feat(customTokenExchange): add subject_token and organization input validation

Author: cschetan77

index.d.ts

@@ -157,8 +157,8 @@ interface CustomTokenExchangeOptions {
    */
   requested_token_type?: string;
   /**
-   * Auth0 organization ID or name to use for the exchange.
-   * When provided, the issued token will be scoped to that organization.
+   * Organization ID or name to scope the exchange to.
+   * When provided, the issued token will be bound to that organization.
    */
   organization?: string;
   /** Requested audience. Defaults to `authorizationParams.audience`. */

lib/context.js

@@ -139,6 +139,27 @@ function validateTokenExchangeExtras(extra) {
   return result;
 }
 
+/**
+ * Fails fast on common subject_token mistakes before hitting the network.
+ */
+function validateSubjectToken(token) {
+  if (typeof token !== 'string' || token.trim().length === 0) {
+    throw createError(400, 'subject_token is required for token exchange');
+  }
+  if (token !== token.trim()) {
+    throw createError(
+      400,
+      'subject_token must not include leading or trailing whitespace',
+    );
+  }
+  if (/^bearer\s+/i.test(token)) {
+    throw createError(
+      400,
+      "subject_token must not include the 'Bearer ' prefix",
+    );
+  }
+}
+
 /**
  * Extracts the `act` claim for delegation flows.
  * Prefers the id_token claims (via the helper openid-client attaches to every
@@ -365,8 +386,10 @@ class RequestContext {
       extra,
     } = options;
 
-    if (!subject_token) {
-      throw createError(400, 'subject_token is required for token exchange');
+    validateSubjectToken(subject_token);
+
+    if (organization !== undefined && !organization.trim()) {
+      throw createError(400, 'organization must not be blank');
     }
 
     if (actor_token !== undefined && actor_token_type === undefined) {

test/customTokenExchange.tests.js

@@ -109,6 +109,36 @@ describe('customTokenExchange', () => {
     );
   });
 
+  it('throws 400 when subject_token has leading or trailing whitespace', async () => {
+    const { response } = await setup({
+      exchangeOptions: { subject_token: '  token_with_spaces  ' },
+    });
+    assert.equal(response.statusCode, 400);
+    assert.equal(
+      response.body.err.message,
+      'subject_token must not include leading or trailing whitespace',
+    );
+  });
+
+  it("throws 400 when subject_token includes a 'Bearer ' prefix", async () => {
+    const { response } = await setup({
+      exchangeOptions: { subject_token: 'Bearer __test_token__' },
+    });
+    assert.equal(response.statusCode, 400);
+    assert.equal(
+      response.body.err.message,
+      "subject_token must not include the 'Bearer ' prefix",
+    );
+  });
+
+  it('throws 400 when organization is blank', async () => {
+    const { response } = await setup({
+      exchangeOptions: { organization: '   ' },
+    });
+    assert.equal(response.statusCode, 400);
+    assert.equal(response.body.err.message, 'organization must not be blank');
+  });
+
   it('applies authorizationParams defaults for audience and scope', async () => {
     const { capturedBody } = await setup({
       authConfig: {