feat(xaa): expose the read-only project-level audience on the XAA load response

[dorsha]

Related Issues

Required for:
https://github.com/descope/etc/issues/18013

Related PRs

Upstream PRs

• https://github.com/descope/backend/pull/2378

Related PRs

• https://github.com/descope/console-app/pull/5734
• https://github.com/descope/descope-apps/pull/864
• https://github.com/descope/content/pull/2273
• feat(xaa): expose the read-only project-level audience on the XAA load response go-sdk#839
• docs(xaa): document the read-only project-level audience on the XAA load response python-sdk#1677
• https://github.com/descope/integrationtests/pull/14790

In a Nutshell

• Read-only audience on the XAA load response

Description

Loading Cross-App Access settings now also returns the audience a requesting application has to present in its ID-JAG token, so callers read the same value the console shows instead of building it themselves. It has no tenant in it - the identity provider sends the tenant in the token's aud_tenant claim.

Must

• Tests
• Documentation (if applicable)

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

This PR exposes a read-only audience field on the XAA load response, requiring changes to both test files and type definitions. We have two strong candidates with directly relevant expertise: one contributor has recent work on the test file being modified (sso.test.ts), and another has expertise in the types file being updated (types.ts). Both reviewers should be assigned to ensure comprehensive coverage of the changes across both the testing and type definition aspects of this feature.

Reviewer	Reason
itaihanski	Recent contributor to lib/management/sso.test.ts - can verify the test coverage for the new audience field exposure is adequate and follows existing test patterns
talaharoni	Recent contributor to lib/management/types.ts - can validate that the new read-only audience type definition is correctly integrated and maintains type safety in the XAA load response structure

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni Review

Adds a read-only audience field to XAASettingsResponse, which passes through untouched via the existing transformXAASettingsResponse and is covered by a test asserting the round-trip value.

Actionable comments posted: 0

Merge risk: 🟢 Low: additive optional field on the load response, no transform logic changes, correctly excluded from the write-side XAASettings type, and covered by a test.

---

Review scope: Full review

Reviewed files (2)

• lib/management/sso.test.ts
• lib/management/types.ts