Remove auth middleware

Signed-off-by: Nataliya Issayeva <nissayeva@users.noreply.github.com>

packages/backend/package.json

@@ -55,13 +55,11 @@
     "@gitbeaker/node": "^30.2.0",
     "@octokit/rest": "^18.5.3",
     "azure-devops-node-api": "^11.0.1",
-    "cookie-parser": "^1.4.5",
     "dockerode": "^3.3.1",
     "example-app": "^0.2.53",
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "express-prom-bundle": "^6.3.6",
-    "jose": "^1.27.1",
     "knex": "^0.95.1",
     "pg": "^8.3.0",
     "pg-connection-string": "^2.3.0",

packages/backend/src/index.ts

@@ -34,7 +34,6 @@ import {
   UrlReaders,
   useHotMemoize,
   ServerTokenManager,
-  IdentityClient,
 } from '@backstage/backend-common';
 import { Config } from '@backstage/config';
 import healthcheck from './plugins/healthcheck';
@@ -57,10 +56,6 @@ import app from './plugins/app';
 import badges from './plugins/badges';
 import jenkins from './plugins/jenkins';
 import { PluginEnvironment } from './types';
-import cookieParser from 'cookie-parser';
-import { Request, Response, NextFunction } from 'express';
-import { JWT } from 'jose';
-import { URL } from 'url';
 
 function makeCreateEnv(config: Config) {
   const root = getRootLogger();
@@ -81,27 +76,6 @@ function makeCreateEnv(config: Config) {
   };
 }
 
-function setTokenCookie(
-  res: Response,
-  options: { token: string; secure: boolean; cookieDomain: string },
-) {
-  try {
-    const payload = JWT.decode(options.token) as object & {
-      exp: number;
-    };
-    res.cookie(`token`, options.token, {
-      expires: new Date(payload?.exp ? payload?.exp * 1000 : 0),
-      secure: options.secure,
-      sameSite: 'lax',
-      domain: options.cookieDomain,
-      path: '/',
-      httpOnly: true,
-    });
-  } catch (_err) {
-    // Ignore
-  }
-}
-
 async function main() {
   metricsInit();
   const logger = getRootLogger();
@@ -140,59 +114,7 @@ async function main() {
     createEnv('tech-insights'),
   );
 
-  const discovery = SingleHostDiscovery.fromConfig(config);
-  const identity = new IdentityClient({
-    discovery,
-    issuer: await discovery.getExternalBaseUrl('auth'),
-  });
-  const baseUrl = config.getString('backend.baseUrl');
-  const secure = baseUrl.startsWith('https://');
-  const cookieDomain = new URL(baseUrl).hostname;
-  const authMiddleware = async (
-    req: Request,
-    res: Response,
-    next: NextFunction,
-  ) => {
-    try {
-      const token =
-        IdentityClient.getBearerToken(req.headers.authorization) ||
-        req.cookies.token;
-
-      const isServerToken = await authEnv.tokenManager.isServerToken(token);
-      if (!isServerToken) {
-        await identity.authenticate(token);
-      }
-
-      if (!req.headers.authorization) {
-        // Authorization header may be forwarded by plugin requests
-        req.headers.authorization = `Bearer ${token}`;
-      }
-      if (token !== req.cookies.token) {
-        setTokenCookie(res, {
-          token,
-          secure,
-          cookieDomain,
-        });
-      }
-      next();
-    } catch (error) {
-      res.status(401).send(`Unauthorized`);
-    }
-  };
-
   const apiRouter = Router();
-  apiRouter.use(cookieParser());
-  // The auth route must be publically available as it is used during login
-  apiRouter.use('/auth', await auth(authEnv));
-  // Add a simple endpoint to be used when setting a token cookie
-  apiRouter.use('/cookie', authMiddleware, (_req, res) => {
-    res.status(200).send(`Coming right up`);
-  });
-  // Only authenticated requests are allowed to the routes below
-  apiRouter.use('/catalog', authMiddleware, await catalog(catalogEnv));
-  apiRouter.use('/techdocs', authMiddleware, await techdocs(techdocsEnv));
-  apiRouter.use('/proxy', authMiddleware, await proxy(proxyEnv));
-  apiRouter.use(authMiddleware, notFoundHandler());
   apiRouter.use('/catalog', await catalog(catalogEnv));
   apiRouter.use('/code-coverage', await codeCoverage(codeCoverageEnv));
   apiRouter.use('/rollbar', await rollbar(rollbarEnv));