chore: deno ci type checks and linting (#1694)

Author: zackpollard

.github/workflows/zitadel-actions.yml

@@ -0,0 +1,73 @@
+name: ZITADEL Actions Worker
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  pre-job:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check what should run
+        id: check
+        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        with:
+          github-token: ${{ github.token }}
+          filters: |
+            worker:
+              - 'services/zitadel-actions/**'
+          force-filters: |
+            - '.github/workflows/zitadel-actions.yml'
+
+  check:
+    name: Check & Test
+    needs: pre-job
+    if: ${{ fromJSON(needs.pre-job.outputs.should_run).worker == true }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: ./services/zitadel-actions
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
+        with:
+          deno-version: "2.8.3" # keep in sync with .mise/config.toml
+
+      - name: Format
+        run: deno task fmt
+        if: ${{ !cancelled() }}
+
+      - name: Lint
+        run: deno task lint
+        if: ${{ !cancelled() }}
+
+      - name: Type check
+        run: deno task check
+        if: ${{ !cancelled() }}
+
+      - name: Test
+        run: deno task test
+        if: ${{ !cancelled() }}
+
+      - name: Build (transpile)
+        run: deno task build > /dev/null
+        if: ${{ !cancelled() }}

services/zitadel-actions/deno.json

@@ -1,7 +1,13 @@
 {
+  "imports": {
+    "@std/assert": "jsr:@std/assert@^1.0.19",
+    "@deno/emit": "jsr:@deno/emit@^0.46.0"
+  },
   "tasks": {
     "test": "deno test",
-    "check": "deno check src/index.ts test/index.test.ts",
+    "check": "deno check src/index.ts test/index.test.ts scripts/build.ts",
+    "lint": "deno lint",
+    "fmt": "deno fmt --check",
     "build": "deno run --allow-read --allow-net --allow-env scripts/build.ts"
   },
   "compilerOptions": {

services/zitadel-actions/deno.lock

@@ -2,7 +2,7 @@
 // content_base64 — Cloudflare runs JS, the source is TS. Invoked by the
 // data.external in actions-v2.tf, so it must print ONLY a JSON object with the
 // JS string on stdout (deno's own download/progress noise goes to stderr).
-import { transpile } from "jsr:@deno/emit";
+import { transpile } from "@deno/emit";
 
 const entry = new URL("../src/index.ts", import.meta.url);
 const result = await transpile(entry);

services/zitadel-actions/scripts/build.ts

@@ -26,7 +26,9 @@ export interface Env {
 // Manipulation returned to ZITADEL. `{}` means "no change".
 export interface Manipulation {
   append_claims?: Array<{ key: string; value: unknown }>;
-  append_attribute?: Array<{ name: string; name_format: string; value: string[] }>;
+  append_attribute?: Array<
+    { name: string; name_format: string; value: string[] }
+  >;
 }
 
 type Handler = (body: unknown) => Manipulation | Promise<Manipulation>;
@@ -41,9 +43,17 @@ export default {
 
     switch (url.pathname) {
       case "/idp-intent":
-        return handleVerified(req, env.IDP_INTENT_SIGNING_KEY, (body) => handleIdpIntent(body as IdpIntentBody, env));
+        return await handleVerified(
+          req,
+          env.IDP_INTENT_SIGNING_KEY,
+          (body) => handleIdpIntent(body as IdpIntentBody, env),
+        );
       case "/token":
-        return handleVerified(req, env.TOKEN_SIGNING_KEY, (body) => handleToken(body as TokenBody, env));
+        return await handleVerified(
+          req,
+          env.TOKEN_SIGNING_KEY,
+          (body) => handleToken(body as TokenBody, env),
+        );
       default:
         return new Response("Not found", { status: 404 });
     }
@@ -54,7 +64,11 @@ export default {
 // return value into a JSON 200. A thrown handler error becomes a 500 — with
 // interrupt_on_error=false on the target, ZITADEL ignores it and the login
 // proceeds unchanged, so a worker fault can never break authentication.
-async function handleVerified(req: Request, signingKey: string, handler: Handler): Promise<Response> {
+async function handleVerified(
+  req: Request,
+  signingKey: string,
+  handler: Handler,
+): Promise<Response> {
   if (!signingKey) {
     console.error("[init] missing signing key binding");
     return new Response("Missing configuration", { status: 500 });
@@ -98,7 +112,10 @@ interface IdpIntentBody {
   response?: { userId?: string; idpInformation?: IdpInformation };
 }
 
-async function handleIdpIntent(body: IdpIntentBody, env: Env): Promise<Manipulation> {
+async function handleIdpIntent(
+  body: IdpIntentBody,
+  env: Env,
+): Promise<Manipulation> {
   const idp = body?.response?.idpInformation;
   const userId = body?.response?.userId;
   if (!idp || !userId) {
@@ -114,12 +131,16 @@ async function handleIdpIntent(body: IdpIntentBody, env: Env): Promise<Manipulat
   if (idp.idpId === env.GITHUB_IDP_ID) {
     // GitHub: primary email comes from /user/emails (profile email may be null
     // when the user keeps it private); name split mirrors the old v1 action.
-    email = (await githubPrimaryEmail(idp?.oauth?.accessToken)) ?? raw.email ?? null;
+    email = (await githubPrimaryEmail(idp?.oauth?.accessToken)) ?? raw.email ??
+      null;
     ({ firstName, lastName } = splitName(raw.login ?? idp.userName, raw.name));
   } else if (idp.idpId === env.GITLAB_IDP_ID) {
     // GitLab is OIDC — email + name are already in the userinfo.
     email = raw.email ?? null;
-    ({ firstName, lastName } = splitName(raw.nickname ?? raw.preferred_username ?? idp.userName, raw.name));
+    ({ firstName, lastName } = splitName(
+      raw.nickname ?? raw.preferred_username ?? idp.userName,
+      raw.name,
+    ));
   } else {
     console.log(`[idp-intent] idpId ${idp.idpId} not handled — skipping`);
     return {};
@@ -135,7 +156,9 @@ async function handleIdpIntent(body: IdpIntentBody, env: Env): Promise<Manipulat
   return {};
 }
 
-async function githubPrimaryEmail(accessToken: string | undefined): Promise<string | null> {
+async function githubPrimaryEmail(
+  accessToken: string | undefined,
+): Promise<string | null> {
   if (!accessToken) return null;
   const res = await fetch("https://api.github.com/user/emails", {
     headers: {
@@ -148,13 +171,18 @@ async function githubPrimaryEmail(accessToken: string | undefined): Promise<stri
     console.warn(`[github] /user/emails -> ${res.status}`);
     return null;
   }
-  const emails = (await res.json()) as Array<{ email: string; primary: boolean }>;
+  const emails = (await res.json()) as Array<
+    { email: string; primary: boolean }
+  >;
   return emails.find((e) => e.primary)?.email ?? null;
 }
 
 // Mirror the old v1 action's name split: first word is given name, the rest is
 // family name (defaulting to a single space, which ZITADEL requires non-empty).
-export function splitName(login: string | undefined, name: unknown): { firstName: string; lastName: string } {
+export function splitName(
+  login: string | undefined,
+  name: unknown,
+): { firstName: string; lastName: string } {
   let firstName = login ?? "";
   let lastName = " ";
   const parts = String(name ?? "").trim().split(" ");
@@ -170,27 +198,32 @@ async function updateHumanUser(
   firstName: string,
   lastName: string,
 ): Promise<void> {
-  const res = await fetch(`https://${env.ZITADEL_DOMAIN}/v2/users/human/${userId}`, {
-    method: "PUT",
-    headers: {
-      authorization: `Bearer ${env.ZITADEL_TOKEN}`,
-      "content-type": "application/json",
-    },
-    body: JSON.stringify({
-      // displayName isn't auto-derived on update (only at creation), so set it.
-      profile: {
-        givenName: firstName,
-        familyName: lastName,
-        displayName: `${firstName} ${lastName}`,
+  const res = await fetch(
+    `https://${env.ZITADEL_DOMAIN}/v2/users/human/${userId}`,
+    {
+      method: "PUT",
+      headers: {
+        authorization: `Bearer ${env.ZITADEL_TOKEN}`,
+        "content-type": "application/json",
       },
-      email: { email, isVerified: true },
-    }),
-  });
+      body: JSON.stringify({
+        // displayName isn't auto-derived on update (only at creation), so set it.
+        profile: {
+          givenName: firstName,
+          familyName: lastName,
+          displayName: `${firstName} ${lastName}`,
+        },
+        email: { email, isVerified: true },
+      }),
+    },
+  );
   const text = await res.text();
   if (!res.ok) {
     throw new Error(`UpdateHumanUser ${userId} -> ${res.status} ${text}`);
   }
-  console.log(`[idp-intent] updated ${userId} email=${email} name="${firstName} ${lastName}"`);
+  console.log(
+    `[idp-intent] updated ${userId} email=${email} name="${firstName} ${lastName}"`,
+  );
 }
 
 // --- /token : preuserinfo (roles) + presamlresponse (saml) ---------------
@@ -214,7 +247,7 @@ async function handleToken(body: TokenBody, env: Env): Promise<Manipulation> {
     case "function/preuserinfo":
       return mapRoles(body);
     case "function/presamlresponse":
-      return mapSamlRoles(body, env);
+      return await mapSamlRoles(body, env);
     default:
       console.log(`[token] unhandled function ${body?.function}`);
       return {};
@@ -240,7 +273,9 @@ export function mapRoles(body: TokenBody): Manipulation {
     .filter(Boolean)[0];
   if (!projectId) return {};
 
-  const roles = grants.filter((g) => g.project_id === projectId).map((g) => g.roles);
+  const roles = grants.filter((g) => g.project_id === projectId).map((g) =>
+    g.roles
+  );
   if (roles.length === 1) {
     return { append_claims: [{ key: "role", value: String(roles[0]) }] };
   }
@@ -254,7 +289,10 @@ export function mapRoles(body: TokenBody): Manipulation {
 // SAML attribute — matching the v1 action. Unlike preuserinfo, the
 // presamlresponse payload carries no grants (only `user`), so fetch them from
 // the management API by user id.
-export async function mapSamlRoles(body: TokenBody, env: Env): Promise<Manipulation> {
+export async function mapSamlRoles(
+  body: TokenBody,
+  env: Env,
+): Promise<Manipulation> {
   const userId = body?.user?.id;
   if (!userId) return {};
 
@@ -272,12 +310,18 @@ export async function mapSamlRoles(body: TokenBody, env: Env): Promise<Manipulat
   if (!res.ok) {
     // Loud: a failure here means the SAML assertion ships with no Roles, which
     // can silently drop SP-side access (e.g. OVHCloud admin).
-    console.error(`[saml] grants search failed for ${userId}: ${res.status} — assertion will have no Roles`);
+    console.error(
+      `[saml] grants search failed for ${userId}: ${res.status} — assertion will have no Roles`,
+    );
     return {};
   }
 
-  const data = (await res.json()) as { result?: Array<{ roleKeys?: string[] }> };
-  const roles = [...new Set((data.result ?? []).flatMap((g) => g.roleKeys ?? []))];
+  const data = (await res.json()) as {
+    result?: Array<{ roleKeys?: string[] }>;
+  };
+  const roles = [
+    ...new Set((data.result ?? []).flatMap((g) => g.roleKeys ?? [])),
+  ];
   if (roles.length === 0) return {};
 
   return {
@@ -297,14 +341,21 @@ export async function mapSamlRoles(body: TokenBody, env: Env): Promise<Manipulat
 // outside this window so a captured request can't be replayed indefinitely.
 const SIGNATURE_TOLERANCE_SECONDS = 300;
 
-export async function verifySignature(signatureHeader: string, rawBody: string, signingKey: string): Promise<boolean> {
+export async function verifySignature(
+  signatureHeader: string,
+  rawBody: string,
+  signingKey: string,
+): Promise<boolean> {
   const parts = signatureHeader.split(",");
   const timestamp = parts.find((e) => e.startsWith("t="))?.slice(2);
   const signature = parts.find((e) => e.startsWith("v1="))?.slice(3);
   if (!timestamp || !signature) return false;
 
   const ts = Number(timestamp);
-  if (!Number.isFinite(ts) || Math.abs(Date.now() / 1000 - ts) > SIGNATURE_TOLERANCE_SECONDS) {
+  if (
+    !Number.isFinite(ts) ||
+    Math.abs(Date.now() / 1000 - ts) > SIGNATURE_TOLERANCE_SECONDS
+  ) {
     console.warn(`[verify] timestamp outside tolerance (t=${timestamp})`);
     return false;
   }
@@ -317,7 +368,11 @@ export async function verifySignature(signatureHeader: string, rawBody: string,
     false,
     ["sign"],
   );
-  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(`${timestamp}.${rawBody}`));
+  const sig = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(`${timestamp}.${rawBody}`),
+  );
   const computed = Array.from(new Uint8Array(sig))
     .map((b) => b.toString(16).padStart(2, "0"))
     .join("");