API Gateway Authentication — Centralized Auth at the Gateway

// Kong API Gateway auth plugin
// declarative.yaml
plugins:
- name: jwt
  service: scan-service
  config:
    uri_param_names: []
    cookie_names: ['access_token']
    key_claim_name: sub
    secret_is_base64: false
    claims_to_verify: ['exp', 'nbf']
    maximum_expiration: 3600

// Gateway token introspection
app.use('/api', async (req, res, next) => {
  const token = extractToken(req);
  if (!token) return res.status(401).json({ error: 'No token' });

  // Introspect token at auth service
  const introspection = await axios.post('http://auth.internal/introspect', {
    token,
    token_type_hint: 'access_token'
  }, {
    headers: { Authorization: `Bearer ${process.env.AUTH_SERVICE_TOKEN}` }
  });

  if (!introspection.data.active) {
    return res.status(401).json({ error: 'Token inactive' });
  }

  // Set user context for downstream services
  req.headers['x-user-id'] = introspection.data.sub;
  req.headers['x-user-role'] = introspection.data.role?.join(',');
  req.headers['x-tenant-id'] = introspection.data.tenant_id;

  // Rate limit by user
  const remaining = await rateLimiter.checkLimit(
    `user:${introspection.data.sub}`,
    { max: 1000, window: 60 }
  );

  res.setHeader('X-RateLimit-Remaining', remaining);
  next();
});