update to auth.provider.guest.* login

Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>

.changeset/cold-boats-sell.md

@@ -2,9 +2,22 @@
 '@backstage/plugin-auth-backend-module-guest-provider': minor
 ---
 
-Adds a new guest provider that maps guest users to actual tokens. This also shifts the default guest login to `user:development/guest` to reduce overlap with your production/real data. To change that (or set it back to the old default, use the new `auth.guestEntityRef` config key) like so,
+Adds a new guest provider that maps guest users to actual tokens. This also shifts the default guest login to `user:development/guest` to reduce overlap with your production/real data. To change that (or set it back to the old default, use the new `auth.providers.guest.userEntityRef` config key) like so,
 
 ```yaml title=app-config.yaml
 auth:
-  guestEntityRef: user:default/guest
+  providers:
+    guest:
+      userEntityRef: user:default/guest
+```
+
+This also adds a new property to control the ownership entity refs,
+
+```yaml title=app-config.yaml
+auth:
+  providers:
+    guest:
+      ownershipEntityRefs:
+        - guests
+        - development/custom
 ```

docs/auth/guest/provider.md

@@ -59,9 +59,8 @@ Similar to the other authentication providers, you have to enable the provider i
 auth:
     providers:
 +       guest:
-+           development:
-                // new optional property to override the default value.
-+               loginAs: user:default/guest
++           userEntityRef: user:default/guest
++           development: {}
 ```
 
 We need to specify that the provider is enabled for the given environment, and as there are no config values for this provider yet, you can just specify an empty object.

packages/backend-next/src/index.ts

@@ -20,6 +20,7 @@ const backend = createBackend();
 
 backend.add(import('@backstage/plugin-auth-backend'));
 backend.add(import('./authModuleGithubProvider'));
+backend.add(import('@backstage/plugin-auth-backend-module-guest-provider'));
 
 backend.add(import('@backstage/plugin-adr-backend'));
 backend.add(import('@backstage/plugin-app-backend/alpha'));
@@ -57,7 +58,4 @@ backend.add(import('@backstage/plugin-sonarqube-backend'));
 backend.add(import('@backstage/plugin-signals-backend'));
 backend.add(import('@backstage/plugin-notifications-backend'));
 
-backend.add(import('@backstage/plugin-auth-backend'));
-backend.add(import('@backstage/plugin-auth-backend-module-guest-provider'));
-
 backend.start();

packages/create-app/templates/default-app/examples/org.yaml

@@ -7,15 +7,6 @@ metadata:
 spec:
   memberOf: [guests]
 ---
-# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-user
-apiVersion: backstage.io/v1alpha1
-kind: User
-metadata:
-  name: guest
-  namespace: development
-spec:
-  memberOf: [guests]
----
 # https://backstage.io/docs/features/software-catalog/descriptor-format#kind-group
 apiVersion: backstage.io/v1alpha1
 kind: Group

plugins/auth-backend-module-guest-provider/config.d.ts

@@ -17,11 +17,26 @@
 export interface Config {
   /** Configuration options for the auth plugin */
   auth?: {
-    /**
-     * EXPERIMENTAL value: Allow users to configure what the guest provider logs in as.
-     * @visibility frontend
-     * @default user:default/guest
-     */
-    guestEntityRef?: string;
+    providers: {
+      guest?: {
+        /**
+         * The entity reference to use for the guest user.
+         * @default user:development/guest
+         */
+        userEntityRef?: string;
+
+        /**
+         * A list of entity references to user for ownership of the guest user if the user
+         *  is not found in the catalog.
+         * @default [userEntityRef]
+         */
+        ownershipEntityRefs?: string[];
+
+        /**
+         * Allow users to sign in with the guest provider outside of their development environments.
+         */
+        dangerouslyAllowOutsideDevelopment?: boolean;
+      };
+    };
   };
 }

plugins/auth-backend-module-guest-provider/src/module.ts

@@ -46,7 +46,7 @@ export const authModuleGuestProvider = createBackendModule({
           factory: createProxyAuthProviderFactory({
             authenticator: guestAuthenticator,
             signInResolver: signInAsGuestUser(
-              config.getOptionalString('auth.guestEntityRef'),
+              config.getConfig('auth.providers.guest'),
             ),
           }),
         });

plugins/auth-backend-module-guest-provider/src/resolvers.ts

@@ -15,7 +15,9 @@
  */
 
 import { stringifyEntityRef } from '@backstage/catalog-model';
+import { Config } from '@backstage/config';
 import { SignInResolver } from '@backstage/plugin-auth-node';
+import { NotImplementedError } from '@backstage/errors';
 
 /**
  * Provide a default implementation of the user to resolve to. By default, this
@@ -23,15 +25,26 @@ import { SignInResolver } from '@backstage/plugin-auth-node';
  *  catalog. If that user doesn't exist in the catalog, we will still create a
  *  token for them so they can keep viewing.
  */
-export const signInAsGuestUser: (entityRef?: string) => SignInResolver<{}> =
-  (entityRef?: string) => async (_, ctx) => {
+export const signInAsGuestUser: (config: Config) => SignInResolver<{}> =
+  (config: Config) => async (_, ctx) => {
+    if (
+      process.env.NODE_ENV !== 'development' &&
+      config.getOptionalBoolean('dangerouslyAllowOutsideDevelopment') !== true
+    ) {
+      throw new NotImplementedError(
+        'The guest provider is NOT recommended for use outside of a development environment. If you want to enable this, set `auth.providers.guest.dangerouslyAllowOutsideDevelopment: true` in your app config.',
+      );
+    }
     const userRef =
-      entityRef ??
+      config.getOptionalString('userEntityRef') ??
       stringifyEntityRef({
         kind: 'user',
         namespace: 'development',
         name: 'guest',
       });
+    const ownershipRefs = config.getOptionalStringArray(
+      'ownershipEntityRefs',
+    ) ?? [userRef];
     try {
       return ctx.signInWithCatalogUser({ entityRef: userRef });
     } catch (err) {
@@ -39,7 +52,7 @@ export const signInAsGuestUser: (entityRef?: string) => SignInResolver<{}> =
       return ctx.issueToken({
         claims: {
           sub: userRef,
-          ent: [userRef],
+          ent: ownershipRefs,
         },
       });
     }