@backstage/plugin-auth-backend 0.17.0-next.0 → 0.17.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @backstage/plugin-auth-backend
 
+## 0.17.0-next.1
+
+### Minor Changes
+
+- e2dc42e9f0: Google OAuth refresh tokens will now be revoked on logout by calling Google's API
+
+### Patch Changes
+
+- b5c126010c: Auth0 provider now supports optional `connection` and `connectionScope` parameters to configure social identity providers.
+- Updated dependencies
+  - @backstage/catalog-client@1.1.1-next.1
+  - @backstage/backend-common@0.15.2-next.1
+  - @backstage/catalog-model@1.1.2-next.1
+  - @backstage/config@1.0.3-next.1
+  - @backstage/errors@1.1.2-next.1
+  - @backstage/types@1.0.0
+  - @backstage/plugin-auth-node@0.2.6-next.1
+
 ## 0.17.0-next.0
 
 ### Minor Changes

package/dist/index.cjs.js

@@ -306,6 +306,9 @@ class OAuthAdapter {
         ...cookieConfig
       });
     };
+    this.getRefreshTokenFromCookie = (req) => {
+      return req.cookies[`${this.options.providerId}-refresh-token`];
+    };
     this.getGrantedScopeFromCookie = (req) => {
       return req.cookies[`${this.options.providerId}-granted-scope`];
     };
@@ -415,6 +418,13 @@ class OAuthAdapter {
     if (!ensuresXRequestedWith(req)) {
       throw new errors.AuthenticationError("Invalid X-Requested-With header");
     }
+    if (this.handlers.logout) {
+      const refreshToken = this.getRefreshTokenFromCookie(req);
+      const revokeRequest = Object.assign(req, {
+        refreshToken
+      });
+      await this.handlers.logout(revokeRequest);
+    }
     const origin = req.get("origin");
     const cookieConfig = this.getCookieConfig(origin);
     this.removeRefreshTokenCookie(res, cookieConfig);
@@ -431,7 +441,7 @@ class OAuthAdapter {
       );
     }
     try {
-      const refreshToken = req.cookies[`${this.options.providerId}-refresh-token`];
+      const refreshToken = this.getRefreshTokenFromCookie(req);
       if (!refreshToken) {
         throw new errors.InputError("Missing session cookie");
       }
@@ -745,6 +755,8 @@ class Auth0AuthProvider {
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
     this.audience = options.audience;
+    this.connection = options.connection;
+    this.connectionScope = options.connectionScope;
     this._strategy = new Auth0Strategy(
       {
         clientID: options.clientId,
@@ -776,12 +788,16 @@ class Auth0AuthProvider {
       prompt: "consent",
       scope: req.scope,
       state: encodeState(req.state),
-      ...this.audience ? { audience: this.audience } : {}
+      ...this.audience ? { audience: this.audience } : {},
+      ...this.connection ? { connection: this.connection } : {},
+      ...this.connectionScope ? { connection_scope: this.connectionScope } : {}
     });
   }
   async handler(req) {
     const { result, privateInfo } = await executeFrameHandlerStrategy(req, this._strategy, {
-      ...this.audience ? { audience: this.audience } : {}
+      ...this.audience ? { audience: this.audience } : {},
+      ...this.connection ? { connection: this.connection } : {},
+      ...this.connectionScope ? { connection_scope: this.connectionScope } : {}
     });
     return {
       response: await this.handleResult(result),
@@ -839,6 +855,8 @@ const auth0 = createAuthProviderIntegration({
       const domain = envConfig.getString("domain");
       const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
       const audience = envConfig.getOptionalString("audience");
+      const connection = envConfig.getOptionalString("connection");
+      const connectionScope = envConfig.getOptionalString("connectionScope");
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
         profile: makeProfileInfo(fullProfile, params.id_token)
@@ -852,7 +870,9 @@ const auth0 = createAuthProviderIntegration({
         authHandler,
         signInResolver,
         resolverContext,
-        audience
+        audience,
+        connection,
+        connectionScope
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
         providerId,
@@ -1712,6 +1732,10 @@ class GoogleAuthProvider {
       refreshToken: privateInfo.refreshToken
     };
   }
+  async logout(req) {
+    const oauthClient = new googleAuthLibrary.OAuth2Client();
+    await oauthClient.revokeToken(req.refreshToken);
+  }
   async refresh(req) {
     const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
       this.strategy,