From 70c74edf1fa25c7bfeac8141b8b2003b418131f8 Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Mon, 25 Mar 2024 19:36:40 +0100
Subject: [PATCH] scaffolder-backend: add InternalTaskSecrets

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../src/scaffolder/tasks/StorageTaskBroker.ts       |  8 +++++---
 .../src/scaffolder/tasks/types.ts                   |  7 +++++++
 plugins/scaffolder-backend/src/service/router.ts    | 13 ++++++++-----
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.ts
index 29973e0e94..e9a408d9d6 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.ts
@@ -28,7 +28,7 @@ import {
   TaskCompletionState,
   TaskContext,
 } from '@backstage/plugin-scaffolder-node';
-import { TaskStore } from './types';
+import { InternalTaskSecrets, TaskStore } from './types';
 import { readDuration } from './helper';
 import {
   AuthService,
@@ -179,8 +179,10 @@ export class TaskManager implements TaskContext {
   }
 
   async getInitiatorCredentials(): Promise<BackstageCredentials> {
-    if (this.task.secrets && this.task.secrets.initiatorCredentials) {
-      return JSON.parse(this.task.secrets.initiatorCredentials);
+    const secrets = this.task.secrets as InternalTaskSecrets;
+
+    if (secrets && secrets.__initiatorCredentials) {
+      return JSON.parse(secrets.__initiatorCredentials);
     }
     if (!this.auth) {
       throw new Error(
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
index c0854af391..aa647d8bd6 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
@@ -228,3 +228,10 @@ export type TaskTrackType = {
     action: TemplateAction<JsonObject>,
   ) => Promise<void>;
 };
+
+/**
+ * @internal
+ */
+export type InternalTaskSecrets = TaskSecrets & {
+  __initiatorCredentials: string;
+};
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 50f6fc372f..43618ed5a7 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -88,6 +88,7 @@ import {
   IdentityApi,
   IdentityApiGetIdentityRequest,
 } from '@backstage/plugin-auth-node';
+import { InternalTaskSecrets } from '../scaffolder/tasks/types';
 
 /**
  *
@@ -523,14 +524,16 @@ export async function createRouter(
         },
       };
 
+      const secrets: InternalTaskSecrets = {
+        ...req.body.secrets,
+        backstageToken: token,
+        __initiatorCredentials: JSON.stringify(credentials),
+      };
+
       const result = await taskBroker.dispatch({
         spec: taskSpec,
         createdBy: userEntityRef,
-        secrets: {
-          ...req.body.secrets,
-          backstageToken: token,
-          initiatorCredentials: JSON.stringify(credentials),
-        },
+        secrets,
       });
 
       res.status(201).json({ id: result.taskId });