* fix(auth-backend): harden default allowed patterns for CIMD and DCR
Signed-off-by: benjdlambert <ben@blam.sh>
* address PR review feedback for OIDC defaults
- narrow CLI client ID pattern to exact cli.json path
- add BREAKING prefix to changeset
- add IPv6 [::1] to docs examples
- add loopback redirect URI tests for IPv6 and 127.0.0.1
Signed-off-by: benjdlambert <ben@blam.sh>
* remove dead ['*'] fallback when features are disabled
The restrictive defaults are now always used regardless of the enabled
flag, since the patterns are only consulted on code paths that require
the feature to be enabled.
Signed-off-by: benjdlambert <ben@blam.sh>
* add default pattern tests and fix docs cli example
Signed-off-by: benjdlambert <ben@blam.sh>
* use URL constructor for CLI client ID
Signed-off-by: benjdlambert <ben@blam.sh>
* use string templating for cliClientId to match OidcRouter
Signed-off-by: benjdlambert <ben@blam.sh>
* fix docs: remove misleading CLI client_id URL example
Signed-off-by: benjdlambert <ben@blam.sh>
---------
Signed-off-by: benjdlambert <ben@blam.sh>
* fix(catalog-backend): move generateStableHash out of shared util to fix Storybook build
The util.ts file mixed Node.js-only code (createHash from node:crypto)
with pure constants. Since InMemoryCatalogClient reaches into
buildEntitySearch via a relative import, and buildEntitySearch imports
from util.ts, the node:crypto dependency leaked into Vite's browser
bundle causing the Storybook build to fail.
Signed-off-by: benjdlambert <ben@blam.sh>
* add changeset
Signed-off-by: benjdlambert <ben@blam.sh>
---------
Signed-off-by: benjdlambert <ben@blam.sh>
When using GithubMultiOrgEntityProvider with alwaysUseDefaultNamespace
and teams with identical slugs across orgs, the emitted entity order
was non-deterministic. Since the catalog's upsert path uses last-write-
wins for duplicate entity refs, this caused the winning org to flip
randomly on every refresh cycle, producing constant unnecessary
stitching and flickering entity data.
Sort the emitted entities by entity ref (primary) and location
annotation (tiebreaker) so that the same org consistently wins when
duplicate refs exist.
Fixes#34263
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
The mock credentials created by mockCredentials.none(), .user(), and
.service() were missing the internal version: 'v1' field. This caused
toInternalBackstageCredentials() to throw when used with mock
credentials in tests.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Refactors all test files that use TestDatabases/TestCaches with
it.each(databases.eachSupportedId()) to instead use describe.each at
the outer level. This ensures that all tests for one database engine
complete before moving to the next, rather than interleaving engines
across individual tests. This reduces the number of concurrent database
connections and should help with test timeout issues in CI.
The TestDatabases.create() call is hoisted to module scope so the
describe.each can iterate over supported IDs at the top level.
40 files changed across packages/backend-defaults,
packages/backend-test-utils, and multiple plugins.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Patrik Oldsberg