feat: Use odrl:deliveryChannel to constrain client IDs

joachimvh · joachimvh · commit 47504e515960 · 2026-07-27T11:27:56.000+02:00
diff --git a/documentation/getting-started.md b/documentation/getting-started.md
@@ -464,9 +464,7 @@ The `azp` claim of the token will be used.
 
 To restrict a policy to a certain client application,
 a constraint needs to be added to the policy.
-Due to some issues with internal libraries,
-the `odrl:purpose` constraint is currently used to identify the client.
-This will be fixed in the near future.
+For this, we use the odrl:deliveryChannel left operand.
 
 To restrict a policy to only permit access when using the application `http://example.com/client`,
 the policy should look as follows:
@@ -482,7 +480,7 @@ ex:permission a odrl:Permission ;
               odrl:target <http://localhost:3000/alice/private/> ;
               odrl:assignee <https://woslabbi.pod.knows.idlab.ugent.be/profile/card#me> ;
               odrl:constraint ex:constraint .
-ex:constraint odrl:leftOperand odrl:purpose ;
+ex:constraint odrl:leftOperand odrl:deliveryChannel ;
               odrl:operator odrl:eq ;
               odrl:rightOperand <http://example.com/client> .
 ```
diff --git a/packages/uma/src/policies/authorizers/OdrlAuthorizer.ts b/packages/uma/src/policies/authorizers/OdrlAuthorizer.ts
@@ -1,15 +1,14 @@
-import { BadRequestHttpError, DC, RDF } from '@solid/community-server';
+import { RDF } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
-import { DataFactory, Quad, Store, Writer } from 'n3';
-import { EyelingReasoner, EyeReasoner, ODRLEngineMultipleSteps, ODRLEvaluator } from 'odrl-evaluator';
+import { DataFactory, Quad, Store } from 'n3';
+import { EyelingReasoner, ODRL, ODRLEngineMultipleSteps, ODRLEvaluator } from 'odrl-evaluator';
 import { CLIENTID, WEBID } from '../../credentials/Claims';
 import { ClaimSet } from '../../credentials/ClaimSet';
 import { basicPolicy } from '../../ucp/policy/ODRL';
 import { PrioritizeProhibitionStrategy } from '../../ucp/policy/PrioritizeProhibitionStrategy';
 import { Strategy } from '../../ucp/policy/Strategy';
 import { UCPPolicy } from '../../ucp/policy/UsageControlPolicy';
 import { UCRulesStorage } from '../../ucp/storage/UCRulesStorage';
-import { ODRL } from '../../ucp/util/Vocabularies';
 import { Permission } from '../../views/Permission';
 import { Authorizer } from './Authorizer';
 
@@ -76,17 +75,10 @@ export class OdrlAuthorizer implements Authorizer {
         if (typeof claims[CLIENTID] === 'string') {
             clientQuads.push(
                 quad(clientSubject, RDF.terms.type, ODRL.terms.Constraint),
-                // TODO: using purpose as other constraints are not supported in current version of ODRL evaluator
-                //       https://github.com/SolidLabResearch/ODRL-Evaluator/blob/v0.5.0/ODRL-Support.md#left-operands
-                quad(clientSubject, ODRL.terms.leftOperand, namedNode(ODRL.namespace + 'purpose')),
+                quad(clientSubject, ODRL.terms.leftOperand, ODRL.terms.deliveryChannel),
                 quad(clientSubject, ODRL.terms.operator, ODRL.terms.eq),
                 quad(clientSubject, ODRL.terms.rightOperand, namedNode(claims[CLIENTID])),
             );
-            // constraints.push({
-            //     type: ODRL.namespace + 'deliveryChannel',
-            //     operator: ODRL.eq,
-            //     value: namedNode(claims[CLIENTID]),
-            // });
         }
 
         for (const { resource_id, resource_scopes } of query) {
diff --git a/packages/uma/src/policies/authorizers/SimpleOdrlAuthorizer.ts b/packages/uma/src/policies/authorizers/SimpleOdrlAuthorizer.ts
@@ -151,7 +151,7 @@ export class SimpleOdrlAuthorizer implements Authorizer {
    * Determines if all constraints for the given rule are valid.
    * Returns true if all constraints are valid, false if any constraint is not valid,
    * and undefined if any constraint is too complex to evaluate.
-   * Only supports purpose (for client ID) and dateTime constraints.
+   * Only supports deliveryChannel (for client ID) and dateTime constraints.
    */
   protected validateConstraints(rule: Quad_Subject, policies: ReadOnlyStore, claims: ClaimSet): boolean | undefined {
     const constraints = policies.getObjects(rule, ODRL.terms.constraint, null).map(constraint => ({
@@ -165,8 +165,7 @@ export class SimpleOdrlAuthorizer implements Authorizer {
     }
     for (const constraint of constraints) {
       // Return undefined if any of these are too complex or unknown
-      // TODO: because of weird hack described in OdrlAuthorizer, needs to change to term that makes more sense
-      if (constraint.leftOperand.equals(ODRL.terms.purpose)) {
+      if (constraint.leftOperand.equals(ODRL.terms.deliveryChannel)) {
         if (!constraint.operator.equals(ODRL.terms.eq)) {
           return false;
         }
diff --git a/packages/uma/test/unit/policies/authorizers/OdrlAuthorizer.test.ts b/packages/uma/test/unit/policies/authorizers/OdrlAuthorizer.test.ts
@@ -1,7 +1,9 @@
-import { NotImplementedHttpError, RDF, XSD } from '@solid/community-server';
+import 'jest-rdf';
+import { RDF, XSD } from '@solid/community-server';
 import { DataFactory as DF, Parser, Store } from 'n3';
-import { ODRLEvaluator } from 'odrl-evaluator';
+import { ODRL, ODRLEvaluator } from 'odrl-evaluator';
 import { Mocked } from 'vitest';
+import { CLIENTID } from '../../../../src/credentials/Claims';
 import { OdrlAuthorizer } from '../../../../src/policies/authorizers/OdrlAuthorizer';
 import { basicPolicy } from '../../../../src/ucp/policy/ODRL';
 import { UCRulesStorage } from '../../../../src/ucp/storage/UCRulesStorage';
@@ -34,7 +36,7 @@ describe('OdrlAuthorizer', (): void => {
     evaluate.mockResolvedValue([]);
 
     vi.mocked(basicPolicy).mockReturnValue({
-      ruleIRIs:[],
+      ruleIRIs: [ 'urn:req-rule' ],
       policyIRI: 'req',
       representation: new Store(requestQuads),
     });
@@ -97,6 +99,30 @@ describe('OdrlAuthorizer', (): void => {
     );
   });
 
+  it('adds client claim context using odrl:deliveryChannel', async(): Promise<void> => {
+    const claims = { [CLIENTID]: 'client-a' };
+    const query: Permission[] = [{ resource_id: 'rid', resource_scopes: [ 'urn:example:css:modes:read' ] }];
+
+    await expect(authorizer.permissions(claims, query)).resolves.toEqual([{ resource_id: 'rid', resource_scopes: [] }]);
+
+    expect(evaluate).toHaveBeenCalledTimes(1);
+    const generatedRequest = evaluate.mock.calls[0][1];
+    const clientConstraintQuad = generatedRequest.find((quad) =>
+      quad.predicate.equals(ODRL.terms.leftOperand) && quad.object.equals(ODRL.terms.deliveryChannel));
+
+    expect(clientConstraintQuad).toBeDefined();
+    const clientConstraintSubject = clientConstraintQuad!.subject;
+    const clientConstraintQuads = generatedRequest.filter((quad) =>
+      quad.subject.equals(clientConstraintSubject));
+
+    expect(clientConstraintQuads).toEqualRdfQuadArray([
+      DF.quad(clientConstraintSubject, RDF.terms.type, ODRL.terms.Constraint),
+      DF.quad(clientConstraintSubject, ODRL.terms.leftOperand, ODRL.terms.deliveryChannel),
+      DF.quad(clientConstraintSubject, ODRL.terms.operator, ODRL.terms.eq),
+      DF.quad(clientConstraintSubject, ODRL.terms.rightOperand, DF.namedNode('client-a')),
+    ]);
+  });
+
   it('extracts the allowed scopes from the resulting report.', async(): Promise<void> => {
     const query: Permission[] = [{ resource_id: 'rid', resource_scopes: [ 'urn:example:css:modes:read' ] }];
 
diff --git a/packages/uma/test/unit/policies/authorizers/SimpleOdrlAuthorizer.test.ts b/packages/uma/test/unit/policies/authorizers/SimpleOdrlAuthorizer.test.ts
@@ -134,11 +134,11 @@ describe('SimpleOdrlAuthorizer', () => {
     expect(fallback.permissions).toHaveBeenCalledWith({}, query);
   });
 
-  it('returns empty if constraint is not satisfied (purpose)', async () => {
+  it('returns empty if constraint is not satisfied (deliveryChannel)', async () => {
     const rule = addRule({});
     addConstraint({
       rule,
-      leftOperand: ODRL.terms.purpose,
+      leftOperand: ODRL.terms.deliveryChannel,
       operator: ODRL.terms.eq,
       rightOperand: 'clientA',
     });
@@ -150,11 +150,11 @@ describe('SimpleOdrlAuthorizer', () => {
     expect(fallback.permissions).not.toHaveBeenCalled();
   });
 
-  it('returns permission if constraint is satisfied (purpose)', async () => {
+  it('returns permission if constraint is satisfied (deliveryChannel)', async () => {
     const rule = addRule({});
     addConstraint({
       rule,
-      leftOperand: ODRL.terms.purpose,
+      leftOperand: ODRL.terms.deliveryChannel,
       operator: ODRL.terms.eq,
       rightOperand: 'clientA',
     });
diff --git a/test/integration/Oidc.test.ts b/test/integration/Oidc.test.ts
@@ -195,7 +195,7 @@ describe('A server supporting OIDC tokens', (): void => {
         odrl:constraint ex:constraintStandardClient.
 
       ex:constraintStandardClient
-        odrl:leftOperand odrl:purpose ;
+        odrl:leftOperand odrl:deliveryChannel ;
         odrl:operator odrl:eq ;
         odrl:rightOperand <http://example.com/id/${client}> .`;
 
@@ -333,7 +333,7 @@ describe('A server supporting OIDC tokens', (): void => {
         odrl:constraint ex:constraintSolidClient.
 
       ex:constraintSolidClient
-        odrl:leftOperand odrl:purpose ;
+        odrl:leftOperand odrl:deliveryChannel ;
         odrl:operator odrl:eq ;
         odrl:rightOperand <${client}> .`;
 
