Auth0 の Deploy CLI Tool で Auth0 CLI の access token を利用する

#!/bin/bash

set -euo pipefail

ADDITIONAL_SCOPES=read:guardian_factors,read:mfa_policies,read:self_service_profiles

get_access_token() {
  local token=""
  if ! token=$(jq -er '.tenants["'$domain'"].access_token' $config_file); then
    token=$(get_access_token_from_keychain)
  fi
  echo $token
}

# Retrieves an access token from the macOS keychain.
# This mimics the way the Auth0 CLI stores tokens, based on:
# - https://github.com/auth0/auth0-cli/blob/v1.23.0/internal/keyring/keyring.go#L96-L113
# - https://github.com/zalando/go-keyring/blob/v0.2.6/keyring_darwin.go#L42-L67
get_access_token_from_keychain() {
  local access_token=""

  for i in {0..49}; do
    if ! out=$(security find-generic-password -s "Auth0 CLI Access Token $i" -wa $AUTH0_DOMAIN 2>&1); then
      if [[ $out == *"could not be found"* ]]; then
        echo $access_token
        return 0
      else
        echo $out >&2
        return 1
      fi
    fi

    # go-keyring-base64:ZXlK... => ZXlK... => eyJ...
    access_token+=$(cut -d: -f2 <<< $out | base64 -d)
  done

  echo $access_token
}

decode_jwt() {
  # https://gist.github.com/angelo-v/e0208a18d455e2e6ea3c40ad637aac53?permalink_comment_id=3439919#gistcomment-3439919
  jq -R 'gsub("-";"+") | gsub("_";"/") | split(".") | .[1] | @base64d | fromjson' <<< $1
}

# The Auth0 CLI exits with status 0 on SIGINT, so trap it to stop the script.
trap exit INT

domain=${AUTH0_DOMAIN:?Error: AUTH0_DOMAIN is required}

config_file=~/.config/auth0/config.json

if [ -f $config_file ]; then
  if ! jq -e '.tenants["'$domain'"]' $config_file > /dev/null; then
    auth0 login --domain $domain --scopes $ADDITIONAL_SCOPES
  fi
else
  auth0 login --domain $domain --scopes $ADDITIONAL_SCOPES
fi

token=$(get_access_token)
if [ -n "$token" ]; then
  payload=$(decode_jwt $token)
  exp=$(jq '.exp' <<< $payload)
  require_additional_scopes=$(jq '($ARGS.positional[0] | split(",")) - (.scope | split(" ")) | length > 0' --args $ADDITIONAL_SCOPES <<< $payload)
fi
if [ -z "$token" ] || [ $(date +%s) -ge $exp ] || $require_additional_scopes; then
  auth0 login --domain $domain --scopes $ADDITIONAL_SCOPES
  token=$(get_access_token)
fi

trap - INT
AUTH0_ACCESS_TOKEN=$(get_access_token) a0deploy export --format=yaml -o .