Instead of a one-time warning, emit a deprecation warning every time
an extension is created using the deprecated `config.schema` option,
including the call site location to help track down each usage.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Replace box-style section comments with TSDoc comments to match
the style used throughout the rest of the repository.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Replace the monolithic `createSchemaFromZod` approach with per-field
schema resolution via `createConfigSchema`. Each field is resolved
individually and eagerly validated for JSON Schema conversion support,
but the actual JSON Schema generation is deferred until first access.
`PortableSchema.schema` is now a lazy callable — it can still be
accessed as a property (backward compat, deprecated) or called as a
method returning `{ schema: JsonObject }` for the new API.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Remove the `ConfigFieldSchema` and `ConfigSchemaRecord` types that are
no longer needed now that `configSchema` and `config.schema` each accept
only one form. The deprecated overloads now constrain directly to the
factory signature `(zImpl: typeof z) => z.ZodType`.
Also fix pre-existing API report warnings by promoting
`ResolvedExtensionInputs`, `RequiredExtensionIds`,
`VerifyExtensionFactoryOutput`, and `VerifyExtensionAttachTo` to
`@public` and exporting them from both entry points.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Introduce a new top-level `configSchema` option for `createExtension`,
`createExtensionBlueprint`, `override`, and `makeWithOverrides` that
accepts Standard Schema values directly. The old `config.schema` form
is deprecated via function/method overloads so that the entire call
site gets editor strikethrough when matched.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Widens the TConfigSchema generic constraint in createExtension,
createExtensionBlueprint, and their override/makeWithOverrides methods
to accept both the existing zod factory form and direct Standard Schema
instances via the new ConfigFieldSchema union type.
Existing consumers are unaffected — the factory form continues to
infer concrete types through z.infer<ReturnType<...>>. Direct Standard
Schema values are accepted but infer as any in the current iteration.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Adds a mock/exploration file showing what a central Standard-Schema-based
utility could look like for decoupling the exact zod version from the
public API surface of extension config schemas.
This is not wired into anything — just saving progress on the design
exploration for per-field validation, JSON Schema generation, and
schema merging across different sources (blueprint + override) that
may use different schema libraries or zod versions.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Update the question about hosted/commercial versions of Backstage
to be vendor-neutral and link to the commercial partners page.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Remove solo.io, VMware, and Alauda as commercial partners due to
broken/irrelevant landing pages. Add Spotify for Backstage as a
partner. Sort partners alphabetically and normalize logo sizes
with per-partner height control.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Remove the deprecated alpha exports CatalogPermissionRuleInput,
CatalogPermissionExtensionPoint, and catalogPermissionExtensionPoint
from catalog-node, and remove the corresponding CatalogPermissionExtensionPointImpl,
addPermissions, and addPermissionRules from catalog-backend. Custom permission
rules and permissions are now registered via coreServices.permissionsRegistry.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Adds a new `Badge` component to the Backstage UI library. Badge shares the same visual appearance as `Tag` (size tokens, colors, border radius, icon slot) but renders as a plain non-interactive `<span>` with no React Aria plumbing.
Key characteristics:
- Plain DOM element — accessible text content exposed to screen readers without any role override
- Background consumer — participates in the bg context system and steps up neutral background levels (`neutral-2` → `neutral-3` → `neutral-4`) when placed inside colored containers
- Supports `icon`, `size` (`small` | `medium`, defaults to `small`), `children`, and `className` props
- Fully themeable via `BadgeDefinition`
Also includes Storybook stories and full docs-ui documentation (props table, examples, theming section, changelog).
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
* verify-links: catch broken anchors, directory links, and invisible characters
Enhances the link verification script to catch several categories of
broken links that were previously missed:
- Broken anchors (cross-file and same-file) by extracting heading slugs
from target documents and verifying anchors resolve
- Directory links missing index.md suffix within docs/
- Invisible/zero-width characters in URLs
- Case-sensitive anchor mismatches
Also strips fenced code blocks before scanning for links to avoid false
positives, and handles duplicate heading slug deduplication (GitHub and
Docusaurus append -1, -2, etc.).
Fixes a few newly-caught broken links in existing docs.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* Fix CodeQL incomplete multi-character sanitization alert
Apply HTML tag stripping in a loop so that nested fragments
like <scr<script>ipt> are fully removed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
---------
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Make `permissionsRegistry` required and `permissions` always a
`PermissionsService` in `CatalogEnvironment`. Remove the deprecated
`PermissionAuthorizer` fallback path and the `createPermissionIntegrationRouter`
fallback — catalog now exclusively uses `permissionsRegistry.addResourceType`
to register its permission resource type.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Adds startup warnings to HostDiscovery.fromConfig when backend.baseUrl
is set to a localhost address in a production environment, or when the
value is not a valid URL at all.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Patrik Oldsberg