chore: removing token manager and adding backstage-server condition

Signed-off-by: Lucas Pires <lucas.tulio@grupoboticario.com.br>

.changeset/backend-token-authentication.md

@@ -2,4 +2,4 @@
 '@backstage/plugin-scaffolder-backend': patch
 ---
 
-Make identity valid if subject of token is a github-server token
+Make identity valid if subject of token is a backstage server-2-server auth token

packages/backend/src/plugins/scaffolder.ts

@@ -34,6 +34,5 @@ export default async function createPlugin(
     reader: env.reader,
     identity: env.identity,
     scheduler: env.scheduler,
-    tokenManager: env.tokenManager,
   });
 }

plugins/scaffolder-backend/api-report.md

@@ -32,7 +32,6 @@ import { TaskSecrets as TaskSecrets_2 } from '@backstage/plugin-scaffolder-node'
 import { TaskSpec } from '@backstage/plugin-scaffolder-common';
 import { TaskSpecV1beta3 } from '@backstage/plugin-scaffolder-common';
 import { TemplateAction as TemplateAction_2 } from '@backstage/plugin-scaffolder-node';
-import { TokenManager } from '@backstage/backend-common';
 import { UrlReader } from '@backstage/backend-common';
 import { Writable } from 'stream';
 
@@ -643,8 +642,6 @@ export interface RouterOptions {
   taskBroker?: TaskBroker;
   // @deprecated (undocumented)
   taskWorkers?: number;
-  // (undocumented)
-  tokenManager?: TokenManager;
 }
 
 // @public (undocumented)

plugins/scaffolder-backend/src/ScaffolderPlugin.ts

@@ -82,7 +82,6 @@ export const scaffolderPlugin = createBackendPlugin(
           database: coreServices.database,
           httpRouter: coreServices.httpRouter,
           catalogClient: catalogServiceRef,
-          tokenManager: coreServices.tokenManager,
         },
         async init({
           logger,
@@ -91,7 +90,6 @@ export const scaffolderPlugin = createBackendPlugin(
           database,
           httpRouter,
           catalogClient,
-          tokenManager,
         }) {
           const {
             additionalTemplateFilters,
@@ -129,7 +127,6 @@ export const scaffolderPlugin = createBackendPlugin(
             taskWorkers,
             additionalTemplateFilters,
             additionalTemplateGlobals,
-            tokenManager,
           });
           httpRouter.use(router);
         },

plugins/scaffolder-backend/src/service/router.ts

@@ -86,7 +86,6 @@ export interface RouterOptions {
   additionalTemplateFilters?: Record<string, TemplateFilter>;
   additionalTemplateGlobals?: Record<string, TemplateGlobal>;
   identity?: IdentityApi;
-  tokenManager?: TokenManager;
 }
 
 function isSupportedTemplate(entity: TemplateEntityV1beta3) {
@@ -100,15 +99,11 @@ function isSupportedTemplate(entity: TemplateEntityV1beta3) {
  * until someone explicitly passes an IdentityApi. When we have reasonable confidence that most backstage deployments
  * are using the IdentityApi, we can remove this function.
  */
-function buildDefaultIdentityClient({
-  options,
-}: {
-  options: RouterOptions;
-}): IdentityApi {
+function buildDefaultIdentityClient(options: RouterOptions): IdentityApi {
   return {
     getIdentity: async ({ request }: IdentityApiGetIdentityRequest) => {
       const header = request.headers.authorization;
-      const { logger, tokenManager } = options;
+      const { logger } = options;
 
       if (!header) {
         return undefined;
@@ -138,16 +133,13 @@ function buildDefaultIdentityClient({
           throw new TypeError('Expected string sub claim');
         }
 
-        try {
-          // Check that it's a valid ref, otherwise this will throw.
-          parseEntityRef(sub);
-        } catch (e) {
-          if (sub !== 'backstage-server' || !options.tokenManager) {
-            throw e;
-          }
-          await tokenManager?.authenticate(token);
+        if (sub === 'backstage-server') {
+          return undefined;
         }
 
+        // Check that it's a valid ref, otherwise this will throw.
+        parseEntityRef(sub);
+
         return {
           identity: {
             userEntityRef: sub,
@@ -192,7 +184,7 @@ export async function createRouter(
   const logger = parentLogger.child({ plugin: 'scaffolder' });
 
   const identity: IdentityApi =
-    options.identity || buildDefaultIdentityClient({ options });
+    options.identity || buildDefaultIdentityClient(options);
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = ScmIntegrations.fromConfig(config);