feat: support multiple aud for the external providers (#2117)

## What kind of change does this PR introduce?

Support multiple values in `aud` claim in the provider token. It can be
either string or array of string (complying with JWT [RFC
7519](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3))

Author: cemalkilic

internal/api/provider/oidc_test.go

@@ -5,6 +5,7 @@ import (
 	"crypto"
 	"crypto/rsa"
 	"encoding/base64"
+	"encoding/json"
 	"math/big"
 	"testing"
 	"time"
@@ -188,3 +189,127 @@ func TestAzureIDTokenClaimsIsEmailVerified(t *testing.T) {
 		}
 	}
 }
+
+func TestAudienceUnmarshalJSON(t *testing.T) {
+	tests := []struct {
+		name     string
+		json     string
+		expected audience
+		wantErr  bool
+	}{
+		{
+			name:     "string audience",
+			json:     `"client-id-123"`,
+			expected: audience{"client-id-123"},
+			wantErr:  false,
+		},
+		{
+			name:     "array audience with single element",
+			json:     `["client-id-123"]`,
+			expected: audience{"client-id-123"},
+			wantErr:  false,
+		},
+		{
+			name:     "array audience with multiple elements",
+			json:     `["client-id-123", "client-id-456", "client-id-789"]`,
+			expected: audience{"client-id-123", "client-id-456", "client-id-789"},
+			wantErr:  false,
+		},
+		{
+			name:     "empty array",
+			json:     `[]`,
+			expected: audience{},
+			wantErr:  false,
+		},
+		{
+			name:    "invalid JSON",
+			json:    `{invalid}`,
+			wantErr: true,
+		},
+		{
+			name:     "null value",
+			json:     `null`,
+			expected: audience{""},
+			wantErr:  false,
+		},
+		{
+			name:    "number value",
+			json:    `123`,
+			wantErr: true,
+		},
+		{
+			name:    "boolean value",
+			json:    `true`,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var aud audience
+			err := json.Unmarshal([]byte(tt.json), &aud)
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, aud)
+		})
+	}
+}
+
+func TestClaimsAudienceUnmarshal(t *testing.T) {
+	tests := []struct {
+		name     string
+		json     string
+		expected audience
+		wantErr  bool
+	}{
+		{
+			name: "claims with string audience",
+			json: `{
+				"iss": "https://example.com",
+				"sub": "user123",
+				"aud": "client-id-123"
+			}`,
+			expected: audience{"client-id-123"},
+			wantErr:  false,
+		},
+		{
+			name: "claims with array audience",
+			json: `{
+				"iss": "https://example.com", 
+				"sub": "user123",
+				"aud": ["client-id-123", "client-id-456"]
+			}`,
+			expected: audience{"client-id-123", "client-id-456"},
+			wantErr:  false,
+		},
+		{
+			name: "claims with missing audience",
+			json: `{
+				"iss": "https://example.com",
+				"sub": "user123"
+			}`,
+			expected: audience(nil),
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var claims Claims
+			err := json.Unmarshal([]byte(tt.json), &claims)
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, claims.Aud)
+		})
+	}
+}

internal/api/provider/provider.go

@@ -27,13 +27,29 @@ func init() {
 	}
 }
 
+type audience []string
+
+func (a *audience) UnmarshalJSON(b []byte) error {
+	var s string
+	if json.Unmarshal(b, &s) == nil {
+		*a = audience{s}
+		return nil
+	}
+	var auds []string
+	if err := json.Unmarshal(b, &auds); err != nil {
+		return err
+	}
+	*a = auds
+	return nil
+}
+
 type Claims struct {
 	// Reserved claims
-	Issuer  string  `json:"iss,omitempty" structs:"iss,omitempty"`
-	Subject string  `json:"sub,omitempty" structs:"sub,omitempty"`
-	Aud     string  `json:"aud,omitempty" structs:"aud,omitempty"`
-	Iat     float64 `json:"iat,omitempty" structs:"iat,omitempty"`
-	Exp     float64 `json:"exp,omitempty" structs:"exp,omitempty"`
+	Issuer  string   `json:"iss,omitempty" structs:"iss,omitempty"`
+	Subject string   `json:"sub,omitempty" structs:"sub,omitempty"`
+	Aud     audience `json:"aud,omitempty" structs:"aud,omitempty"`
+	Iat     float64  `json:"iat,omitempty" structs:"iat,omitempty"`
+	Exp     float64  `json:"exp,omitempty" structs:"exp,omitempty"`
 
 	// Default profile claims
 	Name              string `json:"name,omitempty" structs:"name,omitempty"`