Fix JWT token not refreshed when token expires mid-request

[GayathriSrividya]

closes: #67939

This replaces #68054, which cannot be reopened because GitHub treats the head branch as recreated after the remote refresh.

What changed in this update:

• Removed redundant claim injection in middleware and now use cached claims directly.
• Renamed the generic test fixture to a JWT-specific fixture name for clarity.
• Kept the regression test wording update requested in review.

This keeps the original fix intent intact: avoid token revalidation in middleware and refresh from the token already cached in request scope.

related: #68054

---

Important

🛠️ Maintainer triage note for @GayathriSrividya · by @potiuk · 2026-07-08 15:38 UTC

Helpful heads-up from the maintainers — please address before this PR can be reviewed:

• Pre-commit / static checks failing (CI image checks / Static checks). See the contributor guide.

Full criteria: Pull Request quality criteria.

The ball is in your court — you've been assigned to this PR. Fix the above, then mark it Ready for review.

_{Automated triage — may be imperfect; a maintainer takes the next look.}

[GayathriSrividya]

@ashb could you please take another look when you have a moment?

I’ve addressed the points from your earlier review:

Removed the redundant sub claim merge in the JWT reissue middleware and now use the claims already cached in request scope.
Renamed the fixture from client to jwt_bearer_client so its purpose is explicit and less generic.
Kept the test-docstring wording adjustment about request start vs middleware timing.
Behavior-wise, the intent is unchanged: middleware no longer revalidates the bearer token and instead refreshes from the already-validated scope claims.

Thanks again for the guidance and review.

[ashb]

This isn't really testing the TOCTOU bug - fairly sure this would pass without any code changes.

I think what you need to do is register a custom route that does a time travel inside it

[GayathriSrividya]

@ashb

• Fixed! The test now properly validates the TOCTOU scenario:

Test: test_router.py

• Token expires mid-request (line 157: time_machine.move_to(moment + 601))
• Middleware still refreshes (line 163: assert "Refreshed-API-Token" in response.headers)
• No re-validation happens (line 164: assert_awaited_once_with proves avalidated_claims called only once)

Fix: app.py

• Middleware reads from request.scope (cached by JWTBearer) instead of calling avalidated_claims again
• Guarantees refresh even if token expired between request start and middleware execution

Let me know if any other method is needed to address the issue.