From 04f1db9fa752c86c9018d97cec2ac8a69519c88f Mon Sep 17 00:00:00 2001
From: Bharat Kathi <bharat.kathi@withpersona.com>
Date: Wed, 9 Sep 2026 12:53:20 -0700
Subject: [PATCH] fix(auth): enforce Vault token audience

---
 vault/api/api.go | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/vault/api/api.go b/vault/api/api.go
index 0aad5e5..4c05932 100644
--- a/vault/api/api.go
+++ b/vault/api/api.go
@@ -117,6 +117,10 @@ func AuthChecker() gin.HandlerFunc {
 				return
 			}
 			setAuthContext(c, token, claims)
+			if !RequestTokenHasAudience(c, config.SentinelClientID) {
+				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "token is not intended for Vault"})
+				return
+			}
 			logger.SugarLogger.Infof("Decoded token: entity=%s audience=%s scope=%s", GetRequestTokenEntityID(c), GetRequestTokenAudience(c), GetRequestTokenScopes(c))
 		}
 		c.Next()
@@ -176,15 +180,6 @@ func RequestTokenExists(c *gin.Context) bool {
 	return exists
 }
 
-func RequestTokenHasScope(c *gin.Context, scope string) bool {
-	for _, tokenScope := range strings.Fields(GetRequestTokenScopes(c)) {
-		if tokenScope == scope {
-			return true
-		}
-	}
-	return false
-}
-
 func RequestTokenHasAudience(c *gin.Context, audience string) bool {
 	return GetRequestTokenAudience(c) == audience
 }
@@ -215,9 +210,6 @@ func RequestTokenCanAccessAccount(c *gin.Context, account model.Account) bool {
 	if !RequestTokenExists(c) {
 		return false
 	}
-	if RequestTokenHasScope(c, "sentinel:all") {
-		return true
-	}
 	if RequestTokenHasGroupName(c, "Admins") {
 		return true
 	}
@@ -231,9 +223,6 @@ func RequestTokenCanAccessApplication(c *gin.Context, application model.Applicat
 	if !RequestTokenExists(c) {
 		return false
 	}
-	if RequestTokenHasScope(c, "sentinel:all") {
-		return true
-	}
 	if RequestTokenHasGroupName(c, "Admins") {
 		return true
 	}
@@ -244,11 +233,11 @@ func RequestTokenCanAccessApplication(c *gin.Context, application model.Applicat
 }
 
 func RequestTokenCanViewAuditLogs(c *gin.Context) bool {
-	return RequestTokenHasScope(c, "sentinel:all") || RequestTokenHasGroupName(c, "Admins")
+	return RequestTokenHasGroupName(c, "Admins")
 }
 
 func RequestTokenCanManageSettings(c *gin.Context) bool {
-	return RequestTokenHasScope(c, "sentinel:all") || RequestTokenHasGroupName(c, "Admins")
+	return RequestTokenHasGroupName(c, "Admins")
 }
 
 func RequestTokenCanManageGitHubActionsRules(c *gin.Context) bool {