From a86f5c17016632908296e6a8d7498350b3705c01 Mon Sep 17 00:00:00 2001
From: Erik Larsson <erik.larsson@schibsted.com>
Date: Wed, 22 Dec 2021 22:48:07 +0100
Subject: [PATCH] fixes api auth bug in tech-insights plugin

Signed-off-by: Erik Larsson <erik.larsson@schibsted.com>
---
 .changeset/fluffy-toys-tease.md                  |  5 +++++
 .../tech-insights/src/api/TechInsightsClient.ts  | 16 ++++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/fluffy-toys-tease.md

diff --git a/.changeset/fluffy-toys-tease.md b/.changeset/fluffy-toys-tease.md
new file mode 100644
index 0000000000..f20eaebb2c
--- /dev/null
+++ b/.changeset/fluffy-toys-tease.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-tech-insights': minor
+---
+
+fixes api auth in tech-insights plugin
diff --git a/plugins/tech-insights/src/api/TechInsightsClient.ts b/plugins/tech-insights/src/api/TechInsightsClient.ts
index 25002e30a1..43979e60b0 100644
--- a/plugins/tech-insights/src/api/TechInsightsClient.ts
+++ b/plugins/tech-insights/src/api/TechInsightsClient.ts
@@ -17,7 +17,7 @@
 import { TechInsightsApi } from './TechInsightsApi';
 import { CheckResult } from '@backstage/plugin-tech-insights-common';
 import { Check } from './types';
-import { DiscoveryApi } from '@backstage/core-plugin-api';
+import { DiscoveryApi, IdentityApi } from '@backstage/core-plugin-api';
 import { ResponseError } from '@backstage/errors';
 import { EntityName } from '@backstage/catalog-model';
 
@@ -28,13 +28,16 @@ import {
 
 export type Options = {
   discoveryApi: DiscoveryApi;
+  identityApi: IdentityApi;
 };
 
 export class TechInsightsClient implements TechInsightsApi {
   private readonly discoveryApi: DiscoveryApi;
+  private readonly identityApi: IdentityApi;
 
   constructor(options: Options) {
     this.discoveryApi = options.discoveryApi;
+    this.identityApi = options.identityApi;
   }
 
   getScorecardsDefinition(
@@ -47,7 +50,14 @@ export class TechInsightsClient implements TechInsightsApi {
 
   async getAllChecks(): Promise<Check[]> {
     const url = await this.discoveryApi.getBaseUrl('tech-insights');
-    const response = await fetch(`${url}/checks`);
+    const token = await this.identityApi.getIdToken();
+    const response = await fetch(`${url}/checks`, {
+      headers: token
+        ? {
+            Authorization: `Bearer ${token}`,
+          }
+        : undefined,
+    });
     if (!response.ok) {
       throw await ResponseError.fromResponse(response);
     }
@@ -59,6 +69,7 @@ export class TechInsightsClient implements TechInsightsApi {
     checks: Check[],
   ): Promise<CheckResult[]> {
     const url = await this.discoveryApi.getBaseUrl('tech-insights');
+    const token = await this.identityApi.getIdToken();
     const { namespace, kind, name } = entityParams;
     const allChecks = checks ? checks : await this.getAllChecks();
     const checkIds = allChecks.map((check: Check) => check.id);
@@ -71,6 +82,7 @@ export class TechInsightsClient implements TechInsightsApi {
         body: JSON.stringify({ checks: checkIds }),
         headers: {
           'Content-Type': 'application/json',
+          ...(token && { Authorization: `Bearer ${token}` }),
         },
       },
     );