feat(ap1): enforce resource audience

scripts/validate-realm.py

@@ -70,6 +70,18 @@ def validate(path: Path, runtime: bool) -> None:
         spa.get("attributes", {}).get("pkce.code.challenge.method") == "S256",
         "spa-public must enforce PKCE S256",
     )
+    audience_mappers = [
+        mapper
+        for mapper in spa.get("protocolMappers", [])
+        if mapper.get("protocolMapper") == "oidc-audience-mapper"
+    ]
+    if not runtime:
+        require(len(audience_mappers) == 1, "spa-public must declare one audience mapper")
+        require(
+            audience_mappers[0].get("config", {}).get("included.custom.audience")
+            == "keycloak-pattern-api",
+            "spa-public access token must target keycloak-pattern-api",
+        )
 
     for client_id, placeholder in CONFIDENTIAL_CLIENTS.items():
         client = clients[client_id]

scripts/verify-pattern1.sh

@@ -12,10 +12,12 @@ set +a
 
 docker compose down --volumes --remove-orphans
 docker compose up --build -d --wait
+docker compose --profile diagnostics up -d --wait app-wrong-audience
 
 npm --prefix e2e ci
 E2E_USERNAME=regular-user \
 E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
+WRONG_AUDIENCE_URL=http://localhost:18081/api/me \
   npm --prefix e2e run test:pattern1
 
 echo "AP1 verified end to end"