add warning and prevent startup in production.

Signed-off-by: Aramis <sennyeyaramis@gmail.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>

plugins/auth-backend-module-guest-provider/README.md

@@ -2,7 +2,7 @@
 
 This module provides a guest auth provider implementation for `@backstage/plugin-auth-backend`. This is meant to supersede the existing `'guest'` option for authentication that does not emit tokens and is completely stored as frontend state.
 
-**NOTE**:
+**NOTE**: This provider should only ever be enabled for `development` or `test`. Enabling this for production is strongly discouraged as it would give everyone a way to bypass your other authentication methods.
 
 ## Installation
 

plugins/auth-backend-module-guest-provider/src/module.ts

@@ -30,6 +30,11 @@ export const authModuleGuestProvider = createBackendModule({
         providers: authProvidersExtensionPoint,
       },
       async init({ providers }) {
+        if (process.env.NODE_ENV === 'production') {
+          throw new Error(
+            'Guest provider does not support authenticating production workloads.',
+          );
+        }
         providers.registerProvider({
           providerId: 'guest',
           factory: createGuestAuthProviderFactory(),