mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
3509e29cd7
Mutation-testing the audience guard found it unheld: removing the "no audience configured" refusal changed no test, because golang-jwt happens to refuse everything when the expected audience is the empty string (expectedAud becomes [""], which no token's aud contains). The guard was right and the test was weak — and it was resting on library behaviour nobody had written down, so a future release that read an empty expectation as "no check" would have turned every unpinned deployment into one that accepts any token, silently. The property is now stated where it is independent of the library: an instance with no audience configured refuses BEFORE resolving a keyset, so it costs no issuer round trip per request either. Breaking the guard now fails the test. Co-authored-by: Hanzo Dev <[email protected]>