feat: use upstream setting for OIDC strict audience verification

Author: dervoeti

backend/application/access_control/services/oidc_authentication.py

@@ -62,10 +62,7 @@ def _validate_jwt(self, token: str) -> Optional[User]:
             options = Options(
                 verify_signature=True,
                 verify_aud=True,
-                # Stackable: audience verification is deliberately not strict, see f945bc9b.
-                # Upstream made this configurable via settings.oidc_strict_audience (default True),
-                # but flipping it on would break existing deployments, so it stays hardcoded.
-                strict_aud=False,
+                strict_aud=settings.oidc_strict_audience,
                 require=["exp"],
                 verify_iat=True,
                 verify_exp=True,

backend/unittests/access_control/services/test_oidc_authentication.py

@@ -128,7 +128,7 @@ def test_validate_jwt_message(self, get_signing_key_mock, pyjwkclient_mock, jwks
             options={
                 "verify_signature": True,
                 "verify_aud": True,
-                "strict_aud": False,
+                "strict_aud": True,
                 "require": ["exp"],
                 "verify_iat": True,
                 "verify_exp": True,
@@ -221,7 +221,7 @@ def test_validate_jwt_user_not_found(
             options={
                 "verify_signature": True,
                 "verify_aud": True,
-                "strict_aud": False,
+                "strict_aud": True,
                 "require": ["exp"],
                 "verify_iat": True,
                 "verify_exp": True,
@@ -275,7 +275,7 @@ def test_validate_jwt_user_found(
             options={
                 "verify_signature": True,
                 "verify_aud": True,
-                "strict_aud": False,
+                "strict_aud": True,
                 "require": ["exp"],
                 "verify_iat": True,
                 "verify_exp": True,