Implement Secure Authentication Middleware with JWT and Role-Based Access Control

Write a complete authentication and authorization middleware for a [FRAMEWORK] application (e.g., Express.js, FastAPI, Spring Boot, Laravel) in [PROGRAMMING_LANGUAGE]. The middleware should handle JWT-based authentication with role-based access control (RBAC) and meet these specifications: 1. **JWT Token Handling**: - Extract the JWT from the Authorization header (Bearer scheme) and optionally from an HTTP-only cookie named [COOKIE_NAME]. - Verify the token signature using [ALGORITHM] (e.g., RS256 or HS256) with a secret/key stored in environment variables. - Decode the payload and attach the authenticated user object to the request context. - Handle token expiration gracefully with clear error messages. 2. **Token Refresh Flow**: - Implement a refresh token mechanism. Access tokens should expire in [ACCESS_TOKEN_TTL] and refresh tokens in [REFRESH_TOKEN_TTL]. - Include a middleware or utility function that issues new access/refresh token pairs and rotates the refresh token on each use (to detect token reuse/theft). 3. **Role-Based Access Control**: - Define roles: [ROLES_LIST] (e.g., admin, editor, viewer, user). - Create a `requireRole(...roles)` middleware/decorator that restricts route access to users with the specified roles. - Create a `requirePermission(...permissions)` middleware/decorator for fine-grained permission checks (e.g., 'posts:write', 'users:delete'). 4. **Security Best Practices**: - Protect against common attacks: add rate limiting on auth endpoints, prevent timing attacks in token comparison, and sanitize error messages to avoid leaking information. - Include CSRF protection strategy for cookie-based auth. - Log authentication failures with IP address and timestamp for audit purposes. 5. **Error Handling**: Return standardized JSON error responses with appropriate HTTP status codes (401 for unauthenticated, 403 for unauthorized) following [API_STYLE] conventions (e.g., REST, JSON:API). 6. **Integration Example**: Show how to apply the middleware to three sample routes — a public route, an authenticated route, and an admin-only route. Provide complete, production-quality code with comments explaining security decisions. Include a list of required environment variables and npm/pip/maven dependencies.