Merge pull request #32796 from backstage/changeset-release/master

Version Packages

plugins/auth-backend/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @backstage/plugin-auth-backend
 
+## 0.27.0
+
+### Minor Changes
+
+- 31de2c9: Added experimental support for Client ID Metadata Documents (CIMD).
+
+  This allows Backstage to act as an OAuth 2.0 authorization server that supports the [IETF Client ID Metadata Document draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/). External OAuth clients can use HTTPS URLs as their `client_id`, and Backstage will fetch metadata from those URLs to validate the client.
+
+  **Configuration example:**
+
+  ```yaml
+  auth:
+    experimentalClientIdMetadataDocuments:
+      enabled: true
+      # Optional: restrict which `client_id` URLs are allowed (defaults to ['*'])
+      allowedClientIdPatterns:
+        - 'https://example.com/*'
+        - 'https://*.trusted-domain.com/*'
+      # Optional: restrict which redirect URIs are allowed (defaults to ['*'])
+      allowedRedirectUriPatterns:
+        - 'http://localhost:*'
+        - 'https://*.example.com/*'
+  ```
+
+  Clients using CIMD must host a JSON metadata document at their `client_id` URL containing at minimum:
+
+  ```json
+  {
+    "client_id": "https://example.com/.well-known/oauth-client/my-app",
+    "client_name": "My Application",
+    "redirect_uris": ["http://localhost:8080/callback"],
+    "token_endpoint_auth_method": "none"
+  }
+  ```
+
+- d0786b9: Added experimental support for refresh tokens via the `auth.experimentalRefreshToken.enabled` configuration option. When enabled, clients can request the `offline_access` scope to receive refresh tokens that can be used to obtain new access tokens without re-authentication.
+
+### Patch Changes
+
+- 7455dae: Use node prefix on native imports
+- Updated dependencies
+  - @backstage/plugin-catalog-node@2.0.0
+  - @backstage/backend-plugin-api@1.7.0
+  - @backstage/plugin-auth-node@0.6.13
+
 ## 0.27.0-next.1
 
 ### Minor Changes

plugins/auth-backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend",
-  "version": "0.27.0-next.1",
+  "version": "0.27.0",
   "description": "A Backstage backend plugin that handles authentication",
   "backstage": {
     "role": "backend-plugin",