Support audience arrays and multiple issuers

[renatoathaydes]

Two changes:

support array of strings for the aud JWT claim.

According to the specification: https://www.rfc-editor.org/info/rfc7519/#section-4.1.3

allow more than one issuer in the JWT validator.

The server supports configuring more than one issuer, so we should also let the filter accept more than one.
This was a customer request.

[Copilot]

Pull request overview

This PR updates JWT validation to support spec-compliant aud claims that may be either a string or an array of strings, and extends validator APIs to allow configuring multiple accepted issuers (and audiences). It also refactors test fixtures around JWT issuance/keystore loading and bumps the build’s Java target level.

Changes:

• Accept aud as either a string or an array of strings during JWT validation, and validate against configured accepted audiences.
• Add Set-based issuer/audience constructor options to JWT validators and introduce new tests for multi-issuer and audience-array behavior.
• Refactor test keystore/token fixture setup into reusable helpers; update Maven compiler settings to Java 15.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/test/java/io/curity/oauth/TestKeyStoreHelper.java	New helper to load PKCS12 keystore and access key material for tests.
src/test/java/io/curity/oauth/JwtWithJwksTest.java	Uses keystore helper instead of inline keystore-loading logic.
src/test/java/io/curity/oauth/JwtWithCertTest.java	Uses keystore helper instead of inline keystore-loading logic.
src/test/java/io/curity/oauth/JwtTokenIssuer.java	Adjusts audience issuance logic and tightens generics in helper method.
src/test/java/io/curity/oauth/JwtTokenFixtureHelper.java	New helper to issue tokens and produce key material for validator tests.
src/test/java/io/curity/oauth/JwtIssuerClaimTest.java	New tests for accepting one vs multiple configured issuers.
src/test/java/io/curity/oauth/JwtAudienceClaimTest.java	New tests for validating aud as string vs array, with single vs multiple accepted audiences.
src/main/java/io/curity/oauth/ValidationExceptions.java	Updates issuer validation error message to reflect multiple accepted issuers.
src/main/java/io/curity/oauth/JwtValidatorWithJwk.java	Adds Set-based constructor(s) for audiences/issuers and overloads for compatibility.
src/main/java/io/curity/oauth/JwtValidatorWithCert.java	Adds Set-based constructor(s) for audiences/issuers and overloads for compatibility.
src/main/java/io/curity/oauth/JsonUtils.java	Adds helper to read a claim as string-or-string-array into a set.
src/main/java/io/curity/oauth/AbstractJwtValidator.java	Implements multi-audience + multi-issuer validation and supports aud arrays.
pom.xml	Bumps compiler plugin and changes source/target to Java 15.
CHANGELOG.md	Documents aud array support, set-based audiences, and Java 15 requirement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[renatoathaydes]

What do the humans think here? I intentionally decided to throw on arrays containing a non-string element since that's almost certainly to be a broken token.

[mtrojanowski]

I think it's OK. It's true for a claim like aud that it should contain only strings, and it would mean a broken token otherwise. The method is also named "getStrings" so it shouldn't be a surprise that it can't get other types ;)