From 05a4bbb5d0eaa7098b36b4f436bcf17c1ed21aa8 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Mon, 26 Feb 2024 10:17:50 +0100
Subject: [PATCH] beps/0003: add none credential and expiration times

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 beps/0003-auth-architecture-evolution/README.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/beps/0003-auth-architecture-evolution/README.md b/beps/0003-auth-architecture-evolution/README.md
index fe3cc7bdb8..998eb08dbd 100644
--- a/beps/0003-auth-architecture-evolution/README.md
+++ b/beps/0003-auth-architecture-evolution/README.md
@@ -110,6 +110,8 @@ export type BackstageServicePrincipal = {
 export type BackstageCredentials<TPrincipal = unknown> = {
   $$type: '@backstage/BackstageCredentials';
 
+  expiresAt?: Date;
+
   principal: TPrincipal;
 };
 
@@ -132,6 +134,8 @@ export interface AuthService {
     type: TType,
   ): credentials is BackstageCredentials<BackstagePrincipalTypes[TType]>;
 
+  getNoneCredentials(): Promise<BackstageCredentials<BackstageUserPrincipal>>;
+
   getOwnServiceCredentials(): Promise<
     BackstageCredentials<BackstageServicePrincipal>
   >;
@@ -228,9 +232,9 @@ export default createBackendPlugin({
 
         // Endpoint that sets the cookie for the user
         router.get('/cookie', async (req, res) => {
-          await httpAuth.issueUserCookie(req);
+          const { expiresAt } = await httpAuth.issueUserCookie(req);
 
-          res.json({ ok: true });
+          res.json({ expiresAt: expiresAt.toISOString() });
         });
 
         // Endpoint protected by cookie auth
@@ -303,7 +307,7 @@ export interface HttpAuthService {
       // If credentials are not provided, they will be read from the request
       credentials?: BackstageCredentials<BackstageUserPrincipal>;
     },
-  ): Promise<void>;
+  ): Promise<{ expiresAt: Date }>;
 }
 ```