Allow the backend to reimplement extension point outputs at creation
time via a new extensionPointFactoryMiddleware option on createBackend().
Each middleware entry declaratively targets a specific extension point
by reference and the framework handles matching and pass-through
automatically.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Adds a new `Badge` component to the Backstage UI library. Badge shares the same visual appearance as `Tag` (size tokens, colors, border radius, icon slot) but renders as a plain non-interactive `<span>` with no React Aria plumbing.
Key characteristics:
- Plain DOM element — accessible text content exposed to screen readers without any role override
- Background consumer — participates in the bg context system and steps up neutral background levels (`neutral-2` → `neutral-3` → `neutral-4`) when placed inside colored containers
- Supports `icon`, `size` (`small` | `medium`, defaults to `small`), `children`, and `className` props
- Fully themeable via `BadgeDefinition`
Also includes Storybook stories and full docs-ui documentation (props table, examples, theming section, changelog).
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
Adds startup warnings to HostDiscovery.fromConfig when backend.baseUrl
is set to a localhost address in a production environment, or when the
value is not a valid URL at all.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
- Remove JSON.stringify fallback from toError, use the same unknown
error messaging as stringifyError for all non-string/non-error values
- Add try/catch to protect against values that throw on string
conversion (e.g. null-prototype objects, symbols)
- Fix no-op `void toError(err)` in DeleteEntityConfirmationDialog
- Fix `${err}` producing [object Object] in UrlReaderProcessor
- Fix double toError call in openStackSwift
- Update JSDoc to accurately describe the behavior
- Add tests for throwing toString and circular objects
- Add changeset for all refactored packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add a `toError` utility function to `@backstage/errors` that converts
unknown values to `ErrorLike` objects. If the value is already error-like
it is returned as-is. Strings are used directly as the error message, and
other values are stringified with a fallback to JSON.stringify to avoid
unhelpful `[object Object]` messages.
Non-error causes passed to `CustomErrorBase` are now converted and stored
using `toError` rather than discarded. Existing `assertError` call sites
across the codebase are migrated to `toError`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Uses a PID file to track which process owns each temp directory, so
concurrent instances from different projects are not affected.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Close embedded DB on shutdown to avoid leaking the Postgres process
and temp directory
- Use fs.remove instead of deprecated fs.rmdir with recursive option
- Guard against absolute config paths in readDatabaseClient
- Forward embedded-postgres error logs to console.error
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The 18.x version ships its own .d.ts files that TypeScript resolves
correctly, so the custom module declaration is no longer needed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix implicit any types in startEmbeddedDb callbacks, replace the
re-export type declaration with an inline type definition for the
embedded-postgres module, and update runBackend tests to mock the
config loading and use async timer advancement.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add server-side URL validation for logoutUrl (HTTPS + localhost only),
origin validation on the logout endpoint, and a configurable `federated`
option (default false) for Auth0 provider logout. Includes comprehensive
test coverage for all security controls.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Add origin allowlist validation in the OAuth logout handler (matching
the existing start/refresh pattern) and validate the logoutUrl protocol
on the frontend before redirecting. Also replace inline type annotation
with the named OAuthAuthenticatorLogoutResult type.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Rather than requiring the `EXPERIMENTAL_DEV_DB` environment variable,
the embedded postgres server is now started automatically when
`backend.database.client` is set to `embedded-postgres` in the app
config. The CLI reads the config before spawning the backend and
injects the actual pg connection details via env override.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Glob v13 treats backslashes as escape characters by default, unlike v7
which treated them as path separators on Windows. This broke Windows CI
where path.join/resolve produce backslash paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The legacy frontend plugin template had the same name (`frontend-plugin`) as
the new frontend plugin template, causing a conflict error when both were shown
(e.g. when the frontend system could not be auto-detected). Rename the legacy
template to `frontend-plugin-legacy` so both can coexist.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
Patrik Oldsberg