fix nil pointer in GetTokenIDAndSubjectFromToken

2025-03-26 05:18:34 -03:00 · 2025-03-26 05:18:34 -03:00 · f47a37e233
commit f47a37e233
parent aeda5d7178
7 changed files with 773 additions and 3 deletions
--- a/pkg/op/mock/crypto.mock.go
+++ b/pkg/op/mock/crypto.mock.go
@ -0,0 +1,64 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/zitadel/oidc/v3/pkg/op (interfaces: Crypto)
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockCrypto is a mock of Crypto interface.
+type MockCrypto struct {
+	ctrl     *gomock.Controller
+	recorder *MockCryptoMockRecorder
+}
+
+// MockCryptoMockRecorder is the mock recorder for MockCrypto.
+type MockCryptoMockRecorder struct {
+	mock *MockCrypto
+}
+
+// NewMockCrypto creates a new mock instance.
+func NewMockCrypto(ctrl *gomock.Controller) *MockCrypto {
+	mock := &MockCrypto{ctrl: ctrl}
+	mock.recorder = &MockCryptoMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockCrypto) EXPECT() *MockCryptoMockRecorder {
+	return m.recorder
+}
+
+// Decrypt mocks base method.
+func (m *MockCrypto) Decrypt(arg0 string) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Decrypt", arg0)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Decrypt indicates an expected call of Decrypt.
+func (mr *MockCryptoMockRecorder) Decrypt(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Decrypt", reflect.TypeOf((*MockCrypto)(nil).Decrypt), arg0)
+}
+
+// Encrypt mocks base method.
+func (m *MockCrypto) Encrypt(arg0 string) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Encrypt", arg0)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Encrypt indicates an expected call of Encrypt.
+func (mr *MockCryptoMockRecorder) Encrypt(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Encrypt", reflect.TypeOf((*MockCrypto)(nil).Encrypt), arg0)
+}
--- a/pkg/op/mock/exchanger.mock.go
+++ b/pkg/op/mock/exchanger.mock.go
@ -0,0 +1,220 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/zitadel/oidc/v3/pkg/op (interfaces: Exchanger)
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	context "context"
+	slog "log/slog"
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+	http "github.com/zitadel/oidc/v3/pkg/http"
+	op "github.com/zitadel/oidc/v3/pkg/op"
+)
+
+// MockExchanger is a mock of Exchanger interface.
+type MockExchanger struct {
+	ctrl     *gomock.Controller
+	recorder *MockExchangerMockRecorder
+}
+
+// MockExchangerMockRecorder is the mock recorder for MockExchanger.
+type MockExchangerMockRecorder struct {
+	mock *MockExchanger
+}
+
+// NewMockExchanger creates a new mock instance.
+func NewMockExchanger(ctrl *gomock.Controller) *MockExchanger {
+	mock := &MockExchanger{ctrl: ctrl}
+	mock.recorder = &MockExchangerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockExchanger) EXPECT() *MockExchangerMockRecorder {
+	return m.recorder
+}
+
+// AccessTokenVerifier mocks base method.
+func (m *MockExchanger) AccessTokenVerifier(arg0 context.Context) *op.AccessTokenVerifier {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AccessTokenVerifier", arg0)
+	ret0, _ := ret[0].(*op.AccessTokenVerifier)
+	return ret0
+}
+
+// AccessTokenVerifier indicates an expected call of AccessTokenVerifier.
+func (mr *MockExchangerMockRecorder) AccessTokenVerifier(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AccessTokenVerifier", reflect.TypeOf((*MockExchanger)(nil).AccessTokenVerifier), arg0)
+}
+
+// AuthMethodPostSupported mocks base method.
+func (m *MockExchanger) AuthMethodPostSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AuthMethodPostSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// AuthMethodPostSupported indicates an expected call of AuthMethodPostSupported.
+func (mr *MockExchangerMockRecorder) AuthMethodPostSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthMethodPostSupported", reflect.TypeOf((*MockExchanger)(nil).AuthMethodPostSupported))
+}
+
+// AuthMethodPrivateKeyJWTSupported mocks base method.
+func (m *MockExchanger) AuthMethodPrivateKeyJWTSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AuthMethodPrivateKeyJWTSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// AuthMethodPrivateKeyJWTSupported indicates an expected call of AuthMethodPrivateKeyJWTSupported.
+func (mr *MockExchangerMockRecorder) AuthMethodPrivateKeyJWTSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthMethodPrivateKeyJWTSupported", reflect.TypeOf((*MockExchanger)(nil).AuthMethodPrivateKeyJWTSupported))
+}
+
+// Crypto mocks base method.
+func (m *MockExchanger) Crypto() op.Crypto {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Crypto")
+	ret0, _ := ret[0].(op.Crypto)
+	return ret0
+}
+
+// Crypto indicates an expected call of Crypto.
+func (mr *MockExchangerMockRecorder) Crypto() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Crypto", reflect.TypeOf((*MockExchanger)(nil).Crypto))
+}
+
+// Decoder mocks base method.
+func (m *MockExchanger) Decoder() http.Decoder {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Decoder")
+	ret0, _ := ret[0].(http.Decoder)
+	return ret0
+}
+
+// Decoder indicates an expected call of Decoder.
+func (mr *MockExchangerMockRecorder) Decoder() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Decoder", reflect.TypeOf((*MockExchanger)(nil).Decoder))
+}
+
+// GrantTypeClientCredentialsSupported mocks base method.
+func (m *MockExchanger) GrantTypeClientCredentialsSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GrantTypeClientCredentialsSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// GrantTypeClientCredentialsSupported indicates an expected call of GrantTypeClientCredentialsSupported.
+func (mr *MockExchangerMockRecorder) GrantTypeClientCredentialsSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantTypeClientCredentialsSupported", reflect.TypeOf((*MockExchanger)(nil).GrantTypeClientCredentialsSupported))
+}
+
+// GrantTypeDeviceCodeSupported mocks base method.
+func (m *MockExchanger) GrantTypeDeviceCodeSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GrantTypeDeviceCodeSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// GrantTypeDeviceCodeSupported indicates an expected call of GrantTypeDeviceCodeSupported.
+func (mr *MockExchangerMockRecorder) GrantTypeDeviceCodeSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantTypeDeviceCodeSupported", reflect.TypeOf((*MockExchanger)(nil).GrantTypeDeviceCodeSupported))
+}
+
+// GrantTypeJWTAuthorizationSupported mocks base method.
+func (m *MockExchanger) GrantTypeJWTAuthorizationSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GrantTypeJWTAuthorizationSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// GrantTypeJWTAuthorizationSupported indicates an expected call of GrantTypeJWTAuthorizationSupported.
+func (mr *MockExchangerMockRecorder) GrantTypeJWTAuthorizationSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantTypeJWTAuthorizationSupported", reflect.TypeOf((*MockExchanger)(nil).GrantTypeJWTAuthorizationSupported))
+}
+
+// GrantTypeRefreshTokenSupported mocks base method.
+func (m *MockExchanger) GrantTypeRefreshTokenSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GrantTypeRefreshTokenSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// GrantTypeRefreshTokenSupported indicates an expected call of GrantTypeRefreshTokenSupported.
+func (mr *MockExchangerMockRecorder) GrantTypeRefreshTokenSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantTypeRefreshTokenSupported", reflect.TypeOf((*MockExchanger)(nil).GrantTypeRefreshTokenSupported))
+}
+
+// GrantTypeTokenExchangeSupported mocks base method.
+func (m *MockExchanger) GrantTypeTokenExchangeSupported() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GrantTypeTokenExchangeSupported")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// GrantTypeTokenExchangeSupported indicates an expected call of GrantTypeTokenExchangeSupported.
+func (mr *MockExchangerMockRecorder) GrantTypeTokenExchangeSupported() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GrantTypeTokenExchangeSupported", reflect.TypeOf((*MockExchanger)(nil).GrantTypeTokenExchangeSupported))
+}
+
+// IDTokenHintVerifier mocks base method.
+func (m *MockExchanger) IDTokenHintVerifier(arg0 context.Context) *op.IDTokenHintVerifier {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IDTokenHintVerifier", arg0)
+	ret0, _ := ret[0].(*op.IDTokenHintVerifier)
+	return ret0
+}
+
+// IDTokenHintVerifier indicates an expected call of IDTokenHintVerifier.
+func (mr *MockExchangerMockRecorder) IDTokenHintVerifier(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IDTokenHintVerifier", reflect.TypeOf((*MockExchanger)(nil).IDTokenHintVerifier), arg0)
+}
+
+// Logger mocks base method.
+func (m *MockExchanger) Logger() *slog.Logger {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Logger")
+	ret0, _ := ret[0].(*slog.Logger)
+	return ret0
+}
+
+// Logger indicates an expected call of Logger.
+func (mr *MockExchangerMockRecorder) Logger() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Logger", reflect.TypeOf((*MockExchanger)(nil).Logger))
+}
+
+// Storage mocks base method.
+func (m *MockExchanger) Storage() op.Storage {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Storage")
+	ret0, _ := ret[0].(op.Storage)
+	return ret0
+}
+
+// Storage indicates an expected call of Storage.
+func (mr *MockExchangerMockRecorder) Storage() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Storage", reflect.TypeOf((*MockExchanger)(nil).Storage))
+}
--- a/pkg/op/mock/generate.go
+++ b/pkg/op/mock/generate.go
@ -9,3 +9,7 @@ package mock
 //go:generate mockgen -package mock -destination ./discovery.mock.go github.com/zitadel/oidc/v3/pkg/op DiscoverStorage
 //go:generate mockgen -package mock -destination ./signer.mock.go github.com/zitadel/oidc/v3/pkg/op SigningKey,Key
 //go:generate mockgen -package mock -destination ./key.mock.go github.com/zitadel/oidc/v3/pkg/op KeyProvider
+//go:generate mockgen -package mock -destination ./exchanger.mock.go github.com/zitadel/oidc/v3/pkg/op Exchanger
+//go:generate mockgen -package mock -destination ./tokenexchangeverifierstorage.mock.go github.com/zitadel/oidc/v3/pkg/op TokenExchangeTokensVerifierStorage
+//go:generate mockgen -package mock -destination ./crypto.mock.go github.com/zitadel/oidc/v3/pkg/op Crypto
+//go:generate mockgen -package mock -destination ./token_refresh.mock.go github.com/zitadel/oidc/v3/pkg/op RefreshTokenRequest
--- a/pkg/op/mock/token_refresh.mock.go
+++ b/pkg/op/mock/token_refresh.mock.go
@ -0,0 +1,131 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/zitadel/oidc/v3/pkg/op (interfaces: RefreshTokenRequest)
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	reflect "reflect"
+	time "time"
+
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockRefreshTokenRequest is a mock of RefreshTokenRequest interface.
+type MockRefreshTokenRequest struct {
+	ctrl     *gomock.Controller
+	recorder *MockRefreshTokenRequestMockRecorder
+}
+
+// MockRefreshTokenRequestMockRecorder is the mock recorder for MockRefreshTokenRequest.
+type MockRefreshTokenRequestMockRecorder struct {
+	mock *MockRefreshTokenRequest
+}
+
+// NewMockRefreshTokenRequest creates a new mock instance.
+func NewMockRefreshTokenRequest(ctrl *gomock.Controller) *MockRefreshTokenRequest {
+	mock := &MockRefreshTokenRequest{ctrl: ctrl}
+	mock.recorder = &MockRefreshTokenRequestMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockRefreshTokenRequest) EXPECT() *MockRefreshTokenRequestMockRecorder {
+	return m.recorder
+}
+
+// GetAMR mocks base method.
+func (m *MockRefreshTokenRequest) GetAMR() []string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAMR")
+	ret0, _ := ret[0].([]string)
+	return ret0
+}
+
+// GetAMR indicates an expected call of GetAMR.
+func (mr *MockRefreshTokenRequestMockRecorder) GetAMR() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAMR", reflect.TypeOf((*MockRefreshTokenRequest)(nil).GetAMR))
+}
+
+// GetAudience mocks base method.
+func (m *MockRefreshTokenRequest) GetAudience() []string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAudience")
+	ret0, _ := ret[0].([]string)
+	return ret0
+}
+
+// GetAudience indicates an expected call of GetAudience.
+func (mr *MockRefreshTokenRequestMockRecorder) GetAudience() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAudience", reflect.TypeOf((*MockRefreshTokenRequest)(nil).GetAudience))
+}
+
+// GetAuthTime mocks base method.
+func (m *MockRefreshTokenRequest) GetAuthTime() time.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAuthTime")
+	ret0, _ := ret[0].(time.Time)
+	return ret0
+}
+
+// GetAuthTime indicates an expected call of GetAuthTime.
+func (mr *MockRefreshTokenRequestMockRecorder) GetAuthTime() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAuthTime", reflect.TypeOf((*MockRefreshTokenRequest)(nil).GetAuthTime))
+}
+
+// GetClientID mocks base method.
+func (m *MockRefreshTokenRequest) GetClientID() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClientID")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetClientID indicates an expected call of GetClientID.
+func (mr *MockRefreshTokenRequestMockRecorder) GetClientID() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClientID", reflect.TypeOf((*MockRefreshTokenRequest)(nil).GetClientID))
+}
+
+// GetScopes mocks base method.
+func (m *MockRefreshTokenRequest) GetScopes() []string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetScopes")
+	ret0, _ := ret[0].([]string)
+	return ret0
+}
+
+// GetScopes indicates an expected call of GetScopes.
+func (mr *MockRefreshTokenRequestMockRecorder) GetScopes() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetScopes", reflect.TypeOf((*MockRefreshTokenRequest)(nil).GetScopes))
+}
+
+// GetSubject mocks base method.
+func (m *MockRefreshTokenRequest) GetSubject() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetSubject")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// GetSubject indicates an expected call of GetSubject.
+func (mr *MockRefreshTokenRequestMockRecorder) GetSubject() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSubject", reflect.TypeOf((*MockRefreshTokenRequest)(nil).GetSubject))
+}
+
+// SetCurrentScopes mocks base method.
+func (m *MockRefreshTokenRequest) SetCurrentScopes(arg0 []string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetCurrentScopes", arg0)
+}
+
+// SetCurrentScopes indicates an expected call of SetCurrentScopes.
+func (mr *MockRefreshTokenRequestMockRecorder) SetCurrentScopes(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetCurrentScopes", reflect.TypeOf((*MockRefreshTokenRequest)(nil).SetCurrentScopes), arg0)
+}
--- a/pkg/op/mock/tokenexchangeverifierstorage.mock.go
+++ b/pkg/op/mock/tokenexchangeverifierstorage.mock.go
@ -0,0 +1,70 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/zitadel/oidc/v3/pkg/op (interfaces: TokenExchangeTokensVerifierStorage)
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+	oidc "github.com/zitadel/oidc/v3/pkg/oidc"
+)
+
+// MockTokenExchangeTokensVerifierStorage is a mock of TokenExchangeTokensVerifierStorage interface.
+type MockTokenExchangeTokensVerifierStorage struct {
+	ctrl     *gomock.Controller
+	recorder *MockTokenExchangeTokensVerifierStorageMockRecorder
+}
+
+// MockTokenExchangeTokensVerifierStorageMockRecorder is the mock recorder for MockTokenExchangeTokensVerifierStorage.
+type MockTokenExchangeTokensVerifierStorageMockRecorder struct {
+	mock *MockTokenExchangeTokensVerifierStorage
+}
+
+// NewMockTokenExchangeTokensVerifierStorage creates a new mock instance.
+func NewMockTokenExchangeTokensVerifierStorage(ctrl *gomock.Controller) *MockTokenExchangeTokensVerifierStorage {
+	mock := &MockTokenExchangeTokensVerifierStorage{ctrl: ctrl}
+	mock.recorder = &MockTokenExchangeTokensVerifierStorageMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockTokenExchangeTokensVerifierStorage) EXPECT() *MockTokenExchangeTokensVerifierStorageMockRecorder {
+	return m.recorder
+}
+
+// VerifyExchangeActorToken mocks base method.
+func (m *MockTokenExchangeTokensVerifierStorage) VerifyExchangeActorToken(arg0 context.Context, arg1 string, arg2 oidc.TokenType) (string, string, map[string]interface{}, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "VerifyExchangeActorToken", arg0, arg1, arg2)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(string)
+	ret2, _ := ret[2].(map[string]interface{})
+	ret3, _ := ret[3].(error)
+	return ret0, ret1, ret2, ret3
+}
+
+// VerifyExchangeActorToken indicates an expected call of VerifyExchangeActorToken.
+func (mr *MockTokenExchangeTokensVerifierStorageMockRecorder) VerifyExchangeActorToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "VerifyExchangeActorToken", reflect.TypeOf((*MockTokenExchangeTokensVerifierStorage)(nil).VerifyExchangeActorToken), arg0, arg1, arg2)
+}
+
+// VerifyExchangeSubjectToken mocks base method.
+func (m *MockTokenExchangeTokensVerifierStorage) VerifyExchangeSubjectToken(arg0 context.Context, arg1 string, arg2 oidc.TokenType) (string, string, map[string]interface{}, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "VerifyExchangeSubjectToken", arg0, arg1, arg2)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(string)
+	ret2, _ := ret[2].(map[string]interface{})
+	ret3, _ := ret[3].(error)
+	return ret0, ret1, ret2, ret3
+}
+
+// VerifyExchangeSubjectToken indicates an expected call of VerifyExchangeSubjectToken.
+func (mr *MockTokenExchangeTokensVerifierStorageMockRecorder) VerifyExchangeSubjectToken(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "VerifyExchangeSubjectToken", reflect.TypeOf((*MockTokenExchangeTokensVerifierStorage)(nil).VerifyExchangeSubjectToken), arg0, arg1, arg2)
+}
--- a/pkg/op/token_exchange.go
+++ b/pkg/op/token_exchange.go
@ -310,7 +310,9 @@ func GetTokenIDAndSubjectFromToken(
 		if !ok {
 			break
 		}
-		claims = accessTokenClaims.Claims
+		if accessTokenClaims != nil {
+			claims = accessTokenClaims.Claims
+		}
 	case oidc.RefreshTokenType:
 		refreshTokenRequest, err := exchanger.Storage().TokenRequestByRefreshToken(ctx, token)
 		if err != nil {
@ -323,8 +325,11 @@ func GetTokenIDAndSubjectFromToken(
 		if err != nil {
 			break
 		}
-
-		tokenIDOrToken, subject, claims, ok = token, idTokenClaims.Subject, idTokenClaims.Claims, true
+		if idTokenClaims != nil {
+			claims = idTokenClaims.Claims
+			subject = idTokenClaims.Subject
+		}
+		tokenIDOrToken, ok = token, true
 	}

 	if !ok {
--- a/pkg/op/token_exchange_test.go
+++ b/pkg/op/token_exchange_test.go
@ -0,0 +1,276 @@
+package op_test
+
+import (
+	"context"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
+	"github.com/zitadel/oidc/v3/pkg/op"
+	"github.com/zitadel/oidc/v3/pkg/op/mock"
+)
+
+func TestGetTokenIDAndSubjectFromToken(t *testing.T) {
+	tests := []struct {
+		name string
+
+		// args
+		ctx       context.Context
+		token     string
+		tokenType oidc.TokenType
+		isActor   bool
+		exchanger op.Exchanger
+
+		wantReturn []interface{}
+	}{
+		{
+			name: "empty strings, nil and false if fails verify token actor",
+			ctx:  context.Background(),
+			token: func() string {
+				tkn, err := op.NewAESCrypto([32]byte{0x01}).Encrypt("test:test:test")
+				require.NoError(t, err)
+				return tkn
+			}(),
+			tokenType: oidc.TokenType("unsupported_token_type"),
+			isActor:   true,
+			exchanger: func() op.Exchanger {
+				type mStorage struct {
+					op.Storage
+					op.TokenExchangeTokensVerifierStorage
+				}
+
+				verifier := mock.NewMockTokenExchangeTokensVerifierStorage(gomock.NewController(t))
+				verifier.
+					EXPECT().
+					VerifyExchangeActorToken(gomock.Any(), gomock.Any(), oidc.TokenType("unsupported_token_type")).
+					Return("", "", nil, errors.New("actor verify error"))
+				ms := mStorage{TokenExchangeTokensVerifierStorage: verifier}
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().Storage().Return(ms)
+
+				return ex
+			}(),
+			wantReturn: []interface{}{"", "", map[string]interface{}(nil), false},
+		},
+		{
+			name: "empty strings, nil and false if fails verify token exchange subject",
+			ctx:  context.Background(),
+			token: func() string {
+				tkn, err := op.NewAESCrypto([32]byte{0x01}).Encrypt("test:test:test")
+				require.NoError(t, err)
+				return tkn
+			}(),
+			tokenType: oidc.TokenType("unsupported_token_type"),
+			isActor:   false,
+			exchanger: func() op.Exchanger {
+				type mStorage struct {
+					op.Storage
+					op.TokenExchangeTokensVerifierStorage
+				}
+
+				verifier := mock.NewMockTokenExchangeTokensVerifierStorage(gomock.NewController(t))
+				verifier.
+					EXPECT().
+					VerifyExchangeSubjectToken(gomock.Any(), gomock.Any(), oidc.TokenType("unsupported_token_type")).
+					Return("", "", nil, errors.New("actor verify error"))
+				ms := mStorage{TokenExchangeTokensVerifierStorage: verifier}
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().Storage().Return(ms)
+
+				return ex
+			}(),
+			wantReturn: []interface{}{"", "", map[string]interface{}(nil), false},
+		},
+		{
+			name: "empty strings, nil and false if exchanger storage is not TokenExchangeTokenVerifierStorage",
+			ctx:  context.Background(),
+			token: func() string {
+				tkn, err := op.NewAESCrypto([32]byte{0x01}).Encrypt("test:test:test")
+				require.NoError(t, err)
+				return tkn
+			}(),
+			tokenType: oidc.TokenType("unsupported_token_type"),
+			isActor:   false,
+			exchanger: func() op.Exchanger {
+				type mStorage struct {
+					op.Storage
+				}
+
+				ms := mStorage{}
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().Storage().Return(ms)
+
+				return ex
+			}(),
+			wantReturn: []interface{}{"", "", map[string]interface{}(nil), false},
+		},
+		{
+			name: "tokenId subject nil claims and true if success decrypt AccessTokenType",
+			ctx:  context.Background(),
+			token: func() string {
+				tkn, err := op.NewAESCrypto([32]byte{0x01}).Encrypt("test:test")
+				require.NoError(t, err)
+				return tkn
+			}(),
+			tokenType: oidc.AccessTokenType,
+			isActor:   true,
+			exchanger: func() op.Exchanger {
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().Crypto().Return(op.NewAESCrypto([32]byte{0x001}))
+				return ex
+			}(),
+			wantReturn: []interface{}{"test", "test", map[string]interface{}(nil), true},
+		},
+		{
+			name: "tokenId subject claims and true if success verify AccessTokenType claims",
+			ctx:  context.Background(),
+			// jwt.io sample token for RS256 with some extra claims
+			token:     "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImFiY2RlZiJ9.eyJqdGkiOiJ0ZXN0Iiwic3ViIjoiMTIzNDU2Nzg5MCIsIm5hbWUiOiJKb2huIERvZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3NDI4OTA4NjksImV4cCI6Mjc0Mjg5MDg2OSwiaXNzIjoiaXNzdWVyIn0.MpR3s7zrvwHUnis7Sc9C1-dZnDsXAsssJcdDWJY5cfhR7bXpwJs87GsUkdP-kVc1S3MDZg0Dl0ITLbAeu70Ix5E65o9wlUQM2QB2Nc3O16zWIWkHH9xhKf5mW-s1JRtNDqsy5hypl6S2l9zNSXSLhj96lMxyi4-4qfX2wsI8XN9sQk7oEgZt_Lcl-xiJtqZOKKyfA0zRqOCOPruaAIUJc5bo3dxmDRs9dILP1F7LYkarIH_DXDzOmqRT4UfHVdg7ZH2-yluXQvk24dFwtC2Vm9jut1Ecdihm4vBjvyokuPNw_5RC3nxlk14BPBcgsBNR9NVVo5SV6ATGI-9Uq2TR-Q",
+			tokenType: oidc.AccessTokenType,
+			isActor:   true,
+			exchanger: func() op.Exchanger {
+				c := mock.NewMockCrypto(gomock.NewController(t))
+				c.EXPECT().
+					Decrypt(gomock.Any()).
+					Return("", errors.New("decrypt_error"))
+
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().Crypto().Return(c)
+
+				mockKey := mock.NewMockKey(gomock.NewController(t))
+				mockKey.EXPECT().ID().Return("abcdef")
+				mockKey.EXPECT().Algorithm().Return(jose.RS256)
+				mockKey.EXPECT().Use().Return("sig")
+				mockKey.EXPECT().Key().Return(getPublicKey())
+
+				kStorage := mock.NewMockStorage(gomock.NewController(t))
+				kStorage.EXPECT().KeySet(gomock.Any()).Return([]op.Key{mockKey}, nil)
+				v := op.AccessTokenVerifier(oidc.Verifier{
+					Issuer:            "issuer",
+					SupportedSignAlgs: []string{string(jose.RS256)},
+					KeySet: &op.OpenIDKeySet{
+						Storage: kStorage,
+					},
+					Offset: 5000 * time.Minute,
+				})
+				ex.EXPECT().AccessTokenVerifier(gomock.Any()).Return(&v)
+				return ex
+			}(),
+			wantReturn: []interface{}{"test", "1234567890", map[string]interface{}{
+				"admin": true,
+				"exp":   float64(2742890869),
+				"iat":   float64(1742890869),
+				"iss":   "issuer",
+				"name":  "John Doe",
+				"jti":   "test",
+				"sub":   "1234567890",
+			}, true},
+		},
+		{
+			name: "token subject and nil claims if success handling refresh token type",
+			ctx:  context.Background(),
+			// jwt.io sample token for RS256 with some extra claims
+			token:     "test",
+			tokenType: oidc.RefreshTokenType,
+			isActor:   true,
+			exchanger: func() op.Exchanger {
+				rt := mock.NewMockRefreshTokenRequest(gomock.NewController(t))
+				rt.EXPECT().GetSubject().Return("1234567890")
+				st := mock.NewMockStorage(gomock.NewController(t))
+				st.EXPECT().
+					TokenRequestByRefreshToken(gomock.Any(), "test").
+					Return(rt, nil)
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().Storage().Return(st)
+				return ex
+			}(),
+			wantReturn: []interface{}{"test", "1234567890", map[string]interface{}(nil), true},
+		},
+		{
+			name: "token subject and tokenclaims if success handling id token type",
+			ctx:  context.Background(),
+			// jwt.io sample token for RS256 with some extra claims
+			token:     "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImFiY2RlZiJ9.eyJqdGkiOiJ0ZXN0Iiwic3ViIjoiMTIzNDU2Nzg5MCIsIm5hbWUiOiJKb2huIERvZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3NDI4OTA4NjksImV4cCI6Mjc0Mjg5MDg2OSwiaXNzIjoiaXNzdWVyIn0.MpR3s7zrvwHUnis7Sc9C1-dZnDsXAsssJcdDWJY5cfhR7bXpwJs87GsUkdP-kVc1S3MDZg0Dl0ITLbAeu70Ix5E65o9wlUQM2QB2Nc3O16zWIWkHH9xhKf5mW-s1JRtNDqsy5hypl6S2l9zNSXSLhj96lMxyi4-4qfX2wsI8XN9sQk7oEgZt_Lcl-xiJtqZOKKyfA0zRqOCOPruaAIUJc5bo3dxmDRs9dILP1F7LYkarIH_DXDzOmqRT4UfHVdg7ZH2-yluXQvk24dFwtC2Vm9jut1Ecdihm4vBjvyokuPNw_5RC3nxlk14BPBcgsBNR9NVVo5SV6ATGI-9Uq2TR-Q",
+			tokenType: oidc.IDTokenType,
+			isActor:   true,
+			exchanger: func() op.Exchanger {
+				mockKey := mock.NewMockKey(gomock.NewController(t))
+				mockKey.EXPECT().ID().Return("abcdef")
+				mockKey.EXPECT().Algorithm().Return(jose.RS256)
+				mockKey.EXPECT().Use().Return("sig")
+				mockKey.EXPECT().Key().Return(getPublicKey())
+
+				kStorage := mock.NewMockStorage(gomock.NewController(t))
+				kStorage.EXPECT().KeySet(gomock.Any()).Return([]op.Key{mockKey}, nil)
+				v := &op.IDTokenHintVerifier{
+					Issuer:            "issuer",
+					SupportedSignAlgs: []string{string(jose.RS256)},
+					KeySet: &op.OpenIDKeySet{
+						Storage: kStorage,
+					},
+					Offset: 5000 * time.Minute,
+				}
+				ex := mock.NewMockExchanger(gomock.NewController(t))
+				ex.EXPECT().IDTokenHintVerifier(gomock.Any()).Return(v)
+				return ex
+			}(),
+			wantReturn: []interface{}{
+				"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImFiY2RlZiJ9.eyJqdGkiOiJ0ZXN0Iiwic3ViIjoiMTIzNDU2Nzg5MCIsIm5hbWUiOiJKb2huIERvZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3NDI4OTA4NjksImV4cCI6Mjc0Mjg5MDg2OSwiaXNzIjoiaXNzdWVyIn0.MpR3s7zrvwHUnis7Sc9C1-dZnDsXAsssJcdDWJY5cfhR7bXpwJs87GsUkdP-kVc1S3MDZg0Dl0ITLbAeu70Ix5E65o9wlUQM2QB2Nc3O16zWIWkHH9xhKf5mW-s1JRtNDqsy5hypl6S2l9zNSXSLhj96lMxyi4-4qfX2wsI8XN9sQk7oEgZt_Lcl-xiJtqZOKKyfA0zRqOCOPruaAIUJc5bo3dxmDRs9dILP1F7LYkarIH_DXDzOmqRT4UfHVdg7ZH2-yluXQvk24dFwtC2Vm9jut1Ecdihm4vBjvyokuPNw_5RC3nxlk14BPBcgsBNR9NVVo5SV6ATGI-9Uq2TR-Q",
+				"1234567890",
+				map[string]interface{}{
+					"admin": true,
+					"exp":   float64(2742890869),
+					"iat":   float64(1742890869),
+					"iss":   "issuer",
+					"name":  "John Doe",
+					"jti":   "test",
+					"sub":   "1234567890",
+				},
+				true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tokenIdOrToken, subject, claims, ok := op.GetTokenIDAndSubjectFromToken(
+				tt.ctx,
+				tt.exchanger,
+				tt.token,
+				tt.tokenType,
+				tt.isActor,
+			)
+
+			assert.Equal(t, tt.wantReturn[0].(string), tokenIdOrToken)
+			assert.Equal(t, tt.wantReturn[1].(string), subject)
+			assert.Equal(t, tt.wantReturn[2], claims)
+			assert.Equal(t, tt.wantReturn[3].(bool), ok)
+		})
+	}
+}
+
+func getPublicKey() *rsa.PublicKey {
+	// jwt.io sample public key for RS256
+	spkiPem := `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
+4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
+qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh
+kd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ
+0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg
+cKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc
+mwIDAQAB
+-----END PUBLIC KEY-----`
+	spkiBlock, _ := pem.Decode([]byte(spkiPem))
+	var spkiKey *rsa.PublicKey
+	pubInterface, _ := x509.ParsePKIXPublicKey(spkiBlock.Bytes)
+	spkiKey = pubInterface.(*rsa.PublicKey)
+	return spkiKey
+}