notifications-backend: migrated to use new auth services

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Carl-Erik Bergström <cbergstrom@spotify.com>
Co-authored-by: blam <ben@blam.sh>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

plugins/notifications-backend/src/plugin.ts

@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 import {
   coreServices,
   createBackendPlugin,
@@ -58,6 +59,8 @@ export const notificationsPlugin = createBackendPlugin({
 
     env.registerInit({
       deps: {
+        auth: coreServices.auth,
+        httpAuth: coreServices.httpAuth,
         httpRouter: coreServices.httpRouter,
         logger: coreServices.logger,
         identity: coreServices.identity,
@@ -67,6 +70,8 @@ export const notificationsPlugin = createBackendPlugin({
         signals: signalService,
       },
       async init({
+        auth,
+        httpAuth,
         httpRouter,
         logger,
         identity,
@@ -77,6 +82,8 @@ export const notificationsPlugin = createBackendPlugin({
       }) {
         httpRouter.use(
           await createRouter({
+            auth,
+            httpAuth,
             logger,
             identity,
             database,

plugins/notifications-backend/src/service/router.ts

@@ -14,16 +14,14 @@
  * limitations under the License.
  */
 import {
+  createLegacyAuthAdapters,
   errorHandler,
   PluginDatabaseManager,
   TokenManager,
 } from '@backstage/backend-common';
 import express, { Request } from 'express';
 import Router from 'express-promise-router';
-import {
-  getBearerTokenFromAuthorizationHeader,
-  IdentityApi,
-} from '@backstage/plugin-auth-node';
+import { IdentityApi } from '@backstage/plugin-auth-node';
 import {
   DatabaseNotificationsStore,
   NotificationGetOptions,
@@ -39,7 +37,12 @@ import {
 } from '@backstage/catalog-model';
 import { NotificationProcessor } from '@backstage/plugin-notifications-node';
 import { AuthenticationError, InputError } from '@backstage/errors';
-import { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';
+import {
+  AuthService,
+  DiscoveryService,
+  HttpAuthService,
+  LoggerService,
+} from '@backstage/backend-plugin-api';
 import { SignalService } from '@backstage/plugin-signals-node';
 import {
   NewNotificationSignal,
@@ -58,6 +61,8 @@ export interface RouterOptions {
   signalService?: SignalService;
   catalog?: CatalogApi;
   processors?: NotificationProcessor[];
+  auth?: AuthService;
+  httpAuth?: HttpAuthService;
 }
 
 /** @internal */
@@ -70,7 +75,6 @@ export async function createRouter(
     identity,
     discovery,
     catalog,
-    tokenManager,
     processors,
     signalService,
   } = options;
@@ -79,6 +83,8 @@ export async function createRouter(
     catalog ?? new CatalogClient({ discoveryApi: discovery });
   const store = await DatabaseNotificationsStore.create({ database });
 
+  const { auth, httpAuth } = createLegacyAuthAdapters(options);
+
   const getUser = async (req: Request<unknown>) => {
     const user = await identity.getIdentity({ request: req });
     if (!user) {
@@ -87,20 +93,13 @@ export async function createRouter(
     return user.identity.userEntityRef;
   };
 
-  const authenticateService = async (req: Request<unknown>) => {
-    const token = getBearerTokenFromAuthorizationHeader(
-      req.header('authorization'),
-    );
-    if (!token) {
-      throw new AuthenticationError();
-    }
-    await tokenManager.authenticate(token);
-  };
-
   const getUsersForEntityRef = async (
     entityRef: string | string[] | null,
   ): Promise<string[]> => {
-    const { token } = await tokenManager.getToken();
+    const { token } = await auth.getPluginRequestToken({
+      onBehalfOf: await auth.getOwnServiceCredentials(),
+      targetPluginId: 'catalog',
+    });
 
     // TODO: Support for broadcast
     if (entityRef === null) {
@@ -276,11 +275,7 @@ export async function createRouter(
     const notifications = [];
     let users = [];
 
-    try {
-      await authenticateService(req);
-    } catch (e) {
-      throw new AuthenticationError();
-    }
+    await httpAuth.credentials(req, { allow: ['service'] });
 
     const { title, link, scope } = payload;