docs(xaa): document the read-only project-level audience on the XAA load response

[dorsha]

Related Issues

Required for:
https://github.com/descope/etc/issues/18013

Related PRs

Upstream PRs

• https://github.com/descope/backend/pull/2378

Related PRs

• https://github.com/descope/console-app/pull/5734
• https://github.com/descope/descope-apps/pull/864
• https://github.com/descope/content/pull/2273
• feat(xaa): expose the read-only project-level audience on the XAA load response go-sdk#839
• feat(xaa): expose the read-only project-level audience on the XAA load response node-sdk#801
• https://github.com/descope/integrationtests/pull/14790

In a Nutshell

• Document the read-only audience on the XAA load response

Description

Loading Cross-App Access settings also returns the audience a requesting application has to present in its ID-JAG token, so the docstrings now say so instead of leaving callers to build the value themselves. It has no tenant in it - the identity provider sends the tenant in the token's aud_tenant claim.

Must

• Tests
• Documentation (if applicable)

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

This PR documents the read-only audience field on XAA load response across both sync and async SSO settings implementations. The changes span 3 files with equal coverage of sync/async implementations and tests. LioriE has extensive experience with all affected files (4 commits across all 3 files), making them the primary reviewer. omercnet complements with solid coverage of the core SSO settings file and tests (2 commits). Together, they provide comprehensive expertise in both the implementation and test suite for this documentation update.

Reviewer	Reason
LioriE	LioriE has 4 commits across all 3 modified files (sso_settings.py, sso_settings_async.py, test_sso_settings.py), providing the deepest expertise in both sync/async implementations and related tests.
omercnet	omercnet has 2 commits across the core sso_settings.py and test suite, offering complementary perspective on the main implementation and test coverage for this documentation change.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni Review

Docs-only change: updates docstrings for load_xaa_settings (sync/async) to document the read-only, project-level audience field and adds a matching test assertion.

Actionable comments posted: 0

Merge risk: 🟢 Low: no functional code changed — response.json() already passes the audience field through untouched, and the docstring wording/test fixture are consistent between the sync and async variants.

---

Review scope: Full review

Reviewed files (3)

• descope/management/sso_settings.py
• descope/management/sso_settings_async.py
• tests/management/test_sso_settings.py

[github-actions]

Coverage report

The coverage rate went from 98.26% to 98.26% ➡️

None of the new lines are part of the tested code. Therefore, there is no coverage data about them.