@backstage/plugin-auth-backend 0.18.4-next.1 → 0.18.4-next.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @backstage/plugin-auth-backend
 
+## 0.18.4-next.2
+
+### Patch Changes
+
+- d0f5b0c886c2: Set the expiration time of oidc `idToken` to be less than backstage session expiration time.
+- Updated dependencies
+  - @backstage/config@1.0.7
+
 ## 0.18.4-next.1
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -1449,8 +1449,9 @@ const gcpIap = createAuthProviderIntegration({
   }
 });
 
+const BACKSTAGE_SESSION_EXPIRATION = 3600;
+
 const ACCESS_TOKEN_PREFIX = "access-token.";
-const BACKSTAGE_SESSION_EXPIRATION$1 = 3600;
 class GithubAuthProvider {
   constructor(options) {
     this.signInResolver = options.signInResolver;
@@ -1544,10 +1545,10 @@ class GithubAuthProvider {
       if (expiresInSeconds) {
         expiresInSeconds = Math.min(
           expiresInSeconds,
-          BACKSTAGE_SESSION_EXPIRATION$1
+          BACKSTAGE_SESSION_EXPIRATION
         );
       } else {
-        expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION$1;
+        expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION;
       }
     }
     return {
@@ -1872,7 +1873,6 @@ const google = createAuthProviderIntegration({
   }
 });
 
-const BACKSTAGE_SESSION_EXPIRATION = 3600;
 class MicrosoftAuthProvider {
   constructor(options) {
     this.skipUserProfile = (accessToken) => {
@@ -2337,17 +2337,10 @@ class OidcAuthProvider {
   // Then populate the profile with it
   async handleResult(result) {
     const { profile } = await this.authHandler(result, this.resolverContext);
-    const response = {
-      providerInfo: {
-        idToken: result.tokenset.id_token,
-        accessToken: result.tokenset.access_token,
-        scope: result.tokenset.scope,
-        expiresInSeconds: result.tokenset.expires_in
-      },
-      profile
-    };
+    const expiresInSeconds = result.tokenset.expires_in === void 0 ? BACKSTAGE_SESSION_EXPIRATION : Math.min(result.tokenset.expires_in, BACKSTAGE_SESSION_EXPIRATION);
+    let backstageIdentity = void 0;
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver(
+      backstageIdentity = await this.signInResolver(
         {
           result,
           profile
@@ -2355,7 +2348,16 @@ class OidcAuthProvider {
         this.resolverContext
       );
     }
-    return response;
+    return {
+      backstageIdentity,
+      providerInfo: {
+        idToken: result.tokenset.id_token,
+        accessToken: result.tokenset.access_token,
+        scope: result.tokenset.scope,
+        expiresInSeconds
+      },
+      profile
+    };
   }
 }
 const oidc = createAuthProviderIntegration({
@@ -3642,7 +3644,7 @@ async function createRouter(options) {
     logger,
     database: authDb
   });
-  const keyDurationSeconds = 3600;
+  const keyDurationSeconds = BACKSTAGE_SESSION_EXPIRATION;
   const tokenIssuer = new TokenFactory({
     issuer: authUrl,
     keyStore,