auth-backend: hook up oidc router and token issuer/db

packages/backend/src/plugins/auth.ts

@@ -19,7 +19,8 @@ import { PluginEnvironment } from '../types';
 
 export default async function createPlugin({
   logger,
+  database,
   config,
 }: PluginEnvironment) {
-  return await createRouter({ logger, config });
+  return await createRouter({ logger, config, database });
 }

plugins/auth-backend/src/providers/factories.ts

@@ -20,6 +20,7 @@ import { createGoogleProvider } from './google';
 import { createSamlProvider } from './saml';
 import { AuthProviderFactory, AuthProviderConfig } from './types';
 import { Logger } from 'winston';
+import { TokenIssuer } from '../identity';
 
 const factories: { [providerId: string]: AuthProviderFactory } = {
   google: createGoogleProvider,
@@ -32,13 +33,14 @@ export const createAuthProviderRouter = (
   globalConfig: AuthProviderConfig,
   providerConfig: any, // TODO: make this a config reader object of sorts
   logger: Logger,
+  issuer: TokenIssuer,
 ) => {
   const factory = factories[providerId];
   if (!factory) {
     throw Error(`No auth provider available for '${providerId}'`);
   }
 
-  const provider = factory(globalConfig, providerConfig, logger);
+  const provider = factory(globalConfig, providerConfig, logger, issuer);
 
   const router = Router();
   router.get('/start', provider.start.bind(provider));

plugins/auth-backend/src/providers/types.ts

@@ -16,6 +16,7 @@
 
 import express from 'express';
 import { Logger } from 'winston';
+import { TokenIssuer } from '../identity';
 
 export type OAuthProviderOptions = {
   /**
@@ -180,6 +181,7 @@ export type AuthProviderFactory = (
   globalConfig: AuthProviderConfig,
   providerConfig: EnvironmentProviderConfig,
   logger: Logger,
+  issuer: TokenIssuer,
 ) => AuthProviderRouteHandlers;
 
 export type AuthInfoBase = {

plugins/auth-backend/src/service/router.ts

@@ -18,12 +18,15 @@ import express from 'express';
 import Router from 'express-promise-router';
 import cookieParser from 'cookie-parser';
 import bodyParser from 'body-parser';
+import Knex from 'knex';
 import { Logger } from 'winston';
 import { createAuthProviderRouter } from '../providers';
 import { Config } from '@backstage/config';
+import { DatabaseKeyStore, TokenFactory, createOidcRouter } from '../identity';
 
 export interface RouterOptions {
   logger: Logger;
+  database: Knex;
   config: Config;
 }
 
@@ -33,6 +36,18 @@ export async function createRouter(
   const router = Router();
   const logger = options.logger.child({ plugin: 'auth' });
 
+  const baseUrl = `${options.config.getString('backend.baseUrl')}/auth`;
+
+  const keyStore = await DatabaseKeyStore.create({
+    database: options.database,
+    logger,
+  });
+  const issuer = new TokenFactory({
+    issuer: baseUrl,
+    keyStore,
+    logger,
+  });
+
   router.use(cookieParser());
   router.use(bodyParser.urlencoded({ extended: false }));
   router.use(bodyParser.json());
@@ -79,7 +94,6 @@ export async function createRouter(
   const providerConfigs = config.auth.providers;
 
   for (const [providerId, providerConfig] of Object.entries(providerConfigs)) {
-    const baseUrl = `${options.config.getString('backend.baseUrl')}/auth`;
     logger.info(`Configuring provider, ${providerId}`);
     try {
       const providerRouter = createAuthProviderRouter(
@@ -87,11 +101,15 @@ export async function createRouter(
         { baseUrl },
         providerConfig,
         logger,
+        issuer,
       );
       router.use(`/${providerId}`, providerRouter);
     } catch (e) {
       logger.error(e.message);
     }
   }
+
+  router.use(createOidcRouter({ logger, keyStore, baseUrl }));
+
   return router;
 }