paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 36 Packages Projects Releases Wiki Activity

Merge branch 'master' into mob/scaffolder-frontend

Browse Source
This commit is contained in:
Johan Haals
2021-02-16 11:50:52 +01:00
parent f6c81bb8d5 02109ea642
commit ddc3da44f1
74 changed files with 2468 additions and 2080 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/brown-pumpkins-impress.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend': patch
---
Refactored auth provider factories to accept options along with other internal refactoring of the auth providers.
.changeset/many-bags-sort.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/backend-common': patch
---
Support globs in `FileReaderProcessor`.
.changeset/mean-grapes-march.md
+7
View File
@@ -0,0 +1,7 @@
---
'@backstage/backend-common': patch
'@backstage/techdocs-common': patch
'@backstage/plugin-scaffolder-backend': patch
---
Switched to using `'x-access-token'` for authenticating Git over HTTPS towards GitHub.
.changeset/techdocs-fast-foxes-relate.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/techdocs-common': patch
---
After TechDocs generate step, insert build timestamp to techdocs_metadata.json
.changeset/techdocs-spotty-cooks-wait.md
+6
View File
@@ -0,0 +1,6 @@
---
'@backstage/techdocs-common': patch
'@backstage/plugin-techdocs-backend': patch
---
Add etag of the prepared file tree to techdocs_metadata.json in the storage
.changeset/wicked-forks-sleep.md
+13
View File
@@ -0,0 +1,13 @@
---
'@backstage/cli': minor
'@backstage/create-app': minor
---
Upgrading to lerna@4.0.0. This changes the interface for importing, and because we can't run multiple versions of lerna, this is a breaking change.
You'll need to update your root `package.json` like the following:
```diff
- "lerna": "^3.20.2",
+ "lerna": "^4.0.0",
```
app-config.yaml
+2 -1
View File
@@ -167,7 +167,8 @@ catalog:
# - target: ldaps://ds.example.net
# bind:
# dn: uid=ldap-reader-user,ou=people,ou=example,dc=example,dc=net
# secret: { $secret: { env: LDAP_SECRET } }
# secret:
# $env: LDAP_SECRET
# users:
# dn: ou=people,ou=example,dc=example,dc=net
# options:
contrib/chart/backstage/values.yaml
+21 -42
View File
@@ -127,88 +127,67 @@ appConfig:
appOrigin: 'http://localhost:3000/'
secure: false
clientId:
$secret:
env: AUTH_GOOGLE_CLIENT_ID
$env: AUTH_GOOGLE_CLIENT_ID
clientSecret:
$secret:
env: AUTH_GOOGLE_CLIENT_SECRET
$env: AUTH_GOOGLE_CLIENT_SECRET
github:
development:
appOrigin: 'http://localhost:3000/'
secure: false
clientId:
$secret:
env: AUTH_GITHUB_CLIENT_ID
$env: AUTH_GITHUB_CLIENT_ID
clientSecret:
$secret:
env: AUTH_GITHUB_CLIENT_SECRET
$env: AUTH_GITHUB_CLIENT_SECRET
enterpriseInstanceUrl:
$secret:
env: AUTH_GITHUB_ENTERPRISE_INSTANCE_URL
$env: AUTH_GITHUB_ENTERPRISE_INSTANCE_URL
gitlab:
development:
appOrigin: 'http://localhost:3000/'
secure: false
clientId:
$secret:
env: AUTH_GITLAB_CLIENT_ID
$env: AUTH_GITLAB_CLIENT_ID
clientSecret:
$secret:
env: AUTH_GITLAB_CLIENT_SECRET
$env: AUTH_GITLAB_CLIENT_SECRET
audience:
$secret:
env: GITLAB_BASE_URL
$env: GITLAB_BASE_URL
okta:
development:
appOrigin: 'http://localhost:3000/'
secure: false
clientId:
$secret:
env: AUTH_OKTA_CLIENT_ID
$env: AUTH_OKTA_CLIENT_ID
clientSecret:
$secret:
env: AUTH_OKTA_CLIENT_SECRET
$env: AUTH_OKTA_CLIENT_SECRET
audience:
$secret:
env: AUTH_OKTA_AUDIENCE
$env: AUTH_OKTA_AUDIENCE
oauth2:
development:
appOrigin: 'http://localhost:3000/'
secure: false
clientId:
$secret:
env: AUTH_OAUTH2_CLIENT_ID
$env: AUTH_OAUTH2_CLIENT_ID
clientSecret:
$secret:
env: AUTH_OAUTH2_CLIENT_SECRET
$env: AUTH_OAUTH2_CLIENT_SECRET
authorizationURL:
$secret:
env: AUTH_OAUTH2_AUTH_URL
$env: AUTH_OAUTH2_AUTH_URL
tokenURL:
$secret:
env: AUTH_OAUTH2_TOKEN_URL
$env: AUTH_OAUTH2_TOKEN_URL
auth0:
development:
clientId:
$secret:
env: AUTH_AUTH0_CLIENT_ID
$env: AUTH_AUTH0_CLIENT_ID
clientSecret:
$secret:
env: AUTH_AUTH0_CLIENT_SECRET
$env: AUTH_AUTH0_CLIENT_SECRET
domain:
$secret:
env: AUTH_AUTH0_DOMAIN
$env: AUTH_AUTH0_DOMAIN
microsoft:
development:
clientId:
$secret:
env: AUTH_MICROSOFT_CLIENT_ID
$env: AUTH_MICROSOFT_CLIENT_ID
clientSecret:
$secret:
env: AUTH_MICROSOFT_CLIENT_SECRET
$env: AUTH_MICROSOFT_CLIENT_SECRET
tenantId:
$secret:
env: AUTH_MICROSOFT_TENANT_ID
$env: AUTH_MICROSOFT_TENANT_ID
auth:
google:
docs/plugins/github-apps.md
+1 -1
View File
@@ -77,6 +77,6 @@ method of distributing secrets.
integrations:
github:
- host: github.com
apps:
apps:
- $include: example-backstage-app-credentials.yaml
```
package.json
+1 -1
View File
@@ -50,7 +50,7 @@
"concurrently": "^5.2.0",
"fs-extra": "^9.0.0",
"husky": "^4.2.3",
"lerna": "^3.20.2",
"lerna": "^4.0.0",
"lint-staged": "^10.1.0",
"prettier": "^2.0.5",
"recursive-readdir": "^2.2.2",
packages/backend-common/src/reading/GithubUrlReader.test.ts
+2 -2
View File
@@ -273,7 +273,7 @@ describe('GithubUrlReader', () => {
'https://github.com/backstage/mock',
);
const dir = await response.dir({ targetDir: '/tmp' });
const dir = await response.dir({ targetDir: tmpDir });
await expect(
fs.readFile(path.join(dir, 'mkdocs.yml'), 'utf8'),
@@ -354,7 +354,7 @@ describe('GithubUrlReader', () => {
'https://github.com/backstage/mock/tree/main/docs',
);
const dir = await response.dir({ targetDir: '/tmp' });
const dir = await response.dir({ targetDir: tmpDir });
await expect(
fs.readFile(path.join(dir, 'index.md'), 'utf8'),
packages/backend-common/src/scm/git.ts
+5 -6
View File
@@ -23,12 +23,11 @@ import fs from 'fs-extra';
import { Logger } from 'winston';
/*
provider username password
GitHub token 'x-oauth-basic'
GitHub App token 'x-access-token'
BitBucket 'x-token-auth' token
GitLab 'oauth2' token
From : https://isomorphic-git.org/docs/en/onAuth
provider username password
GitHub 'x-access-token' token
BitBucket 'x-token-auth' token
GitLab 'oauth2' token
From : https://isomorphic-git.org/docs/en/onAuth with fix for GitHub
Azure 'notempty' token
*/
packages/cli/package.json
+2 -2
View File
@@ -32,8 +32,8 @@
"@backstage/config": "^0.1.2",
"@backstage/config-loader": "^0.5.1",
"@hot-loader/react-dom": "^16.13.0",
"@lerna/package-graph": "^3.18.5",
"@lerna/project": "^3.18.0",
"@lerna/package-graph": "^4.0.0",
"@lerna/project": "^4.0.0",
"@octokit/request": "^5.4.12",
"@rollup/plugin-commonjs": "^17.1.0",
"@rollup/plugin-json": "^4.0.2",
packages/cli/src/lib/bundler/config.ts
+2 -2
View File
@@ -72,8 +72,8 @@ async function readBuildInfo() {
}
async function loadLernaPackages(): Promise<LernaPackage[]> {
const LernaProject = require('@lerna/project');
const project = new LernaProject(cliPaths.targetDir);
const { Project } = require('@lerna/project');
const project = new Project(cliPaths.targetDir);
return project.getPackages();
}
packages/cli/src/lib/config.ts
+3 -3
View File
@@ -28,8 +28,8 @@ export async function loadCliConfig(options: Options) {
const configPaths = options.args.map(arg => paths.resolveTarget(arg));
// Consider all packages in the monorepo when loading in config
const LernaProject = require('@lerna/project');
const project = new LernaProject(paths.targetDir);
const { Project } = require('@lerna/project');
const project = new Project(paths.targetDir);
const packages = await project.getPackages();
const localPackageNames = options.fromPackage
@@ -75,7 +75,7 @@ export async function loadCliConfig(options: Options) {
}
function findPackages(packages: any[], fromPackage: string): string[] {
const PackageGraph = require('@lerna/package-graph');
const { PackageGraph } = require('@lerna/package-graph');
const graph = new PackageGraph(packages);
packages/cli/src/lib/packager/index.ts
+3 -3
View File
@@ -219,10 +219,10 @@ async function moveToDistWorkspace(
}
async function findTargetPackages(pkgNames: string[]): Promise<LernaPackage[]> {
const LernaProject = require('@lerna/project');
const PackageGraph = require('@lerna/package-graph');
const { Project } = require('@lerna/project');
const { PackageGraph } = require('@lerna/package-graph');
const project = new LernaProject(paths.targetDir);
const project = new Project(paths.targetDir);
const packages = await project.getPackages();
const graph = new PackageGraph(packages);
packages/cli/src/lib/versioning/packages.test.ts
+2 -2
View File
@@ -59,8 +59,8 @@ describe('mapDependencies', () => {
it('should read dependencies', async () => {
// Make sure all modules involved in package discovery are in the module cache before we mock fs
const LernaProject = require('@lerna/project');
const project = new LernaProject(paths.targetDir);
const { Project } = require('@lerna/project');
const project = new Project(paths.targetDir);
await project.getPackages();
mockFs({
packages/cli/src/lib/versioning/packages.ts
+2 -2
View File
@@ -67,8 +67,8 @@ export async function fetchPackageInfo(
export async function mapDependencies(
targetDir: string,
): Promise<Map<string, PkgVersionInfo[]>> {
const LernaProject = require('@lerna/project');
const project = new LernaProject(targetDir);
const { Project } = require('@lerna/project');
const project = new Project(targetDir);
const packages = await project.getPackages();
const dependencyMap = new Map<string, PkgVersionInfo[]>();
packages/create-app/templates/default-app/package.json.hbs
+1 -1
View File
@@ -30,7 +30,7 @@
"devDependencies": {
"@backstage/cli": "^{{version '@backstage/cli'}}",
"@spotify/prettier-config": "^7.0.0",
"lerna": "^3.20.2",
"lerna": "^4.0.0",
"prettier": "^1.19.1"
},
"prettier": "@spotify/prettier-config",
packages/integration/src/gitlab/core.test.ts
+15
View File
@@ -50,6 +50,21 @@ describe('gitlab core', () => {
describe('getGitLabFileFetchUrl', () => {
it.each([
// Project URLs
{
config: configWithNoToken,
url:
'https://gitlab.com/groupA/teams/teamA/subgroupA/repoA/-/blob/branch/my/path/to/file.yaml',
result:
'https://gitlab.com/api/v4/projects/12345/repository/files/my%2Fpath%2Fto%2Ffile.yaml/raw?ref=branch',
},
{
config: configWithNoToken,
// Works with non URI encoded link
url:
'https://gitlab.com/groupA/teams/teamA/subgroupA/repoA/-/blob/branch/my/path/to/file with spaces.yaml',
result:
'https://gitlab.com/api/v4/projects/12345/repository/files/my%2Fpath%2Fto%2Ffile%20with%20spaces.yaml/raw?ref=branch',
},
{
config: configWithNoToken,
url:
packages/techdocs-common/__mocks__/aws-sdk.ts
+1 -5
View File
@@ -71,11 +71,7 @@ export class S3 {
return {
promise: () =>
new Promise((resolve, reject) => {
if (!fs.existsSync(Key)) {
reject('');
} else {
resolve('');
}
resolve('');
}),
};
}
packages/techdocs-common/src/helpers.ts
+3 -3
View File
@@ -133,11 +133,11 @@ export const checkoutGitRepository = async (
switch (type) {
case 'github':
git = Git.fromAuth({
username: token,
password: 'x-oauth-basic',
username: 'x-access-token',
password: token,
logger,
});
parsedGitLocation.token = `${token}:x-oauth-basic`;
parsedGitLocation.token = `x-access-token:${token}`;
break;
case 'gitlab':
git = Git.fromAuth({
packages/techdocs-common/src/stages/generate/helpers.test.ts
+93 -14
View File
@@ -13,22 +13,24 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import fs from 'fs-extra';
import os from 'os';
import { resolve as resolvePath } from 'path';
import Stream, { PassThrough } from 'stream';
import { getVoidLogger } from '@backstage/backend-common';
import Docker from 'dockerode';
import fs from 'fs-extra';
import mockFs from 'mock-fs';
import * as winston from 'winston';
import {
runDockerContainer,
getGeneratorKey,
isValidRepoUrlForMkdocs,
getRepoUrlFromLocationAnnotation,
patchMkdocsYmlPreBuild,
} from './helpers';
import { RemoteProtocol } from '../prepare/types';
import os from 'os';
import path, { resolve as resolvePath } from 'path';
import Stream, { PassThrough } from 'stream';
import { ParsedLocationAnnotation } from '../../helpers';
import { RemoteProtocol } from '../prepare/types';
import {
addBuildTimestampMetadata,
getGeneratorKey,
getRepoUrlFromLocationAnnotation,
isValidRepoUrlForMkdocs,
patchMkdocsYmlPreBuild,
runDockerContainer,
storeEtagMetadata,
} from './helpers';
const mockEntity = {
apiVersion: 'version',
@@ -46,7 +48,8 @@ const mkdocsYml = fs.readFileSync(
const mkdocsYmlWithRepoUrl = fs.readFileSync(
resolvePath(__filename, '../__fixtures__/mkdocs_with_repo_url.yml'),
);
const mockLogger = winston.createLogger();
const mockLogger = getVoidLogger();
const rootDir = os.platform() === 'win32' ? 'C:\\rootDir' : '/rootDir';
describe('helpers', () => {
describe('getGeneratorKey', () => {
@@ -329,4 +332,80 @@ describe('helpers', () => {
);
});
});
describe('addBuildTimestampMetadata', () => {
beforeEach(() => {
mockFs.restore();
mockFs({
[rootDir]: {
'invalid_techdocs_metadata.json': 'dsds',
'techdocs_metadata.json': '{"site_name": "Tech Docs"}',
},
});
});
afterEach(() => {
mockFs.restore();
});
it('should create the file if it does not exist', async () => {
const filePath = path.join(rootDir, 'wrong_techdocs_metadata.json');
await addBuildTimestampMetadata(filePath, mockLogger);
// Check if the file exists
await expect(
fs.access(filePath, fs.constants.F_OK),
).resolves.not.toThrowError();
});
it('should throw error when the JSON is invalid', async () => {
const filePath = path.join(rootDir, 'invalid_techdocs_metadata.json');
await expect(
addBuildTimestampMetadata(filePath, mockLogger),
).rejects.toThrowError('Unexpected token d in JSON at position 0');
});
it('should add build timestamp to the metadata json', async () => {
const filePath = path.join(rootDir, 'techdocs_metadata.json');
await addBuildTimestampMetadata(filePath, mockLogger);
const json = await fs.readJson(filePath);
expect(json.build_timestamp).toBeLessThanOrEqual(Date.now());
});
});
describe('storeEtagMetadata', () => {
beforeEach(() => {
mockFs.restore();
mockFs({
[rootDir]: {
'invalid_techdocs_metadata.json': 'dsds',
'techdocs_metadata.json': '{"site_name": "Tech Docs"}',
},
});
});
afterEach(() => {
mockFs.restore();
});
it('should throw error when the JSON is invalid', async () => {
const filePath = path.join(rootDir, 'invalid_techdocs_metadata.json');
await expect(
storeEtagMetadata(filePath, 'etag123abc'),
).rejects.toThrowError('Unexpected token d in JSON at position 0');
});
it('should add etag to the metadata json', async () => {
const filePath = path.join(rootDir, 'techdocs_metadata.json');
await storeEtagMetadata(filePath, 'etag123abc');
const json = await fs.readJson(filePath);
expect(json.etag).toBe('etag123abc');
});
});
});
packages/techdocs-common/src/stages/generate/helpers.ts
+55 -7
View File
@@ -14,16 +14,16 @@
* limitations under the License.
*/
import fs from 'fs-extra';
import { spawn } from 'child_process';
import { Writable, PassThrough } from 'stream';
import Docker from 'dockerode';
import yaml from 'js-yaml';
import { Logger } from 'winston';
import { Entity } from '@backstage/catalog-model';
import { SupportedGeneratorKey } from './types';
import { spawn } from 'child_process';
import Docker from 'dockerode';
import fs from 'fs-extra';
import yaml from 'js-yaml';
import { PassThrough, Writable } from 'stream';
import { Logger } from 'winston';
import { ParsedLocationAnnotation } from '../../helpers';
import { RemoteProtocol } from '../prepare/types';
import { SupportedGeneratorKey } from './types';
// TODO: Implement proper support for more generators.
export function getGeneratorKey(entity: Entity): SupportedGeneratorKey {
@@ -275,3 +275,51 @@ export const patchMkdocsYmlPreBuild = async (
return;
}
};
/**
* Update the techdocs_metadata.json to add a new build timestamp metadata. Create the .json file if it doesn't exist.
*
* @param {string} techdocsMetadataPath File path to techdocs_metadata.json
*/
export const addBuildTimestampMetadata = async (
techdocsMetadataPath: string,
logger: Logger,
): Promise<void> => {
// check if file exists, create if it does not.
try {
await fs.access(techdocsMetadataPath, fs.constants.F_OK);
} catch (err) {
// Bootstrap file with empty JSON
await fs.writeJson(techdocsMetadataPath, JSON.parse('{}'));
}
// check if valid Json
let json;
try {
json = await fs.readJson(techdocsMetadataPath);
} catch (err) {
const message = `Invalid JSON at ${techdocsMetadataPath} with error ${err.message}`;
logger.error(message);
throw new Error(message);
}
json.build_timestamp = Date.now();
await fs.writeJson(techdocsMetadataPath, json);
return;
};
/**
* Update the techdocs_metadata.json to add etag of the prepared tree (e.g. commit SHA or actual Etag of the resource).
* This is helpful to check if a TechDocs site in storage has gone outdated, without maintaining an in-memory build info
* per Backstage instance.
*
* @param {string} techdocsMetadataPath File path to techdocs_metadata.json
* @param {string} etag
*/
export const storeEtagMetadata = async (
techdocsMetadataPath: string,
etag: string,
): Promise<void> => {
const json = await fs.readJson(techdocsMetadataPath);
json.etag = etag;
await fs.writeJson(techdocsMetadataPath, json);
};
packages/techdocs-common/src/stages/generate/techdocs.ts
+29 -7
View File
@@ -14,17 +14,18 @@
* limitations under the License.
*/
import path from 'path';
import { Logger } from 'winston';
import { PassThrough } from 'stream';
import { Config } from '@backstage/config';
import { GeneratorBase, GeneratorRunOptions } from './types';
import path from 'path';
import { PassThrough } from 'stream';
import { Logger } from 'winston';
import {
runDockerContainer,
runCommand,
addBuildTimestampMetadata,
patchMkdocsYmlPreBuild,
runCommand,
runDockerContainer,
storeEtagMetadata,
} from './helpers';
import { GeneratorBase, GeneratorRunOptions } from './types';
type TechdocsGeneratorOptions = {
// This option enables users to configure if they want to use TechDocs container
@@ -62,6 +63,7 @@ export class TechdocsGenerator implements GeneratorBase {
outputDir,
dockerClient,
parsedLocationAnnotation,
etag,
}: GeneratorRunOptions): Promise<void> {
const [log, logStream] = createStream();
@@ -118,5 +120,25 @@ export class TechdocsGenerator implements GeneratorBase {
`Failed to generate docs from ${inputDir} into ${outputDir} with error ${error.message}`,
);
}
/**
* Post Generate steps
*/
// Add build timestamp to techdocs_metadata.json
// Creates techdocs_metadata.json if file does not exist.
await addBuildTimestampMetadata(
path.join(outputDir, 'techdocs_metadata.json'),
this.logger,
);
// Add etag of the prepared tree to techdocs_metadata.json
// Assumes that the file already exists.
if (etag) {
await storeEtagMetadata(
path.join(outputDir, 'techdocs_metadata.json'),
etag,
);
}
}
}
packages/techdocs-common/src/stages/generate/types.ts
+4 -2
View File
@@ -13,9 +13,9 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { Writable } from 'stream';
import Docker from 'dockerode';
import { Entity } from '@backstage/catalog-model';
import Docker from 'dockerode';
import { Writable } from 'stream';
import { ParsedLocationAnnotation } from '../../helpers';
/**
@@ -25,6 +25,7 @@ import { ParsedLocationAnnotation } from '../../helpers';
* @param {string} outputDir Directory to store generated docs in. Usually - a newly created temporary directory.
* @param {Docker} dockerClient A docker client to run any generator on top of your directory
* @param {ParsedLocationAnnotation} parsedLocationAnnotation backstage.io/techdocs-ref annotation of an entity
* @param {string} etag A unique identifier for the prepared tree e.g. commit SHA. If provided it will be stored in techdocs_metadata.json.
* @param {Writable} [logStream] A dedicated log stream
*/
export type GeneratorRunOptions = {
@@ -32,6 +33,7 @@ export type GeneratorRunOptions = {
outputDir: string;
dockerClient: Docker;
parsedLocationAnnotation?: ParsedLocationAnnotation;
etag?: string;
logStream?: Writable;
};
packages/techdocs-common/src/stages/publish/awsS3.test.ts
+7 -11
View File
@@ -13,13 +13,13 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import type { Entity, EntityName } from '@backstage/catalog-model';
import { ConfigReader } from '@backstage/config';
import mockFs from 'mock-fs';
import path from 'path';
import * as winston from 'winston';
import { ConfigReader } from '@backstage/config';
import { AwsS3Publish } from './awsS3';
import { PublisherBase, TechDocsMetadata } from './types';
import type { Entity, EntityName } from '@backstage/catalog-model';
const createMockEntity = (annotations = {}): Entity => {
return {
@@ -127,9 +127,9 @@ describe('AwsS3Publish', () => {
directory: wrongPathToGeneratedDirectory,
})
.catch(error =>
expect(error).toEqual(
new Error(
`Unable to upload file(s) to AWS S3. Error Failed to read template directory: ENOENT, no such file or directory '${wrongPathToGeneratedDirectory}'`,
expect(error.message).toEqual(
expect.stringContaining(
'Unable to upload file(s) to AWS S3. Error Failed to read template directory: ENOENT, no such file or directory',
),
),
);
@@ -205,16 +205,12 @@ describe('AwsS3Publish', () => {
it('should return an error if the techdocs_metadata.json file is not present', async () => {
const entityNameMock = createMockEntityName();
const entity = createMockEntity();
const entityRootDir = getEntityRootDir(entity);
await publisher
.fetchTechDocsMetadata(entityNameMock)
.catch(error =>
expect(error).toEqual(
new Error(
`TechDocs metadata fetch failed, The file ${entityRootDir}/techdocs_metadata.json doest not exist !`,
),
expect(error.message).toEqual(
expect.stringContaining('TechDocs metadata fetch'),
),
);
});
packages/techdocs-common/src/stages/publish/awsS3.ts
+8 -8
View File
@@ -13,19 +13,19 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import path from 'path';
import express from 'express';
import aws from 'aws-sdk';
import { ManagedUpload } from 'aws-sdk/clients/s3';
import { Logger } from 'winston';
import { Entity, EntityName } from '@backstage/catalog-model';
import { Config } from '@backstage/config';
import { getHeadersForFileExtension, getFileTreeRecursively } from './helpers';
import { PublisherBase, PublishRequest, TechDocsMetadata } from './types';
import aws from 'aws-sdk';
import { ManagedUpload } from 'aws-sdk/clients/s3';
import express from 'express';
import fs from 'fs-extra';
import { Readable } from 'stream';
import JSON5 from 'json5';
import createLimiter from 'p-limit';
import path from 'path';
import { Readable } from 'stream';
import { Logger } from 'winston';
import { getFileTreeRecursively, getHeadersForFileExtension } from './helpers';
import { PublisherBase, PublishRequest, TechDocsMetadata } from './types';
const streamToBuffer = (stream: Readable): Promise<Buffer> => {
return new Promise((resolve, reject) => {
plugins/auth-backend/package.json
+1 -1
View File
@@ -34,6 +34,7 @@
"@backstage/catalog-model": "^0.7.1",
"@backstage/config": "^0.1.2",
"@types/express": "^4.17.6",
"@types/passport": "^1.0.3",
"compression": "^1.7.4",
"cookie-parser": "^1.4.5",
"cors": "^2.8.5",
@@ -70,7 +71,6 @@
"@types/cookie-parser": "^1.4.2",
"@types/express-session": "^1.17.2",
"@types/jwt-decode": "^3.1.0",
"@types/passport": "^1.0.3",
"@types/passport-github2": "^1.2.4",
"@types/passport-google-oauth20": "^2.0.3",
"@types/passport-microsoft": "^0.0.0",
plugins/auth-backend/src/lib/oauth/index.ts
+1
View File
@@ -25,4 +25,5 @@ export type {
OAuthState,
OAuthStartRequest,
OAuthRefreshRequest,
OAuthResult,
} from './types';
plugins/auth-backend/src/lib/oauth/types.ts
+12
View File
@@ -15,6 +15,7 @@
*/
import express from 'express';
import { Profile as PassportProfile } from 'passport';
import { AuthResponse, RedirectInfo } from '../../providers/types';
/**
@@ -35,6 +36,17 @@ export type OAuthProviderOptions = {
callbackUrl: string;
};
export type OAuthResult = {
fullProfile: PassportProfile;
params: {
id_token?: string;
scope: string;
expires_in: number;
};
accessToken: string;
refreshToken?: string;
};
export type OAuthResponse = AuthResponse<OAuthProviderInfo>;
export type OAuthProviderInfo = {
plugins/auth-backend/src/lib/passport/PassportStrategyHelper.test.ts
+1 -1
View File
@@ -87,7 +87,7 @@ describe('PassportStrategyHelper', () => {
expect(spyAuthenticate).toBeCalledTimes(1);
await expect(frameHandlerStrategyPromise).resolves.toStrictEqual(
expect.objectContaining({
response: { accessToken: 'ACCESS_TOKEN' },
result: { accessToken: 'ACCESS_TOKEN' },
privateInfo: { refreshToken: 'REFRESH_TOKEN' },
}),
);
plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts
+9 -11
View File
@@ -39,7 +39,7 @@ export const makeProfileInfo = (
}
let picture: string | undefined = undefined;
if (profile.photos) {
if (profile.photos && profile.photos.length > 0) {
const [firstPhoto] = profile.photos;
picture = firstPhoto.value;
}
@@ -80,15 +80,15 @@ export const executeRedirectStrategy = async (
});
};
export const executeFrameHandlerStrategy = async <T, PrivateInfo = never>(
export const executeFrameHandlerStrategy = async <Result, PrivateInfo = never>(
req: express.Request,
providerStrategy: passport.Strategy,
) => {
return new Promise<{ response: T; privateInfo: PrivateInfo }>(
return new Promise<{ result: Result; privateInfo: PrivateInfo }>(
(resolve, reject) => {
const strategy = Object.create(providerStrategy);
strategy.success = (response: any, privateInfo: any) => {
resolve({ response, privateInfo });
strategy.success = (result: any, privateInfo: any) => {
resolve({ result, privateInfo });
};
strategy.fail = (
info: { type: 'success' | 'error'; message?: string },
@@ -190,19 +190,17 @@ type ProviderStrategy = {
export const executeFetchUserProfileStrategy = async (
providerStrategy: passport.Strategy,
accessToken: string,
idToken?: string,
): Promise<ProfileInfo> => {
): Promise<passport.Profile> => {
return new Promise((resolve, reject) => {
const anyStrategy = (providerStrategy as unknown) as ProviderStrategy;
anyStrategy.userProfile(
accessToken,
(error: Error, passportProfile: passport.Profile) => {
(error: Error, rawProfile: passport.Profile) => {
if (error) {
reject(error);
} else {
resolve(rawProfile);
}
const profile = makeProfileInfo(passportProfile, idToken);
resolve(profile);
},
);
});
plugins/auth-backend/src/providers/auth0/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createAuth0Provider } from './provider';
export type { Auth0ProviderOptions } from './provider';
plugins/auth-backend/src/providers/auth0/provider.ts
+45 -37
View File
@@ -26,6 +26,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import {
executeFetchUserProfileStrategy,
@@ -61,20 +62,16 @@ export class Auth0AuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
fullProfile,
accessToken,
refreshToken,
params,
},
{
refreshToken,
@@ -96,13 +93,23 @@ export class Auth0AuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -114,11 +121,11 @@ export class Auth0AuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -148,28 +155,29 @@ export class Auth0AuthProvider implements OAuthHandlers {
}
}
export const createAuth0Provider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const domain = envConfig.getString('domain');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type Auth0ProviderOptions = {};
const provider = new Auth0AuthProvider({
clientId,
clientSecret,
callbackUrl,
domain,
});
export const createAuth0Provider = (
_options?: Auth0ProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const domain = envConfig.getString('domain');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
const provider = new Auth0AuthProvider({
clientId,
clientSecret,
callbackUrl,
domain,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/aws-alb/index.ts
+1
View File
@@ -14,3 +14,4 @@
* limitations under the License.
*/
export { createAwsAlbProvider } from './provider';
export type { AwsAlbProviderOptions } from './provider';
plugins/auth-backend/src/providers/aws-alb/provider.ts
+22 -18
View File
@@ -106,22 +106,26 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
}
}
export const createAwsAlbProvider = ({
logger,
catalogApi,
config,
identityResolver,
}: AuthProviderFactoryOptions) => {
const region = config.getString('region');
const issuer = config.getOptionalString('iss');
if (identityResolver !== undefined) {
return new AwsAlbAuthProvider(logger, catalogApi, {
region,
issuer,
identityResolutionCallback: identityResolver,
});
}
throw new Error(
'Identity resolver is required to use this authentication provider',
);
export type AwsAlbProviderOptions = {};
export const createAwsAlbProvider = (_options?: AwsAlbProviderOptions) => {
return ({
logger,
catalogApi,
config,
identityResolver,
}: AuthProviderFactoryOptions) => {
const region = config.getString('region');
const issuer = config.getOptionalString('iss');
if (identityResolver !== undefined) {
return new AwsAlbAuthProvider(logger, catalogApi, {
region,
issuer,
identityResolutionCallback: identityResolver,
});
}
throw new Error(
'Identity resolver is required to use this authentication provider',
);
};
};
plugins/auth-backend/src/providers/factories.ts
+11 -11
View File
@@ -28,15 +28,15 @@ import { AuthProviderFactory } from './types';
import { createAwsAlbProvider } from './aws-alb';
export const factories: { [providerId: string]: AuthProviderFactory } = {
google: createGoogleProvider,
github: createGithubProvider,
gitlab: createGitlabProvider,
saml: createSamlProvider,
okta: createOktaProvider,
auth0: createAuth0Provider,
microsoft: createMicrosoftProvider,
oauth2: createOAuth2Provider,
oidc: createOidcProvider,
onelogin: createOneLoginProvider,
awsalb: createAwsAlbProvider,
google: createGoogleProvider(),
github: createGithubProvider(),
gitlab: createGitlabProvider(),
saml: createSamlProvider(),
okta: createOktaProvider(),
auth0: createAuth0Provider(),
microsoft: createMicrosoftProvider(),
oauth2: createOAuth2Provider(),
oidc: createOidcProvider(),
onelogin: createOneLoginProvider(),
awsalb: createAwsAlbProvider(),
};
plugins/auth-backend/src/providers/github/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createGithubProvider } from './provider';
export type { GithubProviderOptions } from './provider';
plugins/auth-backend/src/providers/github/provider.test.ts
+49 -38
View File
@@ -14,13 +14,31 @@
* limitations under the License.
*/
import { Profile as PassportProfile } from 'passport';
import { GithubAuthProvider } from './provider';
import * as helpers from '../../lib/passport';
import { OAuthResult } from '../../lib/oauth';
const mockFrameHandler = (jest.spyOn(
helpers,
'executeFrameHandlerStrategy',
) as unknown) as jest.MockedFunction<
() => Promise<{
result: Omit<OAuthResult, 'params'> & { params: { scope: string } };
}>
>;
describe('GithubAuthProvider', () => {
const provider = new GithubAuthProvider({
callbackUrl: 'mock',
clientId: 'mock',
clientSecret: 'mock',
});
describe('should transform to type OAuthResponse', () => {
it('when all fields are present, it should be able to map them', () => {
it('when all fields are present, it should be able to map them', async () => {
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
const rawProfile = {
const fullProfile = {
id: 'uid-123',
username: 'jimmymarkum',
provider: 'github',
@@ -59,18 +77,17 @@ describe('GithubAuthProvider', () => {
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
it('when "email" is missing, it should be able to create the profile without it', () => {
it('when "email" is missing, it should be able to create the profile without it', async () => {
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
const rawProfile = {
const fullProfile = ({
id: 'uid-123',
username: 'jimmymarkum',
provider: 'github',
@@ -82,7 +99,7 @@ describe('GithubAuthProvider', () => {
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
],
};
} as unknown) as PassportProfile;
const params = {
scope: 'read:scope',
@@ -105,18 +122,16 @@ describe('GithubAuthProvider', () => {
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
it('when "displayName" is missing, it should be able to create the profile and map "displayName" with "username"', () => {
it('when "displayName" is missing, it should be able to create the profile and map "displayName" with "username"', async () => {
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
const rawProfile = {
const fullProfile = ({
id: 'uid-123',
username: 'jimmymarkum',
provider: 'github',
@@ -128,7 +143,7 @@ describe('GithubAuthProvider', () => {
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
],
};
} as unknown) as PassportProfile;
const params = {
scope: 'read:scope',
@@ -150,19 +165,17 @@ describe('GithubAuthProvider', () => {
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
it('when "photos" is missing, it should be able to create the profile without it', () => {
it('when "photos" is missing, it should be able to create the profile without it', async () => {
const accessToken =
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe';
const rawProfile = {
const fullProfile = {
id: 'ipd12039',
username: 'daveboyle',
provider: 'gitlab',
@@ -195,13 +208,11 @@ describe('GithubAuthProvider', () => {
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
});
});
plugins/auth-backend/src/providers/github/provider.ts
+67 -100
View File
@@ -27,12 +27,11 @@ import {
OAuthAdapter,
OAuthProviderOptions,
OAuthHandlers,
OAuthResponse,
OAuthEnvironmentHandler,
OAuthStartRequest,
encodeState,
OAuthResult,
} from '../../lib/oauth';
import passport from 'passport';
export type GithubAuthProviderOptions = OAuthProviderOptions & {
tokenUrl?: string;
@@ -43,55 +42,6 @@ export type GithubAuthProviderOptions = OAuthProviderOptions & {
export class GithubAuthProvider implements OAuthHandlers {
private readonly _strategy: GithubStrategy;
static transformPassportProfile(rawProfile: any): passport.Profile {
const profile: passport.Profile = {
id: rawProfile.username,
username: rawProfile.username,
provider: rawProfile.provider,
displayName: rawProfile.displayName || rawProfile.username,
photos: rawProfile.photos,
emails: rawProfile.emails,
};
return profile;
}
static transformOAuthResponse(
accessToken: string,
rawProfile: any,
params: any = {},
): OAuthResponse {
const passportProfile = GithubAuthProvider.transformPassportProfile(
rawProfile,
);
const profile = makeProfileInfo(passportProfile, params.id_token);
const providerInfo = {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
idToken: params.id_token,
};
// GitHub provides an id numeric value (123)
// as a fallback
const id = passportProfile!.id;
if (params.expires_in) {
providerInfo.expiresInSeconds = params.expires_in;
}
if (params.id_token) {
providerInfo.idToken = params.id_token;
}
return {
providerInfo,
profile,
backstageIdentity: {
id,
},
};
}
constructor(options: GithubAuthProviderOptions) {
this._strategy = new GithubStrategy(
{
@@ -104,17 +54,12 @@ export class GithubAuthProvider implements OAuthHandlers {
},
(
accessToken: any,
_: any,
refreshToken: any,
params: any,
rawProfile: any,
done: PassportDoneCallback<OAuthResponse>,
fullProfile: any,
done: PassportDoneCallback<OAuthResult>,
) => {
const oauthResponse = GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
);
done(undefined, oauthResponse);
done(undefined, { fullProfile, params, accessToken, refreshToken });
},
);
}
@@ -127,51 +72,73 @@ export class GithubAuthProvider implements OAuthHandlers {
}
async handler(req: express.Request) {
const { response } = await executeFrameHandlerStrategy<OAuthResponse>(
req,
this._strategy,
const {
result: { fullProfile, accessToken, params },
} = await executeFrameHandlerStrategy<OAuthResult>(req, this._strategy);
const profile = makeProfileInfo(
{
...fullProfile,
id: fullProfile.username || fullProfile.id,
displayName:
fullProfile.displayName || fullProfile.username || fullProfile.id,
},
params.id_token,
);
return { response };
return {
response: {
profile,
providerInfo: {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
backstageIdentity: {
id: fullProfile.username || fullProfile.id,
},
},
};
}
}
export const createGithubProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const enterpriseInstanceUrl = envConfig.getOptionalString(
'enterpriseInstanceUrl',
);
const authorizationUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/authorize`
: undefined;
const tokenUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/access_token`
: undefined;
const userProfileUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/api/v3/user`
: undefined;
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type GithubProviderOptions = {};
const provider = new GithubAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenUrl,
userProfileUrl,
authorizationUrl,
});
export const createGithubProvider = (
_options?: GithubProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const enterpriseInstanceUrl = envConfig.getOptionalString(
'enterpriseInstanceUrl',
);
const authorizationUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/authorize`
: undefined;
const tokenUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/access_token`
: undefined;
const userProfileUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/api/v3/user`
: undefined;
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
persistScopes: true,
providerId,
tokenIssuer,
const provider = new GithubAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenUrl,
userProfileUrl,
authorizationUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
persistScopes: true,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/gitlab/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createGitlabProvider } from './provider';
export type { GitlabProviderOptions } from './provider';
plugins/auth-backend/src/providers/gitlab/provider.test.ts
+23 -12
View File
@@ -15,14 +15,21 @@
*/
import { GitlabAuthProvider } from './provider';
import * as helpers from '../../lib/passport';
import { OAuthResult } from '../../lib/oauth';
const mockFrameHandler = (jest.spyOn(
helpers,
'executeFrameHandlerStrategy',
) as unknown) as jest.MockedFunction<() => Promise<{ result: OAuthResult }>>;
describe('GitlabAuthProvider', () => {
it('should transform to type OAuthResponse', () => {
it('should transform to type OAuthResponse', async () => {
const tests = [
{
arguments: {
result: {
accessToken: '19xasczxcm9n7gacn9jdgm19me',
rawProfile: {
fullProfile: {
id: 'uid-123',
username: 'jimmymarkum',
provider: 'gitlab',
@@ -58,10 +65,10 @@ describe('GitlabAuthProvider', () => {
},
},
{
arguments: {
result: {
accessToken:
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe',
rawProfile: {
fullProfile: {
id: 'ipd12039',
username: 'daveboyle',
provider: 'gitlab',
@@ -74,6 +81,7 @@ describe('GitlabAuthProvider', () => {
},
params: {
scope: 'read_repository',
expires_in: 200,
},
},
expect: {
@@ -83,6 +91,7 @@ describe('GitlabAuthProvider', () => {
providerInfo: {
accessToken:
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe',
expiresInSeconds: 200,
scope: 'read_repository',
},
profile: {
@@ -93,14 +102,16 @@ describe('GitlabAuthProvider', () => {
},
];
const provider = new GitlabAuthProvider({
clientId: 'mock',
clientSecret: 'mock',
callbackUrl: 'mock',
baseUrl: 'mock',
});
for (const test of tests) {
expect(
GitlabAuthProvider.transformOAuthResponse(
test.arguments.accessToken,
test.arguments.rawProfile,
test.arguments.params,
),
).toEqual(test.expect);
mockFrameHandler.mockResolvedValueOnce({ result: test.result });
const { response } = await provider.handler({} as any);
expect(response).toEqual(test.expect);
}
});
});
plugins/auth-backend/src/providers/gitlab/provider.ts
+67 -92
View File
@@ -31,8 +31,8 @@ import {
OAuthEnvironmentHandler,
OAuthStartRequest,
encodeState,
OAuthResult,
} from '../../lib/oauth';
import passport from 'passport';
export type GitlabAuthProviderOptions = OAuthProviderOptions & {
baseUrl: string;
@@ -41,64 +41,6 @@ export type GitlabAuthProviderOptions = OAuthProviderOptions & {
export class GitlabAuthProvider implements OAuthHandlers {
private readonly _strategy: GitlabStrategy;
static transformPassportProfile(rawProfile: any): passport.Profile {
const profile: passport.Profile = {
id: rawProfile.id,
username: rawProfile.username,
provider: rawProfile.provider,
displayName: rawProfile.displayName,
};
if (rawProfile.emails && rawProfile.emails.length > 0) {
profile.emails = rawProfile.emails;
}
if (rawProfile.avatarUrl) {
profile.photos = [{ value: rawProfile.avatarUrl }];
}
return profile;
}
static transformOAuthResponse(
accessToken: string,
rawProfile: any,
params: any = {},
): OAuthResponse {
const passportProfile = GitlabAuthProvider.transformPassportProfile(
rawProfile,
);
const profile = makeProfileInfo(passportProfile, params.id_token);
const providerInfo = {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
idToken: params.id_token,
};
// gitlab provides an id numeric value (123)
// as a fallback
let id = passportProfile!.id;
if (profile.email) {
id = profile.email.split('@')[0];
}
if (params.expires_in) {
providerInfo.expiresInSeconds = params.expires_in;
}
if (params.id_token) {
providerInfo.idToken = params.id_token;
}
return {
providerInfo,
profile,
backstageIdentity: {
id,
},
};
}
constructor(options: GitlabAuthProviderOptions) {
this._strategy = new GitlabStrategy(
{
@@ -109,17 +51,12 @@ export class GitlabAuthProvider implements OAuthHandlers {
},
(
accessToken: any,
_: any,
refreshToken: any,
params: any,
rawProfile: any,
done: PassportDoneCallback<OAuthResponse>,
fullProfile: any,
done: PassportDoneCallback<OAuthResult>,
) => {
const oauthResponse = GitlabAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
);
done(undefined, oauthResponse);
done(undefined, { fullProfile, params, accessToken, refreshToken });
},
);
}
@@ -132,36 +69,74 @@ export class GitlabAuthProvider implements OAuthHandlers {
}
async handler(req: express.Request): Promise<{ response: OAuthResponse }> {
return await executeFrameHandlerStrategy<OAuthResponse>(
const { result } = await executeFrameHandlerStrategy<OAuthResult>(
req,
this._strategy,
);
const { accessToken, params } = result;
const fullProfile = result.fullProfile as OAuthResult['fullProfile'] & {
avatarUrl?: string;
};
const profile = makeProfileInfo(
{
...fullProfile,
photos: [
...(fullProfile.photos ?? []),
...(fullProfile.avatarUrl ? [{ value: fullProfile.avatarUrl }] : []),
],
},
params.id_token,
);
// gitlab provides an id numeric value (123)
// as a fallback
let id = fullProfile.id;
if (profile.email) {
id = profile.email.split('@')[0];
}
return {
response: {
profile,
providerInfo: {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
idToken: params.id_token,
},
backstageIdentity: {
id,
},
},
};
}
}
export const createGitlabProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const baseUrl = audience || 'https://gitlab.com';
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type GitlabProviderOptions = {};
const provider = new GitlabAuthProvider({
clientId,
clientSecret,
callbackUrl,
baseUrl,
});
export const createGitlabProvider = (
_options?: GitlabProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const baseUrl = audience || 'https://gitlab.com';
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
const provider = new GitlabAuthProvider({
clientId,
clientSecret,
callbackUrl,
baseUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/google/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createGoogleProvider } from './provider';
export type { GoogleProviderOptions } from './provider';
plugins/auth-backend/src/providers/google/provider.ts
+55 -42
View File
@@ -28,6 +28,7 @@ import {
OAuthRefreshRequest,
OAuthResponse,
OAuthStartRequest,
OAuthResult,
} from '../../lib/oauth';
import {
executeFetchUserProfileStrategy,
@@ -44,7 +45,7 @@ type PrivateInfo = {
refreshToken: string;
};
export type GoogleAuthProviderOptions = OAuthProviderOptions & {
type Options = OAuthProviderOptions & {
logger: Logger;
identityClient: CatalogIdentityClient;
tokenIssuer: TokenIssuer;
@@ -56,7 +57,7 @@ export class GoogleAuthProvider implements OAuthHandlers {
private readonly identityClient: CatalogIdentityClient;
private readonly tokenIssuer: TokenIssuer;
constructor(options: GoogleAuthProviderOptions) {
constructor(options: Options) {
this.logger = options.logger;
this.identityClient = options.identityClient;
this.tokenIssuer = options.tokenIssuer;
@@ -74,20 +75,16 @@ export class GoogleAuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
fullProfile,
params,
accessToken,
refreshToken,
},
{
refreshToken,
@@ -109,13 +106,23 @@ export class GoogleAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
profile,
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -127,11 +134,11 @@ export class GoogleAuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -184,31 +191,37 @@ export class GoogleAuthProvider implements OAuthHandlers {
}
}
export const createGoogleProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
logger,
tokenIssuer,
catalogApi,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type GoogleProviderOptions = {};
const provider = new GoogleAuthProvider({
clientId,
clientSecret,
callbackUrl,
logger,
tokenIssuer,
identityClient: new CatalogIdentityClient({ catalogApi }),
});
export const createGoogleProvider = (
_options?: GoogleProviderOptions,
): AuthProviderFactory => {
return ({
providerId,
globalConfig,
config,
logger,
tokenIssuer,
catalogApi,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new GoogleAuthProvider({
clientId,
clientSecret,
callbackUrl,
logger,
tokenIssuer,
identityClient: new CatalogIdentityClient({ catalogApi }),
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/microsoft/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createMicrosoftProvider } from './provider';
export type { MicrosoftProviderOptions } from './provider';
plugins/auth-backend/src/providers/microsoft/provider.ts
+61 -75
View File
@@ -38,6 +38,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import got from 'got';
@@ -54,32 +55,6 @@ export type MicrosoftAuthProviderOptions = OAuthProviderOptions & {
export class MicrosoftAuthProvider implements OAuthHandlers {
private readonly _strategy: MicrosoftStrategy;
static transformAuthResponse(
accessToken: string,
params: any,
rawProfile: any,
photoURL: any,
): OAuthResponse {
let passportProfile: passport.Profile = rawProfile;
passportProfile = {
...passportProfile,
photos: [{ value: photoURL }],
};
const profile = makeProfileInfo(passportProfile, params.id_token);
const providerInfo = {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
};
return {
providerInfo,
profile,
};
}
constructor(options: MicrosoftAuthProviderOptions) {
this._strategy = new MicrosoftStrategy(
{
@@ -94,22 +69,10 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
this.getUserPhoto(accessToken)
.then(photoURL => {
const authResponse = MicrosoftAuthProvider.transformAuthResponse(
accessToken,
params,
rawProfile,
photoURL,
);
done(undefined, authResponse, { refreshToken });
})
.catch(error => {
throw new Error(`Error processing auth response: ${error}`);
});
done(undefined, { fullProfile, accessToken, refreshToken, params });
},
);
}
@@ -124,15 +87,37 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
return {
response: await this.populateIdentity(response),
refreshToken: privateInfo.refreshToken,
};
try {
const photoUrl = await this.getUserPhoto(result.accessToken);
const profile = makeProfileInfo(
{
...result.fullProfile,
photos: photoUrl ? [{ value: photoUrl }] : undefined,
},
result.params.id_token,
);
return {
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
} catch (error) {
throw new Error(`Error processing auth response: ${error}`);
}
}
async refresh(req: OAuthRefreshRequest): Promise<OAuthResponse> {
@@ -142,11 +127,11 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
const photo = await this.getUserPhoto(accessToken);
if (photo) {
profile.picture = photo;
@@ -205,32 +190,33 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
}
}
export const createMicrosoftProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const tenantID = envConfig.getString('tenantId');
export type MicrosoftProviderOptions = {};
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/authorize`;
const tokenUrl = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/token`;
export const createMicrosoftProvider = (
_options?: MicrosoftProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const tenantId = envConfig.getString('tenantId');
const provider = new MicrosoftAuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
const provider = new MicrosoftAuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
};
plugins/auth-backend/src/providers/oauth2/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createOAuth2Provider } from './provider';
export type { OAuth2ProviderOptions } from './provider';
plugins/auth-backend/src/providers/oauth2/provider.ts
+49 -42
View File
@@ -26,6 +26,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import {
executeFetchUserProfileStrategy,
@@ -65,21 +66,16 @@ export class OAuth2AuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
fullProfile,
accessToken,
refreshToken,
params,
},
{
refreshToken,
@@ -101,13 +97,23 @@ export class OAuth2AuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -124,11 +130,11 @@ export class OAuth2AuthProvider implements OAuthHandlers {
refreshToken: updatedRefreshToken,
} = refreshTokenResponse;
const profile = await executeFetchUserProfileStrategy(
const rawProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(rawProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -158,32 +164,33 @@ export class OAuth2AuthProvider implements OAuthHandlers {
}
}
export const createOAuth2Provider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = envConfig.getString('authorizationUrl');
const tokenUrl = envConfig.getString('tokenUrl');
const scope = envConfig.getOptionalString('scope');
export type OAuth2ProviderOptions = {};
const provider = new OAuth2AuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
scope,
});
export const createOAuth2Provider = (
_options?: OAuth2ProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = envConfig.getString('authorizationUrl');
const tokenUrl = envConfig.getString('tokenUrl');
const scope = envConfig.getOptionalString('scope');
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OAuth2AuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
scope,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/oidc/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createOidcProvider } from './provider';
export type { OidcProviderOptions } from './provider';
plugins/auth-backend/src/providers/oidc/provider.test.ts
+1 -1
View File
@@ -121,7 +121,7 @@ describe('OidcAuthProvider', () => {
})),
} as any) as Config,
} as AuthProviderFactoryOptions;
const provider = createOidcProvider(options) as OAuthAdapter;
const provider = createOidcProvider()(options) as OAuthAdapter;
expect(provider.start).toBeDefined();
await new Promise(resolve => process.nextTick(resolve)); // advance a tick to give nock a chance to intercept the request
expect(scope.isDone()).toBeTruthy();
plugins/auth-backend/src/providers/oidc/provider.ts
+61 -56
View File
@@ -37,10 +37,10 @@ import {
executeRedirectStrategy,
PassportDoneCallback,
} from '../../lib/passport';
import { RedirectInfo, AuthProviderFactory, ProfileInfo } from '../types';
import { RedirectInfo, AuthProviderFactory } from '../types';
type PrivateInfo = {
refreshToken: string;
refreshToken?: string;
};
type OidcImpl = {
@@ -48,7 +48,12 @@ type OidcImpl = {
client: Client;
};
export type OidcAuthProviderOptions = OAuthProviderOptions & {
type AuthResult = {
tokenset: TokenSet;
userinfo: UserinfoResponse;
};
export type Options = OAuthProviderOptions & {
metadataUrl: string;
tokenSignedResponseAlg?: string;
};
@@ -56,7 +61,7 @@ export type OidcAuthProviderOptions = OAuthProviderOptions & {
export class OidcAuthProvider implements OAuthHandlers {
private readonly implementation: Promise<OidcImpl>;
constructor(options: OidcAuthProviderOptions) {
constructor(options: Options) {
this.implementation = this.setupStrategy(options);
}
@@ -72,15 +77,30 @@ export class OidcAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
): Promise<{ response: OAuthResponse; refreshToken?: string }> {
const { strategy } = await this.implementation;
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
PrivateInfo
>(req, strategy);
const {
result: { userinfo, tokenset },
privateInfo,
} = await executeFrameHandlerStrategy<AuthResult, PrivateInfo>(
req,
strategy,
);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile: {
displayName: userinfo.name,
email: userinfo.email,
picture: userinfo.picture,
},
providerInfo: {
idToken: tokenset.id_token,
accessToken: tokenset.access_token || '',
scope: tokenset.scope || '',
expiresInSeconds: tokenset.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -105,9 +125,7 @@ export class OidcAuthProvider implements OAuthHandlers {
});
}
private async setupStrategy(
options: OidcAuthProviderOptions,
): Promise<OidcImpl> {
private async setupStrategy(options: Options): Promise<OidcImpl> {
const issuer = await Issuer.discover(options.metadataUrl);
const client = new issuer.Client({
client_id: options.clientId,
@@ -125,27 +143,13 @@ export class OidcAuthProvider implements OAuthHandlers {
(
tokenset: TokenSet,
userinfo: UserinfoResponse,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
done: PassportDoneCallback<AuthResult, PrivateInfo>,
) => {
const profile: ProfileInfo = {
displayName: userinfo.name,
email: userinfo.email,
picture: userinfo.picture,
};
done(
undefined,
{ tokenset, userinfo },
{
providerInfo: {
idToken: tokenset.id_token || '',
accessToken: tokenset.access_token || '',
scope: tokenset.scope || '',
expiresInSeconds: tokenset.expires_in,
},
profile,
},
{
refreshToken: tokenset.refresh_token || '',
refreshToken: tokenset.refresh_token,
},
);
},
@@ -170,32 +174,33 @@ export class OidcAuthProvider implements OAuthHandlers {
}
}
export const createOidcProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const metadataUrl = envConfig.getString('metadataUrl');
const tokenSignedResponseAlg = envConfig.getString(
'tokenSignedResponseAlg',
);
export type OidcProviderOptions = {};
const provider = new OidcAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenSignedResponseAlg,
metadataUrl,
});
export const createOidcProvider = (
_options?: OidcProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const metadataUrl = envConfig.getString('metadataUrl');
const tokenSignedResponseAlg = envConfig.getString(
'tokenSignedResponseAlg',
);
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OidcAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenSignedResponseAlg,
metadataUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/okta/index.ts
+2
View File
@@ -13,4 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
export { createOktaProvider } from './provider';
export type { OktaProviderOptions } from './provider';
plugins/auth-backend/src/providers/okta/provider.ts
+45 -38
View File
@@ -23,6 +23,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import { Strategy as OktaStrategy } from 'passport-okta-oauth';
import passport from 'passport';
@@ -80,21 +81,16 @@ export class OktaAuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
accessToken,
refreshToken,
params,
fullProfile,
},
{
refreshToken,
@@ -116,13 +112,23 @@ export class OktaAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -134,11 +140,11 @@ export class OktaAuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -167,28 +173,29 @@ export class OktaAuthProvider implements OAuthHandlers {
}
}
export const createOktaProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type OktaProviderOptions = {};
const provider = new OktaAuthProvider({
audience,
clientId,
clientSecret,
callbackUrl,
});
export const createOktaProvider = (
_options?: OktaProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OktaAuthProvider({
audience,
clientId,
clientSecret,
callbackUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/onelogin/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createOneLoginProvider } from './provider';
export type { OneLoginProviderOptions } from './provider';
plugins/auth-backend/src/providers/onelogin/provider.ts
+47 -40
View File
@@ -25,6 +25,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import passport from 'passport';
import {
@@ -41,14 +42,14 @@ type PrivateInfo = {
refreshToken: string;
};
export type OneLoginProviderOptions = OAuthProviderOptions & {
export type Options = OAuthProviderOptions & {
issuer: string;
};
export class OneLoginProvider implements OAuthHandlers {
private readonly _strategy: any;
constructor(options: OneLoginProviderOptions) {
constructor(options: Options) {
this._strategy = new OneLoginStrategy(
{
issuer: options.issuer,
@@ -61,21 +62,16 @@ export class OneLoginProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
accessToken,
refreshToken,
params,
fullProfile,
},
{
refreshToken,
@@ -96,13 +92,23 @@ export class OneLoginProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -114,11 +120,11 @@ export class OneLoginProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -146,28 +152,29 @@ export class OneLoginProvider implements OAuthHandlers {
}
}
export const createOneLoginProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const issuer = envConfig.getString('issuer');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type OneLoginProviderOptions = {};
const provider = new OneLoginProvider({
clientId,
clientSecret,
callbackUrl,
issuer,
});
export const createOneLoginProvider = (
_options?: OneLoginProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const issuer = envConfig.getString('issuer');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OneLoginProvider({
clientId,
clientSecret,
callbackUrl,
issuer,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/saml/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createSamlProvider } from './provider';
export type { SamlProviderOptions } from './provider';
plugins/auth-backend/src/providers/saml/provider.ts
+48 -53
View File
@@ -26,17 +26,17 @@ import {
executeRedirectStrategy,
PassportDoneCallback,
} from '../../lib/passport';
import {
AuthProviderRouteHandlers,
ProfileInfo,
AuthProviderFactory,
} from '../types';
import { AuthProviderRouteHandlers, AuthProviderFactory } from '../types';
import { postMessageResponse } from '../../lib/flow';
import { TokenIssuer } from '../../identity';
type SamlInfo = {
userId: string;
profile: ProfileInfo;
fullProfile: any;
};
type Options = SamlConfig & {
tokenIssuer: TokenIssuer;
appUrl: string;
};
export class SamlAuthProvider implements AuthProviderRouteHandlers {
@@ -44,11 +44,11 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
private readonly tokenIssuer: TokenIssuer;
private readonly appUrl: string;
constructor(options: SAMLProviderOptions) {
constructor(options: Options) {
this.appUrl = options.appUrl;
this.tokenIssuer = options.tokenIssuer;
this.strategy = new SamlStrategy({ ...options }, ((
profile: SamlProfile,
fullProfile: SamlProfile,
done: PassportDoneCallback<SamlInfo>,
) => {
// TODO: There's plenty more validation and profile handling to do here,
@@ -56,13 +56,7 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
// for non-oauth auth flows.
// TODO: This flow doesn't issue an identity token that can be used to validate
// the identity of the user in other backends, which we need in some form.
done(undefined, {
userId: profile.nameID!,
profile: {
email: profile.email!,
displayName: profile.displayName as string,
},
});
done(undefined, { fullProfile });
}) as VerifyWithoutRequest);
}
@@ -76,11 +70,13 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
res: express.Response,
): Promise<void> {
try {
const {
response: { userId, profile },
} = await executeFrameHandlerStrategy<SamlInfo>(req, this.strategy);
const { result } = await executeFrameHandlerStrategy<SamlInfo>(
req,
this.strategy,
);
const id = result.fullProfile.nameID;
const id = userId;
const idToken = await this.tokenIssuer.issueToken({
claims: { sub: id },
});
@@ -88,8 +84,11 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
return postMessageResponse(res, this.appUrl, {
type: 'authorization_response',
response: {
profile: {
email: result.fullProfile.email,
displayName: result.fullProfile.displayName,
},
providerInfo: {},
profile,
backstageIdentity: { id, idToken },
},
});
@@ -113,40 +112,36 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
}
}
type SAMLProviderOptions = SamlConfig & {
tokenIssuer: TokenIssuer;
appUrl: string;
};
type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';
export const createSamlProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) => {
const opts = {
callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
entryPoint: config.getString('entryPoint'),
logoutUrl: config.getOptionalString('logoutUrl'),
issuer: config.getString('issuer'),
cert: config.getOptionalString('cert'),
privateCert: config.getOptionalString('privateKey'),
decryptionPvk: config.getOptionalString('decryptionPvk'),
signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as
| SignatureAlgorithm
| undefined,
digestAlgorithm: config.getOptionalString('digestAlgorithm'),
export type SamlProviderOptions = {};
tokenIssuer,
appUrl: globalConfig.appUrl,
export const createSamlProvider = (
_options?: SamlProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) => {
const opts = {
callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
entryPoint: config.getString('entryPoint'),
logoutUrl: config.getOptionalString('logoutUrl'),
issuer: config.getString('issuer'),
cert: config.getOptionalString('cert'),
privateCert: config.getOptionalString('privateKey'),
decryptionPvk: config.getOptionalString('decryptionPvk'),
signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as
| SignatureAlgorithm
| undefined,
digestAlgorithm: config.getOptionalString('digestAlgorithm'),
tokenIssuer,
appUrl: globalConfig.appUrl,
};
// passport-saml will return an error if the `cert` key is set, and the value is empty.
// Since we read from config (such as environment variables) an empty string should be equal to being unset.
if (!opts.cert) {
delete opts.cert;
}
return new SamlAuthProvider(opts);
};
// passport-saml will return an error if the `cert` key is set, and the value is empty.
// Since we read from config (such as environment variables) an empty string should be equal to being unset.
if (!opts.cert) {
delete opts.cert;
}
return new SamlAuthProvider(opts);
};
plugins/catalog-backend/package.json
+1
View File
@@ -45,6 +45,7 @@
"express-promise-router": "^3.0.3",
"fs-extra": "^9.0.0",
"git-url-parse": "^11.4.4",
"glob": "^7.1.6",
"knex": "^0.21.6",
"ldapjs": "^2.2.0",
"lodash": "^4.17.15",
plugins/catalog-backend/src/ingestion/processors/FileReaderProcessor.test.ts
+84
View File
@@ -0,0 +1,84 @@
/*
* Copyright 2020 Spotify AB
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { FileReaderProcessor } from './FileReaderProcessor';
import {
CatalogProcessorEntityResult,
CatalogProcessorErrorResult,
CatalogProcessorResult,
} from './types';
import path from 'path';
describe('FileReaderProcessor', () => {
const fixturesRoot = path.join(
'src',
'ingestion',
'processors',
'__fixtures__',
'fileReaderProcessor',
);
it('should load from file', async () => {
const processor = new FileReaderProcessor();
const spec = {
type: 'file',
target: `${path.join(fixturesRoot, 'component.yaml')}`,
};
const generated = (await new Promise<CatalogProcessorResult>(emit =>
processor.readLocation(spec, false, emit),
)) as CatalogProcessorEntityResult;
expect(generated.type).toBe('entity');
expect(generated.location).toEqual(spec);
expect(generated.entity).toEqual({ kind: 'Component' });
});
it('should fail load from file with error', async () => {
const processor = new FileReaderProcessor();
const spec = {
type: 'file',
target: `${path.join(fixturesRoot, 'missing.yaml')}`,
};
const generated = (await new Promise<CatalogProcessorResult>(emit =>
processor.readLocation(spec, false, emit),
)) as CatalogProcessorErrorResult;
expect(generated.type).toBe('error');
expect(generated.location).toBe(spec);
expect(generated.error.name).toBe('NotFoundError');
expect(generated.error.message).toBe(
`file ${path.join(fixturesRoot, 'missing.yaml')} does not exist`,
);
});
it('should support globs', async () => {
const processor = new FileReaderProcessor();
const emit = jest.fn();
await processor.readLocation(
{ type: 'file', target: `${path.join(fixturesRoot, '**', '*.yaml')}` },
false,
emit,
);
expect(emit).toBeCalledTimes(2);
expect(emit.mock.calls[0][0].entity).toEqual({ kind: 'Component' });
expect(emit.mock.calls[1][0].entity).toEqual({ kind: 'API' });
});
});
plugins/catalog-backend/src/ingestion/processors/FileReaderProcessor.ts
+12 -5
View File
@@ -19,6 +19,10 @@ import fs from 'fs-extra';
import * as result from './results';
import { CatalogProcessor, CatalogProcessorEmit } from './types';
import { parseEntityYaml } from './util/parse';
import { promisify } from 'util';
import g from 'glob';
const glob = promisify(g);
export class FileReaderProcessor implements CatalogProcessor {
async readLocation(
@@ -31,12 +35,15 @@ export class FileReaderProcessor implements CatalogProcessor {
}
try {
const exists = await fs.pathExists(location.target);
if (exists) {
const data = await fs.readFile(location.target);
const fileMatches = await glob(location.target);
for (const parseResult of parseEntityYaml(data, location)) {
emit(parseResult);
if (fileMatches.length > 0) {
for (const fileMatch of fileMatches) {
const data = await fs.readFile(fileMatch);
for (const parseResult of parseEntityYaml(data, location)) {
emit(parseResult);
}
}
} else if (!optional) {
const message = `${location.type} ${location.target} does not exist`;
plugins/catalog-backend/src/ingestion/processors/__fixtures__/fileReaderProcessor/component.yaml
+1
View File
@@ -0,0 +1 @@
kind: Component
plugins/catalog-backend/src/ingestion/processors/__fixtures__/fileReaderProcessor/dir/api.yaml
+1
View File
@@ -0,0 +1 @@
kind: API
plugins/catalog-backend/src/ingestion/processors/__fixtures__/fileReaderProcessor/test.txt
+1
View File
@@ -0,0 +1 @@
Just a text file
plugins/scaffolder-backend/src/scaffolder/stages/prepare/github.test.ts
+2 -2
View File
@@ -90,8 +90,8 @@ describe('GitHubPreparer', () => {
expect(Git.fromAuth).toHaveBeenCalledWith({
logger,
username: 'fake-token',
password: 'x-oauth-basic',
username: 'x-access-token',
password: 'fake-token',
});
});
});
plugins/scaffolder-backend/src/scaffolder/stages/prepare/github.ts
+2 -2
View File
@@ -38,8 +38,8 @@ export class GithubPreparer implements PreparerBase {
const git = this.config.token
? Git.fromAuth({
username: this.config.token,
password: 'x-oauth-basic',
username: 'x-access-token',
password: this.config.token,
logger,
})
: Git.fromAuth({ logger });
plugins/scaffolder-backend/src/scaffolder/stages/publish/github.test.ts
+5 -5
View File
@@ -97,7 +97,7 @@ describe('GitHub Publisher', () => {
expect(initRepoAndPush).toHaveBeenCalledWith({
dir: resultPath,
remoteUrl: 'https://github.com/backstage/backstage.git',
auth: { username: 'fake-token', password: 'x-oauth-basic' },
auth: { username: 'x-access-token', password: 'fake-token' },
logger,
});
});
@@ -148,7 +148,7 @@ describe('GitHub Publisher', () => {
expect(initRepoAndPush).toHaveBeenCalledWith({
dir: resultPath,
remoteUrl: 'https://github.com/backstage/backstage.git',
auth: { username: 'fake-token', password: 'x-oauth-basic' },
auth: { username: 'x-access-token', password: 'fake-token' },
logger,
});
});
@@ -206,7 +206,7 @@ describe('GitHub Publisher', () => {
expect(initRepoAndPush).toHaveBeenCalledWith({
dir: resultPath,
remoteUrl: 'https://github.com/backstage/backstage.git',
auth: { username: 'fake-token', password: 'x-oauth-basic' },
auth: { username: 'x-access-token', password: 'fake-token' },
logger,
});
});
@@ -257,7 +257,7 @@ describe('GitHub Publisher', () => {
expect(initRepoAndPush).toHaveBeenCalledWith({
dir: resultPath,
remoteUrl: 'https://github.com/backstage/backstage.git',
auth: { username: 'fake-token', password: 'x-oauth-basic' },
auth: { username: 'x-access-token', password: 'fake-token' },
logger,
});
});
@@ -307,7 +307,7 @@ describe('GitHub Publisher', () => {
expect(initRepoAndPush).toHaveBeenCalledWith({
dir: resultPath,
remoteUrl: 'https://github.com/backstage/backstage.git',
auth: { username: 'fake-token', password: 'x-oauth-basic' },
auth: { username: 'x-access-token', password: 'fake-token' },
logger,
});
});
plugins/scaffolder-backend/src/scaffolder/stages/publish/github.ts
+2 -2
View File
@@ -72,8 +72,8 @@ export class GithubPublisher implements PublisherBase {
dir: path.join(workspacePath, 'result'),
remoteUrl,
auth: {
username: this.config.token,
password: 'x-oauth-basic',
username: 'x-access-token',
password: this.config.token,
},
logger,
});
plugins/techdocs-backend/src/DocsBuilder/builder.ts
+1
View File
@@ -130,6 +130,7 @@ export class DocsBuilder {
outputDir,
dockerClient: this.dockerClient,
parsedLocationAnnotation,
etag,
});
this.logger.debug(`Generated files temporarily stored at ${outputDir}`);
plugins/techdocs/package.json
+1 -1
View File
@@ -47,7 +47,7 @@
"react-router": "6.0.0-beta.0",
"react-router-dom": "6.0.0-beta.0",
"react-use": "^15.3.3",
"sanitize-html": "^1.27.0"
"sanitize-html": "^2.3.2"
},
"devDependencies": {
"@backstage/cli": "^0.6.0",
scripts/check-type-dependencies.js
+2 -2
View File
@@ -24,8 +24,8 @@ const chalk = require('chalk');
async function main() {
// This is from lerna, and cba polluting root package.json
// eslint-disable-next-line import/no-extraneous-dependencies
const LernaProject = require('@lerna/project');
const project = new LernaProject(resolvePath('.'));
const { Project } = require('@lerna/project');
const project = new Project(resolvePath('.'));
const packages = await project.getPackages();
let hadErrors = false;
scripts/isolated-release.js
+2 -2
View File
@@ -18,7 +18,7 @@
const path = require('path');
const childProcess = require('child_process');
// eslint-disable-next-line import/no-extraneous-dependencies
const LernaProject = require('@lerna/project');
const { Project } = require('@lerna/project');
// Prepare a release of the provided packages, e.g. @backstage/core
async function main(args) {
@@ -28,7 +28,7 @@ async function main(args) {
process.exit(1);
}
const project = new LernaProject(__dirname);
const project = new Project(__dirname);
const packages = await project.getPackages();
const ignoreArgs = packages
.filter(p => !args.includes(p.name))
yarn.lock
+1361 -1266
View File
File diff suppressed because it is too large Load Diff