Legacy nav-item output is no longer a first-class extension type worth
highlighting in the detailed visualizer legend.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop the deprecated NavItemBlueprint from the public API and migrate core
plugins to set title and icon on PageBlueprint instead. AppNav keeps
backward compatibility for legacy nav-item extensions via an internal
core.nav-item.target data ref.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The relations table had indexes on originating_entity_id and
source_entity_ref but none on target_entity_ref. Several query paths
join or filter on this column:
- Orphan deletion (LEFT JOIN relations ON target_entity_ref)
- Entity ancestry (INNER JOIN relations ON target_entity_ref)
- Eager pruning (JOIN relations ON target_entity_ref)
Without an index these queries seq-scan the full table (~3.5M rows,
714 MB heap). On a production replica, a single point lookup takes
~122ms via seq scan. With the index it drops to <1ms.
The index is ~141 MB based on column width (~35 bytes avg) across
~3.5M rows. On PostgreSQL it's created with CONCURRENTLY to avoid
blocking reads/writes.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Adds discriminated union on spec.type with specType dispatch in the
model layer. The skill type adds disciplines, categories, agents,
and dependsOn fields. Fixes model source to not duplicate the default
catalog entity model.
Signed-off-by: benjdlambert <ben@blam.sh>
Introduces @backstage/plugin-catalog-backend-module-ai-resource-entity-model,
a new backend module that registers the AIResource kind with the catalog.
Signed-off-by: benjdlambert <ben@blam.sh>
* feat(catalog-backend-module-msgraph): filter out disabled users by default
The Microsoft Graph provider now always applies an `accountEnabled eq true`
base filter when fetching users. Any custom `user.filter` is combined with
the base filter using `and`, so adopters no longer need to manually add
`accountEnabled eq true` to their configuration.
Also removes the legacy mutual exclusivity check between `userFilter` and
`userGroupMemberFilter` — these serve orthogonal purposes (user-level
filtering vs group selection) and the downstream code already handles
both being set.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
* chore: mark msgraph disabled-user filtering as breaking change
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
* docs(catalog-backend-module-msgraph): clarify automatic accountEnabled filter in docs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
---------
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(auth-backend): harden default allowed patterns for CIMD and DCR
Signed-off-by: benjdlambert <ben@blam.sh>
* address PR review feedback for OIDC defaults
- narrow CLI client ID pattern to exact cli.json path
- add BREAKING prefix to changeset
- add IPv6 [::1] to docs examples
- add loopback redirect URI tests for IPv6 and 127.0.0.1
Signed-off-by: benjdlambert <ben@blam.sh>
* remove dead ['*'] fallback when features are disabled
The restrictive defaults are now always used regardless of the enabled
flag, since the patterns are only consulted on code paths that require
the feature to be enabled.
Signed-off-by: benjdlambert <ben@blam.sh>
* add default pattern tests and fix docs cli example
Signed-off-by: benjdlambert <ben@blam.sh>
* use URL constructor for CLI client ID
Signed-off-by: benjdlambert <ben@blam.sh>
* use string templating for cliClientId to match OidcRouter
Signed-off-by: benjdlambert <ben@blam.sh>
* fix docs: remove misleading CLI client_id URL example
Signed-off-by: benjdlambert <ben@blam.sh>
---------
Signed-off-by: benjdlambert <ben@blam.sh>
The nav-item extensions were disabled in the template config to prevent
duplicate rendering, but the custom sidebar already handles this via
nav.take(). After #33788 added filtering of disabled nav items from page
discovery, disabling them causes nav.take('page:catalog') to return
nothing, breaking the sidebar navigation.
Signed-off-by: benjdlambert <ben@blam.sh>
* fix(catalog-backend): move generateStableHash out of shared util to fix Storybook build
The util.ts file mixed Node.js-only code (createHash from node:crypto)
with pure constants. Since InMemoryCatalogClient reaches into
buildEntitySearch via a relative import, and buildEntitySearch imports
from util.ts, the node:crypto dependency leaked into Vite's browser
bundle causing the Storybook build to fail.
Signed-off-by: benjdlambert <ben@blam.sh>
* add changeset
Signed-off-by: benjdlambert <ben@blam.sh>
---------
Signed-off-by: benjdlambert <ben@blam.sh>
Mark immediate mode stitching as deprecated in config.d.ts, the
StitchingStrategy type, and log a warning on startup when it is
detected. This is a precursor to removing immediate mode entirely
in the next release.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Adds a structured set of 11 query scenarios covering the main catalog
database access patterns: paginated listings, counts, facets, entity
lookups, full-text search, ancestry traversal, stitching reference
counts, and orphan detection.
Each scenario documents the SQL, what a healthy plan looks like, and
what anti-patterns to watch for. The baseline records execution times
and plan shapes from the staging database (545K entities, 13.8M search
rows).
This is intended to be run by humans or AI agents before and after
database-affecting changes to detect performance regressions. It lives
alongside the existing performance tests.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
When using GithubMultiOrgEntityProvider with alwaysUseDefaultNamespace
and teams with identical slugs across orgs, the emitted entity order
was non-deterministic. Since the catalog's upsert path uses last-write-
wins for duplicate entity refs, this caused the winning org to flip
randomly on every refresh cycle, producing constant unnecessary
stitching and flickering entity data.
Sort the emitted entities by entity ref (primary) and location
annotation (tiebreaker) so that the same org consistently wins when
duplicate refs exist.
Fixes#34263
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
The permission backend previously resolved userInfo and minted a plugin
request token sequentially for every authorize request with user
credentials. On high-traffic endpoints this meant two serial internal
HTTP round-trips per request, even when the same user made many
requests in quick succession.
This change:
1. Adds a 5-second TTL cache to DefaultUserInfoService so that repeated
getUserInfo() calls for the same user return the cached result
without an HTTP call to the auth backend.
2. Parallelises the getUserInfo() and getPluginRequestToken() calls in
the permission backend's handleRequest via Promise.all, saving one
sequential round-trip on cache misses.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
The mock credentials created by mockCredentials.none(), .user(), and
.service() were missing the internal version: 'v1' field. This caused
toInternalBackstageCredentials() to throw when used with mock
credentials in tests.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Patrik Oldsberg