServices","catalogServiceRef","loggerToWinstonLogger","ScmIntegrations","createFetchPlainAction","createFetchPlainFileAction","createFetchTemplateAction","createDebugLogAction","createWaitAction","createCatalogRegisterAction","createFetchCatalogEntityAction","createCatalogWriteAction","createFilesystemDeleteAction","createFilesystemRenameAction","router","createRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,2BAA2BA,2CAAuB,CAAA;AAAA,EACtD,QAAU,EAAA,YAAA;AAAA,EACV,YAAc,EAAAC,uCAAA;AAAA,EACd,KAAO,EAAAC,8BAAA;AACT,CAAC,CAAA,CAAA;AAED,MAAM,0BAA0BF,2CAAuB,CAAA;AAAA,EACrD,QAAU,EAAA,YAAA;AAAA,EACV,YAAc,EAAAG,qCAAA;AAAA,EACd,KAAO,EAAAC,4BAAA;AACT,CAAC,CAAA,CAAA;AAkCM,MAAM,8CACX,wBAAyB,CAAA,0BAAA;AAQpB,MAAM,+BAA+B,wBAAyB,CAAA,WAAA;AAK9D,MAAM,4CACX,uBAAwB,CAAA,0BAAA;AASnB,MAAM,6BAA6B,uBAAwB,CAAA;;ACtC3D,MAAM,mBAAmBC,oCAAoB,CAAA;AAAA,EAClD,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAM,MAAA,YAAA,GAAe,IAAI,KAAgC,EAAA,CAAA;AACzD,IAAA,GAAA,CAAI,uBAAuBC,uCAAiC,EAAA;AAAA,MAC1D,cAAc,UAAmC,EAAA;AAC/C,QAAa,YAAA,CAAA,IAAA,CAAK,GAAG,UAAU,CAAA,CAAA;AAAA,OACjC;AAAA,KACD,CAAA,CAAA;AAED,IAAI,IAAA,UAAA,CAAA;AACJ,IAAA,GAAA,CAAI,uBAAuBC,0CAAoC,EAAA;AAAA,MAC7D,cAAc,aAAe,EAAA;AAC3B,QAAA,IAAI,UAAY,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,kCAAkC,CAAA,CAAA;AAAA,SACpD;AACA,QAAa,UAAA,GAAA,aAAA,CAAA;AAAA,OACf;AAAA,KACD,CAAA,CAAA;AAED,IAAA,MAAM,4BAA4D,EAAC,CAAA;AACnE,IAAA,MAAM,4BAA4D,EAAC,CAAA;AACnE,IAAA,GAAA,CAAI,uBAAuBC,0CAAoC,EAAA;AAAA,MAC7D,mBAAmB,UAAY,EAAA;AAC7B,QAAO,MAAA,CAAA,MAAA,CAAO,2BAA2B,UAAU,CAAA,CAAA;AAAA,OACrD;AAAA,MACA,mBAAmB,UAAY,EAAA;AAC7B,QAAO,MAAA,CAAA,MAAA,CAAO,2BAA2B,UAAU,CAAA,CAAA;AAAA,OACrD;AAAA,KACD,CAAA,CAAA;AAED,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,QAAQC,6BAAa,CAAA,MAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA,UAAA;AAAA,QACrB,WAAWA,6BAAa,CAAA,aAAA;AAAA,QACxB,QAAQA,6BAAa,CAAA,SAAA;AAAA,QACrB,aAAaA,6BAAa,CAAA,WAAA;AAAA,QAC1B,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,YAAYA,6BAAa,CAAA,UAAA;AAAA,QACzB,aAAe,EAAAC,yBAAA;AAAA,OACjB;AAAA,MACA,MAAM,IAAK,CAAA;AAAA,QACT,MAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA,QACA,aAAA;AAAA,QACA,WAAA;AAAA,OACC,EAAA;AACD,QAAM,MAAA,GAAA,GAAMC,oCAAsB,MAAM,CAAA,CAAA;AACxC,QAAM,MAAA,YAAA,GAAeC,2BAAgB,CAAA,UAAA,CAAW,MAAM,CAAA,CAAA;AAEtD,QAAA,MAAM,OAAU,GAAA;AAAA;AAAA,UAEd,GAAG,YAAA;AAAA;AAAA,UAGHC,6BAAuB,CAAA;AAAA,YACrB,MAAA;AAAA,YACA,YAAA;AAAA,WACD,CAAA;AAAA,UACDC,iCAA2B,CAAA;AAAA,YACzB,MAAA;AAAA,YACA,YAAA;AAAA,WACD,CAAA;AAAA,UACDC,gCAA0B,CAAA;AAAA,YACxB,YAAA;AAAA,YACA,MAAA;AAAA,YACA,yBAAA;AAAA,YACA,yBAAA;AAAA,WACD,CAAA;AAAA,UACDC,2BAAqB,EAAA;AAAA,UACrBC,uBAAiB,EAAA;AAAA;AAAA,UAEjBC,kCAA4B,CAAA,EAAE,aAAe,EAAA,YAAA,EAAc,CAAA;AAAA,UAC3DC,qCAAA,CAA+B,EAAE,aAAA,EAAe,CAAA;AAAA,UAChDC,+BAAyB,EAAA;AAAA,UACzBC,mCAA6B,EAAA;AAAA,UAC7BC,mCAA6B,EAAA;AAAA,SAC/B,CAAA;AAEA,QAAM,MAAA,SAAA,GAAY,QAAQ,GAAI,CAAA,CAAA,MAAA,KAAU,OAAO,EAAE,CAAA,CAAE,KAAK,IAAI,CAAA,CAAA;AAE5D,QAAI,GAAA,CAAA,IAAA;AAAA,UACF,0DAA0D,SAAS,CAAA,CAAA;AAAA,SACrE,CAAA;AAEA,QAAM,MAAAC,QAAA,GAAS,MAAMC,mBAAa,CAAA;AAAA,UAChC,MAAQ,EAAA,GAAA;AAAA,UACR,MAAA;AAAA,UACA,QAAA;AAAA,UACA,aAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAA;AAAA,UACA,UAAA;AAAA,UACA,yBAAA;AAAA,UACA,yBAAA;AAAA,UACA,WAAA;AAAA,SACD,CAAA,CAAA;AACD,QAAA,UAAA,CAAW,IAAID,QAAM,CAAA,CAAA;AAAA,OACvB;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;;;;;"}
+{"version":3,"file":"alpha.cjs.js","sources":["../src/service/conditionExports.ts","../src/ScaffolderPlugin.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  RESOURCE_TYPE_SCAFFOLDER_ACTION,\n} from '@backstage/plugin-scaffolder-common/alpha';\nimport { createConditionExports } from '@backstage/plugin-permission-node';\nimport { scaffolderTemplateRules, scaffolderActionRules } from './rules';\n\nconst templateConditionExports = createConditionExports({\n  pluginId: 'scaffolder',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  rules: scaffolderTemplateRules,\n});\n\nconst actionsConditionExports = createConditionExports({\n  pluginId: 'scaffolder',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,\n  rules: scaffolderActionRules,\n});\n\n/**\n * `createScaffolderTemplateConditionalDecision` can be used when authoring policies to\n * create conditional decisions. It requires a permission of type\n * `ResourcePermission<'scaffolder-template'>` to be passed as the first parameter.\n * It's recommended that you use the provided `isResourcePermission` and\n * `isPermission` helper methods to narrow the type of the permission passed to\n * the handle method as shown below.\n *\n * ```\n * // MyAuthorizationPolicy.ts\n * ...\n * import { createScaffolderPolicyDecision } from '@backstage/plugin-scaffolder-backend';\n * import { RESOURCE_TYPE_SCAFFOLDER_TEMPLATE } from '@backstage/plugin-scaffolder-common';\n *\n * class MyAuthorizationPolicy implements PermissionPolicy {\n *   async handle(request, user) {\n *    ...\n *\n *    if (isResourcePermission(request.permission, RESOURCE_TYPE_SCAFFOLDER_TEMPLATE)) {\n *      return createScaffolderConditionalDecision(\n *        request.permission,\n *        { anyOf: [...insert conditions here...] }\n *      );\n *    }\n *\n *    ...\n * }\n *\n * ```\n *\n * @alpha\n */\nexport const createScaffolderTemplateConditionalDecision =\n  templateConditionExports.createConditionalDecision;\n\n/**\n * These conditions are used when creating conditional decisions for scaffolder\n * templates that are returned by authorization policies.\n *\n * @alpha\n */\nexport const scaffolderTemplateConditions = templateConditionExports.conditions;\n\n/**\n * @alpha\n */\nexport const createScaffolderActionConditionalDecision =\n  actionsConditionExports.createConditionalDecision;\n\n/**\n *\n * These conditions are used when creating conditional decisions for scaffolder\n * actions that are returned by authorization policies.\n *\n * @alpha\n */\nexport const scaffolderActionConditions = actionsConditionExports.conditions;\n","/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createBackendPlugin,\n  coreServices,\n} from '@backstage/backend-plugin-api';\nimport { loggerToWinstonLogger } from '@backstage/backend-common';\nimport { ScmIntegrations } from '@backstage/integration';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node/alpha';\nimport {\n  TaskBroker,\n  TemplateAction,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport {\n  scaffolderActionsExtensionPoint,\n  scaffolderTaskBrokerExtensionPoint,\n  scaffolderTemplatingExtensionPoint,\n} from '@backstage/plugin-scaffolder-node/alpha';\nimport {\n  createCatalogRegisterAction,\n  createCatalogWriteAction,\n  createDebugLogAction,\n  createFetchCatalogEntityAction,\n  createFetchPlainAction,\n  createFetchPlainFileAction,\n  createFetchTemplateAction,\n  createFilesystemDeleteAction,\n  createFilesystemRenameAction,\n  createWaitAction,\n} from './scaffolder';\nimport { createRouter } from './service/router';\n\n/**\n * Scaffolder plugin\n *\n * @alpha\n */\nexport const scaffolderPlugin = createBackendPlugin({\n  pluginId: 'scaffolder',\n  register(env) {\n    const addedActions = new Array<TemplateAction<any, any>>();\n    env.registerExtensionPoint(scaffolderActionsExtensionPoint, {\n      addActions(...newActions: TemplateAction<any>[]) {\n        addedActions.push(...newActions);\n      },\n    });\n\n    let taskBroker: TaskBroker | undefined;\n    env.registerExtensionPoint(scaffolderTaskBrokerExtensionPoint, {\n      setTaskBroker(newTaskBroker) {\n        if (taskBroker) {\n          throw new Error('Task broker may only be set once');\n        }\n        taskBroker = newTaskBroker;\n      },\n    });\n\n    const additionalTemplateFilters: Record<string, TemplateFilter> = {};\n    const additionalTemplateGlobals: Record<string, TemplateGlobal> = {};\n    env.registerExtensionPoint(scaffolderTemplatingExtensionPoint, {\n      addTemplateFilters(newFilters) {\n        Object.assign(additionalTemplateFilters, newFilters);\n      },\n      addTemplateGlobals(newGlobals) {\n        Object.assign(additionalTemplateGlobals, newGlobals);\n      },\n    });\n\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        config: coreServices.rootConfig,\n        lifecycle: coreServices.rootLifecycle,\n        reader: coreServices.urlReader,\n        permissions: coreServices.permissions,\n        database: coreServices.database,\n        auth: coreServices.auth,\n        discovery: coreServices.discovery,\n        httpRouter: coreServices.httpRouter,\n        httpAuth: coreServices.httpAuth,\n        catalogClient: catalogServiceRef,\n      },\n      async init({\n        logger,\n        config,\n        lifecycle,\n        reader,\n        database,\n        auth,\n        discovery,\n        httpRouter,\n        httpAuth,\n        catalogClient,\n        permissions,\n      }) {\n        const log = loggerToWinstonLogger(logger);\n        const integrations = ScmIntegrations.fromConfig(config);\n\n        const actions = [\n          // actions provided from other modules\n          ...addedActions,\n\n          // built-in actions for the scaffolder\n          createFetchPlainAction({\n            reader,\n            integrations,\n          }),\n          createFetchPlainFileAction({\n            reader,\n            integrations,\n          }),\n          createFetchTemplateAction({\n            integrations,\n            reader,\n            additionalTemplateFilters,\n            additionalTemplateGlobals,\n          }),\n          createDebugLogAction(),\n          createWaitAction(),\n          // todo(blam): maybe these should be a -catalog module?\n          createCatalogRegisterAction({ catalogClient, integrations, auth }),\n          createFetchCatalogEntityAction({ catalogClient, auth }),\n          createCatalogWriteAction(),\n          createFilesystemDeleteAction(),\n          createFilesystemRenameAction(),\n        ];\n\n        const actionIds = actions.map(action => action.id).join(', ');\n\n        log.info(\n          `Starting scaffolder with the following actions enabled ${actionIds}`,\n        );\n\n        const router = await createRouter({\n          logger: log,\n          config,\n          database,\n          catalogClient,\n          reader,\n          lifecycle,\n          actions,\n          taskBroker,\n          additionalTemplateFilters,\n          additionalTemplateGlobals,\n          auth,\n          httpAuth,\n          discovery,\n          permissions,\n        });\n        httpRouter.use(router);\n      },\n    });\n  },\n});\n"],"names":["createConditionExports","RESOURCE_TYPE_SCAFFOLDER_TEMPLATE","scaffolderTemplateRules","RESOURCE_TYPE_SCAFFOLDER_ACTION","scaffolderActionRules","createBackendPlugin","scaffolderActionsExtensionPoint","scaffolderTaskBrokerExtensionPoint","scaffolderTemplatingExtensionPoint","coreServices","catalogServiceRef","loggerToWinstonLogger","ScmIntegrations","createFetchPlainAction","createFetchPlainFileAction","createFetchTemplateAction","createDebugLogAction","createWaitAction","createCatalogRegisterAction","createFetchCatalogEntityAction","createCatalogWriteAction","createFilesystemDeleteAction","createFilesystemRenameAction","router","createRouter"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,2BAA2BA,2CAAuB,CAAA;AAAA,EACtD,QAAU,EAAA,YAAA;AAAA,EACV,YAAc,EAAAC,uCAAA;AAAA,EACd,KAAO,EAAAC,8BAAA;AACT,CAAC,CAAA,CAAA;AAED,MAAM,0BAA0BF,2CAAuB,CAAA;AAAA,EACrD,QAAU,EAAA,YAAA;AAAA,EACV,YAAc,EAAAG,qCAAA;AAAA,EACd,KAAO,EAAAC,4BAAA;AACT,CAAC,CAAA,CAAA;AAkCM,MAAM,8CACX,wBAAyB,CAAA,0BAAA;AAQpB,MAAM,+BAA+B,wBAAyB,CAAA,WAAA;AAK9D,MAAM,4CACX,uBAAwB,CAAA,0BAAA;AASnB,MAAM,6BAA6B,uBAAwB,CAAA;;ACtC3D,MAAM,mBAAmBC,oCAAoB,CAAA;AAAA,EAClD,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAM,MAAA,YAAA,GAAe,IAAI,KAAgC,EAAA,CAAA;AACzD,IAAA,GAAA,CAAI,uBAAuBC,uCAAiC,EAAA;AAAA,MAC1D,cAAc,UAAmC,EAAA;AAC/C,QAAa,YAAA,CAAA,IAAA,CAAK,GAAG,UAAU,CAAA,CAAA;AAAA,OACjC;AAAA,KACD,CAAA,CAAA;AAED,IAAI,IAAA,UAAA,CAAA;AACJ,IAAA,GAAA,CAAI,uBAAuBC,0CAAoC,EAAA;AAAA,MAC7D,cAAc,aAAe,EAAA;AAC3B,QAAA,IAAI,UAAY,EAAA;AACd,UAAM,MAAA,IAAI,MAAM,kCAAkC,CAAA,CAAA;AAAA,SACpD;AACA,QAAa,UAAA,GAAA,aAAA,CAAA;AAAA,OACf;AAAA,KACD,CAAA,CAAA;AAED,IAAA,MAAM,4BAA4D,EAAC,CAAA;AACnE,IAAA,MAAM,4BAA4D,EAAC,CAAA;AACnE,IAAA,GAAA,CAAI,uBAAuBC,0CAAoC,EAAA;AAAA,MAC7D,mBAAmB,UAAY,EAAA;AAC7B,QAAO,MAAA,CAAA,MAAA,CAAO,2BAA2B,UAAU,CAAA,CAAA;AAAA,OACrD;AAAA,MACA,mBAAmB,UAAY,EAAA;AAC7B,QAAO,MAAA,CAAA,MAAA,CAAO,2BAA2B,UAAU,CAAA,CAAA;AAAA,OACrD;AAAA,KACD,CAAA,CAAA;AAED,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,QAAQC,6BAAa,CAAA,MAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA,UAAA;AAAA,QACrB,WAAWA,6BAAa,CAAA,aAAA;AAAA,QACxB,QAAQA,6BAAa,CAAA,SAAA;AAAA,QACrB,aAAaA,6BAAa,CAAA,WAAA;AAAA,QAC1B,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,MAAMA,6BAAa,CAAA,IAAA;AAAA,QACnB,WAAWA,6BAAa,CAAA,SAAA;AAAA,QACxB,YAAYA,6BAAa,CAAA,UAAA;AAAA,QACzB,UAAUA,6BAAa,CAAA,QAAA;AAAA,QACvB,aAAe,EAAAC,yBAAA;AAAA,OACjB;AAAA,MACA,MAAM,IAAK,CAAA;AAAA,QACT,MAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA;AAAA,QACA,SAAA;AAAA,QACA,UAAA;AAAA,QACA,QAAA;AAAA,QACA,aAAA;AAAA,QACA,WAAA;AAAA,OACC,EAAA;AACD,QAAM,MAAA,GAAA,GAAMC,oCAAsB,MAAM,CAAA,CAAA;AACxC,QAAM,MAAA,YAAA,GAAeC,2BAAgB,CAAA,UAAA,CAAW,MAAM,CAAA,CAAA;AAEtD,QAAA,MAAM,OAAU,GAAA;AAAA;AAAA,UAEd,GAAG,YAAA;AAAA;AAAA,UAGHC,6BAAuB,CAAA;AAAA,YACrB,MAAA;AAAA,YACA,YAAA;AAAA,WACD,CAAA;AAAA,UACDC,iCAA2B,CAAA;AAAA,YACzB,MAAA;AAAA,YACA,YAAA;AAAA,WACD,CAAA;AAAA,UACDC,gCAA0B,CAAA;AAAA,YACxB,YAAA;AAAA,YACA,MAAA;AAAA,YACA,yBAAA;AAAA,YACA,yBAAA;AAAA,WACD,CAAA;AAAA,UACDC,2BAAqB,EAAA;AAAA,UACrBC,uBAAiB,EAAA;AAAA;AAAA,UAEjBC,kCAA4B,CAAA,EAAE,aAAe,EAAA,YAAA,EAAc,MAAM,CAAA;AAAA,UACjEC,qCAA+B,CAAA,EAAE,aAAe,EAAA,IAAA,EAAM,CAAA;AAAA,UACtDC,+BAAyB,EAAA;AAAA,UACzBC,mCAA6B,EAAA;AAAA,UAC7BC,mCAA6B,EAAA;AAAA,SAC/B,CAAA;AAEA,QAAM,MAAA,SAAA,GAAY,QAAQ,GAAI,CAAA,CAAA,MAAA,KAAU,OAAO,EAAE,CAAA,CAAE,KAAK,IAAI,CAAA,CAAA;AAE5D,QAAI,GAAA,CAAA,IAAA;AAAA,UACF,0DAA0D,SAAS,CAAA,CAAA;AAAA,SACrE,CAAA;AAEA,QAAM,MAAAC,QAAA,GAAS,MAAMC,mBAAa,CAAA;AAAA,UAChC,MAAQ,EAAA,GAAA;AAAA,UACR,MAAA;AAAA,UACA,QAAA;AAAA,UACA,aAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAA;AAAA,UACA,UAAA;AAAA,UACA,yBAAA;AAAA,UACA,yBAAA;AAAA,UACA,IAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA;AAAA,UACA,WAAA;AAAA,SACD,CAAA,CAAA;AACD,QAAA,UAAA,CAAW,IAAID,QAAM,CAAA,CAAA;AAAA,OACvB;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;;;;;"}

package/dist/cjs/{router-ae706822.cjs.js → router-1665319e.cjs.js}

@@ -1,5 +1,6 @@
 'use strict';
 
+var backendCommon = require('@backstage/backend-common');
 var catalogModel = require('@backstage/catalog-model');
 var config = require('@backstage/config');
 var errors = require('@backstage/errors');
@@ -13,7 +14,6 @@ var zod = require('zod');
 var pluginScaffolderNode = require('@backstage/plugin-scaffolder-node');
 var yaml = require('yaml');
 var fs = require('fs-extra');
-var backendCommon = require('@backstage/backend-common');
 var path = require('path');
 var luxon = require('luxon');
 var globby = require('globby');
@@ -95,7 +95,7 @@ const examples$9 = [
 
 const id$4 = "catalog:register";
 function createCatalogRegisterAction(options) {
-  const { catalogClient, integrations } = options;
+  const { catalogClient, integrations, auth } = options;
   return pluginScaffolderNode.createTemplateAction({
     id: id$4,
     description: "Registers entities from a catalog descriptor file in the workspace into the software catalog.",
@@ -175,13 +175,17 @@ function createCatalogRegisterAction(options) {
         });
       }
       ctx.logger.info(`Registering ${catalogInfoUrl} in the catalog`);
+      const { token } = (_b = await (auth == null ? void 0 : auth.getPluginRequestToken({
+        onBehalfOf: await ctx.getInitiatorCredentials(),
+        targetPluginId: "catalog"
+      }))) != null ? _b : { token: (_a = ctx.secrets) == null ? void 0 : _a.backstageToken };
       try {
         await catalogClient.addLocation(
           {
             type: "url",
             target: catalogInfoUrl
           },
-          ((_a = ctx.secrets) == null ? void 0 : _a.backstageToken) ? { token: ctx.secrets.backstageToken } : {}
+          token ? { token } : {}
         );
       } catch (e) {
         if (!input.optional) {
@@ -195,7 +199,7 @@ function createCatalogRegisterAction(options) {
             type: "url",
             target: catalogInfoUrl
           },
-          ((_b = ctx.secrets) == null ? void 0 : _b.backstageToken) ? { token: ctx.secrets.backstageToken } : {}
+          token ? { token } : {}
         );
         if (result.entities.length) {
           const { entities } = result;
@@ -316,7 +320,7 @@ const examples$7 = [
 
 const id$2 = "catalog:fetch";
 function createFetchCatalogEntityAction(options) {
-  const { catalogClient } = options;
+  const { catalogClient, auth } = options;
   return pluginScaffolderNode.createTemplateAction({
     id: id$2,
     description: "Returns entity or entities from the catalog by entity reference(s)",
@@ -356,13 +360,17 @@ function createFetchCatalogEntityAction(options) {
         }
         throw new Error("Missing entity reference or references");
       }
+      const { token } = (_b = await (auth == null ? void 0 : auth.getPluginRequestToken({
+        onBehalfOf: await ctx.getInitiatorCredentials(),
+        targetPluginId: "catalog"
+      }))) != null ? _b : { token: (_a = ctx.secrets) == null ? void 0 : _a.backstageToken };
       if (entityRef) {
         const entity = await catalogClient.getEntityByRef(
           catalogModel.stringifyEntityRef(
             catalogModel.parseEntityRef(entityRef, { defaultKind, defaultNamespace })
           ),
           {
-            token: (_a = ctx.secrets) == null ? void 0 : _a.backstageToken
+            token
           }
         );
         if (!entity && !optional) {
@@ -380,7 +388,7 @@ function createFetchCatalogEntityAction(options) {
             )
           },
           {
-            token: (_b = ctx.secrets) == null ? void 0 : _b.backstageToken
+            token
           }
         );
         const finalEntities = entities.items.map((e, i) => {
@@ -1320,6 +1328,7 @@ const createBuiltinActions = (options) => {
     reader,
     integrations,
     catalogClient,
+    auth,
     config,
     additionalTemplateFilters,
     additionalTemplateGlobals
@@ -1393,8 +1402,8 @@ const createBuiltinActions = (options) => {
     }),
     createDebugLogAction(),
     createWaitAction(),
-    createCatalogRegisterAction({ catalogClient, integrations }),
-    createFetchCatalogEntityAction({ catalogClient }),
+    createCatalogRegisterAction({ catalogClient, integrations, auth }),
+    createFetchCatalogEntityAction({ catalogClient, auth }),
     createCatalogWriteAction(),
     createFilesystemDeleteAction(),
     createFilesystemRenameAction(),
@@ -1893,16 +1902,17 @@ var __publicField$2 = (obj, key, value) => {
 };
 class TaskManager {
   // Runs heartbeat internally
-  constructor(task, storage, signal, logger) {
+  constructor(task, storage, signal, logger, auth) {
     this.task = task;
     this.storage = storage;
     this.signal = signal;
     this.logger = logger;
+    this.auth = auth;
     __publicField$2(this, "isDone", false);
     __publicField$2(this, "heartbeatTimeoutId");
   }
-  static create(task, storage, abortSignal, logger) {
-    const agent = new TaskManager(task, storage, abortSignal, logger);
+  static create(task, storage, abortSignal, logger, auth) {
+    const agent = new TaskManager(task, storage, abortSignal, logger, auth);
     agent.startTimeout();
     return agent;
   }
@@ -1975,6 +1985,17 @@ class TaskManager {
       }
     }, 1e3);
   }
+  async getInitiatorCredentials() {
+    if (this.task.secrets && "__initiatorCredentials" in this.task.secrets) {
+      return JSON.parse(this.task.secrets.__initiatorCredentials);
+    }
+    if (!this.auth) {
+      throw new Error(
+        "Failed to create none credentials in scaffolder task. The TaskManager has not been initialized with an auth service implementation"
+      );
+    }
+    return this.auth.getNoneCredentials();
+  }
 }
 function defer() {
   let resolve = () => {
@@ -1985,10 +2006,11 @@ function defer() {
   return { promise, resolve };
 }
 class StorageTaskBroker {
-  constructor(storage, logger, config) {
+  constructor(storage, logger, config, auth) {
     this.storage = storage;
     this.logger = logger;
     this.config = config;
+    this.auth = auth;
     __publicField$2(this, "deferredDispatch", defer());
   }
   async list(options) {
@@ -2059,7 +2081,8 @@ class StorageTaskBroker {
           },
           this.storage,
           abortController.signal,
-          this.logger
+          this.logger,
+          this.auth
         );
       }
       await this.waitForDispatch();
@@ -2499,7 +2522,8 @@ class NunjucksWorkflowRunner {
           templateInfo: task.spec.templateInfo,
           user: task.spec.user,
           isDryRun: task.isDryRun,
-          signal: task.cancelSignal
+          signal: task.cancelSignal,
+          getInitiatorCredentials: task.getInitiatorCredentials
         });
       }
       for (const tmpDir of tmpDirs) {
@@ -2517,7 +2541,6 @@ class NunjucksWorkflowRunner {
     }
   }
   async execute(task) {
-    var _a;
     if (!isValidTaskSpec(task.spec)) {
       throw new errors.InputError(
         "Wrong template version executed with the workflow engine"
@@ -2545,7 +2568,7 @@ class NunjucksWorkflowRunner {
       };
       const [decision] = this.options.permissions && task.spec.steps.length ? await this.options.permissions.authorizeConditional(
         [{ permission: alpha.actionExecutePermission }],
-        { token: (_a = task.secrets) == null ? void 0 : _a.backstageToken }
+        { credentials: await task.getInitiatorCredentials() }
       ) : [{ result: pluginPermissionCommon.AuthorizeResult.ALLOW }];
       for (const step of task.spec.steps) {
         await this.executeStep(
@@ -2868,6 +2891,7 @@ function createDryRunner(options) {
           }
         },
         secrets: input.secrets,
+        getInitiatorCredentials: () => Promise.resolve(input.credentials),
         // No need to update this at the end of the run, so just hard-code it
         done: false,
         isDryRun: true,
@@ -3026,17 +3050,23 @@ async function createRouter(options) {
     additionalTemplateFilters,
     additionalTemplateGlobals,
     permissions,
-    permissionRules
+    permissionRules,
+    discovery = backendCommon.HostDiscovery.fromConfig(config),
+    identity = buildDefaultIdentityClient(options)
   } = options;
+  const { auth, httpAuth } = backendCommon.createLegacyAuthAdapters({
+    ...options,
+    identity,
+    discovery
+  });
   const concurrentTasksLimit = (_a = options.concurrentTasksLimit) != null ? _a : options.config.getOptionalNumber("scaffolder.concurrentTasksLimit");
   const logger = parentLogger.child({ plugin: "scaffolder" });
-  const identity = options.identity || buildDefaultIdentityClient(options);
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = integration.ScmIntegrations.fromConfig(config);
   let taskBroker;
   if (!options.taskBroker) {
     const databaseTaskStore = await DatabaseTaskStore.create({ database });
-    taskBroker = new StorageTaskBroker(databaseTaskStore, logger, config);
+    taskBroker = new StorageTaskBroker(databaseTaskStore, logger, config, auth);
     if (scheduler && databaseTaskStore.listStaleTasks) {
       await scheduler.scheduleTask({
         id: "close_stale_tasks",
@@ -3090,7 +3120,8 @@ async function createRouter(options) {
     reader,
     config,
     additionalTemplateFilters,
-    additionalTemplateGlobals
+    additionalTemplateGlobals,
+    auth
   });
   actionsToRegister.forEach((action) => actionRegistry.register(action));
   const launchWorkers = () => workers.forEach((worker) => worker.start());
@@ -3144,11 +3175,16 @@ async function createRouter(options) {
     "/v2/templates/:namespace/:kind/:name/parameter-schema",
     async (req, res) => {
       var _a2, _b;
-      const userIdentity = await identity.getIdentity({
-        request: req
+      const credentials = await httpAuth.credentials(req);
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: credentials,
+        targetPluginId: "catalog"
       });
-      const token = userIdentity == null ? void 0 : userIdentity.token;
-      const template = await authorizeTemplate(req.params, token);
+      const template = await authorizeTemplate(
+        req.params,
+        token,
+        credentials
+      );
       const parameters = [(_a2 = template.spec.parameters) != null ? _a2 : []].flat();
       const presentation = template.spec.presentation;
       res.json({
@@ -3182,11 +3218,12 @@ async function createRouter(options) {
     const { kind, namespace, name } = catalogModel.parseEntityRef(templateRef, {
       defaultKind: "template"
     });
-    const callerIdentity = await identity.getIdentity({
-      request: req
+    const credentials = await httpAuth.credentials(req, { allow: ["user"] });
+    const { token } = await auth.getPluginRequestToken({
+      onBehalfOf: credentials,
+      targetPluginId: "catalog"
     });
-    const token = callerIdentity == null ? void 0 : callerIdentity.token;
-    const userEntityRef = callerIdentity == null ? void 0 : callerIdentity.identity.userEntityRef;
+    const userEntityRef = credentials.principal.userEntityRef;
     const userEntity = userEntityRef ? await catalogClient.getEntityByRef(userEntityRef, { token }) : void 0;
     let auditLog = `Scaffolding task for ${templateRef}`;
     if (userEntityRef) {
@@ -3196,7 +3233,8 @@ async function createRouter(options) {
     const values = req.body.values;
     const template = await authorizeTemplate(
       { kind, namespace, name },
-      token
+      token,
+      credentials
     );
     for (const parameters of [(_a2 = template.spec.parameters) != null ? _a2 : []].flat()) {
       const result2 = jsonschema.validate(values, parameters);
@@ -3236,7 +3274,8 @@ async function createRouter(options) {
       createdBy: userEntityRef,
       secrets: {
         ...req.body.secrets,
-        backstageToken: token
+        backstageToken: token,
+        initiatorCredentials: JSON.stringify(credentials)
       }
     });
     res.status(201).json({ id: result.taskId });
@@ -3331,7 +3370,7 @@ data: ${JSON.stringify(event)}
       clearTimeout(timeout);
     });
   }).post("/v2/dry-run", async (req, res) => {
-    var _a2, _b, _c, _d;
+    var _a2, _b, _c;
     const bodySchema = zod.z.object({
       template: zod.z.unknown(),
       values: zod.z.record(zod.z.unknown()),
@@ -3347,10 +3386,12 @@ data: ${JSON.stringify(event)}
     if (!await pluginScaffolderCommon.templateEntityV1beta3Validator.check(template)) {
       throw new errors.InputError("Input template is not a template");
     }
-    const token = (_a2 = await identity.getIdentity({
-      request: req
-    })) == null ? void 0 : _a2.token;
-    for (const parameters of [(_b = template.spec.parameters) != null ? _b : []].flat()) {
+    const credentials = await httpAuth.credentials(req);
+    const { token } = await auth.getPluginRequestToken({
+      onBehalfOf: credentials,
+      targetPluginId: "catalog"
+    });
+    for (const parameters of [(_a2 = template.spec.parameters) != null ? _a2 : []].flat()) {
       const result2 = jsonschema.validate(body.values, parameters);
       if (!result2.valid) {
         res.status(400).json({ errors: result2.errors });
@@ -3369,17 +3410,18 @@ data: ${JSON.stringify(event)}
       spec: {
         apiVersion: template.apiVersion,
         steps,
-        output: (_c = template.spec.output) != null ? _c : {},
+        output: (_b = template.spec.output) != null ? _b : {},
         parameters: body.values
       },
-      directoryContents: ((_d = body.directoryContents) != null ? _d : []).map((file) => ({
+      directoryContents: ((_c = body.directoryContents) != null ? _c : []).map((file) => ({
         path: file.path,
         content: Buffer.from(file.base64Content, "base64")
       })),
       secrets: {
         ...body.secrets,
         ...token && { backstageToken: token }
-      }
+      },
+      credentials
     });
     res.status(200).json({
       ...result,
@@ -3394,7 +3436,7 @@ data: ${JSON.stringify(event)}
   const app = express__default["default"]();
   app.set("logger", logger);
   app.use("/", router);
-  async function authorizeTemplate(entityRef, token) {
+  async function authorizeTemplate(entityRef, token, credentials) {
     const template = await findTemplate({
       catalogApi: catalogClient,
       entityRef,
@@ -3413,7 +3455,7 @@ data: ${JSON.stringify(event)}
         { permission: alpha.templateParameterReadPermission },
         { permission: alpha.templateStepReadPermission }
       ],
-      { token }
+      { credentials }
     );
     if (Array.isArray(template.spec.parameters)) {
       template.spec.parameters = template.spec.parameters.filter(
@@ -3448,4 +3490,4 @@ exports.createRouter = createRouter;
 exports.createWaitAction = createWaitAction;
 exports.scaffolderActionRules = scaffolderActionRules;
 exports.scaffolderTemplateRules = scaffolderTemplateRules;
-//# sourceMappingURL=router-ae706822.cjs.js.map
+//# sourceMappingURL=router-1665319e.cjs.js.map