Merge pull request #24870 from backstage/permission-framework-remove-references-backend-common

permission-node: remove references from backend-common

.changeset/selfish-pugs-lick.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-permission-node': patch
+---
+
+Import `tokenManager` definition from `@backstage/backend-plugin-api`

plugins/permission-node/api-report.md

@@ -25,7 +25,7 @@ import { PermissionsServiceRequestOptions } from '@backstage/backend-plugin-api'
 import { PolicyDecision } from '@backstage/plugin-permission-common';
 import { QueryPermissionRequest } from '@backstage/plugin-permission-common';
 import { ResourcePermission } from '@backstage/plugin-permission-common';
-import { TokenManager } from '@backstage/backend-common';
+import { TokenManagerService } from '@backstage/backend-plugin-api';
 import { z } from 'zod';
 import zodToJsonSchema from 'zod-to-json-schema';
 
@@ -289,7 +289,7 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager: TokenManager;
+      tokenManager: TokenManagerService;
       auth?: AuthService;
     },
   ): ServerPermissionClient;

plugins/permission-node/src/ServerPermissionClient.test.ts

@@ -28,24 +28,13 @@ import {
   setupRequestMockHandlers,
 } from '@backstage/backend-test-utils';
 import { ConfigReader } from '@backstage/config';
-import {
-  PluginEndpointDiscovery,
-  ServerTokenManager,
-} from '@backstage/backend-common';
 import { setupServer } from 'msw/node';
 import { RestContext, rest } from 'msw';
 
 const server = setupServer();
 
 const mockBaseUrl = 'http://backstage:9191/i-am-a-mock-base';
-const discovery: PluginEndpointDiscovery = {
-  async getBaseUrl() {
-    return mockBaseUrl;
-  },
-  async getExternalBaseUrl() {
-    return mockBaseUrl;
-  },
-};
+
 const testBasicPermission = createPermission({
   name: 'test.permission',
   attributes: {
@@ -63,21 +52,14 @@ const config = new ConfigReader({
   permission: { enabled: true },
   backend: { auth: { keys: [{ secret: 'a-secret-key' }] } },
 });
-const logger = mockServices.logger.mock();
 
 describe('ServerPermissionClient', () => {
   setupRequestMockHandlers(server);
 
-  it('should error if permissions are enabled but a no-op token manager is configured', async () => {
-    expect(() =>
-      ServerPermissionClient.fromConfig(config, {
-        discovery,
-        tokenManager: ServerTokenManager.noop(),
-      }),
-    ).toThrow(
-      'Service-to-service authentication must be configured before enabling permissions. Read more here https://backstage.io/docs/auth/service-to-service-auth',
-    );
-  });
+  const discovery = mockServices.discovery.mock();
+
+  discovery.getBaseUrl.mockResolvedValue(mockBaseUrl);
+  discovery.getExternalBaseUrl.mockResolvedValue(mockBaseUrl);
 
   describe('authorize', () => {
     let mockAuthorizeHandler: jest.Mock;
@@ -100,7 +82,7 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are disabled', async () => {
       const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
         discovery,
-        tokenManager: ServerTokenManager.noop(),
+        tokenManager: mockServices.tokenManager.mock(),
       });
 
       await client.authorize([
@@ -113,28 +95,28 @@ describe('ServerPermissionClient', () => {
     });
 
     it('should bypass the permission backend if permissions are enabled and request has valid server token', async () => {
-      const tokenManager = ServerTokenManager.fromConfig(config, { logger });
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager,
+        tokenManager: mockServices.tokenManager.mock(),
+        auth: mockServices.auth(),
       });
 
       await client.authorize([{ permission: testBasicPermission }], {
-        token: (await tokenManager.getToken()).token,
+        token: mockCredentials.service.token(),
       });
 
       expect(mockAuthorizeHandler).not.toHaveBeenCalled();
     });
 
     it('should call the permission backend if permissions are enabled and request does not have valid server token', async () => {
-      const tokenManager = ServerTokenManager.fromConfig(config, { logger });
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager,
+        tokenManager: mockServices.tokenManager.mock(),
+        auth: mockServices.auth(),
       });
 
       await client.authorize([{ permission: testBasicPermission }], {
-        token: 'a-user-token',
+        token: mockCredentials.user.token(),
       });
 
       expect(mockAuthorizeHandler).toHaveBeenCalled();
@@ -162,7 +144,7 @@ describe('ServerPermissionClient', () => {
     it('should bypass the permission backend if permissions are disabled', async () => {
       const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
         discovery,
-        tokenManager: ServerTokenManager.noop(),
+        tokenManager: mockServices.tokenManager.mock(),
       });
 
       await client.authorizeConditional([
@@ -173,16 +155,15 @@ describe('ServerPermissionClient', () => {
     });
 
     it('should bypass the permission backend if permissions are enabled and request has valid server token', async () => {
-      const tokenManager = ServerTokenManager.fromConfig(config, { logger });
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager,
+        tokenManager: mockServices.tokenManager.mock(),
       });
 
       await client.authorizeConditional(
         [{ permission: testResourcePermission }],
         {
-          token: (await tokenManager.getToken()).token,
+          token: mockCredentials.service.token(),
         },
       );
 
@@ -190,16 +171,17 @@ describe('ServerPermissionClient', () => {
     });
 
     it('should call the permission backend if permissions are enabled and request does not have valid server token', async () => {
-      const tokenManager = ServerTokenManager.fromConfig(config, { logger });
+      const auth = mockServices.auth();
       const client = ServerPermissionClient.fromConfig(config, {
         discovery,
-        tokenManager,
+        tokenManager: mockServices.tokenManager.mock(),
+        auth,
       });
 
       await client.authorizeConditional(
         [{ permission: testResourcePermission }],
         {
-          token: 'a-user-token',
+          token: mockCredentials.user.token(),
         },
       );
 
@@ -229,7 +211,7 @@ describe('ServerPermissionClient', () => {
       it('should bypass the permission backend if permissions are disabled', async () => {
         const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
           discovery,
-          tokenManager: ServerTokenManager.noop(),
+          tokenManager: mockServices.tokenManager.mock(),
           auth: mockServices.auth(),
         });
 
@@ -246,10 +228,9 @@ describe('ServerPermissionClient', () => {
       });
 
       it('should bypass the permission backend if permissions are enabled and request has valid server token', async () => {
-        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
         const client = ServerPermissionClient.fromConfig(config, {
           discovery,
-          tokenManager,
+          tokenManager: mockServices.tokenManager.mock(),
           auth: mockServices.auth(),
         });
 
@@ -261,10 +242,9 @@ describe('ServerPermissionClient', () => {
       });
 
       it('should call the permission backend if permissions are enabled and request does not have valid server token', async () => {
-        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
         const client = ServerPermissionClient.fromConfig(config, {
           discovery,
-          tokenManager,
+          tokenManager: mockServices.tokenManager.mock(),
           auth: mockServices.auth(),
         });
 
@@ -305,7 +285,7 @@ describe('ServerPermissionClient', () => {
       it('should bypass the permission backend if permissions are disabled', async () => {
         const client = ServerPermissionClient.fromConfig(new ConfigReader({}), {
           discovery,
-          tokenManager: ServerTokenManager.noop(),
+          tokenManager: mockServices.tokenManager.mock(),
           auth: mockServices.auth(),
         });
 
@@ -320,10 +300,9 @@ describe('ServerPermissionClient', () => {
       });
 
       it('should bypass the permission backend if permissions are enabled and request has valid server token', async () => {
-        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
         const client = ServerPermissionClient.fromConfig(config, {
           discovery,
-          tokenManager,
+          tokenManager: mockServices.tokenManager.mock(),
           auth: mockServices.auth(),
         });
 
@@ -338,10 +317,9 @@ describe('ServerPermissionClient', () => {
       });
 
       it('should call the permission backend if permissions are enabled and request does not have valid server token', async () => {
-        const tokenManager = ServerTokenManager.fromConfig(config, { logger });
         const client = ServerPermissionClient.fromConfig(config, {
           discovery,
-          tokenManager,
+          tokenManager: mockServices.tokenManager.mock(),
           auth: mockServices.auth(),
         });
 

plugins/permission-node/src/ServerPermissionClient.ts

@@ -14,10 +14,7 @@
  * limitations under the License.
  */
 
-import {
-  TokenManager,
-  createLegacyAuthAdapters,
-} from '@backstage/backend-common';
+import { createLegacyAuthAdapters } from '@backstage/backend-common';
 import {
   AuthService,
   BackstageCredentials,
@@ -25,6 +22,7 @@ import {
   DiscoveryService,
   PermissionsService,
   PermissionsServiceRequestOptions,
+  TokenManagerService,
 } from '@backstage/backend-plugin-api';
 import { Config } from '@backstage/config';
 import {
@@ -53,7 +51,7 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager: TokenManager;
+      tokenManager: TokenManagerService;
       auth?: AuthService;
     },
   ) {