@backstage/plugin-auth-backend-module-github-provider 0.5.7 → 0.5.8-next.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @backstage/plugin-auth-backend-module-github-provider
 
+## 0.5.8-next.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.11.0-next.1
+  - @backstage/plugin-auth-node@0.7.7-next.1
+  - @backstage/plugin-catalog-node@2.2.6-next.1
+
+## 0.5.8-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/errors@1.3.2-next.0
+  - @backstage/backend-plugin-api@1.10.2-next.0
+  - @backstage/plugin-auth-node@0.7.7-next.0
+  - @backstage/catalog-model@1.10.2-next.0
+  - @backstage/plugin-catalog-node@2.2.6-next.0
+
 ## 0.5.7
 
 ### Patch Changes

package/dist/authenticator.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Strategy as GithubStrategy } from 'passport-github2';\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport type GithubProfile = PassportProfile & {\n  nodeId?: string;\n};\n\nconst ACCESS_TOKEN_PREFIX = 'access-token-v2.';\n\n/** @public */\nexport const githubAuthenticator = createOAuthAuthenticator<\n  PassportOAuthAuthenticatorHelper,\n  GithubProfile\n>({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    persist: true,\n    required: ['read:user'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const enterpriseInstanceUrl = config\n      .getOptionalString('enterpriseInstanceUrl')\n      ?.replace(/\\/$/, '');\n    const authorizationUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/authorize`\n      : undefined;\n    const tokenUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/access_token`\n      : undefined;\n    const userProfileUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/api/v3/user`\n      : undefined;\n\n    return PassportOAuthAuthenticatorHelper.from(\n      new GithubStrategy(\n        {\n          clientID: clientId,\n          clientSecret: clientSecret,\n          callbackURL: callbackUrl,\n          tokenURL: tokenUrl,\n          userProfileURL: userProfileUrl,\n          authorizationURL: authorizationUrl,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            { fullProfile, params, accessToken },\n            { refreshToken },\n          );\n        },\n      ),\n    );\n  },\n\n  async start(input, helper) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n\n  async authenticate(input, helper) {\n    const { fullProfile, session } = await helper.authenticate(input);\n\n    // If we do not have a real refresh token and we have a non-expiring\n    // access token, then we use that as our refresh token.\n    if (!session.refreshToken && !session.expiresInSeconds) {\n      session.refreshToken = ACCESS_TOKEN_PREFIX + session.accessToken;\n    }\n    return { fullProfile: fullProfile as GithubProfile, session };\n  },\n\n  async refresh(input, helper) {\n    // This is the OAuth App flow. A non-expiring access token is stored in the\n    // refresh token cookie. We use that token to fetch the user profile and\n    // refresh the Backstage session when needed.\n    if (input.refreshToken?.startsWith(ACCESS_TOKEN_PREFIX)) {\n      if (!input.scopeAlreadyGranted) {\n        throw new Error(\n          'Refresh failed, session has not been granted the requested scope',\n        );\n      }\n      const accessToken = input.refreshToken.slice(ACCESS_TOKEN_PREFIX.length);\n\n      const fullProfile = await helper\n        .fetchProfile(accessToken)\n        .catch(error => {\n          if (error.oauthError?.statusCode === 401) {\n            throw new Error('Invalid access token');\n          }\n          throw error;\n        });\n\n      return {\n        fullProfile: fullProfile as GithubProfile,\n        session: {\n          accessToken,\n          tokenType: 'bearer',\n          scope: input.scope,\n          refreshToken: input.refreshToken,\n          // No expiration\n        },\n      };\n    }\n\n    // This is the App flow, which is close to a standard OAuth refresh flow. It has a\n    // pretty long session expiration, and it also ignores the requested scope, instead\n    // just allowing access to whatever is configured as part of the app installation.\n    return helper.refresh(input);\n  },\n});\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","GithubStrategy"],"mappings":";;;;;AA6BA,MAAM,mBAAA,GAAsB,kBAAA;AAGrB,MAAM,sBAAsBA,uCAAA,CAGjC;AAAA,EACA,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,wBAAwB,MAAA,CAC3B,iBAAA,CAAkB,uBAAuB,CAAA,EACxC,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrB,IAAA,MAAM,gBAAA,GAAmB,qBAAA,GACrB,CAAA,EAAG,qBAAqB,CAAA,sBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,QAAA,GAAW,qBAAA,GACb,CAAA,EAAG,qBAAqB,CAAA,yBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,qBAAA,GACnB,CAAA,EAAG,qBAAqB,CAAA,YAAA,CAAA,GACxB,MAAA;AAEJ,IAAA,OAAOA,+CAAA,CAAiC,IAAA;AAAA,MACtC,IAAIC,wBAAA;AAAA,QACF;AAAA,UACE,QAAA,EAAU,QAAA;AAAA,UACV,YAAA;AAAA,UACA,WAAA,EAAa,WAAA;AAAA,UACb,QAAA,EAAU,QAAA;AAAA,UACV,cAAA,EAAgB,cAAA;AAAA,UAChB,gBAAA,EAAkB;AAAA,SACpB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,WAAA,EAAa,MAAA,EAAQ,WAAA,EAAY;AAAA,YACnC,EAAE,YAAA;AAAa,WACjB;AAAA,QACF;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ;AACzB,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CAAa,KAAA,EAAO,MAAA,EAAQ;AAChC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAIhE,IAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,CAAC,QAAQ,gBAAA,EAAkB;AACtD,MAAA,OAAA,CAAQ,YAAA,GAAe,sBAAsB,OAAA,CAAQ,WAAA;AAAA,IACvD;AACA,IAAA,OAAO,EAAE,aAA2C,OAAA,EAAQ;AAAA,EAC9D,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ;AAI3B,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,UAAA,CAAW,mBAAmB,CAAA,EAAG;AACvD,MAAA,IAAI,CAAC,MAAM,mBAAA,EAAqB;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,YAAA,CAAa,KAAA,CAAM,oBAAoB,MAAM,CAAA;AAEvE,MAAA,MAAM,cAAc,MAAM,MAAA,CACvB,aAAa,WAAW,CAAA,CACxB,MAAM,CAAA,KAAA,KAAS;AACd,QAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,UAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,QACxC;AACA,QAAA,MAAM,KAAA;AAAA,MACR,CAAC,CAAA;AAEH,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,WAAA;AAAA,UACA,SAAA,EAAW,QAAA;AAAA,UACX,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,cAAc,KAAA,CAAM;AAAA;AAAA;AAEtB,OACF;AAAA,IACF;AAKA,IAAA,OAAO,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,EAC7B;AACF,CAAC;;;;"}
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Strategy as GithubStrategy } from 'passport-github2';\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport type GithubProfile = PassportProfile & {\n  nodeId?: string;\n};\n\nconst ACCESS_TOKEN_PREFIX = 'access-token-v2.';\n\n/** @public */\nexport const githubAuthenticator = createOAuthAuthenticator<\n  PassportOAuthAuthenticatorHelper,\n  GithubProfile\n>({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    persist: true,\n    required: ['read:user'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const enterpriseInstanceUrl = config\n      .getOptionalString('enterpriseInstanceUrl')\n      ?.replace(/\\/$/, '');\n    const authorizationUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/authorize`\n      : undefined;\n    const tokenUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/access_token`\n      : undefined;\n    const userProfileUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/api/v3/user`\n      : undefined;\n\n    return PassportOAuthAuthenticatorHelper.from(\n      new GithubStrategy(\n        {\n          clientID: clientId,\n          clientSecret: clientSecret,\n          callbackURL: callbackUrl,\n          tokenURL: tokenUrl,\n          userProfileURL: userProfileUrl,\n          authorizationURL: authorizationUrl,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            { fullProfile, params, accessToken },\n            { refreshToken },\n          );\n        },\n      ),\n    );\n  },\n\n  async start(input, helper) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n\n  async authenticate(input, helper) {\n    const { fullProfile, session } = await helper.authenticate(input);\n\n    // If we do not have a real refresh token and we have a non-expiring\n    // access token, then we use that as our refresh token.\n    if (!session.refreshToken && !session.expiresInSeconds) {\n      session.refreshToken = ACCESS_TOKEN_PREFIX + session.accessToken;\n    }\n    return { fullProfile: fullProfile as GithubProfile, session };\n  },\n\n  async refresh(input, helper) {\n    // This is the OAuth App flow. A non-expiring access token is stored in the\n    // refresh token cookie. We use that token to fetch the user profile and\n    // refresh the Backstage session when needed.\n    if (input.refreshToken?.startsWith(ACCESS_TOKEN_PREFIX)) {\n      if (!input.scopeAlreadyGranted) {\n        throw new Error(\n          'Refresh failed, session has not been granted the requested scope',\n        );\n      }\n      const accessToken = input.refreshToken.slice(ACCESS_TOKEN_PREFIX.length);\n\n      const fullProfile = await helper\n        .fetchProfile(accessToken)\n        .catch(error => {\n          if (error.oauthError?.statusCode === 401) {\n            throw new Error('Invalid access token');\n          }\n          throw error;\n        });\n\n      return {\n        fullProfile: fullProfile as GithubProfile,\n        session: {\n          accessToken,\n          tokenType: 'bearer',\n          scope: input.scope,\n          refreshToken: input.refreshToken,\n          // No expiration\n        },\n      };\n    }\n\n    // This is the App flow, which is close to a standard OAuth refresh flow. It has a\n    // pretty long session expiration, and it also ignores the requested scope, instead\n    // just allowing access to whatever is configured as part of the app installation.\n    return helper.refresh(input);\n  },\n});\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","GithubStrategy"],"mappings":";;;;;AA6BA,MAAM,mBAAA,GAAsB,kBAAA;AAGrB,MAAM,sBAAsBA,uCAAA,CAGjC;AAAA,EACA,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,wBAAwB,MAAA,CAC3B,iBAAA,CAAkB,uBAAuB,CAAA,EACxC,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrB,IAAA,MAAM,gBAAA,GAAmB,qBAAA,GACrB,CAAA,EAAG,qBAAqB,CAAA,sBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,QAAA,GAAW,qBAAA,GACb,CAAA,EAAG,qBAAqB,CAAA,yBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,qBAAA,GACnB,CAAA,EAAG,qBAAqB,CAAA,YAAA,CAAA,GACxB,MAAA;AAEJ,IAAA,OAAOA,+CAAA,CAAiC,IAAA;AAAA,MACtC,IAAIC,wBAAA;AAAA,QACF;AAAA,UACE,QAAA,EAAU,QAAA;AAAA,UACV,YAAA;AAAA,UACA,WAAA,EAAa,WAAA;AAAA,UACb,QAAA,EAAU,QAAA;AAAA,UACV,cAAA,EAAgB,cAAA;AAAA,UAChB,gBAAA,EAAkB;AAAA,SACpB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,WAAA,EAAa,MAAA,EAAQ,WAAA,EAAY;AAAA,YACnC,EAAE,YAAA;AAAa,WACjB;AAAA,QACF;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ;AACzB,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CAAa,KAAA,EAAO,MAAA,EAAQ;AAChC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAIhE,IAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,CAAC,QAAQ,gBAAA,EAAkB;AACtD,MAAA,OAAA,CAAQ,YAAA,GAAe,sBAAsB,OAAA,CAAQ,WAAA;AAAA,IACvD;AACA,IAAA,OAAO,EAAE,aAA2C,OAAA,EAAQ;AAAA,EAC9D,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ;AAI3B,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,UAAA,CAAW,mBAAmB,CAAA,EAAG;AACvD,MAAA,IAAI,CAAC,MAAM,mBAAA,EAAqB;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,YAAA,CAAa,KAAA,CAAM,oBAAoB,MAAM,CAAA;AAEvE,MAAA,MAAM,cAAc,MAAM,MAAA,CACvB,aAAa,WAAW,CAAA,CACxB,MAAM,CAAA,KAAA,KAAS;AACd,QAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,UAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,QACxC;AACA,QAAA,MAAM,KAAA;AAAA,MACR,CAAC,CAAA;AAEH,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,WAAA;AAAA,UACA,SAAA,EAAW,QAAA;AAAA,UACX,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,cAAc,KAAA,CAAM;AAAA;AAAA;AAEtB,OACF;AAAA,IACF;AAKA,IAAA,OAAO,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,EAC7B;AACF,CAAC;;"}

package/dist/module.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { githubAuthenticator } from './authenticator';\nimport { createGithubProviderSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleGithubProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'github-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n        auth: coreServices.auth,\n        catalog: catalogServiceRef,\n      },\n      async init({ providers, auth, catalog }) {\n        providers.registerProvider({\n          providerId: 'github',\n          factory: createOAuthProviderFactory({\n            authenticator: githubAuthenticator,\n            signInResolverFactories: {\n              ...createGithubProviderSignInResolvers({ auth, catalog }),\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","coreServices","catalogServiceRef","createOAuthProviderFactory","githubAuthenticator","createGithubProviderSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;;AA6BO,MAAM,2BAA2BA,oCAAA,CAAoB;AAAA,EAC1D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,iBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,SAAA,EAAWC,0CAAA;AAAA,QACX,MAAMC,6BAAA,CAAa,IAAA;AAAA,QACnB,OAAA,EAASC;AAAA,OACX;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,SAAQ,EAAG;AACvC,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,QAAA;AAAA,UACZ,SAASC,yCAAA,CAA2B;AAAA,YAClC,aAAA,EAAeC,iCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC,6CAAA,CAAoC,EAAE,IAAA,EAAM,SAAS,CAAA;AAAA,cACxD,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { githubAuthenticator } from './authenticator';\nimport { createGithubProviderSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleGithubProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'github-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n        auth: coreServices.auth,\n        catalog: catalogServiceRef,\n      },\n      async init({ providers, auth, catalog }) {\n        providers.registerProvider({\n          providerId: 'github',\n          factory: createOAuthProviderFactory({\n            authenticator: githubAuthenticator,\n            signInResolverFactories: {\n              ...createGithubProviderSignInResolvers({ auth, catalog }),\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","coreServices","catalogServiceRef","createOAuthProviderFactory","githubAuthenticator","createGithubProviderSignInResolvers","commonSignInResolvers"],"mappings":";;;;;;;;AA6BO,MAAM,2BAA2BA,oCAAA,CAAoB;AAAA,EAC1D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,iBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,SAAA,EAAWC,0CAAA;AAAA,QACX,MAAMC,6BAAA,CAAa,IAAA;AAAA,QACnB,OAAA,EAASC;AAAA,OACX;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,SAAQ,EAAG;AACvC,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,QAAA;AAAA,UACZ,SAASC,yCAAA,CAA2B;AAAA,YAClC,aAAA,EAAeC,iCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC,6CAAA,CAAoC,EAAE,IAAA,EAAM,SAAS,CAAA;AAAA,cACxD,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;"}

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DEFAULT_NAMESPACE,\n  stringifyEntityRef,\n  type Entity,\n} from '@backstage/catalog-model';\nimport type { AuthService } from '@backstage/backend-plugin-api';\nimport { ConflictError, isError, NotFoundError } from '@backstage/errors';\nimport {\n  type AuthResolverContext,\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport type { CatalogService } from '@backstage/plugin-catalog-node';\nimport { z } from 'zod/v3';\n\nimport { GithubProfile } from './authenticator';\n\nconst GITHUB_USER_ID_ANNOTATION = 'github.com/user-id';\n\nfunction requireMatchingGithubUserId(entity: Entity, userId: string) {\n  if (entity.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] !== userId) {\n    throw new Error(`GitHub user ID does not match the catalog user`);\n  }\n}\n\nasync function signInWithCatalogEntity(\n  entity: Entity,\n  ctx: AuthResolverContext,\n) {\n  const { ownershipEntityRefs } = await ctx.resolveOwnershipEntityRefs(entity);\n  return ctx.issueToken({\n    claims: {\n      sub: stringifyEntityRef(entity),\n      ent: ownershipEntityRefs,\n    },\n  });\n}\n\nasync function signInWithoutCatalogUser(\n  name: string,\n  ctx: AuthResolverContext,\n) {\n  const userEntityRef = stringifyEntityRef({\n    kind: 'User',\n    namespace: DEFAULT_NAMESPACE,\n    name,\n  });\n  return ctx.issueToken({\n    claims: {\n      sub: userEntityRef,\n      ent: [userEntityRef],\n    },\n  });\n}\n\n/**\n * Available sign-in resolvers for the GitHub auth provider.\n *\n * @public\n */\nexport namespace githubSignInResolvers {\n  /**\n   * Looks up the user by matching their GitHub username to the entity name.\n   *\n   * @deprecated Use {@link githubSignInResolvers.userIdMatchingUserEntityAnnotation}\n   * instead, because GitHub usernames can change and be reassigned.\n   */\n  export const usernameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n        ctx,\n      ) => {\n        const { fullProfile } = info.result;\n\n        const userId = fullProfile.username;\n        if (!userId) {\n          throw new Error(`GitHub user profile does not contain a username`);\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            entityRef: { name: userId },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their GitHub user ID to the github.com/user-id annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(options = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx,\n        ) => {\n          const { fullProfile } = info.result;\n\n          const userId = fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          const query = {\n            annotations: {\n              [GITHUB_USER_ID_ANNOTATION]: userId,\n            },\n          };\n\n          let entity;\n          try {\n            ({ entity } = await ctx.findCatalogUser(query));\n          } catch (error) {\n            if (\n              !isError(error) ||\n              error.name !== 'NotFoundError' ||\n              !options.dangerouslyAllowSignInWithoutUserInCatalog\n            ) {\n              throw error;\n            }\n\n            return signInWithoutCatalogUser(userId, ctx);\n          }\n\n          requireMatchingGithubUserId(entity, userId);\n          return signInWithCatalogEntity(entity, ctx);\n        };\n      },\n    },\n  );\n}\n\n/**\n * Creates the resolver map used by the built-in GitHub provider module.\n *\n * @remarks\n *\n * The service-aware user ID resolver can inspect all case-insensitive catalog\n * matches and select the exact ID. The public resolver remains fail-closed when\n * its context reports an ambiguous lookup.\n *\n * @internal\n */\nexport function createGithubProviderSignInResolvers(options: {\n  auth: AuthService;\n  catalog: CatalogService;\n}) {\n  return {\n    ...githubSignInResolvers,\n    userIdMatchingUserEntityAnnotation: createSignInResolverFactory({\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(resolverOptions = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx: AuthResolverContext,\n        ) => {\n          const userId = info.result.fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          const credentials = await options.auth.getOwnServiceCredentials();\n          const { items } = await options.catalog.getEntities(\n            {\n              filter: {\n                kind: 'user',\n                [`metadata.annotations.${GITHUB_USER_ID_ANNOTATION}`]: userId,\n              },\n            },\n            { credentials },\n          );\n          const exactMatches = items.filter(\n            item =>\n              item.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] === userId,\n          );\n\n          if (exactMatches.length > 1) {\n            throw new ConflictError(\n              'User lookup resulted in multiple exact matches',\n            );\n          }\n          if (exactMatches.length === 1) {\n            return signInWithCatalogEntity(exactMatches[0], ctx);\n          }\n          if (items.length > 0) {\n            throw new Error(`GitHub user ID does not match the catalog user`);\n          }\n          if (resolverOptions.dangerouslyAllowSignInWithoutUserInCatalog) {\n            return signInWithoutCatalogUser(userId, ctx);\n          }\n          throw new NotFoundError('User not found');\n        };\n      },\n    }),\n  };\n}\n"],"names":["stringifyEntityRef","DEFAULT_NAMESPACE","githubSignInResolvers","createSignInResolverFactory","z","isError","ConflictError","NotFoundError"],"mappings":";;;;;;;AAkCA,MAAM,yBAAA,GAA4B,oBAAA;AAElC,SAAS,2BAAA,CAA4B,QAAgB,MAAA,EAAgB;AACnE,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,WAAA,GAAc,yBAAyB,MAAM,MAAA,EAAQ;AACvE,IAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,EAClE;AACF;AAEA,eAAe,uBAAA,CACb,QACA,GAAA,EACA;AACA,EAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,GAAA,CAAI,2BAA2B,MAAM,CAAA;AAC3E,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,MAAA,EAAQ;AAAA,MACN,GAAA,EAAKA,gCAAmB,MAAM,CAAA;AAAA,MAC9B,GAAA,EAAK;AAAA;AACP,GACD,CAAA;AACH;AAEA,eAAe,wBAAA,CACb,MACA,GAAA,EACA;AACA,EAAA,MAAM,gBAAgBA,+BAAA,CAAmB;AAAA,IACvC,IAAA,EAAM,MAAA;AAAA,IACN,SAAA,EAAWC,8BAAA;AAAA,IACX;AAAA,GACD,CAAA;AACD,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,aAAA;AAAA,MACL,GAAA,EAAK,CAAC,aAAa;AAAA;AACrB,GACD,CAAA;AACH;AAOiBC;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAOE,EAAMA,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,QAAA,MAAM,SAAS,WAAA,CAAY,QAAA;AAC3B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA;AAAO,WAC5B;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,uBAAA,kCAAA,GAAqCC,0CAAA;AAAA,IAChD;AAAA,MACE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,UAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,KAAA,GAAQ;AAAA,YACZ,WAAA,EAAa;AAAA,cACX,CAAC,yBAAyB,GAAG;AAAA;AAC/B,WACF;AAEA,UAAA,IAAI,MAAA;AACJ,UAAA,IAAI;AACF,YAAA,CAAC,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,gBAAgB,KAAK,CAAA;AAAA,UAC/C,SAAS,KAAA,EAAO;AACd,YAAA,IACE,CAACC,eAAQ,KAAK,CAAA,IACd,MAAM,IAAA,KAAS,eAAA,IACf,CAAC,OAAA,CAAQ,0CAAA,EACT;AACA,cAAA,MAAM,KAAA;AAAA,YACR;AAEA,YAAA,OAAO,wBAAA,CAAyB,QAAQ,GAAG,CAAA;AAAA,UAC7C;AAEA,UAAA,2BAAA,CAA4B,QAAQ,MAAM,CAAA;AAC1C,UAAA,OAAO,uBAAA,CAAwB,QAAQ,GAAG,CAAA;AAAA,QAC5C,CAAA;AAAA,MACF;AAAA;AACF,GACF;AAAA,CAAA,EAxFeH,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;AAsGV,SAAS,oCAAoC,OAAA,EAGjD;AACD,EAAA,OAAO;AAAA,IACL,GAAGA,6BAAA;AAAA,IACH,oCAAoCC,0CAAA,CAA4B;AAAA,MAC9D,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,eAAA,GAAkB,EAAC,EAAG;AAC3B,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,MAAA;AACvC,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA,CAAK,wBAAA,EAAyB;AAChE,UAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAQ,OAAA,CAAQ,WAAA;AAAA,YACtC;AAAA,cACE,MAAA,EAAQ;AAAA,gBACN,IAAA,EAAM,MAAA;AAAA,gBACN,CAAC,CAAA,qBAAA,EAAwB,yBAAyB,CAAA,CAAE,GAAG;AAAA;AACzD,aACF;AAAA,YACA,EAAE,WAAA;AAAY,WAChB;AACA,UAAA,MAAM,eAAe,KAAA,CAAM,MAAA;AAAA,YACzB,CAAA,IAAA,KACE,IAAA,CAAK,QAAA,CAAS,WAAA,GAAc,yBAAyB,CAAA,KAAM;AAAA,WAC/D;AAEA,UAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,YAAA,MAAM,IAAIE,oBAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AACA,UAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,YAAA,OAAO,uBAAA,CAAwB,YAAA,CAAa,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,UACrD;AACA,UAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AACA,UAAA,IAAI,gBAAgB,0CAAA,EAA4C;AAC9D,YAAA,OAAO,wBAAA,CAAyB,QAAQ,GAAG,CAAA;AAAA,UAC7C;AACA,UAAA,MAAM,IAAIC,qBAAc,gBAAgB,CAAA;AAAA,QAC1C,CAAA;AAAA,MACF;AAAA,KACD;AAAA,GACH;AACF;;;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DEFAULT_NAMESPACE,\n  stringifyEntityRef,\n  type Entity,\n} from '@backstage/catalog-model';\nimport type { AuthService } from '@backstage/backend-plugin-api';\nimport { ConflictError, isError, NotFoundError } from '@backstage/errors';\nimport {\n  type AuthResolverContext,\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport type { CatalogService } from '@backstage/plugin-catalog-node';\nimport { z } from 'zod/v3';\n\nimport { GithubProfile } from './authenticator';\n\nconst GITHUB_USER_ID_ANNOTATION = 'github.com/user-id';\n\nfunction requireMatchingGithubUserId(entity: Entity, userId: string) {\n  if (entity.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] !== userId) {\n    throw new Error(`GitHub user ID does not match the catalog user`);\n  }\n}\n\nasync function signInWithCatalogEntity(\n  entity: Entity,\n  ctx: AuthResolverContext,\n) {\n  const { ownershipEntityRefs } = await ctx.resolveOwnershipEntityRefs(entity);\n  return ctx.issueToken({\n    claims: {\n      sub: stringifyEntityRef(entity),\n      ent: ownershipEntityRefs,\n    },\n  });\n}\n\nasync function signInWithoutCatalogUser(\n  name: string,\n  ctx: AuthResolverContext,\n) {\n  const userEntityRef = stringifyEntityRef({\n    kind: 'User',\n    namespace: DEFAULT_NAMESPACE,\n    name,\n  });\n  return ctx.issueToken({\n    claims: {\n      sub: userEntityRef,\n      ent: [userEntityRef],\n    },\n  });\n}\n\n/**\n * Available sign-in resolvers for the GitHub auth provider.\n *\n * @public\n */\nexport namespace githubSignInResolvers {\n  /**\n   * Looks up the user by matching their GitHub username to the entity name.\n   *\n   * @deprecated Use {@link githubSignInResolvers.userIdMatchingUserEntityAnnotation}\n   * instead, because GitHub usernames can change and be reassigned.\n   */\n  export const usernameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n        ctx,\n      ) => {\n        const { fullProfile } = info.result;\n\n        const userId = fullProfile.username;\n        if (!userId) {\n          throw new Error(`GitHub user profile does not contain a username`);\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            entityRef: { name: userId },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their GitHub user ID to the github.com/user-id annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(options = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx,\n        ) => {\n          const { fullProfile } = info.result;\n\n          const userId = fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          const query = {\n            annotations: {\n              [GITHUB_USER_ID_ANNOTATION]: userId,\n            },\n          };\n\n          let entity;\n          try {\n            ({ entity } = await ctx.findCatalogUser(query));\n          } catch (error) {\n            if (\n              !isError(error) ||\n              error.name !== 'NotFoundError' ||\n              !options.dangerouslyAllowSignInWithoutUserInCatalog\n            ) {\n              throw error;\n            }\n\n            return signInWithoutCatalogUser(userId, ctx);\n          }\n\n          requireMatchingGithubUserId(entity, userId);\n          return signInWithCatalogEntity(entity, ctx);\n        };\n      },\n    },\n  );\n}\n\n/**\n * Creates the resolver map used by the built-in GitHub provider module.\n *\n * @remarks\n *\n * The service-aware user ID resolver can inspect all case-insensitive catalog\n * matches and select the exact ID. The public resolver remains fail-closed when\n * its context reports an ambiguous lookup.\n *\n * @internal\n */\nexport function createGithubProviderSignInResolvers(options: {\n  auth: AuthService;\n  catalog: CatalogService;\n}) {\n  return {\n    ...githubSignInResolvers,\n    userIdMatchingUserEntityAnnotation: createSignInResolverFactory({\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(resolverOptions = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx: AuthResolverContext,\n        ) => {\n          const userId = info.result.fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          const credentials = await options.auth.getOwnServiceCredentials();\n          const { items } = await options.catalog.getEntities(\n            {\n              filter: {\n                kind: 'user',\n                [`metadata.annotations.${GITHUB_USER_ID_ANNOTATION}`]: userId,\n              },\n            },\n            { credentials },\n          );\n          const exactMatches = items.filter(\n            item =>\n              item.metadata.annotations?.[GITHUB_USER_ID_ANNOTATION] === userId,\n          );\n\n          if (exactMatches.length > 1) {\n            throw new ConflictError(\n              'User lookup resulted in multiple exact matches',\n            );\n          }\n          if (exactMatches.length === 1) {\n            return signInWithCatalogEntity(exactMatches[0], ctx);\n          }\n          if (items.length > 0) {\n            throw new Error(`GitHub user ID does not match the catalog user`);\n          }\n          if (resolverOptions.dangerouslyAllowSignInWithoutUserInCatalog) {\n            return signInWithoutCatalogUser(userId, ctx);\n          }\n          throw new NotFoundError('User not found');\n        };\n      },\n    }),\n  };\n}\n"],"names":["stringifyEntityRef","DEFAULT_NAMESPACE","githubSignInResolvers","createSignInResolverFactory","z","isError","ConflictError","NotFoundError"],"mappings":";;;;;;;AAkCA,MAAM,yBAAA,GAA4B,oBAAA;AAElC,SAAS,2BAAA,CAA4B,QAAgB,MAAA,EAAgB;AACnE,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,WAAA,GAAc,yBAAyB,MAAM,MAAA,EAAQ;AACvE,IAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,EAClE;AACF;AAEA,eAAe,uBAAA,CACb,QACA,GAAA,EACA;AACA,EAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,GAAA,CAAI,2BAA2B,MAAM,CAAA;AAC3E,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,MAAA,EAAQ;AAAA,MACN,GAAA,EAAKA,gCAAmB,MAAM,CAAA;AAAA,MAC9B,GAAA,EAAK;AAAA;AACP,GACD,CAAA;AACH;AAEA,eAAe,wBAAA,CACb,MACA,GAAA,EACA;AACA,EAAA,MAAM,gBAAgBA,+BAAA,CAAmB;AAAA,IACvC,IAAA,EAAM,MAAA;AAAA,IACN,SAAA,EAAWC,8BAAA;AAAA,IACX;AAAA,GACD,CAAA;AACD,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,aAAA;AAAA,MACL,GAAA,EAAK,CAAC,aAAa;AAAA;AACrB,GACD,CAAA;AACH;AAOiBC;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAOE,EAAMA,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,QAAA,MAAM,SAAS,WAAA,CAAY,QAAA;AAC3B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA;AAAO,WAC5B;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,uBAAA,kCAAA,GAAqCC,0CAAA;AAAA,IAChD;AAAA,MACE,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,UAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,KAAA,GAAQ;AAAA,YACZ,WAAA,EAAa;AAAA,cACX,CAAC,yBAAyB,GAAG;AAAA;AAC/B,WACF;AAEA,UAAA,IAAI,MAAA;AACJ,UAAA,IAAI;AACF,YAAA,CAAC,EAAE,MAAA,EAAO,GAAI,MAAM,GAAA,CAAI,gBAAgB,KAAK,CAAA;AAAA,UAC/C,SAAS,KAAA,EAAO;AACd,YAAA,IACE,CAACC,eAAQ,KAAK,CAAA,IACd,MAAM,IAAA,KAAS,eAAA,IACf,CAAC,OAAA,CAAQ,0CAAA,EACT;AACA,cAAA,MAAM,KAAA;AAAA,YACR;AAEA,YAAA,OAAO,wBAAA,CAAyB,QAAQ,GAAG,CAAA;AAAA,UAC7C;AAEA,UAAA,2BAAA,CAA4B,QAAQ,MAAM,CAAA;AAC1C,UAAA,OAAO,uBAAA,CAAwB,QAAQ,GAAG,CAAA;AAAA,QAC5C,CAAA;AAAA,MACF;AAAA;AACF,GACF;AAAA,CAAA,EAxFeH,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;AAsGV,SAAS,oCAAoC,OAAA,EAGjD;AACD,EAAA,OAAO;AAAA,IACL,GAAGA,6BAAA;AAAA,IACH,oCAAoCC,0CAAA,CAA4B;AAAA,MAC9D,aAAA,EAAeC,KACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,IAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,eAAA,GAAkB,EAAC,EAAG;AAC3B,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,MAAA;AACvC,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA,CAAK,wBAAA,EAAyB;AAChE,UAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,QAAQ,OAAA,CAAQ,WAAA;AAAA,YACtC;AAAA,cACE,MAAA,EAAQ;AAAA,gBACN,IAAA,EAAM,MAAA;AAAA,gBACN,CAAC,CAAA,qBAAA,EAAwB,yBAAyB,CAAA,CAAE,GAAG;AAAA;AACzD,aACF;AAAA,YACA,EAAE,WAAA;AAAY,WAChB;AACA,UAAA,MAAM,eAAe,KAAA,CAAM,MAAA;AAAA,YACzB,CAAA,IAAA,KACE,IAAA,CAAK,QAAA,CAAS,WAAA,GAAc,yBAAyB,CAAA,KAAM;AAAA,WAC/D;AAEA,UAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,YAAA,MAAM,IAAIE,oBAAA;AAAA,cACR;AAAA,aACF;AAAA,UACF;AACA,UAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,YAAA,OAAO,uBAAA,CAAwB,YAAA,CAAa,CAAC,CAAA,EAAG,GAAG,CAAA;AAAA,UACrD;AACA,UAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AACA,UAAA,IAAI,gBAAgB,0CAAA,EAA4C;AAC9D,YAAA,OAAO,wBAAA,CAAyB,QAAQ,GAAG,CAAA;AAAA,UAC7C;AACA,UAAA,MAAM,IAAIC,qBAAc,gBAAgB,CAAA;AAAA,QAC1C,CAAA;AAAA,MACF;AAAA,KACD;AAAA,GACH;AACF;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-github-provider",
-  "version": "0.5.7",
+  "version": "0.5.8-next.1",
   "description": "The github-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -37,20 +37,20 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.10.1",
-    "@backstage/catalog-model": "^1.10.1",
-    "@backstage/errors": "^1.3.1",
-    "@backstage/plugin-auth-node": "^0.7.6",
-    "@backstage/plugin-catalog-node": "^2.2.5",
+    "@backstage/backend-plugin-api": "1.11.0-next.1",
+    "@backstage/catalog-model": "1.10.2-next.0",
+    "@backstage/errors": "1.3.2-next.0",
+    "@backstage/plugin-auth-node": "0.7.7-next.1",
+    "@backstage/plugin-catalog-node": "2.2.6-next.1",
     "passport-github2": "^0.1.12",
     "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "^0.18.0",
-    "@backstage/backend-test-utils": "^1.11.7",
-    "@backstage/cli": "^0.36.6",
-    "@backstage/plugin-auth-backend": "^0.30.1",
-    "@backstage/types": "^1.2.2",
+    "@backstage/backend-defaults": "0.18.1-next.1",
+    "@backstage/backend-test-utils": "1.11.8-next.1",
+    "@backstage/cli": "0.36.7-next.0",
+    "@backstage/plugin-auth-backend": "0.30.2-next.1",
+    "@backstage/types": "1.2.2",
     "@types/passport-github2": "^1.2.4",
     "supertest": "^7.0.0"
   },