auth: add a static keypair method for plugin-to-plugin auth

Co-authored-by: blam <ben@blam.sh> Signed-off-by: Fredrik Adelöw <freben@gmail.com>
2024-06-12 09:39:34 +02:00
parent 5c50d66192
commit e25e467e60
18 changed files with 923 additions and 155 deletions
@@ -33,6 +33,37 @@ export interface Config {
       */
      dangerouslyDisableDefaultAuthPolicy?: boolean;

+      /** Controls how to store keys for plugin-to-plugin auth */
+      keyStore?:
+        | { type: 'database' }
+        | {
+            type: 'static';
+            static: {
+              /**
+               * Must be declared at least once and the first one will be used for signing.
+               */
+              keys: Array<{
+                /**
+                 * Path to the public key file in the SPKI format. Should be an absolute path.
+                 */
+                publicKeyFile: string;
+                /**
+                 * Path to the matching private key file in the PKCS#8 format. Should be an absolute path.
+                 */
+                privateKeyFile: string;
+                /**
+                 * ID to uniquely identify this key within the JWK set.
+                 */
+                keyId: string;
+                /**
+                 * JWS "alg" (Algorithm) Header Parameter value. Defaults to ES256.
+                 * Must match the algorithm used to generate the keys in the provided files
+                 */
+                algorithm?: string;
+              }>;
+            };
+          };
+
      /**
       * Configures methods of external access, ie ways for callers outside of
       * the Backstage ecosystem to get authorized for access to APIs that do