From 2dfeb4b61265a831df403dbef9e8955a68233d17 Mon Sep 17 00:00:00 2001
From: Chris Gemmell <chris.gemmell8@gmail.com>
Date: Sat, 23 Sep 2023 16:34:56 +1000
Subject: [PATCH] fixed

Signed-off-by: Chris Gemmell <chris.gemmell8@gmail.com>
---
 .changeset/spotty-donkeys-give.md             |  6 ++++
 .../src/resolvers.ts                          | 34 +++----------------
 .../src/providers/microsoft/provider.ts       | 19 +++++++++--
 3 files changed, 28 insertions(+), 31 deletions(-)
 create mode 100644 .changeset/spotty-donkeys-give.md

diff --git a/.changeset/spotty-donkeys-give.md b/.changeset/spotty-donkeys-give.md
new file mode 100644
index 0000000000..92fa44fa37
--- /dev/null
+++ b/.changeset/spotty-donkeys-give.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-auth-backend-module-microsoft-provider': minor
+'@backstage/plugin-auth-backend': patch
+---
+
+Moved existing emailMatchingUserEntityAnnotation into `@backstage/plugin-auth-backend-module-microsoft-provider` and adapted SignInResolvers correctly"
diff --git a/plugins/auth-backend-module-microsoft-provider/src/resolvers.ts b/plugins/auth-backend-module-microsoft-provider/src/resolvers.ts
index e50340ca4e..7ef4a57175 100644
--- a/plugins/auth-backend-module-microsoft-provider/src/resolvers.ts
+++ b/plugins/auth-backend-module-microsoft-provider/src/resolvers.ts
@@ -15,8 +15,8 @@
  */
 
 import {
-  createSignInResolverFactory,
   OAuthAuthenticatorResult,
+  createSignInResolverFactory,
   PassportProfile,
   SignInInfo,
 } from '@backstage/plugin-auth-node';
@@ -30,7 +30,7 @@ export namespace microsoftSignInResolvers {
   /**
    * Looks up the user by matching their Microsoft username to the entity name.
    */
-  export const commonByEmailLocalPartResolver = createSignInResolverFactory({
+  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({
     create() {
       return async (
         info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,
@@ -39,36 +39,12 @@ export namespace microsoftSignInResolvers {
         const { profile } = info;
 
         if (!profile.email) {
-          throw new Error(
-            'Login failed, user profile does not contain an email',
-          );
-        }
-        const [localPart] = profile.email.split('@');
-
-        return ctx.signInWithCatalogUser({
-          entityRef: { name: localPart },
-        });
-      };
-    },
-  });
-
-  export const commonByEmailResolver = createSignInResolverFactory({
-    create() {
-      return async (
-        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,
-        ctx,
-      ) => {
-        const { profile } = info;
-
-        if (!profile.email) {
-          throw new Error(
-            'Login failed, user profile does not contain an email',
-          );
+          throw new Error('Microsoft profile contained no email');
         }
 
         return ctx.signInWithCatalogUser({
-          filter: {
-            'spec.profile.email': profile.email,
+          annotations: {
+            'microsoft.com/email': profile.email,
           },
         });
       };
diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts
index 439db03311..8947c7432b 100644
--- a/plugins/auth-backend/src/providers/microsoft/provider.ts
+++ b/plugins/auth-backend/src/providers/microsoft/provider.ts
@@ -17,12 +17,19 @@
 import { SignInResolver, AuthHandler } from '../types';
 import { OAuthResult } from '../../lib/oauth';
 import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
-import { createOAuthProviderFactory } from '@backstage/plugin-auth-node';
+import {
+  commonSignInResolvers,
+  createOAuthProviderFactory,
+} from '@backstage/plugin-auth-node';
 import {
   adaptLegacyOAuthHandler,
   adaptLegacyOAuthSignInResolver,
+  adaptOAuthSignInResolverToLegacy,
 } from '../../lib/legacy';
-import { microsoftAuthenticator } from '@backstage/plugin-auth-backend-module-microsoft-provider';
+import {
+  microsoftAuthenticator,
+  microsoftSignInResolvers,
+} from '@backstage/plugin-auth-backend-module-microsoft-provider';
 
 /**
  * Auth provider integration for GitLab auth
@@ -50,4 +57,12 @@ export const microsoft = createAuthProviderIntegration({
       signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),
     });
   },
+  resolvers: adaptOAuthSignInResolverToLegacy({
+    emailLocalPartMatchingUserEntityName:
+      commonSignInResolvers.emailLocalPartMatchingUserEntityName(),
+    emailMatchingUserEntityProfileEmail:
+      commonSignInResolvers.emailMatchingUserEntityProfileEmail(),
+    emailMatchingUserEntityAnnotation:
+      microsoftSignInResolvers.emailMatchingUserEntityAnnotation(),
+  }),
 });