examples: check token audience and set UserID in auth examples

examples/auth/server/main.go

@@ -67,6 +67,7 @@ func verifyToken(ctx context.Context, token string, _ *http.Request) (*auth.Toke
 		Scope  string `json:"scope"`
 		Exp    int64  `json:"exp"`
 		Sub    string `json:"sub"`
+		Aud    any    `json:"aud"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
 		return nil, err
@@ -76,6 +77,21 @@ func verifyToken(ctx context.Context, token string, _ *http.Request) (*auth.Toke
 		return nil, auth.ErrInvalidToken
 	}
 
+	var aud []string
+	switch v := result.Aud.(type) {
+	case string:
+		aud = []string{v}
+	case []any:
+		for _, a := range v {
+			if s, ok := a.(string); ok {
+				aud = append(aud, s)
+			}
+		}
+	}
+	if !oauthex.MatchesResource(aud, resourceURL()) {
+		return nil, auth.ErrInvalidToken
+	}
+
 	return &auth.TokenInfo{
 		Scopes:     strings.Fields(result.Scope),
 		Expiration: time.Unix(result.Exp, 0),
@@ -95,10 +111,14 @@ func echo(ctx context.Context, req *mcp.CallToolRequest, args args) (*mcp.CallTo
 	}, nil, nil
 }
 
+func resourceURL() string {
+	return fmt.Sprintf("http://localhost:%d/mcp", *port)
+}
+
 func main() {
 	flag.Parse()
 	metadata := &oauthex.ProtectedResourceMetadata{
-		Resource:             fmt.Sprintf("http://localhost:%d/mcp", *port),
+		Resource:             resourceURL(),
 		AuthorizationServers: []string{authorizationServer},
 		ScopesSupported:      []string{"read"},
 	}

examples/server/auth-middleware/main.go

@@ -105,6 +105,7 @@ func verifyJWT(ctx context.Context, tokenString string, _ *http.Request) (*auth.
 		return &auth.TokenInfo{
 			Scopes:     claims.Scopes,         // User permissions
 			Expiration: claims.ExpiresAt.Time, // Token expiration time
+			UserID:     claims.UserID,         // Binds the session to this user
 		}, nil
 	}
 
@@ -125,6 +126,7 @@ func verifyAPIKey(ctx context.Context, apiKey string, _ *http.Request) (*auth.To
 	return &auth.TokenInfo{
 		Scopes:     key.Scopes,                     // User permissions
 		Expiration: time.Now().Add(24 * time.Hour), // 24 hour expiration
+		UserID:     key.UserID,                     // Binds the session to this user
 	}, nil
 }