fix(m2m): reject empty expected_aud on trusted issuer update

UpdateTrustedIssuer let a caller blank expected_aud even though
AddTrustedIssuer already rejects it empty. expected_aud backs the
audience-binding invariant the token endpoint will enforce later, so
the update path shouldn't be the hole that lets it go empty.

Author: lakhansamani

internal/integration_tests/trusted_issuer_test.go

@@ -94,6 +94,18 @@ func TestTrustedIssuerAdmin(t *testing.T) {
 		assert.Equal(t, saID, updated.ServiceAccountID)
 	})
 
+	t.Run("update rejects blanking expected_aud", func(t *testing.T) {
+		saID := createSA(t)
+		created, err := ts.GraphQLProvider.AddTrustedIssuer(ctx, newIssuerReq(saID))
+		require.NoError(t, err)
+
+		_, err = ts.GraphQLProvider.UpdateTrustedIssuer(ctx, &model.UpdateTrustedIssuerRequest{
+			ID:          created.ID,
+			ExpectedAud: refs.NewStringRef("  "),
+		})
+		require.Error(t, err)
+	})
+
 	t.Run("list filters by service_account_id", func(t *testing.T) {
 		saID := createSA(t)
 		_, err := ts.GraphQLProvider.AddTrustedIssuer(ctx, newIssuerReq(saID))

internal/service/admin_trusted_issuers.go

@@ -110,6 +110,10 @@ func (p *provider) UpdateTrustedIssuer(ctx context.Context, meta RequestMetadata
 		issuer.JWKSUrl = params.JwksURL
 	}
 	if params.ExpectedAud != nil {
+		if strings.TrimSpace(*params.ExpectedAud) == "" {
+			log.Debug().Msg("expected_aud cannot be empty")
+			return nil, nil, fmt.Errorf("expected_aud cannot be empty")
+		}
 		issuer.ExpectedAud = *params.ExpectedAud
 	}
 	if params.IsActive != nil {