[VI-252] MAP STS token validation

app/controllers/v0/map_services_controller.rb

@@ -11,7 +11,7 @@ def token
       result = MAP::SecurityToken::Service.new.token(application: params[:application].to_sym, icn:, cache: false)
 
       render json: result, status: :ok
-    rescue Common::Client::Errors::ClientError, Common::Exceptions::GatewayTimeout
+    rescue Common::Client::Errors::ClientError, Common::Exceptions::GatewayTimeout, JWT::DecodeError
       render json: sts_client_error, status: :bad_gateway
     rescue MAP::SecurityToken::Errors::ApplicationMismatchError
       render json: application_mismatch_error, status: :bad_request

config/betamocks/services_config.yml

@@ -896,6 +896,9 @@
     - :method: :post
       :path: "/sts/oauth/v1/token"
       :file_path: "map/secure_token_service/token"
+    - :method: :get
+      :path: "/sts/oauth/v1/jwks"
+      :file_path: "map/secure_token_service/jwks"
 
 # Sign Up Service Terms API
 - :name: "MAP SUS"

lib/map/security_token/configuration.rb

@@ -34,6 +34,10 @@ def client_cert_path
         Settings.map_services.client_cert_path
       end
 
+      def provider_jwks_path
+        '/sts/oauth/v1/jwks'
+      end
+
       def service_name
         'map_security_token_service'
       end
@@ -78,6 +82,16 @@ def client_assertion_certificate
         OpenSSL::X509::Certificate.new(File.read(client_cert_path))
       end
 
+      def provider_certificate
+        @provider_certificate ||= build_provider_certificate
+      end
+
+      def build_provider_certificate
+        response = connection.get(provider_jwks_path)
+        jwk = response.body['keys'].first
+        JWT::JWK.import(jwk).keypair.public_key
+      end
+
       def connection
         @connection ||= Faraday.new(
           base_path,

lib/map/security_token/service.rb

@@ -21,6 +21,10 @@ def token(application:, icn:, cache: true)
         Rails.logger.error("#{config.logging_prefix} token failed, parsing error", application:, icn:,
                                                                                    context: e.message)
         raise e
+      rescue JWT::DecodeError => e
+        Rails.logger.error("#{config.logging_prefix} token failed, JWT decode error", application:, icn:,
+                                                                                      context: e.message)
+        raise e
       rescue Common::Client::Errors::ClientError => e
         parse_and_raise_error(e, icn, application)
       rescue Common::Exceptions::GatewayTimeout => e
@@ -57,17 +61,25 @@ def parse_and_raise_error(e, icn, application)
 
       def parse_response(response, application, icn)
         response_body = response.body
+        validate_map_token(response_body['access_token'])
 
         {
           access_token: response_body['access_token'],
           expiration: Time.zone.now + response_body['expires_in']
         }
+      rescue JWT::DecodeError => e
+        raise e
       rescue => e
         message = "#{config.logging_prefix} token failed, response unknown"
         Rails.logger.error(message, application:, icn:)
         raise e, "#{message}, application: #{application}, icn: #{icn}"
       end
 
+      def validate_map_token(encoded_token)
+        public_cert = config.provider_certificate
+        JWT.decode(encoded_token, public_cert, true, algorithm: 'RS512')
+      end
+
       def client_id_from_application(application)
         case application
         when :chatbot

spec/lib/map/security_token/service_spec.rb

@@ -127,16 +127,16 @@
         end
       end
 
-      context 'when response is malformed',
-              vcr: { cassette_name: 'map/security_token_service_200_malformed_response' } do
-        let(:expected_error) { Common::Client::Errors::ParsingError }
-        let(:expected_error_message) { "unexpected token at 'Not valid JSON'" }
-        let(:expected_logger_message) { "#{log_prefix} token failed, parsing error" }
-        let(:expected_log_values) { { application:, icn:, context: expected_error_message } }
-
-        it 'raises an gateway timeout error and creates a log' do
+      context 'when response is an invalid token',
+              vcr: { cassette_name: 'map/security_token_service_200_invalid_token' } do
+        let(:expected_error) { JWT::DecodeError }
+        let(:expected_error_context) { 'Signature verification failed' }
+        let(:expected_logger_message) { "#{log_prefix} token failed, JWT decode error" }
+        let(:expected_log_values) { { application:, icn:, context: expected_error_context } }
+
+        it 'raises a JWT Decode error and creates a log' do
           expect(Rails.logger).to receive(:error).with(expected_logger_message, expected_log_values)
-          expect { subject }.to raise_exception(expected_error, expected_error_message)
+          expect { subject }.to raise_exception(expected_error, expected_error_context)
         end
       end
 

spec/lib/map/sign_up/service_spec.rb

@@ -126,7 +126,7 @@
       let(:expected_log_message) { "#{log_prefix} agreements accept success, icn: #{icn}" }
 
       before do
-        Timecop.freeze(Time.zone.local(2023, 1, 1, 12, 0, 0))
+        Timecop.freeze(Time.zone.local(2024, 9, 1, 12, 0, 0))
         allow(Rails.logger).to receive(:info)
       end
 

spec/requests/v0/map_services_spec.rb

@@ -93,7 +93,25 @@
           end
         end
 
-        context 'when MAP STS client returns an access token',
+        context 'when MAP STS client returns an invalid token',
+                vcr: { cassette_name: 'map/security_token_service_200_invalid_token' } do
+          it 'responds with error details in response body' do
+            call_endpoint
+            expect(JSON.parse(response.body)).to eq(
+              {
+                'error' => 'server_error',
+                'error_description' => 'STS failed to return a valid token.'
+              }
+            )
+          end
+
+          it 'returns HTTP status bad_gateway' do
+            call_endpoint
+            expect(response).to have_http_status(:bad_gateway)
+          end
+        end
+
+        context 'when MAP STS client returns a valid access token',
                 vcr: { cassette_name: 'map/security_token_service_200_response' } do
           it 'responds with STS-issued token in response body' do
             call_endpoint