From 1069095db1513db05c2242738cab59107b478eee Mon Sep 17 00:00:00 2001
From: Gen Tamura <gen.tamura84@gmail.com>
Date: Mon, 3 Nov 2025 23:11:16 +0900
Subject: [PATCH] chore(auth): restrict supabase audience to string

---
 packages/auth/src/authentication/supabase.ts | 16 +---------------
 packages/types/src/authentication.ts         |  2 +-
 2 files changed, 2 insertions(+), 16 deletions(-)

diff --git a/packages/auth/src/authentication/supabase.ts b/packages/auth/src/authentication/supabase.ts
index c0d34b3..8f84229 100644
--- a/packages/auth/src/authentication/supabase.ts
+++ b/packages/auth/src/authentication/supabase.ts
@@ -45,20 +45,6 @@ function buildSupabaseJwksUrl(
   return new URL(normalizedPath, projectUrl);
 }
 
-function normalizeAudience(
-  audience: string | readonly string[] | undefined,
-): string | string[] | undefined {
-  if (audience === undefined) {
-    return undefined;
-  }
-
-  if (typeof audience === "string") {
-    return audience;
-  }
-
-  return [...audience];
-}
-
 export function createSupabaseAuthentication(
   options: SupabaseAuthenticationOptions,
 ): AuthenticationProvider {
@@ -67,7 +53,7 @@ export function createSupabaseAuthentication(
   const projectUrl = parseSupabaseProjectUrl(options.projectUrl);
   const issuer = (options.issuer ?? buildSupabaseIssuerUrl(projectUrl)).trim();
   const jwksUrl = buildSupabaseJwksUrl(projectUrl, options.jwksPath);
-  const audience = normalizeAudience(options.audience);
+  const audience = options.audience;
   const requiredRole = options.requiredRole;
   const clockTolerance = options.clockToleranceSeconds;
 
diff --git a/packages/types/src/authentication.ts b/packages/types/src/authentication.ts
index 78bfa8f..fa5df89 100644
--- a/packages/types/src/authentication.ts
+++ b/packages/types/src/authentication.ts
@@ -21,7 +21,7 @@ export interface AuthenticationProvider {
 
 export interface SupabaseAuthenticationOptions {
   readonly projectUrl: string;
-  readonly audience?: string | readonly string[];
+  readonly audience?: string;
   readonly issuer?: string;
   readonly requiredRole?: string;
   readonly clockToleranceSeconds?: number;