From 860de10fa67c2efa6ea3cf725e06792f68d7d381 Mon Sep 17 00:00:00 2001
From: Lucas Pires <lucas.tulio@grupoboticario.com.br>
Date: Fri, 27 Jan 2023 17:58:28 -0300
Subject: [PATCH] feat: including authentication to server applications in
 scaffolder plugin

Signed-off-by: Lucas Pires <lucas.tulio@grupoboticario.com.br>
---
 .changeset/backend-token-authentication.md    |  5 ++++
 packages/backend/src/plugins/scaffolder.ts    |  1 +
 .../src/ScaffolderPlugin.ts                   |  3 +++
 .../scaffolder-backend/src/service/router.ts  | 26 ++++++++++++++-----
 4 files changed, 28 insertions(+), 7 deletions(-)
 create mode 100644 .changeset/backend-token-authentication.md

diff --git a/.changeset/backend-token-authentication.md b/.changeset/backend-token-authentication.md
new file mode 100644
index 0000000000..597921822f
--- /dev/null
+++ b/.changeset/backend-token-authentication.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Make identity valid if subject of token is a github-server token
diff --git a/packages/backend/src/plugins/scaffolder.ts b/packages/backend/src/plugins/scaffolder.ts
index d079b64c28..e734408d42 100644
--- a/packages/backend/src/plugins/scaffolder.ts
+++ b/packages/backend/src/plugins/scaffolder.ts
@@ -34,5 +34,6 @@ export default async function createPlugin(
     reader: env.reader,
     identity: env.identity,
     scheduler: env.scheduler,
+    tokenManager: env.tokenManager,
   });
 }
diff --git a/plugins/scaffolder-backend/src/ScaffolderPlugin.ts b/plugins/scaffolder-backend/src/ScaffolderPlugin.ts
index 43b8d30f99..639f9b0806 100644
--- a/plugins/scaffolder-backend/src/ScaffolderPlugin.ts
+++ b/plugins/scaffolder-backend/src/ScaffolderPlugin.ts
@@ -82,6 +82,7 @@ export const scaffolderPlugin = createBackendPlugin(
           database: coreServices.database,
           httpRouter: coreServices.httpRouter,
           catalogClient: catalogServiceRef,
+          tokenManager: coreServices.tokenManager,
         },
         async init({
           logger,
@@ -90,6 +91,7 @@ export const scaffolderPlugin = createBackendPlugin(
           database,
           httpRouter,
           catalogClient,
+          tokenManager,
         }) {
           const {
             additionalTemplateFilters,
@@ -127,6 +129,7 @@ export const scaffolderPlugin = createBackendPlugin(
             taskWorkers,
             additionalTemplateFilters,
             additionalTemplateGlobals,
+            tokenManager,
           });
           httpRouter.use(router);
         },
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index c339de8d10..49cfa68306 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -14,7 +14,11 @@
  * limitations under the License.
  */
 
-import { PluginDatabaseManager, UrlReader } from '@backstage/backend-common';
+import {
+  PluginDatabaseManager,
+  TokenManager,
+  UrlReader,
+} from '@backstage/backend-common';
 import { PluginTaskScheduler } from '@backstage/backend-tasks';
 import { CatalogApi } from '@backstage/catalog-client';
 import {
@@ -82,6 +86,7 @@ export interface RouterOptions {
   additionalTemplateFilters?: Record<string, TemplateFilter>;
   additionalTemplateGlobals?: Record<string, TemplateGlobal>;
   identity?: IdentityApi;
+  tokenManager?: TokenManager;
 }
 
 function isSupportedTemplate(entity: TemplateEntityV1beta3) {
@@ -96,13 +101,14 @@ function isSupportedTemplate(entity: TemplateEntityV1beta3) {
  * are using the IdentityApi, we can remove this function.
  */
 function buildDefaultIdentityClient({
-  logger,
+  options,
 }: {
-  logger: Logger;
+  options: RouterOptions;
 }): IdentityApi {
   return {
     getIdentity: async ({ request }: IdentityApiGetIdentityRequest) => {
       const header = request.headers.authorization;
+      const { logger, tokenManager } = options;
 
       if (!header) {
         return undefined;
@@ -132,8 +138,15 @@ function buildDefaultIdentityClient({
           throw new TypeError('Expected string sub claim');
         }
 
-        // Check that it's a valid ref, otherwise this will throw.
-        parseEntityRef(sub);
+        try {
+          // Check that it's a valid ref, otherwise this will throw.
+          parseEntityRef(sub);
+        } catch (e) {
+          if (sub !== 'backstage-server' || !options.tokenManager) {
+            throw e;
+          }
+          await tokenManager?.authenticate(token);
+        }
 
         return {
           identity: {
@@ -179,8 +192,7 @@ export async function createRouter(
   const logger = parentLogger.child({ plugin: 'scaffolder' });
 
   const identity: IdentityApi =
-    options.identity || buildDefaultIdentityClient({ logger });
-
+    options.identity || buildDefaultIdentityClient({ options });
   const workingDirectory = await getWorkingDirectory(config, logger);
   const integrations = ScmIntegrations.fromConfig(config);