feat: including authentication to server applications in scaffolder plugin

Signed-off-by: Lucas Pires <lucas.tulio@grupoboticario.com.br>

.changeset/backend-token-authentication.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Make identity valid if subject of token is a github-server token

packages/backend/src/plugins/scaffolder.ts

@@ -34,5 +34,6 @@ export default async function createPlugin(
     reader: env.reader,
     identity: env.identity,
     scheduler: env.scheduler,
+    tokenManager: env.tokenManager,
   });
 }

plugins/scaffolder-backend/src/ScaffolderPlugin.ts

@@ -82,6 +82,7 @@ export const scaffolderPlugin = createBackendPlugin(
           database: coreServices.database,
           httpRouter: coreServices.httpRouter,
           catalogClient: catalogServiceRef,
+          tokenManager: coreServices.tokenManager,
         },
         async init({
           logger,
@@ -90,6 +91,7 @@ export const scaffolderPlugin = createBackendPlugin(
           database,
           httpRouter,
           catalogClient,
+          tokenManager,
         }) {
           const {
             additionalTemplateFilters,
@@ -127,6 +129,7 @@ export const scaffolderPlugin = createBackendPlugin(
             taskWorkers,
             additionalTemplateFilters,
             additionalTemplateGlobals,
+            tokenManager,
           });
           httpRouter.use(router);
         },

plugins/scaffolder-backend/src/service/router.ts

@@ -14,7 +14,11 @@
  * limitations under the License.
  */
 
-import { PluginDatabaseManager, UrlReader } from '@backstage/backend-common';
+import {
+  PluginDatabaseManager,
+  TokenManager,
+  UrlReader,
+} from '@backstage/backend-common';
 import { PluginTaskScheduler } from '@backstage/backend-tasks';
 import { CatalogApi } from '@backstage/catalog-client';
 import {
@@ -82,6 +86,7 @@ export interface RouterOptions {
   additionalTemplateFilters?: Record<string, TemplateFilter>;
   additionalTemplateGlobals?: Record<string, TemplateGlobal>;
   identity?: IdentityApi;
+  tokenManager?: TokenManager;
 }
 
 function isSupportedTemplate(entity: TemplateEntityV1beta3) {
@@ -96,13 +101,14 @@ function isSupportedTemplate(entity: TemplateEntityV1beta3) {
  * are using the IdentityApi, we can remove this function.
  */
 function buildDefaultIdentityClient({
-  logger,
+  options,
 }: {
-  logger: Logger;
+  options: RouterOptions;
 }): IdentityApi {
   return {
     getIdentity: async ({ request }: IdentityApiGetIdentityRequest) => {
       const header = request.headers.authorization;
+      const { logger, tokenManager } = options;
 
       if (!header) {
         return undefined;
@@ -132,8 +138,15 @@ function buildDefaultIdentityClient({
           throw new TypeError('Expected string sub claim');
         }
 
-        // Check that it's a valid ref, otherwise this will throw.
-        parseEntityRef(sub);
+        try {
+          // Check that it's a valid ref, otherwise this will throw.
+          parseEntityRef(sub);
+        } catch (e) {
+          if (sub !== 'backstage-server' || !options.tokenManager) {
+            throw e;
+          }
+          await tokenManager?.authenticate(token);
+        }
 
         return {
           identity: {
@@ -179,8 +192,7 @@ export async function createRouter(
   const logger = parentLogger.child({ plugin: 'scaffolder' });
 
   const identity: IdentityApi =
-    options.identity || buildDefaultIdentityClient({ logger });
-
+    options.identity || buildDefaultIdentityClient({ options });
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = ScmIntegrations.fromConfig(config);