@backstage/plugin-auth-backend-module-gcp-iap-provider 0.4.3-next.1 → 0.4.3-next.2

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @backstage/plugin-auth-backend-module-gcp-iap-provider
 
+## 0.4.3-next.2
+
+### Patch Changes
+
+- 5cc1f7f: Introduce `dangerouslyAllowSignInWithoutUserInCatalog` auth resolver config.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.6.3-next.2
+  - @backstage/backend-plugin-api@1.3.1-next.2
+  - @backstage/errors@1.2.7
+  - @backstage/types@1.2.1
+
 ## 0.4.3-next.1
 
 ### Patch Changes

package/config.d.ts

@@ -36,13 +36,23 @@ export interface Config {
 
         signIn?: {
           resolvers: Array<
-            | { resolver: 'emailMatchingUserEntityAnnotation' }
-            | { resolver: 'idMatchingUserEntityAnnotation' }
+            | {
+                resolver: 'emailMatchingUserEntityAnnotation';
+                dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+              }
+            | {
+                resolver: 'idMatchingUserEntityAnnotation';
+                dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+              }
             | {
                 resolver: 'emailLocalPartMatchingUserEntityName';
                 allowedDomains?: string[];
+                dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+              }
+            | {
+                resolver: 'emailMatchingUserEntityProfileEmail';
+                dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
               }
-            | { resolver: 'emailMatchingUserEntityProfileEmail' }
           >;
         };
         sessionDuration?: HumanDuration | string;

package/dist/index.d.ts

@@ -56,11 +56,15 @@ declare namespace gcpIapSignInResolvers {
     /**
      * Looks up the user by matching their email to the `google.com/email` annotation.
      */
-    const emailMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<GcpIapResult, unknown>;
+    const emailMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<GcpIapResult, {
+        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
+    } | undefined>;
     /**
      * Looks up the user by matching their user ID to the `google.com/user-id` annotation.
      */
-    const idMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<GcpIapResult, unknown>;
+    const idMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<GcpIapResult, {
+        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
+    } | undefined>;
 }
 
 export { type GcpIapResult, type GcpIapTokenInfo, authModuleGcpIapProvider as default, gcpIapAuthenticator, gcpIapSignInResolvers };

package/dist/resolvers.cjs.js

@@ -1,33 +1,50 @@
 'use strict';
 
 var pluginAuthNode = require('@backstage/plugin-auth-node');
+var zod = require('zod');
 
 exports.gcpIapSignInResolvers = void 0;
 ((gcpIapSignInResolvers2) => {
   gcpIapSignInResolvers2.emailMatchingUserEntityAnnotation = pluginAuthNode.createSignInResolverFactory({
-    create() {
+    optionsSchema: zod.z.object({
+      dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+    }).optional(),
+    create(options = {}) {
       return async (info, ctx) => {
         const email = info.result.iapToken.email;
         if (!email) {
           throw new Error("Google IAP sign-in result is missing email");
         }
-        return ctx.signInWithCatalogUser({
-          annotations: {
-            "google.com/email": email
+        return ctx.signInWithCatalogUser(
+          {
+            annotations: {
+              "google.com/email": email
+            }
+          },
+          {
+            dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: email } } : void 0
           }
-        });
+        );
       };
     }
   });
   gcpIapSignInResolvers2.idMatchingUserEntityAnnotation = pluginAuthNode.createSignInResolverFactory({
-    create() {
+    optionsSchema: zod.z.object({
+      dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+    }).optional(),
+    create(options = {}) {
       return async (info, ctx) => {
         const userId = info.result.iapToken.sub.split(":")[1];
-        return ctx.signInWithCatalogUser({
-          annotations: {
-            "google.com/user-id": userId
+        return ctx.signInWithCatalogUser(
+          {
+            annotations: {
+              "google.com/user-id": userId
+            }
+          },
+          {
+            dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: userId } } : void 0
           }
-        });
+        );
       };
     }
   });

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { GcpIapResult } from './types';\n\n/**\n * Available sign-in resolvers for the Google auth provider.\n *\n * @public\n */\nexport namespace gcpIapSignInResolvers {\n  /**\n   * Looks up the user by matching their email to the `google.com/email` annotation.\n   */\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    create() {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const email = info.result.iapToken.email;\n\n        if (!email) {\n          throw new Error('Google IAP sign-in result is missing email');\n        }\n\n        return ctx.signInWithCatalogUser({\n          annotations: {\n            'google.com/email': email,\n          },\n        });\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their user ID to the `google.com/user-id` annotation.\n   */\n  export const idMatchingUserEntityAnnotation = createSignInResolverFactory({\n    create() {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const userId = info.result.iapToken.sub.split(':')[1];\n\n        return ctx.signInWithCatalogUser({\n          annotations: {\n            'google.com/user-id': userId,\n          },\n        });\n      };\n    },\n  });\n}\n"],"names":["gcpIapSignInResolvers","createSignInResolverFactory"],"mappings":";;;;AA2BiBA;AAAA,CAAV,CAAUA,sBAAV,KAAA;AAIE,EAAMA,sBAAAA,CAAA,oCAAoCC,0CAA4B,CAAA;AAAA,IAC3E,MAAS,GAAA;AACP,MAAO,OAAA,OAAO,MAAgC,GAAQ,KAAA;AACpD,QAAM,MAAA,KAAA,GAAQ,IAAK,CAAA,MAAA,CAAO,QAAS,CAAA,KAAA;AAEnC,QAAA,IAAI,CAAC,KAAO,EAAA;AACV,UAAM,MAAA,IAAI,MAAM,4CAA4C,CAAA;AAAA;AAG9D,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,WAAa,EAAA;AAAA,YACX,kBAAoB,EAAA;AAAA;AACtB,SACD,CAAA;AAAA,OACH;AAAA;AACF,GACD,CAAA;AAKM,EAAMD,sBAAAA,CAAA,iCAAiCC,0CAA4B,CAAA;AAAA,IACxE,MAAS,GAAA;AACP,MAAO,OAAA,OAAO,MAAgC,GAAQ,KAAA;AACpD,QAAM,MAAA,MAAA,GAAS,KAAK,MAAO,CAAA,QAAA,CAAS,IAAI,KAAM,CAAA,GAAG,EAAE,CAAC,CAAA;AAEpD,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,WAAa,EAAA;AAAA,YACX,oBAAsB,EAAA;AAAA;AACxB,SACD,CAAA;AAAA,OACH;AAAA;AACF,GACD,CAAA;AAAA,CArCc,EAAAD,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { GcpIapResult } from './types';\nimport { z } from 'zod';\n\n/**\n * Available sign-in resolvers for the Google auth provider.\n *\n * @public\n */\nexport namespace gcpIapSignInResolvers {\n  /**\n   * Looks up the user by matching their email to the `google.com/email` annotation.\n   */\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const email = info.result.iapToken.email;\n\n        if (!email) {\n          throw new Error('Google IAP sign-in result is missing email');\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'google.com/email': email,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: email } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their user ID to the `google.com/user-id` annotation.\n   */\n  export const idMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (info: SignInInfo<GcpIapResult>, ctx) => {\n        const userId = info.result.iapToken.sub.split(':')[1];\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'google.com/user-id': userId,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["gcpIapSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA4BiBA;AAAA,CAAV,CAAUA,sBAAV,KAAA;AAIE,EAAMA,sBAAAA,CAAA,oCAAoCC,0CAA4B,CAAA;AAAA,IAC3E,aAAA,EAAeC,MACZ,MAAO,CAAA;AAAA,MACN,0CAA4C,EAAAA,KAAA,CAAE,OAAQ,EAAA,CAAE,QAAS;AAAA,KAClE,EACA,QAAS,EAAA;AAAA,IACZ,MAAA,CAAO,OAAU,GAAA,EAAI,EAAA;AACnB,MAAO,OAAA,OAAO,MAAgC,GAAQ,KAAA;AACpD,QAAM,MAAA,KAAA,GAAQ,IAAK,CAAA,MAAA,CAAO,QAAS,CAAA,KAAA;AAEnC,QAAA,IAAI,CAAC,KAAO,EAAA;AACV,UAAM,MAAA,IAAI,MAAM,4CAA4C,CAAA;AAAA;AAG9D,QAAA,OAAO,GAAI,CAAA,qBAAA;AAAA,UACT;AAAA,YACE,WAAa,EAAA;AAAA,cACX,kBAAoB,EAAA;AAAA;AACtB,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CACL,GAAA,EAAE,WAAW,EAAE,IAAA,EAAM,KAAM,EAAA,EAC3B,GAAA,KAAA;AAAA;AACR,SACF;AAAA,OACF;AAAA;AACF,GACD,CAAA;AAKM,EAAMF,sBAAAA,CAAA,iCAAiCC,0CAA4B,CAAA;AAAA,IACxE,aAAA,EAAeC,MACZ,MAAO,CAAA;AAAA,MACN,0CAA4C,EAAAA,KAAA,CAAE,OAAQ,EAAA,CAAE,QAAS;AAAA,KAClE,EACA,QAAS,EAAA;AAAA,IACZ,MAAA,CAAO,OAAU,GAAA,EAAI,EAAA;AACnB,MAAO,OAAA,OAAO,MAAgC,GAAQ,KAAA;AACpD,QAAM,MAAA,MAAA,GAAS,KAAK,MAAO,CAAA,QAAA,CAAS,IAAI,KAAM,CAAA,GAAG,EAAE,CAAC,CAAA;AAEpD,QAAA,OAAO,GAAI,CAAA,qBAAA;AAAA,UACT;AAAA,YACE,WAAa,EAAA;AAAA,cACX,oBAAsB,EAAA;AAAA;AACxB,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CACL,GAAA,EAAE,WAAW,EAAE,IAAA,EAAM,MAAO,EAAA,EAC5B,GAAA,KAAA;AAAA;AACR,SACF;AAAA,OACF;AAAA;AACF,GACD,CAAA;AAAA,CA/Dc,EAAAF,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-gcp-iap-provider",
-  "version": "0.4.3-next.1",
+  "version": "0.4.3-next.2",
   "description": "A GCP IAP auth provider module for the Backstage auth backend",
   "backstage": {
     "role": "backend-plugin-module",
@@ -41,15 +41,16 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.3.1-next.1",
+    "@backstage/backend-plugin-api": "1.3.1-next.2",
     "@backstage/errors": "1.2.7",
-    "@backstage/plugin-auth-node": "0.6.3-next.1",
+    "@backstage/plugin-auth-node": "0.6.3-next.2",
     "@backstage/types": "1.2.1",
-    "google-auth-library": "^9.0.0"
+    "google-auth-library": "^9.0.0",
+    "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "1.5.0-next.1",
-    "@backstage/cli": "0.32.1-next.1",
+    "@backstage/backend-test-utils": "1.5.0-next.3",
+    "@backstage/cli": "0.32.1-next.3",
     "express": "^4.18.2"
   },
   "configSchema": "config.d.ts",