Improve teh securty of teh DB

gateway/app/middleware/auth.py

@@ -59,9 +59,46 @@ class AuthMiddleware(BaseHTTPMiddleware):
         if self._is_public_route(request.url.path):
             return await call_next(request)
 
-        # ✅ Check if demo middleware already set user context
+        # ✅ Check if demo middleware already set user context OR check query param for SSE
         demo_session_header = request.headers.get("X-Demo-Session-Id")
-        logger.info(f"Auth check - path: {request.url.path}, demo_header: {demo_session_header}, has_demo_state: {hasattr(request.state, 'is_demo_session')}")
+        demo_session_query = request.query_params.get("demo_session_id")  # For SSE endpoint
+        logger.info(f"Auth check - path: {request.url.path}, demo_header: {demo_session_header}, demo_query: {demo_session_query}, has_demo_state: {hasattr(request.state, 'is_demo_session')}")
+
+        # For SSE endpoint with demo_session_id in query params, validate it here
+        if request.url.path == "/api/events" and demo_session_query and not hasattr(request.state, "is_demo_session"):
+            logger.info(f"SSE endpoint with demo_session_id query param: {demo_session_query}")
+            # Validate demo session via demo-session service
+            import httpx
+            try:
+                async with httpx.AsyncClient() as client:
+                    response = await client.get(
+                        f"http://demo-session-service:8000/api/v1/demo/sessions/{demo_session_query}",
+                        headers={"X-Internal-API-Key": "dev-internal-key-change-in-production"}
+                    )
+                    if response.status_code == 200:
+                        session_data = response.json()
+                        # Set demo session context
+                        request.state.is_demo_session = True
+                        request.state.user = {
+                            "user_id": f"demo-user-{demo_session_query}",
+                            "email": f"demo-{demo_session_query}@demo.local",
+                            "tenant_id": session_data.get("virtual_tenant_id"),
+                            "demo_session_id": demo_session_query,
+                        }
+                        request.state.tenant_id = session_data.get("virtual_tenant_id")
+                        logger.info(f"✅ Demo session validated for SSE: {demo_session_query}")
+                    else:
+                        logger.warning(f"Invalid demo session for SSE: {demo_session_query}")
+                        return JSONResponse(
+                            status_code=401,
+                            content={"detail": "Invalid demo session"}
+                        )
+            except Exception as e:
+                logger.error(f"Failed to validate demo session for SSE: {e}")
+                return JSONResponse(
+                    status_code=503,
+                    content={"detail": "Demo session service unavailable"}
+                )
 
         if hasattr(request.state, "is_demo_session") and request.state.is_demo_session:
             if hasattr(request.state, "user") and request.state.user: