diff --git a/src/Rsk.TokenExchange/Validators/DefaultTokenExchangeRequestValidator.cs b/src/Rsk.TokenExchange/Validators/DefaultTokenExchangeRequestValidator.cs index 16c4d02..3a1a1e6 100644 --- a/src/Rsk.TokenExchange/Validators/DefaultTokenExchangeRequestValidator.cs +++ b/src/Rsk.TokenExchange/Validators/DefaultTokenExchangeRequestValidator.cs @@ -32,14 +32,14 @@ public async Task Validate(ITokenExchangeRequest var result = await subjectTokenValidator.Validate(request.SubjectToken, request.SubjectTokenType); // validate that the requester is an intended audience of the subject token - var audiences = result.Claims.Where(x => x.Type == "aud").ToList(); - var clientId = result.Claims.FirstOrDefault(x => x.Type == "client_id"); - if (audiences.All(x => x.Value != request.ClientId) && clientId?.Value != request.ClientId) + var audiences = result.Claims?.Where(x => x.Type == "aud").ToList(); + var clientId = result.Claims?.FirstOrDefault(x => x.Type == "client_id"); + if (audiences != null && audiences.All(x => x.Value != request.ClientId) && clientId?.Value != request.ClientId) { return TokenExchangeValidationResult.Failure("Requester must be a recipient of the subject token"); } - return result.IsValid + return result.IsValid ? TokenExchangeValidationResult.Success(result.Claims) : TokenExchangeValidationResult.Failure("Invalid subject token"); } diff --git a/test/Rsk.TokenExchange.Tests/Validators/DefaultTokenExchangeRequestValidatorTests.cs b/test/Rsk.TokenExchange.Tests/Validators/DefaultTokenExchangeRequestValidatorTests.cs index 7ae6899..c99bcdc 100644 --- a/test/Rsk.TokenExchange.Tests/Validators/DefaultTokenExchangeRequestValidatorTests.cs +++ b/test/Rsk.TokenExchange.Tests/Validators/DefaultTokenExchangeRequestValidatorTests.cs @@ -97,6 +97,23 @@ public async Task Validate_WhenSubjectTokenIsValidWithInvalidAudience_ExpectFail result.ErrorDescription.Should().NotBeNullOrWhiteSpace(); } + [Fact] + public async Task Validate_WhenValidateReturnsInvalidAndExpectedClaimsAreNull_ExpectIsValidToBeFalse() + { + const string validClientId = "app1"; + + mockRequest.Setup(x => x.ClientId).Returns(validClientId); + + mockSubjectTokenResponse.Setup(x => x.IsValid).Returns(false); + mockSubjectTokenResponse.Setup(x => x.Claims).Returns((IEnumerable)null); + + var sut = CreateSut(); + var result = await sut.Validate(mockRequest.Object); + + result.IsValid.Should().BeFalse(); + result.Claims.Should().BeNull(); + } + [Fact] public async Task Validate_WhenSubjectTokenIsValidAndAuthorizedWithCorrectClientId_ExpectSuccessResult() {