oidc and googld subs will be full entity refs

Signed-off-by: elonj <elonj@spotify.com>

plugins/auth-backend/src/providers/google/provider.ts

@@ -227,7 +227,7 @@ const googleDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   }
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -211,20 +211,22 @@ export class OidcAuthProvider implements OAuthHandlers {
   }
 }
 
-export const oAuth2DefaultSignInResolver: SignInResolver<
-  OidcAuthResult
-> = async (info, ctx) => {
-  const { profile } = info;
+export const oAuth2DefaultSignInResolver: SignInResolver<OidcAuthResult> =
+  async (info, ctx) => {
+    const { profile } = info;
 
-  if (!profile.email) {
-    throw new Error('Profile contained no email');
-  }
-  const userId = profile.email.split('@')[0];
-  const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
-  });
-  return { id: userId, token };
-};
+    if (!profile.email) {
+      throw new Error('Profile contained no email');
+    }
+    const userId = profile.email.split('@')[0];
+    const token = await ctx.tokenIssuer.issueToken({
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
+    });
+    return { id: userId, token };
+  };
 
 /**
  * OIDC provider callback options. An auth handler and a sign in resolver