feat: validate jwt audience and issuer

[mandar1045]

TL;DR

Validate the JWT aud and iss claims during user token verification through config overrides.

Problem

Token verification currently doesn't validate the audience or issuer claims. This means a valid token issued for one service could potentially be accepted by another service.

Solution

Adds optional audience and issuer config overrides to verifyCredentials, withClaims, and withRequiredClaims.

This works with both symmetric and asymmetric keys, and doesn't read from any reserved environment variables.

Ref

• Supersedes fix: validate JWT audience and issuer claims #41

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@160

commit: 45b2e8b

[mandarini]

Thanks for picking this up and for moving the options off resolveEnv. The logic is right and every call site gets the options. Three small changes before merge.

• Drop | null from the new field types and pass the options straight to jwtVerify (or guard with !== undefined). With the current truthiness check, an empty string turns validation off with no warning and an empty array rejects every token.
• Fix the example in docs/security.md. Supabase Auth sets aud to authenticated and iss to https://<ref>.supabase.co/auth/v1, so audience: 'my-service' would reject every Supabase token. Use issuer: fromSupabaseUrl(SUPABASE_URL) as the example and point to withRequiredClaims rather than withClaims, since withClaims lets requests with no token through.
• Add a one-line JSDoc to each new field, matching the fields around them. Mention that they apply to user mode only.

On your question about grouping: top level is fine. It matches where jwks sits on withClaims.