[alukach]

Implements the proxy side of ADR-012 §1 (per-connection audience for direct federation). A connection's s3_web_identity_role authentication may now carry an audience. When it is absent or sts.amazonaws.com, nothing changes. When it is scv1:conn:{id}, the connection's own subject, the proxy passes it to multistore as the new oidc_audience backend option, so the connection's assertions carry that aud. A role owner who registers exactly that client ID on their IAM OIDC provider then has STS reject tokens minted for any other connection before the trust policy is evaluated.

Any other value fails closed with InvalidAudience before credentials are minted and with no backend options set. An audience naming another connection would satisfy the one check a role owner registers it for, so the proxy only honours the connection's own.

Rollout is safe in either order. A proxy without this change ignores the field (serde skips unknown fields) and keeps sending sts.amazonaws.com, so a connection that sets scv1:conn:{id} before this deploys fails at STS rather than succeeding under the shared audience. The source.coop side, which adds the field and lets a connection's manager switch it, is a separate PR.

Depends on

developmentseed/multistore#167, which adds oidc_audience and scopes the credential cache by audience, so ADR-006's cache-key invariant holds without relying on aud being derived from sub. Cargo.toml patches the multistore crates to that branch; this stays a draft until it is released and the patch is replaced with the version.

Testing

• cargo test (all suites) passes. New in tests/backend_auth.rs: deserializes_audience, default_audience_sets_no_audience_option (absent and sts.amazonaws.com), own_audience_is_passed_to_the_provider, and another_connections_audience_fails_closed (another connection's id, a suffixed subject, an arbitrary string; each errors with options left empty).
• cargo clippy and cargo check for wasm32-unknown-unknown pass against the patched multistore.
• Not yet run end to end: a connection with audience = scv1:conn:{id} against a role whose OIDC provider registers only that client ID. That needs the source.coop field and a staging deploy.

ADRs

ADR-012 §1 describes this decision and still holds; this implements its proxy half, so the ADR is left as is. ADR-006's requirement that aud stay a pure function of the cache key is met by multistore#167 keying on the audience directly.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 10s —— View job

---

I'll analyze this and get back to you.

---

💰 Estimated review cost: $0.09 · 0m10s · 3 turns

[github-actions]

🚀 Latest commit deployed to https://source-data-proxy-pr-267.source-coop.workers.dev

• Date: 2026-11-08T23:30:33Z
• Commit: db8f69c