GitHub IdP token の診断情報を追加

auth0/actions/require-xlair-org.js

@@ -1,3 +1,5 @@
+const crypto = require("crypto");
+
 const ORGANIZATION = "xlair-dev";
 const AUTH0_DOMAIN = "dev-2dn3mvmvr8tccoss.us.auth0.com";
 
@@ -15,6 +17,9 @@ const describeError = (error) => {
   ].join(" ");
 };
 
+const fingerprint = (token) =>
+  crypto.createHash("sha256").update(token).digest("hex").slice(0, 16);
+
 const getIdentityProviderAccessToken = async (event) => {
   console.log(
     `stage=start management_client_id=${event.secrets.AUTH0_MANAGEMENT_CLIENT_ID}`,
@@ -80,7 +85,9 @@ const getIdentityProviderAccessToken = async (event) => {
     ({ provider }) => provider === "github",
   );
   console.log(
-    `stage=idp-token github_identity=${Boolean(githubIdentity)} access_token=${Boolean(githubIdentity?.access_token)}`,
+    `stage=idp-token github_identity=${Boolean(githubIdentity)} ` +
+      `access_token=${Boolean(githubIdentity?.access_token)} ` +
+      `fingerprint=${githubIdentity?.access_token ? fingerprint(githubIdentity.access_token) : "none"}`,
   );
   return githubIdentity?.access_token;
 };
@@ -112,8 +119,8 @@ exports.onExecutePostLogin = async (event, api) => {
         },
       },
     );
-  } catch (_error) {
-    console.log("GitHub organization membership response could not be parsed");
+  } catch (error) {
+    console.log(`stage=github-membership exception ${describeError(error)}`);
     deny(api);
     return;
   }

auth0/tenant.yaml

@@ -48,6 +48,7 @@ connections:
 actions:
   - name: Require XLAIR GitHub organization membership
     code: ./actions/require-xlair-org.js
+    # Pin the runtime because this Action relies on the Node.js built-in Fetch API.
     runtime: node22
     deployed: true
     status: built