feat: Add sub value to response access tokens

joachimvh · joachimvh · commit c1861838f3a3 · 2026-07-27T10:14:29.000+02:00
diff --git a/packages/uma/src/dialog/BaseNegotiator.ts b/packages/uma/src/dialog/BaseNegotiator.ts
@@ -1,6 +1,7 @@
 import { BadRequestHttpError, ForbiddenHttpError, HttpErrorClass, KeyValueStorage } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
 import { randomUUID } from 'node:crypto';
+import { WEBID } from '../credentials/Claims';
 import { Verifier } from '../credentials/verify/Verifier';
 import { NeedInfoError, RequiredClaim } from '../errors/NeedInfoError';
 import { getOperationLogger } from '../logging/OperationLogger';
@@ -59,7 +60,10 @@ export class BaseNegotiator implements Negotiator {
       const partial = this.isPartialResult(updatedTicket.permissions, resolved.value);
 
       // Retrieve / create instantiated policy
-      const { token, tokenType } = await this.tokenFactory.serialize({ permissions: resolved.value });
+      const { token, tokenType } = await this.tokenFactory.serialize({
+        permissions: resolved.value,
+        ...(typeof updatedTicket.provided[WEBID] === 'string' ? { sub: updatedTicket.provided[WEBID] } : {}),
+      });
       this.logger.debug(`Minted token ${JSON.stringify(token)}`);
 
       // TODO:: test logging
diff --git a/packages/uma/src/dialog/ContractNegotiator.ts b/packages/uma/src/dialog/ContractNegotiator.ts
@@ -1,5 +1,6 @@
 import { createErrorMessage, KeyValueStorage } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
+import { WEBID } from '../credentials/Claims';
 import { Verifier } from '../credentials/verify/Verifier';
 import { RequiredClaim } from '../errors/NeedInfoError';
 import { ContractManager } from '../policies/contracts/ContractManager';
@@ -66,7 +67,7 @@ export class ContractNegotiator extends BaseNegotiator {
 
     if (result.success) {
       // TODO:
-      return this.toResponse(result.value);
+      return this.toResponse(result.value, updatedTicket);
     }
 
     // ... on failure, deny if no solvable requirements
@@ -121,7 +122,7 @@ export class ContractNegotiator extends BaseNegotiator {
   }
 
   // TODO: name
-  protected async toResponse(contract: ODRLContract): Promise<DialogOutput> {
+  protected async toResponse(contract: ODRLContract, ticket: Ticket): Promise<DialogOutput> {
 
     this.logger.debug(JSON.stringify(contract, null, 2))
 
@@ -149,7 +150,11 @@ export class ContractNegotiator extends BaseNegotiator {
     this.logger.debug(`granting permissions: ${JSON.stringify(permissions)}`);
 
     // Create response
-    const tokenContents: AccessToken = { permissions, contract }
+    const tokenContents: AccessToken = {
+      permissions,
+      contract,
+      ...(typeof ticket.provided[WEBID] === 'string' ? { sub: ticket.provided[WEBID] } : {}),
+    };
 
     this.logger.debug(`resolved result ${JSON.stringify(contract)}`);
 
diff --git a/packages/uma/src/tokens/AccessToken.ts b/packages/uma/src/tokens/AccessToken.ts
@@ -4,8 +4,8 @@ import { Type, array, optional as $, string, intersection, optional } from "../u
 
 export const AccessToken = {
   permissions: array(Permission),
+  sub: optional(string),
   contract: optional(ODRLContract)
 }
 
 export type AccessToken = Type<typeof AccessToken>;
-
diff --git a/packages/uma/src/tokens/JwtTokenFactory.ts b/packages/uma/src/tokens/JwtTokenFactory.ts
@@ -44,14 +44,19 @@ export class JwtTokenFactory extends TokenFactory {
   public async serialize(token: AccessToken): Promise<SerializedToken> {
     const key = await this.keyGen.getPrivateKey();
     const jwk = await importJWK(key, key.alg);
-    const jwt = await new SignJWT({ permissions: token.permissions, contract: token.contract })
+    let signJwt = new SignJWT({ permissions: token.permissions, contract: token.contract })
       .setProtectedHeader({ alg: key.alg, kid: key.kid })
       .setIssuedAt()
       .setIssuer(this.issuer)
       .setAudience(this.params.aud ?? AUD)
       .setExpirationTime(this.params.expirationTime)
-      .setJti(randomUUID())
-      .sign(jwk);
+      .setJti(randomUUID());
+
+    if (token.sub) {
+      signJwt = signJwt.setSubject(token.sub);
+    }
+
+    const jwt = await signJwt.sign(jwk);
 
     this.logger.debug(`Issued new JWT Token ${JSON.stringify(token)}`);
     await this.tokenStore.set(jwt, token);
@@ -80,7 +85,10 @@ export class JwtTokenFactory extends TokenFactory {
 
       reType(permissions, array(Permission));
 
-      return { permissions };
+      return {
+        permissions,
+        ...(typeof payload.sub === 'string' ? { sub: payload.sub } : {}),
+      };
     } catch (error: unknown) {
       const msg = `Invalid Access Token provided, error while parsing: ${createErrorMessage(error)}`;
       this.logger.warn(msg);
diff --git a/packages/uma/test/unit/dialog/BaseNegotiator.test.ts b/packages/uma/test/unit/dialog/BaseNegotiator.test.ts
@@ -1,5 +1,6 @@
 import { ForbiddenHttpError, KeyValueStorage } from '@solid/community-server';
 import { Mocked } from 'vitest';
+import { WEBID } from '../../../src/credentials/Claims';
 import { ClaimSet } from '../../../src/credentials/ClaimSet';
 import { Verifier } from '../../../src/credentials/verify/Verifier';
 import { BaseNegotiator } from '../../../src/dialog/BaseNegotiator';
@@ -172,6 +173,22 @@ describe('BaseNegotiator', (): void => {
     expect(ticketingStrategy.validateClaims).toHaveBeenCalledWith(ticket, claims);
   });
 
+  it('includes the WEBID claim in generated tokens as sub value.', async(): Promise<void> => {
+    const webId = 'https://example.com/profile/card#me';
+    ticketingStrategy.validateClaims.mockResolvedValueOnce({
+      ...ticket,
+      provided: { [WEBID]: webId },
+    });
+
+    await expect(negotiator.negotiate({ ...input, claim_token: 'token', claim_token_format: 'format' })).resolves
+      .toEqual({ access_token: 'token', token_type: 'type' });
+
+    expect(tokenFactory.serialize).toHaveBeenLastCalledWith({
+      permissions: [ { resource_id: 'id1', resource_scopes: [ 'scope1' ] } ],
+      sub: webId,
+    });
+  });
+
   it('includes partial=true when resolved permissions do not cover all requested scopes.', async(): Promise<void> => {
     ticketingStrategy.initializeTicket.mockResolvedValueOnce({
       permissions: [ { resource_id: 'id1', resource_scopes: [ 'scope1', 'scope2' ] } ],
diff --git a/packages/uma/test/unit/dialog/ContractNegotiator.test.ts b/packages/uma/test/unit/dialog/ContractNegotiator.test.ts
@@ -1,5 +1,6 @@
 import { ForbiddenHttpError, KeyValueStorage } from '@solid/community-server';
 import { Mocked, MockInstance } from 'vitest';
+import { WEBID } from '../../../src/credentials/Claims';
 import { ClaimSet } from '../../../src/credentials/ClaimSet';
 import { Verifier } from '../../../src/credentials/verify/Verifier';
 import { ContractNegotiator } from '../../../src/dialog/ContractNegotiator';
@@ -10,13 +11,6 @@ import { Ticket } from '../../../src/ticketing/Ticket';
 import { SerializedToken, TokenFactory } from '../../../src/tokens/TokenFactory';
 import { ODRLContract } from '../../../src/views/Contract';
 
-// vi.mock('../../../src/policies/contracts/ContractManager', () => ({
-//   ContractManager: vi.fn().mockReturnValue({
-//     createContract: vi.fn(),
-//     findContract: vi.fn(),
-//   }),
-// }))
-
 describe('ContractNegotiator', (): void => {
   const input: DialogInput = {
     permissions: [
@@ -27,7 +21,6 @@ describe('ContractNegotiator', (): void => {
   const claims: ClaimSet = { claim1: 'value1', claim2: 'value2' };
   const ticket: Ticket = {
     permissions: [ { resource_id: 'id1', resource_scopes: [ 'scope1' ] } ],
-    required: [],
     provided: { claim: 'value' },
   };
   const token: SerializedToken = { token: 'token', tokenType: 'type' };
@@ -142,4 +135,21 @@ describe('ContractNegotiator', (): void => {
     await expect(negotiator.negotiate(input)).rejects.toThrow(ForbiddenHttpError);
     expect(ticketStore.set).toHaveBeenCalledTimes(0);
   });
+
+  it('includes the WEBID claim in generated tokens as sub value.', async(): Promise<void> => {
+    const webId = 'https://example.com/profile/card#me';
+    ticketingStrategy.validateClaims.mockResolvedValueOnce({
+      ...ticket,
+      provided: { [WEBID]: webId },
+    });
+
+    await expect(negotiator.negotiate({ ...input, claim_token: 'token', claim_token_format: 'format' })).resolves
+      .toEqual({ access_token: 'token', token_type: 'type' });
+
+    expect(tokenFactory.serialize).toHaveBeenLastCalledWith({
+      contract,
+      permissions: [{ resource_id: 'target', resource_scopes: [ 'https://w3id.org/oac#action' ] }],
+      sub: webId,
+    });
+  });
 });
diff --git a/packages/uma/test/unit/tokens/JwtTokenFactory.test.ts b/packages/uma/test/unit/tokens/JwtTokenFactory.test.ts
@@ -20,6 +20,7 @@ describe('JwtTokenFactory', (): void => {
 
   const token: AccessToken = {
     permissions: [ { resource_id: 'id', resource_scopes: [ 'scopes' ]} ],
+    sub: 'https://example.com/profile/card#me',
     contract: {
       uid: 'uid',
       permission: [{
@@ -60,7 +61,9 @@ describe('JwtTokenFactory', (): void => {
     expect(result.tokenType).toBe('Bearer');
     const parsed = await jwtVerify(result.token, keys.publicKey);
     expect(parsed.payload).toEqual({
-      ...token,
+      permissions: token.permissions,
+      contract: token.contract,
+      sub: token.sub,
       iat: Math.floor(now.getTime()/1000),
       iss: issuer,
       aud: 'solid',
@@ -79,7 +82,10 @@ describe('JwtTokenFactory', (): void => {
       .setIssuer(issuer)
       .setAudience('solid')
       .sign(keys.privateKey);
-    await expect(factory.deserialize(jwt)).resolves.toEqual({ permissions: token.permissions });
+    await expect(factory.deserialize(jwt)).resolves.toEqual({
+      permissions: token.permissions,
+      sub: token.sub,
+    });
   });
 
   it('errors deserializing tokens with no aud field.', async(): Promise<void> => {

Original file line number	Diff line number	Diff line change
`@@ -4,8 +4,8 @@ import { Type, array, optional as $, string, intersection, optional } from "../u`
`4`	`4`
`5`	`5`	`export const AccessToken = {`
`6`	`6`	`permissions: array(Permission),`
	`7`	`+ sub: optional(string),`
`7`	`8`	`contract: optional(ODRLContract)`
`8`	`9`	`}`
`9`	`10`
`10`	`11`	`export type AccessToken = Type<typeof AccessToken>;`
`11`		`-`