dms-middleware-auth 1.1.5 → 1.1.7

package/dist/auth.middleware.d.ts

@@ -24,9 +24,12 @@ export declare class AuthMiddleware implements NestMiddleware, OnModuleInit {
     private static readonly licenceExpiredMessage;
     private static readonly CLOCK_TOLERANCE_MS;
     private static readonly LIC_EXPIRY_CHECK_INTERVAL_MS;
+    private static readonly MAX_SAFE_TTL_MS;
+    private static readonly MAX_SAFE_TTL_SECONDS;
     private static readonly LIC_CACHE_TTL_SECONDS;
     private static readonly CLIENT_TOKEN_TTL_MAX_SECONDS;
     private static readonly CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS;
+    private static readonly ROLE_ATTRIBUTES_TTL_SECONDS;
     constructor(cacheManager: Cache, options: AuthMiddlewareOptions);
     onModuleInit(): Promise<void>;
     use(req: any, res: Response, next: NextFunction): Promise<void | Response<any, Record<string, any>>>;

package/dist/auth.middleware.js

@@ -92,7 +92,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
                     server_time: new Date().toISOString(),
                     licence_expiry: AuthMiddleware_1.licenceValidatedUntilMs
                         ? new Date(AuthMiddleware_1.licenceValidatedUntilMs).toISOString()
-                        : 'Unknown'
+                        : 'Unknown',
                 });
             }
             // Allow bypass URL
@@ -118,8 +118,8 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             if (!clientAttributes) {
                 const roleObj = await this.getClientRoleAttributes(role, clientToken);
                 clientAttributes = JSON.stringify(roleObj.attributes ?? {});
-                // store indefinitely (or you can choose a short TTL)
-                await this.cacheSetSeconds(clientRoleCacheKey, clientAttributes, 0);
+                // ✅ Cache with safe TTL
+                await this.cacheSetSeconds(clientRoleCacheKey, clientAttributes, AuthMiddleware_1.ROLE_ATTRIBUTES_TTL_SECONDS);
             }
             // Route access check
             const attrs = JSON.parse(clientAttributes);
@@ -137,11 +137,12 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             }
             req['user'] = {
                 role,
-                userName: decoded?.preferred_username
+                userName: decoded?.preferred_username,
             };
             return next();
         }
         catch (error) {
+            this.logger.error(`Middleware error: ${error?.message || error}`, error?.stack);
             return res.status(500).json({ message: error?.message || 'Internal error' });
         }
     }
@@ -173,6 +174,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         if (AuthMiddleware_1.shutdownInitiated)
             return;
         AuthMiddleware_1.shutdownInitiated = true;
+        this.logger.warn('Initiating graceful shutdown due to licence expiry');
         // immediate SIGTERM, then force exit after 5s
         setTimeout(() => {
             try {
@@ -182,7 +184,10 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
                 process.exit(1);
             }
             if (!AuthMiddleware_1.shutdownTimer) {
-                AuthMiddleware_1.shutdownTimer = setTimeout(() => process.exit(1), 5000);
+                AuthMiddleware_1.shutdownTimer = setTimeout(() => {
+                    this.logger.error('Force exit after SIGTERM timeout');
+                    process.exit(1);
+                }, 5000);
             }
         }, 0);
     }
@@ -207,12 +212,18 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
                 const cachedToken = (await this.cacheManager.get('client_Licence_token'));
                 if (cachedToken) {
                     const ok = await this.validateLicence(cachedToken, publicKey, false);
-                    if (ok)
+                    if (ok) {
+                        this.logger.log('Licence validated from cache');
                         return true;
+                    }
                 }
                 // 2) Fetch from licensing service
+                this.logger.log('Fetching licence from service');
                 const token = await this.getLicencingTokenFromService(realm);
                 const ok = await this.validateLicence(token, publicKey, true);
+                if (ok) {
+                    this.logger.log('Licence validated from service');
+                }
                 return ok;
             })();
             try {
@@ -223,7 +234,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             }
         }
         catch (e) {
-            this.logger.warn(`checkLicenceAndValidate failed: ${e?.message || e}`);
+            this.logger.error(`checkLicenceAndValidate failed: ${e?.message || e}`, e?.stack);
             return false;
         }
     }
@@ -245,6 +256,8 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             }
             // ✅ Save only the timestamp (supports 50 days / 500 days / years)
             AuthMiddleware_1.licenceValidatedUntilMs = licEndMs;
+            const daysUntilExpiry = Math.floor((licEndMs - now) / (1000 * 60 * 60 * 24));
+            this.logger.log(`Licence valid until ${new Date(licEndMs).toISOString()} (${daysUntilExpiry} days remaining)`);
             // ✅ Cache only briefly (avoid long TTL -> avoids TimeoutOverflowWarning)
             if (updateCache) {
                 await this.cacheSetSeconds('client_Licence_token', tokenJwt, AuthMiddleware_1.LIC_CACHE_TTL_SECONDS);
@@ -268,15 +281,21 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         const url = this.options.licenceServiceUrl ??
             'https://iiuuckued274sisadalbpf7ivu0eiblk.lambda-url.ap-south-1.on.aws/';
         const body = { client_name: realm };
-        const resp = await axios_1.default.post(url, body, { timeout: 15_000 });
-        if (resp.status !== axios_1.HttpStatusCode.Ok) {
-            throw new Error(`Licencing service returned status ${resp.status}`);
+        try {
+            const resp = await axios_1.default.post(url, body, { timeout: 15_000 });
+            if (resp.status !== axios_1.HttpStatusCode.Ok) {
+                throw new Error(`Licencing service returned status ${resp.status}`);
+            }
+            const token = resp?.data?.token;
+            if (!token || typeof token !== 'string') {
+                throw new Error('Licencing service response missing token');
+            }
+            return token;
         }
-        const token = resp?.data?.token;
-        if (!token || typeof token !== 'string') {
-            throw new Error('Licencing service response missing token');
+        catch (e) {
+            this.logger.error(`Failed to fetch licence from service: ${e?.message || e}`);
+            throw e;
         }
-        return token;
     }
     // -------------------------
     // Keycloak client token caching (safe TTL)
@@ -302,7 +321,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         const resp = await axios_1.default.post(`${keycloakUrl}/realms/${realm}/protocol/openid-connect/token`, new URLSearchParams({
             grant_type: 'client_credentials',
             client_id: clientId,
-            client_secret: clientSecret
+            client_secret: clientSecret,
         }).toString(), { headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, timeout: 15_000 });
         const token = resp?.data?.access_token;
         if (!token) {
@@ -324,7 +343,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         return jwt.verify(token, publicKeys, {
             algorithms: ['RS256'],
             ignoreExpiration: true,
-            clockTolerance: 60
+            clockTolerance: 60,
         });
     }
     decodeAccessToken(authHeader, publicKey) {
@@ -332,7 +351,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         const publicKeys = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`;
         return jwt.verify(token, publicKeys, {
             algorithms: ['RS256'],
-            clockTolerance: 60
+            clockTolerance: 60,
         });
     }
     extractBearerToken(authHeader) {
@@ -352,19 +371,101 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         return n;
     }
     // -------------------------
-    // Cache helper (seconds-based, safe across stores)
-    // - Using seconds avoids ms/sec mismatch across cache-manager stores
-    // - TTL is kept small so no overflow even if a store uses Node timers
+    // ✅ ULTIMATE FIX: Cache helper with COMPLETE OVERFLOW PROTECTION
+    // -------------------------
+    // Works with ANY cache-manager version and ANY cache store
+    // Prevents cache stores from calculating TTL from JWT claims
     // -------------------------
     async cacheSetSeconds(key, value, ttlSeconds) {
-        // ttlSeconds=0 => store forever (supported by many stores); if not, we just set without ttl
-        if (!ttlSeconds || ttlSeconds <= 0) {
-            await this.cacheManager.set(key, value);
-            return;
+        try {
+            // ttlSeconds=0 => store forever (no expiry)
+            if (!ttlSeconds || ttlSeconds <= 0) {
+                await this.cacheManager.set(key, value);
+                this.logger.debug(`Cache set (no TTL): ${key}`);
+                return;
+            }
+            // ✅ CRITICAL: Clamp TTL to prevent overflow
+            let safeTtlSeconds = ttlSeconds;
+            if (ttlSeconds > AuthMiddleware_1.MAX_SAFE_TTL_SECONDS) {
+                safeTtlSeconds = AuthMiddleware_1.MAX_SAFE_TTL_SECONDS;
+                this.logger.warn(`Cache TTL clamped: key=${key}, requested=${ttlSeconds}s (~${Math.floor(ttlSeconds / 86400)} days), using=${safeTtlSeconds}s (~24 days)`);
+            }
+            // Convert to milliseconds
+            const ttlMs = safeTtlSeconds * 1000;
+            // ✅ CRITICAL: Double-check we're not exceeding the limit
+            // This catches any edge cases where ttlMs might still overflow
+            const finalTtlMs = Math.min(ttlMs, AuthMiddleware_1.MAX_SAFE_TTL_MS);
+            if (finalTtlMs !== ttlMs) {
+                this.logger.warn(`TTL further clamped: ${ttlMs}ms -> ${finalTtlMs}ms`);
+            }
+            // ✅ Try multiple methods to ensure compatibility with all cache stores
+            let cacheSetSuccess = false;
+            let lastError = null;
+            // Method 1: Modern cache-manager v5+ (TTL in milliseconds as 3rd param)
+            if (!cacheSetSuccess) {
+                try {
+                    await this.cacheManager.set(key, value, finalTtlMs);
+                    cacheSetSuccess = true;
+                    this.logger.debug(`Cache set (v5 format): ${key} (TTL: ${safeTtlSeconds}s / ${finalTtlMs}ms)`);
+                }
+                catch (err) {
+                    lastError = err;
+                    // Try next method
+                }
+            }
+            // Method 2: Object-based TTL (milliseconds) - some stores
+            if (!cacheSetSuccess) {
+                try {
+                    await this.cacheManager.set(key, value, { ttl: finalTtlMs });
+                    cacheSetSuccess = true;
+                    this.logger.debug(`Cache set (object ms format): ${key} (TTL: ${finalTtlMs}ms)`);
+                }
+                catch (err) {
+                    lastError = err;
+                    // Try next method
+                }
+            }
+            // Method 3: Object-based TTL (seconds) - Redis and others
+            if (!cacheSetSuccess) {
+                try {
+                    await this.cacheManager.set(key, value, { ttl: safeTtlSeconds });
+                    cacheSetSuccess = true;
+                    this.logger.debug(`Cache set (object sec format): ${key} (TTL: ${safeTtlSeconds}s)`);
+                }
+                catch (err) {
+                    lastError = err;
+                    // Try next method
+                }
+            }
+            // Method 4: Direct store access (for Redis stores)
+            if (!cacheSetSuccess) {
+                try {
+                    const store = this.cacheManager.store;
+                    const redisClient = store?.client || store?.getClient?.();
+                    if (redisClient && typeof redisClient.set === 'function') {
+                        // Redis native command: SET key value EX seconds
+                        await redisClient.set(key, value, { EX: safeTtlSeconds });
+                        cacheSetSuccess = true;
+                        this.logger.debug(`Cache set (Redis direct): ${key} (EX: ${safeTtlSeconds}s)`);
+                    }
+                }
+                catch (err) {
+                    lastError = err;
+                    // Continue to fallback
+                }
+            }
+            // Method 5: Fallback - cache without TTL (better than failing)
+            if (!cacheSetSuccess) {
+                this.logger.warn(`All TTL methods failed for key=${key}, caching without TTL. Last error: ${lastError?.message}`);
+                await this.cacheManager.set(key, value);
+                this.logger.debug(`Cache set (no TTL fallback): ${key}`);
+            }
+        }
+        catch (e) {
+            // Even if all methods fail, don't crash the app
+            this.logger.error(`Cache set completely failed for key=${key}: ${e?.message || e}`, e?.stack);
+            // Cache failures are non-fatal - log and continue
         }
-        // cache-manager / Nest stores vary: some accept third param number, others accept { ttl }
-        // We use { ttl } for better compatibility, and TTL is small anyway.
-        await this.cacheManager.set(key, value, { ttl: ttlSeconds });
     }
 };
 exports.AuthMiddleware = AuthMiddleware;
@@ -382,11 +483,15 @@ AuthMiddleware.CLOCK_TOLERANCE_MS = 60_000; // 1 min
 // IMPORTANT:
 // Node timers overflow above ~2,147,483,647ms (~24.8 days).
 // We avoid scheduling long timeouts completely.
-AuthMiddleware.LIC_EXPIRY_CHECK_INTERVAL_MS = 60_000; // 1 min
-// Cache TTLs (short by design; safe for any store, avoids timer overflow)
+AuthMiddleware.LIC_EXPIRY_CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+// ✅ OVERFLOW PROTECTION: Max safe TTL for 32-bit timers
+AuthMiddleware.MAX_SAFE_TTL_MS = 2_147_483_647; // ~24.8 days
+AuthMiddleware.MAX_SAFE_TTL_SECONDS = Math.floor(2_147_483_647 / 1000); // ~24 days
+// Cache TTLs (safe by design; prevents timer overflow)
 AuthMiddleware.LIC_CACHE_TTL_SECONDS = 15 * 60; // 15 minutes
 AuthMiddleware.CLIENT_TOKEN_TTL_MAX_SECONDS = 60 * 60; // 1 hour cap
 AuthMiddleware.CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS = 30; // refresh a bit early
+AuthMiddleware.ROLE_ATTRIBUTES_TTL_SECONDS = 24 * 60 * 60; // 24 hours
 exports.AuthMiddleware = AuthMiddleware = AuthMiddleware_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(cache_manager_1.CACHE_MANAGER)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dms-middleware-auth",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Reusable middleware for authentication and authorization in NestJS applications.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth.middleware.ts

@@ -3,7 +3,7 @@ import {
   Injectable,
   Logger,
   NestMiddleware,
-  OnModuleInit
+  OnModuleInit,
 } from '@nestjs/common';
 import { Response, NextFunction } from 'express';
 import axios, { HttpStatusCode } from 'axios';
@@ -52,18 +52,23 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   // IMPORTANT:
   // Node timers overflow above ~2,147,483,647ms (~24.8 days).
   // We avoid scheduling long timeouts completely.
-  private static readonly LIC_EXPIRY_CHECK_INTERVAL_MS = 60_000; // 1 min
+  private static readonly LIC_EXPIRY_CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
 
-  // Cache TTLs (short by design; safe for any store, avoids timer overflow)
+  // ✅ OVERFLOW PROTECTION: Max safe TTL for 32-bit timers
+  private static readonly MAX_SAFE_TTL_MS = 2_147_483_647; // ~24.8 days
+  private static readonly MAX_SAFE_TTL_SECONDS = Math.floor(2_147_483_647 / 1000); // ~24 days
+
+  // Cache TTLs (safe by design; prevents timer overflow)
   private static readonly LIC_CACHE_TTL_SECONDS = 15 * 60; // 15 minutes
   private static readonly CLIENT_TOKEN_TTL_MAX_SECONDS = 60 * 60; // 1 hour cap
   private static readonly CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS = 30; // refresh a bit early
+  private static readonly ROLE_ATTRIBUTES_TTL_SECONDS = 24 * 60 * 60; // 24 hours
 
   constructor(
     @Inject(CACHE_MANAGER) private readonly cacheManager: Cache,
     @Inject('AUTH_MIDDLEWARE_OPTIONS')
     private readonly options: AuthMiddlewareOptions
-  ) {}
+  ) { }
 
   // -------------------------
   // Startup: validate licence once, then run a small periodic expiry check
@@ -102,7 +107,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
           server_time: new Date().toISOString(),
           licence_expiry: AuthMiddleware.licenceValidatedUntilMs
             ? new Date(AuthMiddleware.licenceValidatedUntilMs).toISOString()
-            : 'Unknown'
+            : 'Unknown',
         });
       }
 
@@ -135,8 +140,13 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       if (!clientAttributes) {
         const roleObj = await this.getClientRoleAttributes(role, clientToken);
         clientAttributes = JSON.stringify(roleObj.attributes ?? {});
-        // store indefinitely (or you can choose a short TTL)
-        await this.cacheSetSeconds(clientRoleCacheKey, clientAttributes, 0);
+
+        // ✅ Cache with safe TTL
+        await this.cacheSetSeconds(
+          clientRoleCacheKey,
+          clientAttributes,
+          AuthMiddleware.ROLE_ATTRIBUTES_TTL_SECONDS
+        );
       }
 
       // Route access check
@@ -157,11 +167,12 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
 
       req['user'] = {
         role,
-        userName: decoded?.preferred_username
+        userName: decoded?.preferred_username,
       };
 
       return next();
     } catch (error: any) {
+      this.logger.error(`Middleware error: ${error?.message || error}`, error?.stack);
       return res.status(500).json({ message: error?.message || 'Internal error' });
     }
   }
@@ -197,6 +208,8 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     if (AuthMiddleware.shutdownInitiated) return;
     AuthMiddleware.shutdownInitiated = true;
 
+    this.logger.warn('Initiating graceful shutdown due to licence expiry');
+
     // immediate SIGTERM, then force exit after 5s
     setTimeout(() => {
       try {
@@ -206,7 +219,10 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       }
 
       if (!AuthMiddleware.shutdownTimer) {
-        AuthMiddleware.shutdownTimer = setTimeout(() => process.exit(1), 5000);
+        AuthMiddleware.shutdownTimer = setTimeout(() => {
+          this.logger.error('Force exit after SIGTERM timeout');
+          process.exit(1);
+        }, 5000);
       }
     }, 0);
   }
@@ -236,12 +252,21 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
         const cachedToken = (await this.cacheManager.get('client_Licence_token')) as string | undefined;
         if (cachedToken) {
           const ok = await this.validateLicence(cachedToken, publicKey, false);
-          if (ok) return true;
+          if (ok) {
+            this.logger.log('Licence validated from cache');
+            return true;
+          }
         }
 
         // 2) Fetch from licensing service
+        this.logger.log('Fetching licence from service');
         const token = await this.getLicencingTokenFromService(realm);
         const ok = await this.validateLicence(token, publicKey, true);
+
+        if (ok) {
+          this.logger.log('Licence validated from service');
+        }
+
         return ok;
       })();
 
@@ -251,7 +276,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
         AuthMiddleware.licenceValidationPromise = null;
       }
     } catch (e: any) {
-      this.logger.warn(`checkLicenceAndValidate failed: ${e?.message || e}`);
+      this.logger.error(`checkLicenceAndValidate failed: ${e?.message || e}`, e?.stack);
       return false;
     }
   }
@@ -281,6 +306,11 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       // ✅ Save only the timestamp (supports 50 days / 500 days / years)
       AuthMiddleware.licenceValidatedUntilMs = licEndMs;
 
+      const daysUntilExpiry = Math.floor((licEndMs - now) / (1000 * 60 * 60 * 24));
+      this.logger.log(
+        `Licence valid until ${new Date(licEndMs).toISOString()} (${daysUntilExpiry} days remaining)`
+      );
+
       // ✅ Cache only briefly (avoid long TTL -> avoids TimeoutOverflowWarning)
       if (updateCache) {
         await this.cacheSetSeconds('client_Licence_token', tokenJwt, AuthMiddleware.LIC_CACHE_TTL_SECONDS);
@@ -308,18 +338,24 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       'https://iiuuckued274sisadalbpf7ivu0eiblk.lambda-url.ap-south-1.on.aws/';
 
     const body = { client_name: realm };
-    const resp = await axios.post(url, body, { timeout: 15_000 });
 
-    if (resp.status !== HttpStatusCode.Ok) {
-      throw new Error(`Licencing service returned status ${resp.status}`);
-    }
+    try {
+      const resp = await axios.post(url, body, { timeout: 15_000 });
 
-    const token = resp?.data?.token;
-    if (!token || typeof token !== 'string') {
-      throw new Error('Licencing service response missing token');
-    }
+      if (resp.status !== HttpStatusCode.Ok) {
+        throw new Error(`Licencing service returned status ${resp.status}`);
+      }
 
-    return token;
+      const token = resp?.data?.token;
+      if (!token || typeof token !== 'string') {
+        throw new Error('Licencing service response missing token');
+      }
+
+      return token;
+    } catch (e: any) {
+      this.logger.error(`Failed to fetch licence from service: ${e?.message || e}`);
+      throw e;
+    }
   }
 
   // -------------------------
@@ -352,7 +388,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       new URLSearchParams({
         grant_type: 'client_credentials',
         client_id: clientId,
-        client_secret: clientSecret
+        client_secret: clientSecret,
       }).toString(),
       { headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, timeout: 15_000 }
     );
@@ -385,7 +421,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     return jwt.verify(token, publicKeys, {
       algorithms: ['RS256'],
       ignoreExpiration: true,
-      clockTolerance: 60
+      clockTolerance: 60,
     });
   }
 
@@ -395,7 +431,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
 
     return jwt.verify(token, publicKeys, {
       algorithms: ['RS256'],
-      clockTolerance: 60
+      clockTolerance: 60,
     });
   }
 
@@ -417,19 +453,109 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   }
 
   // -------------------------
-  // Cache helper (seconds-based, safe across stores)
-  // - Using seconds avoids ms/sec mismatch across cache-manager stores
-  // - TTL is kept small so no overflow even if a store uses Node timers
+  // ✅ ULTIMATE FIX: Cache helper with COMPLETE OVERFLOW PROTECTION
+  // -------------------------
+  // Works with ANY cache-manager version and ANY cache store
+  // Prevents cache stores from calculating TTL from JWT claims
   // -------------------------
   private async cacheSetSeconds(key: string, value: any, ttlSeconds: number) {
-    // ttlSeconds=0 => store forever (supported by many stores); if not, we just set without ttl
-    if (!ttlSeconds || ttlSeconds <= 0) {
-      await (this.cacheManager.set as any)(key, value);
-      return;
-    }
+    try {
+      // ttlSeconds=0 => store forever (no expiry)
+      if (!ttlSeconds || ttlSeconds <= 0) {
+        await this.cacheManager.set(key, value);
+        this.logger.debug(`Cache set (no TTL): ${key}`);
+        return;
+      }
+
+      // ✅ CRITICAL: Clamp TTL to prevent overflow
+      let safeTtlSeconds = ttlSeconds;
+      if (ttlSeconds > AuthMiddleware.MAX_SAFE_TTL_SECONDS) {
+        safeTtlSeconds = AuthMiddleware.MAX_SAFE_TTL_SECONDS;
+        this.logger.warn(
+          `Cache TTL clamped: key=${key}, requested=${ttlSeconds}s (~${Math.floor(ttlSeconds / 86400)} days), using=${safeTtlSeconds}s (~24 days)`
+        );
+      }
 
-    // cache-manager / Nest stores vary: some accept third param number, others accept { ttl }
-    // We use { ttl } for better compatibility, and TTL is small anyway.
-    await (this.cacheManager.set as any)(key, value, { ttl: ttlSeconds });
+      // Convert to milliseconds
+      const ttlMs = safeTtlSeconds * 1000;
+
+      // ✅ CRITICAL: Double-check we're not exceeding the limit
+      // This catches any edge cases where ttlMs might still overflow
+      const finalTtlMs = Math.min(ttlMs, AuthMiddleware.MAX_SAFE_TTL_MS);
+
+      if (finalTtlMs !== ttlMs) {
+        this.logger.warn(`TTL further clamped: ${ttlMs}ms -> ${finalTtlMs}ms`);
+      }
+
+      // ✅ Try multiple methods to ensure compatibility with all cache stores
+      let cacheSetSuccess = false;
+      let lastError: any = null;
+
+      // Method 1: Modern cache-manager v5+ (TTL in milliseconds as 3rd param)
+      if (!cacheSetSuccess) {
+        try {
+          await this.cacheManager.set(key, value, finalTtlMs);
+          cacheSetSuccess = true;
+          this.logger.debug(`Cache set (v5 format): ${key} (TTL: ${safeTtlSeconds}s / ${finalTtlMs}ms)`);
+        } catch (err: any) {
+          lastError = err;
+          // Try next method
+        }
+      }
+
+      // Method 2: Object-based TTL (milliseconds) - some stores
+      if (!cacheSetSuccess) {
+        try {
+          await (this.cacheManager as any).set(key, value, { ttl: finalTtlMs });
+          cacheSetSuccess = true;
+          this.logger.debug(`Cache set (object ms format): ${key} (TTL: ${finalTtlMs}ms)`);
+        } catch (err: any) {
+          lastError = err;
+          // Try next method
+        }
+      }
+
+      // Method 3: Object-based TTL (seconds) - Redis and others
+      if (!cacheSetSuccess) {
+        try {
+          await (this.cacheManager as any).set(key, value, { ttl: safeTtlSeconds });
+          cacheSetSuccess = true;
+          this.logger.debug(`Cache set (object sec format): ${key} (TTL: ${safeTtlSeconds}s)`);
+        } catch (err: any) {
+          lastError = err;
+          // Try next method
+        }
+      }
+
+      // Method 4: Direct store access (for Redis stores)
+      if (!cacheSetSuccess) {
+        try {
+          const store = (this.cacheManager as any).store;
+          const redisClient = store?.client || store?.getClient?.();
+
+          if (redisClient && typeof redisClient.set === 'function') {
+            // Redis native command: SET key value EX seconds
+            await redisClient.set(key, value, { EX: safeTtlSeconds });
+            cacheSetSuccess = true;
+            this.logger.debug(`Cache set (Redis direct): ${key} (EX: ${safeTtlSeconds}s)`);
+          }
+        } catch (err: any) {
+          lastError = err;
+          // Continue to fallback
+        }
+      }
+
+      // Method 5: Fallback - cache without TTL (better than failing)
+      if (!cacheSetSuccess) {
+        this.logger.warn(`All TTL methods failed for key=${key}, caching without TTL. Last error: ${lastError?.message}`);
+        await this.cacheManager.set(key, value);
+        this.logger.debug(`Cache set (no TTL fallback): ${key}`);
+      }
+
+    } catch (e: any) {
+      // Even if all methods fail, don't crash the app
+      this.logger.error(`Cache set completely failed for key=${key}: ${e?.message || e}`, e?.stack);
+      // Cache failures are non-fatal - log and continue
+    }
   }
 }