From 5c485ff60ff2c381e7083449c57cea58586b4acc Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Thu, 19 Nov 2020 09:11:13 -0800
Subject: [PATCH] Added a auth.session.secret config value for setting the
 express session secret

---
 app-config.yaml                            |  2 ++
 plugins/auth-backend/package.json          | 23 +++++++++++++++++++++-
 plugins/auth-backend/src/service/router.ts |  4 +++-
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/app-config.yaml b/app-config.yaml
index cfa47618e8..34a0b09520 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -191,6 +191,8 @@ scaffolder:
         $env: AZURE_TOKEN
 
 auth:
+  session:
+    secret: yaml session secret
   providers:
     google:
       development:
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index f1ad45d9e5..94502775e4 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -71,5 +71,26 @@
   "files": [
     "dist",
     "migrations"
-  ]
+  ],
+  "configSchema": {
+    "$schema": "https://backstage.io/schema/config-v1",
+    "title": "@backstage/auth-backend",
+    "type": "object",
+    "properties": {
+      "auth": {
+        "type": "object",
+        "properties": {
+          "session": {
+            "type": "object",
+            "properties": {
+              "secret": {
+                "type": "string",
+                "visibility": "secret"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
 }
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index e8624d36b3..1baa1d4892 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -60,7 +60,9 @@ export async function createRouter({
   });
   const catalogApi = new CatalogClient({ discoveryApi: discovery });
 
-  const secret = 'backstage secret'; // TODO: Allow an override here
+  const secret =
+    config.getOptionalString('auth.session.secret') ?? 'backstage secret';
+  console.log('using secret', secret);
   router.use(cookieParser(secret));
   router.use(session({ secret, saveUninitialized: false, resave: false }));
   router.use(express.urlencoded({ extended: false }));