From d4a8246fd1799d95c4d2b2a25b75c0caf5a5e56f Mon Sep 17 00:00:00 2001
From: Tyler Davis <tylerd@canva.com>
Date: Sat, 11 Jan 2025 00:01:57 +1100
Subject: [PATCH] cfaccess: fallback to identity email when constructing the
 user profile

Signed-off-by: Tyler Davis <tylerd@canva.com>
---
 .changeset/fast-seas-hunt.md                  |  5 ++++
 .../src/authenticator.test.ts                 | 23 ++++++++++++++++++-
 .../src/authenticator.ts                      |  2 +-
 3 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/fast-seas-hunt.md

diff --git a/.changeset/fast-seas-hunt.md b/.changeset/fast-seas-hunt.md
new file mode 100644
index 0000000000..6e187cb6b1
--- /dev/null
+++ b/.changeset/fast-seas-hunt.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch
+---
+
+Fallback to email from cfIdentity when constructing user profile for Service Token support.
diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts
index 678e513412..69fcb742e5 100644
--- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts
+++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts
@@ -18,7 +18,7 @@ import { mockServices } from '@backstage/backend-test-utils';
 import { createCloudflareAccessAuthenticator } from './authenticator';
 
 describe('authenticator', () => {
-  it('createCloudflareAccessAuthenticator works', async () => {
+  it('works for normal users', async () => {
     const auth = createCloudflareAccessAuthenticator({
       cache: mockServices.cache.mock(),
     });
@@ -38,4 +38,25 @@ describe('authenticator', () => {
       },
     });
   });
+
+  it('works for service tokens', async () => {
+    const auth = createCloudflareAccessAuthenticator({
+      cache: mockServices.cache.mock(),
+    });
+
+    const profile = await auth.defaultProfileTransform(
+      {
+        cfIdentity: { name: 'Name', email: 'hello@example.com' } as any,
+        claims: {} as any,
+        token: 'fake',
+      },
+      {} as any,
+    );
+    expect(profile).toEqual({
+      profile: {
+        displayName: 'Name',
+        email: 'hello@example.com',
+      },
+    });
+  });
 });
diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts
index c15a1a19a0..632c439d7e 100644
--- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts
@@ -38,7 +38,7 @@ export function createCloudflareAccessAuthenticator(options?: {
     async defaultProfileTransform(result: CloudflareAccessResult) {
       return {
         profile: {
-          email: result.claims.email,
+          email: result.claims.email ?? result.cfIdentity.email,
           displayName: result.cfIdentity.name,
         },
       };