clear-skies 1.19.22__tar.gz → 1.19.23__tar.gz

{clear_skies-1.19.22 → clear_skies-1.19.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: clear-skies
-Version: 1.19.22
+Version: 1.19.23
 Summary: A framework for building backends in the cloud
 Home-page: https://github.com/cmancone/clearskies
 License: MIT

{clear_skies-1.19.22 → clear_skies-1.19.23}/pyproject.toml

@@ -2,7 +2,7 @@
 
 [tool.poetry]
 name = "clear-skies"
-version = "1.19.22"
+version = "1.19.23"
 description = "A framework for building backends in the cloud"
 authors = [
     "Conor Mancone <cmancone@gmail.com>",

{clear_skies-1.19.22 → clear_skies-1.19.23}/src/clearskies/authentication/jwks_jwcrypto.py

@@ -30,10 +30,22 @@ class JWKSJwCrypto(JWKS):
         except JWException as e:
             raise ClientError(str(e))
 
-        if self._audience and self.jwt_claims.get("aud") != self._audience:
-            raise ClientError("Audience does not match")
-
         if self._issuer and self.jwt_claims.get("iss") != self._issuer:
             raise ClientError("Issuer does not match")
 
+        if self._audience:
+            jwt_audience = self.jwt_claims.get("aud")
+            if not jwt_audience:
+                raise ClientError("Audience does not match")
+            if isinstance(jwt_audience, str):
+                jwt_audience = [jwt_audience]
+            if not isinstance(jwt_audience, list):
+                raise ClientError("I don't understand the audience in that JWT")
+            has_match = False
+            for audience in jwt_audience:
+                if audience == self._audience:
+                    has_match = True
+            if not has_match:
+                raise ClientError("Audience does not match")
+
         return True