From e0ed31c0c410d29718959ec913e818ea299c68d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikolai=20R=C3=B8ed=20Kristiansen?=
 <nikolai.kristiansen@remarkable.no>
Date: Thu, 11 Apr 2024 13:01:13 +0200
Subject: [PATCH 1/2] feat(gcp-iap): Add user id annotation resolver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Nikolai Røed Kristiansen <nikolai.kristiansen@remarkable.no>
---
 .changeset/serious-snails-poke.md               |  5 +++++
 .../api-report.md                               |  4 ++++
 .../src/resolvers.ts                            | 17 +++++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 .changeset/serious-snails-poke.md

diff --git a/.changeset/serious-snails-poke.md b/.changeset/serious-snails-poke.md
new file mode 100644
index 0000000000..dd02ee0053
--- /dev/null
+++ b/.changeset/serious-snails-poke.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-gcp-iap-provider': minor
+---
+
+Add user id annotation sign-in resolver
diff --git a/plugins/auth-backend-module-gcp-iap-provider/api-report.md b/plugins/auth-backend-module-gcp-iap-provider/api-report.md
index 8d7c319a50..e282dd04b1 100644
--- a/plugins/auth-backend-module-gcp-iap-provider/api-report.md
+++ b/plugins/auth-backend-module-gcp-iap-provider/api-report.md
@@ -37,6 +37,10 @@ export namespace gcpIapSignInResolvers {
     GcpIapResult,
     unknown
   >;
+  const idMatchingUserEntityAnnotation: SignInResolverFactory<
+    GcpIapResult,
+    unknown
+  >;
 }
 
 // @public
diff --git a/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts b/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts
index 32ab2b6cc7..557ee8fdfe 100644
--- a/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts
+++ b/plugins/auth-backend-module-gcp-iap-provider/src/resolvers.ts
@@ -46,4 +46,21 @@ export namespace gcpIapSignInResolvers {
       };
     },
   });
+
+  /**
+   * Looks up the user by matching their user ID to the `google.com/user-id` annotation.
+   */
+  export const idMatchingUserEntityAnnotation = createSignInResolverFactory({
+    create() {
+      return async (info: SignInInfo<GcpIapResult>, ctx) => {
+        const userId = info.result.iapToken.sub.split(':')[1];
+
+        return ctx.signInWithCatalogUser({
+          annotations: {
+            'google.com/user-id': userId,
+          },
+        });
+      };
+    },
+  });
 }

From 1683b8485d5df0e2d02fd01c69083eaa41201470 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Tue, 16 Apr 2024 12:15:41 +0200
Subject: [PATCH 2/2] Apply suggestions from code review

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/serious-snails-poke.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/serious-snails-poke.md b/.changeset/serious-snails-poke.md
index dd02ee0053..bcc8fadbf5 100644
--- a/.changeset/serious-snails-poke.md
+++ b/.changeset/serious-snails-poke.md
@@ -1,5 +1,5 @@
 ---
-'@backstage/plugin-auth-backend-module-gcp-iap-provider': minor
+'@backstage/plugin-auth-backend-module-gcp-iap-provider': patch
 ---
 
 Add user id annotation sign-in resolver