From e1afe84d75f4357df02e43102ffd2075dd4c3a3a Mon Sep 17 00:00:00 2001
From: Vincenzo Scamporlino <vincenzos@spotify.com>
Date: Wed, 3 Apr 2024 21:38:45 +0200
Subject: [PATCH] backend-app-api: return valid subject

Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
---
 .../src/services/implementations/auth/PluginTokenHandler.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts b/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts
index fa6337d8e1..5a20368dfd 100644
--- a/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts
+++ b/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts
@@ -83,9 +83,12 @@ export class PluginTokenHandler {
         // TODO(vinzscam): add audience verification
       });
 
+      if (!payload.sub) {
+        throw new AuthenticationError('Missing subject');
+      }
       console.log('payload', payload);
       console.log('protected header', protectedHeader);
-      return { subject: 'is me' };
+      return { subject: payload.sub };
     } catch (e) {
       // TODO(vinzscam): here we need to handle errors properly
       throw e;
@@ -124,7 +127,6 @@ export class PluginTokenHandler {
       const url = `${await this.discovery.getBaseUrl(
         pluginId,
       )}/.backstage/auth/v1/jwks.json`;
-      console.log('fetching from', url);
       this.jwksMap[pluginId] = createRemoteJWKSet(new URL(url));
     }
     return this.jwksMap[pluginId];