Add jwt-parser function v1.0.0 for JWT token parsing in SonataFlow #4

ishanjogi89 · 2025-08-13T07:44:16Z

Pull Request Template

Thank you for your contribution to the Serverless Workflow Catalog! To help us review and merge your pull request, please provide the following information:

Description

Briefly describe the changes made in this pull request:

This PR adds a new JWT token parsing function to the SonataFlow functions catalog. The function enables workflows to parse JWT tokens and extract user claims for personalized workflow responses, supporting the implementation of apache/incubator-kie-issues#1899.

Related Issues

Link to related issues or tasks:

Create a Custom Function to Access JWT Tokens from the Workflow apache/incubator-kie-issues#1899
Related implementation PR: [Link to incubator-kie-kogito-runtimes PR]

Type of Change

Please check the type of change your pull request introduces:

Function/Version Affected

Specify the function and version affected by this pull request (if applicable):

Function Name: jwt-parser
Function Version: 1.0.0

Implementation Details

Provide a summary of the implementation details:

New Features:
- JWT token parsing function with three operations: parse, extractUser, extractClaim
- Support for extracting complete JWT payload as JSON
- Support for extracting standard user claims (sub, preferred_username, email, etc.)
- Support for extracting specific claims by name
- Automatic handling of "Bearer " token prefix
- Integration with SonataFlow workflow headers via $WORKFLOW.headers
Bug Fixes: N/A
Changes to Existing Functions: N/A
Dependencies Added:
- Function calls the jwt-parser custom function type in SonataFlow runtime
- No external dependencies for the catalog entry itself

Additional Information

Provide any additional information or context related to this pull request:

This function specification supports the exact use case described in apache/incubator-kie-issues#1899, where workflows need to extract user information from JWT tokens for personalized responses.

Example usage from the issue:

{
  "functions": [
    {
      "name": "extractUser",
      "type": "custom",
      "operation": "jwt-parser:extractUser"
    }
  ],
  "states": [
    {
      "name": "extractUserName",
      "actions": [
        {
          "functionRef": {
            "refName": "extractUser",
            "arguments": {
              "token": "${ $WORKFLOW.headers.\"X-Authorization-acme_financial_auth\" }"
            }
          }
        }
      ]
    }
  ]
}

The function is implemented as a Quarkus addon in the SonataFlow runtime and this catalog entry provides the standard specification for its usage.

Checklist

Please ensure your pull request meets the following criteria:

Code follows the project's coding style and guidelines
Changes are thoroughly tested
Documentation is updated (if applicable)

Thank you for contributing to the Serverless Workflow Catalog! Your efforts are greatly appreciated.

cdavernas · 2025-08-13T10:26:22Z

@ishanjogi89 The function catalog applies to Serverless Workflow 1.x.x and above, but it looks like you’re mixing versions in your function. Also, the function should be calling a task internally, whereas yours is calling itself—which obviously won’t work.

To fix this, your function should actually be a set task that assigns a claims property using a jq expression to extract the claims from the token provided as input.

ishanjogi89 · 2025-08-13T10:44:55Z

Thank you for the feedback, @cdavernas ! You're absolutely right about the version mismatch and recursive call issue. I've updated the function specification to:

Use Serverless Workflow 1.x syntax with proper YAML format and dsl: 1.0.0-alpha1
Replace the recursive call with a proper set task using jq expressions
Implement JWT decoding with jq: The function now uses split(".")[1] | @base64d | fromjson to decode the JWT payload
Add optional claim extraction via claimPath parameter using jq path navigation

The function now properly decodes JWT tokens using pure jq expressions and can extract specific claims as requested.

Signed-off-by: Ishan Jogi <[email protected]>

… `dsl: 1.0.0-alpha1` 2. **Replace the recursive call** with a proper `set` task using jq expressions 3. **Implement JWT decoding with jq**: The function now uses `split(".")[1] | @base64d | fromjson` to decode the JWT payload 4. **Add optional claim extraction** via `claimPath` parameter using jq path navigation Signed-off-by: Ishan Jogi <[email protected]>

Signed-off-by: Ishan Jogi <[email protected]>

Signed-off-by: Ishan Jogi <[email protected]> Signed-off-by: Ishan Jogi <[email protected]>

cdavernas

There's still some minor fixes to be made, but thank you for your awesome work! ❤️

cdavernas · 2025-08-16T20:15:32Z