core-app-api: fix immediate sign-in on sign-out

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

.changeset/thirty-paws-hope.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-app-api': patch
+---
+
+The request to delete the session cookie when running the app in protected mode is now done with a plain `fetch` rather than `FetchApi`. This fixes a bug where the app would immediately try to sign-in again when removing the cookie during logout.

packages/core-app-api/src/apis/implementations/IdentityApi/AppIdentityProxy.ts

@@ -153,8 +153,9 @@ export class AppIdentityProxy implements IdentityApi {
       // It is fine if we do NOT worry yet about deleting cookies for OTHER backends like techdocs
       const appBaseUrl = await ctx.discoveryApi.getBaseUrl('app');
       try {
-        await ctx.fetchApi.fetch(`${appBaseUrl}/.backstage/auth/v1/cookie`, {
+        await fetch(`${appBaseUrl}/.backstage/auth/v1/cookie`, {
           method: 'DELETE',
+          credentials: 'include',
         });
       } catch {
         // Ignore the error for those who use static serving of the frontend

packages/core-app-api/src/app/AppManager.test.tsx

@@ -19,9 +19,12 @@ import {
   MockAnalyticsApi,
   renderWithEffects,
   withLogCollector,
+  registerMswTestHooks,
 } from '@backstage/test-utils';
-import { screen, waitFor, act } from '@testing-library/react';
+import { screen, act } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
+import { setupServer } from 'msw/node';
+import { rest } from 'msw';
 import React, { PropsWithChildren, ReactNode } from 'react';
 import { BrowserRouter, Navigate, Route, Routes } from 'react-router-dom';
 import {
@@ -51,6 +54,9 @@ import {
 } from '@backstage/core-plugin-api/alpha';
 
 describe('Integration Test', () => {
+  const server = setupServer();
+  registerMswTestHooks(server);
+
   const noOpAnalyticsApi = createApiFactory(
     analyticsApiRef,
     new NoOpAnalyticsApi(),
@@ -847,6 +853,17 @@ describe('Integration Test', () => {
   });
 
   it('should clear app cookie when the user logs out', async () => {
+    const logoutSignal = jest.fn();
+    server.use(
+      rest.delete(
+        'http://localhost:7007/app/.backstage/auth/v1/cookie',
+        (_req, res, ctx) => {
+          logoutSignal();
+          return res(ctx.status(200));
+        },
+      ),
+    );
+
     const meta = global.document.createElement('meta');
     meta.name = 'backstage-app-mode';
     meta.content = 'protected';
@@ -901,12 +918,7 @@ describe('Integration Test', () => {
       await userEvent.click(screen.getByText('Sign Out'));
     });
 
-    await waitFor(() =>
-      expect(fetchApiMock.fetch).toHaveBeenCalledWith(
-        'http://localhost:7007/app/.backstage/auth/v1/cookie',
-        { method: 'DELETE' },
-      ),
-    );
+    expect(logoutSignal).toHaveBeenCalled();
 
     global.document.head.removeChild(meta);
   });