feat(jwt): support multiple audience verification (#748)

shorebirdtech · Jun 30, 2023 · dd77c00 · dd77c00
1 parent 2ddfcac
commit dd77c00
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 9 deletions.
diff --git a/packages/jwt/example/main.dart b/packages/jwt/example/main.dart
@@ -5,7 +5,7 @@ Future<void> main() async {
   final token = await jwt.verify(
     '<TOKEN>',
     issuer: '<ISSUER>',
-    audience: '<AUDIENCE>',
+    audience: {'<AUDIENCE>'},
     publicKeysUrl: '<PUBLIC_KEYS_URL>',
   );
   print(token);

diff --git a/packages/jwt/lib/src/jwt.dart b/packages/jwt/lib/src/jwt.dart
@@ -71,7 +71,7 @@ class JwtVerificationFailure implements Exception {
 Future<Jwt> verify(
   String jwt, {
   required String issuer,
-  required String audience,
+  required Set<String> audience,
   required String publicKeysUrl,
 }) async {
   final parts = jwt.split('.');
@@ -136,7 +136,7 @@ Future<void> _verifyHeader(
   }
 }
 
-void _verifyPayload(JwtPayload payload, String issuer, String audience) {
+void _verifyPayload(JwtPayload payload, String issuer, Set<String> audience) {
   final now = clock.now();
 
   final exp = DateTime.fromMillisecondsSinceEpoch(payload.exp * 1000);
@@ -158,7 +158,7 @@ void _verifyPayload(JwtPayload payload, String issuer, String audience) {
     }
   }
 
-  if (payload.aud != audience) {
+  if (!audience.contains(payload.aud)) {
     throw const JwtVerificationFailure('Invalid audience.');
   }
 

diff --git a/packages/jwt/test/src/jwt_test.dart b/packages/jwt/test/src/jwt_test.dart
@@ -40,7 +40,7 @@ void main() {
       try {
         await verify(
           token,
-          audience: audience,
+          audience: {audience},
           issuer: issuer,
           publicKeysUrl: publicKeysUrl,
         );
@@ -69,7 +69,7 @@ void main() {
         try {
           await verify(
             token,
-            audience: 'invalid-audience',
+            audience: {'invalid-audience'},
             issuer: issuer,
             publicKeysUrl: publicKeysUrl,
           );
@@ -99,7 +99,7 @@ void main() {
         try {
           await verify(
             token,
-            audience: audience,
+            audience: {audience},
             issuer: 'https://invalid/issuer',
             publicKeysUrl: publicKeysUrl,
           );
@@ -128,7 +128,26 @@ void main() {
         };
         final jwt = await verify(
           token,
-          audience: audience,
+          audience: {audience},
+          issuer: issuer,
+          publicKeysUrl: publicKeysUrl,
+        );
+        expect(jwt, isA<Jwt>());
+      });
+    });
+
+    test('can verify a valid jwt (multiple audiences)', () async {
+      await withClock(Clock.fixed(validTime), () async {
+        getOverride = (Uri uri) async {
+          return Response(
+            body,
+            HttpStatus.ok,
+            headers: {'cache-control': 'max-age=3600'},
+          );
+        };
+        final jwt = await verify(
+          token,
+          audience: {'other-audience', audience},
           issuer: issuer,
           publicKeysUrl: publicKeysUrl,
         );
@@ -147,7 +166,7 @@ void main() {
         };
         final jwt = await verify(
           tokenNoAuthTime,
-          audience: audience,
+          audience: {audience},
           issuer: issuer,
           publicKeysUrl: publicKeysUrl,
         );