fix(ers): include standard JWT claims in claims mode entity resolution

[marythought]

Summary

• The jwx library's PrivateClaims() method excludes standard registered JWT claims (sub, iss, aud, jti) because they are stored as typed struct fields, not in the private claims map
• This caused selectors like .sub to silently fail in subject mapping conditions when using claims mode ERS — the claim was simply absent from the entity representation
• Adds registered string claims (sub, iss, jti, aud) back into the claims map using the token's typed getters
• Time-based claims (exp, iat, nbf) remain excluded because structpb.NewStruct() cannot serialize time.Time values — this maintains existing behavior
• Applies the fix to both v1 and v2 claims ERS implementations

Root Cause

// Before: excludes sub, iss, aud, jti, exp, iat, nbf
claims := token.PrivateClaims()

// After: adds back sub, iss, aud, jti (skips time.Time fields)
claims := token.PrivateClaims()
if sub := token.Subject(); sub != "" {
    claims["sub"] = sub
}
// ...

The multi-strategy ERS already uses token.AsMap(ctx) which includes all claims, so it was not affected.

Test plan

• go test ./service/entityresolution/claims/... -v — all 8 tests pass
• golangci-lint run ./service/entityresolution/claims/... — no issues
• New test assertions verify .sub is present and iat is excluded
• CI checks pass

Fixes #3188

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • JWT-derived claims now expose standard registered fields (subject, issuer, JWT ID, audience) when present, allowing authorization selectors and rules to reference these names directly.
• Tests
  • Updated tests to verify the registered subject is included and certain time-based claims (e.g., issuance time) are excluded from serialized claims.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3ebd35ae-e87a-4776-b181-867b70d8a76f

📥 Commits

Reviewing files that changed from the base of the PR and between f5ede36 and 5881fbb.

📒 Files selected for processing (2)

• service/entityresolution/claims/entity_resolution.go
• service/entityresolution/claims/v2/entity_resolution.go

---

📝 Walkthrough

Walkthrough

Augments JWT-derived claim maps in both v1 and v2 Entity Resolution implementations by inserting standard registered JWT fields (sub, iss, jti, aud) when present, affecting the produced protobuf structpb.Struct used for claim-based entity resolution.

Changes

Cohort / File(s)	Summary
V1 Claims Processing service/entityresolution/claims/entity_resolution.go, service/entityresolution/claims/entity_resolution_test.go	getEntitiesFromToken now merges standard registered JWT fields (sub, iss, jti, aud) into the private claims map when non-empty. Tests updated to assert sub is present and iat is excluded in the resulting structpb.Struct.
V2 Claims Processing service/entityresolution/claims/v2/entity_resolution.go, service/entityresolution/claims/v2/entity_resolution_test.go	Same augmentation applied to v2: registered claims (sub, iss, jti, aud) are inserted into the claims map prior to protobuf conversion. Tests updated to verify sub presence and iat absence.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through claims with nimble feet,
Found sub and friends and made them meet.
Tokens now sing in proper form,
Selectors match—no more storm.
A tiny fix, a quiet feat.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: including standard JWT claims (sub, iss, aud, jti) in the claims mode entity resolution implementation.
Linked Issues check	✅ Passed	The PR successfully addresses issue #3188 by adding standard JWT claims (sub, iss, jti, aud) to the claims map in both v1 and v2 ERS implementations, enabling .sub selector matching in claims mode.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the .sub selector issue: augmenting claims map with standard registered JWT fields in both v1 and v2 implementations with corresponding test assertions.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ers-claims-sub-selector

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug in the claims-based entity resolution service where standard JWT claims were not being properly included in the claims map. This omission prevented effective subject mapping using common selectors. The changes ensure that essential string-based JWT claims are correctly represented, thereby improving the reliability and functionality of entity resolution without altering the handling of time-based claims.

Highlights

• Standard JWT Claims Inclusion: The jwx library's PrivateClaims() method, which previously excluded standard registered JWT claims like sub, iss, aud, and jti because they are stored as typed struct fields, now explicitly adds these string-based claims back into the claims map.
• Subject Mapping Fix: This change resolves an issue where selectors like .sub would silently fail in subject mapping conditions when using claims mode Entity Resolution Service (ERS), as the claim was absent from the entity representation.
• Time-Based Claims Exclusion Maintained: Time-based claims (exp, iat, nbf) continue to be excluded from the claims map, maintaining existing behavior due to structpb.NewStruct()'s inability to serialize time.Time values.
• Broad Application: The fix has been applied to both v1 and v2 implementations of the claims ERS to ensure consistent behavior across versions.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

Claims were missing, a bug, Now 'sub' and 'iss' are snug. Mapping works right, In the code's clear light, No more silent shrug.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request effectively addresses the issue where standard JWT claims were not included in the claims map, which is crucial for subject mapping conditions. The addition of specific tests for both v1 and v2 implementations to verify the presence of 'sub' and exclusion of 'iat' is a good practice, ensuring the fix works as intended and preventing regressions. The changes align with the stated goal of improving entity resolution for JWT claims.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@service/entityresolution/claims/entity_resolution_test.go`:
- Around line 116-119: The test currently asserts that "sub" is included and
"iat" is excluded from claimsMap; add similar assertions to cover other
re-injected standard claims by asserting claimsMap contains "iss", "jti", and
"aud" with their expected values (use the same claimsMap variable in
entity_resolution_test.go and the same assert style, e.g., assert.Equal for
expected values and assert.NotContains for time-based ones) so the test fully
validates all re-injected claims related to the fix.

In `@service/entityresolution/claims/entity_resolution.go`:
- Around line 113-127: Duplicate logic that reinserts standard JWT claims should
be extracted into a shared helper; create a function AddRegisteredClaims(token
jwt.Token, claims map[string]interface{}) that contains the four conditionals
currently in entity_resolution.go (checks for token.Subject(), token.Issuer(),
token.JwtID(), token.Audience()) and then replace the duplicated blocks in both
the v1 and v2 implementations to call AddRegisteredClaims(token, claims); update
imports/packaging as needed so both implementations can call the shared helper.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0acfd2a6-34e6-4d4c-a2fd-4e39649e3d0f

📥 Commits

Reviewing files that changed from the base of the PR and between 0057ff1 and f5ede36.

📒 Files selected for processing (4)

• service/entityresolution/claims/entity_resolution.go
• service/entityresolution/claims/entity_resolution_test.go
• service/entityresolution/claims/v2/entity_resolution.go
• service/entityresolution/claims/v2/entity_resolution_test.go

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.599633ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	81.781819ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	406.43083ms
Throughput	246.04 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.015688949s
Average Latency	418.576628ms
Throughput	119.00 requests/second

[github-actions]

X-Test Failure Report

test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatform0Q4ZLL.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	194.360993ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	92.052338ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	379.84697ms
Throughput	263.26 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.854583213s
Average Latency	386.665941ms
Throughput	128.68 requests/second

[github-actions]

X-Test Results

✅ go-v0.9.0
✅ go-pull-3196
✅ java-v0.9.0
✅ js-v0.9.0
✅ java-pull-3196
✅ js-pull-3196
cukes-report
test-cases-mapping-report
bats-test-results
opentdfplatformRZBFU5.dockerbuild