More comments addressed

Author: anakinj

lib/jwt/encoded_nested_token.rb

@@ -6,9 +6,17 @@ module JWT
   # Unwraps all nesting levels and provides an Enumerable interface over the token layers
   # (outermost to innermost).
   #
-  # @example Verifying a Nested JWT
+  # @example Verifying a Nested JWT with a shared algorithm
   #   nested = JWT::EncodedNestedToken.new(nested_jwt_string)
-  #   nested.verify!(algorithm: ['RS256', 'HS256'], key: [rsa_public, 'inner_secret'])
+  #   nested.verify!(algorithm: 'HS256', key: [outer_secret, inner_secret])
+  #   nested.last.payload # => { 'user_id' => 123 }
+  #
+  # @example Verifying with mixed algorithms using key_finder
+  #   nested = JWT::EncodedNestedToken.new(nested_jwt_string)
+  #   nested.verify!(
+  #     algorithm: %w[RS256 HS256],
+  #     key_finder: ->(token) { key_map[token.header['alg']] }
+  #   )
   #   nested.last.payload # => { 'user_id' => 123 }
   #
   # @example Inspecting layers
@@ -27,16 +35,22 @@ class EncodedNestedToken
     def initialize(jwt, max_depth: MAX_DEPTH)
       raise ArgumentError, 'Provided JWT must be a String' unless jwt.is_a?(String)
 
+      @jwt = jwt
       @max_depth = max_depth
-      @tokens = unwrap(jwt)
+      @verified = false
     end
 
     def each(&block)
-      @tokens.each(&block)
+      tokens.each(&block)
     end
 
+    # Returns the innermost token. Requires {#verify!} to have been called first.
+    # @return [JWT::EncodedToken] the innermost token.
+    # @raise [JWT::DecodeError] if the token has not been verified.
     def last
-      @tokens.last
+      raise JWT::DecodeError, 'Verify the token before accessing the innermost token' unless @verified
+
+      tokens.last
     end
 
     # Verifies signatures at each nesting level and claims on the innermost token.
@@ -58,12 +72,17 @@ def verify!(algorithm:, key: nil, key_finder: nil, claims: nil)
         token.verify_signature!(algorithm: algorithm, key: key, key_finder: key_finder)
       end
 
+      @verified = true
       claims.is_a?(Array) ? last.verify_claims!(*claims) : last.verify_claims!(claims)
       self
     end
 
     private
 
+    def tokens
+      @tokens ||= unwrap(@jwt)
+    end
+
     def unwrap(jwt)
       tokens = []
       current = jwt

spec/jwt/encoded_nested_token_spec.rb

@@ -51,11 +51,19 @@ def create_nested(inner, algorithm:, key:)
   end
 
   describe '#last' do
-    it 'returns the innermost token' do
+    it 'raises DecodeError before verification' do
       nested_jwt = create_nested(inner_jwt, algorithm: 'HS256', key: outer_secret)
       nested = described_class.new(nested_jwt)
 
-      expect(nested.last.unverified_payload).to eq(inner_payload)
+      expect { nested.last }.to raise_error(JWT::DecodeError, /Verify the token before/)
+    end
+
+    it 'returns the innermost token after verification' do
+      nested_jwt = create_nested(inner_jwt, algorithm: 'HS256', key: outer_secret)
+      nested = described_class.new(nested_jwt)
+      nested.verify!(algorithm: 'HS256', key: [outer_secret, inner_secret])
+
+      expect(nested.last.payload).to eq(inner_payload)
     end
   end
 
@@ -161,8 +169,9 @@ def create_nested(inner, algorithm:, key:)
         current = create_nested(current, algorithm: 'HS256', key: "key_#{i}")
       end
 
+      nested = described_class.new(current)
       expect do
-        described_class.new(current)
+        nested.count
       end.to raise_error(JWT::DecodeError, /exceeds maximum depth/)
     end
 
@@ -171,11 +180,11 @@ def create_nested(inner, algorithm:, key:)
       level3 = create_nested(level2, algorithm: 'HS256', key: 'key3')
 
       expect do
-        described_class.new(level3, max_depth: 2)
+        described_class.new(level3, max_depth: 2).count
       end.to raise_error(JWT::DecodeError, 'Nested JWT exceeds maximum depth of 2')
 
       expect do
-        described_class.new(level3, max_depth: 5)
+        described_class.new(level3, max_depth: 5).count
       end.not_to raise_error
     end
   end