From 9a46a81ece020408ce61f4eccd0aa922b712601d Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Tue, 23 Jul 2024 12:40:11 +0200
Subject: [PATCH] core-app-api: fix immediate sign-in on sign-out

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/thirty-paws-hope.md                |  5 ++++
 .../IdentityApi/AppIdentityProxy.ts           |  3 ++-
 .../core-app-api/src/app/AppManager.test.tsx  | 26 ++++++++++++++-----
 3 files changed, 26 insertions(+), 8 deletions(-)
 create mode 100644 .changeset/thirty-paws-hope.md

diff --git a/.changeset/thirty-paws-hope.md b/.changeset/thirty-paws-hope.md
new file mode 100644
index 0000000000..0de607f331
--- /dev/null
+++ b/.changeset/thirty-paws-hope.md
@@ -0,0 +1,5 @@
+---
+'@backstage/core-app-api': patch
+---
+
+The request to delete the session cookie when running the app in protected mode is now done with a plain `fetch` rather than `FetchApi`. This fixes a bug where the app would immediately try to sign-in again when removing the cookie during logout.
diff --git a/packages/core-app-api/src/apis/implementations/IdentityApi/AppIdentityProxy.ts b/packages/core-app-api/src/apis/implementations/IdentityApi/AppIdentityProxy.ts
index 92e2abffb7..941ec90d66 100644
--- a/packages/core-app-api/src/apis/implementations/IdentityApi/AppIdentityProxy.ts
+++ b/packages/core-app-api/src/apis/implementations/IdentityApi/AppIdentityProxy.ts
@@ -153,8 +153,9 @@ export class AppIdentityProxy implements IdentityApi {
       // It is fine if we do NOT worry yet about deleting cookies for OTHER backends like techdocs
       const appBaseUrl = await ctx.discoveryApi.getBaseUrl('app');
       try {
-        await ctx.fetchApi.fetch(`${appBaseUrl}/.backstage/auth/v1/cookie`, {
+        await fetch(`${appBaseUrl}/.backstage/auth/v1/cookie`, {
           method: 'DELETE',
+          credentials: 'include',
         });
       } catch {
         // Ignore the error for those who use static serving of the frontend
diff --git a/packages/core-app-api/src/app/AppManager.test.tsx b/packages/core-app-api/src/app/AppManager.test.tsx
index 85b6bcd684..01277a09c7 100644
--- a/packages/core-app-api/src/app/AppManager.test.tsx
+++ b/packages/core-app-api/src/app/AppManager.test.tsx
@@ -19,9 +19,12 @@ import {
   MockAnalyticsApi,
   renderWithEffects,
   withLogCollector,
+  registerMswTestHooks,
 } from '@backstage/test-utils';
-import { screen, waitFor, act } from '@testing-library/react';
+import { screen, act } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
+import { setupServer } from 'msw/node';
+import { rest } from 'msw';
 import React, { PropsWithChildren, ReactNode } from 'react';
 import { BrowserRouter, Navigate, Route, Routes } from 'react-router-dom';
 import {
@@ -51,6 +54,9 @@ import {
 } from '@backstage/core-plugin-api/alpha';
 
 describe('Integration Test', () => {
+  const server = setupServer();
+  registerMswTestHooks(server);
+
   const noOpAnalyticsApi = createApiFactory(
     analyticsApiRef,
     new NoOpAnalyticsApi(),
@@ -847,6 +853,17 @@ describe('Integration Test', () => {
   });
 
   it('should clear app cookie when the user logs out', async () => {
+    const logoutSignal = jest.fn();
+    server.use(
+      rest.delete(
+        'http://localhost:7007/app/.backstage/auth/v1/cookie',
+        (_req, res, ctx) => {
+          logoutSignal();
+          return res(ctx.status(200));
+        },
+      ),
+    );
+
     const meta = global.document.createElement('meta');
     meta.name = 'backstage-app-mode';
     meta.content = 'protected';
@@ -901,12 +918,7 @@ describe('Integration Test', () => {
       await userEvent.click(screen.getByText('Sign Out'));
     });
 
-    await waitFor(() =>
-      expect(fetchApiMock.fetch).toHaveBeenCalledWith(
-        'http://localhost:7007/app/.backstage/auth/v1/cookie',
-        { method: 'DELETE' },
-      ),
-    );
+    expect(logoutSignal).toHaveBeenCalled();
 
     global.document.head.removeChild(meta);
   });