Not Before (nbf) calculated based on iat/timestamp (#437)

fix #435

Author: MitMaro

sign.js

@@ -145,7 +145,7 @@ module.exports = function (payload, secretOrPrivateKey, options, callback) {
   }
 
   if (typeof options.notBefore !== 'undefined') {
-    payload.nbf = timespan(options.notBefore);
+    payload.nbf = timespan(options.notBefore, timestamp);
     if (typeof payload.nbf === 'undefined') {
       return failure(new Error('"notBefore" should be a number of seconds or string representing a timespan eg: "1d", "20h", 60'));
     }

test/iat.tests.js

@@ -12,4 +12,13 @@ describe('iat', function () {
     expect(result.exp).to.be.closeTo(iat + expiresIn, 0.2);
   });
 
-});
+  it('should work with a nbf calculated based on numeric iat', function () {
+    var dateNow = Math.floor(Date.now() / 1000);
+    var iat = dateNow - 30;
+    var notBefore = -50;
+    var token = jwt.sign({foo: 123, iat: iat}, '123', {notBefore: notBefore});
+    var result = jwt.verify(token, '123');
+    expect(result.nbf).to.equal(iat + notBefore);
+  });
+
+});