From cac3ba68a2630ae7a4177371ec349a740347512d Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Wed, 27 Apr 2022 20:20:32 +0200
Subject: [PATCH] auth-backend: fix ent claim being dropped

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/beige-panthers-dream.md                     | 5 +++++
 plugins/auth-backend/src/identity/TokenFactory.test.ts | 5 ++++-
 plugins/auth-backend/src/identity/TokenFactory.ts      | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/beige-panthers-dream.md

diff --git a/.changeset/beige-panthers-dream.md b/.changeset/beige-panthers-dream.md
new file mode 100644
index 0000000000..e477419c13
--- /dev/null
+++ b/.changeset/beige-panthers-dream.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixed a bug that was introduced in `0.13.1-next.0` which caused the `ent` claim of issued tokens to be dropped.
diff --git a/plugins/auth-backend/src/identity/TokenFactory.test.ts b/plugins/auth-backend/src/identity/TokenFactory.test.ts
index 14b3a00a7f..3ae6b895bc 100644
--- a/plugins/auth-backend/src/identity/TokenFactory.test.ts
+++ b/plugins/auth-backend/src/identity/TokenFactory.test.ts
@@ -47,7 +47,9 @@ describe('TokenFactory', () => {
     });
 
     await expect(factory.listPublicKeys()).resolves.toEqual({ keys: [] });
-    const token = await factory.issueToken({ claims: { sub: entityRef } });
+    const token = await factory.issueToken({
+      claims: { sub: entityRef, ent: [entityRef] },
+    });
 
     const { keys } = await factory.listPublicKeys();
     const keyStore = createLocalJWKSet({ keys: keys });
@@ -57,6 +59,7 @@ describe('TokenFactory', () => {
       iss: 'my-issuer',
       aud: 'backstage',
       sub: entityRef,
+      ent: [entityRef],
       iat: expect.any(Number),
       exp: expect.any(Number),
     });
diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts
index b72c3ef06d..cb24d7ccd1 100644
--- a/plugins/auth-backend/src/identity/TokenFactory.ts
+++ b/plugins/auth-backend/src/identity/TokenFactory.ts
@@ -89,7 +89,7 @@ export class TokenFactory implements TokenIssuer {
       throw new AuthenticationError('No algorithm was provided in the key');
     }
 
-    return new SignJWT({ iss, sub, aud, iat, exp })
+    return new SignJWT({ iss, sub, ent, aud, iat, exp })
       .setProtectedHeader({ alg: key.alg, kid: key.kid })
       .setIssuer(iss)
       .setAudience(aud)