From dd99788e6bd85034e3aa8252723e6b5513ca8abe Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Mon, 13 May 2024 13:20:39 +0200
Subject: [PATCH] auth-node: allow additonalScopes to be a string too

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .../src/oauth/CookieScopeManager.test.ts      | 34 +++++++++++++++++--
 .../auth-node/src/oauth/CookieScopeManager.ts | 11 ++++--
 .../src/oauth/createOAuthRouteHandlers.ts     |  6 ++--
 3 files changed, 43 insertions(+), 8 deletions(-)

diff --git a/plugins/auth-node/src/oauth/CookieScopeManager.test.ts b/plugins/auth-node/src/oauth/CookieScopeManager.test.ts
index 82eeb902d8..6cdee1168f 100644
--- a/plugins/auth-node/src/oauth/CookieScopeManager.test.ts
+++ b/plugins/auth-node/src/oauth/CookieScopeManager.test.ts
@@ -23,6 +23,7 @@ import {
 import { OAuthCookieManager } from './OAuthCookieManager';
 import { OAuthState } from './state';
 import { CookieScopeManager } from './CookieScopeManager';
+import { ConfigReader } from '@backstage/config';
 
 function makeReq(scope?: string): express.Request {
   return {
@@ -32,6 +33,11 @@ function makeReq(scope?: string): express.Request {
   } as express.Request<any, any, any, any>;
 }
 
+const baseOpts = {
+  authenticator: {} as OAuthAuthenticator<any, any>,
+  cookieManager: {} as OAuthCookieManager,
+};
+
 describe('CookieScopeManager', () => {
   it('should work with minimal config', async () => {
     const manager = CookieScopeManager.create({
@@ -71,8 +77,7 @@ describe('CookieScopeManager', () => {
   it('should include additional scopes', async () => {
     const manager = CookieScopeManager.create({
       additionalScopes: ['a', 'b'],
-      authenticator: {} as OAuthAuthenticator<any, any>,
-      cookieManager: {} as OAuthCookieManager,
+      ...baseOpts,
     });
 
     await expect(manager.start(makeReq())).resolves.toEqual({
@@ -95,6 +100,31 @@ describe('CookieScopeManager', () => {
     ).resolves.toEqual('y z a');
   });
 
+  it('should include additional scopes from config', async () => {
+    await expect(
+      CookieScopeManager.create({
+        additionalScopes: ['a'],
+        ...baseOpts,
+      }).start(makeReq()),
+    ).resolves.toEqual({ scope: 'a' });
+
+    await expect(
+      CookieScopeManager.create({
+        config: new ConfigReader({ additionalScopes: 'a,b' }),
+        additionalScopes: ['c'],
+        ...baseOpts,
+      }).start(makeReq()),
+    ).resolves.toEqual({ scope: 'a b c' });
+
+    await expect(
+      CookieScopeManager.create({
+        config: new ConfigReader({ additionalScopes: ['a', 'b'] }),
+        additionalScopes: ['c'],
+        ...baseOpts,
+      }).start(makeReq()),
+    ).resolves.toEqual({ scope: 'a b c' });
+  });
+
   it('should persist scopes', async () => {
     const setGrantedScopes = jest.fn();
     const removeGrantedScopes = jest.fn();
diff --git a/plugins/auth-node/src/oauth/CookieScopeManager.ts b/plugins/auth-node/src/oauth/CookieScopeManager.ts
index 45f6e6238a..f012536755 100644
--- a/plugins/auth-node/src/oauth/CookieScopeManager.ts
+++ b/plugins/auth-node/src/oauth/CookieScopeManager.ts
@@ -23,6 +23,7 @@ import {
 import { OAuthCookieManager } from './OAuthCookieManager';
 import { OAuthState } from './state';
 import { AuthenticationError } from '@backstage/errors';
+import { Config } from '@backstage/config';
 
 function reqRes(req: express.Request): express.Response {
   const res = req.res;
@@ -47,19 +48,25 @@ function splitScope(scope?: string): Iterable<string> {
 
 export class CookieScopeManager {
   static create(options: {
+    config?: Config;
     additionalScopes?: string[];
     authenticator: OAuthAuthenticator<any, any>;
     cookieManager: OAuthCookieManager;
   }) {
-    const { authenticator } = options;
+    const { authenticator, config } = options;
 
     const shouldPersistScopes =
       authenticator.scopes?.persist ??
       authenticator.shouldPersistScopes ??
       false;
 
+    const configScopes =
+      typeof config?.getOptional('additionalScopes') === 'string'
+        ? splitScope(config.getString('additionalScopes'))
+        : config?.getOptionalStringArray('additionalScopes') ?? [];
+
     const transform = authenticator?.scopes?.transform ?? defaultTransform;
-    const additional = options.additionalScopes ?? [];
+    const additional = [...configScopes, ...(options.additionalScopes ?? [])];
     const required = authenticator?.scopes?.required ?? [];
 
     return new CookieScopeManager(
diff --git a/plugins/auth-node/src/oauth/createOAuthRouteHandlers.ts b/plugins/auth-node/src/oauth/createOAuthRouteHandlers.ts
index c13b58f2fc..82bfa2f02c 100644
--- a/plugins/auth-node/src/oauth/createOAuthRouteHandlers.ts
+++ b/plugins/auth-node/src/oauth/createOAuthRouteHandlers.ts
@@ -113,12 +113,10 @@ export function createOAuthRouteHandlers<TProfile>(
   });
 
   const scopeManager = CookieScopeManager.create({
+    config,
     authenticator,
     cookieManager,
-    additionalScopes: [
-      ...(options.additionalScopes ?? []),
-      ...(config.getOptionalStringArray('additionalScopes') ?? []),
-    ],
+    additionalScopes: options.additionalScopes,
   });
 
   return {