From fb09003298357cd35e8c16116c914ca9f41cf953 Mon Sep 17 00:00:00 2001
From: Camila Belo <camilaibs@gmail.com>
Date: Wed, 3 Apr 2024 13:53:53 +0200
Subject: [PATCH] feat: add token backward compatibility

Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Signed-off-by: Camila Belo <camilaibs@gmail.com>
---
 .../implementations/auth/UserTokenHandler.ts  | 32 +++++++++++++++----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/packages/backend-app-api/src/services/implementations/auth/UserTokenHandler.ts b/packages/backend-app-api/src/services/implementations/auth/UserTokenHandler.ts
index 078b46d3be..c1197f44a5 100644
--- a/packages/backend-app-api/src/services/implementations/auth/UserTokenHandler.ts
+++ b/packages/backend-app-api/src/services/implementations/auth/UserTokenHandler.ts
@@ -67,7 +67,7 @@ export class UserTokenHandler {
       this.#keyStore,
       verifyOpts,
     ).catch(e => {
-      throw new AuthenticationError('invalid token', e);
+      throw new AuthenticationError('Invalid token', e);
     });
 
     const userEntityRef = payload.sub;
@@ -98,10 +98,15 @@ export class UserTokenHandler {
       };
     }
 
-    return {
-      algorithms: this.#algorithms,
-      audience: 'backstage',
-    };
+    const { aud } = decodeJwt(token);
+    if (aud === 'backstage') {
+      return {
+        algorithms: this.#algorithms,
+        audience: 'backstage',
+      };
+    }
+
+    return undefined;
   }
 
   createLimitedUserToken(backstageToken: string) {
@@ -113,12 +118,27 @@ export class UserTokenHandler {
       new TextDecoder().decode(base64url.decode(payloadRaw)),
     );
 
+    const tokenType = header.typ;
+
+    // Only new user tokens can be used to create a limited user token. If we
+    // can't create a limited token, or the token is already a limited one, we
+    // return the original token
+    if (!tokenType || tokenType === tokenTypes.limitedUser.typParam) {
+      return { token: backstageToken, expiresAt: new Date(payload.exp * 1000) };
+    }
+
+    if (tokenType !== tokenTypes.user.typParam) {
+      throw new AuthenticationError(
+        'Failed to create limited user token, invalid token type',
+      );
+    }
+
     // NOTE: The order and properties in both the header and payload must match
     //       the usage in plugins/auth-backend/src/identity/TokenFactory.ts
     const limitedUserToken = [
       base64url.encode(
         JSON.stringify({
-          typ: 'vnd.backstage.limited-user',
+          typ: tokenTypes.limitedUser.typParam,
           alg: header.alg,
           kid: header.kid,
         }),