From 9ad307a07cd7df4c7f90c5ee1de583c104e42eaa Mon Sep 17 00:00:00 2001
From: Leonardo Cardoso de Almeida <leozzito@Leonardos-MacBook-Pro.local>
Date: Thu, 29 Sep 2022 11:31:12 -0300
Subject: [PATCH] feat: add connection/connection scope options to auth0
 provider

Signed-off-by: Leonardo Cardoso de Almeida <leozzito@Leonardos-MacBook-Pro.local>
---
 docs/auth/auth0/provider.md                        |  8 ++++++++
 .../auth-backend/src/providers/auth0/provider.ts   | 14 ++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/docs/auth/auth0/provider.md b/docs/auth/auth0/provider.md
index 1bfa333191..6d041647f3 100644
--- a/docs/auth/auth0/provider.md
+++ b/docs/auth/auth0/provider.md
@@ -35,6 +35,8 @@ auth:
         clientSecret: ${AUTH_AUTH0_CLIENT_SECRET}
         domain: ${AUTH_AUTH0_DOMAIN_ID}
         audience: ${AUTH_AUTH0_AUDIENCE}
+        connection: ${AUTH_AUTH0_CONNECTION}
+        connectionScope: ${AUTH_AUTH0_CONNECTION_SCOPE}
 ```
 
 The Auth0 provider is a structure with three configuration keys:
@@ -44,6 +46,12 @@ The Auth0 provider is a structure with three configuration keys:
   page
 - `domain`: The Application domain, found on the Auth0 Application page
 
+## Optional Configuration
+
+- `audience`: The intended recipients of the token
+- `connection`: Social identity provider name
+- `connectionScope`: Additional scopes in the interactive token request. It should always be used in combination with the `connection` parameter
+
 ## Adding the provider to the Backstage frontend
 
 To add the provider to the frontend, add the `auth0AuthApi` reference and
diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts
index 309fb0fc7b..fe45b63b98 100644
--- a/plugins/auth-backend/src/providers/auth0/provider.ts
+++ b/plugins/auth-backend/src/providers/auth0/provider.ts
@@ -55,6 +55,8 @@ export type Auth0AuthProviderOptions = OAuthProviderOptions & {
   authHandler: AuthHandler<OAuthResult>;
   resolverContext: AuthResolverContext;
   audience?: string;
+  connection?: string;
+  connectionScope?: string;
 };
 
 export class Auth0AuthProvider implements OAuthHandlers {
@@ -63,6 +65,8 @@ export class Auth0AuthProvider implements OAuthHandlers {
   private readonly authHandler: AuthHandler<OAuthResult>;
   private readonly resolverContext: AuthResolverContext;
   private readonly audience?: string;
+  private readonly connection?: string;
+  private readonly connectionScope?: string;
 
   /**
    * Due to passport-auth0 forcing options.state = true,
@@ -86,6 +90,8 @@ export class Auth0AuthProvider implements OAuthHandlers {
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
     this.audience = options.audience;
+    this.connection = options.connection;
+    this.connectionScope = options.connectionScope;
     this._strategy = new Auth0Strategy(
       {
         clientID: options.clientId,
@@ -127,6 +133,8 @@ export class Auth0AuthProvider implements OAuthHandlers {
       scope: req.scope,
       state: encodeState(req.state),
       ...(this.audience ? { audience: this.audience } : {}),
+      ...(this.connection ? { connection: this.connection } : {}),
+      ...(this.connectionScope ? { connection_scope: this.connectionScope } : {}),
     });
   }
 
@@ -136,6 +144,8 @@ export class Auth0AuthProvider implements OAuthHandlers {
       PrivateInfo
     >(req, this._strategy, {
       ...(this.audience ? { audience: this.audience } : {}),
+      ...(this.connection ? { connection: this.connection } : {}),
+      ...(this.connectionScope ? { connection_scope: this.connectionScope } : {}),
     });
 
     return {
@@ -224,6 +234,8 @@ export const auth0 = createAuthProviderIntegration({
         const domain = envConfig.getString('domain');
         const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
         const audience = envConfig.getOptionalString('audience');
+        const connection = envConfig.getOptionalString('connection');
+        const connectionScope = envConfig.getOptionalString('connectionScope');
         const callbackUrl =
           customCallbackUrl ||
           `${globalConfig.baseUrl}/${providerId}/handler/frame`;
@@ -245,6 +257,8 @@ export const auth0 = createAuthProviderIntegration({
           signInResolver,
           resolverContext,
           audience,
+          connection,
+          connectionScope,
         });
 
         return OAuthAdapter.fromConfig(globalConfig, provider, {