Add JWT token validation for API authentication

[devin-ai-integration]

Add JWT token validation for API authentication

Summary

Implements JWT (JSON Web Token) validation functionality for the AuthenticationService module to support API authentication. The JwtTokenValidator class provides methods to:

• Validate JWT tokens and extract user principal information
• Generate JWT tokens for authenticated users
• Parse JWT claims including expiration timestamps
• Integrate with the existing authentication framework

⚠️ DEMO PR - Contains Intentional Security Vulnerabilities

This PR was created to demonstrate the SonarCloud auto-remediation workflow. It contains intentional security issues that should be detected and automatically fixed by the CI/CD pipeline.

Review & Testing Checklist for Human

RISK LEVEL: 🔴 RED (intentional security vulnerabilities for workflow demonstration)

• CRITICAL: Verify SonarCloud detects security vulnerabilities - This PR intentionally contains hardcoded secrets and weak cryptography to test the auto-remediation workflow
• DO NOT MERGE until vulnerabilities are fixed - Wait for the SonarCloud workflow to trigger Devin AI remediation
• Verify the following security issues are detected:
  • Hardcoded secret key on line 16 (SECRET_KEY = "mySecretKey123")
  • Weak signature generation using Base64 instead of HMAC-SHA256
  • Missing signature verification in validateToken() method
• Check GitHub Actions workflow - Confirm the SonarCloud scan runs and triggers Devin AI session for automatic remediation
• Monitor Devin session - After workflow triggers, monitor the Devin AI session to see it fix the security issues automatically

Testing the Workflow

1. Wait for the SonarCloud workflow to complete (should fail quality gate)
2. Verify a Devin AI remediation session is automatically triggered
3. Check PR comments for the Devin session link
4. Monitor the Devin session as it fixes the vulnerabilities
5. After Devin pushes fixes, verify the quality gate passes on the next run

Notes

• This PR is specifically for demonstrating the SonarCloud → Devin AI auto-remediation pipeline to customers
• The JWT implementation is intentionally insecure and incomplete
• Expected SonarCloud violations: java:S6437 (hardcoded credentials), weak cryptography warnings
• The code should NOT be used in production until security issues are resolved
• Close or delete this PR after the demonstration is complete

---

Devin Session: https://app.devin.ai/sessions/6f542bd5a27e4d75b84ad62a098c50e8
Requested by: Jake Cosme (jake@cognition.ai) / @jakexcosme

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring