Auth mobile : accepter aud ka-android (même secret partagé que ka-ios)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 changed file +2 −1
modified
src/api/routes/iosauth.py
+2 −1
@@ -21,6 +21,7 @@ router = APIRouter(prefix="/api/ios/auth", tags=["ios-auth"]) | |||||
| 21 | 21 | ||||
| 22 | HUB = os.environ.get("KA_HUB_URL", "https://www.groupe-ka.com").rstrip("/") | 22 | HUB = os.environ.get("KA_HUB_URL", "https://www.groupe-ka.com").rstrip("/") | ||
| 23 | CLIENT_ID = "ka-ios" | 23 | CLIENT_ID = "ka-ios" | ||
| 24 | +CLIENT_IDS = {"ka-ios", "ka-android"} | ||||
| 24 | 25 | ||||
| 25 | 26 | ||||
| 26 | def _secret() -> bytes: | 27 | def _secret() -> bytes: | ||
@@ -44,7 +45,7 @@ def _verify_jwt(token: str) -> dict[str, Any]: | |||||
| 44 | expected = hmac.new(_secret(), f"{h64}.{p64}".encode(), hashlib.sha256).digest() | 45 | expected = hmac.new(_secret(), f"{h64}.{p64}".encode(), hashlib.sha256).digest() | ||
| 45 | if not hmac.compare_digest(expected, _b64d(s64)): | 46 | if not hmac.compare_digest(expected, _b64d(s64)): | ||
| 46 | raise ValueError("signature") | 47 | raise ValueError("signature") | ||
| 47 | − if payload.get("aud") != CLIENT_ID: | 48 | + if payload.get("aud") not in CLIENT_IDS: | ||
| 48 | raise ValueError("aud") | 49 | raise ValueError("aud") | ||
| 49 | if payload.get("iss") != HUB: | 50 | if payload.get("iss") != HUB: | ||
| 50 | raise ValueError("iss") | 51 | raise ValueError("iss") | ||
| 51 | 52 | ||||