backend-defaults: add via to credentials

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>

packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts

@@ -68,6 +68,7 @@ export class DefaultAuthService implements AuthService {
           userResult.userEntityRef,
           pluginResult.limitedUserToken,
           this.#getJwtExpiration(pluginResult.limitedUserToken),
+          pluginResult.subject,
         );
       }
       return createCredentialsWithServicePrincipal(pluginResult.subject);

packages/backend-defaults/src/entrypoints/auth/helpers.ts

@@ -51,6 +51,7 @@ export function createCredentialsWithUserPrincipal(
   sub: string,
   token: string,
   expiresAt?: Date,
+  viaSubject?: string,
 ): InternalBackstageCredentials<BackstageUserPrincipal> {
   return Object.defineProperty(
     {
@@ -60,6 +61,7 @@ export function createCredentialsWithUserPrincipal(
       principal: {
         type: 'user',
         userEntityRef: sub,
+        ...(viaSubject && { via: { type: 'service', subject: viaSubject } }),
       },
     },
     'token',

packages/backend-plugin-api/src/services/definitions/AuthService.ts

@@ -35,6 +35,8 @@ export type BackstageUserPrincipal = {
    * The entity ref of the user entity that this principal represents.
    */
   userEntityRef: string;
+
+  via?: BackstageServicePrincipal;
 };
 
 /**