@stackgenhq/backstage-plugin-stackgen-backend 0.3.6-beta.1

package/dist/index.d.ts

@@ -0,0 +1,224 @@
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+import { LoggerService } from '@backstage/backend-plugin-api';
+import * as _backstage_plugin_scaffolder_node from '@backstage/plugin-scaffolder-node';
+import { Config } from '@backstage/config';
+
+/**
+ * stackgenPlugin backend plugin
+ *
+ * @public
+ */
+declare const stackGenPlugin: _backstage_backend_plugin_api.BackendFeature;
+
+declare const createAppStackAction: (config: Config, logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    appstack: {
+        resources: {
+            name?: string | undefined;
+            id?: string | undefined;
+            resourceType?: string | undefined;
+            iacType?: "Helm" | "Terraform" | undefined;
+            configuration?: Record<string, any> | undefined;
+            tfVars?: Record<string, string> | undefined;
+            resourceTemplateVersionName?: string | undefined;
+            resourcePackId?: string | undefined;
+            templateId?: string | undefined;
+            children?: any[] | undefined;
+            baseId?: string | undefined;
+            label?: string | undefined;
+            versionName?: string | undefined;
+            moduleName?: string | undefined;
+        }[];
+        teamId: string;
+        name?: string | undefined;
+        cloudProvider?: string | undefined;
+        appstackName?: string | undefined;
+        templateAppstackId?: string | undefined;
+    };
+}, {
+    appstackName: string;
+    appstackId: string;
+    appStackURL: string;
+    topologyId?: string | undefined;
+}, "v2">;
+
+declare const createProjectAction: (config: Config, logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    project: {
+        name: string;
+        description: string;
+        gitConfig?: {
+            default?: boolean | undefined;
+            type?: string | undefined;
+            name?: string | undefined;
+            parameters?: {
+                path?: string | undefined;
+                scmType?: "GITHUB" | "GITLAB" | "BITBUCKET" | "AZUREDEV" | undefined;
+                repoUrl?: string | undefined;
+                targetBranch?: string | undefined;
+            } | undefined;
+            vaultReference?: string | undefined;
+        } | undefined;
+        environmentConfig?: {
+            name?: string | undefined;
+            environmentTemplates?: {
+                name?: string | undefined;
+                color?: string | undefined;
+                stateBackendTemplate?: {
+                    type?: "S3" | "GCS" | "AZURERM" | "LOCAL" | "POSTGRES" | "REMOTE" | "CLOUD" | undefined;
+                    configJson?: string | undefined;
+                    hcl?: string | undefined;
+                    editorMode?: boolean | undefined;
+                } | undefined;
+            }[] | undefined;
+            variables?: {
+                type?: string | undefined;
+                name?: string | undefined;
+                defaultValueJson?: string | undefined;
+                description?: string | undefined;
+            }[] | undefined;
+            variableOverrides?: {
+                variableName?: string | undefined;
+                environmentTemplateName?: string | undefined;
+                valueJson?: string | undefined;
+            }[] | undefined;
+        } | undefined;
+    };
+}, {
+    teamId: string;
+    projectId: string;
+    projectName: string;
+    alreadyExisted: boolean;
+    projectURL: string;
+}, "v2">;
+
+declare const downloadIaCAction: (config: Config, logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    teamId: string;
+    extractedIaCPath: string;
+    appstackName?: string | undefined;
+    appstackId?: string | undefined;
+    topologyId?: string | undefined;
+}, {
+    extractedIacPath: string;
+}, "v2">;
+
+declare const setStateBackendAction: (config: Config, logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    color: string;
+    variables: {
+        type: string;
+        name: string;
+        defaultValueJson?: string | undefined;
+        description?: string | undefined;
+    }[];
+    teamId: string;
+    environmentName: string;
+    variableValues: {
+        value: string;
+        name: string;
+    }[];
+    stateBackend: {
+        type: "S3" | "GCS" | "AZURERM" | "LOCAL" | "POSTGRES" | "REMOTE" | "CLOUD";
+        config: Record<string, string>;
+    };
+    appstackName?: string | undefined;
+    topologyId?: string | undefined;
+}, {
+    success: boolean;
+    environmentId?: string | undefined;
+}, "v2">;
+
+/**
+ * Assigns users and/or groups from UserGroupSelect to a StackGen project.
+ * Uses the same OrgManagement APIs as appcd-ui project membership.
+ */
+declare const assignProjectMembersAction: (config: Config, logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    projectId: string;
+    members: {
+        type: "user" | "group";
+        id: string;
+        label?: string | undefined;
+    }[];
+    roleId?: string | undefined;
+}, {
+    assignedUsers: number;
+    assignedGroups: number;
+    assignedUsersText: string;
+    assignedGroupsText: string;
+    roleId?: string | undefined;
+}, "v2">;
+
+/**
+ * Applies VariableSelect values onto an existing environment profile
+ * (consumption / override), matching appcd-ui TF env value updates.
+ */
+declare const setEnvironmentVariableValuesAction: (config: Config, logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    teamId: string;
+    variableValues: {
+        value: string;
+        name: string;
+    }[];
+    environmentId: string;
+    appstackName?: string | undefined;
+    topologyId?: string | undefined;
+}, {
+    topologyId: string;
+    environmentId: string;
+    updatedCount: number;
+    updatedVariablesText: string;
+}, "v2">;
+
+declare const exportAppStackToGitAction: (config: Config, _logger: LoggerService) => _backstage_plugin_scaffolder_node.TemplateAction<{
+    appstackName: string;
+    teamId: string;
+    appstackId?: string | undefined;
+    gitConfig?: {
+        parameters: {
+            scmType: string;
+            repoUrl: string;
+            path?: string | undefined;
+            targetBranch?: string | undefined;
+        };
+        vaultReference: string;
+        default?: boolean | undefined;
+        type?: string | undefined;
+        name?: string | undefined;
+    } | undefined;
+    topologyId?: string | undefined;
+    configId?: string | undefined;
+    baseBranch?: string | undefined;
+    pushBranch?: string | undefined;
+    useSameBranch?: boolean | undefined;
+    createPr?: boolean | undefined;
+    overrides?: {
+        value: string;
+        key: string;
+    }[] | undefined;
+}, {
+    pullRequestUrl?: string | undefined;
+    externalLink?: string | undefined;
+    committedBranch?: string | undefined;
+    notes?: string | undefined;
+}, "v2">;
+
+declare function listVaultSecretsAction(config: Config, _logger: LoggerService): _backstage_plugin_scaffolder_node.TemplateAction<{
+    name?: string | undefined;
+    orgId?: string | undefined;
+    category?: string | undefined;
+    subcategory?: string | undefined;
+}, {
+    secretsJson: string;
+}, "v2">;
+
+/**
+ * Proxies StackGen HTTP APIs used by scaffolder custom fields
+ * (`/vault-secrets`, `/environment-profiles`, `/users`, `/user-groups`,
+ * `/modules`, `/variables`, `/exporter-git-configs`, `/export-history`).
+ * Mounted on the stackgen backend plugin HTTP router.
+ */
+declare const stackgenUiProxiesModule: _backstage_backend_plugin_api.BackendFeature;
+
+/**
+ * Registers stack-exporter git export (`stackGen:exportToGit`) and vault listing (`stackGen:listVaultSecrets`).
+ * Add with `backend.add(stackgenExporterScaffolderModule)` alongside the main stackgen plugin.
+ */
+declare const stackgenExporterScaffolderModule: _backstage_backend_plugin_api.BackendFeature;
+
+export { assignProjectMembersAction, createAppStackAction, createProjectAction, stackGenPlugin as default, downloadIaCAction, exportAppStackToGitAction, listVaultSecretsAction, setEnvironmentVariableValuesAction, setStateBackendAction, stackgenExporterScaffolderModule, stackgenUiProxiesModule, stackgenUiProxiesModule as stackgenVaultSecretsModule };

package/dist/lib/extractArchive.cjs.js

@@ -0,0 +1,62 @@
+'use strict';
+
+var path = require('path');
+var fs = require('fs/promises');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var path__default = /*#__PURE__*/_interopDefaultCompat(path);
+var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
+
+function isPathInsideRoot(root, candidate) {
+  const resolvedRoot = path__default.default.resolve(root);
+  const resolvedCandidate = path__default.default.resolve(candidate);
+  const relative = path__default.default.relative(resolvedRoot, resolvedCandidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path__default.default.sep}`) && !path__default.default.isAbsolute(relative);
+}
+async function assertExtractedTreeStaysInside(destination) {
+  const root = path__default.default.resolve(destination);
+  const stack = [root];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    const entries = await fs__default.default.readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const entryPath = path__default.default.join(current, entry.name);
+      if (!isPathInsideRoot(root, entryPath)) {
+        throw new Error(
+          `Refusing extracted path outside destination: ${entryPath}`
+        );
+      }
+      if (entry.isSymbolicLink()) {
+        const linkTarget = await fs__default.default.readlink(entryPath);
+        const resolvedTarget = path__default.default.resolve(
+          path__default.default.dirname(entryPath),
+          linkTarget
+        );
+        if (!isPathInsideRoot(root, resolvedTarget)) {
+          throw new Error(
+            `Refusing extracted symlink escaping destination: ${entryPath} -> ${linkTarget}`
+          );
+        }
+        continue;
+      }
+      if (entry.isDirectory()) {
+        stack.push(entryPath);
+      }
+    }
+  }
+}
+async function extractArchiveToDir(archivePath, destination) {
+  const { default: decompress } = await import('@xhmikosr/decompress');
+  await decompress(archivePath, destination);
+  await assertExtractedTreeStaysInside(destination);
+  const files = await fs__default.default.readdir(destination);
+  if (files.length === 0) {
+    throw new Error(`No files found in ${destination} after decompression`);
+  }
+}
+
+exports.assertExtractedTreeStaysInside = assertExtractedTreeStaysInside;
+exports.extractArchiveToDir = extractArchiveToDir;
+exports.isPathInsideRoot = isPathInsideRoot;
+//# sourceMappingURL=extractArchive.cjs.js.map

package/dist/lib/extractArchive.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractArchive.cjs.js","sources":["../../src/lib/extractArchive.ts"],"sourcesContent":["import path from 'path';\nimport fs from 'fs/promises';\n\n/**\n * Returns true when `candidate` resolves inside `root` (inclusive).\n * Used as defense-in-depth after archive extraction so Zip Slip escapes\n * cannot land outside the scaffolder workspace destination.\n */\nexport function isPathInsideRoot(root: string, candidate: string): boolean {\n  const resolvedRoot = path.resolve(root);\n  const resolvedCandidate = path.resolve(candidate);\n  const relative = path.relative(resolvedRoot, resolvedCandidate);\n  return (\n    relative === '' ||\n    (relative !== '..' &&\n      !relative.startsWith(`..${path.sep}`) &&\n      !path.isAbsolute(relative))\n  );\n}\n\n/**\n * Walks `destination` and rejects entries whose real path escapes the root,\n * or whose symlink target resolves outside the root.\n * Without this check, a compromised archive library (or a future regression)\n * could write outside the intended extract directory during downloadIaC.\n */\nexport async function assertExtractedTreeStaysInside(\n  destination: string,\n): Promise<void> {\n  const root = path.resolve(destination);\n  const stack = [root];\n\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    const entries = await fs.readdir(current, { withFileTypes: true });\n\n    for (const entry of entries) {\n      const entryPath = path.join(current, entry.name);\n      if (!isPathInsideRoot(root, entryPath)) {\n        throw new Error(\n          `Refusing extracted path outside destination: ${entryPath}`,\n        );\n      }\n\n      if (entry.isSymbolicLink()) {\n        const linkTarget = await fs.readlink(entryPath);\n        const resolvedTarget = path.resolve(\n          path.dirname(entryPath),\n          linkTarget,\n        );\n        if (!isPathInsideRoot(root, resolvedTarget)) {\n          throw new Error(\n            `Refusing extracted symlink escaping destination: ${entryPath} -> ${linkTarget}`,\n          );\n        }\n        continue;\n      }\n\n      if (entry.isDirectory()) {\n        stack.push(entryPath);\n      }\n    }\n  }\n}\n\n/**\n * Extracts an archive into `destination` using the maintained\n * `@xhmikosr/decompress` fork (fixes CVE-2026-53486 / CVE-2026-10732).\n * Dynamic import is required because the fork is ESM-only while this\n * Backstage package publishes CommonJS.\n */\nexport async function extractArchiveToDir(\n  archivePath: string,\n  destination: string,\n): Promise<void> {\n  const { default: decompress } = await import('@xhmikosr/decompress');\n  await decompress(archivePath, destination);\n  await assertExtractedTreeStaysInside(destination);\n\n  const files = await fs.readdir(destination);\n  if (files.length === 0) {\n    throw new Error(`No files found in ${destination} after decompression`);\n  }\n}\n"],"names":["path","fs"],"mappings":";;;;;;;;;;AAQO,SAAS,gBAAA,CAAiB,MAAc,SAAA,EAA4B;AACzE,EAAA,MAAM,YAAA,GAAeA,qBAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AACtC,EAAA,MAAM,iBAAA,GAAoBA,qBAAA,CAAK,OAAA,CAAQ,SAAS,CAAA;AAChD,EAAA,MAAM,QAAA,GAAWA,qBAAA,CAAK,QAAA,CAAS,YAAA,EAAc,iBAAiB,CAAA;AAC9D,EAAA,OACE,QAAA,KAAa,EAAA,IACZ,QAAA,KAAa,IAAA,IACZ,CAAC,QAAA,CAAS,UAAA,CAAW,CAAA,EAAA,EAAKA,qBAAA,CAAK,GAAG,CAAA,CAAE,CAAA,IACpC,CAACA,qBAAA,CAAK,WAAW,QAAQ,CAAA;AAE/B;AAQA,eAAsB,+BACpB,WAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAOA,qBAAA,CAAK,OAAA,CAAQ,WAAW,CAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAI,CAAA;AAEnB,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,OAAA,GAAU,MAAM,GAAA,EAAI;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAMC,mBAAA,CAAG,OAAA,CAAQ,SAAS,EAAE,aAAA,EAAe,MAAM,CAAA;AAEjE,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,MAAM,SAAA,GAAYD,qBAAA,CAAK,IAAA,CAAK,OAAA,EAAS,MAAM,IAAI,CAAA;AAC/C,MAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,EAAM,SAAS,CAAA,EAAG;AACtC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,gDAAgD,SAAS,CAAA;AAAA,SAC3D;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,CAAM,gBAAe,EAAG;AAC1B,QAAA,MAAM,UAAA,GAAa,MAAMC,mBAAA,CAAG,QAAA,CAAS,SAAS,CAAA;AAC9C,QAAA,MAAM,iBAAiBD,qBAAA,CAAK,OAAA;AAAA,UAC1BA,qBAAA,CAAK,QAAQ,SAAS,CAAA;AAAA,UACtB;AAAA,SACF;AACA,QAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,EAAM,cAAc,CAAA,EAAG;AAC3C,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,iDAAA,EAAoD,SAAS,CAAA,IAAA,EAAO,UAAU,CAAA;AAAA,WAChF;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG;AACvB,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACF;AAQA,eAAsB,mBAAA,CACpB,aACA,WAAA,EACe;AACf,EAAA,MAAM,EAAE,OAAA,EAAS,UAAA,EAAW,GAAI,MAAM,OAAO,sBAAsB,CAAA;AACnE,EAAA,MAAM,UAAA,CAAW,aAAa,WAAW,CAAA;AACzC,EAAA,MAAM,+BAA+B,WAAW,CAAA;AAEhD,EAAA,MAAM,KAAA,GAAQ,MAAMC,mBAAA,CAAG,OAAA,CAAQ,WAAW,CAAA;AAC1C,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,WAAW,CAAA,oBAAA,CAAsB,CAAA;AAAA,EACxE;AACF;;;;;;"}

package/dist/modules/stackgenExporterScaffolderModule.cjs.js

@@ -0,0 +1,29 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var pluginScaffolderNode = require('@backstage/plugin-scaffolder-node');
+var export_iac_to_git_action = require('../actions/exporter/export_iac_to_git_action.cjs.js');
+var list_vault_secrets_action = require('../actions/exporter/list_vault_secrets_action.cjs.js');
+
+const stackgenExporterScaffolderModule = backendPluginApi.createBackendModule({
+  pluginId: "scaffolder",
+  moduleId: "stackgen-exporter-actions",
+  register(env) {
+    env.registerInit({
+      deps: {
+        scaffolder: pluginScaffolderNode.scaffolderActionsExtensionPoint,
+        config: backendPluginApi.coreServices.rootConfig,
+        logger: backendPluginApi.coreServices.logger
+      },
+      async init({ scaffolder, config, logger }) {
+        scaffolder.addActions(
+          export_iac_to_git_action.exportAppStackToGitAction(config),
+          list_vault_secrets_action.listVaultSecretsAction(config)
+        );
+      }
+    });
+  }
+});
+
+exports.stackgenExporterScaffolderModule = stackgenExporterScaffolderModule;
+//# sourceMappingURL=stackgenExporterScaffolderModule.cjs.js.map

package/dist/modules/stackgenExporterScaffolderModule.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stackgenExporterScaffolderModule.cjs.js","sources":["../../src/modules/stackgenExporterScaffolderModule.ts"],"sourcesContent":["import {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport { scaffolderActionsExtensionPoint } from '@backstage/plugin-scaffolder-node';\nimport {\n  exportAppStackToGitAction,\n  listVaultSecretsAction,\n} from '../actions/exporter';\n\n/**\n * Registers stack-exporter git export (`stackGen:exportToGit`) and vault listing (`stackGen:listVaultSecrets`).\n * Add with `backend.add(stackgenExporterScaffolderModule)` alongside the main stackgen plugin.\n */\nexport const stackgenExporterScaffolderModule = createBackendModule({\n  pluginId: 'scaffolder',\n  moduleId: 'stackgen-exporter-actions',\n  register(env) {\n    env.registerInit({\n      deps: {\n        scaffolder: scaffolderActionsExtensionPoint,\n        config: coreServices.rootConfig,\n        logger: coreServices.logger,\n      },\n      async init({ scaffolder, config, logger }) {\n        scaffolder.addActions(\n          exportAppStackToGitAction(config, logger),\n          listVaultSecretsAction(config, logger),\n        );\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","scaffolderActionsExtensionPoint","coreServices","exportAppStackToGitAction","listVaultSecretsAction"],"mappings":";;;;;;;AAcO,MAAM,mCAAmCA,oCAAA,CAAoB;AAAA,EAClE,QAAA,EAAU,YAAA;AAAA,EACV,QAAA,EAAU,2BAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,UAAA,EAAYC,oDAAA;AAAA,QACZ,QAAQC,6BAAA,CAAa,UAAA;AAAA,QACrB,QAAQA,6BAAA,CAAa;AAAA,OACvB;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,UAAA,EAAY,MAAA,EAAQ,QAAO,EAAG;AACzC,QAAA,UAAA,CAAW,UAAA;AAAA,UACTC,kDAAA,CAA0B,MAAc,CAAA;AAAA,UACxCC,gDAAA,CAAuB,MAAc;AAAA,SACvC;AAAA,MACF;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}