fix: Return invalid_resource_id error for invalid ticket requests

Author: joachimvh

packages/uma/config/routes/tickets.json

@@ -10,7 +10,8 @@
       "handler": {
         "@type": "TicketRequestHandler",
         "ticketingStrategy": { "@id": "urn:uma:default:TicketingStrategy" },
-        "ticketStore": { "@id": "urn:uma:default:TicketStore" }
+        "ticketStore": { "@id": "urn:uma:default:TicketStore" },
+        "resourceStore": { "@id": "urn:uma:default:ResourceRegistrationStore" }
       },
       "path": "/uma/ticket"
     }

packages/uma/src/routes/Ticket.ts

@@ -12,6 +12,7 @@ import { HttpHandler, HttpHandlerContext, HttpHandlerResponse } from '../util/ht
 import { verifyRequest } from '../util/HttpMessageSignatures';
 import { array, reType } from '../util/ReType';
 import { Permission } from '../views/Permission';
+import { ResourceDescription } from '../views/ResourceDescription';
 
 /**
  * A TicketRequestHandler is tasked with implementing
@@ -25,6 +26,7 @@ export class TicketRequestHandler extends HttpHandler {
   constructor(
     protected readonly ticketingStrategy: TicketingStrategy,
     protected readonly ticketStore: KeyValueStorage<string, Ticket>,
+    protected readonly resourceStore: KeyValueStorage<string, ResourceDescription>,
   ) {
     super();
   }
@@ -40,6 +42,19 @@ export class TicketRequestHandler extends HttpHandler {
       throw new BadRequestHttpError(`Request has bad syntax: ${createErrorMessage(e)}`);
     }
 
+    for (const { resource_id } of request.body) {
+      // https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0.html#rfc.section.4.3
+      if (!await this.resourceStore.has(resource_id)) {
+        return {
+          status: 400,
+          body: {
+            error: 'invalid_resource_id',
+            error_description: `Unknown UMA ID ${resource_id}`,
+          }
+        }
+      }
+    }
+
     const ticket = await this.ticketingStrategy.initializeTicket(request.body);
     const resolved = await this.ticketingStrategy.resolveTicket(ticket);
 

packages/uma/test/unit/routes/Ticket.test.ts

@@ -5,6 +5,7 @@ import { TicketingStrategy } from '../../../src/ticketing/strategy/TicketingStra
 import { Ticket } from '../../../src/ticketing/Ticket';
 import { HttpHandlerContext } from '../../../src/util/http/models/HttpHandler';
 import * as signatures from '../../../src/util/HttpMessageSignatures';
+import { ResourceDescription } from '../../../src/views/ResourceDescription';
 
 vi.mock('node:crypto', () => ({
   randomUUID: vi.fn().mockReturnValue('1-2-3-4-5'),
@@ -16,6 +17,7 @@ describe('Ticket', (): void => {
 
   let ticketingStrategy: Mocked<TicketingStrategy>;
   let ticketStore: Mocked<KeyValueStorage<string, Ticket>>;
+  let resourceStore: Mocked<KeyValueStorage<string, ResourceDescription>>;
   let handler: TicketRequestHandler;
 
   beforeEach(async(): Promise<void> => {
@@ -33,11 +35,15 @@ describe('Ticket', (): void => {
       validateClaims: vi.fn(),
     };
 
+    resourceStore = {
+      has: vi.fn().mockResolvedValue(true),
+    } satisfies Partial<KeyValueStorage<string, ResourceDescription>> as any;
+
     ticketStore = {
       set: vi.fn(),
     } satisfies Partial<KeyValueStorage<string, Ticket>> as any;
 
-    handler = new TicketRequestHandler(ticketingStrategy, ticketStore);
+    handler = new TicketRequestHandler(ticketingStrategy, ticketStore, resourceStore);
   });
 
   it('errors if the request is not authorized.', async(): Promise<void> => {
@@ -64,4 +70,16 @@ describe('Ticket', (): void => {
     expect(ticketStore.set).toHaveBeenCalledTimes(1);
     expect(ticketStore.set).toHaveBeenLastCalledWith('1-2-3-4-5', 'ticket');
   });
+
+  it('returns with invalid_resource_id if one of the targets is unknown.', async(): Promise<void> => {
+    request.request.body = [
+      { resource_id: 'id1', resource_scopes: [ 'scope1' ]},
+      { resource_id: 'id2', resource_scopes: [ 'scope2' ]},
+    ];
+    resourceStore.has.mockResolvedValueOnce(true);
+    resourceStore.has.mockResolvedValueOnce(false);
+    await expect(handler.handle(request)).resolves
+      .toEqual({ status: 400, body: { error: 'invalid_resource_id', error_description: 'Unknown UMA ID id2' }});
+    expect(ticketStore.set).toHaveBeenCalledTimes(0);
+  });
 });