@backstage/plugin-auth-backend-module-github-provider 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @backstage/plugin-auth-backend-module-github-provider
 
+## 0.5.7
+
+### Patch Changes
+
+- 211a61a: Deprecated the GitHub username sign-in resolver in favor of the stable user ID resolver. GitHub user ID catalog lookups now require an exact match and handle candidates that differ only by letter casing.
+- Updated dependencies
+  - @backstage/catalog-model@1.10.1
+  - @backstage/plugin-auth-node@0.7.6
+  - @backstage/backend-plugin-api@1.10.1
+  - @backstage/plugin-catalog-node@2.2.5
+
+## 0.5.7-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.7.5-next.0
+  - @backstage/backend-plugin-api@1.10.1-next.0
+
 ## 0.5.6
 
 ### Patch Changes

package/config.schema.json

@@ -51,7 +51,8 @@
                               "properties": {
                                 "resolver": {
                                   "type": "string",
-                                  "const": "usernameMatchingUserEntityName"
+                                  "const": "usernameMatchingUserEntityName",
+                                  "deprecated": "Use `userIdMatchingUserEntityAnnotation` instead."
                                 },
                                 "dangerouslyAllowSignInWithoutUserInCatalog": {
                                   "type": "boolean"

package/dist/index.d.ts

@@ -20,6 +20,9 @@ declare const authModuleGithubProvider: _backstage_backend_plugin_api.BackendFea
 declare namespace githubSignInResolvers {
     /**
      * Looks up the user by matching their GitHub username to the entity name.
+     *
+     * @deprecated Use {@link githubSignInResolvers.userIdMatchingUserEntityAnnotation}
+     * instead, because GitHub usernames can change and be reassigned.
      */
     const usernameMatchingUserEntityName: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<GithubProfile>, {
         dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;

package/dist/module.cjs.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var backendPluginApi = require('@backstage/backend-plugin-api');
+var pluginCatalogNode = require('@backstage/plugin-catalog-node');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var authenticator = require('./authenticator.cjs.js');
 var resolvers = require('./resolvers.cjs.js');
@@ -11,15 +12,17 @@ const authModuleGithubProvider = backendPluginApi.createBackendModule({
   register(reg) {
     reg.registerInit({
       deps: {
-        providers: pluginAuthNode.authProvidersExtensionPoint
+        providers: pluginAuthNode.authProvidersExtensionPoint,
+        auth: backendPluginApi.coreServices.auth,
+        catalog: pluginCatalogNode.catalogServiceRef
       },
-      async init({ providers }) {
+      async init({ providers, auth, catalog }) {
         providers.registerProvider({
           providerId: "github",
           factory: pluginAuthNode.createOAuthProviderFactory({
             authenticator: authenticator.githubAuthenticator,
             signInResolverFactories: {
-              ...resolvers.githubSignInResolvers,
+              ...resolvers.createGithubProviderSignInResolvers({ auth, catalog }),
               ...pluginAuthNode.commonSignInResolvers
             }
           })

package/dist/module.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { githubAuthenticator } from './authenticator';\nimport { githubSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleGithubProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'github-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'github',\n          factory: createOAuthProviderFactory({\n            authenticator: githubAuthenticator,\n            signInResolverFactories: {\n              ...githubSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","githubAuthenticator","githubSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;AAyBO,MAAM,2BAA2BA,oCAAA,CAAoB;AAAA,EAC1D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,iBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,SAAA,EAAWC;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAU,EAAG;AACxB,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,QAAA;AAAA,UACZ,SAASC,yCAAA,CAA2B;AAAA,YAClC,aAAA,EAAeC,iCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC,+BAAA;AAAA,cACH,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { githubAuthenticator } from './authenticator';\nimport { createGithubProviderSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleGithubProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'github-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n        auth: coreServices.auth,\n        catalog: catalogServiceRef,\n      },\n      async init({ providers, auth, catalog }) {\n        providers.registerProvider({\n          providerId: 'github',\n          factory: createOAuthProviderFactory({\n            authenticator: githubAuthenticator,\n            signInResolverFactories: {\n              ...createGithubProviderSignInResolvers({ auth, catalog }),\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","coreServices","catalogServiceRef","createOAuthProviderFactory","githubAuthenticator","createGithubProviderSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;;AA6BO,MAAM,2BAA2BA,oCAAA,CAAoB;AAAA,EAC1D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,iBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,SAAA,EAAWC,0CAAA;AAAA,QACX,MAAMC,6BAAA,CAAa,IAAA;AAAA,QACnB,OAAA,EAASC;AAAA,OACX;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,SAAQ,EAAG;AACvC,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,QAAA;AAAA,UACZ,SAASC,yCAAA,CAA2B;AAAA,YAClC,aAAA,EAAeC,iCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC,6CAAA,CAAoC,EAAE,IAAA,EAAM,SAAS,CAAA;AAAA,cACxD,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}

package/dist/resolvers.cjs.js

@@ -1,8 +1,38 @@
 'use strict';
 
+var catalogModel = require('@backstage/catalog-model');
+var errors = require('@backstage/errors');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var v3 = require('zod/v3');
 
+const GITHUB_USER_ID_ANNOTATION = "github.com/user-id";
+function requireMatchingGithubUserId(entity, userId) {
+  if (entity.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] !== userId) {
+    throw new Error(`GitHub user ID does not match the catalog user`);
+  }
+}
+async function signInWithCatalogEntity(entity, ctx) {
+  const { ownershipEntityRefs } = await ctx.resolveOwnershipEntityRefs(entity);
+  return ctx.issueToken({
+    claims: {
+      sub: catalogModel.stringifyEntityRef(entity),
+      ent: ownershipEntityRefs
+    }
+  });
+}
+async function signInWithoutCatalogUser(name, ctx) {
+  const userEntityRef = catalogModel.stringifyEntityRef({
+    kind: "User",
+    namespace: catalogModel.DEFAULT_NAMESPACE,
+    name
+  });
+  return ctx.issueToken({
+    claims: {
+      sub: userEntityRef,
+      ent: [userEntityRef]
+    }
+  });
+}
 exports.githubSignInResolvers = void 0;
 ((githubSignInResolvers2) => {
   githubSignInResolvers2.usernameMatchingUserEntityName = pluginAuthNode.createSignInResolverFactory({
@@ -39,19 +69,73 @@ exports.githubSignInResolvers = void 0;
           if (!userId) {
             throw new Error(`GitHub user profile does not contain a user ID`);
           }
-          return ctx.signInWithCatalogUser(
-            {
-              annotations: {
-                "github.com/user-id": userId
-              }
-            },
-            {
-              dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: userId } } : void 0
+          const query = {
+            annotations: {
+              [GITHUB_USER_ID_ANNOTATION]: userId
             }
-          );
+          };
+          let entity;
+          try {
+            ({ entity } = await ctx.findCatalogUser(query));
+          } catch (error) {
+            if (!errors.isError(error) || error.name !== "NotFoundError" || !options.dangerouslyAllowSignInWithoutUserInCatalog) {
+              throw error;
+            }
+            return signInWithoutCatalogUser(userId, ctx);
+          }
+          requireMatchingGithubUserId(entity, userId);
+          return signInWithCatalogEntity(entity, ctx);
         };
       }
     }
   );
 })(exports.githubSignInResolvers || (exports.githubSignInResolvers = {}));
+function createGithubProviderSignInResolvers(options) {
+  return {
+    ...exports.githubSignInResolvers,
+    userIdMatchingUserEntityAnnotation: pluginAuthNode.createSignInResolverFactory({
+      optionsSchema: v3.z.object({
+        dangerouslyAllowSignInWithoutUserInCatalog: v3.z.boolean().optional()
+      }).optional(),
+      create(resolverOptions = {}) {
+        return async (info, ctx) => {
+          const userId = info.result.fullProfile.nodeId;
+          if (!userId) {
+            throw new Error(`GitHub user profile does not contain a user ID`);
+          }
+          const credentials = await options.auth.getOwnServiceCredentials();
+          const { items } = await options.catalog.getEntities(
+            {
+              filter: {
+                kind: "user",
+                [`metadata.annotations.${GITHUB_USER_ID_ANNOTATION}`]: userId
+              }
+            },
+            { credentials }
+          );
+          const exactMatches = items.filter(
+            (item) => item.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] === userId
+          );
+          if (exactMatches.length > 1) {
+            throw new errors.ConflictError(
+              "User lookup resulted in multiple exact matches"
+            );
+          }
+          if (exactMatches.length === 1) {
+            return signInWithCatalogEntity(exactMatches[0], ctx);
+          }
+          if (items.length > 0) {
+            throw new Error(`GitHub user ID does not match the catalog user`);
+          }
+          if (resolverOptions.dangerouslyAllowSignInWithoutUserInCatalog) {
+            return signInWithoutCatalogUser(userId, ctx);
+          }
+          throw new errors.NotFoundError("User not found");
+        };
+      }
+    })
+  };
+}
+
+exports.createGithubProviderSignInResolvers = createGithubProviderSignInResolvers;
 //# sourceMappingURL=resolvers.cjs.js.map

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { z } from 'zod/v3';\n\nimport { GithubProfile } from './authenticator';\n\n/**\n * Available sign-in resolvers for the GitHub auth provider.\n *\n * @public\n */\nexport namespace githubSignInResolvers {\n  /**\n   * Looks up the user by matching their GitHub username to the entity name.\n   */\n  export const usernameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n        ctx,\n      ) => {\n        const { fullProfile } = info.result;\n\n        const userId = fullProfile.username;\n        if (!userId) {\n          throw new Error(`GitHub user profile does not contain a username`);\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            entityRef: { name: userId },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their GitHub user ID to the github.com/user-id annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(options = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx,\n        ) => {\n          const { fullProfile } = info.result;\n\n          const userId = fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          return ctx.signInWithCatalogUser(\n            {\n              annotations: {\n                'github.com/user-id': userId,\n              },\n            },\n            {\n              dangerousEntityRefFallback:\n                options?.dangerouslyAllowSignInWithoutUserInCatalog\n                  ? { entityRef: { name: userId } }\n                  : undefined,\n            },\n          );\n        };\n      },\n    },\n  );\n}\n"],"names":["githubSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA8BiBA;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAIE,EAAMA,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,QAAA,MAAM,SAAS,WAAA,CAAY,QAAA;AAC3B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA;AAAO,WAC5B;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,uBAAA,kCAAA,GAAqCC,0CAAA;AAAA,IAChD;AAAA,MACE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,UAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,YACT;AAAA,cACE,WAAA,EAAa;AAAA,gBACX,oBAAA,EAAsB;AAAA;AACxB,aACF;AAAA,YACA;AAAA,cACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,WACF;AAAA,QACF,CAAA;AAAA,MACF;AAAA;AACF,GACF;AAAA,CAAA,EA3EeF,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DEFAULT_NAMESPACE,\n  stringifyEntityRef,\n  type Entity,\n} from '@backstage/catalog-model';\nimport type { AuthService } from '@backstage/backend-plugin-api';\nimport { ConflictError, isError, NotFoundError } from '@backstage/errors';\nimport {\n  type AuthResolverContext,\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport type { CatalogService } from '@backstage/plugin-catalog-node';\nimport { z } from 'zod/v3';\n\nimport { GithubProfile } from './authenticator';\n\nconst GITHUB_USER_ID_ANNOTATION = 'github.com/user-id';\n\nfunction requireMatchingGithubUserId(entity: Entity, userId: string) {\n  if (entity.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] !== userId) {\n    throw new Error(`GitHub user ID does not match the catalog user`);\n  }\n}\n\nasync function signInWithCatalogEntity(\n  entity: Entity,\n  ctx: AuthResolverContext,\n) {\n  const { ownershipEntityRefs } = await ctx.resolveOwnershipEntityRefs(entity);\n  return ctx.issueToken({\n    claims: {\n      sub: stringifyEntityRef(entity),\n      ent: ownershipEntityRefs,\n    },\n  });\n}\n\nasync function signInWithoutCatalogUser(\n  name: string,\n  ctx: AuthResolverContext,\n) {\n  const userEntityRef = stringifyEntityRef({\n    kind: 'User',\n    namespace: DEFAULT_NAMESPACE,\n    name,\n  });\n  return ctx.issueToken({\n    claims: {\n      sub: userEntityRef,\n      ent: [userEntityRef],\n    },\n  });\n}\n\n/**\n * Available sign-in resolvers for the GitHub auth provider.\n *\n * @public\n */\nexport namespace githubSignInResolvers {\n  /**\n   * Looks up the user by matching their GitHub username to the entity name.\n   *\n   * @deprecated Use {@link githubSignInResolvers.userIdMatchingUserEntityAnnotation}\n   * instead, because GitHub usernames can change and be reassigned.\n   */\n  export const usernameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n        ctx,\n      ) => {\n        const { fullProfile } = info.result;\n\n        const userId = fullProfile.username;\n        if (!userId) {\n          throw new Error(`GitHub user profile does not contain a username`);\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            entityRef: { name: userId },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their GitHub user ID to the github.com/user-id annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(options = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx,\n        ) => {\n          const { fullProfile } = info.result;\n\n          const userId = fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          const query = {\n            annotations: {\n              [GITHUB_USER_ID_ANNOTATION]: userId,\n            },\n          };\n\n          let entity;\n          try {\n            ({ entity } = await ctx.findCatalogUser(query));\n          } catch (error) {\n            if (\n              !isError(error) ||\n              error.name !== 'NotFoundError' ||\n              !options.dangerouslyAllowSignInWithoutUserInCatalog\n            ) {\n              throw error;\n            }\n\n            return signInWithoutCatalogUser(userId, ctx);\n          }\n\n          requireMatchingGithubUserId(entity, userId);\n          return signInWithCatalogEntity(entity, ctx);\n        };\n      },\n    },\n  );\n}\n\n/**\n * Creates the resolver map used by the built-in GitHub provider module.\n *\n * @remarks\n *\n * The service-aware user ID resolver can inspect all case-insensitive catalog\n * matches and select the exact ID. The public resolver remains fail-closed when\n * its context reports an ambiguous lookup.\n *\n * @internal\n */\nexport function createGithubProviderSignInResolvers(options: {\n  auth: AuthService;\n  catalog: CatalogService;\n}) {\n  return {\n    ...githubSignInResolvers,\n    userIdMatchingUserEntityAnnotation: createSignInResolverFactory({\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(resolverOptions = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx: AuthResolverContext,\n        ) => {\n          const userId = info.result.fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          const credentials = await options.auth.getOwnServiceCredentials();\n          const { items } = await options.catalog.getEntities(\n            {\n              filter: {\n                kind: 'user',\n                [`metadata.annotations.${GITHUB_USER_ID_ANNOTATION}`]: userId,\n              },\n            },\n            { credentials },\n          );\n          const exactMatches = items.filter(\n            item =>\n              item.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] === userId,\n          );\n\n          if (exactMatches.length > 1) {\n            throw new ConflictError(\n              'User lookup resulted in multiple exact matches',\n            );\n          }\n          if (exactMatches.length === 1) {\n            return signInWithCatalogEntity(exactMatches[0], ctx);\n          }\n          if (items.length > 0) {\n            throw new Error(`GitHub user ID does not match the catalog user`);\n          }\n          if (resolverOptions.dangerouslyAllowSignInWithoutUserInCatalog) {\n            return signInWithoutCatalogUser(userId, ctx);\n          }\n          throw new NotFoundError('User not found');\n        };\n      },\n    }),\n  };\n}\n"],"names":["stringifyEntityRef","DEFAULT_NAMESPACE","githubSignInResolvers","createSignInResolverFactory","z","isError","ConflictError","NotFoundError"],"mappings":";;;;;;;AAkCA,MAAM,yBAAA,GAA4B,oBAAA;AAElC,SAAS,2BAAA,CAA4B,QAAgB,MAAA,EAAgB;AACnE,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,WAAA,GAAc,yBAAyB,MAAM,MAAA,EAAQ;AACvE,IAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,EAClE;AACF;AAEA,eAAe,uBAAA,CACb,QACA,GAAA,EACA;AACA,EAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,GAAA,CAAI,2BAA2B,MAAM,CAAA;AAC3E,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,MAAA,EAAQ;AAAA,MACN,GAAA,EAAKA,gCAAmB,MAAM,CAAA;AAAA,MAC9B,GAAA,EAAK;AAAA;AACP,GACD,CAAA;AACH;AAEA,eAAe,wBAAA,CACb,MACA,GAAA,EACA;AACA,EAAA,MAAM,gBAAgBA,+BAAA,CAAmB;AAAA,IACvC,IAAA,EAAM,MAAA;AAAA,IACN,SAAA,EAAWC,8BAAA;AAAA,IACX;AAAA,GACD,CAAA;AACD,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,aAAA;AAAA,MACL,GAAA,EAAK,CAAC,aAAa;AAAA;AACrB,GACD,CAAA;AACH;AAOiBC;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAOE,EAAMA,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,QAAA,MAAM,SAAS,WAAA,CAAY,QAAA;AAC3B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA;AAAO,WAC5B;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,uBAAA,kCAAA,GAAqCC,0CAAA;AAAA,IAChD;AAAA,MACE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,UAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,KAAA,GAAQ;AAAA,YACZ,WAAA,EAAa;AAAA,cACX,CAAC,yBAAyB,GAAG;AAAA;AAC/B,WACF;AAEA,UAAA,IAAI,MAAA;AACJ,UAAA,IAAI;AACF,YAAA,CAAC,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,gBAAgB,KAAK,CAAA;AAAA,UAC/C,SAAS,KAAA,EAAO;AACd,YAAA,IACE,CAACC,eAAQ,KAAK,CAAA,IACd,MAAM,IAAA,KAAS,eAAA,IACf,CAAC,OAAA,CAAQ,0CAAA,EACT;AACA,cAAA,MAAM,KAAA;AAAA,YACR;AAEA,YAAA,OAAO,wBAAA,CAAyB,QAAQ,GAAG,CAAA;AAAA,UAC7C;AAEA,UAAA,2BAAA,CAA4B,QAAQ,MAAM,CAAA;AAC1C,UAAA,OAAO,uBAAA,CAAwB,QAAQ,GAAG,CAAA;AAAA,QAC5C,CAAA;AAAA,MACF;AAAA;AACF,GACF;AAAA,CAAA,EAxFeH,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;AAsGV,SAAS,oCAAoC,OAAA,EAGjD;AACD,EAAA,OAAO;AAAA,IACL,GAAGA,6BAAA;AAAA,IACH,oCAAoCC,0CAAA,CAA4B;AAAA,MAC9D,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,eAAA,GAAkB,EAAC,EAAG;AAC3B,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,MAAA;AACvC,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA,CAAK,wBAAA,EAAyB;AAChE,UAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAQ,OAAA,CAAQ,WAAA;AAAA,YACtC;AAAA,cACE,MAAA,EAAQ;AAAA,gBACN,IAAA,EAAM,MAAA;AAAA,gBACN,CAAC,CAAA,qBAAA,EAAwB,yBAAyB,CAAA,CAAE,GAAG;AAAA;AACzD,aACF;AAAA,YACA,EAAE,WAAA;AAAY,WAChB;AACA,UAAA,MAAM,eAAe,KAAA,CAAM,MAAA;AAAA,YACzB,CAAA,IAAA,KACE,IAAA,CAAK,QAAA,CAAS,WAAA,GAAc,yBAAyB,CAAA,KAAM;AAAA,WAC/D;AAEA,UAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,YAAA,MAAM,IAAIE,oBAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AACA,UAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,YAAA,OAAO,uBAAA,CAAwB,YAAA,CAAa,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,UACrD;AACA,UAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AACA,UAAA,IAAI,gBAAgB,0CAAA,EAA4C;AAC9D,YAAA,OAAO,wBAAA,CAAyB,QAAQ,GAAG,CAAA;AAAA,UAC7C;AACA,UAAA,MAAM,IAAIC,qBAAc,gBAAgB,CAAA;AAAA,QAC1C,CAAA;AAAA,MACF;AAAA,KACD;AAAA,GACH;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-github-provider",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "The github-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -37,16 +37,19 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.10.0",
-    "@backstage/plugin-auth-node": "^0.7.4",
+    "@backstage/backend-plugin-api": "^1.10.1",
+    "@backstage/catalog-model": "^1.10.1",
+    "@backstage/errors": "^1.3.1",
+    "@backstage/plugin-auth-node": "^0.7.6",
+    "@backstage/plugin-catalog-node": "^2.2.5",
     "passport-github2": "^0.1.12",
     "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.17.7",
-    "@backstage/backend-test-utils": "^1.11.6",
-    "@backstage/cli": "^0.36.5",
-    "@backstage/plugin-auth-backend": "^0.30.0",
+    "@backstage/backend-defaults": "^0.18.0",
+    "@backstage/backend-test-utils": "^1.11.7",
+    "@backstage/cli": "^0.36.6",
+    "@backstage/plugin-auth-backend": "^0.30.1",
     "@backstage/types": "^1.2.2",
     "@types/passport-github2": "^1.2.4",
     "supertest": "^7.0.0"