fix(06-12): reject typed-nil guards and fractional JWT subjects

bouncer/jwt_test.go

@@ -240,3 +240,15 @@ func noneToken(t *testing.T, claims jwt.MapClaims) string {
 	body := base64.RawURLEncoding.EncodeToString(payload)
 	return header + "." + body + "."
 }
+
+func TestVerifyRejectsFractionalSubject(t *testing.T) {
+	exp := time.Now().Add(time.Hour).Unix()
+	tok := sign(t, jwt.SigningMethodHS256, jwt.MapClaims{"sub": 12.5, "exp": exp}, []byte(secret))
+	if sub, err := Verify(tok, secret); err == nil || sub != "" {
+		t.Fatalf("fractional sub accepted: %q %v", sub, err)
+	}
+	tok = sign(t, jwt.SigningMethodHS256, jwt.MapClaims{"sub": 12, "exp": exp}, []byte(secret))
+	if sub, err := Verify(tok, secret); err != nil || sub != "12" {
+		t.Fatalf("whole sub: %q %v", sub, err)
+	}
+}