Add amr claim to Token model#57
Merged
Merged
Conversation
Populate the optional amr (Authentication Methods References) claim from the /token endpoint id token when present, leaving it null when absent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wrap the amr asList() call in a JWTDecodeException guard so a non-string array element (RFC 8176 violation from upstream) yields null instead of leaking a RuntimeException past the SDK's declared DuoException contract. Also correct the 9-arg Token constructor javadoc (it is no longer "all properties"), mirror amr in toString per the existing pattern, and add tests for the null / non-array / non-string-element wire shapes plus an equals/hashCode contract test for the new field. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
brandonwongduo
marked this pull request as ready for review
July 10, 2026 19:25
The prior test asserted that a JSON array of integers would be rejected by asList(String.class), but Jackson silently coerces numeric nodes to their string form when the target type is String, so no JWTDecodeException is thrown. Update the test to reflect the actual library behavior — the try/catch in extractAmr remains as defense-in-depth for element types Jackson cannot coerce. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
AaronAtDuo
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
amrfield (List<String>) to theTokenmodel to surface the Authentication Methods References claim added to the/tokenendpoint response (Duo OAuth API docs).Utils.transformDecodedJwtToToken()viadecodedJwt.getClaim("amr").asList(String.class). The claim is optional, so absent claims leave the fieldnull(java-jwt'sNullClaim.asList()returnsnull) — the same pattern already used for other optional claims in this method.equals/hashCode/toStringonTokenaccordingly. The existing all-args constructor is intentionally left unchanged to preserve the public API; callers use the no-arg constructor with setters.Note for reviewers
The
amrclaim has three possible states from Duo: absent, empty list, or a list of strings. This PR preserves that distinction — a missing claim leavesgetAmr()returningnull, and an empty list returnsCollections.emptyList(). This is consistent with the other optional fields onToken(auth_result,auth_context, etc.), which also usenullto signal "not provided." If reviewers would prefer collapsing absent → empty list so callers only need to handle one shape, happy to change it.Test plan
transformDecodedJwtToToken— assertsgetAmr()isnullwhen the claim is missingtransformDecodedJwtToTokenWithAmr— asserts a populated list round-tripstransformDecodedJwtToTokenWithEmptyAmr— asserts an empty list round-tripsmvn -pl duo-universal-sdk test(CI)🤖 Generated with Claude Code