Merge pull request #30092 from Sarabadu/module-id-validation

validate plugin and module ids

packages/backend-plugin-api/src/wiring/constants.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// NOTE: changing any of these constants need to be reflected in
+// @backstage/frontend-plugin-api/src/wiring/constants.ts as well
+
+/**
+ * The pattern that IDs must match.
+ *
+ * @remarks
+ * ids must only contain the letters `a` through `z` and digits, in groups separated by
+ * dashes. Additionally, the very first character of the first group
+ * must be a letter, not a digit
+ *
+ * @public
+ */
+export const ID_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/i;
+export const ID_PATTERN_OLD = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/i;

packages/backend-plugin-api/src/wiring/createBackendModule.test.ts

@@ -15,6 +15,7 @@
  */
 
 import { createServiceRef } from '../services';
+import { ID_PATTERN } from './constants';
 import { createBackendModule } from './createBackendModule';
 import { createExtensionPoint } from './createExtensionPoint';
 import { InternalBackendRegistrations } from './types';
@@ -77,4 +78,20 @@ describe('createBackendModule', () => {
 
     expect(plugin.$$type).toEqual('@backstage/BackendFeature');
   });
+  it('should reject modules with invalid moduleId', async () => {
+    expect(() =>
+      createBackendModule({
+        pluginId: 'test',
+        moduleId: 'invalid:module&id',
+        register(reg) {
+          reg.registerInit({
+            deps: {},
+            async init() {},
+          });
+        },
+      }),
+    ).toThrow(
+      `Invalid moduleId 'invalid:module&id' for plugin 'test', must match the pattern ${ID_PATTERN} (letters, digits, and dashes only, starting with a letter)`,
+    );
+  });
 });

packages/backend-plugin-api/src/wiring/createBackendModule.ts

@@ -15,6 +15,7 @@
  */
 
 import { BackendFeature } from '../types';
+import { ID_PATTERN, ID_PATTERN_OLD } from './constants';
 import {
   BackendModuleRegistrationPoints,
   ExtensionPoint,
@@ -55,6 +56,17 @@ export interface CreateBackendModuleOptions {
 export function createBackendModule(
   options: CreateBackendModuleOptions,
 ): BackendFeature {
+  if (!ID_PATTERN.test(options.moduleId)) {
+    console.warn(
+      `WARNING: The moduleId '${options.moduleId}' for plugin '${options.pluginId}', will be invalid soon, please change it to match the pattern ${ID_PATTERN} (letters, digits, and dashes only, starting with a letter)`,
+    );
+  }
+  if (!ID_PATTERN_OLD.test(options.moduleId)) {
+    throw new Error(
+      `Invalid moduleId '${options.moduleId}' for plugin '${options.pluginId}', must match the pattern ${ID_PATTERN} (letters, digits, and dashes only, starting with a letter)`,
+    );
+  }
+
   function getRegistrations() {
     const extensionPoints: InternalBackendModuleRegistrationV1_1['extensionPoints'] =
       [];

packages/backend-plugin-api/src/wiring/createBackendPlugin.test.ts

@@ -15,6 +15,7 @@
  */
 
 import { createServiceRef } from '../services';
+import { ID_PATTERN } from './constants';
 import { createBackendPlugin } from './createBackendPlugin';
 import { createExtensionPoint } from './createExtensionPoint';
 import { InternalBackendRegistrations } from './types';
@@ -90,4 +91,19 @@ describe('createBackendPlugin', () => {
 
     expect(plugin.$$type).toEqual('@backstage/BackendFeature');
   });
+  it('should reject plugins with invalid pluginId', async () => {
+    expect(() =>
+      createBackendPlugin({
+        pluginId: 'test:invalid&id',
+        register(reg) {
+          reg.registerInit({
+            deps: {},
+            async init() {},
+          });
+        },
+      }),
+    ).toThrow(
+      `Invalid pluginId 'test:invalid&id', must match the pattern ${ID_PATTERN} (letters, digits, and dashes only, starting with a letter)`,
+    );
+  });
 });

packages/backend-plugin-api/src/wiring/createBackendPlugin.ts

@@ -22,6 +22,7 @@ import {
   InternalBackendPluginRegistrationV1_1,
   InternalBackendRegistrations,
 } from './types';
+import { ID_PATTERN, ID_PATTERN_OLD } from './constants';
 
 /**
  * The configuration options passed to {@link createBackendPlugin}.
@@ -50,6 +51,17 @@ export interface CreateBackendPluginOptions {
 export function createBackendPlugin(
   options: CreateBackendPluginOptions,
 ): BackendFeature {
+  if (!ID_PATTERN.test(options.pluginId)) {
+    console.warn(
+      `WARNING: The pluginId '${options.pluginId}' will be invalid soon, please change it to match the pattern ${ID_PATTERN} (letters, digits, and dashes only, starting with a letter)`,
+    );
+  }
+  if (!ID_PATTERN_OLD.test(options.pluginId)) {
+    throw new Error(
+      `Invalid pluginId '${options.pluginId}', must match the pattern ${ID_PATTERN} (letters, digits, and dashes only, starting with a letter)`,
+    );
+  }
+
   function getRegistrations() {
     const extensionPoints: InternalBackendPluginRegistrationV1_1['extensionPoints'] =
       [];