Merge pull request #24145 from backstage/fix/permission-obo

ServerPermissionClient: fix targetPluginId

.changeset/eleven-apricots-wave.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-permission-node': patch
+---
+
+Fixed an issue causing `ServerPermissionClient` to generate an invalid token for authorizing permissions against the permission backend.

.changeset/sixty-impalas-admire.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Improved error message thrown by `AuthService` when requesting a token for plugins that don't support the new authentication tokens.

packages/backend-app-api/src/services/implementations/auth/authServiceFactory.test.ts

@@ -384,7 +384,7 @@ describe('authServiceFactory', () => {
         targetPluginId: 'kubernetes',
       }),
     ).rejects.toThrow(
-      "Unable to call 'kubernetes' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens",
+      "Unable to call 'kubernetes' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens or the plugin doesn't exist",
     );
   });
 });

packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts

@@ -240,7 +240,7 @@ class DefaultAuthService implements AuthService {
 
         if (this.userTokenHandler.isLimitedUserToken(token)) {
           throw new AuthenticationError(
-            `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens`,
+            `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens or the plugin doesn't exist`,
           );
         }
         return { token };

plugins/permission-node/src/ServerPermissionClient.test.ts

@@ -277,7 +277,7 @@ describe('ServerPermissionClient', () => {
         ).toBe(
           mockCredentials.service.header({
             onBehalfOf: mockCredentials.user(),
-            targetPluginId: 'permissions',
+            targetPluginId: 'permission',
           }),
         );
       });
@@ -357,7 +357,7 @@ describe('ServerPermissionClient', () => {
         ).toBe(
           mockCredentials.service.header({
             onBehalfOf: mockCredentials.user(),
-            targetPluginId: 'permissions',
+            targetPluginId: 'permission',
           }),
         );
       });

plugins/permission-node/src/ServerPermissionClient.ts

@@ -123,7 +123,7 @@ export class ServerPermissionClient implements PermissionsService {
 
       return this.#auth.getPluginRequestToken({
         onBehalfOf: options.credentials,
-        targetPluginId: 'permissions',
+        targetPluginId: 'permission',
       });
     }