[rodriquelca]

Issue & Reproduction Steps

Invalid Bearer on auth:api routes (e.g. FAKE_JWT, load tests) runs Passport on every hit, saturating Octane (504/slow health) while clients only get 401.

Repro: Octane up → ./scripts/reproduce-invalid-bearer-load.sh or curl -H "Authorization: Bearer FAKE_JWT" /api/1.0/tasks?per_page=1. No DB fixtures.

Solution

• InvalidBearerTokenCache + hooks in ProcessMakerAuthenticate: reject non-JWT Bearer early; cache failed JWT-shaped tokens (hash, 60s, AUTH_INVALID_BEARER_CACHE_TTL); stash Bearer before Passport strips the header.
• Unit tests + auth.invalid_bearer_cache_ttl.

How to Test

• XDEBUG_MODE=off ./vendor/bin/phpunit tests/unit/ProcessMaker/Services/InvalidBearerTokenCacheTest.php
• ./scripts/reproduce-jwt-shaped-invalid-bearer.sh (2nd request → cache hit, 401)
• Valid PAT/API token still works (200).

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-34195

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[cursor]

PR Summary

Medium Risk
Changes the global API authentication middleware path; early rejection of non-JWT-shaped bearers and short-lived negative caching could affect unusual token formats or timing of retries after a transient auth failure.

Overview
Adds a negative cache for failed JWT-shaped Authorization: Bearer tokens on auth:api routes so repeat invalid requests return 401 without running Passport, addressing Octane overload from load tests and malformed tokens.

InvalidBearerTokenCache runs from ProcessMakerAuthenticate before parent auth: cached failures throw immediately; non–JWT-shaped bearers (not x.y.z) are rejected early; JWT-shaped tokens are stashed on the request in case Passport clears the header. On unauthenticated, failed JWT-shaped API bearers are stored under a SHA-256 cache key for AUTH_INVALID_BEARER_CACHE_TTL seconds (default 60, 0 disables). Unit and feature tests cover caching, early reject, and JSON 401 responses.

^{Reviewed by Cursor Bugbot for commit 2ff8477. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 4f8f268. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube