From 3c3fafb5cbc592550b0fff53b9751610f5243ce0 Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Wed, 10 Apr 2024 11:50:07 +0200 Subject: [PATCH 1/4] permission-node: fix target plugin id Signed-off-by: Vincenzo Scamporlino --- plugins/permission-node/src/ServerPermissionClient.test.ts | 4 ++-- plugins/permission-node/src/ServerPermissionClient.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/permission-node/src/ServerPermissionClient.test.ts b/plugins/permission-node/src/ServerPermissionClient.test.ts index 29a5648c70..8f050bcfff 100644 --- a/plugins/permission-node/src/ServerPermissionClient.test.ts +++ b/plugins/permission-node/src/ServerPermissionClient.test.ts @@ -277,7 +277,7 @@ describe('ServerPermissionClient', () => { ).toBe( mockCredentials.service.header({ onBehalfOf: mockCredentials.user(), - targetPluginId: 'permissions', + targetPluginId: 'permission', }), ); }); @@ -357,7 +357,7 @@ describe('ServerPermissionClient', () => { ).toBe( mockCredentials.service.header({ onBehalfOf: mockCredentials.user(), - targetPluginId: 'permissions', + targetPluginId: 'permission', }), ); }); diff --git a/plugins/permission-node/src/ServerPermissionClient.ts b/plugins/permission-node/src/ServerPermissionClient.ts index 05202caf70..f8570fee74 100644 --- a/plugins/permission-node/src/ServerPermissionClient.ts +++ b/plugins/permission-node/src/ServerPermissionClient.ts @@ -123,7 +123,7 @@ export class ServerPermissionClient implements PermissionsService { return this.#auth.getPluginRequestToken({ onBehalfOf: options.credentials, - targetPluginId: 'permissions', + targetPluginId: 'permission', }); } From e20ff0017a02c71ef6ed5424e747027d739c112b Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Wed, 10 Apr 2024 11:51:09 +0200 Subject: [PATCH 2/4] backend-app-api: improve obo not supported error Signed-off-by: Vincenzo Scamporlino --- .../services/implementations/auth/authServiceFactory.test.ts | 2 +- .../src/services/implementations/auth/authServiceFactory.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.test.ts b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.test.ts index f1e5e836e1..812657ad32 100644 --- a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.test.ts +++ b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.test.ts @@ -384,7 +384,7 @@ describe('authServiceFactory', () => { targetPluginId: 'kubernetes', }), ).rejects.toThrow( - "Unable to call 'kubernetes' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens", + "Unable to call 'kubernetes' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens or the plugin doesn't exist", ); }); }); diff --git a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts index f1afd14d29..44eacbfc5d 100644 --- a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts @@ -240,7 +240,7 @@ class DefaultAuthService implements AuthService { if (this.userTokenHandler.isLimitedUserToken(token)) { throw new AuthenticationError( - `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens`, + `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens or the plugin doesn't exist`, ); } return { token }; From 56f81b588e6335deb1bcc086b488b0e0ab39dd30 Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Wed, 10 Apr 2024 12:11:11 +0200 Subject: [PATCH 3/4] backend-app-api: error message changeset Signed-off-by: Vincenzo Scamporlino --- .changeset/sixty-impalas-admire.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/sixty-impalas-admire.md diff --git a/.changeset/sixty-impalas-admire.md b/.changeset/sixty-impalas-admire.md new file mode 100644 index 0000000000..5d8e9055b5 --- /dev/null +++ b/.changeset/sixty-impalas-admire.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-app-api': patch +--- + +Improved error message thrown by `AuthService` when requesting a token for plugins that don't support the new authentication tokens. From 29fa05b2e65dad41605db14352b5ba45b4e449df Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Wed, 10 Apr 2024 12:11:36 +0200 Subject: [PATCH 4/4] permission-node: changeset obo fix Signed-off-by: Vincenzo Scamporlino --- .changeset/eleven-apricots-wave.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/eleven-apricots-wave.md diff --git a/.changeset/eleven-apricots-wave.md b/.changeset/eleven-apricots-wave.md new file mode 100644 index 0000000000..7abd44bf1c --- /dev/null +++ b/.changeset/eleven-apricots-wave.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-permission-node': patch +--- + +Fixed an issue causing `ServerPermissionClient` to generate an invalid token for authorizing permissions against the permission backend.