auth-node: Refresh handler not returning persisted scope in response

[kunickiaj]

Fix OAuth refresh handler in auth-node prompting for re-login on page reload.

The refresh handler is returning an empty scope if scope was previously saved in a cookie. The session is successfully refreshed but the client receives a response without the scope it requested, prompting a new login.

This should also be backported to 1.18.x

Resolves #20322

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)
• All your commits have a Signed-off-by line in the message. (more info)

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage/plugin-auth-node	plugins/auth-node	patch	v0.3.2-next.1

[github-actions]

Uffizzi Preview deployment-37636 was deleted.

[Rugvip]

Great find and fix! 🎉 🙏

Thank you for digging into this issue, been as bit occupied by CI failures and other ongoing things 😅 ❤️

[github-actions]

Thank you for contributing to Backstage! The changes in this pull request will be part of the 1.19.0 release, scheduled for Tue, 17 Oct 2023.

[Rugvip]

Patch release in #20367

[xyzmurali]

Hi, We are seeing a similar issue where this issue where logging in to github through 'backstage-plugin-github-pull-requests' widget also logs in to github authenticator provider, But logging in to github authenticator provider does not login to github for 'backstage-plugin-github-pull-requests' widget

This issue can be reproduced with below steps.

1. Go to page where Github authenticator sign in present

2. Login to github using Github authenticator

3. Go to page where 'backstage-plugin-github-pull-requests' widget is present. The github login should happen automatically and results should be displayed. But it asks for github login again on this page with no results displayed in the widget.

4. Go to page where Github authenticator sign in present

5. Log out of gihub

6. Go to page where 'backstage-plugin-github-pull-requests' widget is present.

7. Login to github from 'backstage-plugin-github-pull-requests' widget.

8. Go to page where Github authenticator sign in present. It will show already signed in

I see that the fix for "scope: result.session.scope," was made only to one location in file plugins/auth-node/src/oauth/createOAuthRouteHandlers.ts but it is present at two locations. Can this be an issue?

[awanlin]

@xyzmurali it would be best to log this as an issue as it's not going to be followed up easily here 👍

[xyzmurali]

Thank you, i submitted issue #24652