azure-stes-backend: migrate to support new auth services

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

.changeset/healthy-experts-rhyme.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-azure-sites-backend': minor
+---
+
+**BREAKING**: The `createRouter` method now requires the `discovery` service to be forwarded from the plugin environment. This is part of the migration to support new auth services.

plugins/azure-sites-backend/api-report.md

@@ -3,14 +3,17 @@
 > Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
 
 ```ts
+import { AuthService } from '@backstage/backend-plugin-api';
 import { AzureSiteListRequest } from '@backstage/plugin-azure-sites-common';
 import { AzureSiteListResponse } from '@backstage/plugin-azure-sites-common';
 import { AzureSiteStartStopRequest } from '@backstage/plugin-azure-sites-common';
 import { CatalogApi } from '@backstage/catalog-client';
 import { Config } from '@backstage/config';
+import { DiscoveryService } from '@backstage/backend-plugin-api';
 import express from 'express';
+import { HttpAuthService } from '@backstage/backend-plugin-api';
 import { Logger } from 'winston';
-import { PermissionEvaluator } from '@backstage/plugin-permission-common';
+import { PermissionsService } from '@backstage/backend-plugin-api';
 
 // @public (undocumented)
 export class AzureSitesApi {
@@ -55,14 +58,20 @@ export function createRouter(options: RouterOptions): Promise<express.Router>;
 
 // @public (undocumented)
 export interface RouterOptions {
+  // (undocumented)
+  auth?: AuthService;
   // (undocumented)
   azureSitesApi: AzureSitesApi;
   // (undocumented)
   catalogApi: CatalogApi;
   // (undocumented)
+  discovery: DiscoveryService;
+  // (undocumented)
+  httpAuth?: HttpAuthService;
+  // (undocumented)
   logger: Logger;
   // (undocumented)
-  permissions: PermissionEvaluator;
+  permissions: PermissionsService;
 }
 
 // (No @packageDocumentation comment for this package)

plugins/azure-sites-backend/package.json

@@ -36,6 +36,7 @@
     "@azure/arm-resourcegraph": "^4.2.1",
     "@azure/identity": "^4.0.0",
     "@backstage/backend-common": "workspace:^",
+    "@backstage/backend-plugin-api": "workspace:^",
     "@backstage/catalog-client": "workspace:^",
     "@backstage/catalog-model": "workspace:^",
     "@backstage/config": "workspace:^",

plugins/azure-sites-backend/src/service/router.ts

@@ -14,17 +14,16 @@
  * limitations under the License.
  */
 
-import { errorHandler } from '@backstage/backend-common';
+import {
+  createLegacyAuthAdapters,
+  errorHandler,
+} from '@backstage/backend-common';
 import express from 'express';
 import Router from 'express-promise-router';
 import { Logger } from 'winston';
 
 import { InputError, NotAllowedError, NotFoundError } from '@backstage/errors';
-import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
-import {
-  PermissionEvaluator,
-  AuthorizeResult,
-} from '@backstage/plugin-permission-common';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
 import {
   azureSitesActionPermission,
   azureSitesPermissions,
@@ -34,13 +33,22 @@ import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-
 import { CatalogApi } from '@backstage/catalog-client';
 
 import { AzureSitesApi } from '../api';
+import {
+  DiscoveryService,
+  AuthService,
+  HttpAuthService,
+  PermissionsService,
+} from '@backstage/backend-plugin-api';
 
 /** @public */
 export interface RouterOptions {
   logger: Logger;
   azureSitesApi: AzureSitesApi;
   catalogApi: CatalogApi;
-  permissions: PermissionEvaluator;
+  permissions: PermissionsService;
+  discovery: DiscoveryService;
+  auth?: AuthService;
+  httpAuth?: HttpAuthService;
 }
 
 /** @public */
@@ -48,6 +56,7 @@ export async function createRouter(
   options: RouterOptions,
 ): Promise<express.Router> {
   const { logger, azureSitesApi, permissions, catalogApi } = options;
+  const { auth, httpAuth } = createLegacyAuthAdapters(options);
 
   const permissionIntegrationRouter = createPermissionIntegrationRouter({
     permissions: azureSitesPermissions,
@@ -73,13 +82,15 @@ export async function createRouter(
     '/:subscription/:resourceGroup/:name/start',
     async (request, response) => {
       const { subscription, resourceGroup, name } = request.params;
-      const token = getBearerTokenFromAuthorizationHeader(
-        request.header('authorization'),
-      );
+      const credentials = await httpAuth.credentials(request);
       const entityRef = request.body.entityRef;
       if (typeof entityRef !== 'string') {
         throw new InputError('Invalid entityRef, not a string');
       }
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: credentials,
+        targetPluginId: 'catalog',
+      });
       const entity = await catalogApi.getEntityByRef(entityRef, { token });
 
       if (entity) {
@@ -101,9 +112,7 @@ export async function createRouter(
                     resourceRef: entityRef,
                   },
                 ],
-                {
-                  token,
-                },
+                { credentials },
               )
             )[0]
           : undefined;
@@ -130,14 +139,16 @@ export async function createRouter(
     '/:subscription/:resourceGroup/:name/stop',
     async (request, response) => {
       const { subscription, resourceGroup, name } = request.params;
-      const token = getBearerTokenFromAuthorizationHeader(
-        request.header('authorization'),
-      );
+      const credentials = await httpAuth.credentials(request);
 
       const entityRef = request.body.entityRef;
       if (typeof entityRef !== 'string') {
         throw new InputError('Invalid entityRef, not a string');
       }
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: credentials,
+        targetPluginId: 'catalog',
+      });
       const entity = await catalogApi.getEntityByRef(entityRef, { token });
 
       if (entity) {
@@ -160,9 +171,7 @@ export async function createRouter(
                     resourceRef: entityRef,
                   },
                 ],
-                {
-                  token,
-                },
+                { credentials },
               )
             )[0]
           : undefined;

plugins/azure-sites-backend/src/service/standaloneServer.ts

@@ -53,6 +53,7 @@ export async function startStandaloneServer(
     permissions,
     azureSitesApi: AzureSitesApi.fromConfig(config),
     catalogApi,
+    discovery,
   });
 
   let service = createServiceBuilder(module)

yarn.lock

@@ -5001,6 +5001,7 @@ __metadata:
     "@azure/arm-resourcegraph": ^4.2.1
     "@azure/identity": ^4.0.0
     "@backstage/backend-common": "workspace:^"
+    "@backstage/backend-plugin-api": "workspace:^"
     "@backstage/catalog-client": "workspace:^"
     "@backstage/catalog-model": "workspace:^"
     "@backstage/cli": "workspace:^"