feat(xaa): expose the read-only project-level audience on the XAA load response

[dorsha]

Related Issues

Required for:
https://github.com/descope/etc/issues/18013

Related PRs

Upstream PRs

• https://github.com/descope/backend/pull/2378

Related PRs

• https://github.com/descope/console-app/pull/5734
• https://github.com/descope/descope-apps/pull/864
• https://github.com/descope/content/pull/2273
• feat(xaa): expose the read-only project-level audience on the XAA load response node-sdk#801
• docs(xaa): document the read-only project-level audience on the XAA load response python-sdk#1677
• https://github.com/descope/integrationtests/pull/14790

In a Nutshell

• Read-only audience on the XAA load response

Description

Loading Cross-App Access settings now also returns the audience a requesting application has to present in its ID-JAG token, so callers read the same value the console shows instead of building it themselves. It has no tenant in it - the identity provider sends the tenant in the token's aud_tenant claim.

Must

• Tests
• Documentation (if applicable)

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

This PR adds a read-only audience field to the XAA load response. The changes span two files: types.go (data structure modifications) and sso_test.go (test coverage). To ensure comprehensive review coverage, we selected reviewers with deep experience in both the type definitions and SSO testing areas. This combination provides expertise in both the API contract changes and their corresponding test validation.

Reviewer	Reason
aviadl	aviadl has the most extensive history with both modified files (3 commits across descope/internal/mgmt/sso_test.go and descope/types.go). This dual expertise makes them ideal for reviewing both the type definition changes and the test implementation, ensuring consistency across the full scope of changes.
omercnet	omercnet has specific expertise in descope/types.go (2 commits), making them critical for reviewing the new audience field definition and any data structure changes to the XAA load response type.
yosiharan	yosiharan has recent test writing experience in descope/internal/mgmt/sso_test.go, providing valuable perspective on the test coverage quality and ensuring the new audience field is properly validated in test scenarios.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni Review

Adds a read-only Audience field to SSOXAASettingsResponse so XAA load responses expose the project-level audience.

Actionable comments posted: 0

Merge risk: 🟢 Low: purely additive field with generic JSON unmarshal covering both single and bulk load paths, kept out of the write-payload struct to preserve read-only semantics, and covered by a passing test assertion.

---

Review scope: Full review

Reviewed files (2)

• descope/types.go
• descope/internal/mgmt/sso_test.go