Take a defensive copy of expected checks so verifiers are independent

The JWTVerifier constructor wrapped the builder's live ArrayList with
Collections.unmodifiableList (a view, not a copy), and build(Clock) appended the
mandatory exp/nbf/iat checks to that same list. Calling build() twice on one
BaseVerification therefore appended a second set of mandatory checks AND
retroactively mutated the first, already-returned (and documented as immutable and
thread-safe) verifier.

Build the mandatory checks into a fresh list inside build() instead of mutating the
builder's field, and take a defensive copy in the constructor. build() is now
idempotent and each verifier owns an independent snapshot. Single-build behaviour
and all existing check counts are unchanged.

Author: asim-alam

lib/src/main/java/com/auth0/jwt/JWTVerifier.java

@@ -30,7 +30,9 @@ public final class JWTVerifier implements com.auth0.jwt.interfaces.JWTVerifier {
 
     JWTVerifier(Algorithm algorithm, List<ExpectedCheckHolder> expectedChecks) {
         this.algorithm = algorithm;
-        this.expectedChecks = Collections.unmodifiableList(expectedChecks);
+        // Defensive copy: never wrap the builder's live list, otherwise a reused builder would
+        // retroactively mutate an already-built (supposedly immutable, thread-safe) verifier.
+        this.expectedChecks = Collections.unmodifiableList(new ArrayList<>(expectedChecks));
         this.parser = new JWTParser();
     }
 
@@ -285,8 +287,11 @@ public JWTVerifier build() {
          */
         public JWTVerifier build(Clock clock) {
             this.clock = clock;
-            addMandatoryClaimChecks();
-            return new JWTVerifier(algorithm, expectedChecks);
+            // Build the mandatory checks into a fresh list rather than mutating this builder's own
+            // field, so build() is idempotent and can be called repeatedly without duplicating them.
+            List<ExpectedCheckHolder> checks = new ArrayList<>(expectedChecks);
+            addMandatoryClaimChecks(checks);
+            return new JWTVerifier(algorithm, checks);
         }
 
         /**
@@ -299,17 +304,17 @@ public long getLeewayFor(String name) {
             return customLeeways.getOrDefault(name, defaultLeeway);
         }
 
-        private void addMandatoryClaimChecks() {
+        private void addMandatoryClaimChecks(List<ExpectedCheckHolder> checks) {
             long expiresAtLeeway = getLeewayFor(RegisteredClaims.EXPIRES_AT);
             long notBeforeLeeway = getLeewayFor(RegisteredClaims.NOT_BEFORE);
             long issuedAtLeeway = getLeewayFor(RegisteredClaims.ISSUED_AT);
 
-            expectedChecks.add(constructExpectedCheck(RegisteredClaims.EXPIRES_AT, (claim, decodedJWT) ->
+            checks.add(constructExpectedCheck(RegisteredClaims.EXPIRES_AT, (claim, decodedJWT) ->
                     assertValidInstantClaim(RegisteredClaims.EXPIRES_AT, claim, expiresAtLeeway, true)));
-            expectedChecks.add(constructExpectedCheck(RegisteredClaims.NOT_BEFORE, (claim, decodedJWT) ->
+            checks.add(constructExpectedCheck(RegisteredClaims.NOT_BEFORE, (claim, decodedJWT) ->
                     assertValidInstantClaim(RegisteredClaims.NOT_BEFORE, claim, notBeforeLeeway, false)));
             if (!ignoreIssuedAt) {
-                expectedChecks.add(constructExpectedCheck(RegisteredClaims.ISSUED_AT, (claim, decodedJWT) ->
+                checks.add(constructExpectedCheck(RegisteredClaims.ISSUED_AT, (claim, decodedJWT) ->
                         assertValidInstantClaim(RegisteredClaims.ISSUED_AT, claim, issuedAtLeeway, false)));
             }
         }

lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java

@@ -1325,4 +1325,18 @@ public void shouldThrowIncorrectClaimNotNpeWhenNullSubjectExpectedButClaimPresen
                 JWTVerifier.init(Algorithm.HMAC256("secret")).withSubject(null).build().verify(token));
         assertThat(e.getClaimName(), is("sub"));
     }
+
+    @Test
+    public void shouldBuildReusableVerifierWithoutDuplicatingMandatoryChecks() {
+        // H3: building the same builder twice must not duplicate the mandatory exp/nbf/iat checks,
+        // nor retroactively mutate the first (supposedly immutable) verifier.
+        Verification verification = JWTVerifier.init(Algorithm.HMAC256("secret")).withIssuer("auth0");
+        JWTVerifier verifier1 = verification.build();
+        int sizeAfterFirstBuild = verifier1.expectedChecks.size(); // 1 issuer + 3 mandatory = 4
+        JWTVerifier verifier2 = verification.build();
+
+        assertThat(sizeAfterFirstBuild, is(4));
+        assertThat(verifier1.expectedChecks.size(), is(sizeAfterFirstBuild)); // first not retroactively mutated
+        assertThat(verifier2.expectedChecks.size(), is(4));                    // second not doubled to 7
+    }
 }