From 86d5f4a07ca9a2545e26e4fcb170ef0d9a4ca08b Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Wed, 9 Apr 2025 11:52:48 +0200
Subject: [PATCH] backend-defaults: add via to credentials
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../backend-defaults/src/entrypoints/auth/DefaultAuthService.ts | 1 +
 packages/backend-defaults/src/entrypoints/auth/helpers.ts       | 2 ++
 .../backend-plugin-api/src/services/definitions/AuthService.ts  | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts b/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts
index a81a99fec7..189976ed7d 100644
--- a/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/DefaultAuthService.ts
@@ -68,6 +68,7 @@ export class DefaultAuthService implements AuthService {
           userResult.userEntityRef,
           pluginResult.limitedUserToken,
           this.#getJwtExpiration(pluginResult.limitedUserToken),
+          pluginResult.subject,
         );
       }
       return createCredentialsWithServicePrincipal(pluginResult.subject);
diff --git a/packages/backend-defaults/src/entrypoints/auth/helpers.ts b/packages/backend-defaults/src/entrypoints/auth/helpers.ts
index dad36670b9..266d3e86b8 100644
--- a/packages/backend-defaults/src/entrypoints/auth/helpers.ts
+++ b/packages/backend-defaults/src/entrypoints/auth/helpers.ts
@@ -51,6 +51,7 @@ export function createCredentialsWithUserPrincipal(
   sub: string,
   token: string,
   expiresAt?: Date,
+  viaSubject?: string,
 ): InternalBackstageCredentials<BackstageUserPrincipal> {
   return Object.defineProperty(
     {
@@ -60,6 +61,7 @@ export function createCredentialsWithUserPrincipal(
       principal: {
         type: 'user',
         userEntityRef: sub,
+        ...(viaSubject && { via: { type: 'service', subject: viaSubject } }),
       },
     },
     'token',
diff --git a/packages/backend-plugin-api/src/services/definitions/AuthService.ts b/packages/backend-plugin-api/src/services/definitions/AuthService.ts
index 1e0cf6e56b..eeac3ea924 100644
--- a/packages/backend-plugin-api/src/services/definitions/AuthService.ts
+++ b/packages/backend-plugin-api/src/services/definitions/AuthService.ts
@@ -35,6 +35,8 @@ export type BackstageUserPrincipal = {
    * The entity ref of the user entity that this principal represents.
    */
   userEntityRef: string;
+
+  via?: BackstageServicePrincipal;
 };
 
 /**