@techdocs/cli 1.8.12-next.3 → 1.8.12

package/dist/embedded-app/.config-schema.json

@@ -333,51 +333,6 @@
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     },
-    {
-      "path": "../../plugins/techdocs/config.d.ts",
-      "value": {
-        "type": "object",
-        "properties": {
-          "techdocs": {
-            "description": "Configuration options for the techdocs plugin",
-            "type": "object",
-            "properties": {
-              "builder": {
-                "description": "Documentation building process depends on the builder attr",
-                "visibility": "frontend",
-                "enum": [
-                  "external",
-                  "local"
-                ],
-                "type": "string"
-              },
-              "legacyUseCaseSensitiveTripletPaths": {
-                "description": "Allows fallback to case-sensitive triplets in case of migration issues.",
-                "visibility": "frontend",
-                "type": "boolean"
-              },
-              "sanitizer": {
-                "type": "object",
-                "properties": {
-                  "allowedIframeHosts": {
-                    "description": "Allows iframe tag only for listed hosts\nExample:\n allowedIframeHosts: [\"example.com\"]\n this will allow all iframes with the host `example.com` in the src attribute",
-                    "visibility": "frontend",
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "required": [
-          "techdocs"
-        ],
-        "$schema": "http://json-schema.org/draft-07/schema#"
-      }
-    },
     {
       "path": "../core-components/config.d.ts",
       "value": {
@@ -423,6 +378,51 @@
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     },
+    {
+      "path": "../../plugins/techdocs/config.d.ts",
+      "value": {
+        "type": "object",
+        "properties": {
+          "techdocs": {
+            "description": "Configuration options for the techdocs plugin",
+            "type": "object",
+            "properties": {
+              "builder": {
+                "description": "Documentation building process depends on the builder attr",
+                "visibility": "frontend",
+                "enum": [
+                  "external",
+                  "local"
+                ],
+                "type": "string"
+              },
+              "legacyUseCaseSensitiveTripletPaths": {
+                "description": "Allows fallback to case-sensitive triplets in case of migration issues.",
+                "visibility": "frontend",
+                "type": "boolean"
+              },
+              "sanitizer": {
+                "type": "object",
+                "properties": {
+                  "allowedIframeHosts": {
+                    "description": "Allows iframe tag only for listed hosts\nExample:\n allowedIframeHosts: [\"example.com\"]\n this will allow all iframes with the host `example.com` in the src attribute",
+                    "visibility": "frontend",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "required": [
+          "techdocs"
+        ],
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
     {
       "path": "../integration/config.d.ts",
       "value": {
@@ -612,6 +612,11 @@
                       "visibility": "frontend",
                       "type": "string"
                     },
+                    "gitilesBaseUrl": {
+                      "description": "The gitiles base url.",
+                      "visibility": "frontend",
+                      "type": "string"
+                    },
                     "cloneUrl": {
                       "description": "The base url for cloning repos.",
                       "visibility": "frontend",
@@ -629,6 +634,7 @@
                     }
                   },
                   "required": [
+                    "gitilesBaseUrl",
                     "host"
                   ]
                 }
@@ -1472,7 +1478,7 @@
       }
     },
     {
-      "path": "../../node_modules/@backstage-community/plugin-puppetdb/node_modules/@backstage/core-components/config.d.ts",
+      "path": "../../node_modules/@oriflame/backstage-plugin-score-card/node_modules/@backstage/core-components/config.d.ts",
       "value": {
         "type": "object",
         "properties": {
@@ -1517,43 +1523,107 @@
       }
     },
     {
-      "path": "../../node_modules/@oriflame/backstage-plugin-score-card/node_modules/@backstage/core-components/config.d.ts",
+      "path": "../integration-aws-node/config.d.ts",
       "value": {
         "type": "object",
         "properties": {
-          "auth": {
+          "aws": {
+            "description": "Configuration for access to AWS accounts",
             "type": "object",
             "properties": {
-              "autologout": {
-                "description": "Autologout feature configuration",
+              "accountDefaults": {
+                "description": "Defaults for retrieving AWS account credentials",
                 "type": "object",
                 "properties": {
-                  "enabled": {
-                    "description": "Enable or disable the autologout feature",
-                    "visibility": "frontend",
-                    "type": "boolean"
+                  "roleName": {
+                    "description": "The IAM role to assume to retrieve temporary AWS credentials",
+                    "type": "string"
                   },
-                  "idleTimeoutMinutes": {
-                    "description": "Number of minutes after which the inactive user is logged out automatically.\nDefault is 60 minutes (1 hour)",
-                    "visibility": "frontend",
-                    "type": "number"
+                  "partition": {
+                    "description": "The AWS partition of the IAM role, e.g. \"aws\", \"aws-cn\"",
+                    "type": "string"
                   },
-                  "promptBeforeIdleSeconds": {
-                    "description": "Number of seconds before the idle timeout where the user will be asked if it's still active.\nA dialog will be shown.\nDefault is 10 seconds.\nSet to 0 seconds to disable the prompt.",
-                    "visibility": "frontend",
-                    "type": "number"
+                  "region": {
+                    "description": "The STS regional endpoint to use when retrieving temporary AWS credentials, e.g. \"ap-northeast-1\"",
+                    "type": "string"
                   },
-                  "useWorkerTimers": {
-                    "description": "Enable/disable the usage of worker thread timers instead of main thread timers.\nDefault is true.\nIf you experience some browser incompatibility, you may try to set this to false.",
-                    "visibility": "frontend",
-                    "type": "boolean"
+                  "externalId": {
+                    "description": "The unique identifier needed to assume the role to retrieve temporary AWS credentials",
+                    "visibility": "secret",
+                    "type": "string"
+                  }
+                }
+              },
+              "mainAccount": {
+                "description": "Main account to use for retrieving AWS account credentials",
+                "type": "object",
+                "properties": {
+                  "accessKeyId": {
+                    "description": "The access key ID for a set of static AWS credentials",
+                    "visibility": "secret",
+                    "type": "string"
                   },
-                  "logoutIfDisconnected": {
-                    "description": "Enable/disable the automatic logout also on users that are logged in but with no Backstage tabs open.\nDefault is true.",
-                    "visibility": "frontend",
-                    "type": "boolean"
+                  "secretAccessKey": {
+                    "description": "The secret access key for a set of static AWS credentials",
+                    "visibility": "secret",
+                    "type": "string"
+                  },
+                  "profile": {
+                    "description": "The configuration profile from a credentials file at ~/.aws/credentials and\na configuration file at ~/.aws/config.",
+                    "type": "string"
+                  },
+                  "region": {
+                    "description": "The STS regional endpoint to use for the main account, e.g. \"ap-northeast-1\"",
+                    "type": "string"
                   }
                 }
+              },
+              "accounts": {
+                "description": "Configuration for retrieving AWS accounts credentials",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "accountId": {
+                      "description": "The account ID of the target account that this matches on, e.g. \"123456789012\"",
+                      "type": "string"
+                    },
+                    "accessKeyId": {
+                      "description": "The access key ID for a set of static AWS credentials",
+                      "visibility": "secret",
+                      "type": "string"
+                    },
+                    "secretAccessKey": {
+                      "description": "The secret access key for a set of static AWS credentials",
+                      "visibility": "secret",
+                      "type": "string"
+                    },
+                    "profile": {
+                      "description": "The configuration profile from a credentials file at ~/.aws/credentials and\na configuration file at ~/.aws/config.",
+                      "type": "string"
+                    },
+                    "roleName": {
+                      "description": "The IAM role to assume to retrieve temporary AWS credentials",
+                      "type": "string"
+                    },
+                    "partition": {
+                      "description": "The AWS partition of the IAM role, e.g. \"aws\", \"aws-cn\"",
+                      "type": "string"
+                    },
+                    "region": {
+                      "description": "The STS regional endpoint to use when retrieving temporary AWS credentials, e.g. \"ap-northeast-1\"",
+                      "type": "string"
+                    },
+                    "externalId": {
+                      "description": "The unique identifier needed to assume the role to retrieve temporary AWS credentials",
+                      "visibility": "secret",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "accountId"
+                  ]
+                }
               }
             }
           }
@@ -1576,6 +1646,73 @@
                     "description": "This disables the otherwise default auth policy, which requires all\nrequests to be authenticated with either user or service credentials.\n\nDisabling this check means that the backend will no longer block\nunauthenticated requests, but instead allow them to pass through to\nplugins.\n\nIf permissions are enabled, unauthenticated requests will be treated\nexactly as such, leaving it to the permission policy to determine what\npermissions should be allowed for an unauthenticated identity. Note\nthat this will also apply to service-to-service calls between plugins\nunless you configure credentials for service calls.",
                     "type": "boolean"
                   },
+                  "pluginKeyStore": {
+                    "description": "Controls how to store keys for plugin-to-plugin auth",
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "type": {
+                            "type": "string",
+                            "const": "database"
+                          }
+                        },
+                        "required": [
+                          "type"
+                        ]
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "type": {
+                            "type": "string",
+                            "const": "static"
+                          },
+                          "static": {
+                            "type": "object",
+                            "properties": {
+                              "keys": {
+                                "description": "Must be declared at least once and the first one will be used for signing.",
+                                "type": "array",
+                                "items": {
+                                  "type": "object",
+                                  "properties": {
+                                    "publicKeyFile": {
+                                      "description": "Path to the public key file in the SPKI format. Should be an absolute path.",
+                                      "type": "string"
+                                    },
+                                    "privateKeyFile": {
+                                      "description": "Path to the matching private key file in the PKCS#8 format. Should be an absolute path.\n\nThe first array entry must specify a private key file, the rest must not.",
+                                      "type": "string"
+                                    },
+                                    "keyId": {
+                                      "description": "ID to uniquely identify this key within the JWK set.",
+                                      "type": "string"
+                                    },
+                                    "algorithm": {
+                                      "description": "JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\nMust match the algorithm used to generate the keys in the provided files",
+                                      "type": "string"
+                                    }
+                                  },
+                                  "required": [
+                                    "keyId",
+                                    "publicKeyFile"
+                                  ]
+                                }
+                              }
+                            },
+                            "required": [
+                              "keys"
+                            ]
+                          }
+                        },
+                        "required": [
+                          "static",
+                          "type"
+                        ]
+                      }
+                    ]
+                  },
                   "externalAccess": {
                     "description": "Configures methods of external access, ie ways for callers outside of\nthe Backstage ecosystem to get authorized for access to APIs that do\nnot permit unauthorized access.",
                     "type": "array",
@@ -1884,568 +2021,390 @@
       }
     },
     {
-      "path": "../integration-aws-node/config.d.ts",
+      "path": "../backend-defaults/config.d.ts",
       "value": {
         "type": "object",
         "properties": {
-          "aws": {
-            "description": "Configuration for access to AWS accounts",
+          "backend": {
             "type": "object",
             "properties": {
-              "accountDefaults": {
-                "description": "Defaults for retrieving AWS account credentials",
+              "auth": {
+                "description": "Options used by the default auth, httpAuth and userInfo services.",
                 "type": "object",
                 "properties": {
-                  "roleName": {
-                    "description": "The IAM role to assume to retrieve temporary AWS credentials",
-                    "type": "string"
+                  "dangerouslyDisableDefaultAuthPolicy": {
+                    "description": "This disables the otherwise default auth policy, which requires all\nrequests to be authenticated with either user or service credentials.\n\nDisabling this check means that the backend will no longer block\nunauthenticated requests, but instead allow them to pass through to\nplugins.\n\nIf permissions are enabled, unauthenticated requests will be treated\nexactly as such, leaving it to the permission policy to determine what\npermissions should be allowed for an unauthenticated identity. Note\nthat this will also apply to service-to-service calls between plugins\nunless you configure credentials for service calls.",
+                    "type": "boolean"
                   },
-                  "partition": {
-                    "description": "The AWS partition of the IAM role, e.g. \"aws\", \"aws-cn\"",
-                    "type": "string"
-                  },
-                  "region": {
-                    "description": "The STS regional endpoint to use when retrieving temporary AWS credentials, e.g. \"ap-northeast-1\"",
-                    "type": "string"
-                  },
-                  "externalId": {
-                    "description": "The unique identifier needed to assume the role to retrieve temporary AWS credentials",
-                    "visibility": "secret",
-                    "type": "string"
-                  }
-                }
-              },
-              "mainAccount": {
-                "description": "Main account to use for retrieving AWS account credentials",
-                "type": "object",
-                "properties": {
-                  "accessKeyId": {
-                    "description": "The access key ID for a set of static AWS credentials",
-                    "visibility": "secret",
-                    "type": "string"
-                  },
-                  "secretAccessKey": {
-                    "description": "The secret access key for a set of static AWS credentials",
-                    "visibility": "secret",
-                    "type": "string"
-                  },
-                  "profile": {
-                    "description": "The configuration profile from a credentials file at ~/.aws/credentials and\na configuration file at ~/.aws/config.",
-                    "type": "string"
-                  },
-                  "region": {
-                    "description": "The STS regional endpoint to use for the main account, e.g. \"ap-northeast-1\"",
-                    "type": "string"
-                  }
-                }
-              },
-              "accounts": {
-                "description": "Configuration for retrieving AWS accounts credentials",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "accountId": {
-                      "description": "The account ID of the target account that this matches on, e.g. \"123456789012\"",
-                      "type": "string"
-                    },
-                    "accessKeyId": {
-                      "description": "The access key ID for a set of static AWS credentials",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "secretAccessKey": {
-                      "description": "The secret access key for a set of static AWS credentials",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "profile": {
-                      "description": "The configuration profile from a credentials file at ~/.aws/credentials and\na configuration file at ~/.aws/config.",
-                      "type": "string"
-                    },
-                    "roleName": {
-                      "description": "The IAM role to assume to retrieve temporary AWS credentials",
-                      "type": "string"
-                    },
-                    "partition": {
-                      "description": "The AWS partition of the IAM role, e.g. \"aws\", \"aws-cn\"",
-                      "type": "string"
-                    },
-                    "region": {
-                      "description": "The STS regional endpoint to use when retrieving temporary AWS credentials, e.g. \"ap-northeast-1\"",
-                      "type": "string"
-                    },
-                    "externalId": {
-                      "description": "The unique identifier needed to assume the role to retrieve temporary AWS credentials",
-                      "visibility": "secret",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "accountId"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "$schema": "http://json-schema.org/draft-07/schema#"
-      }
-    },
-    {
-      "path": "../../node_modules/@backstage-community/plugin-puppetdb/node_modules/@backstage/plugin-permission-common/config.d.ts",
-      "value": {
-        "type": "object",
-        "properties": {
-          "permission": {
-            "description": "Configuration options for Backstage permissions and authorization",
-            "type": "object",
-            "properties": {
-              "enabled": {
-                "description": "Whether authorization is enabled in Backstage. Defaults to false, which means authorization\nrequests will be automatically allowed without invoking the authorization policy.",
-                "visibility": "frontend",
-                "type": "boolean"
-              }
-            }
-          }
-        },
-        "$schema": "http://json-schema.org/draft-07/schema#"
-      }
-    },
-    {
-      "path": "../../node_modules/@backstage-community/plugin-puppetdb/node_modules/@backstage/integration/config.d.ts",
-      "value": {
-        "type": "object",
-        "properties": {
-          "integrations": {
-            "description": "Configuration for integrations towards various external repository provider systems",
-            "visibility": "frontend",
-            "type": "object",
-            "properties": {
-              "azure": {
-                "description": "Integration configuration for Azure",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The hostname of the given Azure instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "token": {
-                      "description": "Token used to authenticate requests.",
-                      "visibility": "secret",
-                      "deprecated": "Use `credentials` instead.",
-                      "type": "string"
-                    },
-                    "credential": {
-                      "description": "The credential to use for requests.\n\nIf no credential is specified anonymous access is used.",
-                      "deepVisibility": "secret",
-                      "deprecated": "Use `credentials` instead.",
-                      "type": "object",
-                      "properties": {
-                        "clientId": {
-                          "type": "string"
-                        },
-                        "clientSecret": {
-                          "type": "string"
-                        },
-                        "tenantId": {
-                          "type": "string"
+                  "pluginKeyStore": {
+                    "description": "Controls how to store keys for plugin-to-plugin auth",
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "type": {
+                            "type": "string",
+                            "const": "database"
+                          }
                         },
-                        "personalAccessToken": {
-                          "type": "string"
-                        }
-                      }
-                    },
-                    "credentials": {
-                      "description": "The credentials to use for requests. If multiple credentials are specified the first one that matches the organization is used.\nIf not organization matches the first credential without an organization is used.\n\nIf no credentials are specified at all, either a default credential (for Azure DevOps) or anonymous access (for Azure DevOps Server) is used.",
-                      "deepVisibility": "secret",
-                      "type": "array",
-                      "items": {
+                        "required": [
+                          "type"
+                        ]
+                      },
+                      {
                         "type": "object",
                         "properties": {
-                          "clientId": {
-                            "type": "string"
-                          },
-                          "clientSecret": {
-                            "type": "string"
-                          },
-                          "tenantId": {
-                            "type": "string"
+                          "type": {
+                            "type": "string",
+                            "const": "static"
                           },
-                          "personalAccessToken": {
-                            "type": "string"
+                          "static": {
+                            "type": "object",
+                            "properties": {
+                              "keys": {
+                                "description": "Must be declared at least once and the first one will be used for signing.",
+                                "type": "array",
+                                "items": {
+                                  "type": "object",
+                                  "properties": {
+                                    "publicKeyFile": {
+                                      "description": "Path to the public key file in the SPKI format. Should be an absolute path.",
+                                      "type": "string"
+                                    },
+                                    "privateKeyFile": {
+                                      "description": "Path to the matching private key file in the PKCS#8 format. Should be an absolute path.\n\nThe first array entry must specify a private key file, the rest must not.",
+                                      "type": "string"
+                                    },
+                                    "keyId": {
+                                      "description": "ID to uniquely identify this key within the JWK set.",
+                                      "type": "string"
+                                    },
+                                    "algorithm": {
+                                      "description": "JWS \"alg\" (Algorithm) Header Parameter value. Defaults to ES256.\nMust match the algorithm used to generate the keys in the provided files",
+                                      "type": "string"
+                                    }
+                                  },
+                                  "required": [
+                                    "keyId",
+                                    "publicKeyFile"
+                                  ]
+                                }
+                              }
+                            },
+                            "required": [
+                              "keys"
+                            ]
                           }
-                        }
+                        },
+                        "required": [
+                          "static",
+                          "type"
+                        ]
                       }
-                    }
-                  },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "bitbucket": {
-                "description": "Integration configuration for Bitbucket",
-                "deprecated": "replaced by bitbucketCloud and bitbucketServer",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The hostname of the given Bitbucket instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "token": {
-                      "description": "Token used to authenticate requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "apiBaseUrl": {
-                      "description": "The base url for the Bitbucket API, for example https://api.bitbucket.org/2.0",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "username": {
-                      "description": "The username to use for authenticated requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "appPassword": {
-                      "description": "Bitbucket app password used to authenticate requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    }
+                    ]
                   },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "bitbucketCloud": {
-                "description": "Integration configuration for Bitbucket Cloud",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "username": {
-                      "description": "The username to use for authenticated requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "appPassword": {
-                      "description": "Bitbucket Cloud app password used to authenticate requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "appPassword",
-                    "username"
-                  ]
-                }
-              },
-              "bitbucketServer": {
-                "description": "Integration configuration for Bitbucket Server",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The hostname of the given Bitbucket Server instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "token": {
-                      "description": "Token used to authenticate requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "username": {
-                      "description": "Username used to authenticate requests with Basic Auth.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "password": {
-                      "description": "Password (or token as password) used to authenticate requests with Basic Auth.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "apiBaseUrl": {
-                      "description": "The base url for the Bitbucket Server API, for example https://<host>/rest/api/1.0",
-                      "visibility": "frontend",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "gerrit": {
-                "description": "Integration configuration for Gerrit",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The hostname of the given Gerrit instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "baseUrl": {
-                      "description": "The base url for the Gerrit instance.",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "cloneUrl": {
-                      "description": "The base url for cloning repos.",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "username": {
-                      "description": "The username to use for authenticated requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "password": {
-                      "description": "Gerrit password used to authenticate requests. This can be either a password\nor a generated access token.",
-                      "visibility": "secret",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "github": {
-                "description": "Integration configuration for GitHub",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The hostname of the given GitHub instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "token": {
-                      "description": "Token used to authenticate requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "apiBaseUrl": {
-                      "description": "The base url for the GitHub API, for example https://api.github.com",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "rawBaseUrl": {
-                      "description": "The base url for GitHub raw resources, for example https://raw.githubusercontent.com",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "apps": {
-                      "description": "GitHub Apps configuration",
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "appId": {
-                            "description": "The numeric GitHub App ID, string for environment variables",
-                            "type": [
-                              "string",
-                              "number"
-                            ]
-                          },
-                          "privateKey": {
-                            "description": "The private key to use for auth against the app",
-                            "visibility": "secret",
-                            "type": "string"
-                          },
-                          "webhookSecret": {
-                            "description": "The secret used for webhooks",
-                            "visibility": "secret",
-                            "type": "string"
-                          },
-                          "clientId": {
-                            "description": "The client ID to use",
-                            "type": "string"
+                  "externalAccess": {
+                    "description": "Configures methods of external access, ie ways for callers outside of\nthe Backstage ecosystem to get authorized for access to APIs that do\nnot permit unauthorized access.",
+                    "type": "array",
+                    "items": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "type": {
+                              "description": "This is the legacy service-to-service access method, where a set\nof static keys were shared among plugins and used for symmetric\nsigning and verification. These correspond to the old\n`backend.auth.keys` set and retain their behavior for backwards\ncompatibility. Please migrate to other access methods when\npossible.\n\nCallers generate JWT tokens with the following payload:\n\n```json\n{\n  \"sub\": \"backstage-plugin\",\n  \"exp\": <epoch seconds one hour in the future>\n}\n```\n\nAnd sign them with HS256, using the base64 decoded secret. The\ntokens are then passed along with requests in the Authorization\nheader:\n\n```\nAuthorization: Bearer eyJhbGciOiJIUzI...\n```",
+                              "type": "string",
+                              "const": "legacy"
+                            },
+                            "options": {
+                              "type": "object",
+                              "properties": {
+                                "secret": {
+                                  "description": "Any set of base64 encoded random bytes to be used as both the\nsigning and verification key. Should be sufficiently long so as\nnot to be easy to guess by brute force.\n\nCan be generated eg using\n\n```sh\nnode -p 'require(\"crypto\").randomBytes(24).toString(\"base64\")'\n```",
+                                  "visibility": "secret",
+                                  "type": "string"
+                                },
+                                "subject": {
+                                  "description": "Sets the subject of the principal, when matching this token.\nUseful for debugging and tracking purposes.",
+                                  "type": "string"
+                                }
+                              },
+                              "required": [
+                                "secret",
+                                "subject"
+                              ]
+                            },
+                            "accessRestrictions": {
+                              "description": "Restricts what types of access that are permitted for this access\nmethod. If no access restrictions are given, it'll have unlimited\naccess. This access restriction applies for the framework level;\nindividual plugins may have their own access control mechanisms\non top of this.",
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "plugin": {
+                                    "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below.",
+                                    "type": "string"
+                                  },
+                                  "permission": {
+                                    "description": "If given, this method is limited to only performing actions\nwith these named permissions in this plugin.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
+                                    "anyOf": [
+                                      {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "type": "string"
+                                      }
+                                    ]
+                                  },
+                                  "permissionAttribute": {
+                                    "description": "If given, this method is limited to only performing actions\nwhose permissions have these attributes.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
+                                    "type": "object",
+                                    "properties": {
+                                      "action": {
+                                        "description": "One of more of 'create', 'read', 'update', or 'delete'.",
+                                        "anyOf": [
+                                          {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            }
+                                          },
+                                          {
+                                            "type": "string"
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  }
+                                },
+                                "required": [
+                                  "plugin"
+                                ]
+                              }
+                            }
                           },
-                          "clientSecret": {
-                            "description": "The client secret to use",
-                            "visibility": "secret",
-                            "type": "string"
+                          "required": [
+                            "options",
+                            "type"
+                          ]
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "type": {
+                              "description": "This access method consists of random static tokens that can be\nhanded out to callers.\n\nThe tokens are then passed along verbatim with requests in the\nAuthorization header:\n\n```\nAuthorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW\n```",
+                              "type": "string",
+                              "const": "static"
+                            },
+                            "options": {
+                              "type": "object",
+                              "properties": {
+                                "token": {
+                                  "description": "A raw token that can be any string, but for security reasons\nshould be sufficiently long so as not to be easy to guess by\nbrute force.\n\nCan be generated eg using\n\n```sh\nnode -p 'require(\"crypto\").randomBytes(24).toString(\"base64\")'\n```\n\nSince the tokens can be any string, you are free to add\nadditional identifying data to them if you like. For example,\nadding a `freben-local-dev-` prefix for debugging purposes to a\ntoken that you know will be handed out for use as a personal\naccess token during development.",
+                                  "visibility": "secret",
+                                  "type": "string"
+                                },
+                                "subject": {
+                                  "description": "Sets the subject of the principal, when matching this token.\nUseful for debugging and tracking purposes.",
+                                  "type": "string"
+                                }
+                              },
+                              "required": [
+                                "subject",
+                                "token"
+                              ]
+                            },
+                            "accessRestrictions": {
+                              "description": "Restricts what types of access that are permitted for this access\nmethod. If no access restrictions are given, it'll have unlimited\naccess. This access restriction applies for the framework level;\nindividual plugins may have their own access control mechanisms\non top of this.",
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "plugin": {
+                                    "description": "Permit access to make requests to this plugin.\n\nCan be further refined by setting additional fields below.",
+                                    "type": "string"
+                                  },
+                                  "permission": {
+                                    "description": "If given, this method is limited to only performing actions\nwith these named permissions in this plugin.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
+                                    "anyOf": [
+                                      {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        }
+                                      },
+                                      {
+                                        "type": "string"
+                                      }
+                                    ]
+                                  },
+                                  "permissionAttribute": {
+                                    "description": "If given, this method is limited to only performing actions\nwhose permissions have these attributes.\n\nNote that this only applies where permissions checks are\nenabled in the first place. Endpoints that are not protected by\nthe permissions system at all, are not affected by this\nsetting.",
+                                    "type": "object",
+                                    "properties": {
+                                      "action": {
+                                        "description": "One of more of 'create', 'read', 'update', or 'delete'.",
+                                        "anyOf": [
+                                          {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            }
+                                          },
+                                          {
+                                            "type": "string"
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  }
+                                },
+                                "required": [
+                                  "plugin"
+                                ]
+                              }
+                            }
                           },
-                          "allowedInstallationOwners": {
-                            "description": "List of installation owners allowed to be used by this GitHub app. The GitHub UI does not provide a way to list the installations.\nHowever you can list the installations with the GitHub API. You can find the list of installations here:\nhttps://api.github.com/app/installations\nThe relevant documentation for this is here.\nhttps://docs.github.com/en/rest/reference/apps#list-installations-for-the-authenticated-app--code-samples",
-                            "type": "array",
-                            "items": {
-                              "type": "string"
+                          "required": [
+                            "options",
+                            "type"
+                          ]
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "type": {
+                              "description": "This access method consists of a JWKS endpoint that can be used to\nverify JWT tokens.\n\nCallers generate JWT tokens via 3rd party tooling\nand pass them in the Authorization header:\n\n```\nAuthorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW\n```",
+                              "type": "string",
+                              "const": "jwks"
+                            },
+                            "options": {
+                              "type": "object",
+                              "properties": {
+                                "url": {
+                                  "description": "The full URL of the JWKS endpoint.",
+                                  "type": "string"
+                                },
+                                "algorithm": {
+                                  "description": "Sets the algorithm(s) that should be used to verify the JWT tokens.\nThe passed JWTs must have been signed using one of the listed algorithms.",
+                                  "anyOf": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "type": "string"
+                                    }
+                                  ]
+                                },
+                                "issuer": {
+                                  "description": "Sets the issuer(s) that should be used to verify the JWT tokens.\nPassed JWTs must have an `iss` claim which matches one of the specified issuers.",
+                                  "anyOf": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "type": "string"
+                                    }
+                                  ]
+                                },
+                                "audience": {
+                                  "description": "Sets the audience(s) that should be used to verify the JWT tokens.\nThe passed JWTs must have an \"aud\" claim that matches one of the audiences specified,\nor have no audience specified.",
+                                  "anyOf": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    {
+                                      "type": "string"
+                                    }
+                                  ]
+                                },
+                                "subjectPrefix": {
+                                  "description": "Sets an optional subject prefix. Passes the subject to called plugins.\nUseful for debugging and tracking purposes.",
+                                  "type": "string"
+                                }
+                              },
+                              "required": [
+                                "url"
+                              ]
                             }
-                          }
-                        },
-                        "required": [
-                          "appId",
-                          "clientId",
-                          "clientSecret",
-                          "privateKey",
-                          "webhookSecret"
-                        ]
-                      }
-                    }
-                  },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "gitlab": {
-                "description": "Integration configuration for GitLab",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The host of the target that this matches on, e.g. \"gitlab.com\".",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "apiBaseUrl": {
-                      "description": "The base URL of the API of this provider, e.g.\n\"https://gitlab.com/api/v4\", with no trailing slash.\n\nMay be omitted specifically for public GitLab; then it will be deduced.",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "token": {
-                      "description": "The authorization token to use for requests to this provider.\n\nIf no token is specified, anonymous access is used.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "baseUrl": {
-                      "description": "The baseUrl of this provider, e.g. \"https://gitlab.com\", which is\npassed into the GitLab client.\n\nIf no baseUrl is provided, it will default to https://${host}.",
-                      "visibility": "frontend",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "googleGcs": {
-                "description": "Integration configuration for Google Cloud Storage",
-                "type": "object",
-                "properties": {
-                  "clientEmail": {
-                    "description": "Service account email used to authenticate requests.",
-                    "type": "string"
-                  },
-                  "privateKey": {
-                    "description": "Service account private key used to authenticate requests.",
-                    "visibility": "secret",
-                    "type": "string"
-                  }
-                }
-              },
-              "awsS3": {
-                "description": "Integration configuration for AWS S3 Service",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "endpoint": {
-                      "description": "AWS Endpoint.\nThe endpoint URI to send requests to. The default endpoint is built from the configured region.",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "s3ForcePathStyle": {
-                      "description": "Whether to use path style URLs when communicating with S3.\nDefaults to false.\nThis allows providers like LocalStack, Minio and Wasabi (and possibly others) to be used.",
-                      "visibility": "frontend",
-                      "type": "boolean"
-                    },
-                    "accessKeyId": {
-                      "description": "Account access key used to authenticate requests.",
-                      "type": "string"
-                    },
-                    "secretAccessKey": {
-                      "description": "Account secret key used to authenticate requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "roleArn": {
-                      "description": "ARN of the role to be assumed",
-                      "type": "string"
-                    },
-                    "externalId": {
-                      "description": "External ID to use when assuming role",
-                      "type": "string"
+                          },
+                          "required": [
+                            "options",
+                            "type"
+                          ]
+                        }
+                      ]
                     }
                   }
-                }
-              },
-              "gitea": {
-                "description": "Integration configuration for Gitea",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "host": {
-                      "description": "The hostname of the given Gitea instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "baseUrl": {
-                      "description": "The base url for the Gitea instance.",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "username": {
-                      "description": "The username to use for authenticated requests.",
-                      "visibility": "secret",
-                      "type": "string"
-                    },
-                    "password": {
-                      "description": "Gitea password used to authenticate requests. This can be either a password\nor a generated access token.",
-                      "visibility": "secret",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "host"
-                  ]
-                }
-              },
-              "harness": {
-                "description": "Integration configuration for Harness Code",
+                },
+                "required": [
+                  "externalAccess"
+                ]
+              }
+            }
+          },
+          "discovery": {
+            "description": "Options used by the default discovery service.",
+            "type": "object",
+            "properties": {
+              "endpoints": {
+                "description": "A list of target baseUrls and the associated plugins.",
                 "type": "array",
                 "items": {
                   "type": "object",
                   "properties": {
-                    "host": {
-                      "description": "The hostname of the given Harness Code instance",
-                      "visibility": "frontend",
-                      "type": "string"
-                    },
-                    "apiKey": {
-                      "description": "The apikey to use for authenticated requests.",
-                      "visibility": "secret",
-                      "type": "string"
+                    "target": {
+                      "description": "The target base URL to use for the plugin.\n\nCan be either a string or an object with internal and external keys.\nTargets with `{{pluginId}}` or `{{ pluginId }} in the URL will be replaced with the plugin ID.",
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "internal": {
+                              "type": "string"
+                            },
+                            "external": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "external",
+                            "internal"
+                          ]
+                        },
+                        {
+                          "type": "string"
+                        }
+                      ]
                     },
-                    "token": {
-                      "description": "Harness Code token used to authenticate requests. This can be either a generated access token.",
-                      "visibility": "secret",
-                      "type": "string"
+                    "plugins": {
+                      "description": "Array of plugins which use the target base URL.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
                     }
                   },
                   "required": [
-                    "host"
+                    "plugins",
+                    "target"
                   ]
                 }
               }
-            }
+            },
+            "required": [
+              "endpoints"
+            ]
           }
         },
         "$schema": "http://json-schema.org/draft-07/schema#"