plugin/auth-backend: add gitlab oauth

packages/app/src/apis.ts

@@ -27,11 +27,13 @@ import {
   GoogleAuth,
   GithubAuth,
   OktaAuth,
+  GitlabAuth,
   oauthRequestApiRef,
   OAuthRequestManager,
   googleAuthApiRef,
   githubAuthApiRef,
   oktaAuthApiRef,
+  gitlabAuthApiRef,
   storageApiRef,
   WebStorage,
 } from '@backstage/core';
@@ -102,6 +104,15 @@ export const apis = (config: ConfigApi) => {
     }),
   );
 
+  builder.add(
+    gitlabAuthApiRef,
+    GitlabAuth.create({
+      apiOrigin: 'http://localhost:7000',
+      basePath: '/auth/',
+      oauthRequestApi,
+    }),
+  );
+
   builder.add(
     techRadarApiRef,
     new TechRadar({

packages/core-api/src/apis/definitions/auth.ts

@@ -242,11 +242,24 @@ export const githubAuthApiRef = createApiRef<
  */
 export const oktaAuthApiRef = createApiRef<
   OAuthApi &
-  OpenIdConnectApi &
-  ProfileInfoApi &
-  BackstageIdentityApi &
-  SessionStateApi
+    OpenIdConnectApi &
+    ProfileInfoApi &
+    BackstageIdentityApi &
+    SessionStateApi
 >({
   id: 'core.auth.okta',
   description: 'Provides authentication towards Okta APIs',
-}); 
+});
+
+/**
+ * Provides authentication towards Gitlab APIs.
+ *
+ * See https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html#limiting-scopes-of-a-personal-access-token
+ * for a full list of supported scopes.
+ */
+export const gitlabAuthApiRef = createApiRef<
+  OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionStateApi
+>({
+  id: 'core.auth.gitlab',
+  description: 'Provides authentication towards Gitlab APIs',
+});

packages/core-api/src/apis/implementations/auth/gitlab/GitlabAuth.test.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import GitlabAuth from './GitlabAuth';
+
+describe('GitlabAuth', () => {
+  it('should get access token', async () => {
+    const getSession = jest
+      .fn()
+      .mockResolvedValue({ providerInfo: { accessToken: 'access-token' } });
+    const gitlabAuth = new GitlabAuth({ getSession } as any);
+
+    expect(await gitlabAuth.getAccessToken()).toBe('access-token');
+    expect(getSession).toBeCalledTimes(1);
+  });
+
+  it('should normalize scope', () => {
+    const tests = [
+      {
+        arguments: ['read_user api write_repository'],
+        expect: new Set(['read_user', 'api', 'write_repository']),
+      },
+      {
+        arguments: ['read_repository sudo'],
+        expect: new Set(['read_repository', 'sudo']),
+      },
+    ];
+
+    for (const test of tests) {
+      expect(GitlabAuth.normalizeScope(...test.arguments)).toEqual(test.expect);
+    }
+  });
+});

packages/core-api/src/apis/implementations/auth/gitlab/GitlabAuth.ts

@@ -0,0 +1,135 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import GitlabIcon from '@material-ui/icons/AcUnit';
+import { DefaultAuthConnector } from '../../../../lib/AuthConnector';
+import { GitlabSession } from './types';
+import {
+  OAuthApi,
+  SessionStateApi,
+  SessionState,
+  ProfileInfo,
+  BackstageIdentity,
+  AuthRequestOptions,
+} from '../../../definitions/auth';
+import { OAuthRequestApi, AuthProvider } from '../../../definitions';
+import { SessionManager } from '../../../../lib/AuthSessionManager/types';
+import { StaticAuthSessionManager } from '../../../../lib/AuthSessionManager';
+import { Observable } from '../../../../types';
+
+type CreateOptions = {
+  apiOrigin: string;
+  basePath: string;
+
+  oauthRequestApi: OAuthRequestApi;
+
+  environment?: string;
+  provider?: AuthProvider & { id: string };
+};
+
+export type GitlabAuthResponse = {
+  providerInfo: {
+    accessToken: string;
+    scope: string;
+    expiresInSeconds: number;
+  };
+  profile: ProfileInfo;
+  backstageIdentity: BackstageIdentity;
+};
+
+const DEFAULT_PROVIDER = {
+  id: 'gitlab',
+  title: 'Gitlab',
+  icon: GitlabIcon,
+};
+
+class GitlabAuth implements OAuthApi, SessionStateApi {
+  static create({
+    apiOrigin,
+    basePath,
+    environment = 'development',
+    provider = DEFAULT_PROVIDER,
+    oauthRequestApi,
+  }: CreateOptions) {
+    const connector = new DefaultAuthConnector({
+      apiOrigin,
+      basePath,
+      environment,
+      provider,
+      oauthRequestApi,
+      sessionTransform(res: GitlabAuthResponse): GitlabSession {
+        return {
+          ...res,
+          providerInfo: {
+            accessToken: res.providerInfo.accessToken,
+            scopes: GitlabAuth.normalizeScope(res.providerInfo.scope),
+            expiresAt: new Date(
+              Date.now() + res.providerInfo.expiresInSeconds * 1000,
+            ),
+          },
+        };
+      },
+    });
+
+    const sessionManager = new StaticAuthSessionManager({
+      connector,
+      defaultScopes: new Set(['read_user']),
+      sessionScopes: (session: GitlabSession) => session.providerInfo.scopes,
+    });
+
+    return new GitlabAuth(sessionManager);
+  }
+
+  sessionState$(): Observable<SessionState> {
+    return this.sessionManager.sessionState$();
+  }
+
+  constructor(private readonly sessionManager: SessionManager<GitlabSession>) {}
+
+  async getAccessToken(scope?: string, options?: AuthRequestOptions) {
+    const session = await this.sessionManager.getSession({
+      ...options,
+      scopes: GitlabAuth.normalizeScope(scope),
+    });
+    return session?.providerInfo.accessToken ?? '';
+  }
+
+  async getBackstageIdentity(
+    options: AuthRequestOptions = {},
+  ): Promise<BackstageIdentity | undefined> {
+    const session = await this.sessionManager.getSession(options);
+    return session?.backstageIdentity;
+  }
+
+  async getProfile(options: AuthRequestOptions = {}) {
+    const session = await this.sessionManager.getSession(options);
+    return session?.profile;
+  }
+
+  async logout() {
+    await this.sessionManager.removeSession();
+  }
+
+  static normalizeScope(scope?: string): Set<string> {
+    if (!scope) {
+      return new Set();
+    }
+
+    const scopeList = Array.isArray(scope) ? scope : scope.split(' ');
+    return new Set(scopeList);
+  }
+}
+export default GitlabAuth;

packages/core-api/src/apis/implementations/auth/gitlab/index.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export * from './types';
+export { default as GitlabAuth } from './GitlabAuth';

packages/core-api/src/apis/implementations/auth/gitlab/types.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ProfileInfo, BackstageIdentity } from '../../../definitions';
+
+export type GitlabSession = {
+  providerInfo: {
+    accessToken: string;
+    scopes: Set<string>;
+    expiresAt: Date;
+  };
+  profile: ProfileInfo;
+  backstageIdentity: BackstageIdentity;
+};

packages/core-api/src/apis/implementations/auth/index.ts

@@ -16,4 +16,5 @@
 
 export * from './google';
 export * from './github';
+export * from './gitlab';
 export * from './okta';

packages/core/src/layout/Sidebar/UserSettings.tsx

@@ -22,6 +22,7 @@ import { SidebarContext } from './config';
 import {
   googleAuthApiRef,
   githubAuthApiRef,
+  gitlabAuthApiRef,
   identityApiRef,
   oktaAuthApiRef,
   useApi,
@@ -57,6 +58,11 @@ export function SidebarUserSettings() {
           apiRef={githubAuthApiRef}
           icon={Star}
         />
+        <OAuthProviderSettings
+          title="Gitlab"
+          apiRef={gitlabAuthApiRef}
+          icon={Star}
+        />
         <OIDCProviderSettings
           title="Okta"
           apiRef={oktaAuthApiRef}

packages/dev-utils/src/devApp/apiFactories.ts

@@ -28,6 +28,8 @@ import {
   googleAuthApiRef,
   GithubAuth,
   githubAuthApiRef,
+  GitlabAuth,
+  gitlabAuthApiRef,
 } from '@backstage/core';
 
 // TODO(rugvip): We should likely figure out how to reuse all of these between apps
@@ -75,3 +77,14 @@ export const githubAuthApiFactory = createApiFactory({
       oauthRequestApi,
     }),
 });
+
+export const gitlabAuthApiFactory = createApiFactory({
+  implements: gitlabAuthApiRef,
+  deps: { oauthRequestApi: oauthRequestApiRef },
+  factory: ({ oauthRequestApi }) =>
+    GitlabAuth.create({
+      apiOrigin: 'http://localhost:7000',
+      basePath: '/auth/',
+      oauthRequestApi,
+    }),
+});

packages/storybook/.storybook/apis.js

@@ -6,6 +6,7 @@ import {
   OAuthRequestManager,
   googleAuthApiRef,
   githubAuthApiRef,
+  gitlabAuthApiRef,
   oktaAuthApiRef,
   AlertApiForwarder,
   ErrorApiForwarder,
@@ -52,6 +53,15 @@ builder.add(
   }),
 );
 
+builder.add(
+  gitlabAuthApiRef,
+  GitlabAuth.create({
+    apiOrigin: 'http://localhost:7000',
+    basePath: '/auth/',
+    oauthRequestApi,
+  }),
+);
+
 builder.add(
   oktaAuthApiRef,
   OktaAuth.create({