feat: Support any kind of constraint

joachimvh · joachimvh · commit 40accde380e8 · 2026-07-28T15:03:27.000+02:00
diff --git a/packages/uma/src/policies/authorizers/OdrlAuthorizer.ts b/packages/uma/src/policies/authorizers/OdrlAuthorizer.ts
@@ -9,6 +9,7 @@ import { PrioritizeProhibitionStrategy } from '../../ucp/policy/PrioritizeProhib
 import { Strategy } from '../../ucp/policy/Strategy';
 import { UCPPolicy } from '../../ucp/policy/UsageControlPolicy';
 import { UCRulesStorage } from '../../ucp/storage/UCRulesStorage';
+import { isIri } from '../../util/ConvertUtil';
 import { Permission } from '../../views/Permission';
 import { Authorizer } from './Authorizer';
 
@@ -76,9 +77,9 @@ export class OdrlAuthorizer implements Authorizer {
 
         const subject = typeof claims[WEBID] === 'string' ? claims[WEBID] : 'urn:solidlab:uma:id:anonymous';
         const claimContextConstraints: { subject: ReturnType<typeof blankNode>; quads: Quad[] }[] = [];
-        for (const [ claimKey, leftOperand ] of Object.entries(claimOperandMap)) {
-            const claimValue = claims[claimKey];
-            if (typeof claimValue !== 'string') {
+        for (const [ key, value ] of Object.entries(claims)) {
+            const leftOperand = claimOperandMap[key] ?? key;
+            if (!isIri(leftOperand) || typeof value !== 'string') {
                 continue;
             }
             const claimSubject = blankNode();
@@ -88,7 +89,7 @@ export class OdrlAuthorizer implements Authorizer {
                     quad(claimSubject, RDF.terms.type, ODRL.terms.Constraint),
                     quad(claimSubject, ODRL.terms.leftOperand, namedNode(leftOperand)),
                     quad(claimSubject, ODRL.terms.operator, ODRL.terms.eq),
-                    quad(claimSubject, ODRL.terms.rightOperand, namedNode(claimValue)),
+                    quad(claimSubject, ODRL.terms.rightOperand, namedNode(value)),
                 ],
             });
         }
diff --git a/packages/uma/src/policies/authorizers/SimpleOdrlAuthorizer.ts b/packages/uma/src/policies/authorizers/SimpleOdrlAuthorizer.ts
@@ -29,7 +29,6 @@ const dateComparators: NodeJS.Dict<(a: Date, b: Date) => boolean> = {
 
 const claimOperandMap: Record<string, string> = {
     [ODRL.deliveryChannel]: CLIENTID,
-    [ODRL.purpose]: PURPOSE
 } as const;
 
 /**
@@ -168,6 +167,8 @@ export class SimpleOdrlAuthorizer implements Authorizer {
     if (constraints.some(({ leftOperand, operator, rightOperand }) => !leftOperand || !operator || !rightOperand)) {
       return;
     }
+    // TODO: would want middleware step where credentials and other stuff are already extracted into RDF values
+    //       so both ODRL authorizers don't have to bother with this
     for (const constraint of constraints) {
       // Return undefined if any of these are too complex or unknown
       if (constraint.leftOperand.equals(ODRL.terms.dateTime)) {
@@ -188,6 +189,11 @@ export class SimpleOdrlAuthorizer implements Authorizer {
         if (typeof claimValue !== 'string' || constraint.rightOperand.value !== claimValue) {
           return false;
         }
+      } else if (typeof claims[constraint.leftOperand.value] === 'string'
+        && constraint.operator.equals(ODRL.terms.eq)) {
+        if (constraint.rightOperand.value !== claims[constraint.leftOperand.value]) {
+          return false;
+        }
       } else {
         // Unsupported constraint
         return;
diff --git a/packages/uma/test/unit/policies/authorizers/OdrlAuthorizer.test.ts b/packages/uma/test/unit/policies/authorizers/OdrlAuthorizer.test.ts
@@ -94,7 +94,8 @@ describe('OdrlAuthorizer', (): void => {
     expect(evaluate).toHaveBeenCalledTimes(1);
     expect(evaluate).toHaveBeenLastCalledWith(
       policyStore.getQuads(null, null, null, null),
-      [ ...new Store(requestQuads) ],
+      // Also contains sotw data generated by claims being present
+      expect.any(Array),
       sotw,
     );
   });
@@ -123,7 +124,7 @@ describe('OdrlAuthorizer', (): void => {
     ]);
   });
 
-  it('adds purpose claim context using odrl:purpose', async(): Promise<void> => {
+  it('adds other claims to constraints', async(): Promise<void> => {
     const claims = { [PURPOSE]: 'https://w3id.org/dpv#ScientificResearch' };
     const query: Permission[] = [{ resource_id: 'rid', resource_scopes: [ 'urn:example:css:modes:read' ] }];
 
diff --git a/packages/uma/test/unit/policies/authorizers/SimpleOdrlAuthorizer.test.ts b/packages/uma/test/unit/policies/authorizers/SimpleOdrlAuthorizer.test.ts
@@ -166,7 +166,7 @@ describe('SimpleOdrlAuthorizer', () => {
     expect(fallback.permissions).not.toHaveBeenCalled();
   });
 
-  it('returns permission if purpose constraint is satisfied', async () => {
+  it('returns permission if other constraints are satisfied', async () => {
     const rule = addRule({});
     addConstraint({
       rule,
@@ -182,7 +182,7 @@ describe('SimpleOdrlAuthorizer', () => {
     expect(fallback.permissions).not.toHaveBeenCalled();
   });
 
-  it('returns empty if claim constraint is not satisfied', async () => {
+  it('returns empty if other constraints are not satisfied', async () => {
     const rule = addRule({});
     addConstraint({
       rule,
diff --git a/test/integration/Demo.test.ts b/test/integration/Demo.test.ts
@@ -1,9 +1,9 @@
 import { App } from '@solid/community-server';
 import { setGlobalLoggerFactory, WinstonLoggerFactory } from 'global-logger-factory';
-import { Parser, Store } from 'n3';
+import { UnsecuredJWT } from 'jose';
 import * as path from 'node:path';
 import { getDefaultCssVariables, getPorts, instantiateFromConfig } from '../util/ServerUtil';
-import { findTokenEndpoint, getToken, noTokenFetch, generateCredentials, tokenFetch, umaFetch } from '../util/UmaUtil';
+import { findTokenEndpoint, generateCredentials, getToken, noTokenFetch, tokenFetch, umaFetch } from '../util/UmaUtil';
 
 const [ cssPort, umaPort ] = getPorts('Demo');
 
@@ -142,69 +142,40 @@ _:rename a solid:InsertDeletePatch;
   }.`,
     }, terms.agents.ruben);
     expect(response.status).toBe(205);
-
-    // TODO: Do I need this though
-    // Add necessary triples to WebID
-    response = await fetch(terms.agents.ruben, {
-      method: 'PATCH',
-      headers: { 'content-type': 'text/n3' },
-      body: `
-@prefix solid: <http://www.w3.org/ns/solid/terms#>.
-
-_:rename a solid:InsertDeletePatch;
-  solid:inserts {
-    <${terms.agents.ruben}> solid:umaServer <http://localhost:${umaPort}/uma/>
-  }.`,
-    });
-    expect(response.status).toBe(205);
-  });
-
-  it('finds the UMA server of the user in their WebID.', async(): Promise<void> => {
-    // TODO: what is the point of any of this? the as_uri response should have this data?
-    // TODO: find out why it doesn't work though as the term does get added at the end of the previous test
-    const response = await fetch(terms.agents.ruben, {
-      headers: { 'accept': 'text/turtle' },
-    });
-    expect(response.status).toBe(200);
-    const parser = new Parser({ baseIRI: terms.agents.ruben });
-    const store = new Store(parser.parse(await response.text()));
-    expect(store.countQuads(terms.agents.ruben, terms.solid.umaServer, null, null)).toBe(1);
-    const umaServer = store.getObjects(terms.agents.ruben, terms.solid.umaServer, null)[0].value;
   });
 
   it('can add a healthcare policy to the server.', async(): Promise<void> => {
-    // TODO: policy currently not linking to constraints as these need to be added to the ODRL evaluator
-    // odrl:constraint <http://example.org/HCPX-agreement-permission-purpose>,
-    //                 <http://example.org/HCPX-agreement-permission-lb> .
     const healthcare_patient_policy =
       `PREFIX dcterms: <http://purl.org/dc/terms/>
-PREFIX eu-gdpr: <https://w3id.org/dpv/legal/eu/gdpr#>
-PREFIX oac: <https://w3id.org/oac#>
-PREFIX odrl: <http://www.w3.org/ns/odrl/2/>
-PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
-
-PREFIX ex: <http://example.org/>
-
-  <http://example.org/HCPX-agreement> a odrl:Agreement ;
-    odrl:uid ex:HCPX-agreement ;
-    odrl:profile oac: ;
-    odrl:permission <http://example.org/HCPX-agreement-permission> .
-
-<http://example.org/HCPX-agreement-permission> a odrl:Permission ;
-    odrl:action odrl:read ;
-    odrl:target <${terms.resources.smartwatch}> ;
-    odrl:assigner <${terms.agents.ruben}> ;
-    odrl:assignee <${terms.agents.alice}> .
-
-<http://example.org/HCPX-agreement-permission-purpose> a odrl:Constraint ;
-    odrl:leftOperand odrl:purpose ; # can also be oac:Purpose, to conform with OAC profile
-    odrl:operator odrl:eq ;
-    odrl:rightOperand ex:bariatric-care .
-
-<http://example.org/HCPX-agreement-permission-lb> a odrl:Constraint ;
-    odrl:leftOperand oac:LegalBasis ;
-    odrl:operator odrl:eq ;
-    odrl:rightOperand eu-gdpr:A9-2-a .`
+       PREFIX eu-gdpr: <https://w3id.org/dpv/legal/eu/gdpr#>
+       PREFIX oac: <https://w3id.org/oac#>
+       PREFIX odrl: <http://www.w3.org/ns/odrl/2/>
+       PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
+       
+       PREFIX ex: <http://example.org/>
+
+       <http://example.org/HCPX-agreement> a odrl:Agreement ;
+         odrl:uid ex:HCPX-agreement ;
+         odrl:profile oac: ;
+         odrl:permission <http://example.org/HCPX-agreement-permission> .
+      
+       <http://example.org/HCPX-agreement-permission> a odrl:Permission ;
+         odrl:action odrl:read ;
+         odrl:target <${terms.resources.smartwatch}> ;
+         odrl:assigner <${terms.agents.ruben}> ;
+         odrl:assignee <${terms.agents.alice}> ;
+         odrl:constraint <http://example.org/HCPX-agreement-permission-purpose>,
+                         <http://example.org/HCPX-agreement-permission-lb> .
+      
+       <http://example.org/HCPX-agreement-permission-purpose> a odrl:Constraint ;
+         odrl:leftOperand odrl:purpose ;
+         odrl:operator odrl:eq ;
+         odrl:rightOperand ex:bariatric-care .
+      
+       <http://example.org/HCPX-agreement-permission-lb> a odrl:Constraint ;
+         odrl:leftOperand oac:LegalBasis ;
+         odrl:operator odrl:eq ;
+         odrl:rightOperand eu-gdpr:A9-2-a .`
 
     const medicalPolicyCreationResponse = await fetch(policyContainer, {
       method: 'POST',
@@ -215,15 +186,25 @@ PREFIX ex: <http://example.org/>
   });
 
   it('requires authorized access for patient data.', async(): Promise<void> => {
-    // TODO: should do the steps individually here so we can check the contents of the tokens/tickets
     // Parse ticket and UMA server URL from header
     const parsedHeader = await noTokenFetch(terms.resources.smartwatch);
 
     // Find UMA server token endpoint
     const tokenEndpoint = await findTokenEndpoint(parsedHeader.as_uri);
 
+    const jwt = new UnsecuredJWT({
+      'http://www.w3.org/ns/odrl/2/purpose': 'http://example.org/bariatric-care',
+      'urn:solidlab:uma:claims:types:webid': terms.agents.alice,
+      'https://w3id.org/oac#LegalBasis': 'https://w3id.org/dpv/legal/eu/gdpr#A9-2-a'
+    }).encode();
+
     // Send ticket request to UMA server and extract token from response
-    const token = await getToken(parsedHeader.ticket, tokenEndpoint, terms.agents.alice);
+    const token = await getToken(
+      parsedHeader.ticket,
+      tokenEndpoint,
+      undefined,
+      undefined,
+      [{ claim_token: jwt, claim_token_format: 'urn:solidlab:uma:claims:formats:jwt' }]);
     const accessToken = JSON.parse(Buffer.from(token.access_token.split('.')[1], 'base64').toString());
     expect(accessToken).toMatchObject({
       permissions:[{
@@ -235,7 +216,7 @@ PREFIX ex: <http://example.org/>
       aud: 'solid',
       exp: expect.any(Number),
       jti: expect.any(String),
-    })
+    });
 
     // Perform new call with token
     const response = await tokenFetch(token, terms.resources.smartwatch);
diff --git a/test/integration/Oidc.test.ts b/test/integration/Oidc.test.ts
@@ -216,7 +216,6 @@ describe('A server supporting OIDC tokens', (): void => {
       });
       const endpoint = await findTokenEndpoint(as_uri);
 
-      // TODO: also add token that fails
       const jwk = await importJWK(privateKey, privateKey.alg);
       const jwt = await new SignJWT({ azp: client })
         .setSubject(sub)
