@red-hat-developer-hub/plugin-cost-management-backend 2.0.2

package/dist/util/checkPermissions.cjs.js

@@ -0,0 +1,108 @@
+'use strict';
+
+var pluginPermissionCommon = require('@backstage/plugin-permission-common');
+var permissions = require('@red-hat-developer-hub/plugin-cost-management-common/permissions');
+
+const authorize = async (request, anyOfPermissions, permissionsSvc, httpAuth) => {
+  const credentials = await httpAuth.credentials(request);
+  const permissionRequests = anyOfPermissions.map((permission) => ({
+    permission
+  }));
+  const decisions = await permissionsSvc.authorize(permissionRequests, {
+    credentials
+  });
+  const allow = decisions.find((d) => d.result === pluginPermissionCommon.AuthorizeResult.ALLOW);
+  return allow || {
+    result: pluginPermissionCommon.AuthorizeResult.DENY
+  };
+};
+const filterAuthorizedClustersAndProjects = async (request, permissionsSvc, httpAuth, clusterDataMap, allProjects, permissionType = "ros") => {
+  const credentials = await httpAuth.credentials(request);
+  const allClusterNames = Object.keys(clusterDataMap);
+  const allClusterIds = Object.values(clusterDataMap);
+  if (allClusterNames.length === 0) {
+    return {
+      authorizedClusterIds: [],
+      authorizedClusterProjects: []
+    };
+  }
+  const getClusterPermission = permissionType === "cost" ? permissions.costClusterSpecificPermission : permissions.rosClusterSpecificPermission;
+  const getClusterProjectPermission = permissionType === "cost" ? permissions.costClusterProjectPermission : permissions.rosClusterProjectPermission;
+  const numClusters = allClusterNames.length;
+  const clusterPermissionRequests = allClusterNames.map((clusterName) => {
+    const perm = getClusterPermission(clusterName);
+    return { permission: perm };
+  });
+  const clusterDecisions = await permissionsSvc.authorize(
+    clusterPermissionRequests,
+    {
+      credentials
+    }
+  );
+  const clustersWithFullAccess = /* @__PURE__ */ new Set();
+  const clustersWithoutFullAccess = [];
+  for (let i = 0; i < numClusters; i++) {
+    const clusterName = allClusterNames[i];
+    const clusterId = allClusterIds[i];
+    const clusterIdentifier = permissionType === "cost" ? clusterName : clusterId;
+    const decision = clusterDecisions[i].result;
+    if (decision === pluginPermissionCommon.AuthorizeResult.ALLOW) {
+      clustersWithFullAccess.add(clusterIdentifier);
+    } else {
+      clustersWithoutFullAccess.push(i);
+    }
+  }
+  const authorizedClusterProjects = [];
+  const clustersGrantedViaProjects = /* @__PURE__ */ new Set();
+  if (clustersWithoutFullAccess.length > 0 && allProjects.length > 0) {
+    const numProjectChecks = clustersWithoutFullAccess.length * allProjects.length;
+    const projectPermissionRequests = new Array(
+      numProjectChecks
+    );
+    const projectPermissionMap = new Array(
+      numProjectChecks
+    );
+    let idx = 0;
+    for (const clusterIdx of clustersWithoutFullAccess) {
+      const clusterName = allClusterNames[clusterIdx];
+      const clusterId = allClusterIds[clusterIdx];
+      const clusterIdentifier = permissionType === "cost" ? clusterName : clusterId;
+      for (let j = 0; j < allProjects.length; j++) {
+        const projectName = allProjects[j];
+        const perm = getClusterProjectPermission(clusterName, projectName);
+        projectPermissionRequests[idx] = {
+          permission: perm
+        };
+        projectPermissionMap[idx] = {
+          cluster: clusterIdentifier,
+          project: projectName
+        };
+        idx++;
+      }
+    }
+    const projectDecisions = await permissionsSvc.authorize(
+      projectPermissionRequests,
+      { credentials }
+    );
+    for (let i = 0; i < projectDecisions.length; i++) {
+      const decision = projectDecisions[i].result;
+      if (decision === pluginPermissionCommon.AuthorizeResult.ALLOW) {
+        const result = projectPermissionMap[i];
+        authorizedClusterProjects.push(result);
+        clustersGrantedViaProjects.add(result.cluster);
+      }
+    }
+  }
+  const authorizedClusterIds = [
+    ...clustersWithFullAccess,
+    ...clustersGrantedViaProjects
+  ];
+  return {
+    authorizedClusterIds,
+    authorizedClusterProjects
+  };
+};
+
+exports.authorize = authorize;
+exports.filterAuthorizedClustersAndProjects = filterAuthorizedClustersAndProjects;
+//# sourceMappingURL=checkPermissions.cjs.js.map

package/dist/util/checkPermissions.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkPermissions.cjs.js","sources":["../../src/util/checkPermissions.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Request as HttpRequest } from 'express-serve-static-core';\nimport {\n  AuthorizePermissionRequest,\n  AuthorizePermissionResponse,\n  AuthorizeResult,\n  BasicPermission,\n} from '@backstage/plugin-permission-common';\nimport {\n  PermissionsService,\n  HttpAuthService,\n} from '@backstage/backend-plugin-api';\nimport {\n  rosClusterProjectPermission,\n  rosClusterSpecificPermission,\n  costClusterSpecificPermission,\n  costClusterProjectPermission,\n} from '@red-hat-developer-hub/plugin-cost-management-common/permissions';\n\n/** Permission type for cluster-level access */\nexport type ClusterPermissionType = 'ros' | 'cost';\n\nexport interface ClusterProjectResult {\n  cluster: string;\n  project: string;\n}\n\nexport interface CombinedAuthorizationResult {\n  /** Clusters authorized via cluster-only permissions (all projects allowed) */\n  authorizedClusterIds: string[];\n  /** Specific cluster-project combinations authorized */\n  authorizedClusterProjects: ClusterProjectResult[];\n}\n\n/**\n * Checks if the user has ANY of the given permissions (OR logic).\n * Optimized to use a single batch authorization call instead of multiple parallel calls.\n *\n * @param request - The HTTP request\n * @param anyOfPermissions - Array of permissions to check (user needs at least one)\n * @param permissionsSvc - The permissions service\n * @param httpAuth - The HTTP auth service\n * @returns Authorization response with ALLOW if any permission is granted, DENY otherwise\n */\nexport const authorize = async (\n  request: HttpRequest,\n  anyOfPermissions: BasicPermission[],\n  permissionsSvc: PermissionsService,\n  httpAuth: HttpAuthService,\n): Promise<AuthorizePermissionResponse> => {\n  const credentials = await httpAuth.credentials(request);\n\n  // Single batch call for all permissions\n  const permissionRequests = anyOfPermissions.map(permission => ({\n    permission,\n  }));\n  const decisions = await permissionsSvc.authorize(permissionRequests, {\n    credentials,\n  });\n\n  // Return ALLOW if any permission is granted\n  const allow = decisions.find(d => d.result === AuthorizeResult.ALLOW);\n  return (\n    allow || {\n      result: AuthorizeResult.DENY,\n    }\n  );\n};\n\n/**\n * Combines cluster-only and cluster-project permission checks into a single optimized flow.\n * Uses permission hierarchy where project-level access also grants cluster access.\n *\n * Permission Hierarchy:\n * - cost/{cluster} → grants access to cluster + ALL projects in that cluster\n * - cost/{cluster}/{project} → grants access to cluster + that specific project\n *\n * @param request - The HTTP request\n * @param permissionsSvc - The permissions service\n * @param httpAuth - The HTTP auth service\n * @param clusterDataMap - Map of clusterName → clusterId\n * @param allProjects - Array of all project names\n * @param permissionType - 'ros' or 'cost' permission namespace (defaults to 'ros')\n * @returns Object containing both cluster-level and project-level authorizations\n */\nexport const filterAuthorizedClustersAndProjects = async (\n  request: HttpRequest,\n  permissionsSvc: PermissionsService,\n  httpAuth: HttpAuthService,\n  clusterDataMap: Record<string, string>,\n  allProjects: string[],\n  permissionType: ClusterPermissionType = 'ros',\n): Promise<CombinedAuthorizationResult> => {\n  const credentials = await httpAuth.credentials(request);\n  const allClusterNames: string[] = Object.keys(clusterDataMap);\n  const allClusterIds: string[] = Object.values(clusterDataMap);\n\n  // Early exit if no data\n  if (allClusterNames.length === 0) {\n    return {\n      authorizedClusterIds: [],\n      authorizedClusterProjects: [],\n    };\n  }\n\n  // Select appropriate permission functions based on type\n  const getClusterPermission =\n    permissionType === 'cost'\n      ? costClusterSpecificPermission\n      : rosClusterSpecificPermission;\n\n  const getClusterProjectPermission =\n    permissionType === 'cost'\n      ? costClusterProjectPermission\n      : rosClusterProjectPermission;\n\n  const numClusters = allClusterNames.length;\n\n  // Step 1: Check cluster-level permissions first\n  const clusterPermissionRequests: AuthorizePermissionRequest[] =\n    allClusterNames.map(clusterName => {\n      const perm = getClusterPermission(clusterName);\n      return { permission: perm };\n    });\n\n  const clusterDecisions = await permissionsSvc.authorize(\n    clusterPermissionRequests,\n    {\n      credentials,\n    },\n  );\n\n  // Track clusters with and without full access\n  const clustersWithFullAccess = new Set<string>();\n  const clustersWithoutFullAccess: number[] = [];\n\n  for (let i = 0; i < numClusters; i++) {\n    const clusterName = allClusterNames[i];\n    const clusterId = allClusterIds[i];\n    const clusterIdentifier =\n      permissionType === 'cost' ? clusterName : clusterId;\n    const decision = clusterDecisions[i].result;\n\n    if (decision === AuthorizeResult.ALLOW) {\n      // User has full cluster access\n      clustersWithFullAccess.add(clusterIdentifier);\n    } else {\n      // No cluster access - will need to check project-level permissions\n      clustersWithoutFullAccess.push(i);\n    }\n  }\n\n  // Step 2: Check project-level permissions only for clusters without full access\n  const authorizedClusterProjects: ClusterProjectResult[] = [];\n  const clustersGrantedViaProjects = new Set<string>();\n\n  if (clustersWithoutFullAccess.length > 0 && allProjects.length > 0) {\n    const numProjectChecks =\n      clustersWithoutFullAccess.length * allProjects.length;\n    const projectPermissionRequests: AuthorizePermissionRequest[] = new Array(\n      numProjectChecks,\n    );\n    const projectPermissionMap: ClusterProjectResult[] = new Array(\n      numProjectChecks,\n    );\n\n    // Build requests only for clusters that don't have full access\n    let idx = 0;\n    for (const clusterIdx of clustersWithoutFullAccess) {\n      const clusterName = allClusterNames[clusterIdx];\n      const clusterId = allClusterIds[clusterIdx];\n      const clusterIdentifier =\n        permissionType === 'cost' ? clusterName : clusterId;\n\n      for (let j = 0; j < allProjects.length; j++) {\n        const projectName = allProjects[j];\n        const perm = getClusterProjectPermission(clusterName, projectName);\n\n        projectPermissionRequests[idx] = {\n          permission: perm,\n        };\n\n        projectPermissionMap[idx] = {\n          cluster: clusterIdentifier,\n          project: projectName,\n        };\n\n        idx++;\n      }\n    }\n\n    // Batch check project-level permissions\n    const projectDecisions = await permissionsSvc.authorize(\n      projectPermissionRequests,\n      { credentials },\n    );\n\n    // Process project-level results\n    for (let i = 0; i < projectDecisions.length; i++) {\n      const decision = projectDecisions[i].result;\n\n      if (decision === AuthorizeResult.ALLOW) {\n        const result = projectPermissionMap[i];\n        authorizedClusterProjects.push(result);\n        // Project-level permission also grants cluster access\n        clustersGrantedViaProjects.add(result.cluster);\n      }\n    }\n  }\n\n  // Step 3: Combine clusters from both full access and project-level grants\n  const authorizedClusterIds = [\n    ...clustersWithFullAccess,\n    ...clustersGrantedViaProjects,\n  ];\n\n  return {\n    authorizedClusterIds,\n    authorizedClusterProjects,\n  };\n};\n"],"names":["AuthorizeResult","costClusterSpecificPermission","rosClusterSpecificPermission","costClusterProjectPermission","rosClusterProjectPermission"],"mappings":";;;;;AA2DO,MAAM,SAAY,GAAA,OACvB,OACA,EAAA,gBAAA,EACA,gBACA,QACyC,KAAA;AACzC,EAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAO,CAAA;AAGtD,EAAM,MAAA,kBAAA,GAAqB,gBAAiB,CAAA,GAAA,CAAI,CAAe,UAAA,MAAA;AAAA,IAC7D;AAAA,GACA,CAAA,CAAA;AACF,EAAA,MAAM,SAAY,GAAA,MAAM,cAAe,CAAA,SAAA,CAAU,kBAAoB,EAAA;AAAA,IACnE;AAAA,GACD,CAAA;AAGD,EAAA,MAAM,QAAQ,SAAU,CAAA,IAAA,CAAK,OAAK,CAAE,CAAA,MAAA,KAAWA,uCAAgB,KAAK,CAAA;AACpE,EAAA,OACE,KAAS,IAAA;AAAA,IACP,QAAQA,sCAAgB,CAAA;AAAA,GAC1B;AAEJ;AAkBa,MAAA,mCAAA,GAAsC,OACjD,OACA,EAAA,cAAA,EACA,UACA,cACA,EAAA,WAAA,EACA,iBAAwC,KACC,KAAA;AACzC,EAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAO,CAAA;AACtD,EAAM,MAAA,eAAA,GAA4B,MAAO,CAAA,IAAA,CAAK,cAAc,CAAA;AAC5D,EAAM,MAAA,aAAA,GAA0B,MAAO,CAAA,MAAA,CAAO,cAAc,CAAA;AAG5D,EAAI,IAAA,eAAA,CAAgB,WAAW,CAAG,EAAA;AAChC,IAAO,OAAA;AAAA,MACL,sBAAsB,EAAC;AAAA,MACvB,2BAA2B;AAAC,KAC9B;AAAA;AAIF,EAAM,MAAA,oBAAA,GACJ,cAAmB,KAAA,MAAA,GACfC,yCACA,GAAAC,wCAAA;AAEN,EAAM,MAAA,2BAAA,GACJ,cAAmB,KAAA,MAAA,GACfC,wCACA,GAAAC,uCAAA;AAEN,EAAA,MAAM,cAAc,eAAgB,CAAA,MAAA;AAGpC,EAAM,MAAA,yBAAA,GACJ,eAAgB,CAAA,GAAA,CAAI,CAAe,WAAA,KAAA;AACjC,IAAM,MAAA,IAAA,GAAO,qBAAqB,WAAW,CAAA;AAC7C,IAAO,OAAA,EAAE,YAAY,IAAK,EAAA;AAAA,GAC3B,CAAA;AAEH,EAAM,MAAA,gBAAA,GAAmB,MAAM,cAAe,CAAA,SAAA;AAAA,IAC5C,yBAAA;AAAA,IACA;AAAA,MACE;AAAA;AACF,GACF;AAGA,EAAM,MAAA,sBAAA,uBAA6B,GAAY,EAAA;AAC/C,EAAA,MAAM,4BAAsC,EAAC;AAE7C,EAAA,KAAA,IAAS,CAAI,GAAA,CAAA,EAAG,CAAI,GAAA,WAAA,EAAa,CAAK,EAAA,EAAA;AACpC,IAAM,MAAA,WAAA,GAAc,gBAAgB,CAAC,CAAA;AACrC,IAAM,MAAA,SAAA,GAAY,cAAc,CAAC,CAAA;AACjC,IAAM,MAAA,iBAAA,GACJ,cAAmB,KAAA,MAAA,GAAS,WAAc,GAAA,SAAA;AAC5C,IAAM,MAAA,QAAA,GAAW,gBAAiB,CAAA,CAAC,CAAE,CAAA,MAAA;AAErC,IAAI,IAAA,QAAA,KAAaJ,uCAAgB,KAAO,EAAA;AAEtC,MAAA,sBAAA,CAAuB,IAAI,iBAAiB,CAAA;AAAA,KACvC,MAAA;AAEL,MAAA,yBAAA,CAA0B,KAAK,CAAC,CAAA;AAAA;AAClC;AAIF,EAAA,MAAM,4BAAoD,EAAC;AAC3D,EAAM,MAAA,0BAAA,uBAAiC,GAAY,EAAA;AAEnD,EAAA,IAAI,yBAA0B,CAAA,MAAA,GAAS,CAAK,IAAA,WAAA,CAAY,SAAS,CAAG,EAAA;AAClE,IAAM,MAAA,gBAAA,GACJ,yBAA0B,CAAA,MAAA,GAAS,WAAY,CAAA,MAAA;AACjD,IAAA,MAAM,4BAA0D,IAAI,KAAA;AAAA,MAClE;AAAA,KACF;AACA,IAAA,MAAM,uBAA+C,IAAI,KAAA;AAAA,MACvD;AAAA,KACF;AAGA,IAAA,IAAI,GAAM,GAAA,CAAA;AACV,IAAA,KAAA,MAAW,cAAc,yBAA2B,EAAA;AAClD,MAAM,MAAA,WAAA,GAAc,gBAAgB,UAAU,CAAA;AAC9C,MAAM,MAAA,SAAA,GAAY,cAAc,UAAU,CAAA;AAC1C,MAAM,MAAA,iBAAA,GACJ,cAAmB,KAAA,MAAA,GAAS,WAAc,GAAA,SAAA;AAE5C,MAAA,KAAA,IAAS,CAAI,GAAA,CAAA,EAAG,CAAI,GAAA,WAAA,CAAY,QAAQ,CAAK,EAAA,EAAA;AAC3C,QAAM,MAAA,WAAA,GAAc,YAAY,CAAC,CAAA;AACjC,QAAM,MAAA,IAAA,GAAO,2BAA4B,CAAA,WAAA,EAAa,WAAW,CAAA;AAEjE,QAAA,yBAAA,CAA0B,GAAG,CAAI,GAAA;AAAA,UAC/B,UAAY,EAAA;AAAA,SACd;AAEA,QAAA,oBAAA,CAAqB,GAAG,CAAI,GAAA;AAAA,UAC1B,OAAS,EAAA,iBAAA;AAAA,UACT,OAAS,EAAA;AAAA,SACX;AAEA,QAAA,GAAA,EAAA;AAAA;AACF;AAIF,IAAM,MAAA,gBAAA,GAAmB,MAAM,cAAe,CAAA,SAAA;AAAA,MAC5C,yBAAA;AAAA,MACA,EAAE,WAAY;AAAA,KAChB;AAGA,IAAA,KAAA,IAAS,CAAI,GAAA,CAAA,EAAG,CAAI,GAAA,gBAAA,CAAiB,QAAQ,CAAK,EAAA,EAAA;AAChD,MAAM,MAAA,QAAA,GAAW,gBAAiB,CAAA,CAAC,CAAE,CAAA,MAAA;AAErC,MAAI,IAAA,QAAA,KAAaA,uCAAgB,KAAO,EAAA;AACtC,QAAM,MAAA,MAAA,GAAS,qBAAqB,CAAC,CAAA;AACrC,QAAA,yBAAA,CAA0B,KAAK,MAAM,CAAA;AAErC,QAA2B,0BAAA,CAAA,GAAA,CAAI,OAAO,OAAO,CAAA;AAAA;AAC/C;AACF;AAIF,EAAA,MAAM,oBAAuB,GAAA;AAAA,IAC3B,GAAG,sBAAA;AAAA,IACH,GAAG;AAAA,GACL;AAEA,EAAO,OAAA;AAAA,IACL,oBAAA;AAAA,IACA;AAAA,GACF;AACF;;;;;"}

package/dist/util/constant.cjs.js

@@ -0,0 +1,8 @@
+'use strict';
+
+const DEFAULT_SSO_BASE_URL = "https://sso.redhat.com";
+const DEFAULT_COST_MANAGEMENT_PROXY_BASE_URL = "https://console.redhat.com/api";
+
+exports.DEFAULT_COST_MANAGEMENT_PROXY_BASE_URL = DEFAULT_COST_MANAGEMENT_PROXY_BASE_URL;
+exports.DEFAULT_SSO_BASE_URL = DEFAULT_SSO_BASE_URL;
+//# sourceMappingURL=constant.cjs.js.map

package/dist/util/constant.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constant.cjs.js","sources":["../../src/util/constant.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport const DEFAULT_SSO_BASE_URL = 'https://sso.redhat.com';\n\n// Base URL without the /cost-management/v1 path since the client appends it\nexport const DEFAULT_COST_MANAGEMENT_PROXY_BASE_URL =\n  'https://console.redhat.com/api';\n"],"names":[],"mappings":";;AAgBO,MAAM,oBAAuB,GAAA;AAG7B,MAAM,sCACX,GAAA;;;;;"}

package/dist/util/tokenUtil.cjs.js

@@ -0,0 +1,76 @@
+'use strict';
+
+var assert = require('assert');
+var constant = require('./constant.cjs.js');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var assert__default = /*#__PURE__*/_interopDefaultCompat(assert);
+
+const TOKEN_CACHE_KEY = "sso_access_token";
+const getTokenFromApi = async (options) => {
+  const { logger, config, cache } = options;
+  const now = Date.now();
+  const cachedToken = await cache.get(TOKEN_CACHE_KEY);
+  if (cachedToken) {
+    const timeUntilExpiry = cachedToken.expiresAt - now;
+    const timeUntilExpirySeconds = Math.floor(timeUntilExpiry / 1e3);
+    logger.info(
+      `Cache check: Token expires in ${timeUntilExpirySeconds}s, needs >60s to be valid`
+    );
+  } else {
+    logger.info("Cache check: No cached token exists");
+  }
+  if (cachedToken && cachedToken.expiresAt > now + 6e4) {
+    logger.info("Using cached access token");
+    return cachedToken.token;
+  }
+  let accessToken = "";
+  assert__default.default(typeof config !== "undefined", "Config is undefined");
+  logger.info("Requesting new access token");
+  const ssoBaseUrl = config.getOptionalString("costManagement.ssoBaseUrl") ?? constant.DEFAULT_SSO_BASE_URL;
+  const params = {
+    tokenUrl: `${ssoBaseUrl}/auth/realms/redhat-external/protocol/openid-connect/token`,
+    clientId: config.getString("costManagement.clientId"),
+    clientSecret: config.getString("costManagement.clientSecret"),
+    scope: "api.console",
+    grantType: "client_credentials"
+  };
+  const rhSsoResponse = await fetch(params.tokenUrl, {
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(
+      Object.entries({
+        client_id: params.clientId,
+        client_secret: params.clientSecret,
+        scope: params.scope,
+        grant_type: params.grantType
+      }).map(([k, v]) => [encodeURIComponent(k), encodeURIComponent(v)])
+    ),
+    method: "POST"
+  });
+  if (rhSsoResponse.ok) {
+    const { access_token, expires_in } = await rhSsoResponse.json();
+    accessToken = access_token;
+    const expiresAt = Date.now() + expires_in * 1e3;
+    await cache.set(
+      TOKEN_CACHE_KEY,
+      {
+        token: accessToken,
+        expiresAt
+      },
+      {
+        ttl: expires_in * 1e3
+        // TTL in milliseconds
+      }
+    );
+    logger.info(`Token cached, expires in ${expires_in} seconds`);
+  } else {
+    throw new Error(rhSsoResponse.statusText);
+  }
+  return accessToken;
+};
+
+exports.getTokenFromApi = getTokenFromApi;
+//# sourceMappingURL=tokenUtil.cjs.js.map

package/dist/util/tokenUtil.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenUtil.cjs.js","sources":["../../src/util/tokenUtil.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport assert from 'assert';\nimport { RouterOptions } from '../models/RouterOptions';\nimport { DEFAULT_SSO_BASE_URL } from './constant';\n\n// Cache key for token storage\nconst TOKEN_CACHE_KEY = 'sso_access_token';\n\nexport const getTokenFromApi = async (options: RouterOptions) => {\n  const { logger, config, cache } = options;\n\n  const now = Date.now();\n\n  // Try to get cached token from cache service\n  const cachedToken = (await cache.get(TOKEN_CACHE_KEY)) as\n    | { token: string; expiresAt: number }\n    | undefined;\n\n  // Debug logging\n  if (cachedToken) {\n    const timeUntilExpiry = cachedToken.expiresAt - now;\n    const timeUntilExpirySeconds = Math.floor(timeUntilExpiry / 1000);\n    logger.info(\n      `Cache check: Token expires in ${timeUntilExpirySeconds}s, needs >60s to be valid`,\n    );\n  } else {\n    logger.info('Cache check: No cached token exists');\n  }\n\n  // Return cached token if still valid (with 60s buffer)\n  if (cachedToken && cachedToken.expiresAt > now + 60000) {\n    logger.info('Using cached access token');\n    return cachedToken.token;\n  }\n\n  let accessToken = '';\n\n  assert(typeof config !== 'undefined', 'Config is undefined');\n\n  logger.info('Requesting new access token');\n\n  const ssoBaseUrl =\n    config.getOptionalString('costManagement.ssoBaseUrl') ??\n    DEFAULT_SSO_BASE_URL;\n  const params = {\n    tokenUrl: `${ssoBaseUrl}/auth/realms/redhat-external/protocol/openid-connect/token`,\n    clientId: config.getString('costManagement.clientId'),\n    clientSecret: config.getString('costManagement.clientSecret'),\n    scope: 'api.console',\n    grantType: 'client_credentials',\n  } as const;\n\n  const rhSsoResponse = await fetch(params.tokenUrl, {\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams(\n      Object.entries({\n        client_id: params.clientId,\n        client_secret: params.clientSecret,\n        scope: params.scope,\n        grant_type: params.grantType,\n      }).map(([k, v]) => [encodeURIComponent(k), encodeURIComponent(v)]),\n    ),\n    method: 'POST',\n  });\n\n  if (rhSsoResponse.ok) {\n    const { access_token, expires_in } = await rhSsoResponse.json();\n    accessToken = access_token;\n\n    const expiresAt = Date.now() + expires_in * 1000;\n\n    // Cache token with expiry using cache service\n    await cache.set(\n      TOKEN_CACHE_KEY,\n      {\n        token: accessToken,\n        expiresAt,\n      },\n      {\n        ttl: expires_in * 1000, // TTL in milliseconds\n      },\n    );\n\n    logger.info(`Token cached, expires in ${expires_in} seconds`);\n  } else {\n    throw new Error(rhSsoResponse.statusText);\n  }\n\n  return accessToken;\n};\n"],"names":["assert","DEFAULT_SSO_BASE_URL"],"mappings":";;;;;;;;;AAqBA,MAAM,eAAkB,GAAA,kBAAA;AAEX,MAAA,eAAA,GAAkB,OAAO,OAA2B,KAAA;AAC/D,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAQ,EAAA,KAAA,EAAU,GAAA,OAAA;AAElC,EAAM,MAAA,GAAA,GAAM,KAAK,GAAI,EAAA;AAGrB,EAAA,MAAM,WAAe,GAAA,MAAM,KAAM,CAAA,GAAA,CAAI,eAAe,CAAA;AAKpD,EAAA,IAAI,WAAa,EAAA;AACf,IAAM,MAAA,eAAA,GAAkB,YAAY,SAAY,GAAA,GAAA;AAChD,IAAA,MAAM,sBAAyB,GAAA,IAAA,CAAK,KAAM,CAAA,eAAA,GAAkB,GAAI,CAAA;AAChE,IAAO,MAAA,CAAA,IAAA;AAAA,MACL,iCAAiC,sBAAsB,CAAA,yBAAA;AAAA,KACzD;AAAA,GACK,MAAA;AACL,IAAA,MAAA,CAAO,KAAK,qCAAqC,CAAA;AAAA;AAInD,EAAA,IAAI,WAAe,IAAA,WAAA,CAAY,SAAY,GAAA,GAAA,GAAM,GAAO,EAAA;AACtD,IAAA,MAAA,CAAO,KAAK,2BAA2B,CAAA;AACvC,IAAA,OAAO,WAAY,CAAA,KAAA;AAAA;AAGrB,EAAA,IAAI,WAAc,GAAA,EAAA;AAElB,EAAOA,uBAAA,CAAA,OAAO,MAAW,KAAA,WAAA,EAAa,qBAAqB,CAAA;AAE3D,EAAA,MAAA,CAAO,KAAK,6BAA6B,CAAA;AAEzC,EAAA,MAAM,UACJ,GAAA,MAAA,CAAO,iBAAkB,CAAA,2BAA2B,CACpD,IAAAC,6BAAA;AACF,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,QAAA,EAAU,GAAG,UAAU,CAAA,0DAAA,CAAA;AAAA,IACvB,QAAA,EAAU,MAAO,CAAA,SAAA,CAAU,yBAAyB,CAAA;AAAA,IACpD,YAAA,EAAc,MAAO,CAAA,SAAA,CAAU,6BAA6B,CAAA;AAAA,IAC5D,KAAO,EAAA,aAAA;AAAA,IACP,SAAW,EAAA;AAAA,GACb;AAEA,EAAA,MAAM,aAAgB,GAAA,MAAM,KAAM,CAAA,MAAA,CAAO,QAAU,EAAA;AAAA,IACjD,OAAS,EAAA;AAAA,MACP,cAAgB,EAAA;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA;AAAA,MACR,OAAO,OAAQ,CAAA;AAAA,QACb,WAAW,MAAO,CAAA,QAAA;AAAA,QAClB,eAAe,MAAO,CAAA,YAAA;AAAA,QACtB,OAAO,MAAO,CAAA,KAAA;AAAA,QACd,YAAY,MAAO,CAAA;AAAA,OACpB,CAAA,CAAE,GAAI,CAAA,CAAC,CAAC,CAAG,EAAA,CAAC,CAAM,KAAA,CAAC,mBAAmB,CAAC,CAAA,EAAG,kBAAmB,CAAA,CAAC,CAAC,CAAC;AAAA,KACnE;AAAA,IACA,MAAQ,EAAA;AAAA,GACT,CAAA;AAED,EAAA,IAAI,cAAc,EAAI,EAAA;AACpB,IAAA,MAAM,EAAE,YAAc,EAAA,UAAA,EAAe,GAAA,MAAM,cAAc,IAAK,EAAA;AAC9D,IAAc,WAAA,GAAA,YAAA;AAEd,IAAA,MAAM,SAAY,GAAA,IAAA,CAAK,GAAI,EAAA,GAAI,UAAa,GAAA,GAAA;AAG5C,IAAA,MAAM,KAAM,CAAA,GAAA;AAAA,MACV,eAAA;AAAA,MACA;AAAA,QACE,KAAO,EAAA,WAAA;AAAA,QACP;AAAA,OACF;AAAA,MACA;AAAA,QACE,KAAK,UAAa,GAAA;AAAA;AAAA;AACpB,KACF;AAEA,IAAO,MAAA,CAAA,IAAA,CAAK,CAA4B,yBAAA,EAAA,UAAU,CAAU,QAAA,CAAA,CAAA;AAAA,GACvD,MAAA;AACL,IAAM,MAAA,IAAI,KAAM,CAAA,aAAA,CAAc,UAAU,CAAA;AAAA;AAG1C,EAAO,OAAA,WAAA;AACT;;;;"}

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@red-hat-developer-hub/plugin-cost-management-backend",
+  "version": "2.0.2",
+  "backstage": {
+    "pluginId": "cost-management",
+    "pluginPackages": [
+      "@red-hat-developer-hub/plugin-cost-management",
+      "@red-hat-developer-hub/plugin-cost-management-backend",
+      "@red-hat-developer-hub/plugin-cost-management-common"
+    ],
+    "role": "backend-plugin"
+  },
+  "configSchema": "config.d.ts",
+  "dependencies": {
+    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-dynamic-feature-service": "^0.5.3",
+    "@backstage/backend-plugin-api": "^1.1.1",
+    "@backstage/config": "^1.3.2",
+    "@backstage/plugin-permission-common": "^0.8.4",
+    "@backstage/plugin-permission-node": "^0.8.7",
+    "@red-hat-developer-hub/plugin-cost-management-common": "^2.0.1",
+    "@types/express": "4.17.25",
+    "express": "^4.17.1",
+    "express-promise-router": "^4.1.0",
+    "lodash": "4.17.23",
+    "node-fetch": "^2.6.7",
+    "winston": "^3.2.1",
+    "yn": "^4.0.0"
+  },
+  "devDependencies": {
+    "@backstage/backend-test-utils": "^1.2.1",
+    "@backstage/cli": "^0.29.4",
+    "@backstage/plugin-auth-backend": "^0.24.2",
+    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.4",
+    "@backstage/plugin-proxy-backend": "^0.5.10",
+    "@types/lodash": "4.17.24",
+    "@types/supertest": "^6.0.0",
+    "msw": "^1.0.0",
+    "supertest": "^7.0.0"
+  },
+  "exports": {
+    ".": {
+      "backstage": "@backstage/BackendFeature",
+      "require": "./dist/index.cjs.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.cjs.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "app-config.dynamic.yaml",
+    "dist",
+    "config.d.ts"
+  ],
+  "license": "Apache-2.0",
+  "main": "./dist/index.cjs.js",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "directory": "workspaces/cost-management/plugins/cost-management-backend",
+    "type": "git",
+    "url": "https://github.com/redhat-developer/rhdh-plugins"
+  },
+  "scripts": {
+    "build": "backstage-cli package build",
+    "clean": "backstage-cli package clean",
+    "lint": "backstage-cli package lint",
+    "postpack": "backstage-cli package postpack",
+    "prepack": "backstage-cli package prepack",
+    "start": "backstage-cli package start",
+    "test": "backstage-cli package test"
+  },
+  "types": "./dist/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "index": [
+        "dist/index.d.ts"
+      ]
+    }
+  }
+}