fix: parse aud claim from []interface{} in JWTClaims.FromMap

[vincentluan]

Summary

JWTClaims.FromMap drops the aud claim when it is encoded as a JSON array, leaving JWTClaims.Audience empty.

Details

When a JWT is decoded into MapClaims (map[string]interface{}) — which is what DefaultSigner.Decode produces and what stateless JWT introspection (AccessTokenJWTToRequest → FromMapClaims → FromMap) feeds back in — a multi-value aud claim arrives as []interface{}, because JSON arrays never unmarshal to []string. The current case "aud" only handles string and []string:

case "aud":
    if s, ok := v.(string); ok {
        c.Audience = []string{s}
    } else if s, ok := v.([]string); ok {
        c.Audience = s
    }

So a token issued with aud: ["foo"] round-trips through introspection with an empty Audience (and, via AccessTokenJWTToRequest, an empty GrantedAudience/RequestedAudience). Any resource server that classifies or authorizes a token by reading the introspected session's audience silently sees no audience.

Note ToMap always emits aud as an array (ret["aud"] = c.Audience), so the array form is the common case on the wire — this isn't an edge case.

Fix

Handle []interface{} in the aud case, exactly as the neighbouring scp case already does:

case "aud":
    switch aud := v.(type) {
    case string:
        c.Audience = []string{aud}
    case []string:
        c.Audience = aud
    case []interface{}:
        c.Audience = make([]string, 0, len(aud))
        for _, a := range aud {
            if s, ok := a.(string); ok {
                c.Audience = append(c.Audience, s)
            }
        }
    }

Tests

Added TestClaimsFromMapAudienceInterfaceSlice (the []interface{} round-trip) and TestClaimsFromMapAudienceString (bare-string aud per RFC 7519) in token/jwt/claims_jwt_test.go. Existing tests still cover the []string path.

No behaviour change for string or []string inputs; this only recovers audiences that were previously dropped.

Summary by CodeRabbit

• Bug Fixes

  • Improved JWT audience claim handling when values are provided as multiple entries or a single string.
  • Non-string audience entries are safely ignored during conversion.

• Tests

  • Added coverage for single-value and multi-value audience claims.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 432cf606-d809-4638-a0e5-595d3fbc5db6

📥 Commits

Reviewing files that changed from the base of the PR and between a5f0b09 and 7d64c9c.

📒 Files selected for processing (2)

• token/jwt/claims_jwt.go
• token/jwt/claims_jwt_test.go

---

📝 Walkthrough

Walkthrough

JWTClaims.FromMap now normalizes aud claims from strings, []string, and []interface{} into []string. Tests cover single-string and multi-value interface-slice decoding.

Changes

JWT audience claim decoding

Layer / File(s)	Summary
Audience claim normalization and coverage token/jwt/claims_jwt.go, token/jwt/claims_jwt_test.go	JWTClaims.FromMap converts supported aud representations into []string, and tests verify string and []interface{} inputs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: aeneasr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main fix to JWTClaims.FromMap audience parsing.
Description check	✅ Passed	The description covers the bug, root cause, fix, and tests, which matches the template well enough.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}