Merge pull request #22765 from drodil/auth_resolver_override

feat: allow overriding default ownership resolving

plugins/auth-backend/api-report.md

@@ -3,6 +3,7 @@
 > Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
 
 ```ts
+import { AuthOwnershipResolver } from '@backstage/plugin-auth-node';
 import { AuthProviderConfig as AuthProviderConfig_2 } from '@backstage/plugin-auth-node';
 import { AuthProviderFactory as AuthProviderFactory_2 } from '@backstage/plugin-auth-node';
 import { AuthProviderRouteHandlers as AuthProviderRouteHandlers_2 } from '@backstage/plugin-auth-node';
@@ -665,6 +666,8 @@ export interface RouterOptions {
   // (undocumented)
   logger: LoggerService;
   // (undocumented)
+  ownershipResolver?: AuthOwnershipResolver;
+  // (undocumented)
   providerFactories?: ProviderFactories;
   // (undocumented)
   tokenFactoryAlgorithm?: string;

plugins/auth-backend/src/authPlugin.ts

@@ -19,6 +19,8 @@ import {
   createBackendPlugin,
 } from '@backstage/backend-plugin-api';
 import {
+  authOwnershipResolutionExtensionPoint,
+  AuthOwnershipResolver,
   AuthProviderFactory,
   authProvidersExtensionPoint,
 } from '@backstage/plugin-auth-node';
@@ -34,6 +36,7 @@ export const authPlugin = createBackendPlugin({
   pluginId: 'auth',
   register(reg) {
     const providers = new Map<string, AuthProviderFactory>();
+    let ownershipResolver: AuthOwnershipResolver | undefined = undefined;
 
     reg.registerExtensionPoint(authProvidersExtensionPoint, {
       registerProvider({ providerId, factory }) {
@@ -46,6 +49,15 @@ export const authPlugin = createBackendPlugin({
       },
     });
 
+    reg.registerExtensionPoint(authOwnershipResolutionExtensionPoint, {
+      setAuthOwnershipResolver(resolver) {
+        if (ownershipResolver) {
+          throw new Error('Auth ownership resolver is already set');
+        }
+        ownershipResolver = resolver;
+      },
+    });
+
     reg.registerInit({
       deps: {
         httpRouter: coreServices.httpRouter,
@@ -80,6 +92,7 @@ export const authPlugin = createBackendPlugin({
           catalogApi,
           providerFactories: Object.fromEntries(providers),
           disableDefaultProviderFactories: true,
+          ownershipResolver,
         });
         httpRouter.addAuthPolicy({
           path: '/',

plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts

@@ -31,12 +31,13 @@ import {
   LoggerService,
 } from '@backstage/backend-plugin-api';
 import { TokenIssuer } from '../../identity/types';
-import { CatalogIdentityClient } from '../catalog';
 import {
+  AuthOwnershipResolver,
   AuthResolverCatalogUserQuery,
   AuthResolverContext,
   TokenParams,
 } from '@backstage/plugin-auth-node';
+import { CatalogIdentityClient } from '../catalog';
 
 /**
  * Uses the default ownership resolution logic to return an array
@@ -69,6 +70,7 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
     discovery: DiscoveryService;
     auth: AuthService;
     httpAuth: HttpAuthService;
+    ownershipResolver?: AuthOwnershipResolver;
   }): CatalogAuthResolverContext {
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi: options.catalogApi,
@@ -84,6 +86,7 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
       catalogIdentityClient,
       options.catalogApi,
       options.auth,
+      options.ownershipResolver,
     );
   }
 
@@ -93,6 +96,7 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
     public readonly catalogIdentityClient: CatalogIdentityClient,
     private readonly catalogApi: CatalogApi,
     private readonly auth: AuthService,
+    private readonly ownershipResolver?: AuthOwnershipResolver,
   ) {}
 
   async issueToken(params: TokenParams) {
@@ -160,12 +164,19 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
 
   async signInWithCatalogUser(query: AuthResolverCatalogUserQuery) {
     const { entity } = await this.findCatalogUser(query);
-    const ownershipRefs = getDefaultOwnershipEntityRefs(entity);
+    let ent: string[];
+    if (this.ownershipResolver) {
+      const { ownershipEntityRefs } =
+        await this.ownershipResolver.resolveOwnershipEntityRefs(entity);
+      ent = ownershipEntityRefs;
+    } else {
+      ent = getDefaultOwnershipEntityRefs(entity);
+    }
 
     const token = await this.tokenIssuer.issueToken({
       claims: {
         sub: stringifyEntityRef(entity),
-        ent: ownershipRefs,
+        ent,
       },
     });
     return { token };

plugins/auth-backend/src/providers/router.ts

@@ -25,8 +25,11 @@ import {
 } from '@backstage/backend-plugin-api';
 import { CatalogApi, CatalogClient } from '@backstage/catalog-client';
 import { Config } from '@backstage/config';
-import { NotFoundError, assertError } from '@backstage/errors';
-import { AuthProviderFactory } from '@backstage/plugin-auth-node';
+import { assertError, NotFoundError } from '@backstage/errors';
+import {
+  AuthOwnershipResolver,
+  AuthProviderFactory,
+} from '@backstage/plugin-auth-node';
 import express from 'express';
 import Router from 'express-promise-router';
 import { Minimatch } from 'minimatch';
@@ -49,6 +52,7 @@ export function bindProviderRouters(
     httpAuth: HttpAuthService;
     tokenManager: TokenManager;
     tokenIssuer: TokenIssuer;
+    ownershipResolver?: AuthOwnershipResolver;
     catalogApi?: CatalogApi;
   },
 ) {
@@ -64,6 +68,7 @@ export function bindProviderRouters(
     tokenManager,
     tokenIssuer,
     catalogApi,
+    ownershipResolver,
   } = options;
 
   const providersConfig = config.getOptionalConfig('auth.providers');
@@ -95,6 +100,7 @@ export function bindProviderRouters(
             discovery,
             auth,
             httpAuth,
+            ownershipResolver,
           }),
         });
 

plugins/auth-backend/src/service/router.ts

@@ -23,15 +23,16 @@ import {
   LoggerService,
 } from '@backstage/backend-plugin-api';
 import { defaultAuthProviderFactories } from '../providers';
+import { AuthOwnershipResolver } from '@backstage/plugin-auth-node';
 import {
+  createLegacyAuthAdapters,
   PluginDatabaseManager,
   PluginEndpointDiscovery,
   TokenManager,
-  createLegacyAuthAdapters,
 } from '@backstage/backend-common';
 import { NotFoundError } from '@backstage/errors';
 import { CatalogApi } from '@backstage/catalog-client';
-import { bindOidcRouter, TokenFactory, KeyStores } from '../identity';
+import { bindOidcRouter, KeyStores, TokenFactory } from '../identity';
 import session from 'express-session';
 import connectSessionKnex from 'connect-session-knex';
 import passport from 'passport';
@@ -41,7 +42,7 @@ import { TokenIssuer } from '../identity/types';
 import { StaticTokenIssuer } from '../identity/StaticTokenIssuer';
 import { StaticKeyStore } from '../identity/StaticKeyStore';
 import { Config } from '@backstage/config';
-import { ProviderFactories, bindProviderRouters } from '../providers/router';
+import { bindProviderRouters, ProviderFactories } from '../providers/router';
 
 /** @public */
 export interface RouterOptions {
@@ -56,6 +57,7 @@ export interface RouterOptions {
   providerFactories?: ProviderFactories;
   disableDefaultProviderFactories?: boolean;
   catalogApi?: CatalogApi;
+  ownershipResolver?: AuthOwnershipResolver;
 }
 
 /** @public */