duar-auth 1.0.0__py3-none-any.whl

duar_auth/__init__.py

@@ -0,0 +1,30 @@
+from importlib.metadata import version
+
+from duar_auth.auth import RequestAuth, SystemAuth
+from duar_auth.authz import AuthzClient
+from duar_auth.authz_middleware import AuthzMiddleware
+from duar_auth.dependencies import get_token
+from duar_auth.duar import Duar
+from duar_auth.middleware import JWTAuthMiddleware
+from duar_auth.permissions import PermissionClient
+from duar_auth.proxy import create_proxy_router
+from duar_auth.roles import RoleClient
+from duar_auth.types import AuthenticatedUser, DuarError, WorkspaceContext
+
+__version__ = version("duar-auth")
+__all__ = [
+    "AuthenticatedUser",
+    "AuthzClient",
+    "AuthzMiddleware",
+    "JWTAuthMiddleware",
+    "PermissionClient",
+    "RequestAuth",
+    "RoleClient",
+    "Duar",
+    "DuarError",
+    "SystemAuth",
+    "WorkspaceContext",
+    "__version__",
+    "create_proxy_router",
+    "get_token",
+]

duar_auth/_utils.py

@@ -0,0 +1,21 @@
+"""Internal utilities for the Duar SDK."""
+
+import logging
+from urllib.parse import urlparse
+
+_logger = logging.getLogger("duar_auth")
+
+_SAFE_HOSTS = {"localhost", "127.0.0.1", "::1"}
+
+
+def warn_if_insecure(url: str, context: str = "") -> None:
+    """Log a warning if the URL uses plain HTTP on a non-localhost host."""
+    parsed = urlparse(url)
+    if parsed.scheme == "http" and parsed.hostname not in _SAFE_HOSTS:
+        label = f" ({context})" if context else ""
+        _logger.warning(
+            "Duar SDK%s is connecting over plain HTTP to %s. "
+            "Use HTTPS in production to protect tokens and credentials.",
+            label,
+            parsed.hostname,
+        )

duar_auth/auth.py

@@ -0,0 +1,308 @@
+"""Request-scoped auth context that bundles identity with authorization capabilities.
+
+``RequestAuth`` is created once per request by the framework layer (e.g. a FastAPI
+dependency) and can be passed to any layer — including DDD use cases — as a plain
+Python object.  Receivers only need to define a ``Protocol`` matching the
+attributes/methods they use; no SDK import required.
+"""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
+
+from duar_auth.types import AuthenticatedUser, DuarError
+
+if TYPE_CHECKING:
+    from duar_auth.permissions import PermissionClient
+    from duar_auth.roles import RoleClient
+
+
+@dataclass
+class RequestAuth:
+    """Per-request auth context combining user identity with token-backed authorization.
+
+    The raw JWT token is stored privately and never exposed in ``repr``.
+    Authorization methods (``can``, ``check_action``, ``accessible``) use it
+    internally when calling Duar APIs.
+
+    Attributes:
+        user: The authenticated user from JWT claims.
+    """
+
+    user: AuthenticatedUser
+    _token: str = field(repr=False)
+    _permissions: PermissionClient | None = field(default=None, repr=False, compare=False)
+    _roles: RoleClient | None = field(default=None, repr=False, compare=False)
+    _request_cache: dict = field(default_factory=dict, repr=False, compare=False)
+
+    # -- Forwarded identity properties -----------------------------------------
+
+    @property
+    def user_id(self) -> uuid.UUID:
+        return self.user.user_id
+
+    @property
+    def workspace_id(self) -> uuid.UUID:
+        return self.user.workspace_id
+
+    @property
+    def workspace_role(self) -> str:
+        return self.user.workspace_role
+
+    @property
+    def email(self) -> str:
+        return self.user.email
+
+    @property
+    def name(self) -> str:
+        return self.user.name
+
+    @property
+    def groups(self) -> list[uuid.UUID]:
+        return self.user.groups
+
+    @property
+    def org_id(self) -> uuid.UUID | None:
+        return self.user.org_id
+
+    @property
+    def org_slug(self) -> str | None:
+        return self.user.org_slug
+
+    @property
+    def org_is_public(self) -> bool:
+        return self.user.org_is_public
+
+    @property
+    def is_admin(self) -> bool:
+        return self.user.is_admin
+
+    @property
+    def is_editor(self) -> bool:
+        return self.user.is_editor
+
+    def has_role(self, minimum_role: str) -> bool:
+        """Check workspace role hierarchy. No network call."""
+        return self.user.has_role(minimum_role)
+
+    # -- Authorization (token hidden internally) -------------------------------
+
+    async def can(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+        action: str,
+    ) -> bool:
+        """Check entity-level permission via Duar's Zanzibar API.
+
+        Results are deduplicated within the same request — calling ``can()``
+        twice with the same arguments makes only one HTTP call.
+        """
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        key = ("can", resource_type, resource_id, action)
+        if key not in self._request_cache:
+            self._request_cache[key] = await self._permissions.can(self._token, resource_type, resource_id, action)
+        return self._request_cache[key]
+
+    async def check_action(self, action: str) -> bool:
+        """Check RBAC action via Duar's role API.
+
+        Results are deduplicated within the same request.
+        """
+        if self._roles is None:
+            raise DuarError("RoleClient not configured on this RequestAuth")
+        key = ("check_action", action)
+        if key not in self._request_cache:
+            self._request_cache[key] = await self._roles.check_action(self._token, action, self.user.workspace_id)
+        return self._request_cache[key]
+
+    async def accessible(
+        self,
+        resource_type: str,
+        action: str,
+        limit: int | None = None,
+    ) -> tuple[list[uuid.UUID], bool]:
+        """Get accessible resource IDs for list filtering.
+
+        Returns ``(resource_ids, has_full_access)``.  Results are deduplicated
+        within the same request.
+        """
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        key = ("accessible", resource_type, action, limit)
+        if key not in self._request_cache:
+            self._request_cache[key] = await self._permissions.accessible(
+                self._token,
+                resource_type,
+                action,
+                self.user.workspace_id,
+                limit,
+            )
+        return self._request_cache[key]
+
+    async def register_resource(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+        visibility: str = "workspace",
+    ) -> dict:
+        """Register a new resource ACL (uses service key + user context)."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.register_resource(
+            resource_type=resource_type,
+            resource_id=resource_id,
+            workspace_id=self.user.workspace_id,
+            owner_id=self.user.user_id,
+            visibility=visibility,
+        )
+
+    async def share(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+        grantee_type: str,
+        grantee_id: uuid.UUID,
+        permission: str = "view",
+    ) -> dict:
+        """Share a resource with a user or group."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.share(
+            self._token,
+            resource_type,
+            resource_id,
+            grantee_type,
+            grantee_id,
+            permission,
+        )
+
+    async def unshare(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+        grantee_type: str,
+        grantee_id: uuid.UUID,
+        permission: str = "view",
+    ) -> dict:
+        """Revoke a share on a resource."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.unshare(
+            self._token,
+            resource_type,
+            resource_id,
+            grantee_type,
+            grantee_id,
+            permission,
+        )
+
+    async def update_visibility(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+        visibility: str,
+    ) -> dict:
+        """Update resource visibility (private/workspace)."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.update_visibility(
+            self._token,
+            resource_type,
+            resource_id,
+            visibility,
+        )
+
+    async def get_resource_acl(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+    ) -> dict:
+        """Get the full ACL record for a resource, including shares."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.get_resource_acl(resource_type, resource_id)
+
+    async def get_enriched_resource_acl(
+        self,
+        resource_type: str,
+        resource_id: uuid.UUID,
+    ) -> dict:
+        """Get ACL with user profiles resolved inline (names, emails)."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.get_enriched_resource_acl(resource_type, resource_id)
+
+    # -- Workspace / group helpers (auto-inject workspace_id from JWT) --------
+
+    async def search_members(
+        self,
+        query: str | None = None,
+        limit: int | None = None,
+    ) -> list[dict]:
+        """Search workspace members by name or email."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.search_workspace_members(
+            self._token,
+            self.user.workspace_id,
+            query,
+            limit,
+        )
+
+    async def list_members(
+        self,
+        limit: int | None = None,
+    ) -> list[dict]:
+        """List all members of the current workspace."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.search_workspace_members(
+            self._token,
+            self.user.workspace_id,
+            query=None,
+            limit=limit,
+        )
+
+    async def list_groups(self) -> list[dict]:
+        """List groups in the current workspace."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.list_groups(self._token, self.user.workspace_id)
+
+    async def get_group_members(self, group_id: uuid.UUID) -> list[dict]:
+        """List members of a group in the current workspace."""
+        if self._permissions is None:
+            raise DuarError("PermissionClient not configured on this RequestAuth")
+        return await self._permissions.get_group_members(
+            self._token,
+            self.user.workspace_id,
+            group_id,
+        )
+
+
+@dataclass(frozen=True)
+class SystemAuth:
+    """Per-request context for a no-user (machine-to-machine) in-realm call.
+
+    The no-user counterpart to :class:`RequestAuth`. It is produced by
+    ``Duar.verify_m2m_token`` after a ``type=m2m`` token (``aud=duar:m2m``)
+    passes Duar's RS256 signature + realm-scope checks. It carries service
+    identity only — never a user:
+
+    - ``caller``: the realm member that minted the token (server-stamped, for audit).
+    - ``svc``: the realm slug the token is scoped to (the shared ``effective_scope``).
+    - ``actions``: granted actions. ``["*"]`` is full in-realm trust (v1); a narrowed
+      list is honored by ``can`` with no shape change when least-privilege m2m ships.
+    """
+
+    caller: str
+    actions: list[str]
+    svc: str
+
+    def can(self, action: str) -> bool:
+        """Whether this system caller may perform ``action``. No network call."""
+        return "*" in self.actions or action in self.actions

duar_auth/authz.py

@@ -0,0 +1,78 @@
+"""AuthZ mode client — resolve IdP tokens into authorization context."""
+
+import uuid
+
+import httpx
+
+from duar_auth._utils import warn_if_insecure
+from duar_auth.types import DuarError
+
+
+class AuthzClient:
+    """Client for Duar's AuthZ mode endpoints.
+
+    Validates IdP tokens and retrieves authorization context
+    (workspace roles, RBAC actions, signed authz JWT).
+    """
+
+    def __init__(self, base_url: str, service_key: str):
+        self.base_url = base_url.rstrip("/")
+        self.service_key = service_key
+        self._client: httpx.AsyncClient | None = None
+        warn_if_insecure(self.base_url, "AuthzClient")
+
+    def __repr__(self) -> str:
+        return f"AuthzClient(base_url={self.base_url!r})"
+
+    async def _get_client(self) -> httpx.AsyncClient:
+        if self._client is None or self._client.is_closed:
+            self._client = httpx.AsyncClient(timeout=10.0)
+        return self._client
+
+    def _headers(self) -> dict[str, str]:
+        return {"X-Service-Key": self.service_key}
+
+    async def resolve(
+        self,
+        idp_token: str,
+        provider: str,
+        workspace_id: uuid.UUID | str | None = None,
+        nonce: str | None = None,
+    ) -> dict:
+        """Resolve an IdP token into authorization context.
+
+        Args:
+            idp_token: Raw token from the IdP (OIDC ID token or OAuth access token).
+            provider: IdP provider name ("google", "github", "entra_id").
+            workspace_id: Optional workspace to authorize for.
+            nonce: Optional replay-protection nonce. When provided, Duar
+                requires the IdP token's ``nonce`` claim (OIDC only) to match.
+
+        Returns:
+            Dict with user info. If workspace_id was provided, includes
+            authz_token and workspace. Otherwise includes workspaces list.
+        """
+        client = await self._get_client()
+        body: dict = {"idp_token": idp_token, "provider": provider}
+        if workspace_id:
+            body["workspace_id"] = str(workspace_id)
+        if nonce:
+            body["nonce"] = nonce
+        resp = await client.post(
+            f"{self.base_url}/authz/resolve",
+            json=body,
+            headers=self._headers(),
+        )
+        if resp.status_code != 200:
+            raise DuarError(f"Duar API error: {resp.status_code}", resp.status_code)
+        return resp.json()
+
+    async def close(self) -> None:
+        if self._client and not self._client.is_closed:
+            await self._client.aclose()
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *args):
+        await self.close()

duar_auth/authz_middleware.py

@@ -0,0 +1,254 @@
+"""Dual-token middleware for AuthZ mode.
+
+Validates both an IdP token (identity) and a Duar authz token
+(authorization), checking that the idp_sub claims match.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import uuid
+from typing import TYPE_CHECKING
+
+import jwt
+from jwt import PyJWKClient
+from jwt.exceptions import PyJWKClientError
+from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
+from starlette.requests import Request
+from starlette.responses import JSONResponse, Response
+from starlette.types import ASGIApp
+
+from duar_auth.types import AuthenticatedUser
+
+if TYPE_CHECKING:
+    from duar_auth.duar import Duar
+
+
+class AuthzMiddleware(BaseHTTPMiddleware):
+    """Validates IdP token + Duar authz token on each request.
+
+    IdP token: ``Authorization: Bearer <idp_token>``
+    Authz token: ``X-Authz-Token: <authz_token>``
+
+    Both must be valid and their ``sub``/``idp_sub`` claims must match.
+
+    Required binding arguments:
+    - ``service_name``: the authz token's ``svc`` claim must equal this, so a
+      token minted for another service cannot be replayed here.
+    - ``idp_audience``: the IdP token's ``aud`` claim must equal this. In
+      OpenID Connect this is your OAuth client_id. Without this check, any
+      valid ID token from any client of the same IdP authenticates.
+    - ``idp_issuer`` (optional but recommended): the IdP token's ``iss`` claim
+      must equal this.
+
+    For IdP key material you must provide either ``idp_public_key`` (single PEM)
+    or ``idp_jwks_url`` (e.g. Google's JWKS — handles key rotation).
+
+    **Offline by design — no revocation check.** Validation is purely local
+    (signature, audience, expiry, ``idp_sub``/``svc`` bindings); the middleware
+    does NOT call Duar to consult the token denylist or the user-deactivation
+    flag. A deactivated user's already-issued authz token therefore stays accepted
+    here until it expires naturally. Authz tokens are short-lived (default 5 min)
+    to bound this window — keep ``AUTHZ_TOKEN_EXPIRE_MINUTES`` small. For
+    revocation-sensitive operations, gate them with a Duar ``PermissionClient``
+    / ``RoleClient`` call rather than relying on this middleware alone.
+    """
+
+    def __init__(
+        self,
+        app: ASGIApp,
+        *,
+        service_name: str,
+        idp_audience: str | list[str],
+        idp_public_key: str | None = None,
+        idp_jwks_url: str | None = None,
+        idp_issuer: str | None = None,
+        duar_public_key: str | None = None,
+        duar_instance: Duar | None = None,
+        idp_algorithm: str = "RS256",
+        duar_algorithm: str = "RS256",
+        duar_audience: str = "duar:authz",
+        exclude_paths: list[str] | None = None,
+    ):
+        super().__init__(app)
+        if not service_name:
+            raise ValueError("AuthzMiddleware requires service_name")
+        if not idp_audience:
+            raise ValueError("AuthzMiddleware requires idp_audience")
+        if not duar_public_key and not duar_instance:
+            raise ValueError(
+                "AuthzMiddleware requires either duar_public_key or duar_instance for authz token verification"
+            )
+        if (
+            not idp_public_key
+            and not idp_jwks_url
+            and not (duar_instance and (duar_instance.idp_jwks_url or duar_instance.idp_public_key))
+        ):
+            raise ValueError("AuthzMiddleware requires idp_public_key or idp_jwks_url for IdP token verification")
+
+        self.service_name = service_name
+        self.idp_audience = idp_audience
+        self.idp_issuer = idp_issuer
+        self._idp_public_key = idp_public_key
+        self._idp_jwks_url = idp_jwks_url
+        self._duar_public_key = duar_public_key
+        self._duar_instance = duar_instance
+        self.idp_algorithm = idp_algorithm
+        self.duar_algorithm = duar_algorithm
+        self.duar_audience = duar_audience
+        self.exclude_paths = exclude_paths or ["/health", "/docs", "/openapi.json"]
+
+        jwks_url = idp_jwks_url or (duar_instance.idp_jwks_url if duar_instance else None)
+        # The fetch is sync urllib (like the Duar one): dispatch runs it via
+        # asyncio.to_thread, and the timeout bounds the worker-thread stall.
+        self._idp_jwks_client: PyJWKClient | None = PyJWKClient(jwks_url, timeout=10) if jwks_url else None
+
+        # Duar (authz token) key resolution. Static duar_public_key pins
+        # one key (air-gapped); otherwise resolve by kid via PyJWKClient against
+        # Duar's JWKS — same battle-tested path as IdP tokens, handles rotation.
+        duar_jwks_url = (
+            f"{duar_instance.base_url}/.well-known/jwks.json" if (duar_instance and not duar_public_key) else None
+        )
+        self._duar_jwk_client: PyJWKClient | None = PyJWKClient(duar_jwks_url, timeout=5) if duar_jwks_url else None
+
+    @property
+    def idp_public_key(self) -> str:
+        if self._idp_public_key:
+            return self._idp_public_key
+        if self._duar_instance:
+            return self._duar_instance.idp_public_key or ""
+        return ""
+
+    @property
+    def duar_public_key(self) -> str:
+        key = self._duar_public_key
+        if not key and self._duar_instance:
+            key = self._duar_instance.duar_public_key or ""
+        if not key:
+            raise RuntimeError(
+                "Duar public key not available. Ensure duar_instance.lifespan() has run "
+                "or provide duar_public_key directly."
+            )
+        return key
+
+    @property
+    def effective_scope(self) -> str:
+        """The shared scope an incoming authz token's ``svc`` must match.
+
+        A realm member resolves this from its Duar instance (discovered via
+        ``whoami`` at startup); standalone services and static-key (air-gapped) mode
+        fall back to ``service_name`` — today's behavior, unchanged.
+        """
+        if self._duar_instance is not None:
+            # ponytail: getattr because _FakeDuar in test_authz_middleware.py predates this
+            # attribute and cannot be edited (frozen test). Real Duar always has it post-A2.
+            return getattr(self._duar_instance, "effective_scope", self.service_name)
+        return self.service_name
+
+    def _decode_idp_token(self, token: str) -> dict:
+        """Decode and validate an IdP token.
+
+        Enforces ``aud`` and ``iss`` — these are the sole defences against
+        accepting a valid-but-wrong-client token from the same IdP.
+        """
+        decode_kwargs: dict = {
+            "algorithms": [self.idp_algorithm],
+            "audience": self.idp_audience,
+        }
+        if self.idp_issuer:
+            decode_kwargs["issuer"] = self.idp_issuer
+
+        if self._idp_jwks_client:
+            signing_key = self._idp_jwks_client.get_signing_key_from_jwt(token)
+            return jwt.decode(token, signing_key.key, **decode_kwargs)
+        return jwt.decode(token, self.idp_public_key, **decode_kwargs)
+
+    def _decode_authz(self, token: str) -> dict:
+        """Verify a Duar authz token.
+
+        Static ``duar_public_key`` mode pins one key (air-gapped, not
+        rotation-capable). Otherwise the key is resolved by ``kid`` via
+        ``PyJWKClient``, which refetches Duar's JWKS on a rotated-in kid.
+        """
+        key = self._duar_public_key
+        if not key:
+            key = self._duar_jwk_client.get_signing_key_from_jwt(token).key
+        return jwt.decode(
+            token,
+            key,
+            algorithms=[self.duar_algorithm],
+            audience=self.duar_audience,
+        )
+
+    async def dispatch(self, request: Request, call_next: RequestResponseEndpoint) -> Response:
+        if request.method == "OPTIONS":
+            return await call_next(request)
+        if any(request.url.path == p or request.url.path.startswith(p + "/") for p in self.exclude_paths):
+            return await call_next(request)
+
+        # 1. Extract IdP token from Authorization header
+        auth_header = request.headers.get("Authorization")
+        if not auth_header or not auth_header.startswith("Bearer "):
+            return JSONResponse(status_code=401, content={"detail": "Missing IdP token"})
+        idp_token = auth_header.removeprefix("Bearer ")
+
+        # 2. Extract authz token from X-Authz-Token header
+        authz_token = request.headers.get("X-Authz-Token")
+        if not authz_token:
+            return JSONResponse(status_code=401, content={"detail": "Missing authz token"})
+
+        # 3. Validate IdP token (signature + audience + optional issuer).
+        #    Off-loop: the kid lookup can trigger a sync JWKS refetch.
+        try:
+            idp_payload = await asyncio.to_thread(self._decode_idp_token, idp_token)
+        except jwt.ExpiredSignatureError:
+            return JSONResponse(status_code=401, content={"detail": "IdP token expired"})
+        except (jwt.InvalidTokenError, PyJWKClientError):
+            return JSONResponse(status_code=401, content={"detail": "Invalid IdP token"})
+
+        # 4. Validate authz token (key selected by kid; supports rotation)
+        try:
+            authz_payload = await asyncio.to_thread(self._decode_authz, authz_token)
+        except jwt.ExpiredSignatureError:
+            return JSONResponse(status_code=401, content={"detail": "Authz token expired"})
+        except (jwt.InvalidTokenError, PyJWKClientError):
+            return JSONResponse(status_code=401, content={"detail": "Invalid authz token"})
+
+        # 5. Verify binding: IdP sub must match authz idp_sub, both non-empty.
+        idp_sub = idp_payload.get("sub")
+        authz_idp_sub = authz_payload.get("idp_sub")
+        if not idp_sub or not authz_idp_sub or idp_sub != authz_idp_sub:
+            return JSONResponse(
+                status_code=401,
+                content={"detail": "Token binding mismatch: idp_sub does not match"},
+            )
+
+        # 6. Enforce svc binding: the authz token was minted for this service's
+        #    effective scope (the realm slug for a member, else the service name).
+        token_svc = authz_payload.get("svc")
+        if not token_svc or token_svc != self.effective_scope:
+            return JSONResponse(
+                status_code=403,
+                content={"detail": "Authz token was issued for a different service"},
+            )
+
+        # 7. Set user on request state
+        try:
+            request.state.user = AuthenticatedUser(
+                user_id=uuid.UUID(authz_payload["sub"]),
+                email=idp_payload.get("email", ""),
+                name=idp_payload.get("name", ""),
+                workspace_id=uuid.UUID(authz_payload["wid"]),
+                workspace_slug=authz_payload.get("wslug", ""),
+                workspace_role=authz_payload["wrole"],
+                groups=[],
+                org_id=uuid.UUID(authz_payload["oid"]) if authz_payload.get("oid") else None,
+                org_slug=authz_payload.get("oslug"),
+                org_is_public=bool(authz_payload.get("opub", False)),
+            )
+            request.state.token = authz_token
+            request.state.idp_token = idp_token
+        except (KeyError, ValueError):
+            return JSONResponse(status_code=401, content={"detail": "Invalid token claims"})
+
+        return await call_next(request)