Feature/nested json claims

Readme.md

@@ -102,12 +102,14 @@ FORCE_JWKS_ON_START        = true
 
 optional configurations
 ```
-CLAIM_MAPPINGS=claim1:header1,claim2:header2
+CLAIM_MAPPINGS=claim1:header1,claim2:header2,claim3.subClaim3:header3
 set up claim mappings by env, on the format
-the above corresponds to the json
+the above corresponds to the json. Claim name 
+can use dot(.) to map nested structures
 
 {
   "claim1": "header1",
-  "claim2": "header2"
+  "claim2": "header2",
+  "claim3.subClaim3": "header3"
 }
 ```

decoder/jws.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 	"sync"
 
 	"github.com/lestrrat-go/jwx/jwk"
@@ -52,7 +53,7 @@ func (d *jwsDecoder) Decode(ctx context.Context, rawJws string) (*Token, error)
 		Claims:     make(map[string]string),
 	}
 	for key, destKey := range d.claimMapping {
-		if value, ok := jwtToken.Get(key); ok {
+		if value, ok := getValue(key, jwtToken); ok {
 			if strVal, ok := value.(string); ok {
 				token.Claims[destKey] = strVal
 			} else {
@@ -84,3 +85,19 @@ func (d *jwsDecoder) parseAndValidate(ctx context.Context, rawJws string) (jwt.T
 	}
 	return t, nil
 }
+
+func getValue(key string, token jwt.Token) (interface{}, bool) {
+	keys := strings.Split(key, ".")
+	value, ok := token.Get(keys[0])
+	if !ok {
+		return "", false
+	}
+	for _, k := range keys[1:] {
+		jsonValue, ok := value.(map[string]interface{})
+		if !ok {
+			return "", false
+		}
+		value = jsonValue[k]
+	}
+	return value, true
+}

decoder/jws_test.go

@@ -38,3 +38,35 @@ func TestTokenWithInvalidClaims(t *testing.T) {
 		dt.Report(t, err != nil, "not able to decode token with unusual JSON type: (%s : %+v) into %+v", k, v, resp)
 	}
 }
+
+func TestTokenWithNestedClaims(t *testing.T) {
+	tc := dt.NewTest()
+	claimMapping := map[string]string{
+		"claim1":                "claim-name",
+		"claim2.nested":         "claim-email",
+		"claim3:complex.nested": "claim-address",
+	}
+	dec, _ := decoder.NewJwsDecoder(tc.JwksURL, claimMapping)
+	token := tc.NewValidToken(map[string]interface{}{
+		"claim1":         "name",
+		"claim2":         map[string]interface{}{"nested": "email"},
+		"claim3:complex": map[string]interface{}{"nested": "address"},
+	})
+	resp, err := dec.Decode(dt.Ctx(), string(token))
+	dt.Report(t, err != nil, "not able to decode token with nested claims: %s", err)
+	dt.Report(t, resp.Claims["claim-name"] != "name", "not able to decode token: (claim1 : name) into %+v", resp)
+	dt.Report(t, resp.Claims["claim-email"] != "email", "not able to decode token: (claim2 : { nested: email }) into %+v", resp)
+	dt.Report(t, resp.Claims["claim-address"] != "address", "not able to decode token: (claim3:complex : { nested: address }) into %+v", resp)
+}
+
+func TestTokenWithEmptyNestedClaims(t *testing.T) {
+	tc := dt.NewTest()
+	claimMapping := map[string]string{
+		"claim.nested": "claim-email",
+	}
+	dec, _ := decoder.NewJwsDecoder(tc.JwksURL, claimMapping)
+	token := tc.NewValidToken(map[string]interface{}{"claim": "email"})
+	resp, err := dec.Decode(dt.Ctx(), string(token))
+	dt.Report(t, err != nil, "not able to decode token with conflicting nested claims: %+v", resp)
+	dt.Report(t, resp.Claims["claim-email"] != "", "decoded token should contain no claim: %+v", resp)
+}