feat(ap1): enforce resource audience

e2e/pattern1.mjs

@@ -38,6 +38,14 @@ try {
 
   const accessToken = await page.evaluate(() => window.__pattern1.getAccessToken());
   assert.ok(accessToken, "access token must exist in browser memory");
+  const payload = JSON.parse(
+    Buffer.from(accessToken.split(".")[1], "base64url").toString("utf8"),
+  );
+  const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+  assert.ok(
+    audiences.includes("keycloak-pattern-api"),
+    "access token must target keycloak-pattern-api",
+  );
 
   const storageSnapshot = await page.evaluate(() => ({
     localStorage: Object.values(localStorage),
@@ -55,6 +63,17 @@ try {
     return text.includes('"httpStatus": 200');
   });
 
+  if (process.env.WRONG_AUDIENCE_URL) {
+    const response = await fetch(process.env.WRONG_AUDIENCE_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    assert.equal(
+      response.status,
+      401,
+      "the same signed token must fail when the Resource Server expects another audience",
+    );
+  }
+
   await page.reload();
   await page.locator('[data-authenticated="false"]').waitFor();
   assert.equal(
@@ -64,7 +83,7 @@ try {
   );
 
   console.log(
-    "pattern1 browser verified: code+PKCE S256, protected API 200, Web Storage token 0, reload clears token",
+    "pattern1 browser verified: code+PKCE S256, audience positive 200/negative 401, Web Storage token 0, reload clears token",
   );
 } finally {
   await browser.close();