From e3d4fe42e8eece1025aee4e1cf053a06d0d0b04a Mon Sep 17 00:00:00 2001
From: DDINGJOO <173995233+DDINGJOO@users.noreply.github.com>
Date: Thu, 15 Oct 2026 07:39:31 +0900
Subject: [PATCH] Fix AccessTokenContext raw token id null check

AccessTokenContext checks grantType twice, so a null rawTokenId argument
bypasses the intended validation. Replace the second check with rawTokenId
and add tests covering all four constructor arguments.

Closes #54051

Signed-off-by: DDINGJOO <173995233+DDINGJOO@users.noreply.github.com>
---
 .../oidc/encode/AccessTokenContext.java       |  2 +-
 .../oidc/encode/AccessTokenContextTest.java   | 54 +++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 services/src/test/java/org/keycloak/protocol/oidc/encode/AccessTokenContextTest.java

diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java
index 5b0d9a4f384c..b48e475308ea 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java
@@ -111,7 +111,7 @@ public AccessTokenContext(@JsonProperty("sessionType") SessionType sessionType,
         Objects.requireNonNull(sessionType, "Null sessionType not allowed");
         Objects.requireNonNull(tokenType, "Null tokenType not allowed");
         Objects.requireNonNull(grantType, "Null grantType not allowed");
-        Objects.requireNonNull(grantType, "Null rawTokenId not allowed");
+        Objects.requireNonNull(rawTokenId, "Null rawTokenId not allowed");
         this.sessionType = sessionType;
         this.tokenType = tokenType;
         this.grantType = grantType;
diff --git a/services/src/test/java/org/keycloak/protocol/oidc/encode/AccessTokenContextTest.java b/services/src/test/java/org/keycloak/protocol/oidc/encode/AccessTokenContextTest.java
new file mode 100644
index 000000000000..0e57007197c8
--- /dev/null
+++ b/services/src/test/java/org/keycloak/protocol/oidc/encode/AccessTokenContextTest.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import org.keycloak.OAuth2Constants;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class AccessTokenContextTest {
+
+    @Test
+    public void shouldRejectNullSessionType() {
+        Assert.assertThrows(NullPointerException.class, () -> new AccessTokenContext(null,
+                AccessTokenContext.TokenType.REGULAR, OAuth2Constants.AUTHORIZATION_CODE, "1234"));
+    }
+
+    @Test
+    public void shouldRejectNullTokenType() {
+        Assert.assertThrows(NullPointerException.class, () -> new AccessTokenContext(
+                AccessTokenContext.SessionType.ONLINE, null, OAuth2Constants.AUTHORIZATION_CODE, "1234"));
+    }
+
+    @Test
+    public void shouldRejectNullGrantType() {
+        Assert.assertThrows(NullPointerException.class, () -> new AccessTokenContext(
+                AccessTokenContext.SessionType.ONLINE, AccessTokenContext.TokenType.REGULAR, null, "1234"));
+    }
+
+    @Test
+    public void shouldRejectNullRawTokenId() {
+        Assert.assertThrows(NullPointerException.class, () -> new AccessTokenContext(
+                AccessTokenContext.SessionType.ONLINE, AccessTokenContext.TokenType.REGULAR,
+                OAuth2Constants.AUTHORIZATION_CODE, null));
+    }
+
+}