Feat: Added audience override if contains Project ID

[gaokevin1]

Related Issues

Fixes https://github.com/descope/etc/issues/12464

Related PRs

branch	PR
service a PR	Link to PR
service b PR	Link to PR

Description

A few sentences describing the overall goals of the pull request's commits.

Must

• Tests
• Documentation (if applicable)

[Copilot]

Pull Request Overview

This PR implements automatic audience detection for JWT validation when the token's audience claim matches the project ID. This allows tokens with project ID audiences to be validated without explicitly passing the audience parameter.

Key changes:

• Added logic to auto-detect and use project ID as audience when token contains matching audience claim
• Supports both single string and list audience formats in tokens
• Added comprehensive test coverage for the new auto-detection behavior

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
descope/auth.py	Added audience auto-detection logic in _validate_token method that decodes token without audience verification first, checks if audience matches project ID, and uses it for final validation
tests/test_auth.py	Added 6 new test cases covering auto-detection scenarios: string audience, list audience, no match, explicit audience override, validate_and_refresh_session, and mismatch failure

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[github-actions]

Coverage report

The coverage rate went from 98.2% to 98.21% ⬆️

100% of new lines are covered.

Diff Coverage details (click to unfold)

descope/auth.py

100% of new lines are covered (98.08% of the complete file).