feat: Allow NamespacedAuthorizer to use different fragment

Author: joachimvh

packages/uma/src/policies/authorizers/NamespacedAuthorizer.ts

@@ -4,8 +4,6 @@ import { RegistrationStore } from '../../util/RegistrationStore';
 import { Permission } from '../../views/Permission';
 import { Authorizer } from './Authorizer';
 
-const namespace = (resource: string) => new URL(resource).pathname.split('/')?.[2] ?? '';
-
 /**
  * An authorizer delegating to different authorizers based on the namespaces in the request.
  */
@@ -19,11 +17,15 @@ export class NamespacedAuthorizer implements Authorizer {
    *                      and the value being the corresponding authorizer to use for that namespace.
    * @param fallback - Authorizer to use if there is no namespace match.
    * @param registrationStore - The key/value store containing the resource registrations.
+   * @param namespacePosition - URL segment position to find the namespace, after removing the domain.
+   *                            E.g., if URL is http://localhost:3000/alice/profile/card, `profile` has position 2.
+   *                            Defaults to 2.
    */
   constructor(
-    protected authorizers: Record<string, Authorizer>,
-    protected fallback: Authorizer,
-    protected registrationStore: RegistrationStore,
+    protected readonly authorizers: Record<string, Authorizer>,
+    protected readonly fallback: Authorizer,
+    protected readonly registrationStore: RegistrationStore,
+    protected readonly namespacePosition = 2,
   ) {}
 
   /** @inheritdoc */
@@ -68,9 +70,9 @@ export class NamespacedAuthorizer implements Authorizer {
     const resourceIdentifier = registration.description.name;
     if (!resourceIdentifier) {
       this.logger.warn(`Resource ${resourceId} has no registered name.`);
-      return
+      return;
     }
 
-    return namespace(resourceIdentifier);
+    return new URL(resourceIdentifier).pathname.split('/')?.[this.namespacePosition] ?? '';
   }
 }

packages/uma/test/unit/policies/authorizers/NamespacedAuthorizer.test.ts

@@ -64,4 +64,13 @@ describe('NamespacedAuthorizer', (): void => {
       expect(fallback.permissions).toHaveBeenCalledWith(claims, query2);
     });
   });
+
+  it('can be configured to use a different path segment.', async(): Promise<void> => {
+    authorizers.res = { permissions: vi.fn().mockResolvedValue('perm-res'), };
+    const authorizer = new NamespacedAuthorizer(authorizers, fallback, registrationStore, 3);
+    const query = [{ resource_id: 'res1' }];
+    await expect(authorizer.permissions(claims, query)).resolves.toEqual('perm-res');
+    expect(authorizers.res.permissions).toHaveBeenCalledTimes(1);
+    expect(authorizers.res.permissions).toHaveBeenLastCalledWith(claims, query);
+  });
 });