@backstage/backend-defaults/dist/entrypoints/auth/external/ExternalTokenHandler.cjs.js

Backend defaults used by Backstage backend apps

'use strict';

var errors = require('@backstage/errors');
var legacy = require('./legacy.cjs.js');
var _static = require('./static.cjs.js');
var jwks = require('./jwks.cjs.js');

const NEW_CONFIG_KEY = "backend.auth.externalAccess";
const OLD_CONFIG_KEY = "backend.auth.keys";
let loggedDeprecationWarning = false;
class ExternalTokenHandler {
  constructor(ownPluginId, handlers) {
    this.ownPluginId = ownPluginId;
    this.handlers = handlers;
  }
  static create(options) {
    const { ownPluginId, config, logger } = options;
    const staticHandler = new _static.StaticTokenHandler();
    const legacyHandler = new legacy.LegacyTokenHandler();
    const jwksHandler = new jwks.JWKSHandler();
    const handlers = {
      static: staticHandler,
      legacy: legacyHandler,
      jwks: jwksHandler
    };
    const handlerConfigs = config.getOptionalConfigArray(NEW_CONFIG_KEY) ?? [];
    for (const handlerConfig of handlerConfigs) {
      const type = handlerConfig.getString("type");
      const handler = handlers[type];
      if (!handler) {
        const valid = Object.keys(handlers).map((k) => `'${k}'`).join(", ");
        throw new Error(
          `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`
        );
      }
      handler.add(handlerConfig);
    }
    const legacyConfigs = config.getOptionalConfigArray(OLD_CONFIG_KEY) ?? [];
    if (legacyConfigs.length && !loggedDeprecationWarning) {
      loggedDeprecationWarning = true;
      logger.warn(
        `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`
      );
    }
    for (const handlerConfig of legacyConfigs) {
      legacyHandler.addOld(handlerConfig);
    }
    return new ExternalTokenHandler(ownPluginId, Object.values(handlers));
  }
  async verifyToken(token) {
    for (const handler of this.handlers) {
      const result = await handler.verifyToken(token);
      if (result) {
        const { allAccessRestrictions, ...rest } = result;
        if (allAccessRestrictions) {
          const accessRestrictions = allAccessRestrictions.get(
            this.ownPluginId
          );
          if (!accessRestrictions) {
            const valid = [...allAccessRestrictions.keys()].map((k) => `'${k}'`).join(", ");
            throw new errors.NotAllowedError(
              `This token's access is restricted to plugin(s) ${valid}`
            );
          }
          return {
            ...rest,
            accessRestrictions
          };
        }
        return rest;
      }
    }
    return void 0;
  }
}

exports.ExternalTokenHandler = ExternalTokenHandler;
//# sourceMappingURL=ExternalTokenHandler.cjs.js.map