Merge pull request #2129 from GoWind/accept-updated-refresh-tokens

Update Refresh Token, if provided by the server in the refresh grant. Refs #2128

plugins/auth-backend/src/lib/OAuthProvider.ts

@@ -274,6 +274,13 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
 
       await this.populateIdentity(response.backstageIdentity);
 
+      if (
+        response.providerInfo.refreshToken &&
+        response.providerInfo.refreshToken !== refreshToken
+      ) {
+        this.setRefreshTokenCookie(res, response.providerInfo.refreshToken);
+      }
+
       res.send(response);
     } catch (error) {
       res.status(401).send(`${error.message}`);

plugins/auth-backend/src/lib/PassportStrategyHelper.ts

@@ -45,7 +45,6 @@ export const makeProfileInfo = (
   if ((!email || !picture) && idToken) {
     try {
       const decoded: Record<string, string> = jwtDecoder(idToken);
-
       if (!email && decoded.email) {
         email = decoded.email;
       }
@@ -133,7 +132,7 @@ export const executeRefreshTokenStrategy = async (
       (
         err: Error | null,
         accessToken: string,
-        _refreshToken: string,
+        newRefreshToken: string,
         params: any,
       ) => {
         if (err) {
@@ -149,6 +148,7 @@ export const executeRefreshTokenStrategy = async (
 
         resolve({
           accessToken,
+          refreshToken: newRefreshToken,
           params,
         });
       },

plugins/auth-backend/src/providers/oauth2/provider.ts

@@ -67,6 +67,7 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
         done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
       ) => {
         const profile = makeProfileInfo(rawProfile, params.id_token);
+
         done(
           undefined,
           {
@@ -113,11 +114,16 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
   }
 
   async refresh(refreshToken: string, scope: string): Promise<OAuthResponse> {
-    const { accessToken, params } = await executeRefreshTokenStrategy(
+    const refreshTokenResponse = await executeRefreshTokenStrategy(
       this._strategy,
       refreshToken,
       scope,
     );
+    const {
+      accessToken,
+      params,
+      refreshToken: updatedRefreshToken,
+    } = refreshTokenResponse;
 
     const profile = await executeFetchUserProfileStrategy(
       this._strategy,
@@ -128,6 +134,7 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
     return this.populateIdentity({
       providerInfo: {
         accessToken,
+        refreshToken: updatedRefreshToken,
         idToken: params.id_token,
         expiresInSeconds: params.expires_in,
         scope: params.scope,
@@ -146,7 +153,6 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
     if (!profile.email) {
       throw new Error('Profile does not contain a profile');
     }
-
     const id = profile.email.split('@')[0];
 
     return { ...response, backstageIdentity: { id } };

plugins/auth-backend/src/providers/types.ts

@@ -213,6 +213,10 @@ export type OAuthProviderInfo = {
    * Scopes granted for the access token.
    */
   scope: string;
+  /**
+   * A refresh token issued for the signed in user
+   */
+  refreshToken?: string;
 };
 
 export type OAuthPrivateInfo = {
@@ -280,6 +284,10 @@ export type RefreshTokenResponse = {
    * An access token issued for the signed in user.
    */
   accessToken: string;
+  /**
+   * Optionally, the server can issue a new Refresh Token for the user
+   */
+  refreshToken?: string;
   params: any;
 };