Merge pull request #28433 from tylerd-canva/cfaccess-email-fallback

cfaccess: fallback to identity email when constructing the user profile

.changeset/fast-seas-hunt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch
+---
+
+Use the email from `cfIdentity` instead of `claims` when constructing user profile in order to support Cloudflare Service Tokens.

plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts

@@ -18,14 +18,14 @@ import { mockServices } from '@backstage/backend-test-utils';
 import { createCloudflareAccessAuthenticator } from './authenticator';
 
 describe('authenticator', () => {
-  it('createCloudflareAccessAuthenticator works', async () => {
+  it('works for normal users', async () => {
     const auth = createCloudflareAccessAuthenticator({
       cache: mockServices.cache.mock(),
     });
 
     const profile = await auth.defaultProfileTransform(
       {
-        cfIdentity: { name: 'Name' } as any,
+        cfIdentity: { name: 'Name', email: 'hello@example.com' } as any,
         claims: { email: 'hello@example.com' } as any,
         token: 'fake',
       },
@@ -38,4 +38,25 @@ describe('authenticator', () => {
       },
     });
   });
+
+  it('works for service tokens', async () => {
+    const auth = createCloudflareAccessAuthenticator({
+      cache: mockServices.cache.mock(),
+    });
+
+    const profile = await auth.defaultProfileTransform(
+      {
+        cfIdentity: { name: 'Name', email: 'hello@example.com' } as any,
+        claims: {} as any,
+        token: 'fake',
+      },
+      {} as any,
+    );
+    expect(profile).toEqual({
+      profile: {
+        displayName: 'Name',
+        email: 'hello@example.com',
+      },
+    });
+  });
 });

plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts

@@ -38,7 +38,7 @@ export function createCloudflareAccessAuthenticator(options?: {
     async defaultProfileTransform(result: CloudflareAccessResult) {
       return {
         profile: {
-          email: result.claims.email,
+          email: result.cfIdentity.email,
           displayName: result.cfIdentity.name,
         },
       };