backend-{plugin,app}-api: refactored HttpAuth to separate allowing principals from auth method

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Carl-Erik Bergström <cbergstrom@spotify.com>
Co-authored-by: blam <ben@blam.sh>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/backend-plugin-api/api-report.md

@@ -101,15 +101,6 @@ export type BackstageCredentials<TPrincipal = unknown> = {
   principal: TPrincipal;
 };
 
-// @public (undocumented)
-export type BackstageHttpAccessToPrincipalTypesMapping = {
-  user: BackstageUserPrincipal;
-  'user-cookie': BackstageUserPrincipal;
-  service: BackstageServicePrincipal;
-  unauthenticated: BackstageNonePrincipal;
-  unknown: unknown;
-};
-
 // @public (undocumented)
 export type BackstageNonePrincipal = {
   type: 'none';
@@ -119,6 +110,8 @@ export type BackstageNonePrincipal = {
 export type BackstagePrincipalTypes = {
   user: BackstageUserPrincipal;
   service: BackstageServicePrincipal;
+  unauthenticated: BackstageNonePrincipal;
+  unknown: unknown;
 };
 
 // @public (undocumented)
@@ -293,16 +286,13 @@ export interface ExtensionPointConfig {
 // @public (undocumented)
 export interface HttpAuthService {
   // (undocumented)
-  credentials<
-    TAllowed extends keyof BackstageHttpAccessToPrincipalTypesMapping = 'unknown',
-  >(
+  credentials<TAllowed extends keyof BackstagePrincipalTypes = 'unknown'>(
     req: Request_2,
     options?: {
-      allow: Array<TAllowed>;
+      allow?: Array<TAllowed>;
+      allowedAuthMethods?: Array<'token' | 'cookie'>;
     },
-  ): Promise<
-    BackstageCredentials<BackstageHttpAccessToPrincipalTypesMapping[TAllowed]>
-  >;
+  ): Promise<BackstageCredentials<BackstagePrincipalTypes[TAllowed]>>;
   // (undocumented)
   issueUserCookie(res: Response_2): Promise<void>;
   // (undocumented)

packages/backend-plugin-api/src/services/definitions/AuthService.ts

@@ -55,6 +55,8 @@ export type BackstageCredentials<TPrincipal = unknown> = {
 export type BackstagePrincipalTypes = {
   user: BackstageUserPrincipal;
   service: BackstageServicePrincipal;
+  unauthenticated: BackstageNonePrincipal;
+  unknown: unknown;
 };
 
 /**

packages/backend-plugin-api/src/services/definitions/HttpAuthService.ts

@@ -15,33 +15,17 @@
  */
 
 import { Request, Response } from 'express';
-import {
-  BackstageCredentials,
-  BackstageServicePrincipal,
-  BackstageNonePrincipal,
-  BackstageUserPrincipal,
-} from './AuthService';
-
-/** @public */
-export type BackstageHttpAccessToPrincipalTypesMapping = {
-  user: BackstageUserPrincipal;
-  'user-cookie': BackstageUserPrincipal;
-  service: BackstageServicePrincipal;
-  unauthenticated: BackstageNonePrincipal;
-  unknown: unknown;
-};
+import { BackstageCredentials, BackstagePrincipalTypes } from './AuthService';
 
 /** @public */
 export interface HttpAuthService {
-  credentials<
-    TAllowed extends
-      | keyof BackstageHttpAccessToPrincipalTypesMapping = 'unknown',
-  >(
+  credentials<TAllowed extends keyof BackstagePrincipalTypes = 'unknown'>(
     req: Request,
-    options?: { allow: Array<TAllowed> },
-  ): Promise<
-    BackstageCredentials<BackstageHttpAccessToPrincipalTypesMapping[TAllowed]>
-  >;
+    options?: {
+      allow?: Array<TAllowed>;
+      allowedAuthMethods?: Array<'token' | 'cookie'>;
+    },
+  ): Promise<BackstageCredentials<BackstagePrincipalTypes[TAllowed]>>;
 
   requestHeaders(options: {
     forward: BackstageCredentials;

packages/backend-plugin-api/src/services/definitions/index.ts

@@ -35,10 +35,7 @@ export type {
   HttpRouterService,
   HttpRouterServiceAuthPolicy,
 } from './HttpRouterService';
-export type {
-  HttpAuthService,
-  BackstageHttpAccessToPrincipalTypesMapping,
-} from './HttpAuthService';
+export type { HttpAuthService } from './HttpAuthService';
 export type {
   LifecycleService,
   LifecycleServiceStartupHook,