fix: jwt validation correctly compares the aud with both app id and auth origin

[ctran88]

What's New?

There was a bug where the validate_jwt method was not using the correct auth origin value when verifying the jwt audience.

The jwt would still pass verification if it was the new structure, since it also includes the app id in the audience array. But it would compare a nil auth origin to the jwt's real auth origin.

• c86e409 is what minimally fixes the issue
• d88248c removes the auth origin comparison all together so the audience is only checked against app id (compatible with new jwt structure)

To repro:
Change the expected audience to only check for @auth_origin and run the auth tests. they should error, stating

Passage::PassageError: Invalid audience. Expected [nil], received ["http://localhost:4173", "<app id>"]

where nil is supposed to be the value of @auth_origin

Screenshots (if appropriate):

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have manually tested my code thoroughly
• I have added/updated inline documentation for public facing interfaces if relevant
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing integration and unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Additional context

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud