From 444436f45804739062a172c70c6468f652357aee Mon Sep 17 00:00:00 2001
From: n4mlz <n4mlz.dev@gmail.com>
Date: Mon, 31 Aug 2026 11:59:24 +0900
Subject: [PATCH] =?UTF-8?q?:bug:=20GitHub=20IdP=20token=20=E3=81=AE?=
 =?UTF-8?q?=E8=A8=BA=E6=96=AD=E6=83=85=E5=A0=B1=E3=82=92=E8=BF=BD=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 auth0/actions/require-xlair-org.js | 13 ++++++++++---
 auth0/tenant.yaml                  |  1 +
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/auth0/actions/require-xlair-org.js b/auth0/actions/require-xlair-org.js
index 7bc374bf..df6a74f0 100644
--- a/auth0/actions/require-xlair-org.js
+++ b/auth0/actions/require-xlair-org.js
@@ -1,3 +1,5 @@
+const crypto = require("crypto");
+
 const ORGANIZATION = "xlair-dev";
 const AUTH0_DOMAIN = "dev-2dn3mvmvr8tccoss.us.auth0.com";
 
@@ -15,6 +17,9 @@ const describeError = (error) => {
   ].join(" ");
 };
 
+const fingerprint = (token) =>
+  crypto.createHash("sha256").update(token).digest("hex").slice(0, 16);
+
 const getIdentityProviderAccessToken = async (event) => {
   console.log(
     `stage=start management_client_id=${event.secrets.AUTH0_MANAGEMENT_CLIENT_ID}`,
@@ -80,7 +85,9 @@ const getIdentityProviderAccessToken = async (event) => {
     ({ provider }) => provider === "github",
   );
   console.log(
-    `stage=idp-token github_identity=${Boolean(githubIdentity)} access_token=${Boolean(githubIdentity?.access_token)}`,
+    `stage=idp-token github_identity=${Boolean(githubIdentity)} ` +
+      `access_token=${Boolean(githubIdentity?.access_token)} ` +
+      `fingerprint=${githubIdentity?.access_token ? fingerprint(githubIdentity.access_token) : "none"}`,
   );
   return githubIdentity?.access_token;
 };
@@ -112,8 +119,8 @@ exports.onExecutePostLogin = async (event, api) => {
         },
       },
     );
-  } catch (_error) {
-    console.log("GitHub organization membership response could not be parsed");
+  } catch (error) {
+    console.log(`stage=github-membership exception ${describeError(error)}`);
     deny(api);
     return;
   }
diff --git a/auth0/tenant.yaml b/auth0/tenant.yaml
index f2da6716..f06e1d8d 100644
--- a/auth0/tenant.yaml
+++ b/auth0/tenant.yaml
@@ -48,6 +48,7 @@ connections:
 actions:
   - name: Require XLAIR GitHub organization membership
     code: ./actions/require-xlair-org.js
+    # Pin the runtime because this Action relies on the Node.js built-in Fetch API.
     runtime: node22
     deployed: true
     status: built