message: auth-backend: look up google users in the catalog via email annotation
diff: */
  import express from 'express';
  +import { Logger } from 'winston';
  import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
  import {
  executeFrameHandlerStrategy,
  @@ -36,15 +37,25 @@ import {
  OAuthRefreshRequest,
  } from '../../lib/oauth';
  import passport from 'passport';
  +import { CatalogIdentityClient } from '../../lib/catalog';
  type PrivateInfo = {
  refreshToken: string;
  };
  +export type GoogleAuthProviderOptions = OAuthProviderOptions & {
  + logger: Logger;
  + identityClient: CatalogIdentityClient;
  +};
  +
  export class GoogleAuthProvider implements OAuthHandlers {
  private readonly _strategy: GoogleStrategy;
  + private readonly logger: Logger;
  + private readonly identityClient: CatalogIdentityClient;
  - constructor(options: OAuthProviderOptions) {
  + constructor(options: GoogleAuthProviderOptions) {
  + this.logger = options.logger;
  + this.identityClient = options.identityClient;
  // TODO: throw error if env variables not set?
  this._strategy = new GoogleStrategy(
  {
  @@ -138,17 +149,44 @@ export class GoogleAuthProvider implements OAuthHandlers {
  throw new Error('Google profile contained no email');
  }
  - // TODO(Rugvip): Hardcoded to the local part of the email for now
  - const id = profile.email.split('@')[0];
  + const users = await this.identityClient.findUser({
  + annotations: {
  + 'google.com/email': profile.email,
  + },
  + });
  + if (users.length !== 1) {
  + if (users.length > 1) {
  + this.logger.info(
  + `Multiple identities found for Google user ${profile.email}`,
  + );
  + } else {
  + this.logger.info(`No identity found for Google user ${profile.email}`);
  + }
  +
  + this.logger.warn(
  + `Falling back to allowing login based on email pattern, this will probably break in the future`,
  + );
  + return {
  + ...response,
  + backstageIdentity: { id: profile.email.split('@')[0] },
  + };
  + }
  - return { ...response, backstageIdentity: { id } };
  + return {
  + ...response,
  + backstageIdentity: {
  + id: users[0].metadata.name,
  + },
  + };
  }
  }
  export const createGoogleProvider: AuthProviderFactory = ({
  globalConfig,
  config,
  + logger,
  tokenIssuer,
  + discovery,
  }) =>
  OAuthEnvironmentHandler.mapConfig(config, envConfig => {
  const providerId = 'google';
  @@ -160,6 +198,8 @@ export const createGoogleProvider: AuthProviderFactory = ({
  clientId,
  clientSecret,
  callbackUrl,
  + logger,
  + identityClient: new CatalogIdentityClient({ discovery }),
  });
  return OAuthAdapter.fromConfig(globalConfig, provider, {
  