feat(ap1): enforce resource audience

scripts/validate-realm.py

@@ -70,6 +70,18 @@ def validate(path: Path, runtime: bool) -> None:
         spa.get("attributes", {}).get("pkce.code.challenge.method") == "S256",
         "spa-public must enforce PKCE S256",
     )
+    audience_mappers = [
+        mapper
+        for mapper in spa.get("protocolMappers", [])
+        if mapper.get("protocolMapper") == "oidc-audience-mapper"
+    ]
+    if not runtime:
+        require(len(audience_mappers) == 1, "spa-public must declare one audience mapper")
+        require(
+            audience_mappers[0].get("config", {}).get("included.custom.audience")
+            == "keycloak-pattern-api",
+            "spa-public access token must target keycloak-pattern-api",
+        )
 
     for client_id, placeholder in CONFIDENTIAL_CLIENTS.items():
         client = clients[client_id]