dms-middleware-auth 1.2.0 → 1.2.2

package/dist/auth.middleware.d.ts

@@ -22,6 +22,7 @@ export declare class AuthMiddleware implements NestMiddleware, OnModuleInit {
     private static shutdownTimer;
     private static licenceExpiryInterval;
     private static readonly licenceExpiredMessage;
+    private static readonly licenceValidationFailedMessage;
     private static readonly CLOCK_TOLERANCE_MS;
     private static readonly LIC_CACHE_TTL_SECONDS;
     private static readonly CLIENT_TOKEN_TTL_MAX_SECONDS;
@@ -37,7 +38,6 @@ export declare class AuthMiddleware implements NestMiddleware, OnModuleInit {
     private checkLicenceAndValidate;
     private validateLicence;
     private getLicencingTokenFromService;
-    private getOrFetchClientAccessToken;
     private clientLogin;
     private getClientRoleAttributes;
     private verifyLicenceJwt;
@@ -45,5 +45,8 @@ export declare class AuthMiddleware implements NestMiddleware, OnModuleInit {
     private extractBearerToken;
     private normalizeEpochMs;
     private cacheSetSeconds;
+    private cacheGetIfFresh;
+    private isCacheEnvelope;
+    private normalizeTtlSeconds;
 }
 export {};

package/dist/auth.middleware.js

@@ -82,7 +82,9 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
     // -------------------------
     async use(req, res, next) {
         try {
-            // ✅ Production-safe: enforce expiry by timestamp compare, not long setTimeout
+            // Validate licence for this request; fast path returns from in-memory state.
+            const licenceOk = await this.checkLicenceAndValidate(this.options.realm, this.options.publicKey);
+            // Production-safe: enforce expiry by timestamp compare, not long setTimeout
             this.enforceLicenceExpiry();
             if (AuthMiddleware_1.licenceExpired) {
                 // In EKS, letting the pod terminate is fine; K8s restarts/rolls
@@ -95,39 +97,64 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
                         : 'Unknown',
                 });
             }
+            // Fail closed when licence could not be validated for this request.
+            if (!licenceOk || !AuthMiddleware_1.licenceValidatedUntilMs) {
+                return res.status(axios_1.HttpStatusCode.Forbidden).json({
+                    message: AuthMiddleware_1.licenceValidationFailedMessage,
+                    server_time: new Date().toISOString(),
+                });
+            }
+            if (req.originalUrl == this.options.bypassURL) {
+                return next();
+            }
             const authHeader = req.headers['authorization'];
             if (!authHeader || !authHeader.startsWith('Bearer ')) {
                 return res.status(401).json({ message: 'Bearer token required' });
             }
             const decoded = this.decodeAccessToken(authHeader, this.options.publicKey);
-            const clientToken = await this.getOrFetchClientAccessToken();
+            // Read client token from app-managed cache envelope (no native store TTL timer).
+            let clientToken = await this.cacheGetIfFresh('client_access_token');
+            if (!clientToken) {
+                clientToken = await this.clientLogin();
+                const decodedToken = jwt.decode(clientToken);
+                const nowSec = Math.floor(Date.now() / 1000);
+                const expSec = Number(decodedToken?.exp || 0);
+                // Clamp to 1 hour max to avoid stale token usage.
+                let ttlSec = expSec - nowSec - AuthMiddleware_1.CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS;
+                if (!Number.isFinite(ttlSec) || ttlSec <= 0)
+                    ttlSec = 60;
+                ttlSec = Math.min(Math.max(60, ttlSec), AuthMiddleware_1.CLIENT_TOKEN_TTL_MAX_SECONDS);
+                await this.cacheSetSeconds('client_access_token', clientToken, ttlSec);
+            }
             const role = decoded?.resource_access?.[this.options.clientId]?.roles?.[0];
             if (!role) {
                 return res.status(403).json({ message: 'Role not found for client' });
             }
-            const clientRoleCacheKey = `${this.options.clientId}${role}`;
-            let clientAttributes = await this.cacheManager.get(clientRoleCacheKey);
+            const clientRoleName = `${this.options.clientId + role}`;
+            let clientAttributes = await this.cacheGetIfFresh(clientRoleName);
             if (!clientAttributes) {
-                const roleObj = await this.getClientRoleAttributes(role, clientToken);
-                clientAttributes = JSON.stringify(roleObj.attributes ?? {});
-                // ✅ Cache with 24-hour TTL
-                await this.cacheSetSeconds(clientRoleCacheKey, clientAttributes, AuthMiddleware_1.ROLE_ATTRIBUTES_TTL_SECONDS);
+                clientAttributes = await this.getClientRoleAttributes(role, clientToken);
+                clientAttributes = JSON.stringify(clientAttributes.attributes);
+                await this.cacheSetSeconds(clientRoleName, clientAttributes, AuthMiddleware_1.ROLE_ATTRIBUTES_TTL_SECONDS);
             }
-            const attrs = JSON.parse(clientAttributes);
-            if (!attrs[req.originalUrl]) {
+            // Check route access
+            clientAttributes = JSON.parse(clientAttributes);
+            if (!clientAttributes[req.originalUrl]) {
                 return res.status(403).json({ message: 'Access denied for this route' });
             }
-            const apiPermission = JSON.parse(attrs[req.originalUrl]);
-            if (apiPermission?.params === 'true') {
-                const event = req?.body?.event;
-                const url = `${req.originalUrl}?action=${event}`;
-                if (!attrs[url]) {
-                    return res.status(403).json({ message: 'Access denied for event' });
+            else {
+                const apiPermission = JSON.parse(clientAttributes[req.originalUrl]);
+                if (apiPermission?.params === "true") {
+                    const event = req?.body?.event;
+                    const url = req?.originalUrl + `?action=${event}`;
+                    if (!clientAttributes[url]) {
+                        return res.status(403).json({ message: 'Access denied for event' });
+                    }
                 }
             }
             req['user'] = {
-                role,
-                userName: decoded?.preferred_username,
+                role: role,
+                userName: decoded.preferred_username
             };
             return next();
         }
@@ -146,15 +173,20 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             return;
         const now = Date.now();
         if (now >= AuthMiddleware_1.licenceValidatedUntilMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) {
-            this.markLicenceExpired();
+            this.markLicenceExpired(AuthMiddleware_1.licenceValidatedUntilMs, 'licence end time reached');
         }
     }
-    markLicenceExpired() {
+    markLicenceExpired(expiredAtMs, reason) {
+        if (Number.isFinite(expiredAtMs) && Number(expiredAtMs) > 0) {
+            AuthMiddleware_1.licenceValidatedUntilMs = Number(expiredAtMs);
+        }
         if (!AuthMiddleware_1.licenceExpired) {
             AuthMiddleware_1.licenceExpired = true;
-            this.logger.error(`Licence expired at ${AuthMiddleware_1.licenceValidatedUntilMs
+            const expiryText = AuthMiddleware_1.licenceValidatedUntilMs
                 ? new Date(AuthMiddleware_1.licenceValidatedUntilMs).toISOString()
-                : 'unknown'}`);
+                : 'unknown';
+            const reasonText = reason ? ` (reason: ${reason})` : '';
+            this.logger.error(`Licence expired at ${expiryText}${reasonText}`);
         }
     }
     // -------------------------
@@ -188,9 +220,13 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         try {
             if (AuthMiddleware_1.licenceExpired)
                 return false;
-            // If we already have an expiry and it's still valid, no need to fetch again
-            if (AuthMiddleware_1.licenceValidatedUntilMs &&
-                Date.now() < AuthMiddleware_1.licenceValidatedUntilMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) {
+            // If we already have an expiry in memory, decide immediately.
+            if (AuthMiddleware_1.licenceValidatedUntilMs) {
+                const now = Date.now();
+                if (now >= AuthMiddleware_1.licenceValidatedUntilMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) {
+                    this.markLicenceExpired(AuthMiddleware_1.licenceValidatedUntilMs, 'in-memory licence already expired');
+                    return false;
+                }
                 return true;
             }
             // De-duplicate concurrent validations
@@ -199,7 +235,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             }
             AuthMiddleware_1.licenceValidationPromise = (async () => {
                 // 1) Try cache first (short TTL)
-                const cachedToken = (await this.cacheManager.get('client_Licence_token'));
+                const cachedToken = await this.cacheGetIfFresh('client_Licence_token');
                 if (cachedToken) {
                     const ok = await this.validateLicence(cachedToken, publicKey, realm, this.options.keycloakUrl, false);
                     if (ok) {
@@ -230,18 +266,29 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
     }
     async validateLicence(tokenJwt, publicKey, realm, keycloakUrl, updateCache) {
         try {
+            const isAuthoritativeToken = updateCache;
             const payload = this.verifyLicenceJwt(tokenJwt, publicKey, realm, keycloakUrl);
             // Your custom claim: lic_end
             const licEndMs = this.normalizeEpochMs(payload?.lic_end);
             const now = Date.now();
             if (!licEndMs) {
-                this.logger.error('Licence token missing lic_end');
-                this.markLicenceExpired();
+                if (isAuthoritativeToken) {
+                    this.logger.error('Licence token missing lic_end');
+                    this.markLicenceExpired(null, 'authoritative token missing lic_end');
+                }
+                else {
+                    this.logger.warn('Cached licence token missing lic_end, refetching from service');
+                }
                 return false;
             }
             if (now >= licEndMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) {
-                this.logger.error(`Licence already expired. lic_end=${new Date(licEndMs).toISOString()} now=${new Date(now).toISOString()}`);
-                this.markLicenceExpired();
+                if (isAuthoritativeToken) {
+                    this.logger.error(`Licence already expired. lic_end=${new Date(licEndMs).toISOString()} now=${new Date(now).toISOString()}`);
+                    this.markLicenceExpired(licEndMs, 'authoritative token already expired');
+                }
+                else {
+                    this.logger.warn(`Cached licence token expired. lic_end=${new Date(licEndMs).toISOString()} now=${new Date(now).toISOString()}`);
+                }
                 return false;
             }
             // ✅ Save only the timestamp (supports 50 days / 500 days / years)
@@ -255,11 +302,17 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             return true;
         }
         catch (e) {
+            const isAuthoritativeToken = updateCache;
             // If JWT invalid, expire
             const name = e?.name || '';
             if (name === 'JsonWebTokenError' || name === 'TokenExpiredError' || name === 'NotBeforeError') {
-                this.logger.error(`Invalid licence token: ${e?.message || e}`);
-                this.markLicenceExpired();
+                if (isAuthoritativeToken) {
+                    this.logger.error(`Invalid licence token: ${e?.message || e}`);
+                    this.markLicenceExpired(null, `authoritative token invalid (${name})`);
+                }
+                else {
+                    this.logger.warn(`Cached licence token invalid, refetching from service: ${e?.message || e}`);
+                }
                 return false;
             }
             // transient failures should not hard-expire immediately
@@ -287,25 +340,6 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             throw e;
         }
     }
-    // -------------------------
-    // Keycloak client token caching (safe TTL)
-    // -------------------------
-    async getOrFetchClientAccessToken() {
-        let token = (await this.cacheManager.get('client_access_token'));
-        if (token)
-            return token;
-        token = await this.clientLogin();
-        const decoded = jwt.decode(token);
-        const nowSec = Math.floor(Date.now() / 1000);
-        const expSec = Number(decoded?.exp || 0);
-        // ttl seconds: refresh early, clamp to [60, 3600]
-        let ttlSec = expSec - nowSec - AuthMiddleware_1.CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS;
-        if (!Number.isFinite(ttlSec) || ttlSec <= 0)
-            ttlSec = 60;
-        ttlSec = Math.min(Math.max(60, ttlSec), AuthMiddleware_1.CLIENT_TOKEN_TTL_MAX_SECONDS);
-        await this.cacheSetSeconds('client_access_token', token, ttlSec);
-        return token;
-    }
     async clientLogin() {
         const { keycloakUrl, realm, clientId, clientSecret } = this.options;
         const resp = await axios_1.default.post(`${keycloakUrl}/realms/${realm}/protocol/openid-connect/token`, new URLSearchParams({
@@ -329,10 +363,8 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
     // -------------------------
     verifyLicenceJwt(token, publicKey, realm, keycloakUrl) {
         const publicKeys = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`;
-        const issuer = `${keycloakUrl}/realms/${realm}`;
         return jwt.verify(token, publicKeys, {
             algorithms: ['RS256'],
-            issuer,
             clockTolerance: 60,
         });
     }
@@ -363,18 +395,54 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
     // -------------------------
     // Cache helper with overflow protection
     // -------------------------
-    async cacheSetSeconds(key, value, _ttlSeconds) {
+    async cacheSetSeconds(key, value, ttlSeconds) {
         try {
-            // Force a consistent one-day TTL in seconds; clamp to avoid 32-bit timer overflow even if a store multiplies by 1000
-            // Use a simple, safe 24-hour TTL; 86,400s (86,400,000ms if misread as ms) is far below the Node timer limit.
-            const ttlSeconds = AuthMiddleware_1.LIC_CACHE_TTL_SECONDS; // 24 * 60 * 60
-            await this.cacheManager.set(key, value, ttlSeconds);
-            this.logger.debug(`Cache set: ${key} (TTL: ${ttlSeconds}s)`);
+            const safeTtlSeconds = this.normalizeTtlSeconds(ttlSeconds);
+            const envelope = {
+                value,
+                expiresAtMs: Date.now() + safeTtlSeconds * 1000,
+            };
+            // Do not use native store TTL; some stores map TTL to long setTimeout internally.
+            await this.cacheManager.set(key, envelope);
+            this.logger.debug(`Cache set: ${key} (TTL: ${safeTtlSeconds}s)`);
         }
         catch (e) {
             this.logger.error(`Cache set failed for key=${key}: ${e?.message || e}`, e?.stack);
         }
     }
+    async cacheGetIfFresh(key) {
+        try {
+            const cached = (await this.cacheManager.get(key));
+            if (!cached)
+                return undefined;
+            // Backward compatibility for entries written before envelope format.
+            if (!this.isCacheEnvelope(cached)) {
+                return cached;
+            }
+            if (Date.now() >= cached.expiresAtMs) {
+                await this.cacheManager.del(key);
+                this.logger.debug(`Cache expired: ${key}`);
+                return undefined;
+            }
+            return cached.value;
+        }
+        catch (e) {
+            this.logger.warn(`Cache get failed for key=${key}: ${e?.message || e}`);
+            return undefined;
+        }
+    }
+    isCacheEnvelope(value) {
+        if (!value || typeof value !== 'object')
+            return false;
+        const v = value;
+        return Number.isFinite(v.expiresAtMs) && Object.prototype.hasOwnProperty.call(v, 'value');
+    }
+    normalizeTtlSeconds(ttlSeconds) {
+        if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {
+            return AuthMiddleware_1.ONE_DAY_SECONDS;
+        }
+        return Math.floor(ttlSeconds);
+    }
 };
 exports.AuthMiddleware = AuthMiddleware;
 // ---- Global-ish state (process-wide) ----
@@ -386,6 +454,7 @@ AuthMiddleware.shutdownTimer = null;
 AuthMiddleware.licenceExpiryInterval = null;
 // ---- Constants ----
 AuthMiddleware.licenceExpiredMessage = 'Server Licence is expired! Please renew';
+AuthMiddleware.licenceValidationFailedMessage = 'Server licence validation failed. Please try again.';
 // Allow small clock drift
 AuthMiddleware.CLOCK_TOLERANCE_MS = 60_000; // 1 minute
 // Cache TTLs (safe by design; prevents timer overflow)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dms-middleware-auth",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Reusable middleware for authentication and authorization in NestJS applications.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth.middleware.ts

@@ -24,6 +24,11 @@ interface AuthMiddlewareOptions {
   licenceServiceUrl?: string;
 }
 
+interface CacheEnvelope<T> {
+  value: T;
+  expiresAtMs: number;
+}
+
 @Injectable()
 export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   private readonly logger = new Logger('AuthMiddleware');
@@ -41,6 +46,8 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   // ---- Constants ----
   private static readonly licenceExpiredMessage =
     'Server Licence is expired! Please renew';
+  private static readonly licenceValidationFailedMessage =
+    'Server licence validation failed. Please try again.';
 
   // Allow small clock drift
   private static readonly CLOCK_TOLERANCE_MS = 60_000; // 1 minute
@@ -85,7 +92,13 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   // -------------------------
   async use(req: any, res: Response, next: NextFunction) {
     try {
-      // ✅ Production-safe: enforce expiry by timestamp compare, not long setTimeout
+      // Validate licence for this request; fast path returns from in-memory state.
+      const licenceOk = await this.checkLicenceAndValidate(
+        this.options.realm,
+        this.options.publicKey
+      );
+
+      // Production-safe: enforce expiry by timestamp compare, not long setTimeout
       this.enforceLicenceExpiry();
 
       if (AuthMiddleware.licenceExpired) {
@@ -100,6 +113,17 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
         });
       }
 
+      // Fail closed when licence could not be validated for this request.
+      if (!licenceOk || !AuthMiddleware.licenceValidatedUntilMs) {
+        return res.status(HttpStatusCode.Forbidden).json({
+          message: AuthMiddleware.licenceValidationFailedMessage,
+          server_time: new Date().toISOString(),
+        });
+      }
+
+      if (req.originalUrl == this.options.bypassURL) {
+        return next();
+      }
       const authHeader = req.headers['authorization'];
       if (!authHeader || !authHeader.startsWith('Bearer ')) {
         return res.status(401).json({ message: 'Bearer token required' });
@@ -107,48 +131,63 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
 
       const decoded: any = this.decodeAccessToken(authHeader, this.options.publicKey);
 
-      const clientToken = await this.getOrFetchClientAccessToken();
+      // Read client token from app-managed cache envelope (no native store TTL timer).
+      let clientToken = await this.cacheGetIfFresh<string>('client_access_token');
+      if (!clientToken) {
+        clientToken = await this.clientLogin();
+        const decodedToken: any = jwt.decode(clientToken);
+        const nowSec = Math.floor(Date.now() / 1000);
+        const expSec = Number(decodedToken?.exp || 0);
+
+        // Clamp to 1 hour max to avoid stale token usage.
+        let ttlSec = expSec - nowSec - AuthMiddleware.CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS;
+        if (!Number.isFinite(ttlSec) || ttlSec <= 0) ttlSec = 60;
+        ttlSec = Math.min(Math.max(60, ttlSec), AuthMiddleware.CLIENT_TOKEN_TTL_MAX_SECONDS);
+
+        await this.cacheSetSeconds('client_access_token', clientToken, ttlSec);
+      }
+
+
+
       const role = decoded?.resource_access?.[this.options.clientId]?.roles?.[0];
 
       if (!role) {
         return res.status(403).json({ message: 'Role not found for client' });
       }
 
-      const clientRoleCacheKey = `${this.options.clientId}${role}`;
-      let clientAttributes: any = await this.cacheManager.get(clientRoleCacheKey);
-
+      const clientRoleName = `${this.options.clientId + role}`;
+      let clientAttributes: any = await this.cacheGetIfFresh<string>(clientRoleName);
       if (!clientAttributes) {
-        const roleObj = await this.getClientRoleAttributes(role, clientToken);
-        clientAttributes = JSON.stringify(roleObj.attributes ?? {});
-
-        // ✅ Cache with 24-hour TTL
+        clientAttributes = await this.getClientRoleAttributes(role, clientToken);
+        clientAttributes = JSON.stringify(clientAttributes.attributes);
         await this.cacheSetSeconds(
-          clientRoleCacheKey,
+          clientRoleName,
           clientAttributes,
           AuthMiddleware.ROLE_ATTRIBUTES_TTL_SECONDS
         );
       }
-
-      const attrs = JSON.parse(clientAttributes);
-      if (!attrs[req.originalUrl]) {
+ // Check route access
+      clientAttributes = JSON.parse(clientAttributes);
+      if (!clientAttributes[req.originalUrl]) {
         return res.status(403).json({ message: 'Access denied for this route' });
-      }
-
-      const apiPermission = JSON.parse(attrs[req.originalUrl]);
-      if (apiPermission?.params === 'true') {
-        const event = req?.body?.event;
-        const url = `${req.originalUrl}?action=${event}`;
-        if (!attrs[url]) {
-          return res.status(403).json({ message: 'Access denied for event' });
+      } else {
+        const apiPermission = JSON.parse(clientAttributes[req.originalUrl]);
+        if (apiPermission?.params === "true") {
+          const event = req?.body?.event;
+          const url = req?.originalUrl + `?action=${event}`;
+          if (!clientAttributes[url]) {
+            return res.status(403).json({ message: 'Access denied for event' });
+          }
         }
       }
-
+   
       req['user'] = {
-        role,
-        userName: decoded?.preferred_username,
+        role: role,
+        userName: decoded.preferred_username
       };
 
       return next();
+
     } catch (error: any) {
       this.logger.error(`Middleware error: ${error?.message || error}`, error?.stack);
       return res.status(500).json({ message: error?.message || 'Internal error' });
@@ -162,22 +201,31 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     if (AuthMiddleware.licenceExpired) return;
     if (!AuthMiddleware.licenceValidatedUntilMs) return;
 
-    const now = Date.now();
-    if (now >= AuthMiddleware.licenceValidatedUntilMs + AuthMiddleware.CLOCK_TOLERANCE_MS) {
-      this.markLicenceExpired();
-    }
-  }
-
-  private markLicenceExpired() {
-    if (!AuthMiddleware.licenceExpired) {
-      AuthMiddleware.licenceExpired = true;
-      this.logger.error(
-        `Licence expired at ${AuthMiddleware.licenceValidatedUntilMs
-          ? new Date(AuthMiddleware.licenceValidatedUntilMs).toISOString()
-          : 'unknown'}`
-      );
-    }
-  }
+    const now = Date.now();
+    if (now >= AuthMiddleware.licenceValidatedUntilMs + AuthMiddleware.CLOCK_TOLERANCE_MS) {
+      this.markLicenceExpired(
+        AuthMiddleware.licenceValidatedUntilMs,
+        'licence end time reached'
+      );
+    }
+  }
+
+  private markLicenceExpired(expiredAtMs?: number | null, reason?: string) {
+    if (Number.isFinite(expiredAtMs) && Number(expiredAtMs) > 0) {
+      AuthMiddleware.licenceValidatedUntilMs = Number(expiredAtMs);
+    }
+
+    if (!AuthMiddleware.licenceExpired) {
+      AuthMiddleware.licenceExpired = true;
+      const expiryText = AuthMiddleware.licenceValidatedUntilMs
+        ? new Date(AuthMiddleware.licenceValidatedUntilMs).toISOString()
+        : 'unknown';
+      const reasonText = reason ? ` (reason: ${reason})` : '';
+      this.logger.error(
+        `Licence expired at ${expiryText}${reasonText}`
+      );
+    }
+  }
 
   // -------------------------
   // Graceful shutdown for EKS
@@ -212,12 +260,17 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     try {
       if (AuthMiddleware.licenceExpired) return false;
 
-      // If we already have an expiry and it's still valid, no need to fetch again
-      if (
-        AuthMiddleware.licenceValidatedUntilMs &&
-        Date.now() < AuthMiddleware.licenceValidatedUntilMs + AuthMiddleware.CLOCK_TOLERANCE_MS
-      ) {
-        return true;
+      // If we already have an expiry in memory, decide immediately.
+      if (AuthMiddleware.licenceValidatedUntilMs) {
+        const now = Date.now();
+        if (now >= AuthMiddleware.licenceValidatedUntilMs + AuthMiddleware.CLOCK_TOLERANCE_MS) {
+          this.markLicenceExpired(
+            AuthMiddleware.licenceValidatedUntilMs,
+            'in-memory licence already expired'
+          );
+          return false;
+        }
+        return true;
       }
 
       // De-duplicate concurrent validations
@@ -227,7 +280,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
 
       AuthMiddleware.licenceValidationPromise = (async () => {
         // 1) Try cache first (short TTL)
-        const cachedToken = (await this.cacheManager.get('client_Licence_token')) as string | undefined;
+        const cachedToken = await this.cacheGetIfFresh<string>('client_Licence_token');
         if (cachedToken) {
           const ok = await this.validateLicence(cachedToken, publicKey, realm, this.options.keycloakUrl, false);
           if (ok) {
@@ -267,6 +320,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     updateCache: boolean
   ): Promise<boolean> {
     try {
+      const isAuthoritativeToken = updateCache;
       const payload: any = this.verifyLicenceJwt(tokenJwt, publicKey, realm, keycloakUrl);
 
       // Your custom claim: lic_end
@@ -274,16 +328,26 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       const now = Date.now();
 
       if (!licEndMs) {
-        this.logger.error('Licence token missing lic_end');
-        this.markLicenceExpired();
+        if (isAuthoritativeToken) {
+          this.logger.error('Licence token missing lic_end');
+          this.markLicenceExpired(null, 'authoritative token missing lic_end');
+        } else {
+          this.logger.warn('Cached licence token missing lic_end, refetching from service');
+        }
         return false;
       }
 
       if (now >= licEndMs + AuthMiddleware.CLOCK_TOLERANCE_MS) {
-        this.logger.error(
-          `Licence already expired. lic_end=${new Date(licEndMs).toISOString()} now=${new Date(now).toISOString()}`
-        );
-        this.markLicenceExpired();
+        if (isAuthoritativeToken) {
+          this.logger.error(
+            `Licence already expired. lic_end=${new Date(licEndMs).toISOString()} now=${new Date(now).toISOString()}`
+          );
+          this.markLicenceExpired(licEndMs, 'authoritative token already expired');
+        } else {
+          this.logger.warn(
+            `Cached licence token expired. lic_end=${new Date(licEndMs).toISOString()} now=${new Date(now).toISOString()}`
+          );
+        }
         return false;
       }
 
@@ -302,11 +366,16 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
 
       return true;
     } catch (e: any) {
+      const isAuthoritativeToken = updateCache;
       // If JWT invalid, expire
       const name = e?.name || '';
       if (name === 'JsonWebTokenError' || name === 'TokenExpiredError' || name === 'NotBeforeError') {
-        this.logger.error(`Invalid licence token: ${e?.message || e}`);
-        this.markLicenceExpired();
+        if (isAuthoritativeToken) {
+          this.logger.error(`Invalid licence token: ${e?.message || e}`);
+          this.markLicenceExpired(null, `authoritative token invalid (${name})`);
+        } else {
+          this.logger.warn(`Cached licence token invalid, refetching from service: ${e?.message || e}`);
+        }
         return false;
       }
 
@@ -342,27 +411,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     }
   }
 
-  // -------------------------
-  // Keycloak client token caching (safe TTL)
-  // -------------------------
-  private async getOrFetchClientAccessToken(): Promise<string> {
-    let token = (await this.cacheManager.get('client_access_token')) as string | undefined;
-    if (token) return token;
-
-    token = await this.clientLogin();
-
-    const decoded: any = jwt.decode(token);
-    const nowSec = Math.floor(Date.now() / 1000);
-    const expSec = Number(decoded?.exp || 0);
-
-    // ttl seconds: refresh early, clamp to [60, 3600]
-    let ttlSec = expSec - nowSec - AuthMiddleware.CLIENT_TOKEN_TTL_SAFETY_SKEW_SECONDS;
-    if (!Number.isFinite(ttlSec) || ttlSec <= 0) ttlSec = 60;
-    ttlSec = Math.min(Math.max(60, ttlSec), AuthMiddleware.CLIENT_TOKEN_TTL_MAX_SECONDS);
-
-    await this.cacheSetSeconds('client_access_token', token, ttlSec);
-    return token;
-  }
+ 
 
   private async clientLogin(): Promise<string> {
     const { keycloakUrl, realm, clientId, clientSecret } = this.options;
@@ -401,11 +450,8 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   private verifyLicenceJwt(token: string, publicKey: string, realm: string, keycloakUrl: string) {
     const publicKeys = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`;
 
-    const issuer = `${keycloakUrl}/realms/${realm}`;
-
     return jwt.verify(token, publicKeys, {
       algorithms: ['RS256'],
-      issuer,
       clockTolerance: 60,
     });
   }
@@ -440,15 +486,55 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   // -------------------------
   // Cache helper with overflow protection
   // -------------------------
-  private async cacheSetSeconds(key: string, value: any, _ttlSeconds: number) {
+  private async cacheSetSeconds(key: string, value: any, ttlSeconds: number) {
     try {
-      // Force a consistent one-day TTL in seconds; clamp to avoid 32-bit timer overflow even if a store multiplies by 1000
-      // Use a simple, safe 24-hour TTL; 86,400s (86,400,000ms if misread as ms) is far below the Node timer limit.
-      const ttlSeconds = AuthMiddleware.LIC_CACHE_TTL_SECONDS; // 24 * 60 * 60
-      await this.cacheManager.set(key, value, ttlSeconds);
-      this.logger.debug(`Cache set: ${key} (TTL: ${ttlSeconds}s)`);
+      const safeTtlSeconds = this.normalizeTtlSeconds(ttlSeconds);
+      const envelope: CacheEnvelope<any> = {
+        value,
+        expiresAtMs: Date.now() + safeTtlSeconds * 1000,
+      };
+
+      // Do not use native store TTL; some stores map TTL to long setTimeout internally.
+      await this.cacheManager.set(key, envelope as any);
+      this.logger.debug(`Cache set: ${key} (TTL: ${safeTtlSeconds}s)`);
     } catch (e: any) {
       this.logger.error(`Cache set failed for key=${key}: ${e?.message || e}`, e?.stack);
     }
   }
+
+  private async cacheGetIfFresh<T>(key: string): Promise<T | undefined> {
+    try {
+      const cached = (await this.cacheManager.get(key)) as CacheEnvelope<T> | T | undefined;
+      if (!cached) return undefined;
+
+      // Backward compatibility for entries written before envelope format.
+      if (!this.isCacheEnvelope(cached)) {
+        return cached as T;
+      }
+
+      if (Date.now() >= cached.expiresAtMs) {
+        await this.cacheManager.del(key);
+        this.logger.debug(`Cache expired: ${key}`);
+        return undefined;
+      }
+
+      return cached.value;
+    } catch (e: any) {
+      this.logger.warn(`Cache get failed for key=${key}: ${e?.message || e}`);
+      return undefined;
+    }
+  }
+
+  private isCacheEnvelope<T>(value: unknown): value is CacheEnvelope<T> {
+    if (!value || typeof value !== 'object') return false;
+    const v = value as CacheEnvelope<T>;
+    return Number.isFinite(v.expiresAtMs) && Object.prototype.hasOwnProperty.call(v, 'value');
+  }
+
+  private normalizeTtlSeconds(ttlSeconds: number): number {
+    if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {
+      return AuthMiddleware.ONE_DAY_SECONDS;
+    }
+    return Math.floor(ttlSeconds);
+  }
 }