fix: validate numeric type of iat, nbf and exp claims in encode

[guillaumedelre]

The decode() path already rejected non-numeric iat/nbf/exp values, but encode() accepted any type and silently produced an invalid token. Add the same is_numeric guards in encode() and cover them with unit tests.

Closes #453

[guillaumedelre]

Hey @bshaffer, this PR fixes #453 — happy to adjust if anything looks off.

[bshaffer]

@guillaumedelre thank you for your contribution! Please see my comments here: #453 (review)

[guillaumedelre]

Hi @bshaffer, thanks for the feedback on #453!

I'm aware of the breaking change concern with is_int — that's exactly why this PR takes a different approach. It uses is_numeric() instead, which accepts both integers and numeric strings, so existing code passing (string) time() continues to work without exceptions.

I've also added an explicit regression test covering that exact scenario:

$payload = [
    'message' => 'abc',
    'iat' => (string) time(),
    'exp' => (string) (time() + 20),
    'nbf' => (string) (time() - 20),
];

$encoded = JWT::encode($payload, $key, 'HS256');
$decoded = JWT::decode($encoded, $keyObj); // no exception thrown

So this should be mergeable without a major version bump. Happy to adjust if you'd like a different approach.

[bshaffer]

@guillaumedelre I see, I was a bit confused by your PR description and referencing the other PR as "fixed".

This looks good to me then!

[guillaumedelre]

@bshaffer Sorry, I think I might have gotten a bit mixed up.