backend-{app,plugin}-api: add initial AuthService interface + implementation

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Carl-Erik Bergström <cbergstrom@spotify.com>
Co-authored-by: blam <ben@blam.sh>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/backend-plugin-api/api-report.md

@@ -15,6 +15,16 @@ import { PermissionEvaluator } from '@backstage/plugin-permission-common';
 import { PluginTaskScheduler } from '@backstage/backend-tasks';
 import { Readable } from 'stream';
 
+// @public (undocumented)
+export interface AuthService {
+  // (undocumented)
+  authenticate(token: string): Promise<BackstageCredentials>;
+  // (undocumented)
+  issueServiceToken(options?: { forward?: BackstageCredentials }): Promise<{
+    token: string;
+  }>;
+}
+
 // @public (undocumented)
 export interface BackendFeature {
   // (undocumented)
@@ -76,6 +86,25 @@ export interface BackendPluginRegistrationPoints {
   }): void;
 }
 
+// @public (undocumented)
+export type BackstageCredentials =
+  | BackstageUserCredentials
+  | BackstageServiceCredentials;
+
+// @public (undocumented)
+export type BackstageServiceCredentials = {
+  $$type: '@backstage/BackstageCredentials';
+  type: 'service';
+  subject: string;
+};
+
+// @public (undocumented)
+export type BackstageUserCredentials = {
+  $$type: '@backstage/BackstageCredentials';
+  type: 'user';
+  userEntityRef: string;
+};
+
 // @public
 export interface CacheService {
   delete(key: string): Promise<void>;
@@ -100,6 +129,7 @@ export type CacheServiceSetOptions = {
 
 // @public
 export namespace coreServices {
+  const auth: ServiceRef<AuthService, 'plugin'>;
   const cache: ServiceRef<CacheService, 'plugin'>;
   const rootConfig: ServiceRef<RootConfigService, 'root'>;
   const database: ServiceRef<DatabaseService, 'plugin'>;

packages/backend-plugin-api/src/services/definitions/AuthService.ts

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2022 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @public
+ */
+export type BackstageUserCredentials = {
+  $$type: '@backstage/BackstageCredentials';
+
+  type: 'user';
+
+  userEntityRef: string;
+};
+
+/**
+ * @public
+ */
+export type BackstageServiceCredentials = {
+  $$type: '@backstage/BackstageCredentials';
+
+  type: 'service';
+
+  subject: string;
+};
+
+/**
+ * @public
+ */
+export type BackstageCredentials =
+  | BackstageUserCredentials
+  | BackstageServiceCredentials;
+
+/**
+ * @public
+ */
+export interface AuthService {
+  authenticate(token: string): Promise<BackstageCredentials>;
+  issueServiceToken(options?: {
+    forward?: BackstageCredentials;
+  }): Promise<{ token: string }>;
+}

packages/backend-plugin-api/src/services/definitions/coreServices.ts

@@ -22,6 +22,15 @@ import { createServiceRef } from '../system';
  * @public
  */
 export namespace coreServices {
+  /**
+   * The service reference for the plugin scoped {@link IdentityService}.
+   *
+   * @public
+   */
+  export const auth = createServiceRef<import('./AuthService').AuthService>({
+    id: 'core.auth',
+  });
+
   /**
    * The service reference for the plugin scoped {@link CacheService}.
    *

packages/backend-plugin-api/src/services/definitions/index.ts

@@ -15,6 +15,12 @@
  */
 
 export { coreServices } from './coreServices';
+export type {
+  AuthService,
+  BackstageCredentials,
+  BackstageServiceCredentials,
+  BackstageUserCredentials,
+} from './AuthService';
 export type {
   CacheService,
   CacheServiceOptions,