From 03691f0f32705e0f6f2de0daccb3d4ac133012b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Tue, 19 Sep 2023 11:04:53 +0200
Subject: [PATCH] add back proxy legacy config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 .changeset/purple-hotels-doubt.md |  5 ++++
 plugins/proxy-backend/config.d.ts | 49 +++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 .changeset/purple-hotels-doubt.md

diff --git a/.changeset/purple-hotels-doubt.md b/.changeset/purple-hotels-doubt.md
new file mode 100644
index 0000000000..476d8071de
--- /dev/null
+++ b/.changeset/purple-hotels-doubt.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-proxy-backend': patch
+---
+
+Add back the legacy proxy config, to get secret redaction
diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts
index 79e1cfcba6..dd65aa8e75 100644
--- a/plugins/proxy-backend/config.d.ts
+++ b/plugins/proxy-backend/config.d.ts
@@ -73,5 +73,54 @@ export interface Config {
             allowedHeaders?: string[];
           };
     };
+  } & {
+    /**
+     * This was the legacy way of expressing proxies, and is now deprecated. We
+     * keep it around in the config schema, to ensure that legacy setups still
+     * have properly secret-marked values so that they get redacted.
+     *
+     * TODO(freben): Remove this in the future (suggestion: after 2024-03-01)
+     * when people likely have moved off of this format.
+     */
+    [key: string]:
+      | string
+      | {
+          /**
+           * Target of the proxy. Url string to be parsed with the url module.
+           */
+          target: string;
+          /**
+           * Object with extra headers to be added to target requests.
+           */
+          headers?: {
+            /** @visibility secret */
+            Authorization?: string;
+            /** @visibility secret */
+            authorization?: string;
+            /** @visibility secret */
+            'X-Api-Key'?: string;
+            /** @visibility secret */
+            'x-api-key'?: string;
+            [key: string]: string | undefined;
+          };
+          /**
+           * Changes the origin of the host header to the target URL. Default: true.
+           */
+          changeOrigin?: boolean;
+          /**
+           * Rewrite target's url path. Object-keys will be used as RegExp to match paths.
+           * If pathRewrite is not specified, it is set to a single rewrite that removes the entire prefix and route.
+           */
+          pathRewrite?: { [regexp: string]: string };
+          /**
+           * Limit the forwarded HTTP methods, for example allowedMethods: ['GET'] to enforce read-only access.
+           */
+          allowedMethods?: string[];
+          /**
+           * Limit the forwarded HTTP methods. By default, only the headers that are considered safe for CORS
+           * and headers that are set by the proxy will be forwarded.
+           */
+          allowedHeaders?: string[];
+        };
   };
 }