Require exp when verifying access tokens

[SashaMIT]

Summary

TokenVerifier#verify called JWT.decode without required_claims. ruby-jwt only checks exp when the claim is present, so a valid HS256 token with no exp never expired.

This sets required_claims: ["exp"]. Language-split of livekit/protocol#1706, livekit/python-sdks#779, and livekit/node-sdks#710. Distinct from #88 (jwt 3.x bump).

Test plan

• bundle exec rspec 23 examples, 0 failures (2 pending mock-server)
• New case: signed token with no exp raises JWT::MissingRequiredClaim
• Revert-test: drop required_claims and that case fails (token is accepted)

Made with Cursor

[frostbyte73]

See below

[frostbyte73]

required_claims landed in ruby-jwt v2.3.0 - Gemfile.lock needs to bump the minimum from v2.2.3

[SashaMIT]

Thanks. Floor is now jwt >= 2.3.0 in the gemspec and Gemfile.lock. Resolved jwt stays 2.10.3. required_claims is a no-op below 2.3.0, so that floor is the real fix.

bundle exec rspec still 23 examples, 0 failures (2 pending mock-server).