Add post-decode issuer mismatch check and cross-issuer test

After jwt.decode verifies the signature against the detected issuer's
JWKS, explicitly assert that the verified iss claim matches the issuer
we routed to. This makes the invariant enforced rather than emergent,
closing a theoretical hole if two issuers ever shared a JWKS endpoint.

Author: subinz1

aws/lambda/cross_repo_ci_relay/tests/test_jwt_helper.py

@@ -112,6 +112,18 @@ def test_github_token_missing_repository_claim_raises_401(self):
             verify_oidc_token("token.no.repo")
         self.assertEqual(ctx.exception.status_code, 401)
 
+    def test_cross_issuer_token_rejected(self):
+        """A GitHub-signed token asserting iss=buildkite must be rejected."""
+        self.mock_detect.return_value = GITHUB_ISSUER
+        self.mock_decode.return_value = {
+            "iss": BUILDKITE_ISSUER,
+            "repository": "org/repo",
+        }
+        with self.assertRaises(HTTPException) as ctx:
+            verify_oidc_token("cross.issuer.token")
+        self.assertEqual(ctx.exception.status_code, 401)
+        self.assertIn("Issuer mismatch", ctx.exception.detail)
+
 
 class TestVerifyBuildkiteOIDC(unittest.TestCase):
     """Tests for Buildkite OIDC tokens."""

aws/lambda/cross_repo_ci_relay/utils/jwt_helper.py

@@ -211,21 +211,29 @@ def verify_oidc_token(token: str) -> dict:
         if token.lower().startswith("bearer "):
             token = token[7:].strip()
 
-        issuer = _detect_issuer(token)
-        if issuer not in _jwks_clients:
-            raise HTTPException(401, f"Unsupported OIDC issuer: {issuer}")
+        detected_issuer = _detect_issuer(token)
+        if detected_issuer not in _jwks_clients:
+            raise HTTPException(401, f"Unsupported OIDC issuer: {detected_issuer}")
 
-        client = _jwks_clients[issuer]
+        client = _jwks_clients[detected_issuer]
         signing_key = client.get_signing_key_from_jwt(token)
         claims = jwt.decode(
             token,
             signing_key.key,
             algorithms=["RS256"],
-            issuer=issuer,
+            issuer=detected_issuer,
             audience=AUDIENCE,
         )
 
-        extractor = _REPO_EXTRACTORS[issuer]
+        verified_issuer = claims.get("iss", "")
+        if verified_issuer != detected_issuer:
+            raise HTTPException(
+                401,
+                f"Issuer mismatch: token claims '{verified_issuer}' "
+                f"but was routed as '{detected_issuer}'",
+            )
+
+        extractor = _REPO_EXTRACTORS[detected_issuer]
         repo = extractor(claims)
         claims["repository"] = repo