feat: support both github and gitlab logins to internal futo auth service (#1676)

Author: zackpollard

.mise/config.toml

@@ -1,4 +1,5 @@
 [tools]
+deno = "2.8.3"
 flux2 = "2.8.7"
 go = "1.26.3"
 "go:github.com/cloudnative-pg/cloudnative-pg/cmd/kubectl-cnpg" = "1.29.1"
@@ -14,9 +15,14 @@ yamlfmt = "0.21.0"
 
 [env]
 KUBECONFIG = "{{config_root}}/.mise/kube.config"
+# Pin op CLI resolution to the immich account so `op run`/`op inject` aren't
+# ambiguous when other 1Password accounts are also signed in. All op:// refs in
+# this repo live in the immich account; the FUTO account is reached via service
+# tokens at the provider level, not the op CLI.
+OP_ACCOUNT = "immich.1password.com"
 
 [tasks.tg]
-run = "op run '--env-file={{config_root}}/tf/deployment/.env' -- env -u OP_CONNECT_HOST -u OP_CONNECT_TOKEN -u OP_SERVICE_ACCOUNT_TOKEN -- terragrunt"
+run = "op run '--env-file={{config_root}}/tf/deployment/.env' -- env -u OP_CONNECT_HOST -u OP_CONNECT_TOKEN -u OP_SERVICE_ACCOUNT_TOKEN -u OP_ACCOUNT -- terragrunt"
 description = "Wrapper for terragrunt, op run resolves secrets then env -u strips op auth vars so they don't conflict with terraform providers"
 dir = "{{cwd}}"
 

services/outline-role-sync/src/zitadel.ts

@@ -54,21 +54,24 @@ export class ZitadelClient {
   }
 
   async getUserGrants(userId: string, projectId: string): Promise<string[]> {
+    // The per-user path (/users/{userId}/grants/_search) 405s; the grants search
+    // lives at /users/grants/_search filtered by user, then narrowed to the
+    // project client-side.
     const result = await this.request<{ result?: ZitadelUserGrant[] }>(
       "POST",
-      `/management/v1/users/${userId}/grants/_search`,
+      `/management/v1/users/grants/_search`,
       {
         queries: [
           {
-            projectIdQuery: {
-              projectId,
+            userIdQuery: {
+              userId,
             },
           },
         ],
       },
     );
 
-    const grants = result.result ?? [];
+    const grants = (result.result ?? []).filter((grant) => grant.projectId === projectId);
     return grants.flatMap((grant) => grant.roleKeys);
   }
 }

services/zitadel-actions/deno.json

@@ -0,0 +1,10 @@
+{
+  "tasks": {
+    "test": "deno test",
+    "check": "deno check src/index.ts test/index.test.ts",
+    "build": "deno run --allow-read --allow-net --allow-env scripts/build.ts"
+  },
+  "compilerOptions": {
+    "strict": true
+  }
+}

services/zitadel-actions/deno.lock

@@ -0,0 +1,16 @@
+// Transpiles the TypeScript worker (src/index.ts) to JavaScript for terraform's
+// content_base64 — Cloudflare runs JS, the source is TS. Invoked by the
+// data.external in actions-v2.tf, so it must print ONLY a JSON object with the
+// JS string on stdout (deno's own download/progress noise goes to stderr).
+import { transpile } from "jsr:@deno/emit";
+
+const entry = new URL("../src/index.ts", import.meta.url);
+const result = await transpile(entry);
+const js = result.get(entry.href);
+
+if (!js) {
+  console.error(`transpile produced no output for ${entry.href}`);
+  Deno.exit(1);
+}
+
+console.log(JSON.stringify({ js }));