identity: validate every audience in multi-audience tokens

VerifyJWT only inspected aud[0] when the claim was an array, and since
verification runs with SkipClientIDCheck this manual check is the only
audience gate: a token with aud ["other-api", "sam-mesh-audience"]
was rejected even though it names an allowed audience. Accept a token
when any of its audiences is allowed, and report all of them when none
is.

Author: aojea

internal/identity/oidc.go

@@ -44,31 +44,36 @@ func VerifyJWT(ctx context.Context, jwtStr string, allowedAudiences []string, pr
 	}
 	iss, _ := claims["iss"].(string)
 
-	// 2. Extract the audience
-	var aud string
+	// 2. Extract all audiences; the aud claim may be a string or an array.
+	var auds []string
 	switch a := claims["aud"].(type) {
 	case string:
-		aud = a
+		auds = []string{a}
 	case []any:
-		if len(a) > 0 {
-			aud, _ = a[0].(string)
+		for _, v := range a {
+			if s, ok := v.(string); ok {
+				auds = append(auds, s)
+			}
 		}
 	}
 
-	if aud == "" {
+	if len(auds) == 0 {
 		return nil, nil, fmt.Errorf("missing aud claim")
 	}
 
-	// 3. Verify the audience matches one of your expected tenants/platforms
+	// 3. Accept if any audience matches an allowed one: a multi-audience token
+	// only needs to be intended for us, whatever else it names.
 	validAudience := false
-	for _, allowed := range allowedAudiences {
-		if aud == allowed {
-			validAudience = true
-			break
+	for _, aud := range auds {
+		for _, allowed := range allowedAudiences {
+			if aud == allowed {
+				validAudience = true
+				break
+			}
 		}
 	}
 	if !validAudience {
-		return nil, nil, fmt.Errorf("untrusted audience: %s", aud)
+		return nil, nil, fmt.Errorf("untrusted audience(s): %s", strings.Join(auds, ", "))
 	}
 
 	// 4. Route to the correct provider

internal/identity/oidc_test.go

@@ -157,6 +157,39 @@ func TestVerifyJWT(t *testing.T) {
 		}
 	})
 
+	t.Run("allowed audience in any array position succeeds", func(t *testing.T) {
+		claims := validClaims()
+		claims["aud"] = []string{"some-other-audience", "sam-mesh-audience"}
+		tokenStr := signToken(t, key, testKID, claims)
+
+		_, _, err := VerifyJWT(ctx, tokenStr, allowedAudiences, providers)
+		if err != nil {
+			t.Fatalf("expected success for multi-audience token, got: %v", err)
+		}
+	})
+
+	t.Run("audience array with no allowed entry is rejected", func(t *testing.T) {
+		claims := validClaims()
+		claims["aud"] = []string{"some-other-audience", "yet-another-audience"}
+		tokenStr := signToken(t, key, testKID, claims)
+
+		_, _, err := VerifyJWT(ctx, tokenStr, allowedAudiences, providers)
+		if err == nil {
+			t.Fatal("expected error for audience array with no allowed entry")
+		}
+	})
+
+	t.Run("empty audience array is rejected", func(t *testing.T) {
+		claims := validClaims()
+		claims["aud"] = []string{}
+		tokenStr := signToken(t, key, testKID, claims)
+
+		_, _, err := VerifyJWT(ctx, tokenStr, allowedAudiences, providers)
+		if err == nil {
+			t.Fatal("expected error for empty audience array")
+		}
+	})
+
 	t.Run("unknown issuer is rejected", func(t *testing.T) {
 		claims := validClaims()
 		claims["iss"] = "https://unknown-issuer.example"