chore(identity): address review cleanups on blocking token audiences

Reject a non-string "aud" with InvalidAuthBlockingTokenError rather than letting
the membership test raise TypeError, fix the class comment to name the renamed
kwarg, drop a stale test comment, and declare cryptography in the dev group since
the tests import it directly.

Author: IzaakGough

pyproject.toml

@@ -45,6 +45,7 @@ dev = [
   "pytest>=7.1.2,<10",
   "setuptools>=63.4.2",
   "pytest-cov>=3.0.0",
+  "cryptography>=3.4.0",
   "mypy>=1.0.0",
   "sphinx>=6.1.3",
   "sphinxcontrib-napoleon>=0.7",

src/firebase_functions/private/token_verifier.py

@@ -34,7 +34,7 @@
 # mypy: ignore-errors
 # TODO remove once firebase-admin supports this directly.
 # Modified from src/firebase_admin/_token_gen.py to add
-# support for app_check tokens (expected_audience kwarg and
+# support for app_check tokens (expected_audiences kwarg and
 # usage are new, plus None for audience on google.oauth2.id_token.verify_token call)
 class _JWTVerifier:
     """Verifies Firebase JWTs (ID tokens or session cookies)."""
@@ -105,7 +105,10 @@ def verify(self, token, request):
         elif (
             not emulated
             and self.expected_audiences
-            and not any(expected in audience for expected in self.expected_audiences)
+            and not (
+                isinstance(audience, str)
+                and any(expected in audience for expected in self.expected_audiences)
+            )
         ):
             expected = " or ".join(f'"{expected}"' for expected in self.expected_audiences)
             error_message = (

tests/test_identity_fn.py

@@ -21,8 +21,6 @@
         "iat": 0,
     }
 )
-# Patch the reference _identity_fn holds rather than the sys.modules entry, which
-# `import ... as` bypasses once anything else has imported the real module.
 
 
 class TestIdentity(unittest.TestCase):