401 GET /api/catalog/entities/

[vocal perch]

Locally spinning up the new backend system and the backend API routes are not wired up correctly. In the legacy backend, there is apiRouter that explicitly registered these paths, for example:

  const apiRouter = Router();
  apiRouter.use('/auth', await auth(authEnv));
  apiRouter.use('/catalog', await catalog(catalogEnv));
  ...

While in the new backend, they seem to be hidden behind the packages per this guide - https://backstage.io/docs/backend-system/building-backends/migrating/#overall-structure

Not sure what we're missing. Any idea and debug tips will be helpful.

Attached my yarn tsc and yarn backstage-cli info.

Our yarn is pretty old at 1.22.22; we plan to upgrade it to the recommended version at 4.x as a seperate endeavor for problem isolation.

[vocal perch]

401 GET /api/catalog/entities/

Updated: I got 401 for API calls from the frontend to the backend with the following errors:

{
  "error": {
    "name": "AuthenticationError",
    "message": "Missing credentials",
    "stack": "AuthenticationError: Missing credentials\n    at DefaultHttpAuthService.credentials (/Users/username/Sources/new/backstage/packages/backend/node_modules/@backstage/backend-defaults/dist/entrypoints/httpAuth/httpAuthServiceFactory.cjs.js:91:13)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
  },
  "request": {
    "method": "GET",
    "url": "/entities"
  },
  "response": {
    "statusCode": 401
  }
}

Is the new auth model requiring auth even for guest profile?

[boreal plank]

In the new backend system, everything is authed always yes. With a few very explicit (opt-out) exceptions on safe "system" service paths.

There's a guest auth module that issues proper tokens though. And it can be configured to dangerously apply in production too if you like

[vocal perch]

Do you have a link to the doc mentioning about the dangerous config @boreal plank ?