refactor(10.2-01): nest framework packages under modules

- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths

modules/bouncer/audience_test.go

@@ -0,0 +1,42 @@
+package bouncer
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestAudienceCrossover(t *testing.T) {
+	const secret = "same-secret-for-both-guards"
+	users := memUsers{byID: map[uint]*Principal{1: {ID: 1}}}
+	userTok, _, err := MintAudience(secret, "1", "https://app.test/login", time.Hour, AudienceUser)
+	if err != nil {
+		t.Fatal(err)
+	}
+	backendTok, _, err := MintAudience(secret, "1", "https://app.test/_admin/api/v1/auth/login", time.Hour, AudienceBackend)
+	if err != nil {
+		t.Fatal(err)
+	}
+	frontend := NewJWTGuard(secret, users, nil)
+	backend := NewBackendJWTGuard(secret, users, nil, nil)
+
+	if principal, err := backend.Authenticate(withBearer(backendTok)); err != nil || principal == nil || principal.ID != 1 {
+		t.Fatalf("backend guard rejected its own audience: %v", err)
+	}
+	if principal, err := frontend.Authenticate(withBearer(userTok)); err != nil || principal == nil || principal.ID != 1 {
+		t.Fatalf("frontend guard rejected its own audience: %v", err)
+	}
+	if principal, err := backend.Authenticate(withBearer(userTok)); err == nil || principal != nil {
+		t.Fatal("backend guard accepted a frontend-audience token signed with the same secret")
+	}
+	if principal, err := frontend.Authenticate(withBearer(backendTok)); err == nil || principal != nil {
+		t.Fatal("frontend guard accepted a backend-audience token signed with the same secret")
+	}
+}
+
+func withBearer(token string) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	return req
+}