feat: Allow ImmediateAuthorizerStrategy to return partial results

Author: joachimvh

packages/uma/src/ticketing/strategy/ImmediateAuthorizerStrategy.ts

@@ -10,12 +10,17 @@ import { Authorizer } from "../../policies/authorizers/Authorizer";
 /**
  * A TicketingStrategy that simply stores provided Claims, and calculates all
  * available Permissions from them upon resolution.
+ *
+ * If `allowPartialSuccess` is set to true,
+ * the strategy will return all available permissions,
+ * even if not all required permissions are granted.
  */
 export class ImmediateAuthorizerStrategy implements TicketingStrategy {
   protected readonly logger = getLoggerFor(this);
 
   constructor(
     protected authorizer: Authorizer,
+    protected readonly allowPartialSuccess = false,
   ) {}
 
   /** @inheritdoc */
@@ -45,9 +50,12 @@ export class ImmediateAuthorizerStrategy implements TicketingStrategy {
 
     const permissions = await this.calculatePermissions(ticket);
 
+    // Always fail if no results at all, even with allowPartialSuccess
     if (permissions.length === 0) return Failure([]);
 
-    // TODO: if, in the future, we want to allow partial results, this will need to change
+    // With partial success enabled, any non-empty authorization result is accepted
+    if (this.allowPartialSuccess) return Success(permissions);
+
     // Verify all required scopes have been granted
     const unmatchedPermissions: Permission[] = [];
     for (const required of ticket.permissions) {

packages/uma/test/unit/ticketing/strategy/ImmediateAuthorizerStrategy.test.ts

@@ -64,4 +64,29 @@ describe('ImmediateAuthorizerStrategy', (): void => {
     await expect(strategy.resolveTicket(ticket)).resolves
       .toEqual({ success: false, value: [{ resource_scopes: ['scopes'] }] });
   });
+
+  it('resolves with partial permissions when allowPartialSuccess is enabled.', async(): Promise<void> => {
+    const partialStrategy = new ImmediateAuthorizerStrategy(authorizer, true);
+    const ticket: Ticket = {
+      permissions: [{ resource_id: 'id', resource_scopes: [ 'read', 'write' ] }],
+      provided: {},
+    };
+    const authResponse: Permission[] = [
+      { resource_id: 'id', resource_scopes: [ 'read' ] },
+    ];
+    authorizer.permissions.mockResolvedValueOnce(authResponse);
+    await expect(partialStrategy.resolveTicket(ticket)).resolves
+      .toEqual({ success: true, value: authResponse });
+  });
+
+  it('rejects when no permissions are resolved, even with allowPartialSuccess enabled.', async(): Promise<void> => {
+    const partialStrategy = new ImmediateAuthorizerStrategy(authorizer, true);
+    const ticket: Ticket = {
+      permissions,
+      provided: {},
+    };
+    authorizer.permissions.mockResolvedValueOnce([]);
+    await expect(partialStrategy.resolveTicket(ticket)).resolves
+      .toEqual({ success: false, value: [] });
+  });
 });