Move auth token to contrib

plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts

@@ -160,7 +160,7 @@ describe('OAuthAdapter', () => {
     expect(mockResponse.cookie).toHaveBeenCalledTimes(0);
   });
 
-  it('removes access and refresh cookies when logging out', async () => {
+  it('removes refresh cookie when logging out', async () => {
     const oauthProvider = new OAuthAdapter(providerInstance, {
       ...oAuthProviderOptions,
       disableRefresh: false,
@@ -176,12 +176,7 @@ describe('OAuthAdapter', () => {
     } as unknown) as express.Response;
 
     await oauthProvider.logout(mockRequest, mockResponse);
-    expect(mockResponse.cookie).toHaveBeenCalledTimes(2);
-    expect(mockResponse.cookie).toHaveBeenCalledWith(
-      expect.stringContaining('access-token'),
-      '',
-      expect.objectContaining({ path: '/api' }),
-    );
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
     expect(mockResponse.cookie).toHaveBeenCalledWith(
       expect.stringContaining('test-provider-refresh-token'),
       '',

plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts

@@ -16,7 +16,6 @@
 
 import express from 'express';
 import crypto from 'crypto';
-import { JWT } from 'jose';
 import { URL } from 'url';
 import {
   AuthProviderRouteHandlers,
@@ -128,9 +127,6 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
       }
 
       await this.populateIdentity(response.backstageIdentity);
-      if (response.backstageIdentity?.idToken) {
-        this.setAccessTokenCookie(res, response.backstageIdentity?.idToken);
-      }
 
       // post message back to popup if successful
       return postMessageResponse(res, this.options.appOrigin, {
@@ -155,7 +151,6 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
       return;
     }
 
-    this.removeAccessTokenCookie(res);
     if (!this.options.disableRefresh) {
       // remove refresh token cookie before logout
       this.removeRefreshTokenCookie(res);
@@ -195,9 +190,6 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
       );
 
       await this.populateIdentity(response.backstageIdentity);
-      if (response.backstageIdentity?.idToken) {
-        this.setAccessTokenCookie(res, response.backstageIdentity?.idToken);
-      }
 
       if (
         response.providerInfo.refreshToken &&
@@ -254,27 +246,6 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
     return req.cookies[`${providerId}-scope`];
   };
 
-  private setAccessTokenCookie = (
-    res: express.Response,
-    accessToken: string,
-  ) => {
-    try {
-      const payload = JWT.decode(accessToken) as object & {
-        exp: number;
-      };
-      res.cookie(`access-token`, accessToken, {
-        expires: new Date(payload?.exp ? payload?.exp * 1000 : 0),
-        secure: this.options.secure,
-        sameSite: 'lax',
-        domain: this.options.cookieDomain,
-        path: '/api',
-        httpOnly: true,
-      });
-    } catch (_err) {
-      // Ignore
-    }
-  };
-
   private setRefreshTokenCookie = (
     res: express.Response,
     refreshToken: string,
@@ -289,17 +260,6 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
     });
   };
 
-  private removeAccessTokenCookie = (res: express.Response) => {
-    res.cookie(`access-token`, '', {
-      maxAge: 0,
-      secure: this.options.secure,
-      sameSite: 'lax',
-      domain: this.options.cookieDomain,
-      path: '/api',
-      httpOnly: true,
-    });
-  };
-
   private removeRefreshTokenCookie = (res: express.Response) => {
     res.cookie(`${this.options.providerId}-refresh-token`, '', {
       maxAge: 0,

plugins/techdocs-backend/src/service/router.ts

@@ -82,9 +82,7 @@ export async function createRouter({
     const { kind, namespace, name } = req.params;
 
     try {
-      const token =
-        getBearerToken(req.headers.authorization) ||
-        req.cookies['access-token'];
+      const token = getBearerToken(req.headers.authorization);
       const entity = (await (
         await fetch(
           `${catalogUrl}/entities/by-name/${kind}/${namespace}/${name}`,
@@ -115,8 +113,7 @@ export async function createRouter({
     const catalogUrl = await discovery.getBaseUrl('catalog');
     const triple = [kind, namespace, name].map(encodeURIComponent).join('/');
 
-    const token =
-      getBearerToken(req.headers.authorization) || req.cookies['access-token'];
+    const token = getBearerToken(req.headers.authorization);
     const catalogRes = await fetch(`${catalogUrl}/entities/by-name/${triple}`, {
       headers: token ? { Authorization: `Bearer ${token}` } : {},
     });
@@ -214,5 +211,5 @@ export async function createRouter({
 }
 
 function getBearerToken(header?: string): string | undefined {
-  return header?.match(/(?:Bearer|Basic)\s+(\S+)/i)?.[1];
+  return header?.match(/(?:Bearer)\s+(\S+)/i)?.[1];
 }

plugins/techdocs/src/api.ts

@@ -171,6 +171,7 @@ export class TechDocsStorageApi implements TechDocsStorage {
     const request = await fetch(
       `${url.endsWith('/') ? url : `${url}/`}index.html`,
       {
+        credentials: 'include',
         headers: token ? { Authorization: `Bearer ${token}` } : {},
       },
     );