@backstage/backend-defaults/dist/entrypoints/httpRouter/http/createCredentialsBarrier.cjs.js

Backend defaults used by Backstage backend apps

'use strict';

var pathToRegexp = require('path-to-regexp');

function createPathPolicyPredicate(policyPath) {
  if (policyPath === "/" || policyPath === "*") {
    return () => true;
  }
  const { regexp: pathRegex } = pathToRegexp.pathToRegexp(policyPath, {
    end: false
  });
  return (path) => {
    return pathRegex.test(path);
  };
}
function createCredentialsBarrier(options) {
  const { httpAuth, config } = options;
  const disableDefaultAuthPolicy = config.getOptionalBoolean(
    "backend.auth.dangerouslyDisableDefaultAuthPolicy"
  );
  if (disableDefaultAuthPolicy) {
    return {
      middleware: (_req, _res, next) => next(),
      addAuthPolicy: () => {
      }
    };
  }
  const unauthenticatedPredicates = new Array();
  const cookiePredicates = new Array();
  const middleware = (req, _, next) => {
    const allowsUnauthenticated = unauthenticatedPredicates.some(
      (predicate) => predicate(req.path)
    );
    if (allowsUnauthenticated) {
      next();
      return;
    }
    const allowsCookie = cookiePredicates.some(
      (predicate) => predicate(req.path)
    );
    httpAuth.credentials(req, {
      allow: ["user", "service"],
      allowLimitedAccess: allowsCookie
    }).then(
      () => next(),
      (err) => next(err)
    );
  };
  const addAuthPolicy = (policy) => {
    if (policy.allow === "unauthenticated") {
      unauthenticatedPredicates.push(createPathPolicyPredicate(policy.path));
    } else if (policy.allow === "user-cookie") {
      cookiePredicates.push(createPathPolicyPredicate(policy.path));
    } else {
      throw new Error("Invalid auth policy");
    }
  };
  return { middleware, addAuthPolicy };
}

exports.createCredentialsBarrier = createCredentialsBarrier;
exports.createPathPolicyPredicate = createPathPolicyPredicate;
//# sourceMappingURL=createCredentialsBarrier.cjs.js.map