From b3bf8967a4715ca7e329d688e812d69b807fdadf Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Tue, 10 Aug 2021 12:49:43 +0200 Subject: [PATCH 01/10] Auth backend: add support for authenticating from additional app origins Co-authored-by: Patrik Oldsberg Signed-off-by: Samira Mokaram --- .../lib/AuthConnector/DefaultAuthConnector.ts | 8 ++++-- plugins/auth-backend/package.json | 1 + .../src/lib/oauth/OAuthAdapter.ts | 28 +++++++++++++++---- plugins/auth-backend/src/lib/oauth/types.ts | 5 +++- plugins/auth-backend/src/providers/types.ts | 5 ++++ plugins/auth-backend/src/service/router.ts | 20 ++++++++++++- 6 files changed, 57 insertions(+), 10 deletions(-) diff --git a/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts b/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts index d707acdc9b..88156fedad 100644 --- a/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts +++ b/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts @@ -61,8 +61,7 @@ function defaultJoinScopes(scopes: Set) { * via the OAuthRequestApi. */ export class DefaultAuthConnector - implements AuthConnector -{ + implements AuthConnector { private readonly discoveryApi: DiscoveryApi; private readonly environment: string; private readonly provider: AuthProvider & { id: string }; @@ -152,7 +151,10 @@ export class DefaultAuthConnector private async showPopup(scopes: Set): Promise { const scope = this.joinScopesFunc(scopes); - const popupUrl = await this.buildUrl('/start', { scope }); + const popupUrl = await this.buildUrl('/start', { + scope, + origin: location.origin, + }); const payload = await showLoginPopup({ url: popupUrl, diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index c9219ddfae..4ea799c37c 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -51,6 +51,7 @@ "jwt-decode": "^3.1.0", "knex": "^0.95.1", "luxon": "^1.25.0", + "minimatch": "^3.0.3", "morgan": "^1.10.0", "node-cache": "^5.1.2", "openid-client": "^4.2.1", diff --git a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts index d9a49e17e8..6397c09233 100644 --- a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts +++ b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts @@ -22,9 +22,9 @@ import { BackstageIdentity, AuthProviderConfig, } from '../../providers/types'; -import { InputError } from '@backstage/errors'; +import { InputError, NotAllowedError } from '@backstage/errors'; import { TokenIssuer } from '../../identity/types'; -import { verifyNonce } from './helpers'; +import { readState, verifyNonce } from './helpers'; import { postMessageResponse, ensuresXRequestedWith } from '../flow'; import { OAuthHandlers, OAuthStartRequest, OAuthRefreshRequest } from './types'; @@ -40,6 +40,7 @@ export type Options = { cookiePath: string; appOrigin: string; tokenIssuer: TokenIssuer; + isOriginAllowed: (origin: string) => boolean; }; export class OAuthAdapter implements AuthProviderRouteHandlers { @@ -61,6 +62,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { cookieDomain: url.hostname, cookiePath, secure, + isOriginAllowed: config.isOriginAllowed, }); } @@ -73,6 +75,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { // retrieve scopes from request const scope = req.query.scope?.toString() ?? ''; const env = req.query.env?.toString(); + const origin = req.query.origin?.toString(); if (!env) { throw new InputError('No env provided in request query parameters'); @@ -86,7 +89,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { // set a nonce cookie before redirecting to oauth provider this.setNonceCookie(res, nonce); - const state = { nonce: nonce, env: env }; + const state = { nonce, env, origin }; const forwardReq = Object.assign(req, { scope, state }); const { url, status } = await this.handlers.start( @@ -103,7 +106,22 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { req: express.Request, res: express.Response, ): Promise { + let appOrigin = this.options.appOrigin; + try { + const state: any = readState(req.query.state?.toString() ?? ''); + + if (state.origin) { + try { + appOrigin = new URL(state.origin).origin; + } catch { + throw new NotAllowedError('App origin is invalid, failed to parse'); + } + if (!this.options.isOriginAllowed(appOrigin)) { + throw new NotAllowedError(`Origin '${appOrigin}' is not allowed`); + } + } + // verify nonce cookie and state cookie on callback verifyNonce(req, this.options.providerId); @@ -129,13 +147,13 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { await this.populateIdentity(response.backstageIdentity); // post message back to popup if successful - return postMessageResponse(res, this.options.appOrigin, { + return postMessageResponse(res, appOrigin, { type: 'authorization_response', response, }); } catch (error) { // post error message back to popup if failure - return postMessageResponse(res, this.options.appOrigin, { + return postMessageResponse(res, appOrigin, { type: 'authorization_response', error: { name: error.name, diff --git a/plugins/auth-backend/src/lib/oauth/types.ts b/plugins/auth-backend/src/lib/oauth/types.ts index c5ece2b921..989b76c0a4 100644 --- a/plugins/auth-backend/src/lib/oauth/types.ts +++ b/plugins/auth-backend/src/lib/oauth/types.ts @@ -77,6 +77,7 @@ export type OAuthState = { */ nonce: string; env: string; + origin?: string; }; export type OAuthStartRequest = express.Request<{}> & { @@ -106,7 +107,9 @@ export interface OAuthHandlers { * Handles the redirect from the auth provider when the user has signed in. * @param {express.Request} req */ - handler(req: express.Request): Promise<{ + handler( + req: express.Request, + ): Promise<{ response: AuthResponse; refreshToken?: string; }>; diff --git a/plugins/auth-backend/src/providers/types.ts b/plugins/auth-backend/src/providers/types.ts index c838005c00..66928ab4a7 100644 --- a/plugins/auth-backend/src/providers/types.ts +++ b/plugins/auth-backend/src/providers/types.ts @@ -34,6 +34,11 @@ export type AuthProviderConfig = { * The base URL of the app as provided by app.baseUrl */ appUrl: string; + + /** + * A function that is called to check whether an origin other than the apps default one is allowed. + */ + isOriginAllowed: (origin: string) => boolean; }; export type RedirectInfo = { diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts index 8173efcbc1..b314f2fd2f 100644 --- a/plugins/auth-backend/src/service/router.ts +++ b/plugins/auth-backend/src/service/router.ts @@ -32,6 +32,7 @@ import { Config } from '@backstage/config'; import { createOidcRouter, DatabaseKeyStore, TokenFactory } from '../identity'; import session from 'express-session'; import passport from 'passport'; +import { Minimatch } from 'minimatch'; type ProviderFactories = { [s: string]: AuthProviderFactory }; @@ -88,6 +89,8 @@ export async function createRouter({ const providersConfig = config.getConfig('auth.providers'); const configuredProviders = providersConfig.keys(); + const isOriginAllowed = createOriginFilter(config); + for (const [providerId, providerFactory] of Object.entries( allProviderFactories, )) { @@ -96,7 +99,7 @@ export async function createRouter({ try { const provider = providerFactory({ providerId, - globalConfig: { baseUrl: authUrl, appUrl }, + globalConfig: { baseUrl: authUrl, appUrl, isOriginAllowed }, config: providersConfig.getConfig(providerId), logger, tokenIssuer, @@ -158,3 +161,18 @@ export async function createRouter({ return router; } + +function createOriginFilter(config: Config): (origin: string) => boolean { + const allowedOrigins = config.getOptionalStringArray('auth.allowedOrigins'); + if (!allowedOrigins || allowedOrigins.length === 0) { + return () => false; + } + + const allowedOriginPatterns = allowedOrigins.map( + pattern => new Minimatch(pattern, { nocase: true, noglobstar: true }), + ); + + return origin => { + return allowedOriginPatterns.some(pattern => pattern.match(origin)); + }; +} From a90523497f825e5e98598c2ced22c8032e7cf0af Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Wed, 11 Aug 2021 10:13:52 +0200 Subject: [PATCH 02/10] address comments Signed-off-by: Samira Mokaram --- plugins/auth-backend/src/service/router.ts | 4 +++- yarn.lock | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts index b314f2fd2f..3c2ed31b94 100644 --- a/plugins/auth-backend/src/service/router.ts +++ b/plugins/auth-backend/src/service/router.ts @@ -163,7 +163,9 @@ export async function createRouter({ } function createOriginFilter(config: Config): (origin: string) => boolean { - const allowedOrigins = config.getOptionalStringArray('auth.allowedOrigins'); + const allowedOrigins = config.getOptionalStringArray( + 'auth.experimentalExtraAllowedOrigins', + ); if (!allowedOrigins || allowedOrigins.length === 0) { return () => false; } diff --git a/yarn.lock b/yarn.lock index 6568aed665..e48efe4e81 100644 --- a/yarn.lock +++ b/yarn.lock @@ -19330,7 +19330,7 @@ minimatch@0.3: lru-cache "2" sigmund "~1.0.0" -"minimatch@2 || 3", minimatch@3.0.4, minimatch@^3.0.2, minimatch@^3.0.4: +"minimatch@2 || 3", minimatch@3.0.4, minimatch@^3.0.2, minimatch@^3.0.3, minimatch@^3.0.4: version "3.0.4" resolved "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz#5166e286457f03306064be5497e8dbb0c3d32083" integrity sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA== From 3201f09734dd2213ac2d6fcad4c87617b413c1d1 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Thu, 12 Aug 2021 16:09:55 +0200 Subject: [PATCH 03/10] add test Signed-off-by: Samira Mokaram --- .../src/lib/oauth/OAuthAdapter.ts | 9 +++- .../auth-backend/src/service/router.test.ts | 46 +++++++++++++++++++ plugins/auth-backend/src/service/router.ts | 4 +- 3 files changed, 56 insertions(+), 3 deletions(-) create mode 100644 plugins/auth-backend/src/service/router.test.ts diff --git a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts index 6397c09233..df9fb43cbe 100644 --- a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts +++ b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts @@ -26,7 +26,12 @@ import { InputError, NotAllowedError } from '@backstage/errors'; import { TokenIssuer } from '../../identity/types'; import { readState, verifyNonce } from './helpers'; import { postMessageResponse, ensuresXRequestedWith } from '../flow'; -import { OAuthHandlers, OAuthStartRequest, OAuthRefreshRequest } from './types'; +import { + OAuthHandlers, + OAuthStartRequest, + OAuthRefreshRequest, + OAuthState, +} from './types'; export const THOUSAND_DAYS_MS = 1000 * 24 * 60 * 60 * 1000; export const TEN_MINUTES_MS = 600 * 1000; @@ -109,7 +114,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { let appOrigin = this.options.appOrigin; try { - const state: any = readState(req.query.state?.toString() ?? ''); + const state: OAuthState = readState(req.query.state?.toString() ?? ''); if (state.origin) { try { diff --git a/plugins/auth-backend/src/service/router.test.ts b/plugins/auth-backend/src/service/router.test.ts new file mode 100644 index 0000000000..f0f5134848 --- /dev/null +++ b/plugins/auth-backend/src/service/router.test.ts @@ -0,0 +1,46 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import { ConfigReader } from '@backstage/config'; +import { createOriginFilter } from './router'; + +describe('Auth origin filtering', () => { + const defaultConfigOptions = { + auth: { + experimentalExtraAllowedOrigins: ['https://test-*.example.net'], + }, + }; + const defaultConfig = () => new ConfigReader(defaultConfigOptions); + const getOptionalString = jest.fn(); + const config = defaultConfig(); + config.getOptionalString = getOptionalString; + it('Will explode, invalid origin', () => { + const origin = 'https://test.example.net'; + expect(createOriginFilter(config)(origin)).toBeFalsy(); + }); + it('Will explode, invalid origin domain', () => { + const origin = 'https://test-1234.examplee.net'; + expect(createOriginFilter(config)(origin)).toBeFalsy(); + }); + it("Won't explode, valid origin with numbers", () => { + const origin = 'https://test-1234.example.net'; + expect(createOriginFilter(config)(origin)).toBeTruthy(); + }); + it("Won't explode, valid origin with chars and numbers", () => { + const origin = 'https://test-test1234.example.net'; + expect(createOriginFilter(config)(origin)).toBeTruthy(); + }); +}); diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts index 3c2ed31b94..de6c1ffe03 100644 --- a/plugins/auth-backend/src/service/router.ts +++ b/plugins/auth-backend/src/service/router.ts @@ -162,7 +162,9 @@ export async function createRouter({ return router; } -function createOriginFilter(config: Config): (origin: string) => boolean { +export function createOriginFilter( + config: Config, +): (origin: string) => boolean { const allowedOrigins = config.getOptionalStringArray( 'auth.experimentalExtraAllowedOrigins', ); From 03121606fcb041138be223e2c40743fa6a370661 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Thu, 12 Aug 2021 16:47:31 +0200 Subject: [PATCH 04/10] fix prettier issue Signed-off-by: Samira Mokaram --- .../src/lib/AuthConnector/DefaultAuthConnector.ts | 3 ++- plugins/auth-backend/src/lib/oauth/types.ts | 4 +--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts b/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts index 88156fedad..261a008d4b 100644 --- a/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts +++ b/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts @@ -61,7 +61,8 @@ function defaultJoinScopes(scopes: Set) { * via the OAuthRequestApi. */ export class DefaultAuthConnector - implements AuthConnector { + implements AuthConnector +{ private readonly discoveryApi: DiscoveryApi; private readonly environment: string; private readonly provider: AuthProvider & { id: string }; diff --git a/plugins/auth-backend/src/lib/oauth/types.ts b/plugins/auth-backend/src/lib/oauth/types.ts index 989b76c0a4..7912dd16a5 100644 --- a/plugins/auth-backend/src/lib/oauth/types.ts +++ b/plugins/auth-backend/src/lib/oauth/types.ts @@ -107,9 +107,7 @@ export interface OAuthHandlers { * Handles the redirect from the auth provider when the user has signed in. * @param {express.Request} req */ - handler( - req: express.Request, - ): Promise<{ + handler(req: express.Request): Promise<{ response: AuthResponse; refreshToken?: string; }>; From 782cd0ed1ea95ef90aa912482bb05d51f7054a81 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Fri, 13 Aug 2021 09:58:46 +0200 Subject: [PATCH 05/10] add scape Signed-off-by: Samira Mokaram --- plugins/auth-backend/src/service/router.test.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/auth-backend/src/service/router.test.ts b/plugins/auth-backend/src/service/router.test.ts index f0f5134848..ca8a14f4e6 100644 --- a/plugins/auth-backend/src/service/router.test.ts +++ b/plugins/auth-backend/src/service/router.test.ts @@ -28,19 +28,19 @@ describe('Auth origin filtering', () => { const config = defaultConfig(); config.getOptionalString = getOptionalString; it('Will explode, invalid origin', () => { - const origin = 'https://test.example.net'; + const origin = 'https://test\\.example.net'; expect(createOriginFilter(config)(origin)).toBeFalsy(); }); it('Will explode, invalid origin domain', () => { - const origin = 'https://test-1234.examplee.net'; + const origin = 'https://test-1234\\.examplee.net'; expect(createOriginFilter(config)(origin)).toBeFalsy(); }); it("Won't explode, valid origin with numbers", () => { - const origin = 'https://test-1234.example.net'; + const origin = 'https://test-1234\\.example.net'; expect(createOriginFilter(config)(origin)).toBeTruthy(); }); it("Won't explode, valid origin with chars and numbers", () => { - const origin = 'https://test-test1234.example.net'; + const origin = 'https://test-test1234\\.example.net'; expect(createOriginFilter(config)(origin)).toBeTruthy(); }); }); From 72a31c29ae32c31fa3aa783ed416291de0bdf5a3 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Fri, 13 Aug 2021 13:22:00 +0200 Subject: [PATCH 06/10] add changest Signed-off-by: Samira Mokaram --- .changeset/fifty-insects-love.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .changeset/fifty-insects-love.md diff --git a/.changeset/fifty-insects-love.md b/.changeset/fifty-insects-love.md new file mode 100644 index 0000000000..6df7897f05 --- /dev/null +++ b/.changeset/fifty-insects-love.md @@ -0,0 +1,6 @@ +--- +'@backstage/core-app-api': minor +'@backstage/plugin-auth-backend': minor +--- + +Add support for additional app origins From 5132ae873d1f5c5b57b1016d57236645a5cd2db7 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Tue, 17 Aug 2021 11:45:03 +0200 Subject: [PATCH 07/10] fix test Signed-off-by: Samira Mokaram --- plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts index 0b35ea7bc8..27b629cc07 100644 --- a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts +++ b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts @@ -64,6 +64,7 @@ describe('OAuthAdapter', () => { issueToken: async () => 'my-id-token', listPublicKeys: async () => ({ keys: [] }), }, + isOriginAllowed: () => false, }; it('sets the correct headers in start', async () => { @@ -105,6 +106,7 @@ describe('OAuthAdapter', () => { const oauthProvider = new OAuthAdapter(providerInstance, { ...oAuthProviderOptions, disableRefresh: false, + isOriginAllowed: () => false, }); const state = { nonce: 'nonce', env: 'development' }; @@ -139,6 +141,7 @@ describe('OAuthAdapter', () => { const oauthProvider = new OAuthAdapter(providerInstance, { ...oAuthProviderOptions, disableRefresh: true, + isOriginAllowed: () => false, }); const mockRequest = { @@ -164,6 +167,7 @@ describe('OAuthAdapter', () => { const oauthProvider = new OAuthAdapter(providerInstance, { ...oAuthProviderOptions, disableRefresh: false, + isOriginAllowed: () => false, }); const mockRequest = { @@ -190,6 +194,7 @@ describe('OAuthAdapter', () => { const oauthProvider = new OAuthAdapter(providerInstance, { ...oAuthProviderOptions, disableRefresh: false, + isOriginAllowed: () => false, }); const mockRequest = { @@ -220,6 +225,7 @@ describe('OAuthAdapter', () => { const oauthProvider = new OAuthAdapter(providerInstance, { ...oAuthProviderOptions, disableRefresh: true, + isOriginAllowed: () => false, }); const mockRequest = { From 5ab35b84ec92ef40930277de73110b2fc0d1ec87 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Tue, 17 Aug 2021 12:00:05 +0200 Subject: [PATCH 08/10] fix check api report Signed-off-by: Samira Mokaram --- plugins/auth-backend/api-report.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md index af4375f5d7..11396cdc7c 100644 --- a/plugins/auth-backend/api-report.md +++ b/plugins/auth-backend/api-report.md @@ -105,6 +105,11 @@ export const createOktaProvider: ( _options?: OktaProviderOptions | undefined, ) => AuthProviderFactory; +// Warning: (ae-missing-release-tag) "createOriginFilter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export function createOriginFilter(config: Config): (origin: string) => boolean; + // Warning: (ae-missing-release-tag) "createRouter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) @@ -308,6 +313,7 @@ export type OAuthStartRequest = express.Request<{}> & { export type OAuthState = { nonce: string; env: string; + origin?: string; }; // Warning: (ae-missing-release-tag) "oktaEmailSignInResolver" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) @@ -399,9 +405,9 @@ export type WebMessageResponse = // src/identity/types.d.ts:25:5 - (ae-forgotten-export) The symbol "TokenParams" needs to be exported by the entry point index.d.ts // src/identity/types.d.ts:31:9 - (ae-forgotten-export) The symbol "AnyJWK" needs to be exported by the entry point index.d.ts // src/providers/google/provider.d.ts:36:5 - (ae-forgotten-export) The symbol "AuthHandler" needs to be exported by the entry point index.d.ts -// src/providers/types.d.ts:105:5 - (ae-forgotten-export) The symbol "AuthProviderConfig" needs to be exported by the entry point index.d.ts -// src/providers/types.d.ts:111:5 - (ae-forgotten-export) The symbol "ExperimentalIdentityResolver" needs to be exported by the entry point index.d.ts -// src/providers/types.d.ts:128:8 - (tsdoc-missing-deprecation-message) The @deprecated block must include a deprecation message, e.g. describing the recommended alternative +// src/providers/types.d.ts:109:5 - (ae-forgotten-export) The symbol "AuthProviderConfig" needs to be exported by the entry point index.d.ts +// src/providers/types.d.ts:115:5 - (ae-forgotten-export) The symbol "ExperimentalIdentityResolver" needs to be exported by the entry point index.d.ts +// src/providers/types.d.ts:132:8 - (tsdoc-missing-deprecation-message) The @deprecated block must include a deprecation message, e.g. describing the recommended alternative // (No @packageDocumentation comment for this package) ``` From 6fb2d041b7ffff86ba6900b8266f1a03356e60f4 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Tue, 17 Aug 2021 13:48:14 +0200 Subject: [PATCH 09/10] fix test Signed-off-by: Samira Mokaram --- .../src/lib/AuthConnector/DefaultAuthConnector.test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.test.ts b/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.test.ts index ce5df9fc91..28125f6fa8 100644 --- a/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.test.ts +++ b/packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.test.ts @@ -126,7 +126,7 @@ describe('DefaultAuthConnector', () => { expect(popupSpy).toBeCalledTimes(1); expect(popupSpy.mock.calls[0][0]).toMatchObject({ - url: 'http://my-host/api/auth/my-provider/start?scope=a%20b&env=production', + url: 'http://my-host/api/auth/my-provider/start?scope=a%20b&origin=http%3A%2F%2Flocalhost&env=production', }); await expect(sessionPromise).resolves.toEqual({ @@ -174,7 +174,7 @@ describe('DefaultAuthConnector', () => { expect(popupSpy).toBeCalledTimes(1); expect(popupSpy.mock.calls[0][0]).toMatchObject({ - url: 'http://my-host/api/auth/my-provider/start?scope=-ab-&env=production', + url: 'http://my-host/api/auth/my-provider/start?scope=-ab-&origin=http%3A%2F%2Flocalhost&env=production', }); }); }); From aed3e16dd901c3435aa25d4809bb0fd3f6e9faa2 Mon Sep 17 00:00:00 2001 From: Samira Mokaram Date: Tue, 17 Aug 2021 14:34:46 +0200 Subject: [PATCH 10/10] update changeset Signed-off-by: Samira Mokaram --- .changeset/fifty-insects-love.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/fifty-insects-love.md b/.changeset/fifty-insects-love.md index 6df7897f05..1e992cb72f 100644 --- a/.changeset/fifty-insects-love.md +++ b/.changeset/fifty-insects-love.md @@ -1,6 +1,6 @@ --- -'@backstage/core-app-api': minor -'@backstage/plugin-auth-backend': minor +'@backstage/core-app-api': patch +'@backstage/plugin-auth-backend': patch --- Add support for additional app origins