fix(entityresolution): pass inline claims through multi-strategy context

service/entityresolution/multi-strategy/registration.go

@@ -13,6 +13,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/entityresolution"
 	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
 	"github.com/opentdf/platform/service/logger"
+	"github.com/opentdf/platform/service/pkg/protohelper"
 	"github.com/opentdf/platform/service/pkg/serviceregistry"
 	"go.opentelemetry.io/otel/trace"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -54,6 +55,7 @@ func (ers *ERS) ResolveEntities(
 			continue
 		}
 
+		resolveCtx := ctx
 		var claimsMap types.JWTClaims
 		switch entity.GetEntityType().(type) {
 		case *authorization.Entity_Claims:
@@ -67,6 +69,7 @@ func (ers *ERS) ResolveEntities(
 				}
 				// Convert to map[string]interface{}
 				claimsMap = claimsStruct.AsMap()
+				resolveCtx = context.WithValue(ctx, types.JWTClaimsContextKey, claimsMap)
 			}
 		default:
 			entityBytes, err := protojson.Marshal(entity)
@@ -80,7 +83,7 @@ func (ers *ERS) ResolveEntities(
 		}
 
 		// Resolve entity using multi-strategy service
-		result, err := ers.service.ResolveEntity(ctx, entityID, claimsMap)
+		result, err := ers.service.ResolveEntity(resolveCtx, entityID, claimsMap)
 		if err != nil {
 			ers.logger.Error("failed to resolve entity",
 				slog.String("entity_id", entityID),
@@ -109,12 +112,12 @@ func (ers *ERS) ResolveEntities(
 
 		// Add resolved claims
 		for claimName, claimValue := range result.Claims {
-			resultData[claimName] = claimValue
+			resultData[claimName] = protohelper.StructPBCompatibleValue(claimValue)
 		}
 
 		// Add metadata with "metadata_" prefix
 		for metaKey, metaValue := range result.Metadata {
-			resultData[("metadata_" + metaKey)] = metaValue
+			resultData[("metadata_" + metaKey)] = protohelper.StructPBCompatibleValue(metaValue)
 		}
 
 		// Convert to protobuf struct

service/entityresolution/multi-strategy/registration_test.go

@@ -0,0 +1,157 @@
+package multistrategy
+
+import (
+	"testing"
+
+	"connectrpc.com/connect"
+	"github.com/opentdf/platform/protocol/go/authorization"
+	"github.com/opentdf/platform/protocol/go/entityresolution"
+	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
+	"github.com/opentdf/platform/service/logger"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestResolveEntities_ClaimsProviderUsesInlineClaimsContext(t *testing.T) {
+	t.Helper()
+
+	erService, err := NewERS(t.Context(), types.MultiStrategyConfig{
+		Providers: map[string]types.ProviderConfig{
+			"jwt": {
+				Type:       "claims",
+				Connection: map[string]interface{}{},
+			},
+		},
+		MappingStrategies: []types.MappingStrategy{
+			{
+				Name:       "claims_passthrough",
+				Provider:   "jwt",
+				EntityType: types.EntityTypeSubject,
+				Conditions: types.StrategyConditions{
+					JWTClaims: []types.JWTClaimCondition{
+						{
+							Claim:    "sub",
+							Operator: "exists",
+						},
+					},
+				},
+				OutputMapping: []types.OutputMapping{
+					{
+						SourceClaim: "sub",
+						ClaimName:   "subject",
+					},
+					{
+						SourceClaim: "email",
+						ClaimName:   "email_address",
+					},
+				},
+			},
+		},
+	}, logger.CreateTestLogger())
+	if err != nil {
+		t.Fatalf("NewERS() error = %v", err)
+	}
+
+	claimsStruct, err := structpb.NewStruct(map[string]interface{}{
+		"sub":   "diana",
+		"email": "diana@example.com",
+	})
+	if err != nil {
+		t.Fatalf("structpb.NewStruct() error = %v", err)
+	}
+
+	claimsAny, err := anypb.New(claimsStruct)
+	if err != nil {
+		t.Fatalf("anypb.New() error = %v", err)
+	}
+
+	resp, err := erService.ResolveEntities(t.Context(), connect.NewRequest(&entityresolution.ResolveEntitiesRequest{
+		Entities: []*authorization.Entity{
+			{
+				Id:         "diana-claims",
+				EntityType: &authorization.Entity_Claims{Claims: claimsAny},
+			},
+		},
+	}))
+	if err != nil {
+		t.Fatalf("ResolveEntities() error = %v", err)
+	}
+
+	if got := len(resp.Msg.GetEntityRepresentations()); got != 1 {
+		t.Fatalf("expected 1 entity representation, got %d", got)
+	}
+
+	props := resp.Msg.GetEntityRepresentations()[0].GetAdditionalProps()
+	if len(props) != 1 {
+		t.Fatalf("expected 1 additional props entry, got %d", len(props))
+	}
+
+	result := props[0].AsMap()
+	if got := result["subject"]; got != "diana" {
+		t.Fatalf("expected subject diana, got %v", got)
+	}
+	if got := result["email_address"]; got != "diana@example.com" {
+		t.Fatalf("expected email_address diana@example.com, got %v", got)
+	}
+	if got := result["metadata_source"]; got != "jwt_claims" {
+		t.Fatalf("expected metadata_source jwt_claims, got %v", got)
+	}
+	if _, hasError := result["error"]; hasError {
+		t.Fatalf("expected successful resolution, got error payload: %v", result["error"])
+	}
+}
+
+func TestResolveEntities_UserNameEntityDoesNotSeedClaimsContext(t *testing.T) {
+	t.Helper()
+
+	erService, err := NewERS(t.Context(), types.MultiStrategyConfig{
+		Providers: map[string]types.ProviderConfig{
+			"jwt": {
+				Type:       "claims",
+				Connection: map[string]interface{}{},
+			},
+		},
+		FailureStrategy: types.FailureStrategyContinue,
+		MappingStrategies: []types.MappingStrategy{
+			{
+				Name:       "claims_passthrough",
+				Provider:   "jwt",
+				EntityType: types.EntityTypeSubject,
+				Conditions: types.StrategyConditions{
+					JWTClaims: []types.JWTClaimCondition{{Claim: "userName", Operator: "exists"}},
+				},
+				OutputMapping: []types.OutputMapping{{SourceClaim: "userName", ClaimName: "username"}},
+			},
+		},
+	}, logger.CreateTestLogger())
+	if err != nil {
+		t.Fatalf("NewERS() error = %v", err)
+	}
+
+	resp, err := erService.ResolveEntities(t.Context(), connect.NewRequest(&entityresolution.ResolveEntitiesRequest{
+		Entities: []*authorization.Entity{{
+			Id:         "alice-user-name",
+			EntityType: &authorization.Entity_UserName{UserName: "alice"},
+		}},
+	}))
+	if err != nil {
+		t.Fatalf("ResolveEntities() error = %v", err)
+	}
+
+	if got := len(resp.Msg.GetEntityRepresentations()); got != 1 {
+		t.Fatalf("expected 1 entity representation, got %d", got)
+	}
+
+	props := resp.Msg.GetEntityRepresentations()[0].GetAdditionalProps()
+	if len(props) != 1 {
+		t.Fatalf("expected 1 additional props entry, got %d", len(props))
+	}
+
+	result := props[0].AsMap()
+	if _, hasError := result["error"]; !hasError {
+		t.Fatalf("expected claims provider to fail without middleware claims for user_name entity, got %v", result)
+	}
+	if got := result["entity_id"]; got != "alice-user-name" {
+		t.Fatalf("expected entity_id alice-user-name, got %v", got)
+	}
+}

service/entityresolution/multi-strategy/v2/registration.go

@@ -16,6 +16,7 @@ import (
 	multistrategy "github.com/opentdf/platform/service/entityresolution/multi-strategy"
 	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
 	"github.com/opentdf/platform/service/logger"
+	"github.com/opentdf/platform/service/pkg/protohelper"
 	"github.com/opentdf/platform/service/pkg/serviceregistry"
 	"go.opentelemetry.io/otel/trace"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -63,6 +64,7 @@ func (ers *ERSV2) ResolveEntities(
 			ers.logger.Warn("empty entity ID in request; using generated ID", slog.String("entity_id", entityID))
 		}
 
+		resolveCtx := ctx
 		var claimsMap types.JWTClaims
 		switch entityV2.GetEntityType().(type) {
 		case *entity.Entity_Claims:
@@ -76,6 +78,7 @@ func (ers *ERSV2) ResolveEntities(
 				}
 				// Convert to map[string]interface{}
 				claimsMap = claimsStruct.AsMap()
+				resolveCtx = context.WithValue(ctx, types.JWTClaimsContextKey, claimsMap)
 			}
 		default:
 			entityBytes, err := protojson.Marshal(entityV2)
@@ -89,7 +92,7 @@ func (ers *ERSV2) ResolveEntities(
 		}
 
 		// Resolve entity using multi-strategy service
-		result, err := ers.service.ResolveEntity(ctx, entityID, claimsMap)
+		result, err := ers.service.ResolveEntity(resolveCtx, entityID, claimsMap)
 		if err != nil {
 			ers.logger.Error("failed to resolve entity",
 				slog.String("entity_id", entityID),
@@ -123,7 +126,7 @@ func (ers *ERSV2) ResolveEntities(
 
 		// Add metadata with "metadata_" prefix
 		for metaKey, metaValue := range result.Metadata {
-			resultData[("metadata_" + metaKey)] = metaValue
+			resultData[("metadata_" + metaKey)] = protohelper.StructPBCompatibleValue(metaValue)
 		}
 
 		// Convert to protobuf struct