allow custom headers in SubIdentityMapper

__tests__/authorizer/mapper/identity/sub.test.ts

@@ -55,4 +55,16 @@ describe("SubIdentityMapper", () => {
 
     expect(result).toEqual(identityContext("test", "IDENTITY_TYPE_SUB"));
   });
+
+  it("returns an identity context from a custom header", async () => {
+    const req = httpMocks.createRequest({
+      headers: {
+        identity: `my-id`,
+      },
+    });
+    const customSubMapper = SubIdentityMapper("identity");
+    const result = await customSubMapper(req);
+
+    expect(result).toEqual(identityContext("my-id", "IDENTITY_TYPE_SUB"));
+  });
 });

__tests__/middleware.test.ts

@@ -112,7 +112,7 @@ describe("Middleware", () => {
       expect(next).toBeCalledWith({
         statusCode: 403,
         error: "Forbidden",
-        message: `aserto-node: Forbidden by policy examplePolicy`,
+        message: `aserto-node: Forbidden by policy examplePolicy.check`,
       });
     });
 
@@ -248,7 +248,7 @@ describe("Middleware", () => {
       expect(next).toBeCalledWith({
         statusCode: 403,
         error: "Forbidden",
-        message: `aserto-node: Forbidden by policy examplePolicy`,
+        message: `aserto-node: Forbidden by policy examplePolicy.GET.todos`,
       });
     });
 

lib/authorizer/mapper/identity/sub.ts

@@ -11,11 +11,15 @@ const SubIdentityMapper = (
   return async (req: Request): Promise<IdentityContext> => {
     const authHeader = req.header(header);
     if (authHeader) {
-      const token: JwtPayload = jwt_decode(authHeader);
-      if (token && token.sub) {
-        return identityContext(token.sub, "IDENTITY_TYPE_SUB");
+      if (header === "Authorization") {
+        const token: JwtPayload = jwt_decode(authHeader);
+        if (token && token.sub) {
+          return identityContext(token.sub, "IDENTITY_TYPE_SUB");
+        } else {
+          throw new Error("Missing token");
+        }
       } else {
-        throw new Error("Missing token");
+        return identityContext(authHeader, "IDENTITY_TYPE_SUB");
       }
     } else {
       throw new Error(`Missing ${header} header`);

lib/authorizer/middleware.ts

@@ -117,18 +117,21 @@ export class Middleware {
           resourceContext = { ...resourceContext, ...this.resourceMapper };
         }
 
-        return this.client.Is({
-          identityContext: await this.identityContext(req),
-          policyContext: policyCtx,
-          policyInstance: this.policyInstance(),
-          resourceContext: resourceContext,
-        });
+        return [
+          await this.client.Is({
+            identityContext: await this.identityContext(req),
+            policyContext: policyCtx,
+            policyInstance: this.policyInstance(),
+            resourceContext: resourceContext,
+          }),
+          policyCtx.getPath(),
+        ];
       };
       try {
-        const allowed = await callAuthorizer();
+        const [allowed, policyPath] = await callAuthorizer();
         return allowed
           ? next()
-          : error(res, `Forbidden by policy ${this.policy.root}`);
+          : error(res, `Forbidden by policy ${policyPath}`);
       } catch (err) {
         error(res, err as string);
       }
@@ -151,18 +154,21 @@ export class Middleware {
             : this.resourceMapper
           : ResourceParamsMapper(req);
 
-        return this.client.Is({
-          identityContext: await this.identityContext(req),
-          policyContext: policyCtx,
-          policyInstance: this.policyInstance(),
-          resourceContext: resourceContext,
-        });
+        return [
+          await this.client.Is({
+            identityContext: await this.identityContext(req),
+            policyContext: policyCtx,
+            policyInstance: this.policyInstance(),
+            resourceContext: resourceContext,
+          }),
+          policyCtx.getPath(),
+        ];
       };
       try {
-        const allowed = await callAuthorizer();
+        const [allowed, policyPath] = await callAuthorizer();
         return allowed
           ? next()
-          : error(res, `Forbidden by policy ${this.policy.root}`);
+          : error(res, `Forbidden by policy ${policyPath}`);
       } catch (err) {
         error(res, err as string);
       }