Merge branch 'master' of github.com:spotify/backstage into mob/catalog-in-gql

* 'master' of github.com:spotify/backstage:
  fix(catalog-backend): update migration to delete dependent view first
  auth-backend: temporary fix for strict CSP being set

plugins/auth-backend/src/lib/OAuthProvider.test.ts

@@ -125,7 +125,7 @@ describe('OAuthProvider Utils', () => {
       const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
 
       postMessageResponse(mockResponse, appOrigin, data);
-      expect(mockResponse.setHeader).toBeCalledTimes(2);
+      expect(mockResponse.setHeader).toBeCalledTimes(3);
       expect(mockResponse.end).toBeCalledTimes(1);
       expect(mockResponse.end).toBeCalledWith(
         expect.stringContaining(base64Data),
@@ -146,7 +146,7 @@ describe('OAuthProvider Utils', () => {
       const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
 
       postMessageResponse(mockResponse, appOrigin, data);
-      expect(mockResponse.setHeader).toBeCalledTimes(2);
+      expect(mockResponse.setHeader).toBeCalledTimes(3);
       expect(mockResponse.end).toBeCalledTimes(1);
       expect(mockResponse.end).toBeCalledWith(
         expect.stringContaining(base64Data),

plugins/auth-backend/src/lib/OAuthProvider.ts

@@ -64,6 +64,7 @@ export const postMessageResponse = (
 
   res.setHeader('Content-Type', 'text/html');
   res.setHeader('X-Frame-Options', 'sameorigin');
+  res.setHeader('Content-Security-Policy', "script-src 'unsafe-inline'");
 
   // TODO: Make target app origin configurable globally
   res.end(`

plugins/catalog-backend/migrations/20200805163904_location_update_log_duplication_fix.js

@@ -21,6 +21,7 @@
  */
 exports.up = function up(knex) {
   return knex.schema
+    .raw('DROP VIEW location_update_log_latest;')
     .dropTable('location_update_log')
     .createTable('location_update_log', table => {
       table.bigIncrements('id').primary(); // instead of uuid, so we can MAX it
@@ -35,8 +36,6 @@ exports.up = function up(knex) {
         .onDelete('CASCADE');
       table.string('entity_name').nullable();
     }).raw(`
-      DROP VIEW location_update_log_latest;
-    `).raw(`
       CREATE VIEW location_update_log_latest AS
       SELECT t1.* FROM location_update_log t1
       JOIN
@@ -56,20 +55,33 @@ exports.up = function up(knex) {
  * @param {import('knex')} knex
  */
 exports.down = function down(knex) {
-  return knex.schema.raw(`
-    DROP VIEW location_update_log_latest;
-  `).raw(`
-    CREATE VIEW location_update_log_latest AS
-    SELECT t1.* FROM location_update_log t1
-    JOIN
-    (
-      SELECT location_id, MAX(created_at) AS MAXDATE
-      FROM location_update_log
-      GROUP BY location_id
-    ) t2
-    ON t1.location_id = t2.location_id
-    AND t1.created_at = t2.MAXDATE
-    GROUP BY t1.location_id, t1.id
-    ORDER BY created_at DESC;
-  `);
+  return knex.schema
+    .raw('DROP VIEW location_update_log_latest;')
+    .dropTable('location_update_log')
+    .createTable('location_update_log', table => {
+      table.uuid('id').primary();
+      table.enum('status', ['success', 'fail']).notNullable();
+      table.dateTime('created_at').defaultTo(knex.fn.now()).notNullable();
+      table.string('message');
+      table
+        .uuid('location_id')
+        .references('id')
+        .inTable('locations')
+        .onUpdate('CASCADE')
+        .onDelete('CASCADE');
+      table.string('entity_name').nullable();
+    }).raw(`
+      CREATE VIEW location_update_log_latest AS
+      SELECT t1.* FROM location_update_log t1
+      JOIN
+      (
+        SELECT location_id, MAX(created_at) AS MAXDATE
+        FROM location_update_log
+        GROUP BY location_id
+      ) t2
+      ON t1.location_id = t2.location_id
+      AND t1.created_at = t2.MAXDATE
+      GROUP BY t1.location_id, t1.id
+      ORDER BY created_at DESC;
+    `);
 };