test: log issuer & audience

Author: SaboniAmine

carbonserver/carbonserver/api/services/auth_providers/oidc_auth_provider.py

@@ -30,6 +30,7 @@ def __init__(
         client_id: str,
         client_secret: str,
         *,
+        cli_client_id: Optional[str] = None,
         signature_cache_ttl: int = DEFAULT_SIGNATURE_CACHE_TTL,
         openid_configuration: Optional[Dict[str, Any]] = None,
     ):
@@ -40,12 +41,14 @@ def __init__(
             base_url: The OIDC issuer URL (base URL of the authentication server)
             client_id: The OAuth2 client ID
             client_secret: The OAuth2 client secret
+            cli_client_id: Optional CLI client ID (for validating tokens from CLI)
             signature_cache_ttl: Seconds to cache the OIDC discovery/JWKS responses
             openid_configuration: Optional pre-loaded OIDC configuration (used mainly for testing)
         """
         self.base_url = base_url.rstrip("/")
         self.client_id = client_id
         self.client_secret = client_secret
+        self.cli_client_id = cli_client_id
         self._discovery = discovery.configure(cache_ttl=signature_cache_ttl)
         self._openid_configuration = openid_configuration
 
@@ -64,20 +67,55 @@ async def _get_algorithms(self) -> List[str]:
         oidc_config = await self._get_openid_configuration()
         return await asyncio.to_thread(self._discovery.signing_algos, oidc_config)
 
+    def _get_valid_audiences(self) -> List[str]:
+        """Get list of valid audiences (client IDs) for token validation."""
+        audiences = [self.client_id]
+        if self.cli_client_id:
+            audiences.append(self.cli_client_id)
+        return audiences
+
     async def _decode_token(
         self, token: str, *, audience: Optional[str] = None
     ) -> Dict[str, Any]:
         oidc_config = await self._get_openid_configuration()
         jwks = await self._get_jwks()
         algorithms = await self._get_algorithms()
-        return jwt.decode(
-            token,
-            jwks,
-            algorithms=algorithms,
-            audience=audience or self.client_id,
-            issuer=oidc_config.get("issuer", self.base_url),
-            options={"verify_at_hash": False},
-        )
+        issuer = oidc_config.get("issuer", self.base_url)
+
+        if audience:
+            # Single audience specified, use it directly
+            return jwt.decode(
+                token,
+                jwks,
+                algorithms=algorithms,
+                audience=audience,
+                issuer=issuer,
+                options={"verify_at_hash": False},
+            )
+
+        # Try each valid audience until one succeeds
+        valid_audiences = self._get_valid_audiences()
+        last_error = None
+        for aud in valid_audiences:
+            try:
+                return jwt.decode(
+                    token,
+                    jwks,
+                    algorithms=algorithms,
+                    audience=aud,
+                    issuer=issuer,
+                    options={"verify_at_hash": False},
+                )
+            except jwt.JWTClaimsError as e:
+                # Audience mismatch, try next
+                last_error = e
+                continue
+            except Exception:
+                # Other errors (signature, expiration, etc.) should fail immediately
+                raise
+
+        # None of the audiences matched
+        raise last_error or jwt.JWTClaimsError("Invalid audience")
 
     async def get_auth_url(
         self, redirect_uri: str, scope: List[str], state: Optional[str] = None
@@ -165,8 +203,16 @@ async def validate_access_token(self, token: str) -> bool:
         Raises:
             Exception if validation fails
         """
-        await self._decode_token(token)
-        return True
+        try:
+            result = await self._decode_token(token)
+            print(f"Token validated: {result}")
+            return True
+        except Exception as e:
+            oidc_config = await self._get_openid_configuration()
+            print(f"Validation failed: {e}")
+            print(f"Expected issuer: {oidc_config.get('issuer', self.base_url)}")
+            print(f"Expected audiences: {self._get_valid_audiences()}")
+            raise
 
     async def get_user_info(self, access_token: str) -> Dict[str, Any]:
         """

carbonserver/carbonserver/config.py

@@ -14,6 +14,7 @@ class Settings(BaseSettings):
     # OIDC settings (with backward compatibility for Fief environment variables)
     oidc_client_id: str = ""
     oidc_client_secret: str = ""
+    oidc_cli_client_id: str = ""
     oidc_issuer_url: str = "https://auth.codecarbon.io/codecarbon-dev"
 
     # Deprecated: Old Fief-specific settings (use OIDC settings instead)
@@ -42,6 +43,7 @@ class Config:
         fields = {
             "oidc_client_id": {"env": ["OIDC_CLIENT_ID", "FIEF_CLIENT_ID"]},
             "oidc_client_secret": {"env": ["OIDC_CLIENT_SECRET", "FIEF_CLIENT_SECRET"]},
+            "oidc_cli_client_id": {"env": ["OIDC_CLI_CLIENT_ID", "FIEF_CLI_CLIENT_ID"]},
             "oidc_issuer_url": {"env": ["OIDC_ISSUER_URL", "FIEF_URL"]},
         }
 

carbonserver/carbonserver/container.py

@@ -52,6 +52,7 @@ class ServerContainer(containers.DeclarativeContainer):
                 base_url=settings.oidc_issuer_url,
                 client_id=settings.oidc_client_id,
                 client_secret=settings.oidc_client_secret,
+                cli_client_id=settings.oidc_cli_client_id,
             )
             if settings.auth_provider.lower() in ("oidc", "fief")
             else None