(feat) implement JWT parsing and error handling in CLI commands

Author: paoloanzn

cli/src/index.ts

@@ -6,20 +6,25 @@ import { sepolia, foundry } from "viem/chains";
 import { importAbi } from "@/importAbi.js";
 import packageJson from "../package.json" with { type: "json" };
 import { exit } from "node:process";
+import { parseJwt } from "./oidc.js";
 
 const COMMAND_NAME = "fcf";
 const COMMAND_DESCRIPTION = "FCF CLI tool."
 const VERSION = packageJson?.version || "v0.0.1";
 
+function die(err: any): never {
+    let error = "unknown error";
+    if (err instanceof Error) error = err.message;
+    console.error(`${COMMAND_NAME}: ${error}; exiting.`)
+    exit(1);
+}
+
 // import abi -> created by forge build
 let abi: Abi | null = null;
 try {
     abi = importAbi();
 } catch (err) {
-    let error = "unknown error";
-    if (err instanceof Error) error = err.message;
-    console.error(`${COMMAND_NAME}: ${error}; exiting.`)
-    exit(1);
+    die(err);
 }
 
 const RepoRegisteredEvent = parseAbiItem(
@@ -48,17 +53,32 @@ function clients() {
 
 program
     .command("register")
-    .requiredOption("--repo-id <n>", "GitHub repository_id")
-    .requiredOption("--owner-id <n>", "GitHub owner numeric id")
+    .requiredOption("--oidcToken <token>", "GitHub's OIDC repository token")
     // needs to be removed in prod or be a default
     .requiredOption("--contract <addr>", "deployed RIK address")
     .action(async (opts) => {
         const { wallet, publicC, account } = clients();
+
+        const jwt = (() => {
+            try {
+                return parseJwt(opts.oidcToken);
+            } catch(err) {
+                die(err);
+            }
+        })();
+
+        const expectedAud = account.address.toLowerCase();
+        if (jwt.payload.aud?.toLowerCase() !== expectedAud) {
+            die(new Error(`aud mismatch: want ${expectedAud}, got ${jwt.payload.aud}`));
+        }
+        const repoId = BigInt(jwt.payload.repository_id);
+        const ownerId = BigInt(jwt.payload.repository_owner_id);
+
         const hash = await wallet.writeContract({
             address: opts.contract as `0x${string}`,
             abi,
             functionName: "register",
-            args: [BigInt(opts.repoId), BigInt(opts.ownerId)],
+            args: [repoId, ownerId],
             account,
         });
         const r = await publicC.waitForTransactionReceipt({ hash });

cli/src/oidc.ts

@@ -0,0 +1,17 @@
+function b64urlDecode(s: string): Buffer {
+    s = s.replace(/-/g, "+").replace(/_/g, "/");
+    while (s.length % 4) s += "=";
+    return Buffer.from(s, "base64");
+}
+
+export type JwtParts = {
+    headerB64: string; payloadB64: string; signatureB64: string;
+    payload: any;
+}
+
+export function parseJwt(jwt: string): JwtParts {
+    const [headerB64, payloadB64, signatureB64] = jwt.split(".");
+    if (!payloadB64 || !headerB64 || !signatureB64) throw Error("Failed to decode jwt");
+    const payload = JSON.parse(b64urlDecode(payloadB64).toString("utf-8"));
+    return { headerB64, payloadB64, signatureB64, payload };
+}

cli/test/oidc.test.ts

@@ -0,0 +1,13 @@
+import { test, expect } from "vitest";
+import { parseJwt } from "@/oidc.js";
+
+test("parses GitHub OIDC payload", () => {
+    // real (but expired) token
+    const jwt = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjB0WVZjTSJ9" +
+                ".eyJyZXBvc2l0b3J5X2lkIjoiMTIzNDUiLCJyZXBvc2l0b3J5X293bmV" +
+                "yX2lkIjoiOTk5IiwiYXVkIjoiMHhmMzlmIn0.AAAA";
+
+    const p = parseJwt(jwt).payload;
+    expect(p.repository_id).toBe("12345");
+    expect(p.repository_owner_id).toBe("999");
+});

cli/tsconfig.json

@@ -4,7 +4,7 @@
     // know bug -> https://github.com/egoist/tsup/issues/1389
     "ignoreDeprecations": "6.0",
     // File Layout
-    "rootDir": "./src",
+    "rootDir": ".",
     "outDir": "./dist",
     "paths": {
       "@/*": ["./src/*"]

cli/vitest.config.ts

@@ -0,0 +1,10 @@
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+    resolve: {
+        alias: {
+            "@": fileURLToPath(new URL("./src", import.meta.url)),
+        },
+    },
+});