From 762520d1baee561c588e6eee488da3d90d86b959 Mon Sep 17 00:00:00 2001
From: Tim Hansen <timbonicus@gmail.com>
Date: Tue, 3 Aug 2021 08:12:04 -0600
Subject: [PATCH] Structure args, return inflated ent

Signed-off-by: Tim Hansen <timbonicus@gmail.com>
---
 docs/auth/identity-resolver.md                | 12 ++++----
 .../lib/catalog/CatalogIdentityClient.test.ts | 25 +++++++----------
 .../src/lib/catalog/CatalogIdentityClient.ts  | 28 +++++++++----------
 3 files changed, 31 insertions(+), 34 deletions(-)

diff --git a/docs/auth/identity-resolver.md b/docs/auth/identity-resolver.md
index 38d7567172..0dc1c7434e 100644
--- a/docs/auth/identity-resolver.md
+++ b/docs/auth/identity-resolver.md
@@ -130,16 +130,18 @@ export default async function createPlugin({
           resolver: async ({ profile: { email } }, ctx) => {
             const [sub] = email?.split('@') ?? '';
             // Fetch from an external system that returns entity claims like:
-            // 'user:default/breanna.davison'
+            // ['user:default/breanna.davison', ...]
             const ent = await externalSystemClient.getUsernames(email);
 
             // Resolve group membership from the Backstage catalog
-            const claims = await ctx.catalogIdentityClient.resolveCatalogMemberClaims(
+            const fullEnt = await ctx.catalogIdentityClient.resolveCatalogMemberClaims({
               sub,
               ent,
-              ctx.logger,
-            );
-            const token = await ctx.tokenIssuer.issueToken(claims);
+              logger: ctx.logger,
+            });
+            const token = await ctx.tokenIssuer.issueToken({
+              claims: { sub: id, fullEnt },
+            });
             return { sub, token };
           },
         },
diff --git a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
index 6f05bef5f8..f5c3219e10 100644
--- a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
+++ b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
@@ -118,10 +118,10 @@ describe('CatalogIdentityClient', () => {
       tokenIssuer,
     });
 
-    const claims = await client.resolveCatalogMemberClaims('inigom', [
-      'User:default/imontoya',
-      'User:reality/mpatinkin',
-    ]);
+    const claims = await client.resolveCatalogMemberClaims({
+      sub: 'inigom',
+      ent: ['User:default/imontoya', 'User:reality/mpatinkin'],
+    });
 
     expect(catalogApi.getEntities).toHaveBeenCalledWith({
       filter: [
@@ -143,16 +143,11 @@ describe('CatalogIdentityClient', () => {
       ],
     });
 
-    expect(claims).toMatchObject({
-      claims: {
-        sub: 'inigom',
-        ent: [
-          'user:default/imontoya',
-          'user:reality/mpatinkin',
-          'group:default/team-a',
-          'group:reality/screen-actors-guild',
-        ],
-      },
-    });
+    expect(claims).toMatchObject([
+      'user:default/imontoya',
+      'user:reality/mpatinkin',
+      'group:default/team-a',
+      'group:reality/screen-actors-guild',
+    ]);
   });
 });
diff --git a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
index c1f54f74c8..7b29ed859b 100644
--- a/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
+++ b/plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
@@ -24,12 +24,18 @@ import {
   stringifyEntityRef,
   UserEntity,
 } from '@backstage/catalog-model';
-import { TokenIssuer, TokenParams } from '../../identity';
+import { TokenIssuer } from '../../identity';
 
 type UserQuery = {
   annotations: Record<string, string>;
 };
 
+type MemberClaimQuery = {
+  sub: string;
+  ent: string[];
+  logger?: Logger;
+};
+
 /**
  * A catalog client tailored for reading out identity data from the catalog.
  */
@@ -78,14 +84,13 @@ export class CatalogIdentityClient {
    * provided, but group membership and transient group membership lean on imported catalog
    * relations.
    *
-   * Returns a claim structure that can be passed directly to `issueToken`, with the same sub and a
-   * superset of `ent` claims.
+   * Returns a superset of the `ent` argument that can be passed directly to `issueToken` as `ent`.
    */
-  async resolveCatalogMemberClaims(
-    sub: string,
-    ent: string[],
-    logger?: Logger,
-  ): Promise<TokenParams> {
+  async resolveCatalogMemberClaims({
+    sub,
+    ent,
+    logger,
+  }: MemberClaimQuery): Promise<string[]> {
     const subRef: EntityName = parseEntityRef(sub, {
       defaultKind: 'user',
       defaultNamespace: 'default',
@@ -139,11 +144,6 @@ export class CatalogIdentityClient {
     );
 
     logger?.debug(`Found claims for ${sub} in the catalog: ${newEnt.join()}`);
-    return {
-      claims: {
-        sub,
-        ent: newEnt,
-      },
-    };
+    return newEnt;
   }
 }