@backstage/plugin-auth-backend-module-microsoft-provider 0.3.3-next.1 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @backstage/plugin-auth-backend-module-microsoft-provider
 
+## 0.3.3
+
+### Patch Changes
+
+- 5cc1f7f: Introduce `dangerouslyAllowSignInWithoutUserInCatalog` auth resolver config.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.6.3
+  - @backstage/backend-plugin-api@1.3.1
+
+## 0.3.3-next.2
+
+### Patch Changes
+
+- 5cc1f7f: Introduce `dangerouslyAllowSignInWithoutUserInCatalog` auth resolver config.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.6.3-next.2
+  - @backstage/backend-plugin-api@1.3.1-next.2
+
 ## 0.3.3-next.1
 
 ### Patch Changes

package/config.d.ts

@@ -34,13 +34,23 @@ export interface Config {
           skipUserProfile?: boolean;
           signIn?: {
             resolvers: Array<
-              | { resolver: 'emailMatchingUserEntityAnnotation' }
+              | {
+                  resolver: 'emailMatchingUserEntityAnnotation';
+                  dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+                }
               | {
                   resolver: 'emailLocalPartMatchingUserEntityName';
                   allowedDomains?: string[];
+                  dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+                }
+              | {
+                  resolver: 'emailMatchingUserEntityProfileEmail';
+                  dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+                }
+              | {
+                  resolver: 'userIdMatchingUserEntityAnnotation';
+                  dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
                 }
-              | { resolver: 'emailMatchingUserEntityProfileEmail' }
-              | { resolver: 'userIdMatchingUserEntityAnnotation' }
             >;
           };
           sessionDuration?: HumanDuration | string;

package/dist/index.d.ts

@@ -20,11 +20,15 @@ declare namespace microsoftSignInResolvers {
     /**
      * Looks up the user by matching their Microsoft email to the email entity annotation.
      */
-    const emailMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, unknown>;
+    const emailMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, {
+        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
+    } | undefined>;
     /**
      * Looks up the user by matching their Microsoft user id to the user id entity annotation.
      */
-    const userIdMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, unknown>;
+    const userIdMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, {
+        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
+    } | undefined>;
 }
 
 /**

package/dist/resolvers.cjs.js

@@ -1,38 +1,55 @@
 'use strict';
 
 var pluginAuthNode = require('@backstage/plugin-auth-node');
+var zod = require('zod');
 
 exports.microsoftSignInResolvers = void 0;
 ((microsoftSignInResolvers2) => {
   microsoftSignInResolvers2.emailMatchingUserEntityAnnotation = pluginAuthNode.createSignInResolverFactory({
-    create() {
+    optionsSchema: zod.z.object({
+      dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+    }).optional(),
+    create(options = {}) {
       return async (info, ctx) => {
         const { profile } = info;
         if (!profile.email) {
           throw new Error("Microsoft profile contained no email");
         }
-        return ctx.signInWithCatalogUser({
-          annotations: {
-            "microsoft.com/email": profile.email
+        return ctx.signInWithCatalogUser(
+          {
+            annotations: {
+              "microsoft.com/email": profile.email
+            }
+          },
+          {
+            dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: profile.email } } : void 0
           }
-        });
+        );
       };
     }
   });
   microsoftSignInResolvers2.userIdMatchingUserEntityAnnotation = pluginAuthNode.createSignInResolverFactory(
     {
-      create() {
+      optionsSchema: zod.z.object({
+        dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+      }).optional(),
+      create(options = {}) {
         return async (info, ctx) => {
           const { result } = info;
           const id = result.fullProfile.id;
           if (!id) {
             throw new Error("Microsoft profile contained no id");
           }
-          return ctx.signInWithCatalogUser({
-            annotations: {
-              "graph.microsoft.com/user-id": id
+          return ctx.signInWithCatalogUser(
+            {
+              annotations: {
+                "graph.microsoft.com/user-id": id
+              }
+            },
+            {
+              dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: id } } : void 0
             }
-          });
+          );
         };
       }
     }

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  OAuthAuthenticatorResult,\n  createSignInResolverFactory,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\n\n/**\n * Available sign-in resolvers for the Microsoft auth provider.\n *\n * @public\n */\nexport namespace microsoftSignInResolvers {\n  /**\n   * Looks up the user by matching their Microsoft email to the email entity annotation.\n   */\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    create() {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { profile } = info;\n\n        if (!profile.email) {\n          throw new Error('Microsoft profile contained no email');\n        }\n\n        return ctx.signInWithCatalogUser({\n          annotations: {\n            'microsoft.com/email': profile.email,\n          },\n        });\n      };\n    },\n  });\n  /**\n   * Looks up the user by matching their Microsoft user id to the user id entity annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      create() {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n          ctx,\n        ) => {\n          const { result } = info;\n\n          const id = result.fullProfile.id;\n\n          if (!id) {\n            throw new Error('Microsoft profile contained no id');\n          }\n\n          return ctx.signInWithCatalogUser({\n            annotations: {\n              'graph.microsoft.com/user-id': id,\n            },\n          });\n        };\n      },\n    },\n  );\n}\n"],"names":["microsoftSignInResolvers","createSignInResolverFactory"],"mappings":";;;;AA4BiBA;AAAA,CAAV,CAAUA,yBAAV,KAAA;AAIE,EAAMA,yBAAAA,CAAA,oCAAoCC,0CAA4B,CAAA;AAAA,IAC3E,MAAS,GAAA;AACP,MAAO,OAAA,OACL,MACA,GACG,KAAA;AACH,QAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,QAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,UAAM,MAAA,IAAI,MAAM,sCAAsC,CAAA;AAAA;AAGxD,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,WAAa,EAAA;AAAA,YACX,uBAAuB,OAAQ,CAAA;AAAA;AACjC,SACD,CAAA;AAAA,OACH;AAAA;AACF,GACD,CAAA;AAIM,EAAMD,0BAAA,kCAAqC,GAAAC,0CAAA;AAAA,IAChD;AAAA,MACE,MAAS,GAAA;AACP,QAAO,OAAA,OACL,MACA,GACG,KAAA;AACH,UAAM,MAAA,EAAE,QAAW,GAAA,IAAA;AAEnB,UAAM,MAAA,EAAA,GAAK,OAAO,WAAY,CAAA,EAAA;AAE9B,UAAA,IAAI,CAAC,EAAI,EAAA;AACP,YAAM,MAAA,IAAI,MAAM,mCAAmC,CAAA;AAAA;AAGrD,UAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,YAC/B,WAAa,EAAA;AAAA,cACX,6BAA+B,EAAA;AAAA;AACjC,WACD,CAAA;AAAA,SACH;AAAA;AACF;AACF,GACF;AAAA,CAlDe,EAAAD,gCAAA,KAAAA,gCAAA,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  OAuthAuthenticatorResult,\n  createSignInResolverFactory,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { z } from 'zod';\n\n/**\n * Available sign-in resolvers for the Microsoft auth provider.\n *\n * @public\n */\nexport namespace microsoftSignInResolvers {\n  /**\n   * Looks up the user by matching their Microsoft email to the email entity annotation.\n   */\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { profile } = info;\n\n        if (!profile.email) {\n          throw new Error('Microsoft profile contained no email');\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            annotations: {\n              'microsoft.com/email': profile.email,\n            },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: profile.email } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n  /**\n   * Looks up the user by matching their Microsoft user id to the user id entity annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(options = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n          ctx,\n        ) => {\n          const { result } = info;\n\n          const id = result.fullProfile.id;\n\n          if (!id) {\n            throw new Error('Microsoft profile contained no id');\n          }\n\n          return ctx.signInWithCatalogUser(\n            {\n              annotations: {\n                'graph.microsoft.com/user-id': id,\n              },\n            },\n            {\n              dangerousEntityRefFallback:\n                options?.dangerouslyAllowSignInWithoutUserInCatalog\n                  ? { entityRef: { name: id } }\n                  : undefined,\n            },\n          );\n        };\n      },\n    },\n  );\n}\n"],"names":["microsoftSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA6BiBA;AAAA,CAAV,CAAUA,yBAAV,KAAA;AAIE,EAAMA,yBAAAA,CAAA,oCAAoCC,0CAA4B,CAAA;AAAA,IAC3E,aAAA,EAAeC,MACZ,MAAO,CAAA;AAAA,MACN,0CAA4C,EAAAA,KAAA,CAAE,OAAQ,EAAA,CAAE,QAAS;AAAA,KAClE,EACA,QAAS,EAAA;AAAA,IACZ,MAAA,CAAO,OAAU,GAAA,EAAI,EAAA;AACnB,MAAO,OAAA,OACL,MACA,GACG,KAAA;AACH,QAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,QAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,UAAM,MAAA,IAAI,MAAM,sCAAsC,CAAA;AAAA;AAGxD,QAAA,OAAO,GAAI,CAAA,qBAAA;AAAA,UACT;AAAA,YACE,WAAa,EAAA;AAAA,cACX,uBAAuB,OAAQ,CAAA;AAAA;AACjC,WACF;AAAA,UACA;AAAA,YACE,0BAAA,EACE,OAAS,EAAA,0CAAA,GACL,EAAE,SAAA,EAAW,EAAE,IAAM,EAAA,OAAA,CAAQ,KAAM,EAAA,EACnC,GAAA,KAAA;AAAA;AACR,SACF;AAAA,OACF;AAAA;AACF,GACD,CAAA;AAIM,EAAMF,0BAAA,kCAAqC,GAAAC,0CAAA;AAAA,IAChD;AAAA,MACE,aAAA,EAAeC,MACZ,MAAO,CAAA;AAAA,QACN,0CAA4C,EAAAA,KAAA,CAAE,OAAQ,EAAA,CAAE,QAAS;AAAA,OAClE,EACA,QAAS,EAAA;AAAA,MACZ,MAAA,CAAO,OAAU,GAAA,EAAI,EAAA;AACnB,QAAO,OAAA,OACL,MACA,GACG,KAAA;AACH,UAAM,MAAA,EAAE,QAAW,GAAA,IAAA;AAEnB,UAAM,MAAA,EAAA,GAAK,OAAO,WAAY,CAAA,EAAA;AAE9B,UAAA,IAAI,CAAC,EAAI,EAAA;AACP,YAAM,MAAA,IAAI,MAAM,mCAAmC,CAAA;AAAA;AAGrD,UAAA,OAAO,GAAI,CAAA,qBAAA;AAAA,YACT;AAAA,cACE,WAAa,EAAA;AAAA,gBACX,6BAA+B,EAAA;AAAA;AACjC,aACF;AAAA,YACA;AAAA,cACE,0BAAA,EACE,SAAS,0CACL,GAAA,EAAE,WAAW,EAAE,IAAA,EAAM,EAAG,EAAA,EACxB,GAAA,KAAA;AAAA;AACR,WACF;AAAA,SACF;AAAA;AACF;AACF,GACF;AAAA,CA5Ee,EAAAF,gCAAA,KAAAA,gCAAA,GAAA,EAAA,CAAA,CAAA;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-microsoft-provider",
-  "version": "0.3.3-next.1",
+  "version": "0.3.3",
   "description": "The microsoft-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -37,19 +37,20 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.3.1-next.1",
-    "@backstage/plugin-auth-node": "0.6.3-next.1",
+    "@backstage/backend-plugin-api": "^1.3.1",
+    "@backstage/plugin-auth-node": "^0.6.3",
     "express": "^4.18.2",
     "jose": "^5.0.0",
-    "passport-microsoft": "^1.0.0"
+    "passport-microsoft": "^1.0.0",
+    "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.10.0-next.1",
-    "@backstage/backend-test-utils": "1.5.0-next.1",
-    "@backstage/cli": "0.32.1-next.1",
-    "@backstage/config": "1.3.2",
-    "@backstage/plugin-auth-backend": "0.25.0-next.1",
-    "@backstage/types": "1.2.1",
+    "@backstage/backend-defaults": "^0.10.0",
+    "@backstage/backend-test-utils": "^1.5.0",
+    "@backstage/cli": "^0.32.1",
+    "@backstage/config": "^1.3.2",
+    "@backstage/plugin-auth-backend": "^0.25.0",
+    "@backstage/types": "^1.2.1",
     "@types/passport-microsoft": "^1.0.0",
     "msw": "^1.0.0",
     "supertest": "^7.0.0"