Correctly construct aud for scope verification

(different from aud for jwt)

Author: futurGH

pegasus/lib/xrpc.ml

@@ -209,10 +209,11 @@ let service_proxy ?lxm ?aud (ctx : context) =
     | None ->
         Errors.invalid_request "invalid proxy header"
   in
-  let aud = Option.value aud ~default:(service_did ^ "#" ^ service_type) in
-  let lxm = Option.value lxm ~default:nsid in
-  Auth.assert_rpc_scope ctx.auth ~aud ~lxm ;
   let fragment = "#" ^ service_type in
+  let aud = Option.value aud ~default:service_did in
+  let lxm = Option.value lxm ~default:nsid in
+  let rpc_aud = aud ^ fragment in
+  Auth.assert_rpc_scope ctx.auth ~aud:rpc_aud ~lxm ;
   match%lwt Id_resolver.Did.resolve service_did with
   | Ok did_doc -> (
       let scheme, host =