Validating that custom auth strategies don't include dashes

Signed-off-by: Andres Mauricio Gomez P <andmagom@outlook.com>

.changeset/two-dingos-dream.md

@@ -1,6 +1,7 @@
 ---
 '@backstage/plugin-kubernetes-backend': patch
 '@backstage/plugin-kubernetes-react': patch
+'@backstage/plugin-kubernetes-common': patch
 ---
 
 The kubernetes APIs invokes Authentication Strategies when Backstage-Kubernetes-Authorization-X-X headers are provided, this enable the possibility to invoke strategies that executes additional steps to get a kubernetes token like on pinniped or custom strategies

plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts

@@ -520,6 +520,26 @@ metadata:
 
       expect(response.body).toStrictEqual({ items: [] });
     });
+
+    it('should not permit custom auth strategies with dashes', async () => {
+      const throwError = () =>
+        KubernetesBuilder.createBuilder({
+          logger: getVoidLogger(),
+          config,
+          catalogApi,
+          permissions,
+        }).addAuthStrategy('custom-strategy', {
+          getCredential: jest
+            .fn<
+              Promise<KubernetesCredential>,
+              [ClusterDetails, KubernetesRequestAuth]
+            >()
+            .mockResolvedValue({ type: 'anonymous' }),
+          validateCluster: jest.fn().mockReturnValue([]),
+        });
+
+      expect(throwError).toThrow('Strategy name can not include dashes');
+    });
   });
   describe('get /.well-known/backstage/permissions/metadata', () => {
     it('lists permissions supported by the kubernetes plugin', async () => {

plugins/kubernetes-backend/src/service/KubernetesBuilder.ts

@@ -205,6 +205,9 @@ export class KubernetesBuilder {
   }
 
   public addAuthStrategy(key: string, strategy: AuthenticationStrategy) {
+    if (key.includes('-')) {
+      throw new Error('Strategy name can not include dashes');
+    }
     this.getAuthStrategyMap()[key] = strategy;
     return this;
   }

plugins/kubernetes-common/api-report.md

@@ -7,6 +7,7 @@ import { BasicPermission } from '@backstage/plugin-permission-common';
 import { Entity } from '@backstage/catalog-model';
 import { FetchResponse as FetchResponse_2 } from '@backstage/plugin-kubernetes-common';
 import type { JsonObject } from '@backstage/types';
+import type { JsonValue } from '@backstage/types';
 import { ObjectsByEntityResponse as ObjectsByEntityResponse_2 } from '@backstage/plugin-kubernetes-common';
 import { PodStatus } from '@kubernetes/client-node';
 import { V1ConfigMap } from '@kubernetes/client-node';
@@ -319,7 +320,9 @@ export const kubernetesPermissions: BasicPermission[];
 export const kubernetesProxyPermission: BasicPermission;
 
 // @public (undocumented)
-export type KubernetesRequestAuth = JsonObject;
+export type KubernetesRequestAuth = {
+  [providerKey: string]: JsonValue | undefined;
+};
 
 // @public (undocumented)
 export interface KubernetesRequestBody {

plugins/kubernetes-common/src/types.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import type { JsonObject } from '@backstage/types';
+import type { JsonObject, JsonValue } from '@backstage/types';
 import {
   PodStatus,
   V1ConfigMap,
@@ -33,7 +33,9 @@ import {
 import { Entity } from '@backstage/catalog-model';
 
 /** @public */
-export type KubernetesRequestAuth = JsonObject;
+export type KubernetesRequestAuth = {
+  [providerKey: string]: JsonValue | undefined;
+};
 
 /** @public */
 export interface CustomResourceMatcher {