Remove backend-common from permission-node

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>

.changeset/first-purple-bykors.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-permission-node': minor
+---
+
+**BREAKING** The `ServerPermissionClient` can no longer be instantiated with a `tokenManager` and must instead be instantiated with an `auth` service. If you are still on the legacy backend system, use `createLegacyAuthAdapters()` from `@backstage/backend-common` to create a compatible `auth` service.

packages/backend-legacy/src/index.ts

@@ -25,6 +25,7 @@
 import Router from 'express-promise-router';
 import {
   CacheManager,
+  createLegacyAuthAdapters,
   createServiceBuilder,
   DatabaseManager,
   getRootLogger,
@@ -37,7 +38,7 @@ import {
 import { Config } from '@backstage/config';
 import healthcheck from './plugins/healthcheck';
 import { metricsHandler, metricsInit } from './metrics';
-import auth from './plugins/auth';
+import authPlugin from './plugins/auth';
 import catalog from './plugins/catalog';
 import events from './plugins/events';
 import kubernetes from './plugins/kubernetes';
@@ -59,10 +60,15 @@ function makeCreateEnv(config: Config) {
   const reader = UrlReaders.default({ logger: root, config });
   const discovery = HostDiscovery.fromConfig(config);
   const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
-  const permissions = ServerPermissionClient.fromConfig(config, {
+  const { auth } = createLegacyAuthAdapters({
+    auth: undefined,
     discovery,
     tokenManager,
   });
+  const permissions = ServerPermissionClient.fromConfig(config, {
+    discovery,
+    auth,
+  });
   const databaseManager = DatabaseManager.fromConfig(config, { logger: root });
   const cacheManager = CacheManager.fromConfig(config);
   const identity = DefaultIdentityClient.create({
@@ -137,7 +143,7 @@ async function main() {
   apiRouter.use('/catalog', await catalog(catalogEnv));
   apiRouter.use('/events', await events(eventsEnv));
   apiRouter.use('/scaffolder', await scaffolder(scaffolderEnv));
-  apiRouter.use('/auth', await auth(authEnv));
+  apiRouter.use('/auth', await authPlugin(authEnv));
   apiRouter.use('/search', await search(searchEnv));
   apiRouter.use('/techdocs', await techdocs(techdocsEnv));
   apiRouter.use('/kubernetes', await kubernetes(kubernetesEnv));

plugins/permission-node/package.json

@@ -56,7 +56,6 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.25.0",
     "@backstage/backend-plugin-api": "workspace:^",
     "@backstage/config": "workspace:^",
     "@backstage/errors": "workspace:^",

plugins/permission-node/report.api.md

@@ -29,7 +29,6 @@ import { PermissionsServiceRequestOptions } from '@backstage/backend-plugin-api'
 import { PolicyDecision } from '@backstage/plugin-permission-common';
 import { QueryPermissionRequest } from '@backstage/plugin-permission-common';
 import { ResourcePermission } from '@backstage/plugin-permission-common';
-import { TokenManager } from '@backstage/backend-common';
 import { z } from 'zod';
 
 // @public
@@ -385,8 +384,7 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      tokenManager?: TokenManager;
-      auth?: AuthService;
+      auth: AuthService;
     },
   ): ServerPermissionClient;
 }

plugins/permission-node/src/ServerPermissionClient.ts

@@ -14,10 +14,6 @@
  * limitations under the License.
  */
 
-import {
-  TokenManager,
-  createLegacyAuthAdapters,
-} from '@backstage/backend-common';
 import {
   AuthService,
   BackstageCredentials,
@@ -53,28 +49,14 @@ export class ServerPermissionClient implements PermissionsService {
     config: Config,
     options: {
       discovery: DiscoveryService;
-      /** @deprecated This option will be removed in the future, provide a the auth option instead */
-      tokenManager?: TokenManager;
-      auth?: AuthService;
+      auth: AuthService;
     },
   ) {
-    const { discovery, tokenManager } = options;
+    const { auth, discovery } = options;
     const permissionClient = new PermissionClient({ discovery, config });
     const permissionEnabled =
       config.getOptionalBoolean('permission.enabled') ?? false;
 
-    if (
-      permissionEnabled &&
-      tokenManager &&
-      (tokenManager as any).isInsecureServerTokenManager
-    ) {
-      throw new Error(
-        'Service-to-service authentication must be configured before enabling permissions. Read more here https://backstage.io/docs/auth/service-to-service-auth',
-      );
-    }
-
-    const { auth } = createLegacyAuthAdapters(options);
-
     return new ServerPermissionClient({
       auth,
       permissionClient,

yarn.lock

@@ -7396,7 +7396,6 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "@backstage/plugin-permission-node@workspace:plugins/permission-node"
   dependencies:
-    "@backstage/backend-common": ^0.25.0
     "@backstage/backend-defaults": "workspace:^"
     "@backstage/backend-plugin-api": "workspace:^"
     "@backstage/backend-test-utils": "workspace:^"