backend-app-api: move listPublicServiceKeys to authService

Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>

packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts

@@ -24,12 +24,12 @@ import {
   BackstageUserPrincipal,
   coreServices,
   createServiceFactory,
-  DatabaseService,
 } from '@backstage/backend-plugin-api';
 import { AuthenticationError } from '@backstage/errors';
 import { decodeJwt } from 'jose';
 import { UserTokenHandler } from './UserTokenHandler';
 import { PluginTokenHandler } from './PluginTokenHandler';
+import { JsonObject } from '@backstage/types';
 
 /** @internal */
 export type InternalBackstageCredentials<TPrincipal = unknown> =
@@ -111,6 +111,9 @@ class DefaultAuthService implements AuthService {
     private readonly disableDefaultAuthPolicy: boolean,
     private readonly pluginTokenHandler: PluginTokenHandler,
   ) {}
+  listPublicServiceKeys(): Promise<{ keys: JsonObject[] }> {
+    throw new Error('Method not implemented.');
+  }
 
   // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
   async authenticate(token: string): Promise<BackstageCredentials> {

packages/backend-app-api/src/services/implementations/auth/createAuthIntegrationRouter.ts

@@ -13,17 +13,18 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { PublicKeyStoreService } from '@backstage/backend-plugin-api';
+import { AuthService } from '@backstage/backend-plugin-api';
 import express from 'express';
 import Router from 'express-promise-router';
 
 export function createAuthIntegrationRouter(options: {
-  publicKeyStore: PublicKeyStoreService;
+  auth: AuthService;
 }): express.Router {
   const router = Router();
 
   router.get('/.backstage/auth/v1/jwks.json', async (_req, res) => {
-    res.json({ keys: await options.publicKeyStore.listKeys() });
+    const { keys } = await options.auth.listPublicServiceKeys();
+    res.json({ keys });
   });
 
   return router;

packages/backend-app-api/src/services/implementations/httpRouter/httpRouterServiceFactory.ts

@@ -45,21 +45,23 @@ export interface HttpRouterFactoryOptions {
 export const httpRouterServiceFactory = createServiceFactory(
   (options?: HttpRouterFactoryOptions) => ({
     service: coreServices.httpRouter,
+    initialization: 'always',
     deps: {
       plugin: coreServices.pluginMetadata,
       config: coreServices.rootConfig,
       lifecycle: coreServices.lifecycle,
       rootHttpRouter: coreServices.rootHttpRouter,
+      auth: coreServices.auth,
       httpAuth: coreServices.httpAuth,
       publicKeyStore: coreServices.publicKeyStore,
     },
     async factory({
+      auth,
       httpAuth,
       config,
       plugin,
       rootHttpRouter,
       lifecycle,
-      publicKeyStore,
     }) {
       const getPath = options?.getPath ?? (id => `/api/${id}`);
       const path = getPath(plugin.getId());
@@ -73,7 +75,7 @@ export const httpRouterServiceFactory = createServiceFactory(
       });
 
       router.use(createLifecycleMiddleware({ lifecycle }));
-      router.use(createAuthIntegrationRouter({ publicKeyStore }));
+      router.use(createAuthIntegrationRouter({ auth }));
       router.use(credentialsBarrier.middleware);
 
       return {

packages/backend-next/src/index.ts

@@ -55,7 +55,7 @@ backend.add(
           rootLifecycle: coreServices.rootLifecycle,
           auth: coreServices.auth,
           discovery: coreServices.discovery,
-          httpRouter: coreServices.httpRouter,
+          // httpRouter: coreServices.httpRouter,
         },
         async init({ rootLifecycle, auth, discovery }) {
           rootLifecycle.addStartupHook(async () => {

packages/backend-plugin-api/src/services/definitions/AuthService.ts

@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+import { JsonObject } from '@backstage/types';
+
 /**
  * @public
  */
@@ -91,4 +93,8 @@ export interface AuthService {
   getLimitedUserToken(
     credentials: BackstageCredentials<BackstageUserPrincipal>,
   ): Promise<{ token: string; expiresAt: Date }>;
+
+  listPublicServiceKeys(): Promise<{
+    keys: JsonObject[];
+  }>;
 }