fix: parse Tinybird workspace identity

Author: richiemcilroy

scripts/analytics/tests/tooling.test.js

@@ -136,17 +136,33 @@ test("cloud deploy verifies the token workspace before mutation", () => {
 		TINYBIRD_WORKSPACE_ID: workspaceId,
 	};
 	assert.equal(
-		verifyCloudWorkspace(env, () => `| production | ${workspaceId} | admin |`),
+		verifyCloudWorkspace(env, (_command, args) => {
+			assert.deepEqual(args.slice(-5), [
+				"--cloud",
+				"--output",
+				"json",
+				"workspace",
+				"current",
+			]);
+			return JSON.stringify({ id: workspaceId, name: "production" });
+		}),
 		workspaceId,
 	);
 	assert.throws(
 		() =>
-			verifyCloudWorkspace(
-				env,
-				() => "| staging | 87654321-4321-4321-8321-cba987654321 | admin |",
+			verifyCloudWorkspace(env, () =>
+				JSON.stringify({
+					id: "87654321-4321-4321-8321-cba987654321",
+					metadata: workspaceId,
+					name: "staging",
+				}),
 			),
 		/does not target/,
 	);
+	assert.throws(
+		() => verifyCloudWorkspace(env, () => "warning: invalid token"),
+		/Unable to parse/,
+	);
 });
 
 test("local credentials are written to a private gitignored env file", () => {

scripts/analytics/tooling.js

@@ -25,8 +25,7 @@ const TEST_FILES = fs
 const CLOUD_URL_DEFAULT = "https://api.tinybird.co";
 const WORKSPACE_ID_PATTERN =
 	/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const WORKSPACE_ID_SEARCH_PATTERN =
-	/[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/gi;
+const LOCAL_TOKEN_SIGNING_KEY = "tinybird-local";
 const LOCAL_IDENTIFIERS = {
 	workspaceId: "00000000-0000-4000-8000-000000000001",
 	workspaceTokenId: "00000000-0000-4000-8000-000000000002",
@@ -373,7 +372,7 @@ const cloudEnvironment = (env = process.env) => {
 const encodeLocalToken = (userId, tokenId) => {
 	const payload = `{"u": "${userId}", "id": "${tokenId}", "host": null}`;
 	const encodedPayload = Buffer.from(payload).toString("base64url");
-	const signature = createHmac("sha256", "abcd")
+	const signature = createHmac("sha256", LOCAL_TOKEN_SIGNING_KEY)
 		.update(encodedPayload)
 		.digest("base64url");
 	return `p.${encodedPayload}.${signature}`;
@@ -433,18 +432,34 @@ const runProcessCapture = (command, args, options = {}) => {
 	if (result.error || result.status !== 0) {
 		throw new Error("Unable to verify Tinybird workspace identity.");
 	}
-	return `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+	return result.stdout ?? "";
 };
 
 const verifyCloudWorkspace = (env = process.env, run = runProcessCapture) => {
 	const environment = cloudEnvironment(env);
-	const step = cloudCliStep("--cloud", "workspace", "current");
+	const step = cloudCliStep(
+		"--cloud",
+		"--output",
+		"json",
+		"workspace",
+		"current",
+	);
 	assertSafeStep(step);
 	const output = run(step.command, step.args, { env: environment });
-	const workspaceIds = (output.match(WORKSPACE_ID_SEARCH_PATTERN) ?? []).map(
-		(workspaceId) => workspaceId.toLowerCase(),
-	);
-	if (!workspaceIds.includes(environment.TINYBIRD_WORKSPACE_ID.toLowerCase())) {
+	let workspace;
+	try {
+		workspace = JSON.parse(output);
+	} catch {
+		throw new Error("Unable to parse Tinybird workspace identity.");
+	}
+	if (
+		!workspace ||
+		typeof workspace !== "object" ||
+		Array.isArray(workspace) ||
+		typeof workspace.id !== "string" ||
+		workspace.id.toLowerCase() !==
+			environment.TINYBIRD_WORKSPACE_ID.toLowerCase()
+	) {
 		throw new Error(
 			"Tinybird deploy token does not target TINYBIRD_WORKSPACE_ID.",
 		);