Add bounded resource audiences and enforce browser scope grants

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

src/internal/server/oidc/token.go

@@ -93,6 +93,14 @@ func (h *TokenHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Recheck grants in case the client registration changed after authorization.
+	for _, scope := range sess.Scopes {
+		if !containsString(h.ClientConfig[clientID].AllowedScopes, scope) {
+			profileerrors.InvalidProfileUsage("requested scope is not allowed", "scope").Write(w, http.StatusBadRequest)
+			return
+		}
+	}
+
 	// 4. Verify PKCE code_verifier.
 	if !verifyPKCE(codeVerifier, sess.PKCEChallenge) {
 		profileerrors.InvalidProfileUsage(
@@ -169,12 +177,24 @@ func (h *TokenHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Access tokens target the statically registered resource server. ID tokens
+	// remain bound to the OIDC relying party.
+	if audience := h.ClientConfig[clientID].Audience; audience != "" {
+		claims["aud"] = audience
+	}
+	claims["scope"] = strings.Join(sess.Scopes, " ")
+	accessToken, err := buildJWT(claims, kid, h.SigningKey)
+	if err != nil {
+		http.Error(w, "failed to build JWT", http.StatusInternalServerError)
+		return
+	}
+
 	// 8. Delete used PKCE session (prevent replay).
 	h.Sessions.Delete(code)
 
 	// 9. Build response.
 	resp := tokenResponse{
-		AccessToken: jwtToken,
+		AccessToken: accessToken,
 		TokenType:   "Bearer",
 		ExpiresIn:   int(h.TokenLifetime.Seconds()),
 		IDToken:     jwtToken,
@@ -239,7 +259,7 @@ func (h *TokenHandler) serveClientCredentials(w http.ResponseWriter, r *http.Req
 	claims := map[string]interface{}{
 		"iss":            h.Issuer,
 		"sub":            client.ServiceSubject,
-		"aud":            clientID,
+		"aud":            accessAudience(client),
 		"exp":            now.Add(tokenLifetime).Unix(),
 		"iat":            now.Unix(),
 		"tenant":         client.Tenant,
@@ -393,3 +413,11 @@ func buildJWT(claims map[string]interface{}, kid string, key *rsa.PrivateKey) (s
 
 	return strings.Join([]string{hdrB64, payloadB64, sigB64}, "."), nil
 }
+
+// accessAudience is configured by the issuer, never selected by request input.
+func accessAudience(client *domain.Client) string {
+	if client.Audience != "" {
+		return client.Audience
+	}
+	return client.ClientID
+}