` tags to avoid word break.
diff --git a/.changeset/thick-pillows-develop.md b/.changeset/thick-pillows-develop.md
new file mode 100644
index 0000000000..9be71da55d
--- /dev/null
+++ b/.changeset/thick-pillows-develop.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-tech-insights-backend': patch
+---
+
+Added support for the new `AuthService`.
diff --git a/.changeset/thick-pillows-punch.md b/.changeset/thick-pillows-punch.md
deleted file mode 100644
index def589d3f8..0000000000
--- a/.changeset/thick-pillows-punch.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-scaffolder-node': patch
----
-
-Add gitea as new type to be used from integrations configuration
diff --git a/.changeset/thin-spiders-do.md b/.changeset/thin-spiders-do.md
new file mode 100644
index 0000000000..df8672fd6c
--- /dev/null
+++ b/.changeset/thin-spiders-do.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-backstage-openapi': patch
+---
+
+Migrated to use new auth service.
diff --git a/.changeset/thin-turtles-float.md b/.changeset/thin-turtles-float.md
deleted file mode 100644
index 7416093e17..0000000000
--- a/.changeset/thin-turtles-float.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-kubernetes-backend': patch
----
-
-Clusters in the catalog can now specify a human-readable title via `metadata.title`.
diff --git a/.changeset/thirty-bags-try.md b/.changeset/thirty-bags-try.md
deleted file mode 100644
index 98d6c5620b..0000000000
--- a/.changeset/thirty-bags-try.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-'@backstage/plugin-catalog-backend': minor
-'@backstage/plugin-catalog-node': minor
----
-
-Adds support for supplying field validators to the new backend's catalog plugin. If you're using entity policies, you should use the new `transformLegacyPolicyToProcessor` function to install them as processors instead.
-
-```ts
-import {
- catalogProcessingExtensionPoint,
- catalogModelExtensionPoint,
-} from '@backstage/plugin-catalog-node/alpha';
-import {myPolicy} from './my-policy';
-
-export const catalogModulePolicyProvider = createBackendModule({
- pluginId: 'catalog',
- moduleId: 'internal-policy-provider',
- register(reg) {
- reg.registerInit({
- deps: {
- modelExtensions: catalogModelExtensionPoint,
- processingExtensions: catalogProcessingExtensionPoint,
- },
- async init({ modelExtensions, processingExtensions }) {
- modelExtensions.setFieldValidators({
- ...
- });
- processingExtensions.addProcessors(transformLegacyPolicyToProcessor(myPolicy))
- },
- });
- },
-});
-```
diff --git a/.changeset/thirty-bikes-stare.md b/.changeset/thirty-bikes-stare.md
new file mode 100644
index 0000000000..d8249299a7
--- /dev/null
+++ b/.changeset/thirty-bikes-stare.md
@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-scaffolder-node-test-utils': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/plugin-scaffolder-node': patch
+---
+
+Made "checkpoint" on scaffolder action context non-optional
diff --git a/.changeset/thirty-dolls-admire.md b/.changeset/thirty-dolls-admire.md
deleted file mode 100644
index 1011508a98..0000000000
--- a/.changeset/thirty-dolls-admire.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-catalog-backend-module-github': minor
----
-
-Prevent Entity Providers from eliminating Users and Groups from the DB when the synchronisation fails
diff --git a/.changeset/thirty-shirts-allow.md b/.changeset/thirty-shirts-allow.md
new file mode 100644
index 0000000000..b84a3a621e
--- /dev/null
+++ b/.changeset/thirty-shirts-allow.md
@@ -0,0 +1,7 @@
+---
+'@backstage/backend-common': patch
+---
+
+Added a `createLegacyAuthAdapters` function that can be used as a compatibility adapter for backend plugins who want to start using the new [`auth`](https://backstage.io/docs/backend-system/core-services/auth/) and [`httpAuth`](https://backstage.io/docs/backend-system/core-services/http-auth) services that were created as part of [BEP-0003](https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution).
+
+See the [Auth Service Migration tutorial](https://backstage.io/docs/tutorials/auth-service-migration) for more information on the usage of this adapter.
diff --git a/.changeset/tidy-cooks-mix.md b/.changeset/tidy-cooks-mix.md
deleted file mode 100644
index 873de64a45..0000000000
--- a/.changeset/tidy-cooks-mix.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-'@backstage/plugin-azure-sites-backend': patch
-'@backstage/plugin-azure-sites-common': patch
-'@backstage/plugin-azure-sites': patch
----
-
-Azure Sites `start` and `stop` action is now protected with the Permissions framework.
-
-The below example describes an action that forbids anyone but the owner of the catalog entity to trigger actions towards a site tied to an entity.
-
-```typescript
- // packages/backend/src/plugins/permission.ts
- import { azureSitesActionPermission } from '@backstage/plugin-azure-sites-common';
- ...
- class TestPermissionPolicy implements PermissionPolicy {
- async handle(request: PolicyQuery, user?: BackstageIdentityResponse): Promise {
- if (isPermission(request.permission, azureSitesActionPermission)) {
- return createCatalogConditionalDecision(
- request.permission,
- catalogConditions.isEntityOwner({
- claims: user?.identity.ownershipEntityRefs ?? [],
- }),
- );
- }
- ...
- return {
- result: AuthorizeResult.ALLOW,
- };
- }
- ...
- }
-```
diff --git a/.changeset/tidy-cooks-mixed.md b/.changeset/tidy-cooks-mixed.md
deleted file mode 100644
index a72f1ee0df..0000000000
--- a/.changeset/tidy-cooks-mixed.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-'@backstage/plugin-azure-sites-backend': minor
----
-
-**BREAKING**: `catalogApi` and `permissionsApi` are now a requirement to be passed through to the `createRouter` function.
-
-You can fix the typescript issues by passing through the required dependencies like the below `diff` shows:
-
-```diff
- import {
- createRouter,
- AzureSitesApi,
- } from '@backstage/plugin-azure-sites-backend';
- import { Router } from 'express';
- import { PluginEnvironment } from '../types';
-
- export default async function createPlugin(
- env: PluginEnvironment,
- ): Promise {
-+ const catalogClient = new CatalogClient({
-+ discoveryApi: env.discovery,
-+ });
-
- return await createRouter({
- logger: env.logger,
- azureSitesApi: AzureSitesApi.fromConfig(env.config),
-+ catalogApi: catalogClient,
-+ permissionsApi: env.permissions,
- });
- }
-```
diff --git a/.changeset/tidy-cycles-obey.md b/.changeset/tidy-cycles-obey.md
deleted file mode 100644
index 4a002269e1..0000000000
--- a/.changeset/tidy-cycles-obey.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@backstage/plugin-scaffolder-react': patch
-'@backstage/plugin-scaffolder': patch
----
-
-Remove unused deps
diff --git a/.changeset/tidy-peaches-nail.md b/.changeset/tidy-peaches-nail.md
deleted file mode 100644
index d044a6bfaa..0000000000
--- a/.changeset/tidy-peaches-nail.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-kubernetes-backend': patch
----
-
-Clusters in the app-config can now specify a `title` property for human readability.
diff --git a/.changeset/tiny-books-destroy.md b/.changeset/tiny-books-destroy.md
new file mode 100644
index 0000000000..2516080ec5
--- /dev/null
+++ b/.changeset/tiny-books-destroy.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Add index for original value in search table for faster entity facet response
diff --git a/.changeset/tiny-bugs-enjoy.md b/.changeset/tiny-bugs-enjoy.md
new file mode 100644
index 0000000000..963ccc2a1f
--- /dev/null
+++ b/.changeset/tiny-bugs-enjoy.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-adr-backend': patch
+---
+
+Migrated `DefaultAdrCollatorFactory` to support new auth services.
diff --git a/.changeset/tiny-donuts-drive.md b/.changeset/tiny-donuts-drive.md
deleted file mode 100644
index aadac7a276..0000000000
--- a/.changeset/tiny-donuts-drive.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@backstage/plugin-kubernetes-backend': patch
----
-
-Backstage will log a warning whenever duplicate cluster names are detected --
-even if clusters sharing the same name come from separate locators.
diff --git a/.changeset/tiny-kiwis-know.md b/.changeset/tiny-kiwis-know.md
deleted file mode 100644
index add4736527..0000000000
--- a/.changeset/tiny-kiwis-know.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/cli': patch
----
-
-Updated dependencies in frontend plugin templates
diff --git a/.changeset/tough-drinks-scream.md b/.changeset/tough-drinks-scream.md
deleted file mode 100644
index 3d2f154016..0000000000
--- a/.changeset/tough-drinks-scream.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-'@backstage/plugin-cloudbuild': minor
----
-
-Changed build list view to automatically filter builds based on repository name matching component-info's metadata.name.
-Added optional `google.com/cloudbuild-repo-name` annotation which allows you to specify a different repository to filter on.
-Added optional `google.com/cloudbuild-trigger-name` annotation which allows you to filter based on a trigger name instead of a repo name.
-Updated the ReadMe with information about the filtering and some other minor verbiage updates.
-Changed `substitutions.BRANCH_NAME` to `substitutions.REF_NAME` so that the Ref field is populated properly.
-Added optional `google.com/cloudbuild-location` annotation which allows you to specify the Cloud Build location of your builds. Default is global scope.
-Changed build list view to show builds in a specific location if the location annotation is used.
-Updated ReadMe with information about the use of the location filtering.
diff --git a/.changeset/tricky-months-hug.md b/.changeset/tricky-months-hug.md
new file mode 100644
index 0000000000..ae1bd85532
--- /dev/null
+++ b/.changeset/tricky-months-hug.md
@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-auth-backend-module-oauth2-proxy-provider': patch
+'@backstage/plugin-auth-backend-module-aws-alb-provider': patch
+'@backstage/plugin-auth-backend-module-gcp-iap-provider': patch
+'@backstage/plugin-auth-node': patch
+---
+
+Fix issue with `providerInfo` not being set properly for some proxy providers, by making `providerInfo` an explicit optional return from `authenticate`
diff --git a/.changeset/twelve-berries-cross.md b/.changeset/twelve-berries-cross.md
new file mode 100644
index 0000000000..9862f465d2
--- /dev/null
+++ b/.changeset/twelve-berries-cross.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Make sure to not filter out schemas in `createConfigSecretEnumerator`
diff --git a/.changeset/twelve-hounds-know.md b/.changeset/twelve-hounds-know.md
deleted file mode 100644
index 3c95c71ddb..0000000000
--- a/.changeset/twelve-hounds-know.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-scaffolder-react': minor
----
-
-Use more distinguishable icons for link (`Link`) and text output (`Description`).
diff --git a/.changeset/twelve-pens-rescue.md b/.changeset/twelve-pens-rescue.md
deleted file mode 100644
index 9d40fb2851..0000000000
--- a/.changeset/twelve-pens-rescue.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@backstage/frontend-plugin-api': patch
-'@backstage/frontend-app-api': patch
-'@backstage/core-compat-api': patch
----
-
-Allow external route refs in the new system to have a `defaultTarget` pointing to a route that it'll resolve to by default if no explicit bindings were made by the adopter.
diff --git a/.changeset/twelve-shirts-buy.md b/.changeset/twelve-shirts-buy.md
deleted file mode 100644
index 6183c7dabd..0000000000
--- a/.changeset/twelve-shirts-buy.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-'@backstage/plugin-catalog-backend': patch
-'@backstage/plugin-catalog-node': patch
----
-
-Add support for `onProcessingError` handler at the catalog plugin (new backend system).
-
-You can use `setOnProcessingErrorHandler` at the `catalogProcessingExtensionPoint`
-as replacement for
-
-```ts
-catalogBuilder.subscribe({
- onProcessingError: hander,
-});
-```
diff --git a/.changeset/twelve-weeks-march.md b/.changeset/twelve-weeks-march.md
deleted file mode 100644
index 4d9fff5b34..0000000000
--- a/.changeset/twelve-weeks-march.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-scaffolder-react': patch
----
-
-Fix issue where `ui:schema` was replaced with an empty object if `dependencies` is defined
diff --git a/.changeset/twenty-taxis-mate.md b/.changeset/twenty-taxis-mate.md
deleted file mode 100644
index 65ed158e9b..0000000000
--- a/.changeset/twenty-taxis-mate.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/core-compat-api': patch
----
-
-Plugins converted by `convertLegacyApp` now have their `routes` and `externalRoutes` included as well, allowing them to be used to bind external routes in configuration.
diff --git a/.changeset/two-coats-smile.md b/.changeset/two-coats-smile.md
deleted file mode 100644
index 65abb7a1eb..0000000000
--- a/.changeset/two-coats-smile.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/cli': patch
----
-
-Updated the backend module template to make the module instance the package default export.
diff --git a/.changeset/two-geese-explain.md b/.changeset/two-geese-explain.md
deleted file mode 100644
index 12ae307cfe..0000000000
--- a/.changeset/two-geese-explain.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/cli': patch
----
-
-Fixed an issue that would cause an invalid `__backstage-autodetected-plugins__.js` to be written when using experimental module discovery.
diff --git a/.changeset/two-planets-beam.md b/.changeset/two-planets-beam.md
new file mode 100644
index 0000000000..d500d22853
--- /dev/null
+++ b/.changeset/two-planets-beam.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-kubernetes-common': patch
+'@backstage/plugin-kubernetes-react': patch
+---
+
+Add support to fetch data for Daemon Sets and display an accordion in the same way as with Deployments
diff --git a/.changeset/two-singers-learn.md b/.changeset/two-singers-learn.md
deleted file mode 100644
index f5c2a78ab0..0000000000
--- a/.changeset/two-singers-learn.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-devtools': patch
----
-
-Added alpha support for the New Frontend System (Declarative Integration)
diff --git a/.changeset/two-snails-fry.md b/.changeset/two-snails-fry.md
new file mode 100644
index 0000000000..979134f98e
--- /dev/null
+++ b/.changeset/two-snails-fry.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-badges-backend': patch
+---
+
+Migrated to support new auth services.
diff --git a/.changeset/unlucky-jobs-report.md b/.changeset/unlucky-jobs-report.md
new file mode 100644
index 0000000000..4eab12d53e
--- /dev/null
+++ b/.changeset/unlucky-jobs-report.md
@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-permission-backend': patch
+---
+
+Migrated to use the new auth services introduced in [BEP-0003](https://github.com/backstage/backstage/blob/master/beps/0003-auth-architecture-evolution/README.md).
+
+The `createRouter` function now accepts `auth`, `httpAuth` and `userInfo` options. Theses are used internally to support the new backend system, and can be ignored.
diff --git a/.changeset/unlucky-lizards-suffer.md b/.changeset/unlucky-lizards-suffer.md
new file mode 100644
index 0000000000..15862e1736
--- /dev/null
+++ b/.changeset/unlucky-lizards-suffer.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-cicd-statistics-module-gitlab': patch
+'@backstage/plugin-github-pull-requests-board': patch
+---
+
+Align `p-limit` dependency version to v3
diff --git a/.changeset/unlucky-pens-search.md b/.changeset/unlucky-pens-search.md
deleted file mode 100644
index 4786c14691..0000000000
--- a/.changeset/unlucky-pens-search.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@backstage/plugin-scaffolder-backend': patch
----
-
-When using node 20+ the `scaffolder-backend` will now throw an error at startup if the `--no-node-snapshot` option was
-not provided to node.
diff --git a/.changeset/unlucky-wasps-tan.md b/.changeset/unlucky-wasps-tan.md
deleted file mode 100644
index 97813cb416..0000000000
--- a/.changeset/unlucky-wasps-tan.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-scaffolder-backend-module-bitbucket': patch
----
-
-Enhanced the pull request action to allow for adding new content to the PR as described in this issue #21762
diff --git a/.changeset/violet-rocks-rescue.md b/.changeset/violet-rocks-rescue.md
new file mode 100644
index 0000000000..91fbcdd871
--- /dev/null
+++ b/.changeset/violet-rocks-rescue.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend-node': patch
+---
+
+Exports `QueryTranslator`, `QueryRequestOptions` and `SearchEngine` types. These new types were extracted from the `@backstage/plugin-search-common` package and the `token` property was deprecated in favor of the a new credentials one.
diff --git a/.changeset/warm-maps-scream.md b/.changeset/warm-maps-scream.md
deleted file mode 100644
index 3ea5d93b03..0000000000
--- a/.changeset/warm-maps-scream.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@backstage/plugin-azure-devops': patch
-'@backstage/plugin-devtools': patch
-'@backstage/plugin-linguist': patch
----
-
-Updated imports from named to default imports to help with the Material UI v4 to v5 migration
diff --git a/.changeset/weak-flowers-repeat.md b/.changeset/weak-flowers-repeat.md
deleted file mode 100644
index d1705343bc..0000000000
--- a/.changeset/weak-flowers-repeat.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@backstage/plugin-scaffolder-backend-module-gitea': patch
----
-
-- Fix issue for infinite loop when repository already exists
-- Log the root cause of error reported by `checkGiteaOrg`
diff --git a/.changeset/weak-news-jam.md b/.changeset/weak-news-jam.md
deleted file mode 100644
index a1f44082da..0000000000
--- a/.changeset/weak-news-jam.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/plugin-scaffolder-react': patch
----
-
-Fix bug that erroneously caused a separator or a 0 to render in the TemplateCard for Templates with empty links
diff --git a/.changeset/wet-emus-work.md b/.changeset/wet-emus-work.md
deleted file mode 100644
index 413670a325..0000000000
--- a/.changeset/wet-emus-work.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/core-compat-api': patch
----
-
-collectLegacyRoutes throws in case invalid ' or 'external:'
subject: string;
@@ -110,6 +110,8 @@ export type BackstageServicePrincipal = {
export type BackstageCredentials = {
$$type: '@backstage/BackstageCredentials';
+ expiresAt?: Date;
+
principal: TPrincipal;
};
@@ -120,13 +122,20 @@ export type BackstagePrincipalTypes = {
};
export interface AuthService {
- authenticate(token: string): Promise;
+ authenticate(
+ token: string,
+ options?: {
+ allowLimitedAccess?: boolean;
+ },
+ ): Promise;
isPrincipal(
credentials: BackstageCredentials,
type: TType,
): credentials is BackstageCredentials;
+ getNoneCredentials(): Promise>;
+
getOwnServiceCredentials(): Promise<
BackstageCredentials
>;
@@ -135,6 +144,10 @@ export interface AuthService {
onBehalfOf: BackstageCredentials;
targetPluginId: string;
}): Promise<{ token: string }>;
+
+ getLimitedUserToken(
+ credentials: BackstageCredentials,
+ ): Promise<{ token: string; expiresAt: Date }>;
}
```
@@ -149,6 +162,7 @@ export interface BackstageUserInfo {
}
export interface UserInfoService {
+ // The implementation of this method should support both regular and limited user credentials
getUserInfo(credentials: BackstageCredentials): Promise;
}
```
@@ -159,7 +173,7 @@ The `UserInfoService` is exported by `@backstage/auth-node`, and the initial imp
> Open question: Should this instead be added to the `HttpAuthService`? It may fit a bit better there, but on the other hand it might make sense to add additional policies unrelated to authentication too, such as rate limiting.
-The `HttpRouterService` interface will be extended with the ability to opt-out of the default protection of endpoints, enabling either cookie auth or unauthenticated access.
+The `HttpRouterService` interface will be extended with the ability to opt-out of the default protection of endpoints, enabling cookie or unauthenticated access.
```ts
export interface HttpRouterServiceAuthPolicy {
@@ -201,7 +215,7 @@ export default createBackendPlugin({
This is expected to be the pattern for the vast majority of plugins.
-#### A plugin with an endpoint that only allows cookie auth
+#### A plugin with a cookie-based authentication endpoint
```ts
export default createBackendPlugin({
@@ -209,11 +223,25 @@ export default createBackendPlugin({
register(env) {
env.registerInit({
deps: {
+ auth: coreServices.auth,
+ httpAuth: coreServices.httpAuth,
http: coreServices.httpRouter,
},
- async init({ http }) {
+ async init({ auth, httpAuth, http }) {
+ const router = Router();
+
+ // Endpoint that sets the cookie for the user
+ router.get('/cookie', async (req, res) => {
+ const { expiresAt } = await httpAuth.issueUserCookie(res);
+
+ res.json({ expiresAt: expiresAt.toISOString() });
+ });
+
+ // Endpoint protected by cookie auth
+ router.get('/static', express.static(/* ... */));
+
// The order of these two calls does not matter
- http.use(await createRouter(/* ... */));
+ http.use(router);
http.addAuthPolicy({
path: '/static',
allow: 'user-cookie',
@@ -224,7 +252,7 @@ export default createBackendPlugin({
});
```
-#### A plugin that allows both public access and cookie auth
+#### A plugin that disabled the default auth policy and handles auth by itself
```ts
export default createBackendPlugin({
@@ -236,15 +264,8 @@ export default createBackendPlugin({
},
async init({ http }) {
http.use(await createRouter(/* ... */));
-
http.addAuthPolicy({
path: '/',
- allow: 'user-cookie',
- });
-
- // Unauthenticated access takes precedence, the /public endpoint does not require cookie auth
- http.addAuthPolicy({
- path: '/public',
allow: 'unauthenticated',
});
},
@@ -274,16 +295,19 @@ export interface HttpAuthService {
req: Request,
options?: {
allow?: Array;
- allowedAuthMethods?: Array<'token' | 'cookie'>;
+ allowLimitedAccess?: boolean;
},
): Promise<
BackstageCredentials
>;
- // The cookie issued by this method must be consumable by the `credentials` method, which in turn
- // should create a credentials object that can be passed to the `getPluginRequestToken` method.
- // The issued token must then in turn be a valid token for a user principal with full access.
- issueUserCookie(res: Response): Promise;
+ issueUserCookie(
+ res: Response,
+ options?: {
+ // If credentials are not provided, they will be read from the request
+ credentials?: BackstageCredentials;
+ },
+ ): Promise<{ expiresAt: Date }>;
}
```
@@ -377,41 +401,22 @@ router.get('/read-data', (req, res) => {
});
```
-#### Issuing a cookie and allowing user cookie auth on a separate endpoint
+#### Using limited user tokens to access user info
```ts
-router.get('/cookie', async (req, res) => {
- await httpAuth.issueUserCookie(res); // If this is a service call it'll throw
- res.json({ ok: true });
+router.get('/read-data', (req, res) => {
+ const credentials = await httpAuth.credentials(req, {
+ allow: ['user'],
+ allowLimitedAccess: true,
+ });
+
+ const { userEntityRef, ownershipEntityRefs } = await userInfo.getUserInfo(
+ credentials,
+ );
+
+ console.log(`User ref=${userEntityRef} ownership=${ownershipEntityRefs}`);
+ // ...
});
-
-// Allowing cookie auth is a separate step where you call the addAuthPolicy method
-// of the httpRouter API in your plugin setup code.
-httpRouter.addAuthPolicy({
- path: '/static',
- allow: 'user-cookie',
-});
-
-// Separate endpoint that serves static content, allowing user cookie auth as
-// well as the default user and service auth methods
-router.use('/static', express.static(staticContentDir));
-```
-
-#### Passing along user identity from a cookie in an upstream request
-
-```ts
-router.get(
- '/read-data',
- httpAuth.middleware({ allow: ['user-cookie'] }),
- (req, res) => {
- const credentials = await httpAuth.credentials(req, { allow: ['user'] });
- const { ownershipEntityRefs } = await userInfo.getUserInfo(credentials);
- console.log(
- `User ref=${credentials.userEntityRef} ownership=${ownershipEntityRefs}`,
- );
- // ...
- },
-);
```
### Access Control Configuration
@@ -425,6 +430,79 @@ backend:
The exact impact that this has is that it disables the check in the `HttpRouterService` implementation, effectively applying the `unauthenticated` access level to all routes. Furthermore, it will also change `AuthService` so that the `getPluginRequestToken()` method will now issue an empty token for a `'none'` principal, rather than throwing.
+### Token Details
+
+Note that this section is NOT normative. It illustrates the token shapes and major token flows that are involved in this proposal, but intentionally leaves out some low level details and is subject to change.
+
+#### Backstage Identity Tokens
+
+These are the regular tokens, commonly in short referred to just as "Backstage Tokens", that the auth backend generates for the user during sign-in. These are sent along with calls to backend plugins to identify the user. This BEP does not aim to change the shape of these tokens; this section is only here for informative purposes to convey what pieces of information that are at play.
+
+This is a JWT token.
+
+```yaml
+# Header
+{
+ "alg": "ES256",
+ "kid": "4f5a0543-894a-4176-b0b7-699a7026b72f"
+}
+# Payload
+{
+ "iss": "http://localhost:7007/api/auth",
+ "sub": "user:default/example-user",
+ "ent": ["user:default/example-user", "group:default/my-team"],
+ "aud": "backstage",
+ "iat": 1708333140,
+ "exp": 1708336740
+}
+```
+
+The key ID is some random UUID. The `iss` (issuer) is the external base URL of your auth backend. Note that it uses the `ES256` asymmetric signature algorithm, and the auth backend exposes a JWKS that contains the public parts of the signing keys. The `sub` is an entity ref denoting who the signed in user is, and the `ent` is an array of entity refs that they claim ownership through. The `aud` (audience) is hardcoded to the string `"backstage"` always.
+
+#### Legacy Service Tokens
+
+These are the tokens that have been used for backend-to-backend communications before this BEP, and they will likely have changes as part of this work.
+
+This is a JWT token.
+
+```yaml
+# Header
+{
+ "alg": "HS256"
+}
+# Payload
+{
+ "sub": "backstage-server",
+ "exp": 1708337056
+}
+```
+
+Note that unlike the identity token in the previous section, it uses the `HS256` symmetric signature algorithm. The key used is the first of the `backend.auth.keys` entries in your `app-config`, which is a shared secret among all backend plugins, enabling them to know that the caller is a legitimate one. But the token does not contain any information about who the caller is (it's just a generic `"backstage-server"`), nor who the receiver (audience) is.
+
+#### New Cookie Token Flow
+
+Some plugins serve static content that the browser engine requests directly, e.g. the TechDocs plugin. Those calls cannot easily have a bearer token attached to them. For these use cases a cookie based flow will be used instead.
+
+
+
+The frontend part of the plugin ensures that a cookie endpoint on the backend part of the plugin is called before attempting to render static content. This endpoint validates the user's identity token and sets a corresponding cookie on the response. Subsequent requests for getting static content will automatically have this cookie attached to them by the browser.
+
+We intentionally do not specify here how the cookie token is acquired. It might be issued by the plugin itself or by the auth backend depending on how the architecture evolves, but this does not have any effect on plugin code.
+
+The cookie token contains the user's identifying information just like the identity cookie but is severely limited. It has the plugin itself specified as its audience. Thus, this token is not usable in any bearer token context, nor as a cookie toward any other plugin.
+
+#### New Service OBO Token Flow
+
+When a backend service needs to in turn make a request to another upstream service to fulfil the original request, it uses an On-Behalf-Of (OBO) token for the purpose.
+
+
+
+The initial request in this picture is a frontend plugin, but the same concept applies if it is initiated by a service. The scaffolder backend in this example acquires an OBO token to be able to talk to the catalog plugin.
+
+We intentionally do not specify here how the OBO token is acquired. It might be issued by the plugin itself or by the auth backend depending on how the architecture evolves, but this does not have any effect on plugin code.
+
+The OBO token specifies the target service as its audience and itself as the subject, but additionally also contains the original caller's identifying information. Thus, the target service can identify who the nearest caller is but also apply permissions that are relevant to the original caller. The token is thus scoped to not be usable toward other backend plugins.
+
## Release Plan
The existing `IdentityService` and `TokenManagerService` will be deprecated and instead implemented in terms of the new `AuthService`.
@@ -433,10 +511,11 @@ The new `AuthService` and `HttpAuthService` will need backwards compatible imple
The backwards compatibility helpers will have the following behavior for each individual service call:
-- `auth.authenticate(token)`: If the decoded token has the `backstage` audience, authenticate the token for a user principal using `identity.getIdentity(...)`, otherwise authenticate it using `tokenManager.authenticate(...)` and return a service principal with the subject `external:backstage-plugin`. If a no-op token manager is used then anything but a user token will be treated as a valid service token, which is consistent with existing behavior.
+- `auth.authenticate(token, options)`: If the decoded token has the `backstage` audience, authenticate the token for a user principal using `identity.getIdentity(...)`, otherwise authenticate it using `tokenManager.authenticate(...)` and return a service principal with the subject `external:backstage-plugin`. If a no-op token manager is used then anything but a user token will be treated as a valid service token, which is consistent with existing behavior. The limited access option is ignored.
- `auth.getOwnServiceCredentials()`: Use original implementation.
- `auth.isPrincipal()`: Use original implementation.
- `auth.getPluginRequestToken(options)`: Same behavior as the original implementation, using the `tokenManager` to issue service tokens, with the exception that a `none` principal will translate to an empty token rather than an error in order to properly forward calls with a no-op token manager.
+- `auth.getLimitedUserToken(credentials)`: This is a no-op and returns the underlying user token with full scope.
- `httpAuth.credentials(...)`: Use original implementation.
- `httpAuth.issueUserCookie(...)`: This is a no-op as we do not need to support cookie auth in the legacy adapter.
@@ -475,9 +554,9 @@ Cons:
- Can be extremely confusing because the top-level middleware for more lax access will also apply to the more strict access levels. For example
```ts
- const cookieRouter = Router();
- cookieRouter.use(rateLimit());
- http.useWithCookieAuthentication(cookieRouter);
+ const publicRouter = Router();
+ publicRouter.use(rateLimit());
+ http.useWithoutAuthentication(publicRouter);
const mainRouter = Router();
// rateLimit() will apply here too
@@ -487,7 +566,7 @@ Cons:
This applied to any similar way of structuring this API, such as a single `.use()` method with additional options:
```ts
-http.use(cookieRouter, { allow: ['user-cookie'] });
+http.use(publicRouter, { allow: ['unauthenticated'] });
```
#### Separate configuration on different paths for `use`
diff --git a/beps/0003-auth-architecture-evolution/token-sequence-cookie.drawio.svg b/beps/0003-auth-architecture-evolution/token-sequence-cookie.drawio.svg
new file mode 100644
index 0000000000..b20b528c35
--- /dev/null
+++ b/beps/0003-auth-architecture-evolution/token-sequence-cookie.drawio.svg
@@ -0,0 +1,203 @@
+
diff --git a/beps/0003-auth-architecture-evolution/token-sequence-obo.drawio.svg b/beps/0003-auth-architecture-evolution/token-sequence-obo.drawio.svg
new file mode 100644
index 0000000000..f337f8b572
--- /dev/null
+++ b/beps/0003-auth-architecture-evolution/token-sequence-obo.drawio.svg
@@ -0,0 +1,203 @@
+
diff --git a/beps/0004-scaffolder-task-idempotency/README.md b/beps/0004-scaffolder-task-idempotency/README.md
index a7e592af39..03569de3d6 100644
--- a/beps/0004-scaffolder-task-idempotency/README.md
+++ b/beps/0004-scaffolder-task-idempotency/README.md
@@ -4,7 +4,8 @@ status: provisional
authors:
- 'bnechyporenko@bol.com'
- 'benjaminl@spotify.com'
-owners:
+owners:
+ - @backstage/scaffolder-maintainers
project-areas:
- scaffolder
creation-date: 2024-01-31
@@ -153,7 +154,7 @@ export function createGithubRepoCreateAction(options: {
username: owner,
});
- await ctx.checkpoint('v1.task.checkpoint.repo.creation', async () => {
+ await ctx.checkpoint('repo.creation', async () => {
const repoCreationPromise =
user.data.type === 'Organization'
? client.rest.repos.createInOrg({
@@ -168,19 +169,16 @@ export function createGithubRepoCreateAction(options: {
});
if (secrets) {
- await ctx.checkpoint(
- 'v1.task.checkpoint.repo.create.variables',
- async () => {
- for (const [key, value] of Object.entries(repoVariables ?? {})) {
- await client.rest.actions.createRepoVariable({
- owner,
- repo,
- name: key,
- value: value,
- });
- }
- },
- );
+ await ctx.checkpoint('repo.create.variables', async () => {
+ for (const [key, value] of Object.entries(repoVariables ?? {})) {
+ await client.rest.actions.createRepoVariable({
+ owner,
+ repo,
+ name: key,
+ value: value,
+ });
+ }
+ });
}
ctx.output('remoteUrl', newRepo.clone_url);
@@ -204,7 +202,7 @@ Checkpoints will allow action authors to create actions where code paths are ign
This will be provided on a context object and action of author provide a key and a callback.
```typescript
-await ctx.checkpoint('v1.task.checkpoint.repo.creation', async () => {
+await ctx.checkpoint('repo.creation', async () => {
const { repoUrl } = await client.rest.Repository.create({});
return { repoUrl };
});
@@ -215,7 +213,7 @@ It's going look like:
```json
{
- "v1.task.checkpoint.repo.creation": {
+ "repo.creation": {
"status": "success",
"result": {
"repoUrl": "https://github.com/backstage/backstage.git"
@@ -224,6 +222,43 @@ It's going look like:
}
```
+or a failed attempt as:
+
+```json
+{
+ "repo.creation": {
+ "status": "failed",
+ "reason": "Namespace is not valid"
+ }
+}
+```
+
+DatabaseTaskStore will provide two extra methods `saveTaskState` and `getTaskState`. The type of state in API will be
+represented as `JsonObject`.
+
+Task state will be stored in the extra column `state` in the table `tasks` with the next structure:
+
+```json
+{
+ "state": {
+ "checkpoints": {
+ "repo.creation": {
+ "status": "success",
+ "result": {
+ "repoUrl": "https://github.com/backstage/backstage.git"
+ }
+ },
+ "repo.add.member": {
+ "status": "success",
+ "result": {
+ "id": "2345"
+ }
+ }
+ }
+ }
+}
+```
+
## Release Plan