auth-node: add allowedDomains options for emailLocalPartMatchingUserEntityName + fixes

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

plugins/auth-node/package.json

@@ -53,7 +53,8 @@
     "passport": "^0.7.0",
     "winston": "^3.2.1",
     "zod": "^3.22.4",
-    "zod-to-json-schema": "^3.21.4"
+    "zod-to-json-schema": "^3.21.4",
+    "zod-validation-error": "^3.4.0"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",

plugins/auth-node/src/oauth/createOAuthProviderFactory.ts

@@ -34,10 +34,7 @@ export function createOAuthProviderFactory<TProfile>(options: {
   profileTransform?: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
   signInResolver?: SignInResolver<OAuthAuthenticatorResult<TProfile>>;
   signInResolverFactories?: {
-    [name in string]: SignInResolverFactory<
-      OAuthAuthenticatorResult<TProfile>,
-      unknown
-    >;
+    [name in string]: SignInResolverFactory;
   };
 }): AuthProviderFactory {
   return ctx => {

plugins/auth-node/src/proxy/createProxyAuthProviderFactory.ts

@@ -31,10 +31,7 @@ export function createProxyAuthProviderFactory<TResult>(options: {
   authenticator: ProxyAuthenticator<unknown, TResult, unknown>;
   profileTransform?: ProfileTransform<TResult>;
   signInResolver?: SignInResolver<TResult>;
-  signInResolverFactories?: Record<
-    string,
-    SignInResolverFactory<TResult, unknown>
-  >;
+  signInResolverFactories?: Record<string, SignInResolverFactory>;
 }): AuthProviderFactory {
   return ctx => {
     const signInResolver =

plugins/auth-node/src/sign-in/commonSignInResolvers.ts

@@ -14,7 +14,9 @@
  * limitations under the License.
  */
 
+import { z } from 'zod';
 import { createSignInResolverFactory } from './createSignInResolverFactory';
+import { NotAllowedError } from '@backstage/errors';
 
 // This splits an email "joe+work@acme.com" into ["joe", "+work", "@acme.com"]
 // so that we can remove the plus addressing. May output a shorter array:
@@ -77,7 +79,13 @@ export namespace commonSignInResolvers {
    */
   export const emailLocalPartMatchingUserEntityName =
     createSignInResolverFactory({
-      create() {
+      optionsSchema: z
+        .object({
+          allowedDomains: z.array(z.string()).optional(),
+        })
+        .optional(),
+      create(options = {}) {
+        const { allowedDomains } = options;
         return async (info, ctx) => {
           const { profile } = info;
 
@@ -87,6 +95,13 @@ export namespace commonSignInResolvers {
             );
           }
           const [localPart] = profile.email.split('@');
+          const domain = profile.email.slice(localPart.length + 1);
+
+          if (allowedDomains && !allowedDomains.includes(domain)) {
+            throw new NotAllowedError(
+              'Sign-in user email is not from an allowed domain',
+            );
+          }
 
           return ctx.signInWithCatalogUser({
             entityRef: { name: localPart },

plugins/auth-node/src/sign-in/createSignInResolverFactory.ts

@@ -18,10 +18,11 @@ import { ZodSchema, ZodTypeDef } from 'zod';
 import { SignInResolver } from '../types';
 import zodToJsonSchema from 'zod-to-json-schema';
 import { JsonObject } from '@backstage/types';
+import { fromError } from 'zod-validation-error';
 import { InputError } from '@backstage/errors';
 
 /** @public */
-export interface SignInResolverFactory<TAuthResult, TOptions> {
+export interface SignInResolverFactory<TAuthResult = any, TOptions = any> {
   (
     ...options: undefined extends TOptions
       ? [options?: TOptions]
@@ -66,7 +67,14 @@ export function createSignInResolverFactory<
       ? [options?: TOptionsInput]
       : [options: TOptionsInput]
   ) => {
-    const parsedOptions = optionsSchema.parse(resolverOptions);
+    let parsedOptions;
+    try {
+      parsedOptions = optionsSchema.parse(resolverOptions);
+    } catch (error) {
+      throw new InputError(
+        `Invalid sign-in resolver options, ${fromError(error)}`,
+      );
+    }
     return options.create(parsedOptions);
   };