change: Set jwt-aud default value to \`\' (accepting only empty string)

Fixes #4134 (JWT with aud claim should be rejected if jwt-aud is not set)

Updated default jwt-aud value in Config module.
Updated spec tests.

Author: mkleczek

src/PostgREST/Config.hs

@@ -88,7 +88,7 @@ parseCfgAud = fmap CfgAud . (fmap . ParsedValue . Just <*> parseRegex)
     bounded = ("\\`(" <>) . (<> "\\')")
 
 defaultCfgAud :: CfgAud
-defaultCfgAud = CfgAud $ ParsedValue Nothing $ R.makeRegex (".*"::Text)
+defaultCfgAud = CfgAud $ ParsedValue Nothing $ R.makeRegex ("\\`\\'"::Text)
 
 audMatchesCfg :: AppConfig -> Text -> Bool
 audMatchesCfg = R.matchTest . parsedValue . unCfgAud . configJwtAudience

test/spec/Feature/Auth/AudienceJwtSecretSpec.hs

@@ -165,7 +165,7 @@ disabledSpec :: SpecWith ((), Application)
 disabledSpec = describe "test handling of aud claims in JWT when the jwt-aud config is not set" $ do
 
   context "when the audience claim is a string" $ do
-    it "ignores the audience claim and suceeds" $ do
+    it "fails when it is not empty" $ do
       let jwtPayload =
             [json|{
               "exp": 9999999999,
@@ -175,7 +175,7 @@ disabledSpec = describe "test handling of aud claims in JWT when the jwt-aud con
             }|]
           auth = authHeaderJWT $ generateJWT jwtPayload
       request methodGet "/authors_only" [auth] ""
-        `shouldRespondWith` 200
+        `shouldRespondWith` 401
 
     it "ignores the audience claim and suceeds when it's empty" $ do
       let jwtPayload =
@@ -205,7 +205,7 @@ disabledSpec = describe "test handling of aud claims in JWT when the jwt-aud con
 
 
   context "when the audience is an array of strings" $ do
-    it "ignores the audience claim and suceeds when it has 1 element" $ do
+    it "fails it has 1 element" $ do
       let jwtPayload = [json|
             {
               "exp": 9999999999,
@@ -215,9 +215,9 @@ disabledSpec = describe "test handling of aud claims in JWT when the jwt-aud con
             }|]
           auth = authHeaderJWT $ generateJWT jwtPayload
       request methodGet "/authors_only" [auth] ""
-        `shouldRespondWith` 200
+        `shouldRespondWith` 401
 
-    it "ignores the audience claim and suceeds when it has more than 1 element" $ do
+    it "fails when it has more than 1 element" $ do
       let jwtPayload = [json|
             {
               "exp": 9999999999,
@@ -227,7 +227,7 @@ disabledSpec = describe "test handling of aud claims in JWT when the jwt-aud con
             }|]
           auth = authHeaderJWT $ generateJWT jwtPayload
       request methodGet "/authors_only" [auth] ""
-        `shouldRespondWith` 200
+        `shouldRespondWith` 401
 
     it "ignores the audience claim and suceeds when it's empty" $ do
       let jwtPayload = [json|