From 29363d2c7e692ba9728ef0848943e70b1eb0a9b4 Mon Sep 17 00:00:00 2001 From: dorsha Date: Tue, 25 Aug 2026 22:26:29 +0300 Subject: [PATCH] feat(xaa): expose the read-only project-level audience on the XAA load response LoadXAASettings now returns the audience a requesting application must present in its ID-JAG token, so API and Terraform users read the same value the console and the SSO setup suite show instead of building it by hand. It is project-level and names no tenant - the IdP sends the tenant in the token's aud_tenant claim. Co-Authored-By: Claude Opus 5 (1M context) --- descope/internal/mgmt/sso_test.go | 3 +++ descope/types.go | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/descope/internal/mgmt/sso_test.go b/descope/internal/mgmt/sso_test.go index c7064cd9..2bb338e1 100644 --- a/descope/internal/mgmt/sso_test.go +++ b/descope/internal/mgmt/sso_test.go @@ -1569,6 +1569,7 @@ func TestLoadXAASettingsSuccess(t *testing.T) { "groupPriorityEnabled": true, "allowOverrideRoles": true, "providerID": "prov1", + "audience": "https://api.descope.com/v1/apps/P1", } mgmt := newTestMgmt(nil, helpers.DoOkWithBody(func(r *http.Request) { require.Equal(t, r.Header.Get("Authorization"), "Bearer a:key") @@ -1594,6 +1595,8 @@ func TestLoadXAASettingsSuccess(t *testing.T) { assert.True(t, res.GroupPriorityEnabled) assert.True(t, res.AllowOverrideRoles) assert.EqualValues(t, "prov1", res.ProviderID) + // Read-only, project-level: no tenant segment - the tenant travels in the aud_tenant claim. + assert.EqualValues(t, "https://api.descope.com/v1/apps/P1", res.Audience) } func TestLoadXAASettingsErrorMissingTenantID(t *testing.T) { diff --git a/descope/types.go b/descope/types.go index aae297f3..e24a2d46 100644 --- a/descope/types.go +++ b/descope/types.go @@ -1744,6 +1744,10 @@ type SSOXAASettingsResponse struct { GroupPriorityEnabled bool `json:"groupPriorityEnabled,omitempty"` AllowOverrideRoles bool `json:"allowOverrideRoles,omitempty"` ProviderID string `json:"providerID,omitempty"` // selected IdP provider template id (display metadata; mirrors SSOSAMLSettings providerID) + // Audience is read-only: the project-level audience a requesting application must present in its + // ID-JAG token. It carries no tenant segment - it equals the issuer the project publishes - so the + // identity provider must send the tenant id in the token's aud_tenant claim. + Audience string `json:"audience,omitempty"` } type SSOXAAAllSettingsResponse struct {