From 201eb08c8413b584bf3b2da59081af8efc4ea691 Mon Sep 17 00:00:00 2001
From: Andres Mauricio Gomez P <andmagom@outlook.com>
Date: Fri, 29 Sep 2023 17:23:22 -0500
Subject: [PATCH] Validating that custom auth strategies don't include dashes

Signed-off-by: Andres Mauricio Gomez P <andmagom@outlook.com>
---
 .changeset/two-dingos-dream.md                |  1 +
 .../src/service/KubernetesBuilder.test.ts     | 20 +++++++++++++++++++
 .../src/service/KubernetesBuilder.ts          |  3 +++
 plugins/kubernetes-common/api-report.md       |  5 ++++-
 plugins/kubernetes-common/src/types.ts        |  6 ++++--
 5 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/.changeset/two-dingos-dream.md b/.changeset/two-dingos-dream.md
index 4fbe7651c9..9ebefacc69 100644
--- a/.changeset/two-dingos-dream.md
+++ b/.changeset/two-dingos-dream.md
@@ -1,6 +1,7 @@
 ---
 '@backstage/plugin-kubernetes-backend': patch
 '@backstage/plugin-kubernetes-react': patch
+'@backstage/plugin-kubernetes-common': patch
 ---
 
 The kubernetes APIs invokes Authentication Strategies when Backstage-Kubernetes-Authorization-X-X headers are provided, this enable the possibility to invoke strategies that executes additional steps to get a kubernetes token like on pinniped or custom strategies
diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts
index 85a4326d60..c676cc6246 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts
@@ -520,6 +520,26 @@ metadata:
 
       expect(response.body).toStrictEqual({ items: [] });
     });
+
+    it('should not permit custom auth strategies with dashes', async () => {
+      const throwError = () =>
+        KubernetesBuilder.createBuilder({
+          logger: getVoidLogger(),
+          config,
+          catalogApi,
+          permissions,
+        }).addAuthStrategy('custom-strategy', {
+          getCredential: jest
+            .fn<
+              Promise<KubernetesCredential>,
+              [ClusterDetails, KubernetesRequestAuth]
+            >()
+            .mockResolvedValue({ type: 'anonymous' }),
+          validateCluster: jest.fn().mockReturnValue([]),
+        });
+
+      expect(throwError).toThrow('Strategy name can not include dashes');
+    });
   });
   describe('get /.well-known/backstage/permissions/metadata', () => {
     it('lists permissions supported by the kubernetes plugin', async () => {
diff --git a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts
index f3766d8513..9ac1bf6e5d 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesBuilder.ts
@@ -205,6 +205,9 @@ export class KubernetesBuilder {
   }
 
   public addAuthStrategy(key: string, strategy: AuthenticationStrategy) {
+    if (key.includes('-')) {
+      throw new Error('Strategy name can not include dashes');
+    }
     this.getAuthStrategyMap()[key] = strategy;
     return this;
   }
diff --git a/plugins/kubernetes-common/api-report.md b/plugins/kubernetes-common/api-report.md
index 0840278394..8daeb9a875 100644
--- a/plugins/kubernetes-common/api-report.md
+++ b/plugins/kubernetes-common/api-report.md
@@ -7,6 +7,7 @@ import { BasicPermission } from '@backstage/plugin-permission-common';
 import { Entity } from '@backstage/catalog-model';
 import { FetchResponse as FetchResponse_2 } from '@backstage/plugin-kubernetes-common';
 import type { JsonObject } from '@backstage/types';
+import type { JsonValue } from '@backstage/types';
 import { ObjectsByEntityResponse as ObjectsByEntityResponse_2 } from '@backstage/plugin-kubernetes-common';
 import { PodStatus } from '@kubernetes/client-node';
 import { V1ConfigMap } from '@kubernetes/client-node';
@@ -319,7 +320,9 @@ export const kubernetesPermissions: BasicPermission[];
 export const kubernetesProxyPermission: BasicPermission;
 
 // @public (undocumented)
-export type KubernetesRequestAuth = JsonObject;
+export type KubernetesRequestAuth = {
+  [providerKey: string]: JsonValue | undefined;
+};
 
 // @public (undocumented)
 export interface KubernetesRequestBody {
diff --git a/plugins/kubernetes-common/src/types.ts b/plugins/kubernetes-common/src/types.ts
index 9648293432..9f8d5eed82 100644
--- a/plugins/kubernetes-common/src/types.ts
+++ b/plugins/kubernetes-common/src/types.ts
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import type { JsonObject } from '@backstage/types';
+import type { JsonObject, JsonValue } from '@backstage/types';
 import {
   PodStatus,
   V1ConfigMap,
@@ -33,7 +33,9 @@ import {
 import { Entity } from '@backstage/catalog-model';
 
 /** @public */
-export type KubernetesRequestAuth = JsonObject;
+export type KubernetesRequestAuth = {
+  [providerKey: string]: JsonValue | undefined;
+};
 
 /** @public */
 export interface CustomResourceMatcher {