introduce dangerouslyAllowSignInWithoutUserInCatalog auth resolver config

Signed-off-by: Jessica He <jhe@redhat.com>

plugins/auth-node/src/sign-in/commonSignInResolvers.ts

@@ -35,7 +35,13 @@ export namespace commonSignInResolvers {
    */
   export const emailMatchingUserEntityProfileEmail =
     createSignInResolverFactory({
-      create() {
+      optionsSchema: z
+        .object({
+          allowedDomains: z.array(z.string()).optional(),
+          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),
+        })
+        .optional(),
+      create(options = {}) {
         return async (info, ctx) => {
           const { profile } = info;
 
@@ -59,11 +65,19 @@ export namespace commonSignInResolvers {
                 const [_, name, _plus, domain] = m;
                 const noPlusEmail = `${name}${domain}`;
 
-                return ctx.signInWithCatalogUser({
-                  filter: {
-                    'spec.profile.email': noPlusEmail,
+                return ctx.signInWithCatalogUser(
+                  {
+                    filter: {
+                      'spec.profile.email': noPlusEmail,
+                    },
                   },
-                });
+                  {
+                    dangerousEntityRefFallback:
+                      options?.dangerouslyAllowSignInWithoutUserInCatalog
+                        ? { name: noPlusEmail }
+                        : undefined,
+                  },
+                );
               }
             }
             // Email had no plus addressing or is missing in the catalog, forward failure
@@ -82,6 +96,7 @@ export namespace commonSignInResolvers {
       optionsSchema: z
         .object({
           allowedDomains: z.array(z.string()).optional(),
+          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),
         })
         .optional(),
       create(options = {}) {
@@ -102,10 +117,15 @@ export namespace commonSignInResolvers {
               'Sign-in user email is not from an allowed domain',
             );
           }
-
-          return ctx.signInWithCatalogUser({
-            entityRef: { name: localPart },
-          });
+          return ctx.signInWithCatalogUser(
+            { entityRef: { name: localPart } },
+            {
+              dangerousEntityRefFallback:
+                options?.dangerouslyAllowSignInWithoutUserInCatalog
+                  ? { name: localPart }
+                  : undefined,
+            },
+          );
         };
       },
     });

plugins/auth-node/src/types.ts

@@ -162,10 +162,24 @@ export type AuthResolverContext = {
    * Finds a single user in the catalog using the provided query, and then
    * issues an identity for that user using default ownership resolution.
    *
+   * If the user is not found, an optional `dangerousEntityRefFallback`
+   * entity ref can be provided to allow sign-in to proceed by issuing an
+   * identity based on the given ref. This bypasses the requirement for the
+   * user to exist in the catalog and should be used with caution.
+   *
    * See {@link AuthResolverCatalogUserQuery} for details.
    */
   signInWithCatalogUser(
     query: AuthResolverCatalogUserQuery,
+    options?: {
+      dangerousEntityRefFallback?:
+        | string
+        | {
+            kind?: string;
+            namespace?: string;
+            name: string;
+          };
+    },
   ): Promise<BackstageSignInResult>;
 
   /**