feat: Return required claims in need_info error when possible

Author: joachimvh

packages/uma/.componentsignore

@@ -6,6 +6,7 @@
   "Buffer",
   "Error",
   "EventEmitter",
+  "ForbiddenHttpError",
   "Map",
   "NodeJS.Dict",
   "Permission",

packages/uma/config/tickets/strategy/claim-elimination.json

@@ -1,9 +1,8 @@
 import { BadRequestHttpError, ForbiddenHttpError, HttpErrorClass, KeyValueStorage } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
 import { randomUUID } from 'node:crypto';
-import { ClaimSet } from '../credentials/ClaimSet';
 import { Verifier } from '../credentials/verify/Verifier';
-import { NeedInfoError } from '../errors/NeedInfoError';
+import { NeedInfoError, RequiredClaim } from '../errors/NeedInfoError';
 import { getOperationLogger } from '../logging/OperationLogger';
 import { serializePolicyInstantiation } from '../logging/OperationSerializer';
 import { TicketingStrategy } from '../ticketing/strategy/TicketingStrategy';
@@ -73,21 +72,18 @@ export class BaseNegotiator implements Negotiator {
     }
 
     // ... on failure, deny if no solvable requirements
-    this.denyRequest(ticket);
+    this.denyRequest(ticket, resolved.value);
   }
 
   // TODO:
-  protected denyRequest(ticket: Ticket): never {
-    const requiredClaims = ticket.required.map(req => Object.keys(req));
-    if (requiredClaims.length === 0) throw new ForbiddenHttpError();
+  protected denyRequest(ticket: Ticket, requirements: RequiredClaim[]): never {
+    if (requirements.length === 0) throw new ForbiddenHttpError('Request denied');
 
     // ... require more info otherwise
     const id = randomUUID();
     this.ticketStore.set(id, ticket);
     throw new NeedInfoError('Need more info to authorize request ...', id, {
-      required_claims: {
-        claim_token_format: requiredClaims,
-      },
+      required_claims: requirements,
     });
   }
 

packages/uma/src/credentials/Requirements.ts

@@ -1,7 +1,7 @@
 import { createErrorMessage, KeyValueStorage } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
-import { Requirements } from '../credentials/Requirements';
 import { Verifier } from '../credentials/verify/Verifier';
+import { RequiredClaim } from '../errors/NeedInfoError';
 import { ContractManager } from '../policies/contracts/ContractManager';
 import { TicketingStrategy } from '../ticketing/strategy/TicketingStrategy';
 import { Ticket } from '../ticketing/Ticket';
@@ -70,7 +70,7 @@ export class ContractNegotiator extends BaseNegotiator {
     }
 
     // ... on failure, deny if no solvable requirements
-    this.denyRequest(ticket);
+    this.denyRequest(ticket, result.value);
   }
 
   /**
@@ -81,8 +81,8 @@ export class ContractNegotiator extends BaseNegotiator {
    * In case the ticket is not resolved,
    * the needed requirements will be returned as Failure.
    */
-  protected async toContract(ticket: Ticket): Promise<Result<ODRLContract, Requirements[]>> {
-    let result : Result<ODRLContract, Requirements[]>;
+  protected async toContract(ticket: Ticket): Promise<Result<ODRLContract, RequiredClaim[]>> {
+    let result : Result<ODRLContract, RequiredClaim[]>;
     let contract: ODRLContract | undefined;
 
     // Check contract availability

packages/uma/src/dialog/BaseNegotiator.ts

@@ -3,8 +3,19 @@ import { ForbiddenHttpError } from '@solid/community-server';
 export type RedirectUserInfo = {
     redirect_user: string
 }
+
+export type RequiredClaim = {
+  claim_token_format?: string,
+  claim_type?: string,
+  friendly_name?: string,
+  issuer?: string,
+  name?: string,
+  derivation_resource_id?: string,
+  resource_scopes?: string[],
+}
+
 export type RequiredClaimsInfo = {
-    required_claims: { claim_token_format: string[][] }
+  required_claims: RequiredClaim[]
 }
 
 /**

packages/uma/src/dialog/ContractNegotiator.ts

@@ -1,6 +1,5 @@
 import { getLoggerFor } from 'global-logger-factory';
 import { ClaimSet } from '../../credentials/ClaimSet';
-import { Requirements } from '../../credentials/Requirements';
 import { Permission } from '../../views/Permission';
 import { ANY_RESOURCE, ANY_SCOPE, Authorizer } from './Authorizer';
 
@@ -28,10 +27,4 @@ export class AllAuthorizer implements Authorizer {
 
     return [{ resource_id: ANY_RESOURCE, resource_scopes: [ ANY_SCOPE ] }];
   }
-
-  /** @inheritdoc */
-  public async credentials(permissions: Permission[]): Promise<Requirements[]> {
-    this.logger.info(`Skipping credentials. ${JSON.stringify(permissions)}`);
-    return [{}];
-  }
 }

packages/uma/src/errors/NeedInfoError.ts

@@ -1,4 +1,3 @@
-import { Requirements } from '../../credentials/Requirements';
 import { ClaimSet } from '../../credentials/ClaimSet';
 import { Permission } from '../../views/Permission';
 
@@ -17,18 +16,4 @@ export abstract class Authorizer {
    * @return {Promise<Permission[]>} - An Array of available Permissions.
    */
   public abstract permissions(claims: ClaimSet, query?: Partial<Permission>[]): Promise<Permission[]>;
-
-  /**
-   * Calculates the required Credentials to achieve a set of given Permissions.
-   *
-   * @param {Permissions[]} permissions - The requested Permissions.
-   * @param {Requirements} query - An optional query to constrain the calculated Requirements.
-   *
-   * @return {Promise<Requirements>} An object containing ClaimDescriptions.
-   */
-  public abstract credentials(permissions: Permission[], query?: Requirements): Promise<Requirements[]>;
-  // TODO:
-  // * @throws {ForbiddenHttpError} When no Credentials can be found (within the query limits)
-  // * that would grant the requested Permissions.
-
 }

packages/uma/src/policies/authorizers/AllAuthorizer.ts

@@ -1,6 +1,5 @@
 import { getLoggerFor } from 'global-logger-factory';
 import { ClaimSet } from '../../credentials/ClaimSet';
-import { Requirements } from '../../credentials/Requirements';
 import { RegistrationStore } from '../../util/RegistrationStore';
 import { Permission } from '../../views/Permission';
 import { Authorizer } from './Authorizer';
@@ -52,30 +51,6 @@ export class NamespacedAuthorizer implements Authorizer {
     return authorizer.permissions(claims, query);
   }
 
-  /** @inheritdoc */
-  public async credentials(permissions: Permission[], query?: Requirements): Promise<Requirements[]> {
-    this.logger.info(`Calculating credentials. ${JSON.stringify({ permissions, query })}`);
-
-    // No requirements if no requested permissions
-    if (!permissions || permissions.length === 0) return [];
-
-    // Base namespace on first resource
-    const ns = await this.findNamespace(permissions[0].resource_id);
-
-    // Check namespaces of other resources
-    for (let i = 1; i < permissions.length; ++i) {
-      if (await this.findNamespace(permissions[i].resource_id) !== ns) {
-        this.logger.warn(`Cannot calculate credentials over multiple namespaces at once.`);
-        return [];
-      }
-    }
-
-    // Find applicable authorizer
-    const authorizer = (typeof ns === 'string' && this.authorizers[ns]) || this.fallback;
-
-    return authorizer.credentials(permissions, query);
-  }
-
   /**
    * Finds the applicable authorizer to use based on the input query.
    */

packages/uma/src/policies/authorizers/Authorizer.ts

@@ -1,6 +1,5 @@
 import { getLoggerFor } from 'global-logger-factory';
 import { ClaimSet } from '../../credentials/ClaimSet';
-import { Requirements } from '../../credentials/Requirements';
 import { Permission } from '../../views/Permission';
 import { Authorizer } from './Authorizer';
 
@@ -14,11 +13,4 @@ export class NoneAuthorizer implements Authorizer {
   public async permissions(claims: ClaimSet, query?: Partial<Permission>[]): Promise<Permission[]> {
     return [];
   }
-
-  /** @inheritdoc */
-  public async credentials(permissions: Permission[], query?: Requirements): Promise<Requirements[]> {
-    this.logger.info(`Skipping credentials. ${JSON.stringify({ permissions, query })}`);
-    // throw new ForbiddenHttpError();  // TODO: indicating impossibility to RS would save roundtrip
-    return [];
-  }
 }