support scope and scopes in config

Signed-off-by: Spencer Post <spencer.post@guildeducation.com>

app-config.yaml

@@ -396,7 +396,7 @@ auth:
       development:
         clientId: ${AUTH_ATLASSIAN_CLIENT_ID}
         clientSecret: ${AUTH_ATLASSIAN_CLIENT_SECRET}
-        scopes: ${AUTH_ATLASSIAN_SCOPES}
+        scope: ${AUTH_ATLASSIAN_SCOPES}
     myproxy: {}
     guest: {}
 

plugins/auth-backend-module-atlassian-provider/src/authenticator.ts

@@ -30,7 +30,8 @@ export const atlassianAuthenticator = createOAuthAuthenticator({
     const clientId = config.getString('clientId');
     const clientSecret = config.getString('clientSecret');
     const scope =
-      config.getOptionalString('scope') ||
+      config.getOptionalString('scope') ??
+      config.getOptionalString('scopes') ??
       'offline_access read:jira-work read:jira-user';
     const baseUrl = 'https://auth.atlassian.com';
 

plugins/auth-backend-module-atlassian-provider/src/module.test.ts

@@ -75,7 +75,7 @@ describe('authModuleAtlassianProvider', () => {
       nonce: decodeURIComponent(nonceCookie.value),
     });
   });
-  it('should start with and use custom scopes', async () => {
+  it('should start with and use custom scopes from scope config field', async () => {
     const { server } = await startTestBackend({
       features: [
         import('@backstage/plugin-auth-backend'),
@@ -126,6 +126,62 @@ describe('authModuleAtlassianProvider', () => {
       scope: 'offline_access read:filter:jira read:jira-work',
     });
 
+    expect(decodeOAuthState(startUrl.searchParams.get('state')!)).toEqual({
+      env: 'development',
+      nonce: decodeURIComponent(nonceCookie.value),
+    });
+  });
+  it('should start with and use custom scopes from scopes config field for backward compatibility', async () => {
+    const { server } = await startTestBackend({
+      features: [
+        import('@backstage/plugin-auth-backend'),
+        authModuleAtlassianProvider,
+        mockServices.rootConfig.factory({
+          data: {
+            app: {
+              baseUrl: 'http://localhost:3000',
+            },
+            auth: {
+              providers: {
+                atlassian: {
+                  development: {
+                    clientId: 'my-client-id',
+                    clientSecret: 'my-client-secret',
+                    scopes: 'offline_access read:filter:jira read:jira-work',
+                  },
+                },
+              },
+            },
+          },
+        }),
+      ],
+    });
+
+    const agent = request.agent(server);
+
+    const res = await agent.get('/api/auth/atlassian/start?env=development');
+
+    expect(res.status).toEqual(302);
+
+    const nonceCookie = agent.jar.getCookie('atlassian-nonce', {
+      domain: 'localhost',
+      path: '/api/auth/atlassian/handler',
+      script: false,
+      secure: false,
+    });
+    expect(nonceCookie).toBeDefined();
+
+    const startUrl = new URL(res.get('location'));
+    expect(startUrl.origin).toBe('https://auth.atlassian.com');
+    expect(startUrl.pathname).toBe('/authorize');
+    expect(Object.fromEntries(startUrl.searchParams)).toEqual({
+      response_type: 'code',
+      client_id: 'my-client-id',
+      redirect_uri: `http://localhost:${server.port()}/api/auth/atlassian/handler/frame`,
+      state: expect.any(String),
+      scope: 'offline_access read:filter:jira read:jira-work',
+    });
+
     expect(decodeOAuthState(startUrl.searchParams.get('state')!)).toEqual({
       env: 'development',
       nonce: decodeURIComponent(nonceCookie.value),