latch-asgi 1.0.4__tar.gz → 1.0.5__tar.gz

{latch_asgi-1.0.4 → latch_asgi-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: latch-asgi
-Version: 1.0.4
+Version: 1.0.5
 Summary: ASGI python server
 Author-Email: Max Smolin <max@latch.bio>
 License: CC0-1.0

{latch_asgi-1.0.4 → latch_asgi-1.0.5}/latch_asgi/auth.py

@@ -147,15 +147,15 @@ def get_signer_sub(auth_header: str) -> Authorization:
             # ) from e
 
     with app_tracer.start_as_current_span("decode jwt"):
+        audience = config.audience if jwt_key != config.self_signed_jwk else None
         try:
             jwt_data: dict[str, str] = jwt.decode(
                 oauth_token,
                 key=jwt_key,
                 algorithms=["RS256", "HS256"],
                 # fixme(maximsmol): gut this abomination
-                audience=(
-                    config.audience if jwt_key != config.self_signed_jwk else None
-                ),
+                audience=audience,
+                options={"verify_aud": audience is not None},
             )
         except jwt.exceptions.InvalidTokenError as e:
             # todo(maximsmol): filter out scope failures and include the correct error code

{latch_asgi-1.0.4 → latch_asgi-1.0.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "latch-asgi"
-version = "1.0.4"
+version = "1.0.5"
 description = "ASGI python server"
 authors = [
     { name = "Max Smolin", email = "max@latch.bio" },