backend-plugin-api: auth refactor to issueServiceToken with required credentials + getOwnCredentials

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/backend-plugin-api/api-report.md

@@ -22,12 +22,14 @@ export interface AuthService {
   // (undocumented)
   authenticate(token: string): Promise<BackstageCredentials>;
   // (undocumented)
+  getOwnCredentials(): Promise<BackstageCredentials<BackstageServicePrincipal>>;
+  // (undocumented)
   isPrincipal<TType extends keyof BackstagePrincipalTypes>(
     credentials: BackstageCredentials,
     type: TType,
   ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]>;
   // (undocumented)
-  issueToken(options: { forward?: BackstageCredentials }): Promise<{
+  issueServiceToken(options: { forward: BackstageCredentials }): Promise<{
     token: string;
   }>;
 }
@@ -305,8 +307,8 @@ export interface HttpAuthService {
   // (undocumented)
   issueUserCookie(res: Response_2): Promise<void>;
   // (undocumented)
-  requestHeaders(options?: {
-    forward?: BackstageCredentials;
+  requestHeaders(options: {
+    forward: BackstageCredentials;
   }): Promise<Record<string, string>>;
 }
 

packages/backend-plugin-api/src/services/definitions/AuthService.ts

@@ -71,9 +71,10 @@ export interface AuthService {
     type: TType,
   ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]>;
 
+  getOwnCredentials(): Promise<BackstageCredentials<BackstageServicePrincipal>>;
+
   // TODO: should the caller provide the target plugin ID?
-  // TODO: how can we make it very difficult to forget to forward credentials
-  issueToken(options: {
-    forward?: BackstageCredentials;
+  issueServiceToken(options: {
+    forward: BackstageCredentials;
   }): Promise<{ token: string }>;
 }

packages/backend-plugin-api/src/services/definitions/HttpAuthService.ts

@@ -43,8 +43,8 @@ export interface HttpAuthService {
     BackstageCredentials<BackstageHttpAccessToPrincipalTypesMapping[TAllowed]>
   >;
 
-  requestHeaders(options?: {
-    forward?: BackstageCredentials;
+  requestHeaders(options: {
+    forward: BackstageCredentials;
   }): Promise<Record<string, string>>;
 
   issueUserCookie(res: Response): Promise<void>;