address review comments

Author: lashinijay

packages/javascript/src/DefaultCrypto.ts

@@ -17,83 +17,73 @@
  */
 
 import * as jose from "jose";
-import { JWKInterface } from "./models/crypto";
+import { Crypto, JWKInterface } from "./models/crypto";
 
-interface CryptoInterface<T> {
-    base64URLEncode(value: T): string;
-    base64URLDecode(value: string): string;
-    hashSha256(data: string): Promise<Uint8Array>; // Changed to Promise to match implementation
-    generateRandomBytes(length: number): Uint8Array;
-    verifyJwt(
-        idToken: string,
-        jwk: Partial<any>,
-        algorithms: string[],
-        clientId: string,
-        issuer: string,
-        subject: string,
-        clockTolerance?: number,
-    ): Promise<boolean>;
-}
-
-export class DefaultCrypto implements CryptoInterface<Uint8Array | string> {
-
-    constructor() {}
-
-    /**
-     * Cross-platform Base64URL encoding using 'jose' utilities
-     */
-    public base64URLEncode(value: Uint8Array | string): string {
-        const uint8Array = typeof value === "string"
-            ? new TextEncoder().encode(value)
-            : value;
+/**
+ * Default implementation of the Crypto interface using the 'jose' library
+ * and the native Web Crypto API.
+ */
+export class DefaultCrypto implements Crypto<Uint8Array> {
+  
+  /**
+   * Decodes a base64url string back into a UTF-8 string.
+   */
+  public base64URLDecode(value: string): string {
+    const decodedArray = jose.base64url.decode(value);
+    return new TextDecoder().decode(decodedArray);
+  }
 
-        return jose.base64url.encode(uint8Array);
-    }
+  /**
+   * Encodes a Uint8Array into a base64url string.
+   */
+  public base64URLEncode(value: Uint8Array): string {
+    return jose.base64url.encode(value);
+  }
 
-    /**
-     * Cross-platform Base64URL decoding
-     */
-    public base64URLDecode(value: string): string {
-        const decodedArray = jose.base64url.decode(value);
-        return new TextDecoder().decode(decodedArray);
-    }
+  /**
+   * Generates cryptographically strong random bytes.
+   */
+  public generateRandomBytes(length: number): Uint8Array {
+    return crypto.getRandomValues(new Uint8Array(length));
+  }
 
-    public async hashSha256(data: string): Promise<Uint8Array> {
-        const encoder = new TextEncoder();
+  /**
+   * Hash data using SHA-256.
+   * Note: The Crypto interface expects synchronous return, but Web Crypto is async.
+   * This implementation throws an error - use IsomorphicCrypto wrapper for async hashing.
+   */
+  public async hashSha256(data: string): Promise<Uint8Array> {
+    const encoder = new TextEncoder();
         const dataBuffer = encoder.encode(data);
 
         // Using native web crypto (available in modern Node and Browsers)
         const hashBuffer = await crypto.subtle.digest("SHA-256", dataBuffer);
         return new Uint8Array(hashBuffer);
-    }
-
-    public generateRandomBytes(length: number): Uint8Array {
-        // globalThis.crypto works in Browsers and Node.js 19+
-        const array = new Uint8Array(length);
-        crypto.getRandomValues(array);
-        return array;
-    }
-
-    public async verifyJwt(
-        idToken: string,
-        jwk: Partial<JWKInterface>,
-        algorithms: string[],
-        clientId: string,
-        issuer: string,
-        subject: string,
-        clockTolerance?: number,
-    ): Promise<boolean> {
+}
 
-        const key = await jose.importJWK(jwk as any);
+  /**
+   * Verifies the JWT using the provided JWK and claims.
+   */
+  public async verifyJwt(
+    idToken: string,
+    jwk: JWKInterface,
+    algorithms: string[],
+    clientId: string,
+    issuer: string,
+    subject: string,
+    clockTolerance?: number,
+    validateJwtIssuer: boolean = true,
+  ): Promise<boolean> {
+    const key = await jose.importJWK(jwk as jose.JWK);
 
-        await jose.jwtVerify(idToken, key, {
-            algorithms,
-            audience: clientId,
-            issuer,
-            subject,
-            clockTolerance,
-        });
+    await jose.jwtVerify(idToken, key, {
+      algorithms,
+      audience: clientId,
+      issuer: validateJwtIssuer ? issuer : undefined,
+      subject,
+      clockTolerance,
+    });
 
-        return true;
-    }
+    return true;
+  }
 }

packages/javascript/src/models/crypto.ts

@@ -85,7 +85,7 @@ export interface Crypto<T = any> {
    *
    * @returns Hashed data.
    */
-  hashSha256(data: string): T;
+  hashSha256(data: string): Promise<T>;
 
   /**
    * Verify the provided JWT.