added JWT issuers for audience auth for service interop and shared us…

[thestumonkey]

This is to enable sharing of user tokens across different plaforms

Summary by CodeRabbit

• New Features

  • Configurable support for multiple JWT token issuers, enabling validation against more than one issuer (defaults preserved).
  • Enhanced JWT audience validation to accept issuer-specific audiences.

• Documentation

  • .env template updated with commented guidance and an example for the new issuer configuration.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[AnkushMalaker]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds multi-issuer JWT validation: a new environment variable ACCEPTED_TOKEN_ISSUERS (comma-separated, defaults to "chronicle,ushadow") is parsed into ACCEPTED_ISSUERS and incorporated into JWT strategy token_audience; startup logging reports the accepted issuers.

Changes

Cohort / File(s)	Summary
Environment configuration \.env\.template	Adds commented documentation for ACCEPTED_TOKEN_ISSUERS (comma-separated list), describes default behavior and provides an example; no runtime changes.
JWT authentication logic backends/advanced/src/advanced_omi_backend/auth.py	Introduces ACCEPTED_TOKEN_ISSUERS env parsing into ACCEPTED_ISSUERS (list[str]); extends JWT strategy token_audience to include these issuers; adds startup logging of accepted issuers.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I nibbled configs in the night,

Accepting issuers just right,
Chronicle, Ushadow — side by side,
Tokens hop through, verified,
A carrot-coded auth delight.

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding JWT issuers for audience authentication to enable service interoperability and token sharing across platforms.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bafcdea and cfb9ceb.

📒 Files selected for processing (1)

• .env.template

✅ Files skipped from review due to trivial changes (1)

• .env.template

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Fix all issues with AI Agents 🤖

In @.env.template:
- Around line 58-60: Update the .env.template to match the actual default used
in code and fix the misleading terminology: change the comment for
ACCEPTED_ISSUERS to reflect the real default value "chronicle,ushadow" (or
rename the variable to ACCEPTED_AUDIENCES if you prefer) and explicitly state
this value is used for JWT audience validation (token_audience) rather than
issuer validation; ensure the comment references the token_audience
configuration/variable used in
backends/advanced/src/advanced_omi_backend/auth.py so docs and implementation
are aligned.

🧹 Nitpick comments (1)

backends/advanced/src/advanced_omi_backend/auth.py (1)

111-112: Optional: Use unpacking syntax for cleaner list concatenation.

The static analysis tool suggests using unpacking syntax instead of list concatenation for improved readability.

🔎 Proposed refactor

 def get_jwt_strategy() -> JWTStrategy:
     """Get JWT strategy for token generation and validation."""
     return JWTStrategy(
         secret=SECRET_KEY, lifetime_seconds=JWT_LIFETIME_SECONDS,
-        token_audience=["fastapi-users:auth"] + ACCEPTED_ISSUERS
+        token_audience=["fastapi-users:auth", *ACCEPTED_ISSUERS]
     )

Based on static analysis hint RUF005.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1036a17 and bafcdea.

📒 Files selected for processing (2)

• .env.template
• backends/advanced/src/advanced_omi_backend/auth.py

🧰 Additional context used

🪛 Ruff (0.14.10)

backends/advanced/src/advanced_omi_backend/auth.py

112-112: Consider ["fastapi-users:auth", *ACCEPTED_ISSUERS] instead of concatenation

Replace with ["fastapi-users:auth", *ACCEPTED_ISSUERS]

(RUF005)

🔇 Additional comments (1)

backends/advanced/src/advanced_omi_backend/auth.py (1)

116-145: The current implementation correctly supports cross-platform token sharing—no changes needed.

The JWT strategy already accepts tokens from multiple issuers (ACCEPTED_ISSUERS = ["chronicle", "ushadow"] by default) with appropriate audiences configured in token_audience = ["fastapi-users:auth"] + ACCEPTED_ISSUERS.

The generate_jwt_for_user() function is correctly designed to generate Chronicle-issued tokens (iss: "chronicle", aud: "chronicle"). If other platforms like ushadow need to generate tokens accepted by Chronicle, they can issue tokens with aud: "ushadow" (which is already in the accepted audiences list). The separate configuration of ACCEPTED_ISSUERS and token_audience already enables this cross-platform sharing pattern through the shared AUTH_SECRET_KEY.

Likely an incorrect or invalid review comment.

[AnkushMalaker]

LGTM