Merge pull request #964 from spotify/rugvip/backend-auth-fixes

plugins/auth-backend: couple of backend fixes needed to make auth work e2e
2020-05-22 12:57:15 +02:00
parent 274238b8b8 1d43ee5b1d
commit 1411b170b2
2 changed files with 19 additions and 6 deletions
@@ -23,6 +23,7 @@ import {
  AuthProviderConfig,
 } from './../types';
 import { postMessageResponse } from './../utils';
+import { InputError } from '@backstage/backend-common';

 export class GoogleAuthProvider
  implements AuthProvider, AuthProviderRouteHandlers {
@@ -36,9 +37,12 @@ export class GoogleAuthProvider
    res: express.Response,
    next: express.NextFunction,
  ) {
-    const scopes = req.query.scopes?.toString().split(',');
+    const scope = req.query.scope?.toString() ?? '';
+    if (!scope) {
+      throw new InputError('missing scope parameter');
+    }
    return passport.authenticate('google', {
-      scope: scopes,
+      scope,
      accessType: 'offline',
      prompt: 'consent',
    })(req, res, next);
@@ -66,15 +70,20 @@ export class GoogleAuthProvider

  strategy(): passport.Strategy {
    return new GoogleStrategy(
-      { ...this.providerConfig.options, passReqToCallback: true },
+      { ...this.providerConfig.options },
      (
-        _req: any,
        accessToken: any,
        refreshToken: any,
+        params: any,
        profile: any,
        cb: any,
      ) => {
-        cb(undefined, { profile, accessToken, refreshToken });
+        cb(undefined, {
+          profile,
+          idToken: params.id_token,
+          accessToken,
+          refreshToken,
+        });
      },
    );
  }
@@ -24,12 +24,16 @@ export const postMessageResponse = (
  const jsonData = JSON.stringify(data);
  const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');

+  res.setHeader('Content-Type', 'text/html');
  res.setHeader('X-Frame-Options', 'sameorigin');
+
+  // TODO: Make target app origin configurable globally
  res.end(`
 <html>
 <body>
  <script>
-    (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), location.origin)
+    (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), 'http://localhost:3000')
+    window.close()
  </script>
 </body>
 </html>