import { jwtDecode } from 'jwt-decode';
import { createBackendModule } from '@backstage/backend-plugin-api';
import { microsoftAuthenticator } from '@backstage/plugin-auth-backend-module-microsoft-provider';
import {
  authProvidersExtensionPoint,
  createOAuthProviderFactory,
} from '@backstage/plugin-auth-node';

export const customMicrosoftAuth = createBackendModule({
  // This ID must be exactly "auth" because that's the plugin it targets
  pluginId: 'auth',
  // This ID must be unique, but can be anything
  moduleId: 'custom-microsoft-provider',
  register(reg) {
    reg.registerInit({
      deps: { providers: authProvidersExtensionPoint },
      async init({ providers }) {
        providers.registerProvider({
          // This ID must match the actual provider config, e.g. addressing
          // auth.providers.github means that this must be "github".
          providerId: 'microsoft',
          // Use createProxyAuthProviderFactory instead if it's one of the proxy
          // based providers rather than an OAuth based one
          factory: createOAuthProviderFactory({
            authenticator: microsoftAuthenticator,
            async signInResolver(info, ctx) {
              const { result } = info;
              const { fullProfile, session } = result;
              // We take either the full profile ID or the OID from the session
              const id = fullProfile?.id ?? jwtDecode<{ oid?: string }>(session.accessToken)?.oid;
              if (typeof id !== 'string') {
                throw new Error("Microsoft profile contained no valid id");
              }
              return ctx.signInWithCatalogUser({
                annotations: {
                  "graph.microsoft.com/user-id": id
                }
              });
            },
          }),
        });
      },
    });
  },
});

import { createBackendModule } from '@backstage/backend-plugin-api';
import { microsoftAuthenticator } from '@backstage/plugin-auth-backend-module-microsoft-provider';
import {
  authProvidersExtensionPoint,
  createOAuthProviderFactory
} from '@backstage/plugin-auth-node';
import {
  stringifyEntityRef,
  DEFAULT_NAMESPACE
} from '@backstage/catalog-model';

export const customAuth = createBackendModule({
  // This ID must be exactly "auth" because that's the plugin it targets
  pluginId: 'auth',
  // This ID must be unique, but can be anything
  moduleId: 'custom-auth-provider',
  register(reg) {
    reg.registerInit({
      deps: { providers: authProvidersExtensionPoint },
      async init({ providers }) {
        providers.registerProvider({
          // This ID must match the actual provider config, e.g. addressing
          // auth.providers.github means that this must be "github".
          providerId: 'microsoft',
          // Use createProxyAuthProviderFactory instead if it's one of the proxy
          // based providers rather than an OAuth based one
          factory: createOAuthProviderFactory({
            authenticator: microsoftAuthenticator,
            async signInResolver(info, ctx) {
              const {
                profile: { email },
              } = info;

              // Profiles are not always guaranteed to to have an email address.
              // You can also find more provider-specific information in `info.result`.
              // It typically contains a `fullProfile` object as well as ID and/or access
              // tokens that you can use for additional lookups.
              if (!email) {
                throw new Error('User profile contained no email');
              }

              // This example resolver simply uses the local part of the email as the name.
              const [name, domain] = email.split('@');

              // This helper function handles sign-in by looking up a user in the catalog.
              // The lookup can be done either by reference, annotations, or custom filters.
              // Next we verify the email domain. It is recommended to include this
              // kind of check if you don't look up the user in an external service.
              if (domain !== 'mycompanydomain.com') {
                throw new Error(
                  `Login failed, this email ${email} does not belong to the expected domain`
                );
              }
              // The helper also issues a token for the user, using the standard group
              // membership logic to determine the ownership references of the user.
              //
              // There are a number of other methods on the ctx, feel free to explore them!
              return ctx
                .signInWithCatalogUser({
                  entityRef: { name },
                })
                .catch(error => {
                  if (error.name === 'NotFoundError') {
                    // By using `stringifyEntityRef` we ensure that the reference is formatted correctly
                    const userEntity = stringifyEntityRef({
                      kind: 'User',
                      name: name,
                      namespace: DEFAULT_NAMESPACE,
                    });
                    return ctx.issueToken({
                      claims: {
                        sub: userEntity,
                        ent: [userEntity],
                      },
                    });
                  }

                  throw error; // re-throw the error if it's not a UserNotFound error
                });
            },
          }),
        });
      },
    });
  },
});