Add base kubernetes support final fix 4

gateway/app/middleware/auth.py

@@ -67,7 +67,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
             )
 
         # ✅ STEP 2: Verify token and get user context
-        user_context = await self._verify_token(token)
+        user_context = await self._verify_token(token, request)
         if not user_context:
             logger.warning(f"Invalid token for route: {request.url.path}")
             return JSONResponse(
@@ -117,7 +117,14 @@ class AuthMiddleware(BaseHTTPMiddleware):
                    tenant_id=tenant_id,
                    path=request.url.path)
 
-        return await call_next(request)
+        # Process the request
+        response = await call_next(request)
+
+        # Add token expiry warning header if token is near expiry
+        if hasattr(request.state, 'token_near_expiry') and request.state.token_near_expiry:
+            response.headers["X-Token-Refresh-Suggested"] = "true"
+
+        return response
 
     def _is_public_route(self, path: str) -> bool:
         """Check if route requires authentication"""
@@ -130,7 +137,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
             return auth_header.split(" ")[1]
         return None
 
-    async def _verify_token(self, token: str) -> Optional[Dict[str, Any]]:
+    async def _verify_token(self, token: str, request: Request = None) -> Optional[Dict[str, Any]]:
         """
         Verify JWT token with improved fallback strategy
         FIXED: Better error handling and token structure validation
@@ -141,6 +148,17 @@ class AuthMiddleware(BaseHTTPMiddleware):
             payload = jwt_handler.verify_token(token)
             if payload and self._validate_token_payload(payload):
                 logger.debug("Token validated locally")
+
+                # Check if token is near expiry and set flag for response header
+                if request:
+                    import time
+                    exp_time = payload.get("exp", 0)
+                    current_time = time.time()
+                    time_until_expiry = exp_time - current_time
+
+                    if time_until_expiry < 300:  # 5 minutes
+                        request.state.token_near_expiry = True
+
                 # Convert JWT payload to user context format
                 return self._jwt_payload_to_user_context(payload)
         except Exception as e:
@@ -177,18 +195,26 @@ class AuthMiddleware(BaseHTTPMiddleware):
         """
         required_fields = ["user_id", "email", "exp", "type"]
         missing_fields = [field for field in required_fields if field not in payload]
-        
+
         if missing_fields:
             logger.warning(f"Token payload missing fields: {missing_fields}")
             return False
-            
+
         # Validate token type
         token_type = payload.get("type")
         if token_type not in ["access", "service"]:
             logger.warning(f"Invalid token type: {payload.get('type')}")
             return False
 
-            
+        # Check if token is near expiry (within 5 minutes) and log warning
+        import time
+        exp_time = payload.get("exp", 0)
+        current_time = time.time()
+        time_until_expiry = exp_time - current_time
+
+        if time_until_expiry < 300:  # 5 minutes
+            logger.warning(f"Token expires in {int(time_until_expiry)} seconds for user {payload.get('email')}")
+
         return True
 
     def _jwt_payload_to_user_context(self, payload: Dict[str, Any]) -> Dict[str, Any]: