add test

Signed-off-by: Samira Mokaram <samiram@spotify.com>

plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts

@@ -26,7 +26,12 @@ import { InputError, NotAllowedError } from '@backstage/errors';
 import { TokenIssuer } from '../../identity/types';
 import { readState, verifyNonce } from './helpers';
 import { postMessageResponse, ensuresXRequestedWith } from '../flow';
-import { OAuthHandlers, OAuthStartRequest, OAuthRefreshRequest } from './types';
+import {
+  OAuthHandlers,
+  OAuthStartRequest,
+  OAuthRefreshRequest,
+  OAuthState,
+} from './types';
 
 export const THOUSAND_DAYS_MS = 1000 * 24 * 60 * 60 * 1000;
 export const TEN_MINUTES_MS = 600 * 1000;
@@ -109,7 +114,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
     let appOrigin = this.options.appOrigin;
 
     try {
-      const state: any = readState(req.query.state?.toString() ?? '');
+      const state: OAuthState = readState(req.query.state?.toString() ?? '');
 
       if (state.origin) {
         try {

plugins/auth-backend/src/service/router.test.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ConfigReader } from '@backstage/config';
+import { createOriginFilter } from './router';
+
+describe('Auth origin filtering', () => {
+  const defaultConfigOptions = {
+    auth: {
+      experimentalExtraAllowedOrigins: ['https://test-*.example.net'],
+    },
+  };
+  const defaultConfig = () => new ConfigReader(defaultConfigOptions);
+  const getOptionalString = jest.fn();
+  const config = defaultConfig();
+  config.getOptionalString = getOptionalString;
+  it('Will explode, invalid origin', () => {
+    const origin = 'https://test.example.net';
+    expect(createOriginFilter(config)(origin)).toBeFalsy();
+  });
+  it('Will explode, invalid origin domain', () => {
+    const origin = 'https://test-1234.examplee.net';
+    expect(createOriginFilter(config)(origin)).toBeFalsy();
+  });
+  it("Won't explode, valid origin with numbers", () => {
+    const origin = 'https://test-1234.example.net';
+    expect(createOriginFilter(config)(origin)).toBeTruthy();
+  });
+  it("Won't explode, valid origin with chars and numbers", () => {
+    const origin = 'https://test-test1234.example.net';
+    expect(createOriginFilter(config)(origin)).toBeTruthy();
+  });
+});

plugins/auth-backend/src/service/router.ts

@@ -162,7 +162,9 @@ export async function createRouter({
   return router;
 }
 
-function createOriginFilter(config: Config): (origin: string) => boolean {
+export function createOriginFilter(
+  config: Config,
+): (origin: string) => boolean {
   const allowedOrigins = config.getOptionalStringArray(
     'auth.experimentalExtraAllowedOrigins',
   );