From dc8c5ddbaec0a791ce32411f3ae57c297a0a6d68 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Sat, 20 Apr 2024 16:16:48 +0200
Subject: [PATCH] backend-app-api: stop requiring keys to be configured for the
 token manager

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/hip-carrots-drive.md               |  5 ++++
 .../auth/DefaultAuthService.ts                | 10 +++++--
 .../tokenManagerServiceFactory.test.ts        | 27 ++++++++-----------
 .../tokenManagerServiceFactory.ts             |  1 +
 4 files changed, 25 insertions(+), 18 deletions(-)
 create mode 100644 .changeset/hip-carrots-drive.md

diff --git a/.changeset/hip-carrots-drive.md b/.changeset/hip-carrots-drive.md
new file mode 100644
index 0000000000..5852916b74
--- /dev/null
+++ b/.changeset/hip-carrots-drive.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+The default `TokenManager` implementation no longer requires keys to be configured in production, but it will throw an errors when generating or authenticating tokens. The default `AuthService` implementation will now also provide additional context if such an error is throw when falling back to using the `TokenManager` service to generate tokens for outgoing requests.
diff --git a/packages/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts b/packages/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts
index cbb66891ba..dc76a8761b 100644
--- a/packages/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts
+++ b/packages/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts
@@ -23,7 +23,7 @@ import {
   BackstageServicePrincipal,
   BackstageUserPrincipal,
 } from '@backstage/backend-plugin-api';
-import { AuthenticationError } from '@backstage/errors';
+import { AuthenticationError, ForwardedError } from '@backstage/errors';
 import { JsonObject } from '@backstage/types';
 import { decodeJwt } from 'jose';
 import { ExternalTokenHandler } from './external/ExternalTokenHandler';
@@ -151,7 +151,13 @@ export class DefaultAuthService implements AuthService {
           });
         }
         // If the target plugin does not support the new auth service, fall back to using old token format
-        return this.tokenManager.getToken();
+        return this.tokenManager.getToken().catch(error => {
+          throw new ForwardedError(
+            `Unable to generate legacy token for communication with the '${targetPluginId}' plugin. ` +
+              `You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage`,
+            error,
+          );
+        });
       case 'user': {
         const { token } = internalForward;
         if (!token) {
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
index aca5211e2e..f603c6295e 100644
--- a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
+++ b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.test.ts
@@ -14,25 +14,20 @@
  * limitations under the License.
  */
 
-import { LoggerService } from '@backstage/backend-plugin-api';
-import { ConfigReader } from '@backstage/config';
 import { tokenManagerServiceFactory } from './tokenManagerServiceFactory';
+import { ServiceFactoryTester } from '@backstage/backend-test-utils';
 
 describe('tokenManagerFactory', () => {
-  it('should create managers that can share tokens in development', async () => {
-    (process.env as { NODE_ENV?: string }).NODE_ENV = 'development';
+  it('should create a disabled manager without configuration', async () => {
+    const tokenManager = await ServiceFactoryTester.from(
+      tokenManagerServiceFactory,
+    ).get();
 
-    const factory = tokenManagerServiceFactory() as any;
-    const deps = {
-      config: new ConfigReader({}),
-      logger: { warn() {} } as unknown as LoggerService,
-    };
-
-    const ctx = await factory.createRootContext?.(deps);
-    const manager1 = await factory.factory!(deps, ctx);
-    const manager2 = await factory.factory!(deps, ctx);
-
-    const { token } = await manager1.getToken();
-    await expect(manager2.authenticate(token)).resolves.toBeUndefined();
+    await expect(tokenManager.authenticate('abc')).rejects.toThrow(
+      'no legacy keys are configured',
+    );
+    await expect(tokenManager.getToken()).rejects.toThrow(
+      'no legacy keys are configured',
+    );
   });
 });
diff --git a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
index 7417c18e23..cad1b06035 100644
--- a/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
+++ b/packages/backend-app-api/src/services/implementations/tokenManager/tokenManagerServiceFactory.ts
@@ -30,6 +30,7 @@ export const tokenManagerServiceFactory = createServiceFactory({
   createRootContext({ config, logger }) {
     return ServerTokenManager.fromConfig(config, {
       logger,
+      allowDisabledTokenManager: true,
     });
   },
   async factory(_deps, tokenManager) {