feat: remove cookie on sign out

Signed-off-by: Camila Belo <camilaibs@gmail.com>

packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts

@@ -254,6 +254,10 @@ class DefaultHttpAuthService implements HttpAuthService {
       throw error;
     }
   }
+
+  removeUserCookie(res: Response): void {
+    res.clearCookie(BACKSTAGE_AUTH_COOKIE);
+  }
 }
 
 /** @public */

packages/backend-app-api/src/services/implementations/httpRouter/httpRouterServiceFactory.ts

@@ -59,6 +59,8 @@ export const httpRouterServiceFactory = createServiceFactory(
       rootHttpRouter,
       lifecycle,
     }) {
+      let hasRegistedCookieAuthRefreshMiddleware = false;
+
       if (options?.getPath) {
         logger.warn(
           `DEPRECATION WARNING: The 'getPath' option for HttpRouterService is deprecated. The ability to reconfigure the '/api/' path prefix for plugins will be removed in the future.`,
@@ -85,8 +87,12 @@ export const httpRouterServiceFactory = createServiceFactory(
         },
         addAuthPolicy(policy: HttpRouterServiceAuthPolicy): void {
           credentialsBarrier.addAuthPolicy(policy);
-          if (policy.allow === 'user-cookie') {
-            // TODO: Make sure this is only added once
+          if (
+            policy.allow === 'user-cookie' &&
+            !hasRegistedCookieAuthRefreshMiddleware
+          ) {
+            // Only add the cookie refresh middleware once
+            hasRegistedCookieAuthRefreshMiddleware = true;
             router.use(createCookieAuthRefreshMiddleware({ httpAuth }));
           }
         },