JWT-SVID: aud claim missing from most issued tokens (spec violation)

[rsharath]

Summary

The JWT-SVID specification (§3) requires that the `aud` claim MUST be present in every issued JWT-SVID. However, `internal/service/credential.go` lines 206–208 only sets `aud` when `IssueRequest.Audience` is non-empty — tokens issued without an explicit audience have no `aud` claim at all.

Location

`internal/service/credential.go` ~L206–208

if len(req.Audience) > 0 {
    claims["aud"] = req.Audience
}

Impact

Tokens issued without an explicit audience fail JWT-SVID validation in any conformant verifier (e.g. `authjwt` client package). This is a spec-level violation that breaks interoperability.

Fix

Default `aud` to the issuer URL when the caller does not specify an audience:

aud := req.Audience
if len(aud) == 0 {
    aud = []string{issuerURL}
}
claims["aud"] = aud

Reference

• JWT-SVID spec §3: "The `aud` claim MUST be present"