From 609a95492eca878f2f76db82b0dd3af5a0dee67a Mon Sep 17 00:00:00 2001
From: ataylorme <andrew.taylor@fox.com>
Date: Thu, 12 Oct 2023 21:11:39 -0700
Subject: [PATCH] Allow user-defined scopes for Okta auth in config yaml

- Accept a new scope option during okta creation with `createAuthProviderIntegration`
- Pass the user-defined `scope` as an option to `OktaAuthProvider`
- Add `scope` as an option for `OktaAuthProvider`
- Set `scope` in `OktaAuthProvider` to the `scope` passed as an `option` or a default of `'openid email profile offline_access'` if a user-defined option is not provided
- Update the `start` and `refresh` methods to use `scope` from `OktaAuthProvider` rather than `scope` from the request

Signed-off-by: ataylorme <andrew@ataylor.me>
---
 plugins/auth-backend/src/providers/okta/provider.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index 05e0451bdb..3ebc865726 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -60,6 +60,7 @@ export type OktaAuthProviderOptions = OAuthProviderOptions & {
   signInResolver?: SignInResolver<OAuthResult>;
   authHandler: AuthHandler<OAuthResult>;
   resolverContext: AuthResolverContext;
+  scope?: string;
 };
 
 export class OktaAuthProvider implements OAuthHandlers {
@@ -67,6 +68,7 @@ export class OktaAuthProvider implements OAuthHandlers {
   private readonly signInResolver?: SignInResolver<OAuthResult>;
   private readonly authHandler: AuthHandler<OAuthResult>;
   private readonly resolverContext: AuthResolverContext;
+  private readonly scope: string;
 
   /**
    * Due to passport-okta-oauth forcing options.state = true,
@@ -89,6 +91,7 @@ export class OktaAuthProvider implements OAuthHandlers {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
+    this.scope = options.scope || 'openid email profile offline_access';
 
     this.strategy = new OktaStrategy(
       {
@@ -129,7 +132,7 @@ export class OktaAuthProvider implements OAuthHandlers {
     return await executeRedirectStrategy(req, this.strategy, {
       accessType: 'offline',
       prompt: 'consent',
-      scope: req.scope,
+      scope: this.scope,
       state: encodeState(req.state),
     });
   }
@@ -151,7 +154,7 @@ export class OktaAuthProvider implements OAuthHandlers {
       await executeRefreshTokenStrategy(
         this.strategy,
         req.refreshToken,
-        req.scope,
+        this.scope,
       );
 
     const fullProfile = await executeFetchUserProfileStrategy(
@@ -230,6 +233,7 @@ export const okta = createAuthProviderIntegration({
         const callbackUrl =
           customCallbackUrl ||
           `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+        const scope = envConfig.getOptionalString('scope');
 
         // This is a safe assumption as `passport-okta-oauth` uses the audience
         // as the base for building the authorization, token, and user info URLs.
@@ -254,6 +258,7 @@ export const okta = createAuthProviderIntegration({
           authHandler,
           signInResolver: options?.signIn?.resolver,
           resolverContext,
+          scope,
         });
 
         return OAuthAdapter.fromConfig(globalConfig, provider, {