From ab53e6fed475e203791f1654e51d43e1cec52c1f Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Tue, 13 May 2025 12:03:29 +0200
Subject: [PATCH] changesets: split changeset for new
 dangerousEntityRefFallback option

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/tall-suits-share-auth-backend.md |  5 +++
 .changeset/tall-suits-share-auth-node.md    | 38 +++++++++++++++++++++
 .changeset/tall-suits-share.md              |  4 +--
 3 files changed, 44 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/tall-suits-share-auth-backend.md
 create mode 100644 .changeset/tall-suits-share-auth-node.md

diff --git a/.changeset/tall-suits-share-auth-backend.md b/.changeset/tall-suits-share-auth-backend.md
new file mode 100644
index 0000000000..3f5230c4e3
--- /dev/null
+++ b/.changeset/tall-suits-share-auth-backend.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Added support for the new `dangerousEntityRefFallback` option for `signInWithCatalogUser` in `AuthResolverContext`.
diff --git a/.changeset/tall-suits-share-auth-node.md b/.changeset/tall-suits-share-auth-node.md
new file mode 100644
index 0000000000..cccd3537f7
--- /dev/null
+++ b/.changeset/tall-suits-share-auth-node.md
@@ -0,0 +1,38 @@
+---
+'@backstage/plugin-auth-node': patch
+---
+
+Added a new `dangerousEntityRefFallback` option to the `signInWithCatalogUser` method in `AuthResolverContext`. The option will cause the provided entity reference to be used as a fallback in case the user is not found in the catalog. It is up to the caller to provide the fallback entity reference.
+
+Auth providers that include pre-defined sign-in resolvers are encouraged to define a flag named `dangerouslyAllowSignInWithoutUserInCatalog` in their config, which in turn enables use of the `dangerousEntityRefFallback` option. For example:
+
+```ts
+export const usernameMatchingUserEntityName = createSignInResolverFactory({
+  optionsSchema: z
+    .object({
+      dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),
+    })
+    .optional(),
+  create(options = {}) {
+    return async (
+      info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,
+      ctx,
+    ) => {
+      const { username } = info.result.fullProfile;
+      if (!username) {
+        throw new Error('User profile does not contain a username');
+      }
+
+      return ctx.signInWithCatalogUser(
+        { entityRef: { name: username } },
+        {
+          dangerousEntityRefFallback:
+            options?.dangerouslyAllowSignInWithoutUserInCatalog
+              ? { entityRef: { name: username } }
+              : undefined,
+        },
+      );
+    };
+  },
+});
+```
diff --git a/.changeset/tall-suits-share.md b/.changeset/tall-suits-share.md
index b7c5d1ccfe..05b74bc277 100644
--- a/.changeset/tall-suits-share.md
+++ b/.changeset/tall-suits-share.md
@@ -16,8 +16,6 @@
 '@backstage/plugin-auth-backend-module-oauth2-provider': patch
 '@backstage/plugin-auth-backend-module-oidc-provider': patch
 '@backstage/plugin-auth-backend-module-okta-provider': patch
-'@backstage/plugin-auth-backend': patch
-'@backstage/plugin-auth-node': patch
 ---
 
-introduce dangerouslyAllowSignInWithoutUserInCatalog auth resolver config
+Introduce `dangerouslyAllowSignInWithoutUserInCatalog` auth resolver config.