1. Client sends request with auth token
   Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

2. Gateway validates token signature and expiration
   - Decode JWT without verifying signature (get header)
   - Verify signature using public key
   - Check expiration (exp claim)
   - Extract user claims (sub, name, roles, permissions)

3. Gateway enforces authorization
   - Check if user has required permissions
   - If authorized: add user context headers, forward to backend
   - If unauthorized: return 401/403 immediately

4. Backend receives request with user context
   X-User-ID: user123
   X-User-Role: admin
   X-User-Permissions: read,write,delete

function validateJWT(token: string): JWTClaims {
  try {
    // Decode and verify signature
    const claims = jwt.verify(token, publicKey);

    // Check expiration
    if (claims.exp < Date.now() / 1000) {
      throw new Error("Token expired");
    }

    // Check issuer
    if (claims.iss !== "https://auth.example.com") {
      throw new Error("Invalid issuer");
    }

    return claims;
  } catch (error) {
    throw new Error("Invalid token");
  }
}

// Request with valid JWT:
Request:  {"type": "api_request", "msg_id": 1, "method": "GET", "path": "/api/users/123", "headers": {"Authorization": "Bearer eyJhbGciOiJIUzI1NiIs..."}}
Response: {"type": "api_response", "in_reply_to": 1, "status": 200, "service": "users-service", "user_context": {"user_id": "user123", "role": "admin", "permissions": ["read", "write"]}}

// Request with expired token:
Request:  {"type": "api_request", "msg_id": 2, "method": "GET", "path": "/api/users/123", "headers": {"Authorization": "Bearer expired_token..."}}
Response: {"type": "api_response", "in_reply_to": 2, "status": 401, "error": "Token expired"}

// Request without permission:
Request:  {"type": "api_request", "msg_id": 3, "method": "DELETE", "path": "/api/users/123", "headers": {"Authorization": "Bearer user_token..."}, "required_permission": "delete"}
Response: {"type": "api_response", "in_reply_to": 3, "status": 403, "error": "Insufficient permissions: required [delete], have [read]"}