proxy-backend: require auth by default

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

plugins/proxy-backend/config.d.ts

@@ -71,6 +71,28 @@ export interface Config {
              * and headers that are set by the proxy will be forwarded.
              */
             allowedHeaders?: string[];
+            /**
+             * The credentials policy to apply.
+             *
+             * @remarks
+             *
+             * The values are as follows:
+             *
+             * - 'require': Callers must provide Backstage user or service
+             *   credentials with each request. The credentials are not
+             *   forwarded to the proxy target.
+             * - 'forward': Callers must provide Backstage user or service
+             *   credentials with each request, and those credentials are
+             *   forwarded to the proxy target.
+             * - 'dangerously-allow-unauthenticated': No Backstage credentials
+             *   are required to access this proxy target. The target can still
+             *   apply its own credentials checks, but the proxy will not help
+             *   block non-Backstage-blessed callers.
+             */
+            credentials?:
+              | 'require'
+              | 'forward'
+              | 'dangerously-allow-unauthenticated';
           };
     };
   } & {
@@ -121,6 +143,28 @@ export interface Config {
            * and headers that are set by the proxy will be forwarded.
            */
           allowedHeaders?: string[];
+          /**
+           * The credentials policy to apply.
+           *
+           * @remarks
+           *
+           * The values are as follows:
+           *
+           * - 'require': Callers must provide Backstage user or service
+           *   credentials with each request. The credentials are not
+           *   forwarded to the proxy target.
+           * - 'forward': Callers must provide Backstage user or service
+           *   credentials with each request, and those credentials are
+           *   forwarded to the proxy target.
+           * - 'dangerously-allow-unauthenticated': No Backstage credentials
+           *   are required to access this proxy target. The target can still
+           *   apply its own credentials checks, but the proxy will not help
+           *   block non-Backstage-blessed callers.
+           */
+          credentials?:
+            | 'require'
+            | 'forward'
+            | 'dangerously-allow-unauthenticated';
         };
   };
 }