fix: respect an iat of 0 instead of overwriting it with the current time (#874)

lib/timespan.js

@@ -1,7 +1,7 @@
 var ms = require('ms');
 
 module.exports = function (time, iat) {
-  var timestamp = iat || Math.floor(Date.now() / 1000);
+  var timestamp = (typeof iat === 'number' && !isNaN(iat)) ? iat : Math.floor(Date.now() / 1000);
 
   if (typeof time === 'string') {
     var milliseconds = ms(time);

sign.js

@@ -182,7 +182,7 @@ module.exports = function (payload, secretOrPrivateKey, options, callback) {
     }
   }
 
-  const timestamp = payload.iat || Math.floor(Date.now() / 1000);
+  const timestamp = (typeof payload.iat === 'number' && !isNaN(payload.iat)) ? payload.iat : Math.floor(Date.now() / 1000);
 
   if (options.noTimestamp) {
     delete payload.iat;

test/claim-iat.test.js

@@ -110,6 +110,14 @@ describe('issue at', function() {
         expectedIssueAt: 100,
         options: {}
       },
+      {
+        // regression for #874: iat of 0 (the Unix epoch) is a valid number and
+        // must be preserved, not treated as falsy and overwritten with "now".
+        description: 'should sign with provided time for "iat" of 0',
+        iat: 0,
+        expectedIssueAt: 0,
+        options: {}
+      },
       // TODO an iat of -Infinity should fail validation
       {
         description: 'should set null "iat" when given -Infinity',
@@ -153,6 +161,21 @@ describe('issue at', function() {
         });
       });
     });
+
+    // regression for #874: an "iat" of 0 must anchor "exp"/"nbf" too, not "now".
+    // The bug also affected timespan() (lib/timespan.js), which independently
+    // applied the same `iat || now` fallback, so exp/nbf were derived from "now".
+    it('should derive "exp" and "nbf" from an "iat" of 0', function (done) {
+      signWithIssueAt(0, {expiresIn: 86400, notBefore: 60}, (err, token) => {
+        testUtils.asyncCheck(done, () => {
+          expect(err).to.be.null;
+          const decoded = jwt.decode(token);
+          expect(decoded.iat).to.equal(0);
+          expect(decoded.exp).to.equal(86400);
+          expect(decoded.nbf).to.equal(60);
+        });
+      });
+    });
   });
 
   describe('when verifying a token', function() {