fix: correctly decode base64 supabase secret and specify HS256 algorithm with precise multi-key kid header

Author: adriannoes

src/auth.ts

@@ -25,8 +25,10 @@ const config: NextAuthConfig = {
         }
       }
 
-      const secret = process.env.SUPABASE_JWT_SECRET
-      if (secret && token.id) {
+      const secretString = process.env.SUPABASE_JWT_SECRET
+      if (secretString && token.id) {
+        // Must strictly decode base64 into raw bytes for Supabase HS256!
+        const secretBuffer = Buffer.from(secretString, "base64")
         token.supabaseAccessToken = jwt.sign(
           {
             aud: "authenticated",
@@ -35,7 +37,13 @@ const config: NextAuthConfig = {
             email: token.email,
             role: "authenticated",
           },
-          secret,
+          secretBuffer,
+          {
+            header: {
+              alg: "HS256",
+              kid: "7F438B89-1B14-4807-95B5-AAB76A6A0051",
+            },
+          },
         )
       }
       return token