The `federated` config key was ambiguous. Rename to `federatedLogout`
for clarity since it specifically controls federated logout behavior.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use translation key for "No schema defined" fallback instead of hardcoded string
- Add aria-label to the enum format button for accessibility
- Remove unnecessary `as any` casts on defaultWidth column config
- Fix "Github" -> "GitHub" capitalization in test data
- Update changeset wording to match actual sidebar list UI
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The origin header is always present in browser POST requests, making
the fallback scenario unreachable in practice.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add @backstage/plugin-app to core-app-api changeset, reword to avoid
internal export name, and downgrade auth-node bump to patch.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add server-side URL validation for logoutUrl (HTTPS + localhost only),
origin validation on the logout endpoint, and a configurable `federated`
option (default false) for Auth0 provider logout. Includes comprehensive
test coverage for all security controls.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Add origin allowlist validation in the OAuth logout handler (matching
the existing start/refresh pattern) and validate the logoutUrl protocol
on the frontend before redirecting. Also replace inline type annotation
with the named OAuthAuthenticatorLogoutResult type.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Rather than requiring the `EXPERIMENTAL_DEV_DB` environment variable,
the embedded postgres server is now started automatically when
`backend.database.client` is set to `embedded-postgres` in the app
config. The CLI reads the config before spawning the backend and
injects the actual pg connection details via env override.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix ~30 broken links and anchors across the documentation site, including
incorrect relative paths, mismatched anchor names, zero-width characters
in URLs, and references to renamed or removed headings.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Glob v13 treats backslashes as escape characters by default, unlike v7
which treated them as path separators on Windows. This broke Windows CI
where path.join/resolve produce backslash paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The legacy frontend plugin template had the same name (`frontend-plugin`) as
the new frontend plugin template, causing a conflict error when both were shown
(e.g. when the frontend system could not be auto-detected). Rename the legacy
template to `frontend-plugin-legacy` so both can coexist.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
Add `position: relative` and `z-index: 2` to nav items so they
paint above the hover/active indicator, matching the Tabs pattern.
This fixes themes with opaque `--bui-bg-neutral-2` values obscuring
tab labels on hover.
Also fix `--bui-font-family` (non-existent) to `--bui-font-regular`.
Signed-off-by: Johan Persson <johanopersson@gmail.com>
Jonathan Roebuck