Add support for direct public key JWT verification without JWKS disco…

[arpit-jn]

…very

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

This PR adds support for directly providing a public key for JWT verification without requiring JWKS discovery or endpoints.

Currently, the library only supports:

1. Using issuerBaseURL to fetch JWKS
2. Manually providing jwksUri and issuer

This change extends the secret parameter to accept either:

• A string (for symmetric algorithms like HS256)
• A KeyLike object (for asymmetric algorithms like RS256)

This helps in scenarios where the public key is already known, like in air-gapped environments or custom key management systems.

References

• Fixes publicKey without discovery #133

Testing

Tested with:

• Direct public key verification using RSA keys

• Verification with explicit algorithms

• Negative tests with mismatched keys

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

To fix the problem, the unused exportJWK import should be removed from the file. This involves editing the import statement on line 1 to exclude exportJWK. The rest of the code remains unchanged, as this modification does not affect any functionality.