Changed the configuration property to additionalScopes and added a tested helper function to combine lists of scopes.

Signed-off-by: Daniel Doberenz <daniel.doberenz@lichtblick.de>

docs/auth/microsoft/provider.md

@@ -55,8 +55,8 @@ auth:
         clientSecret: ${AZURE_CLIENT_SECRET}
         tenantId: ${AZURE_TENANT_ID}
         domainHint: ${AZURE_TENANT_ID}
-        scope:
-          - user.read
+        additionalScopes:
+          - Mail.Send
 ```
 
 The Microsoft provider is a structure with three mandatory configuration keys:

plugins/auth-backend-module-microsoft-provider/config.d.ts

@@ -28,7 +28,7 @@ export interface Config {
           clientSecret: string;
           domainHint?: string;
           callbackUrl?: string;
-          scope?: string[];
+          additionalScopes?: string[];
         };
       };
     };

plugins/auth-backend-module-microsoft-provider/src/authenticator.ts

@@ -21,6 +21,7 @@ import {
   PassportProfile,
 } from '@backstage/plugin-auth-node';
 import { ExtendedMicrosoftStrategy } from './strategy';
+import { scopeHelper } from './scopes';
 
 /** @public */
 export const microsoftAuthenticator = createOAuthAuthenticator({
@@ -31,9 +32,10 @@ export const microsoftAuthenticator = createOAuthAuthenticator({
     const clientSecret = config.getString('clientSecret');
     const tenantId = config.getString('tenantId');
     const domainHint = config.getOptionalString('domainHint');
-    const scope: string[] = config.getOptionalStringArray('scope') || [
-      'user.read',
-    ];
+    const scope = scopeHelper(
+      ['user.read'],
+      config.getOptionalStringArray('additionalScopes'),
+    );
 
     const helper = PassportOAuthAuthenticatorHelper.from(
       new ExtendedMicrosoftStrategy(

plugins/auth-backend-module-microsoft-provider/src/scopes.test.ts

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { scopeHelper } from './scopes';
+
+describe('microsoftScopeHelper', () => {
+  it('default scope only with undefined additional scopes', () => {
+    const scopeResult = scopeHelper(['default']);
+    expect(scopeResult.length).toBe(1);
+    expect(scopeResult).toEqual(expect.arrayContaining(['default']));
+  });
+
+  it('default scope only with empty additional scopes', () => {
+    const scopeResult = scopeHelper(['default'], []);
+    expect(scopeResult.length).toBe(1);
+    expect(scopeResult).toEqual(expect.arrayContaining(['default']));
+  });
+
+  it('default scope with mutually exclusive additional scopes', () => {
+    const scopeResult = scopeHelper(['default'], ['secondScope', 'thirdScope']);
+    expect(scopeResult.length).toBe(3);
+    expect(scopeResult).toEqual(
+      expect.arrayContaining(['default', 'secondScope', 'thirdScope']),
+    );
+  });
+
+  it('default scope with overlapping additional scopes', () => {
+    const scopeResult = scopeHelper(
+      ['default', 'secondScope'],
+      ['default', 'secondScope', 'thirdScope'],
+    );
+    expect(scopeResult.length).toBe(3);
+    expect(scopeResult).toEqual(
+      expect.arrayContaining(['default', 'secondScope', 'thirdScope']),
+    );
+  });
+});

plugins/auth-backend-module-microsoft-provider/src/scopes.ts

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Combine two arrays of scopes without duplicates
+ * @param defaultScopes Default scopes
+ * @param additionalScopes Optional additional scopes
+ * @returns List of scopes
+ * @public
+ */
+export const scopeHelper = function (
+  defaultScopes: string[],
+  additionalScopes?: string[],
+): string[] {
+  const scope: string[] = defaultScopes.concat(additionalScopes || []);
+  return scope.filter((value, index) => scope.indexOf(value) === index);
+};