From 770ecf61312cd89a042a10a3b83289cfe772c0db Mon Sep 17 00:00:00 2001
From: Lucas Pires <lucas.tulio@grupoboticario.com.br>
Date: Wed, 15 Feb 2023 12:39:20 -0300
Subject: [PATCH] chore: removing token manager and adding backstage-server
 condition

Signed-off-by: Lucas Pires <lucas.tulio@grupoboticario.com.br>
---
 .changeset/backend-token-authentication.md    |  2 +-
 packages/backend/src/plugins/scaffolder.ts    |  1 -
 plugins/scaffolder-backend/api-report.md      |  3 ---
 .../src/ScaffolderPlugin.ts                   |  3 ---
 .../scaffolder-backend/src/service/router.ts  | 24 +++++++------------
 5 files changed, 9 insertions(+), 24 deletions(-)

diff --git a/.changeset/backend-token-authentication.md b/.changeset/backend-token-authentication.md
index 597921822f..3b0f016800 100644
--- a/.changeset/backend-token-authentication.md
+++ b/.changeset/backend-token-authentication.md
@@ -2,4 +2,4 @@
 '@backstage/plugin-scaffolder-backend': patch
 ---
 
-Make identity valid if subject of token is a github-server token
+Make identity valid if subject of token is a backstage server-2-server auth token
diff --git a/packages/backend/src/plugins/scaffolder.ts b/packages/backend/src/plugins/scaffolder.ts
index e734408d42..d079b64c28 100644
--- a/packages/backend/src/plugins/scaffolder.ts
+++ b/packages/backend/src/plugins/scaffolder.ts
@@ -34,6 +34,5 @@ export default async function createPlugin(
     reader: env.reader,
     identity: env.identity,
     scheduler: env.scheduler,
-    tokenManager: env.tokenManager,
   });
 }
diff --git a/plugins/scaffolder-backend/api-report.md b/plugins/scaffolder-backend/api-report.md
index 81546dd00a..0d745862a1 100644
--- a/plugins/scaffolder-backend/api-report.md
+++ b/plugins/scaffolder-backend/api-report.md
@@ -32,7 +32,6 @@ import { TaskSecrets as TaskSecrets_2 } from '@backstage/plugin-scaffolder-node'
 import { TaskSpec } from '@backstage/plugin-scaffolder-common';
 import { TaskSpecV1beta3 } from '@backstage/plugin-scaffolder-common';
 import { TemplateAction as TemplateAction_2 } from '@backstage/plugin-scaffolder-node';
-import { TokenManager } from '@backstage/backend-common';
 import { UrlReader } from '@backstage/backend-common';
 import { Writable } from 'stream';
 
@@ -643,8 +642,6 @@ export interface RouterOptions {
   taskBroker?: TaskBroker;
   // @deprecated (undocumented)
   taskWorkers?: number;
-  // (undocumented)
-  tokenManager?: TokenManager;
 }
 
 // @public (undocumented)
diff --git a/plugins/scaffolder-backend/src/ScaffolderPlugin.ts b/plugins/scaffolder-backend/src/ScaffolderPlugin.ts
index 639f9b0806..43b8d30f99 100644
--- a/plugins/scaffolder-backend/src/ScaffolderPlugin.ts
+++ b/plugins/scaffolder-backend/src/ScaffolderPlugin.ts
@@ -82,7 +82,6 @@ export const scaffolderPlugin = createBackendPlugin(
           database: coreServices.database,
           httpRouter: coreServices.httpRouter,
           catalogClient: catalogServiceRef,
-          tokenManager: coreServices.tokenManager,
         },
         async init({
           logger,
@@ -91,7 +90,6 @@ export const scaffolderPlugin = createBackendPlugin(
           database,
           httpRouter,
           catalogClient,
-          tokenManager,
         }) {
           const {
             additionalTemplateFilters,
@@ -129,7 +127,6 @@ export const scaffolderPlugin = createBackendPlugin(
             taskWorkers,
             additionalTemplateFilters,
             additionalTemplateGlobals,
-            tokenManager,
           });
           httpRouter.use(router);
         },
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 49cfa68306..d082e3c268 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -86,7 +86,6 @@ export interface RouterOptions {
   additionalTemplateFilters?: Record<string, TemplateFilter>;
   additionalTemplateGlobals?: Record<string, TemplateGlobal>;
   identity?: IdentityApi;
-  tokenManager?: TokenManager;
 }
 
 function isSupportedTemplate(entity: TemplateEntityV1beta3) {
@@ -100,15 +99,11 @@ function isSupportedTemplate(entity: TemplateEntityV1beta3) {
  * until someone explicitly passes an IdentityApi. When we have reasonable confidence that most backstage deployments
  * are using the IdentityApi, we can remove this function.
  */
-function buildDefaultIdentityClient({
-  options,
-}: {
-  options: RouterOptions;
-}): IdentityApi {
+function buildDefaultIdentityClient(options: RouterOptions): IdentityApi {
   return {
     getIdentity: async ({ request }: IdentityApiGetIdentityRequest) => {
       const header = request.headers.authorization;
-      const { logger, tokenManager } = options;
+      const { logger } = options;
 
       if (!header) {
         return undefined;
@@ -138,16 +133,13 @@ function buildDefaultIdentityClient({
           throw new TypeError('Expected string sub claim');
         }
 
-        try {
-          // Check that it's a valid ref, otherwise this will throw.
-          parseEntityRef(sub);
-        } catch (e) {
-          if (sub !== 'backstage-server' || !options.tokenManager) {
-            throw e;
-          }
-          await tokenManager?.authenticate(token);
+        if (sub === 'backstage-server') {
+          return undefined;
         }
 
+        // Check that it's a valid ref, otherwise this will throw.
+        parseEntityRef(sub);
+
         return {
           identity: {
             userEntityRef: sub,
@@ -192,7 +184,7 @@ export async function createRouter(
   const logger = parentLogger.child({ plugin: 'scaffolder' });
 
   const identity: IdentityApi =
-    options.identity || buildDefaultIdentityClient({ options });
+    options.identity || buildDefaultIdentityClient(options);
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = ScmIntegrations.fromConfig(config);