[renanmpimentel]

What changed

Adds test_decode_should_succeed_if_required_claims_are_present next to the existing require tests in tests/test_api_jwt.py. It decodes a token that carries exp, iat and nbf with options={"require": ["exp", "iat", "nbf"]} and asserts that the payload is returned unchanged.

Why

The existing require tests are all negative (test_decode_should_raise_error_if_{exp,iat,nbf}_required_but_not_present, plus the sub/jti variants). They check that a missing claim raises MissingRequiredClaimError, but nothing checks that a token which does contain the required claims is accepted. The usage docs only show the error case as well.

As a result, a regression in _validate_required_claims that rejects every token whenever require is set leaves the whole suite green, e.g.:

# A
if payload.get(None) is None:
    raise MissingRequiredClaimError(claim)

# B: a refactor that collects missing claims but checks the wrong list
missing = [claim for claim in claims if payload.get(claim) is None]
if claims:
    raise MissingRequiredClaimError((missing or list(claims))[0])

With either change, every jwt.decode(..., options={"require": [...]}) call raises, even for valid tokens.

Verification

• pytest with cryptography: 472 passed, 4 skipped (was 471)
• pytest without cryptography: 287 passed, 189 skipped (was 286)
• mypy: no issues
• pre-commit run --files tests/test_api_jwt.py: passed

Suite	Correct code	Regression A	Regression B
Before this PR	471 passed	471 passed (undetected)	471 passed (undetected)
After this PR	472 passed	1 failed: MissingRequiredClaimError: Token is missing the "exp" claim	same

This is a test-only change, so I didn't add a CHANGELOG entry. Could a maintainer apply the tests label so the changelog check is skipped?

---

I found this while experimenting with Supertest, a tool for evaluating test effectiveness using mutation testing and test-harness mutilation.