Uses a PID file to track which process owns each temp directory, so
concurrent instances from different projects are not affected.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Close embedded DB on shutdown to avoid leaking the Postgres process
and temp directory
- Use fs.remove instead of deprecated fs.rmdir with recursive option
- Guard against absolute config paths in readDatabaseClient
- Forward embedded-postgres error logs to console.error
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The 18.x version ships its own .d.ts files that TypeScript resolves
correctly, so the custom module declaration is no longer needed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix implicit any types in startEmbeddedDb callbacks, replace the
re-export type declaration with an inline type definition for the
embedded-postgres module, and update runBackend tests to mock the
config loading and use async timer advancement.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Replace manual string concatenation with URL and URLSearchParams for
safer encoding and better readability.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The `federated` config key was ambiguous. Rename to `federatedLogout`
for clarity since it specifically controls federated logout behavior.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The origin header is always present in browser POST requests, making
the fallback scenario unreachable in practice.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add @backstage/plugin-app to core-app-api changeset, reword to avoid
internal export name, and downgrade auth-node bump to patch.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add server-side URL validation for logoutUrl (HTTPS + localhost only),
origin validation on the logout endpoint, and a configurable `federated`
option (default false) for Auth0 provider logout. Includes comprehensive
test coverage for all security controls.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Add origin allowlist validation in the OAuth logout handler (matching
the existing start/refresh pattern) and validate the logoutUrl protocol
on the frontend before redirecting. Also replace inline type annotation
with the named OAuthAuthenticatorLogoutResult type.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Rather than requiring the `EXPERIMENTAL_DEV_DB` environment variable,
the embedded postgres server is now started automatically when
`backend.database.client` is set to `embedded-postgres` in the app
config. The CLI reads the config before spawning the backend and
injects the actual pg connection details via env override.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix ~30 broken links and anchors across the documentation site, including
incorrect relative paths, mismatched anchor names, zero-width characters
in URLs, and references to renamed or removed headings.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
dependabot[bot]