Merged in feature/permit-policy-cleanup (pull request #210)

cleanup permit policies and correct documentation

* docs

* policy cleanup

* refactor

* Merge remote-tracking branch 'origin/feature/permit-policy-cleanup' into feature/permit-policy-cleanup

* docs and edits

internal/cognitoauth/cognitotest/readme.md

@@ -14,7 +14,7 @@ able to run on a scratch container.
 To run the tests just run `./test.sh` from this directory.
 Also the local permit.io pdp must also be running.  
 This can be started by running `demo.sh` in 
-`/cmd/cognito_test/permit_test/permit.harness`
+`/cmd/auth_related/permit_test/permit.harness`
 
 ##  Obtaining a reusable JWT token 
 If you observe the log output of running test.sh and look for 

internal/cognitoauth/token.go

@@ -266,9 +266,11 @@ func getCodeVerifier(state string, logger *slog.Logger) (string, error) {
 func ExtractUserInfo(claims map[string]interface{}) UserInfo {
 	userInfo := UserInfo{}
 
-	// Extract username
+	// Extract username. ID tokens use "cognito:username", access tokens use "username".
 	if username, ok := claims["cognito:username"].(string); ok {
 		userInfo.Username = username
+	} else if username, ok := claims["username"].(string); ok {
+		userInfo.Username = username
 	}
 
 	// Extract email

internal/cognitoauth/token_test.go

@@ -399,6 +399,32 @@ func TestExtractUserInfo(t *testing.T) {
 				Groups:   nil,
 			},
 		},
+		{
+			name: "access token claims with username instead of cognito:username",
+			claims: map[string]interface{}{
+				"sub":       "e12bb510-30e1-7062-a69a-ca7f3f38d80e",
+				"username":  "accesstokenuser",
+				"token_use": "access",
+			},
+			want: UserInfo{
+				Username: "accesstokenuser",
+				Email:    "",
+				Groups:   nil,
+			},
+		},
+		{
+			name: "cognito:username takes precedence over username",
+			claims: map[string]interface{}{
+				"cognito:username": "idtokenuser",
+				"username":         "accesstokenuser",
+				"email":            "user@example.com",
+			},
+			want: UserInfo{
+				Username: "idtokenuser",
+				Email:    "user@example.com",
+				Groups:   nil,
+			},
+		},
 	}
 
 	for _, tt := range tests {