paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 47 Packages Projects Releases Wiki Activity

feat(auth): migrate Bitbucket auth provider to module package

Browse Source 
Migrate the Bitbucket auth provider to the new `@backstage/plugin-auth-backend-module-bitbucket-provider` module package.

Relates-to: #19476
Signed-off-by: Patrick Jungermann <Patrick.Jungermann@gmail.com>
This commit is contained in:
Patrick Jungermann
2024-04-16 03:16:59 +02:00
parent be8af7f67e
commit ba763b6d86
19 changed files with 530 additions and 318 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-backend/api-report.md
+4 -4
View File
@@ -80,7 +80,7 @@ export type AuthResponse<TProviderInfo> = ClientAuthResponse<TProviderInfo>;
// @public @deprecated
export type AwsAlbResult = AwsAlbResult_2;
// @public (undocumented)
// @public @deprecated (undocumented)
export type BitbucketOAuthResult = {
fullProfile: BitbucketPassportProfile;
params: {
@@ -92,7 +92,7 @@ export type BitbucketOAuthResult = {
refreshToken?: string;
};
// @public (undocumented)
// @public @deprecated (undocumented)
export type BitbucketPassportProfile = Profile & {
id?: string;
displayName?: string;
@@ -424,8 +424,8 @@ export const providers: Readonly<{
| undefined,
) => AuthProviderFactory_2;
resolvers: Readonly<{
usernameMatchingUserEntityAnnotation(): SignInResolver_2<OAuthResult>;
userIdMatchingUserEntityAnnotation(): SignInResolver_2<OAuthResult>;
userIdMatchingUserEntityAnnotation: () => SignInResolver_2<OAuthResult>;
usernameMatchingUserEntityAnnotation: () => SignInResolver_2<OAuthResult>;
}>;
}>;
bitbucketServer: Readonly<{
plugins/auth-backend/package.json
+1 -1
View File
@@ -46,6 +46,7 @@
"@backstage/plugin-auth-backend-module-atlassian-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-aws-alb-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-azure-easyauth-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-bitbucket-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-cloudflare-access-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-gcp-iap-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-github-provider": "workspace:^",
@@ -83,7 +84,6 @@
"openid-client": "^5.2.1",
"passport": "^0.7.0",
"passport-auth0": "^1.4.3",
"passport-bitbucket-oauth2": "^0.1.2",
"passport-github2": "^0.1.12",
"passport-google-oauth20": "^2.0.0",
"passport-microsoft": "^1.0.0",
plugins/auth-backend/src/providers/bitbucket/provider.test.ts
-93
View File
@@ -1,93 +0,0 @@
/*
* Copyright 2020 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { BitbucketAuthProvider, BitbucketOAuthResult } from './provider';
import * as helpers from '../../lib/passport/PassportStrategyHelper';
import { AuthResolverContext } from '@backstage/plugin-auth-node';
const mockFrameHandler = jest.spyOn(
helpers,
'executeFrameHandlerStrategy',
) as unknown as jest.MockedFunction<
() => Promise<{ result: BitbucketOAuthResult; privateInfo: any }>
>;
jest.mock('../../lib/passport/PassportStrategyHelper', () => {
return {
executeFrameHandlerStrategy: jest.fn(),
executeRefreshTokenStrategy: jest.fn(),
executeFetchUserProfileStrategy: jest.fn(),
};
});
describe('createBitbucketProvider', () => {
it('should auth', async () => {
const provider = new BitbucketAuthProvider({
resolverContext: {} as AuthResolverContext,
authHandler: async ({ fullProfile }) => ({
profile: {
email: fullProfile.emails![0]!.value,
displayName: fullProfile.displayName,
picture: 'http://google.com/lols',
},
}),
clientId: 'mock',
clientSecret: 'mock',
callbackUrl: 'mock',
});
mockFrameHandler.mockResolvedValueOnce({
result: {
fullProfile: {
_json: {
links: {
avatar: {
href: 'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
},
},
emails: [{ value: 'conrad@example.com' }],
displayName: 'Conrad',
id: 'conrad',
provider: 'google',
},
params: {
id_token: 'idToken',
scope: 'scope',
expires_in: 123,
},
accessToken: 'accessToken',
},
privateInfo: {
refreshToken: 'wacka',
},
});
const { response } = await provider.handler({} as any);
expect(response).toEqual({
providerInfo: {
accessToken: 'accessToken',
expiresInSeconds: 123,
idToken: 'idToken',
scope: 'scope',
},
profile: {
email: 'conrad@example.com',
displayName: 'Conrad',
picture: 'http://google.com/lols',
},
});
});
});
plugins/auth-backend/src/providers/bitbucket/provider.ts
+33 -219
View File
@@ -14,46 +14,28 @@
* limitations under the License.
*/
import express from 'express';
import passport, { Profile as PassportProfile } from 'passport';
import { Strategy as BitbucketStrategy } from 'passport-bitbucket-oauth2';
import {
encodeState,
OAuthAdapter,
OAuthEnvironmentHandler,
OAuthHandlers,
OAuthProviderOptions,
OAuthRefreshRequest,
OAuthResponse,
OAuthResult,
OAuthStartRequest,
} from '../../lib/oauth';
bitbucketAuthenticator,
bitbucketSignInResolvers,
} from '@backstage/plugin-auth-backend-module-bitbucket-provider';
import {
executeFetchUserProfileStrategy,
executeFrameHandlerStrategy,
executeRedirectStrategy,
executeRefreshTokenStrategy,
makeProfileInfo,
PassportDoneCallback,
} from '../../lib/passport';
import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
import { AuthHandler, OAuthStartResponse } from '../types';
import {
AuthResolverContext,
SignInResolver,
createOAuthProviderFactory,
} from '@backstage/plugin-auth-node';
import { Profile as PassportProfile } from 'passport';
import {
adaptLegacyOAuthHandler,
adaptLegacyOAuthSignInResolver,
adaptOAuthSignInResolverToLegacy,
} from '../../lib/legacy';
import { OAuthResult } from '../../lib/oauth';
import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
import { AuthHandler } from '../types';
type PrivateInfo = {
refreshToken: string;
};
type Options = OAuthProviderOptions & {
signInResolver?: SignInResolver<OAuthResult>;
authHandler: AuthHandler<BitbucketOAuthResult>;
resolverContext: AuthResolverContext;
};
/** @public */
/**
* @public
* @deprecated The Bitbucket auth provider was extracted to `@backstage/plugin-auth-backend-module-bitbucket-provider`.
*/
export type BitbucketOAuthResult = {
fullProfile: BitbucketPassportProfile;
params: {
@@ -65,7 +47,10 @@ export type BitbucketOAuthResult = {
refreshToken?: string;
};
/** @public */
/**
* @public
* @deprecated The Bitbucket auth provider was extracted to `@backstage/plugin-auth-backend-module-bitbucket-provider`.
*/
export type BitbucketPassportProfile = PassportProfile & {
id?: string;
displayName?: string;
@@ -80,119 +65,8 @@ export type BitbucketPassportProfile = PassportProfile & {
};
};
export class BitbucketAuthProvider implements OAuthHandlers {
private readonly _strategy: BitbucketStrategy;
private readonly signInResolver?: SignInResolver<OAuthResult>;
private readonly authHandler: AuthHandler<OAuthResult>;
private readonly resolverContext: AuthResolverContext;
constructor(options: Options) {
this.signInResolver = options.signInResolver;
this.authHandler = options.authHandler;
this.resolverContext = options.resolverContext;
this._strategy = new BitbucketStrategy(
{
clientID: options.clientId,
clientSecret: options.clientSecret,
callbackURL: options.callbackUrl,
passReqToCallback: false,
},
(
accessToken: any,
refreshToken: any,
params: any,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
done(
undefined,
{
fullProfile,
params,
accessToken,
refreshToken,
},
{
refreshToken,
},
);
},
);
}
async start(req: OAuthStartRequest): Promise<OAuthStartResponse> {
return await executeRedirectStrategy(req, this._strategy, {
accessType: 'offline',
prompt: 'consent',
scope: req.scope,
state: encodeState(req.state),
});
}
async handler(req: express.Request) {
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
return {
response: await this.handleResult(result),
refreshToken: privateInfo.refreshToken,
};
}
async refresh(req: OAuthRefreshRequest) {
const { accessToken, refreshToken, params } =
await executeRefreshTokenStrategy(
this._strategy,
req.refreshToken,
req.scope,
);
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
);
return {
response: await this.handleResult({
fullProfile,
params,
accessToken,
}),
refreshToken,
};
}
private async handleResult(result: BitbucketOAuthResult) {
result.fullProfile.avatarUrl =
result.fullProfile._json!.links!.avatar!.href;
const { profile } = await this.authHandler(result, this.resolverContext);
const response: OAuthResponse = {
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
profile,
};
if (this.signInResolver) {
response.backstageIdentity = await this.signInResolver(
{
result,
profile,
},
this.resolverContext,
);
}
return response;
}
}
/**
* Auth provider integration for BitBucket auth
* Auth provider integration for Bitbucket auth
*
* @public
*/
@@ -208,79 +82,19 @@ export const bitbucket = createAuthProviderIntegration({
* Configure sign-in for this provider, without it the provider can not be used to sign users in.
*/
signIn?: {
/**
* Maps an auth result to a Backstage identity for the user.
*/
resolver: SignInResolver<OAuthResult>;
};
}) {
return ({ providerId, globalConfig, config, resolverContext }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
const callbackUrl =
customCallbackUrl ||
`${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authHandler: AuthHandler<BitbucketOAuthResult> =
options?.authHandler
? options.authHandler
: async ({ fullProfile, params }) => ({
profile: makeProfileInfo(fullProfile, params.id_token),
});
const provider = new BitbucketAuthProvider({
clientId,
clientSecret,
callbackUrl,
signInResolver: options?.signIn?.resolver,
authHandler,
resolverContext,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
providerId,
callbackUrl,
});
});
},
resolvers: {
/**
* Looks up the user by matching their username to the `bitbucket.org/username` annotation.
*/
usernameMatchingUserEntityAnnotation(): SignInResolver<OAuthResult> {
return async (info, ctx) => {
const { result } = info;
if (!result.fullProfile.username) {
throw new Error('Bitbucket profile contained no Username');
}
return ctx.signInWithCatalogUser({
annotations: {
'bitbucket.org/username': result.fullProfile.username,
},
});
};
},
/**
* Looks up the user by matching their user ID to the `bitbucket.org/user-id` annotation.
*/
userIdMatchingUserEntityAnnotation(): SignInResolver<OAuthResult> {
return async (info, ctx) => {
const { result } = info;
if (!result.fullProfile.id) {
throw new Error('Bitbucket profile contained no User ID');
}
return ctx.signInWithCatalogUser({
annotations: {
'bitbucket.org/user-id': result.fullProfile.id,
},
});
};
},
return createOAuthProviderFactory({
authenticator: bitbucketAuthenticator,
profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),
});
},
resolvers: adaptOAuthSignInResolverToLegacy({
userIdMatchingUserEntityAnnotation:
bitbucketSignInResolvers.userIdMatchingUserEntityAnnotation(),
usernameMatchingUserEntityAnnotation:
bitbucketSignInResolvers.usernameMatchingUserEntityAnnotation(),
}),
});
plugins/auth-backend/src/providers/bitbucket/types.d.ts
Vendored
-29
View File
@@ -1,29 +0,0 @@
/*
* Copyright 2020 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
declare module 'passport-bitbucket-oauth2' {
import { StrategyCreated } from 'passport';
import express = require('express');
export class Strategy {
name?: string | undefined;
authenticate(
this: StrategyCreated<this>,
req: express.Request,
options?: any,
): any;
constructor(options: any, verify: any);
}
}