customize m2mToken by adding application properties #5
Conversation
WalkthroughA new workflow module for M2M token generation has been introduced. This workflow fetches application properties from the Kinde API and adds them as claims to the generated M2M token. It is configured with specific settings and relies on environment variables and Kinde infrastructure services. Changes
Sequence Diagram(s)sequenceDiagram
participant Event as onM2MTokenGeneratedEvent
participant Workflow as addApplicationPropertiesToM2MWorkflow
participant KindeAPI as Kinde API
Event->>Workflow: Trigger M2M token generation
Workflow->>KindeAPI: Fetch application properties (using client ID)
KindeAPI-->>Workflow: Return application properties or error
Workflow->>Workflow: Add properties as 'allAppProperties' claim to token
Workflow-->>Event: Complete workflow
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
m2mToken/addApplicationPropertiesToM2MWorkflow.ts (3)
10-11: Workflow ID should be globally unique
id: "m2mTokenGeneration"is generic and may collide with other sample workflows.
Use a namespaced identifier such as"addAppPropsToM2M"to avoid deployment conflicts.
40-44: Narrowvaluetype to serialisable primitivesJWT claims must be JSON-serialisable. Typing
valueasanycan hide functions, Dates, etc., leading to runtime serialisation errors.
Suggest restricting tostring | number | boolean | null.
68-70: Token bloat and potential leakageEven after the type fix, embedding all application properties may create oversized tokens or leak internal descriptions/IDs.
Consider whitelisting required keys, or trimming large values before assignment.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
m2mToken/addApplicationPropertiesToM2MWorkflow.ts(1 hunks)
🔇 Additional comments (1)
m2mToken/addApplicationPropertiesToM2MWorkflow.ts (1)
16-22: Binding"url"looks unintendedAll other bindings follow the
kinde.*namespace. Unless the runtime actually injects a plainurl, this entry does nothing and may confuse maintainers. Consider removing or renaming to the correct binding key.
| let appProperties: ApplicationProperty[] = []; | ||
| try { | ||
| const kindeAPI = await createKindeAPI(event); | ||
| const { clientId } = event.context.application; | ||
| const { data } = await kindeAPI.get({ | ||
| endpoint: `applications/${clientId}/properties`, | ||
| }); | ||
| appProperties = data.properties ?? []; | ||
| } catch (err) { | ||
| console.error("Unable to fetch application properties", err); | ||
| // Optionally: decide whether to rethrow based on business rules | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Error handling contradicts failurePolicy: "stop"
Catching every error and only logging means the workflow silently succeeds, overriding the declared stop-on-failure policy.
If fetching properties is business-critical, re-throw after logging (or return a WorkflowError) so Kinde halts token issuance. Otherwise, switch failurePolicy to continue.
🤖 Prompt for AI Agents
In m2mToken/addApplicationPropertiesToM2MWorkflow.ts around lines 53 to 64, the
current error handling catches all errors and only logs them, which contradicts
the workflow's failurePolicy set to "stop". To fix this, after logging the
error, re-throw the caught error or throw a WorkflowError to ensure the workflow
halts token issuance as intended. Alternatively, if silent failure is
acceptable, update the failurePolicy to "continue" to match the current
behavior.
| interface ApplicationPropertiesClaim { | ||
| allAppProperties: Record<string, any>; | ||
| } | ||
|
|
||
| export default async function Workflow(event: onM2MTokenGeneratedEvent) { | ||
| let appProperties: ApplicationProperty[] = []; | ||
| try { | ||
| const kindeAPI = await createKindeAPI(event); | ||
| const { clientId } = event.context.application; | ||
| const { data } = await kindeAPI.get({ | ||
| endpoint: `applications/${clientId}/properties`, | ||
| }); | ||
| appProperties = data.properties ?? []; | ||
| } catch (err) { | ||
| console.error("Unable to fetch application properties", err); | ||
| // Optionally: decide whether to rethrow based on business rules | ||
| } | ||
|
|
||
| const m2mToken = m2mTokenClaims<ApplicationPropertiesClaim>(); | ||
|
|
||
| // Filter and process properties before assigning to token | ||
| m2mToken.allAppProperties = appProperties; | ||
| } No newline at end of file |
There was a problem hiding this comment.
Type mismatch: array assigned where Record<string, any> expected
m2mToken.allAppProperties is declared as Record<string, any> but you pass an ApplicationProperty[].
This will not compile and—even if coerced—emits a claim format that downstream consumers won’t expect.
- // Filter and process properties before assigning to token
- m2mToken.allAppProperties = appProperties;
+ // Convert array → key/value map and strip internal metadata
+ m2mToken.allAppProperties = Object.fromEntries(
+ appProperties.map(({ key, value }) => [key, value]),
+ );📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| interface ApplicationPropertiesClaim { | |
| allAppProperties: Record<string, any>; | |
| } | |
| export default async function Workflow(event: onM2MTokenGeneratedEvent) { | |
| let appProperties: ApplicationProperty[] = []; | |
| try { | |
| const kindeAPI = await createKindeAPI(event); | |
| const { clientId } = event.context.application; | |
| const { data } = await kindeAPI.get({ | |
| endpoint: `applications/${clientId}/properties`, | |
| }); | |
| appProperties = data.properties ?? []; | |
| } catch (err) { | |
| console.error("Unable to fetch application properties", err); | |
| // Optionally: decide whether to rethrow based on business rules | |
| } | |
| const m2mToken = m2mTokenClaims<ApplicationPropertiesClaim>(); | |
| // Filter and process properties before assigning to token | |
| m2mToken.allAppProperties = appProperties; | |
| } | |
| interface ApplicationPropertiesClaim { | |
| allAppProperties: Record<string, any>; | |
| } | |
| export default async function Workflow(event: onM2MTokenGeneratedEvent) { | |
| let appProperties: ApplicationProperty[] = []; | |
| try { | |
| const kindeAPI = await createKindeAPI(event); | |
| const { clientId } = event.context.application; | |
| const { data } = await kindeAPI.get({ | |
| endpoint: `applications/${clientId}/properties`, | |
| }); | |
| appProperties = data.properties ?? []; | |
| } catch (err) { | |
| console.error("Unable to fetch application properties", err); | |
| // Optionally: decide whether to rethrow based on business rules | |
| } | |
| const m2mToken = m2mTokenClaims<ApplicationPropertiesClaim>(); | |
| // Convert array → key/value map and strip internal metadata | |
| m2mToken.allAppProperties = Object.fromEntries( | |
| appProperties.map(({ key, value }) => [key, value]), | |
| ); | |
| } |
🤖 Prompt for AI Agents
In m2mToken/addApplicationPropertiesToM2MWorkflow.ts around lines 48 to 70, the
code assigns an array of ApplicationProperty objects to
m2mToken.allAppProperties, which expects a Record<string, any>. To fix this,
transform the appProperties array into an object mapping property keys to their
values before assignment, ensuring the assigned value matches the expected
Record<string, any> type and maintains the correct claim format.
| @@ -0,0 +1,70 @@ | |||
| import { | |||
There was a problem hiding this comment.
Hey @Upatric thanks so much for the PR - could you add an entry in the readme.md file where we list out all the examples?
2 participants
Explain your changes
I added an example illustrating how to customize the m2mToken by incorporating application properties.
Summary by CodeRabbit