@backstage/plugin-auth-backend 0.9.0-next.0 → 0.9.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @backstage/plugin-auth-backend
 
+## 0.9.0-next.1
+
+### Patch Changes
+
+- 9d75a939b6: Fixed a bug where providers that tracked the granted scopes through a cookie would not take failed authentication attempts into account.
+- 648606b3ac: Added support for storing static GitHub access tokens in cookies and using them to refresh the Backstage session.
+- Updated dependencies
+  - @backstage/backend-common@0.10.6-next.0
+
 ## 0.9.0-next.0
 
 ### Minor Changes

package/dist/index.cjs.js

@@ -281,46 +281,38 @@ class OAuthAdapter {
     this.setNonceCookie = (res, nonce) => {
       res.cookie(`${this.options.providerId}-nonce`, nonce, {
         maxAge: TEN_MINUTES_MS,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: `${this.options.cookiePath}/handler`,
-        httpOnly: true
+        ...this.baseCookieOptions,
+        path: `${this.options.cookiePath}/handler`
       });
     };
-    this.setScopesCookie = (res, scope) => {
-      res.cookie(`${this.options.providerId}-scope`, scope, {
-        maxAge: TEN_MINUTES_MS,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: `${this.options.cookiePath}/handler`,
-        httpOnly: true
+    this.setGrantedScopeCookie = (res, scope) => {
+      res.cookie(`${this.options.providerId}-granted-scope`, scope, {
+        maxAge: THOUSAND_DAYS_MS,
+        ...this.baseCookieOptions
       });
     };
-    this.getScopesFromCookie = (req, providerId) => {
-      return req.cookies[`${providerId}-scope`];
+    this.getGrantedScopeFromCookie = (req) => {
+      return req.cookies[`${this.options.providerId}-granted-scope`];
     };
     this.setRefreshTokenCookie = (res, refreshToken) => {
       res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
         maxAge: THOUSAND_DAYS_MS,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: this.options.cookiePath,
-        httpOnly: true
+        ...this.baseCookieOptions
       });
     };
     this.removeRefreshTokenCookie = (res) => {
       res.cookie(`${this.options.providerId}-refresh-token`, "", {
         maxAge: 0,
-        secure: this.options.secure,
-        sameSite: "lax",
-        domain: this.options.cookieDomain,
-        path: this.options.cookiePath,
-        httpOnly: true
+        ...this.baseCookieOptions
       });
     };
+    this.baseCookieOptions = {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: this.options.secure,
+      path: this.options.cookiePath,
+      domain: this.options.cookieDomain
+    };
   }
   static fromConfig(config, handlers, options) {
     var _a;
@@ -344,12 +336,12 @@ class OAuthAdapter {
     if (!env) {
       throw new errors.InputError("No env provided in request query parameters");
     }
-    if (this.options.persistScopes) {
-      this.setScopesCookie(res, scope);
-    }
     const nonce = crypto__default["default"].randomBytes(16).toString("base64");
     this.setNonceCookie(res, nonce);
     const state = { nonce, env, origin };
+    if (this.options.persistScopes) {
+      state.scope = scope;
+    }
     const forwardReq = Object.assign(req, { scope, state });
     const { url, status } = await this.handlers.start(forwardReq);
     res.statusCode = status || 302;
@@ -374,9 +366,9 @@ class OAuthAdapter {
       }
       verifyNonce(req, this.options.providerId);
       const { response, refreshToken } = await this.handlers.handler(req);
-      if (this.options.persistScopes) {
-        const grantedScopes = this.getScopesFromCookie(req, this.options.providerId);
-        response.providerInfo.scope = grantedScopes;
+      if (this.options.persistScopes && state.scope) {
+        this.setGrantedScopeCookie(res, state.scope);
+        response.providerInfo.scope = state.scope;
       }
       if (refreshToken && !this.options.disableRefresh) {
         this.setRefreshTokenCookie(res, refreshToken);
@@ -414,7 +406,10 @@ class OAuthAdapter {
       if (!refreshToken) {
         throw new errors.InputError("Missing session cookie");
       }
-      const scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
+      let scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
+      if (this.options.persistScopes) {
+        scope = this.getGrantedScopeFromCookie(req);
+      }
       const forwardReq = Object.assign(req, { scope, refreshToken });
       const { response, refreshToken: newRefreshToken } = await this.handlers.refresh(forwardReq);
       const backstageIdentity = await this.populateIdentity(response.backstageIdentity);
@@ -1154,6 +1149,8 @@ const createBitbucketProvider = (options) => {
   });
 };
 
+const ACCESS_TOKEN_PREFIX = "access-token.";
+const BACKSTAGE_SESSION_EXPIRATION = 3600;
 class GithubAuthProvider {
   constructor(options) {
     this.signInResolver = options.signInResolver;
@@ -1181,21 +1178,43 @@ class GithubAuthProvider {
   }
   async handler(req) {
     const { result, privateInfo } = await executeFrameHandlerStrategy(req, this._strategy);
+    let refreshToken = privateInfo.refreshToken;
+    if (!refreshToken && !result.params.expires_in) {
+      refreshToken = ACCESS_TOKEN_PREFIX + result.accessToken;
+    }
     return {
       response: await this.handleResult(result),
-      refreshToken: privateInfo.refreshToken
+      refreshToken
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { scope, refreshToken } = req;
+    if (refreshToken == null ? void 0 : refreshToken.startsWith(ACCESS_TOKEN_PREFIX)) {
+      const accessToken = refreshToken.slice(ACCESS_TOKEN_PREFIX.length);
+      const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken).catch((error) => {
+        var _a;
+        if (((_a = error.oauthError) == null ? void 0 : _a.statusCode) === 401) {
+          throw new Error("Invalid access token");
+        }
+        throw error;
+      });
+      return {
+        response: await this.handleResult({
+          fullProfile,
+          params: { scope },
+          accessToken
+        }),
+        refreshToken
+      };
+    }
+    const result = await executeRefreshTokenStrategy(this._strategy, refreshToken, scope);
     return {
       response: await this.handleResult({
-        fullProfile,
-        params,
-        accessToken
+        fullProfile: await executeFetchUserProfileStrategy(this._strategy, result.accessToken),
+        params: { ...result.params, scope },
+        accessToken: result.accessToken
       }),
-      refreshToken
+      refreshToken: result.refreshToken
     };
   }
   async handleResult(result) {
@@ -1206,21 +1225,28 @@ class GithubAuthProvider {
     };
     const { profile } = await this.authHandler(result, context);
     const expiresInStr = result.params.expires_in;
-    const response = {
+    let expiresInSeconds = expiresInStr === void 0 ? void 0 : Number(expiresInStr);
+    let backstageIdentity = void 0;
+    if (this.signInResolver) {
+      backstageIdentity = await this.signInResolver({
+        result,
+        profile
+      }, context);
+      if (expiresInSeconds) {
+        expiresInSeconds = Math.min(expiresInSeconds, BACKSTAGE_SESSION_EXPIRATION);
+      } else {
+        expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION;
+      }
+    }
+    return {
+      backstageIdentity,
       providerInfo: {
         accessToken: result.accessToken,
         scope: result.params.scope,
-        expiresInSeconds: expiresInStr === void 0 ? void 0 : Number(expiresInStr)
+        expiresInSeconds
       },
       profile
     };
-    if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, context);
-    }
-    return response;
   }
 }
 const githubDefaultSignInResolver = async (info, ctx) => {