Merge pull request #19473 from backstage/rugvip/providers
auth-backend: migrate GitHub provider
This commit is contained in:
Patrik Oldsberg
@@ -0,0 +1,5 @@
|
||||
---
|
||||
'@backstage/plugin-auth-backend-module-github-provider': minor
|
||||
---
|
||||
|
||||
New module for `@backstage/plugin-auth-backend` that adds a GitHub auth provider.
|
||||
@@ -0,0 +1 @@
|
||||
module.exports = require('@backstage/cli/config/eslint-factory')(__dirname);
|
||||
@@ -0,0 +1,8 @@
|
||||
# Auth Module: GitHub Provider
|
||||
|
||||
This module provides an GitHub auth provider implementation for `@backstage/plugin-auth-backend`.
|
||||
|
||||
## Links
|
||||
|
||||
- [Backstage](https://backstage.io)
|
||||
- [Repository](https://github.com/backstage/backstage/tree/master/plugins/auth-backend-module-github-provider)
|
||||
@@ -0,0 +1,29 @@
|
||||
## API Report File for "@backstage/plugin-auth-backend-module-github-provider"
|
||||
|
||||
> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
|
||||
|
||||
```ts
|
||||
import { BackendFeature } from '@backstage/backend-plugin-api';
|
||||
import { OAuthAuthenticator } from '@backstage/plugin-auth-node';
|
||||
import { OAuthAuthenticatorResult } from '@backstage/plugin-auth-node';
|
||||
import { PassportOAuthAuthenticatorHelper } from '@backstage/plugin-auth-node';
|
||||
import { PassportProfile } from '@backstage/plugin-auth-node';
|
||||
import { SignInResolverFactory } from '@backstage/plugin-auth-node';
|
||||
|
||||
// @public (undocumented)
|
||||
export const authModuleGithubProvider: () => BackendFeature;
|
||||
|
||||
// @public (undocumented)
|
||||
export const githubAuthenticator: OAuthAuthenticator<
|
||||
PassportOAuthAuthenticatorHelper,
|
||||
PassportProfile
|
||||
>;
|
||||
|
||||
// @public
|
||||
export namespace githubSignInResolvers {
|
||||
const usernameMatchingUserEntityName: SignInResolverFactory<
|
||||
OAuthAuthenticatorResult<PassportProfile>,
|
||||
unknown
|
||||
>;
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,26 @@
|
||||
/*
|
||||
* Copyright 2023 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import { createBackend } from '@backstage/backend-defaults';
|
||||
import { authPlugin } from '@backstage/plugin-auth-backend';
|
||||
import { authModuleGithubProvider } from '../src';
|
||||
|
||||
const backend = createBackend();
|
||||
|
||||
backend.add(authPlugin);
|
||||
backend.add(authModuleGithubProvider);
|
||||
|
||||
backend.start();
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"name": "@backstage/plugin-auth-backend-module-github-provider",
|
||||
"description": "The github-provider backend module for the auth plugin.",
|
||||
"version": "0.0.0",
|
||||
"main": "src/index.ts",
|
||||
"types": "src/index.ts",
|
||||
"license": "Apache-2.0",
|
||||
"publishConfig": {
|
||||
"access": "public",
|
||||
"main": "dist/index.cjs.js",
|
||||
"types": "dist/index.d.ts"
|
||||
},
|
||||
"backstage": {
|
||||
"role": "backend-plugin-module"
|
||||
},
|
||||
"scripts": {
|
||||
"start": "backstage-cli package start",
|
||||
"build": "backstage-cli package build",
|
||||
"lint": "backstage-cli package lint",
|
||||
"test": "backstage-cli package test",
|
||||
"clean": "backstage-cli package clean",
|
||||
"prepack": "backstage-cli package prepack",
|
||||
"postpack": "backstage-cli package postpack"
|
||||
},
|
||||
"dependencies": {
|
||||
"@backstage/backend-common": "workspace:^",
|
||||
"@backstage/backend-plugin-api": "workspace:^",
|
||||
"@backstage/plugin-auth-node": "workspace:^",
|
||||
"passport-github2": "^0.1.12"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@backstage/backend-defaults": "workspace:^",
|
||||
"@backstage/backend-test-utils": "workspace:^",
|
||||
"@backstage/cli": "workspace:^",
|
||||
"@backstage/plugin-auth-backend": "workspace:^",
|
||||
"supertest": "^6.3.3"
|
||||
},
|
||||
"files": [
|
||||
"dist"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
/*
|
||||
* Copyright 2020 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import {
|
||||
PassportOAuthAuthenticatorHelper,
|
||||
PassportProfile,
|
||||
} from '@backstage/plugin-auth-node';
|
||||
import { githubAuthenticator } from './authenticator';
|
||||
|
||||
describe('githubAuthenticator', () => {
|
||||
it('should store access token without expiration as refresh token', async () => {
|
||||
await expect(
|
||||
githubAuthenticator.authenticate(
|
||||
{} as any,
|
||||
{
|
||||
authenticate: async _input => ({
|
||||
fullProfile: { id: 'id' } as PassportProfile,
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
},
|
||||
}),
|
||||
} as PassportOAuthAuthenticatorHelper,
|
||||
),
|
||||
).resolves.toEqual({
|
||||
fullProfile: { id: 'id' },
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
refreshToken: 'access-token.my-token',
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('should not use access token as refresh token if it expires', async () => {
|
||||
await expect(
|
||||
githubAuthenticator.authenticate(
|
||||
{} as any,
|
||||
{
|
||||
authenticate: async _input => ({
|
||||
fullProfile: { id: 'id' } as PassportProfile,
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
expiresInSeconds: 3,
|
||||
},
|
||||
}),
|
||||
} as PassportOAuthAuthenticatorHelper,
|
||||
),
|
||||
).resolves.toEqual({
|
||||
fullProfile: { id: 'id' },
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
expiresInSeconds: 3,
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('should not store access token without expiration if a refresh token is provided', async () => {
|
||||
await expect(
|
||||
githubAuthenticator.authenticate(
|
||||
{} as any,
|
||||
{
|
||||
authenticate: async _input => ({
|
||||
fullProfile: { id: 'id' } as PassportProfile,
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
refreshToken: 'my-refresh-token',
|
||||
},
|
||||
}),
|
||||
} as PassportOAuthAuthenticatorHelper,
|
||||
),
|
||||
).resolves.toEqual({
|
||||
fullProfile: { id: 'id' },
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
refreshToken: 'my-refresh-token',
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('should refresh with access token', async () => {
|
||||
await expect(
|
||||
githubAuthenticator.refresh(
|
||||
{
|
||||
refreshToken: 'access-token.my-token',
|
||||
req: {} as any,
|
||||
scope: 'user:read',
|
||||
},
|
||||
{
|
||||
fetchProfile: async _input => ({ id: 'id' } as PassportProfile),
|
||||
} as PassportOAuthAuthenticatorHelper,
|
||||
),
|
||||
).resolves.toEqual({
|
||||
fullProfile: { id: 'id' },
|
||||
session: {
|
||||
accessToken: 'my-token',
|
||||
scope: 'user:read',
|
||||
tokenType: 'bearer',
|
||||
refreshToken: 'access-token.my-token',
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it('should refresh with refresh token', async () => {
|
||||
const res = {};
|
||||
await expect(
|
||||
githubAuthenticator.refresh(
|
||||
{
|
||||
refreshToken: 'my-refresh-token',
|
||||
req: {} as any,
|
||||
scope: 'user:read',
|
||||
},
|
||||
{
|
||||
refresh: async _input => res as any,
|
||||
} as PassportOAuthAuthenticatorHelper,
|
||||
),
|
||||
).resolves.toBe(res);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,125 @@
|
||||
/*
|
||||
* Copyright 2023 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import { Strategy as GithubStrategy } from 'passport-github2';
|
||||
import {
|
||||
createOAuthAuthenticator,
|
||||
PassportOAuthAuthenticatorHelper,
|
||||
PassportOAuthDoneCallback,
|
||||
PassportProfile,
|
||||
} from '@backstage/plugin-auth-node';
|
||||
|
||||
const ACCESS_TOKEN_PREFIX = 'access-token.';
|
||||
|
||||
/** @public */
|
||||
export const githubAuthenticator = createOAuthAuthenticator({
|
||||
defaultProfileTransform:
|
||||
PassportOAuthAuthenticatorHelper.defaultProfileTransform,
|
||||
initialize({ callbackUrl, config }) {
|
||||
const clientId = config.getString('clientId');
|
||||
const clientSecret = config.getString('clientSecret');
|
||||
const enterpriseInstanceUrl = config
|
||||
.getOptionalString('enterpriseInstanceUrl')
|
||||
?.replace(/\/$/, '');
|
||||
const authorizationUrl = enterpriseInstanceUrl
|
||||
? `${enterpriseInstanceUrl}/login/oauth/authorize`
|
||||
: undefined;
|
||||
const tokenUrl = enterpriseInstanceUrl
|
||||
? `${enterpriseInstanceUrl}/login/oauth/access_token`
|
||||
: undefined;
|
||||
const userProfileUrl = enterpriseInstanceUrl
|
||||
? `${enterpriseInstanceUrl}/api/v3/user`
|
||||
: undefined;
|
||||
|
||||
return PassportOAuthAuthenticatorHelper.from(
|
||||
new GithubStrategy(
|
||||
{
|
||||
clientID: clientId,
|
||||
clientSecret: clientSecret,
|
||||
callbackURL: callbackUrl,
|
||||
tokenURL: tokenUrl,
|
||||
userProfileURL: userProfileUrl,
|
||||
authorizationURL: authorizationUrl,
|
||||
},
|
||||
(
|
||||
accessToken: string,
|
||||
refreshToken: string,
|
||||
params: any,
|
||||
fullProfile: PassportProfile,
|
||||
done: PassportOAuthDoneCallback,
|
||||
) => {
|
||||
done(
|
||||
undefined,
|
||||
{ fullProfile, params, accessToken },
|
||||
{ refreshToken },
|
||||
);
|
||||
},
|
||||
),
|
||||
);
|
||||
},
|
||||
|
||||
async start(input, helper) {
|
||||
return helper.start(input, {
|
||||
accessType: 'offline',
|
||||
prompt: 'consent',
|
||||
});
|
||||
},
|
||||
|
||||
async authenticate(input, helper) {
|
||||
const { fullProfile, session } = await helper.authenticate(input);
|
||||
|
||||
// If we do not have a real refresh token and we have a non-expiring
|
||||
// access token, then we use that as our refresh token.
|
||||
if (!session.refreshToken && !session.expiresInSeconds) {
|
||||
session.refreshToken = ACCESS_TOKEN_PREFIX + session.accessToken;
|
||||
}
|
||||
return { fullProfile, session };
|
||||
},
|
||||
|
||||
async refresh(input, helper) {
|
||||
// This is the OAuth App flow. A non-expiring access token is stored in the
|
||||
// refresh token cookie. We use that token to fetch the user profile and
|
||||
// refresh the Backstage session when needed.
|
||||
if (input.refreshToken?.startsWith(ACCESS_TOKEN_PREFIX)) {
|
||||
const accessToken = input.refreshToken.slice(ACCESS_TOKEN_PREFIX.length);
|
||||
|
||||
const fullProfile = await helper
|
||||
.fetchProfile(accessToken)
|
||||
.catch(error => {
|
||||
if (error.oauthError?.statusCode === 401) {
|
||||
throw new Error('Invalid access token');
|
||||
}
|
||||
throw error;
|
||||
});
|
||||
|
||||
return {
|
||||
fullProfile,
|
||||
session: {
|
||||
accessToken,
|
||||
tokenType: 'bearer',
|
||||
scope: input.scope,
|
||||
refreshToken: input.refreshToken,
|
||||
// No expiration
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
// This is the App flow, which is close to a standard OAuth refresh flow. It has a
|
||||
// pretty long session expiration, and it also ignores the requested scope, instead
|
||||
// just allowing access to whatever is configured as part of the app installation.
|
||||
return helper.refresh(input);
|
||||
},
|
||||
});
|
||||
@@ -0,0 +1,25 @@
|
||||
/*
|
||||
* Copyright 2023 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
/**
|
||||
* The github-provider backend module for the auth plugin.
|
||||
*
|
||||
* @packageDocumentation
|
||||
*/
|
||||
|
||||
export { githubAuthenticator } from './authenticator';
|
||||
export { authModuleGithubProvider } from './module';
|
||||
export { githubSignInResolvers } from './resolvers';
|
||||
@@ -0,0 +1,78 @@
|
||||
/*
|
||||
* Copyright 2023 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import { mockServices, startTestBackend } from '@backstage/backend-test-utils';
|
||||
import { authPlugin } from '@backstage/plugin-auth-backend';
|
||||
import { authModuleGithubProvider } from './module';
|
||||
import request from 'supertest';
|
||||
import { decodeOAuthState } from '@backstage/plugin-auth-node';
|
||||
|
||||
describe('authModuleGithubProvider', () => {
|
||||
it('should start', async () => {
|
||||
const { server } = await startTestBackend({
|
||||
features: [
|
||||
authPlugin,
|
||||
authModuleGithubProvider,
|
||||
mockServices.rootConfig.factory({
|
||||
data: {
|
||||
app: {
|
||||
baseUrl: 'http://localhost:3000',
|
||||
},
|
||||
auth: {
|
||||
providers: {
|
||||
github: {
|
||||
development: {
|
||||
clientId: 'my-client-id',
|
||||
clientSecret: 'my-client-secret',
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}),
|
||||
],
|
||||
});
|
||||
|
||||
const agent = request.agent(server);
|
||||
|
||||
const res = await agent.get('/api/auth/github/start?env=development');
|
||||
|
||||
expect(res.status).toEqual(302);
|
||||
|
||||
const nonceCookie = agent.jar.getCookie('github-nonce', {
|
||||
domain: 'localhost',
|
||||
path: '/api/auth/github/handler',
|
||||
script: false,
|
||||
secure: false,
|
||||
});
|
||||
expect(nonceCookie).toBeDefined();
|
||||
|
||||
const startUrl = new URL(res.get('location'));
|
||||
expect(startUrl.origin).toBe('https://github.com');
|
||||
expect(startUrl.pathname).toBe('/login/oauth/authorize');
|
||||
expect(Object.fromEntries(startUrl.searchParams)).toEqual({
|
||||
response_type: 'code',
|
||||
client_id: 'my-client-id',
|
||||
redirect_uri: `http://localhost:${server.port()}/api/auth/github/handler/frame`,
|
||||
state: expect.any(String),
|
||||
});
|
||||
|
||||
expect(decodeOAuthState(startUrl.searchParams.get('state')!)).toEqual({
|
||||
env: 'development',
|
||||
nonce: decodeURIComponent(nonceCookie.value),
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,48 @@
|
||||
/*
|
||||
* Copyright 2023 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
import { createBackendModule } from '@backstage/backend-plugin-api';
|
||||
import {
|
||||
authProvidersExtensionPoint,
|
||||
commonSignInResolvers,
|
||||
createOAuthProviderFactory,
|
||||
} from '@backstage/plugin-auth-node';
|
||||
import { githubAuthenticator } from './authenticator';
|
||||
import { githubSignInResolvers } from './resolvers';
|
||||
|
||||
/** @public */
|
||||
export const authModuleGithubProvider = createBackendModule({
|
||||
pluginId: 'auth',
|
||||
moduleId: 'github-provider',
|
||||
register(reg) {
|
||||
reg.registerInit({
|
||||
deps: {
|
||||
providers: authProvidersExtensionPoint,
|
||||
},
|
||||
async init({ providers }) {
|
||||
providers.registerProvider({
|
||||
providerId: 'github',
|
||||
factory: createOAuthProviderFactory({
|
||||
authenticator: githubAuthenticator,
|
||||
signInResolverFactories: {
|
||||
...githubSignInResolvers,
|
||||
...commonSignInResolvers,
|
||||
},
|
||||
}),
|
||||
});
|
||||
},
|
||||
});
|
||||
},
|
||||
});
|
||||
@@ -0,0 +1,50 @@
|
||||
/*
|
||||
* Copyright 2023 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import {
|
||||
createSignInResolverFactory,
|
||||
OAuthAuthenticatorResult,
|
||||
PassportProfile,
|
||||
SignInInfo,
|
||||
} from '@backstage/plugin-auth-node';
|
||||
|
||||
/**
|
||||
* Available sign-in resolvers for the GitHub auth provider.
|
||||
*
|
||||
* @public
|
||||
*/
|
||||
export namespace githubSignInResolvers {
|
||||
/**
|
||||
* Looks up the user by matching their GitHub username to the entity name.
|
||||
*/
|
||||
export const usernameMatchingUserEntityName = createSignInResolverFactory({
|
||||
create() {
|
||||
return async (
|
||||
info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,
|
||||
ctx,
|
||||
) => {
|
||||
const { fullProfile } = info.result;
|
||||
|
||||
const userId = fullProfile.username;
|
||||
if (!userId) {
|
||||
throw new Error(`GitHub user profile does not contain a username`);
|
||||
}
|
||||
|
||||
return ctx.signInWithCatalogUser({ entityRef: { name: userId } });
|
||||
};
|
||||
},
|
||||
});
|
||||
}
|
||||
@@ -478,7 +478,7 @@ export const providers: Readonly<{
|
||||
authHandler?: AuthHandler<GithubOAuthResult> | undefined;
|
||||
signIn?:
|
||||
| {
|
||||
resolver: SignInResolver<GithubOAuthResult>;
|
||||
resolver: SignInResolver_2<GithubOAuthResult>;
|
||||
}
|
||||
| undefined;
|
||||
stateEncoder?: StateEncoder | undefined;
|
||||
@@ -486,7 +486,7 @@ export const providers: Readonly<{
|
||||
| undefined,
|
||||
) => AuthProviderFactory_2;
|
||||
resolvers: Readonly<{
|
||||
usernameMatchingUserEntityName: () => SignInResolver<GithubOAuthResult>;
|
||||
usernameMatchingUserEntityName: () => SignInResolver_2<GithubOAuthResult>;
|
||||
}>;
|
||||
}>;
|
||||
gitlab: Readonly<{
|
||||
|
||||
@@ -39,6 +39,7 @@
|
||||
"@backstage/config": "workspace:^",
|
||||
"@backstage/errors": "workspace:^",
|
||||
"@backstage/plugin-auth-backend-module-gcp-iap-provider": "workspace:^",
|
||||
"@backstage/plugin-auth-backend-module-github-provider": "workspace:^",
|
||||
"@backstage/plugin-auth-backend-module-google-provider": "workspace:^",
|
||||
"@backstage/plugin-auth-node": "workspace:^",
|
||||
"@backstage/plugin-catalog-node": "workspace:^",
|
||||
|
||||
@@ -1,410 +0,0 @@
|
||||
/*
|
||||
* Copyright 2020 The Backstage Authors
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import { Profile as PassportProfile } from 'passport';
|
||||
import { GithubAuthProvider, GithubOAuthResult, github } from './provider';
|
||||
import * as helpers from '../../lib/passport/PassportStrategyHelper';
|
||||
import { makeProfileInfo } from '../../lib/passport/PassportStrategyHelper';
|
||||
import { OAuthStartRequest, encodeState } from '../../lib/oauth';
|
||||
import { AuthResolverContext } from '../types';
|
||||
|
||||
jest.mock('../../lib/passport/PassportStrategyHelper', () => {
|
||||
return {
|
||||
...jest.requireActual('../../lib/passport/PassportStrategyHelper'),
|
||||
executeFrameHandlerStrategy: jest.fn(),
|
||||
executeRefreshTokenStrategy: jest.fn(),
|
||||
executeFetchUserProfileStrategy: jest.fn(),
|
||||
};
|
||||
});
|
||||
|
||||
const mockFrameHandler = jest.spyOn(
|
||||
helpers,
|
||||
'executeFrameHandlerStrategy',
|
||||
) as unknown as jest.MockedFunction<
|
||||
() => Promise<{
|
||||
result: GithubOAuthResult;
|
||||
privateInfo: { refreshToken?: string };
|
||||
}>
|
||||
>;
|
||||
|
||||
describe('GithubAuthProvider', () => {
|
||||
const provider = new GithubAuthProvider({
|
||||
resolverContext: {
|
||||
signInWithCatalogUser: jest.fn(({ entityRef }) => ({
|
||||
token: `token-for-user:${entityRef.name}`,
|
||||
})),
|
||||
} as unknown as AuthResolverContext,
|
||||
signInResolver: github.resolvers.usernameMatchingUserEntityName(),
|
||||
authHandler: async ({ fullProfile }) => ({
|
||||
profile: makeProfileInfo(fullProfile),
|
||||
}),
|
||||
stateEncoder: async (req: OAuthStartRequest) => ({
|
||||
encodedState: encodeState(req.state),
|
||||
}),
|
||||
callbackUrl: 'mock',
|
||||
clientId: 'mock',
|
||||
clientSecret: 'mock',
|
||||
});
|
||||
|
||||
describe('should transform to type OAuthResponse', () => {
|
||||
it('when all fields are present, it should be able to map them', async () => {
|
||||
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
|
||||
const fullProfile = {
|
||||
id: 'uid-123',
|
||||
username: 'jimmymarkum',
|
||||
provider: 'github',
|
||||
displayName: 'Jimmy Markum',
|
||||
emails: [
|
||||
{
|
||||
value: 'jimmymarkum@gmail.com',
|
||||
},
|
||||
],
|
||||
photos: [
|
||||
{
|
||||
value:
|
||||
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
|
||||
},
|
||||
],
|
||||
};
|
||||
|
||||
const params = {
|
||||
scope: 'read:scope',
|
||||
};
|
||||
|
||||
const expected = {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:jimmymarkum',
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken: '19xasczxcm9n7gacn9jdgm19me',
|
||||
scope: 'read:scope',
|
||||
expiresInSeconds: 3600,
|
||||
},
|
||||
profile: {
|
||||
email: 'jimmymarkum@gmail.com',
|
||||
displayName: 'Jimmy Markum',
|
||||
picture:
|
||||
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
|
||||
},
|
||||
};
|
||||
|
||||
mockFrameHandler.mockResolvedValueOnce({
|
||||
result: { fullProfile, accessToken, params },
|
||||
privateInfo: {},
|
||||
});
|
||||
const { response } = await provider.handler({} as any);
|
||||
expect(response).toEqual(expected);
|
||||
});
|
||||
|
||||
it('when "email" is missing, it should be able to create the profile without it', async () => {
|
||||
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
|
||||
const fullProfile = {
|
||||
id: 'uid-123',
|
||||
username: 'jimmymarkum',
|
||||
provider: 'github',
|
||||
displayName: 'Jimmy Markum',
|
||||
emails: null,
|
||||
photos: [
|
||||
{
|
||||
value:
|
||||
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
|
||||
},
|
||||
],
|
||||
} as unknown as PassportProfile;
|
||||
|
||||
const params = {
|
||||
scope: 'read:scope',
|
||||
};
|
||||
|
||||
const expected = {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:jimmymarkum',
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken: '19xasczxcm9n7gacn9jdgm19me',
|
||||
scope: 'read:scope',
|
||||
expiresInSeconds: 3600,
|
||||
},
|
||||
profile: {
|
||||
displayName: 'Jimmy Markum',
|
||||
picture:
|
||||
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
|
||||
},
|
||||
};
|
||||
|
||||
mockFrameHandler.mockResolvedValueOnce({
|
||||
result: { fullProfile, accessToken, params },
|
||||
privateInfo: {},
|
||||
});
|
||||
const { response } = await provider.handler({} as any);
|
||||
expect(response).toEqual(expected);
|
||||
});
|
||||
|
||||
it('when "displayName" is missing, it should be able to create the profile and map "displayName" with "username"', async () => {
|
||||
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
|
||||
const fullProfile = {
|
||||
id: 'uid-123',
|
||||
username: 'jimmymarkum',
|
||||
provider: 'github',
|
||||
displayName: null,
|
||||
emails: null,
|
||||
photos: [
|
||||
{
|
||||
value:
|
||||
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
|
||||
},
|
||||
],
|
||||
} as unknown as PassportProfile;
|
||||
|
||||
const params = {
|
||||
scope: 'read:scope',
|
||||
};
|
||||
const expected = {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:jimmymarkum',
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken: '19xasczxcm9n7gacn9jdgm19me',
|
||||
scope: 'read:scope',
|
||||
expiresInSeconds: 3600,
|
||||
},
|
||||
profile: {
|
||||
displayName: 'jimmymarkum',
|
||||
picture:
|
||||
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
|
||||
},
|
||||
};
|
||||
|
||||
mockFrameHandler.mockResolvedValueOnce({
|
||||
result: { fullProfile, accessToken, params },
|
||||
privateInfo: {},
|
||||
});
|
||||
const { response } = await provider.handler({} as any);
|
||||
expect(response).toEqual(expected);
|
||||
});
|
||||
|
||||
it('when "photos" is missing, it should be able to create the profile without it', async () => {
|
||||
const accessToken =
|
||||
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe';
|
||||
const fullProfile = {
|
||||
id: 'ipd12039',
|
||||
username: 'daveboyle',
|
||||
provider: 'github',
|
||||
displayName: 'Dave Boyle',
|
||||
emails: [
|
||||
{
|
||||
value: 'daveboyle@github.org',
|
||||
},
|
||||
],
|
||||
};
|
||||
|
||||
const params = {
|
||||
scope: 'read:user',
|
||||
};
|
||||
|
||||
const expected = {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:daveboyle',
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken:
|
||||
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe',
|
||||
scope: 'read:user',
|
||||
expiresInSeconds: 3600,
|
||||
},
|
||||
profile: {
|
||||
displayName: 'Dave Boyle',
|
||||
email: 'daveboyle@github.org',
|
||||
},
|
||||
};
|
||||
|
||||
mockFrameHandler.mockResolvedValueOnce({
|
||||
result: { fullProfile, accessToken, params },
|
||||
privateInfo: {},
|
||||
});
|
||||
const { response } = await provider.handler({} as any);
|
||||
expect(response).toEqual(expected);
|
||||
});
|
||||
|
||||
it('should forward a refresh token', async () => {
|
||||
mockFrameHandler.mockResolvedValueOnce({
|
||||
result: {
|
||||
fullProfile: {
|
||||
id: 'ipd12039',
|
||||
username: 'daveboyle',
|
||||
provider: 'github',
|
||||
displayName: 'Dave Boyle',
|
||||
},
|
||||
accessToken: 'a.b.c',
|
||||
params: {
|
||||
scope: 'read:user',
|
||||
expires_in: '123',
|
||||
},
|
||||
},
|
||||
privateInfo: { refreshToken: 'refresh-me' },
|
||||
});
|
||||
|
||||
const response = await provider.handler({} as any);
|
||||
|
||||
expect(response).toEqual({
|
||||
response: {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:daveboyle',
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken: 'a.b.c',
|
||||
scope: 'read:user',
|
||||
expiresInSeconds: 123,
|
||||
},
|
||||
profile: {
|
||||
displayName: 'Dave Boyle',
|
||||
},
|
||||
},
|
||||
refreshToken: 'refresh-me',
|
||||
});
|
||||
});
|
||||
|
||||
it('should fail if username is not available', async () => {
|
||||
mockFrameHandler.mockResolvedValueOnce({
|
||||
result: {
|
||||
fullProfile: {
|
||||
id: 'ipd12039',
|
||||
provider: 'github',
|
||||
displayName: 'Dave Boyle',
|
||||
},
|
||||
accessToken: 'a.b.c',
|
||||
params: {
|
||||
scope: 'read:user',
|
||||
expires_in: '123',
|
||||
},
|
||||
},
|
||||
privateInfo: { refreshToken: 'refresh-me' },
|
||||
});
|
||||
|
||||
await expect(provider.handler({} as any)).rejects.toThrow(
|
||||
'GitHub user profile does not contain a username',
|
||||
);
|
||||
});
|
||||
|
||||
it('should forward a new refresh token on refresh', async () => {
|
||||
const mockRefreshToken = jest.spyOn(
|
||||
helpers,
|
||||
'executeRefreshTokenStrategy',
|
||||
) as unknown as jest.MockedFunction<() => Promise<{}>>;
|
||||
|
||||
mockRefreshToken.mockResolvedValueOnce({
|
||||
accessToken: 'a.b.c',
|
||||
refreshToken: 'dont-forget-to-send-refresh',
|
||||
params: {
|
||||
id_token: 'my-id',
|
||||
expires_in: '123',
|
||||
scope: 'read_user',
|
||||
},
|
||||
});
|
||||
|
||||
const mockUserProfile = jest.spyOn(
|
||||
helpers,
|
||||
'executeFetchUserProfileStrategy',
|
||||
) as unknown as jest.MockedFunction<() => Promise<PassportProfile>>;
|
||||
|
||||
mockUserProfile.mockResolvedValueOnce({
|
||||
id: 'mockid',
|
||||
username: 'mockuser',
|
||||
provider: 'github',
|
||||
displayName: 'Mocked User',
|
||||
emails: [
|
||||
{
|
||||
value: 'mockuser@gmail.com',
|
||||
},
|
||||
],
|
||||
});
|
||||
|
||||
const result = await provider.refresh({ scope: 'actual-scope' } as any);
|
||||
|
||||
expect(result).toEqual({
|
||||
response: {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:mockuser',
|
||||
},
|
||||
profile: {
|
||||
displayName: 'Mocked User',
|
||||
email: 'mockuser@gmail.com',
|
||||
picture: undefined,
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken: 'a.b.c',
|
||||
expiresInSeconds: 123,
|
||||
scope: 'actual-scope',
|
||||
},
|
||||
},
|
||||
refreshToken: 'dont-forget-to-send-refresh',
|
||||
});
|
||||
|
||||
mockRefreshToken.mockRestore();
|
||||
mockUserProfile.mockRestore();
|
||||
});
|
||||
|
||||
it('should use access token as refresh token', async () => {
|
||||
const mockUserProfile = jest.spyOn(
|
||||
helpers,
|
||||
'executeFetchUserProfileStrategy',
|
||||
) as unknown as jest.MockedFunction<() => Promise<PassportProfile>>;
|
||||
|
||||
mockUserProfile.mockResolvedValueOnce({
|
||||
id: 'mockid',
|
||||
username: 'mockuser',
|
||||
provider: 'github',
|
||||
displayName: 'Mocked User',
|
||||
emails: [
|
||||
{
|
||||
value: 'mockuser@gmail.com',
|
||||
},
|
||||
],
|
||||
});
|
||||
|
||||
const result = await provider.refresh({
|
||||
refreshToken: 'access-token.le-token',
|
||||
scope: 'the-scope',
|
||||
} as any);
|
||||
|
||||
expect(mockUserProfile).toHaveBeenCalledTimes(1);
|
||||
expect(mockUserProfile).toHaveBeenCalledWith(
|
||||
expect.anything(),
|
||||
'le-token',
|
||||
);
|
||||
expect(result).toEqual({
|
||||
response: {
|
||||
backstageIdentity: {
|
||||
token: 'token-for-user:mockuser',
|
||||
},
|
||||
profile: {
|
||||
displayName: 'Mocked User',
|
||||
email: 'mockuser@gmail.com',
|
||||
picture: undefined,
|
||||
},
|
||||
providerInfo: {
|
||||
accessToken: 'le-token',
|
||||
expiresInSeconds: 3600,
|
||||
scope: 'the-scope',
|
||||
},
|
||||
},
|
||||
refreshToken: 'access-token.le-token',
|
||||
});
|
||||
|
||||
mockUserProfile.mockRestore();
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -14,41 +14,16 @@
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import express from 'express';
|
||||
import { Profile as PassportProfile } from 'passport';
|
||||
import { Strategy as GithubStrategy } from 'passport-github2';
|
||||
import {
|
||||
executeFetchUserProfileStrategy,
|
||||
executeFrameHandlerStrategy,
|
||||
executeRedirectStrategy,
|
||||
executeRefreshTokenStrategy,
|
||||
makeProfileInfo,
|
||||
PassportDoneCallback,
|
||||
} from '../../lib/passport';
|
||||
import {
|
||||
OAuthStartResponse,
|
||||
AuthHandler,
|
||||
SignInResolver,
|
||||
StateEncoder,
|
||||
AuthResolverContext,
|
||||
} from '../types';
|
||||
import {
|
||||
OAuthAdapter,
|
||||
OAuthProviderOptions,
|
||||
OAuthHandlers,
|
||||
OAuthEnvironmentHandler,
|
||||
OAuthStartRequest,
|
||||
encodeState,
|
||||
OAuthRefreshRequest,
|
||||
} from '../../lib/oauth';
|
||||
import { AuthHandler, StateEncoder } from '../types';
|
||||
import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
|
||||
import { BACKSTAGE_SESSION_EXPIRATION } from '../../lib/session';
|
||||
|
||||
const ACCESS_TOKEN_PREFIX = 'access-token.';
|
||||
|
||||
type PrivateInfo = {
|
||||
refreshToken?: string;
|
||||
};
|
||||
import {
|
||||
createOAuthProviderFactory,
|
||||
OAuthAuthenticatorResult,
|
||||
ProfileTransform,
|
||||
SignInResolver,
|
||||
} from '@backstage/plugin-auth-node';
|
||||
import { githubAuthenticator } from '@backstage/plugin-auth-backend-module-github-provider';
|
||||
|
||||
/** @public */
|
||||
export type GithubOAuthResult = {
|
||||
@@ -62,170 +37,6 @@ export type GithubOAuthResult = {
|
||||
refreshToken?: string;
|
||||
};
|
||||
|
||||
export type GithubAuthProviderOptions = OAuthProviderOptions & {
|
||||
tokenUrl?: string;
|
||||
userProfileUrl?: string;
|
||||
authorizationUrl?: string;
|
||||
signInResolver?: SignInResolver<GithubOAuthResult>;
|
||||
authHandler: AuthHandler<GithubOAuthResult>;
|
||||
stateEncoder: StateEncoder;
|
||||
resolverContext: AuthResolverContext;
|
||||
};
|
||||
|
||||
export class GithubAuthProvider implements OAuthHandlers {
|
||||
private readonly _strategy: GithubStrategy;
|
||||
private readonly signInResolver?: SignInResolver<GithubOAuthResult>;
|
||||
private readonly authHandler: AuthHandler<GithubOAuthResult>;
|
||||
private readonly resolverContext: AuthResolverContext;
|
||||
private readonly stateEncoder: StateEncoder;
|
||||
|
||||
constructor(options: GithubAuthProviderOptions) {
|
||||
this.signInResolver = options.signInResolver;
|
||||
this.authHandler = options.authHandler;
|
||||
this.stateEncoder = options.stateEncoder;
|
||||
this.resolverContext = options.resolverContext;
|
||||
this._strategy = new GithubStrategy(
|
||||
{
|
||||
clientID: options.clientId,
|
||||
clientSecret: options.clientSecret,
|
||||
callbackURL: options.callbackUrl,
|
||||
tokenURL: options.tokenUrl,
|
||||
userProfileURL: options.userProfileUrl,
|
||||
authorizationURL: options.authorizationUrl,
|
||||
},
|
||||
(
|
||||
accessToken: any,
|
||||
refreshToken: any,
|
||||
params: any,
|
||||
fullProfile: any,
|
||||
done: PassportDoneCallback<GithubOAuthResult, PrivateInfo>,
|
||||
) => {
|
||||
done(undefined, { fullProfile, params, accessToken }, { refreshToken });
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
async start(req: OAuthStartRequest): Promise<OAuthStartResponse> {
|
||||
return await executeRedirectStrategy(req, this._strategy, {
|
||||
scope: req.scope,
|
||||
state: (await this.stateEncoder(req)).encodedState,
|
||||
});
|
||||
}
|
||||
|
||||
async handler(req: express.Request) {
|
||||
const { result, privateInfo } = await executeFrameHandlerStrategy<
|
||||
GithubOAuthResult,
|
||||
PrivateInfo
|
||||
>(req, this._strategy);
|
||||
|
||||
let refreshToken = privateInfo.refreshToken;
|
||||
|
||||
// If we do not have a real refresh token and we have a non-expiring
|
||||
// access token, then we use that as our refresh token.
|
||||
if (!refreshToken && !result.params.expires_in) {
|
||||
refreshToken = ACCESS_TOKEN_PREFIX + result.accessToken;
|
||||
}
|
||||
|
||||
return {
|
||||
response: await this.handleResult(result),
|
||||
refreshToken,
|
||||
};
|
||||
}
|
||||
|
||||
async refresh(req: OAuthRefreshRequest) {
|
||||
// We've enable persisting scope in the OAuth provider, so scope here will
|
||||
// be whatever was stored in the cookie
|
||||
const { scope, refreshToken } = req;
|
||||
|
||||
// This is the OAuth App flow. A non-expiring access token is stored in the
|
||||
// refresh token cookie. We use that token to fetch the user profile and
|
||||
// refresh the Backstage session when needed.
|
||||
if (refreshToken?.startsWith(ACCESS_TOKEN_PREFIX)) {
|
||||
const accessToken = refreshToken.slice(ACCESS_TOKEN_PREFIX.length);
|
||||
|
||||
const fullProfile = await executeFetchUserProfileStrategy(
|
||||
this._strategy,
|
||||
accessToken,
|
||||
).catch(error => {
|
||||
if (error.oauthError?.statusCode === 401) {
|
||||
throw new Error('Invalid access token');
|
||||
}
|
||||
throw error;
|
||||
});
|
||||
|
||||
return {
|
||||
response: await this.handleResult({
|
||||
fullProfile,
|
||||
params: { scope },
|
||||
accessToken,
|
||||
}),
|
||||
refreshToken,
|
||||
};
|
||||
}
|
||||
|
||||
// This is the App flow, which is close to a standard OAuth refresh flow. It has a
|
||||
// pretty long session expiration, and it also ignores the requested scope, instead
|
||||
// just allowing access to whatever is configured as part of the app installation.
|
||||
const result = await executeRefreshTokenStrategy(
|
||||
this._strategy,
|
||||
refreshToken,
|
||||
scope,
|
||||
);
|
||||
return {
|
||||
response: await this.handleResult({
|
||||
fullProfile: await executeFetchUserProfileStrategy(
|
||||
this._strategy,
|
||||
result.accessToken,
|
||||
),
|
||||
params: { ...result.params, scope },
|
||||
accessToken: result.accessToken,
|
||||
}),
|
||||
refreshToken: result.refreshToken,
|
||||
};
|
||||
}
|
||||
|
||||
private async handleResult(result: GithubOAuthResult) {
|
||||
const { profile } = await this.authHandler(result, this.resolverContext);
|
||||
|
||||
const expiresInStr = result.params.expires_in;
|
||||
let expiresInSeconds =
|
||||
expiresInStr === undefined ? undefined : Number(expiresInStr);
|
||||
|
||||
let backstageIdentity = undefined;
|
||||
|
||||
if (this.signInResolver) {
|
||||
backstageIdentity = await this.signInResolver(
|
||||
{
|
||||
result,
|
||||
profile,
|
||||
},
|
||||
this.resolverContext,
|
||||
);
|
||||
|
||||
// GitHub sessions last longer than Backstage sessions, so if we're using
|
||||
// GitHub for sign-in, then we need to expire the sessions earlier
|
||||
if (expiresInSeconds) {
|
||||
expiresInSeconds = Math.min(
|
||||
expiresInSeconds,
|
||||
BACKSTAGE_SESSION_EXPIRATION,
|
||||
);
|
||||
} else {
|
||||
expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION;
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
backstageIdentity,
|
||||
providerInfo: {
|
||||
accessToken: result.accessToken,
|
||||
scope: result.params.scope,
|
||||
expiresInSeconds,
|
||||
},
|
||||
profile,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Auth provider integration for GitHub auth
|
||||
*
|
||||
@@ -267,60 +78,55 @@ export const github = createAuthProviderIntegration({
|
||||
*/
|
||||
stateEncoder?: StateEncoder;
|
||||
}) {
|
||||
return ({ providerId, globalConfig, config, resolverContext }) =>
|
||||
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
|
||||
const clientId = envConfig.getString('clientId');
|
||||
const clientSecret = envConfig.getString('clientSecret');
|
||||
const enterpriseInstanceUrl = envConfig
|
||||
.getOptionalString('enterpriseInstanceUrl')
|
||||
?.replace(/\/$/, '');
|
||||
const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
|
||||
const authorizationUrl = enterpriseInstanceUrl
|
||||
? `${enterpriseInstanceUrl}/login/oauth/authorize`
|
||||
: undefined;
|
||||
const tokenUrl = enterpriseInstanceUrl
|
||||
? `${enterpriseInstanceUrl}/login/oauth/access_token`
|
||||
: undefined;
|
||||
const userProfileUrl = enterpriseInstanceUrl
|
||||
? `${enterpriseInstanceUrl}/api/v3/user`
|
||||
: undefined;
|
||||
const callbackUrl =
|
||||
customCallbackUrl ||
|
||||
`${globalConfig.baseUrl}/${providerId}/handler/frame`;
|
||||
|
||||
const authHandler: AuthHandler<GithubOAuthResult> = options?.authHandler
|
||||
? options.authHandler
|
||||
: async ({ fullProfile }) => ({
|
||||
profile: makeProfileInfo(fullProfile),
|
||||
});
|
||||
|
||||
const stateEncoder: StateEncoder =
|
||||
options?.stateEncoder ??
|
||||
(async (
|
||||
req: OAuthStartRequest,
|
||||
): Promise<{ encodedState: string }> => {
|
||||
return { encodedState: encodeState(req.state) };
|
||||
});
|
||||
|
||||
const provider = new GithubAuthProvider({
|
||||
clientId,
|
||||
clientSecret,
|
||||
callbackUrl,
|
||||
tokenUrl,
|
||||
userProfileUrl,
|
||||
authorizationUrl,
|
||||
signInResolver: options?.signIn?.resolver,
|
||||
authHandler,
|
||||
stateEncoder,
|
||||
resolverContext,
|
||||
});
|
||||
|
||||
return OAuthAdapter.fromConfig(globalConfig, provider, {
|
||||
persistScopes: true,
|
||||
providerId,
|
||||
callbackUrl,
|
||||
});
|
||||
});
|
||||
const authHandler = options?.authHandler;
|
||||
const signInResolver = options?.signIn?.resolver;
|
||||
return createOAuthProviderFactory({
|
||||
authenticator: githubAuthenticator,
|
||||
profileTransform:
|
||||
authHandler &&
|
||||
((async (result, ctx) =>
|
||||
authHandler!(
|
||||
{
|
||||
fullProfile: result.fullProfile,
|
||||
accessToken: result.session.accessToken,
|
||||
params: {
|
||||
scope: result.session.scope,
|
||||
expires_in: result.session.expiresInSeconds
|
||||
? String(result.session.expiresInSeconds)
|
||||
: '',
|
||||
refresh_token_expires_in: result.session
|
||||
.refreshTokenExpiresInSeconds
|
||||
? String(result.session.refreshTokenExpiresInSeconds)
|
||||
: '',
|
||||
},
|
||||
},
|
||||
ctx,
|
||||
)) as ProfileTransform<OAuthAuthenticatorResult<PassportProfile>>),
|
||||
signInResolver:
|
||||
signInResolver &&
|
||||
((async ({ profile, result }, ctx) =>
|
||||
signInResolver(
|
||||
{
|
||||
profile: profile,
|
||||
result: {
|
||||
fullProfile: result.fullProfile,
|
||||
accessToken: result.session.accessToken,
|
||||
refreshToken: result.session.refreshToken,
|
||||
params: {
|
||||
scope: result.session.scope,
|
||||
expires_in: result.session.expiresInSeconds
|
||||
? String(result.session.expiresInSeconds)
|
||||
: '',
|
||||
refresh_token_expires_in: result.session
|
||||
.refreshTokenExpiresInSeconds
|
||||
? String(result.session.refreshTokenExpiresInSeconds)
|
||||
: '',
|
||||
},
|
||||
},
|
||||
},
|
||||
ctx,
|
||||
)) as SignInResolver<OAuthAuthenticatorResult<PassportProfile>>),
|
||||
});
|
||||
},
|
||||
resolvers: {
|
||||
/**
|
||||
|
||||
@@ -384,6 +384,8 @@ export interface OAuthSession {
|
||||
// (undocumented)
|
||||
refreshToken?: string;
|
||||
// (undocumented)
|
||||
refreshTokenExpiresInSeconds?: number;
|
||||
// (undocumented)
|
||||
scope: string;
|
||||
// (undocumented)
|
||||
tokenType: string;
|
||||
|
||||
@@ -26,6 +26,7 @@ export interface OAuthSession {
|
||||
scope: string;
|
||||
expiresInSeconds?: number;
|
||||
refreshToken?: string;
|
||||
refreshTokenExpiresInSeconds?: number;
|
||||
}
|
||||
|
||||
/** @public */
|
||||
|
||||
@@ -4553,6 +4553,22 @@ __metadata:
|
||||
languageName: unknown
|
||||
linkType: soft
|
||||
|
||||
"@backstage/plugin-auth-backend-module-github-provider@workspace:^, @backstage/plugin-auth-backend-module-github-provider@workspace:plugins/auth-backend-module-github-provider":
|
||||
version: 0.0.0-use.local
|
||||
resolution: "@backstage/plugin-auth-backend-module-github-provider@workspace:plugins/auth-backend-module-github-provider"
|
||||
dependencies:
|
||||
"@backstage/backend-common": "workspace:^"
|
||||
"@backstage/backend-defaults": "workspace:^"
|
||||
"@backstage/backend-plugin-api": "workspace:^"
|
||||
"@backstage/backend-test-utils": "workspace:^"
|
||||
"@backstage/cli": "workspace:^"
|
||||
"@backstage/plugin-auth-backend": "workspace:^"
|
||||
"@backstage/plugin-auth-node": "workspace:^"
|
||||
passport-github2: ^0.1.12
|
||||
supertest: ^6.3.3
|
||||
languageName: unknown
|
||||
linkType: soft
|
||||
|
||||
"@backstage/plugin-auth-backend-module-google-provider@workspace:^, @backstage/plugin-auth-backend-module-google-provider@workspace:plugins/auth-backend-module-google-provider":
|
||||
version: 0.0.0-use.local
|
||||
resolution: "@backstage/plugin-auth-backend-module-google-provider@workspace:plugins/auth-backend-module-google-provider"
|
||||
@@ -4584,6 +4600,7 @@ __metadata:
|
||||
"@backstage/config": "workspace:^"
|
||||
"@backstage/errors": "workspace:^"
|
||||
"@backstage/plugin-auth-backend-module-gcp-iap-provider": "workspace:^"
|
||||
"@backstage/plugin-auth-backend-module-github-provider": "workspace:^"
|
||||
"@backstage/plugin-auth-backend-module-google-provider": "workspace:^"
|
||||
"@backstage/plugin-auth-node": "workspace:^"
|
||||
"@backstage/plugin-catalog-node": "workspace:^"
|
||||
|
||||
Reference in New Issue
Block a user