Add JWT + Google OAuth authentication #4

New issue

Closed

opened 2026-02-23 18:23:59 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-02-23 18:23:59 +00:00

Owner

Goal

Integrate pal-e-auth shared package into basketball-api for user authentication.

Prerequisite

forgejo_admin/pal-e-auth#1 (scaffold shared auth package)

Scope

Add pal-e-auth to requirements.txt
Include auth router at /auth/
Protect mutation endpoints with require_role("admin", "coach")
Protect parent-facing endpoints with require_role("admin", "coach", "parent")
Add pal-e-auth-secrets to k8s secrets (JWT_SECRET_KEY, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET)
Update k8s deployment env to read auth secrets

User Roles for basketball-api

Role	Access
admin	Everything
coach	Own program: roster, evaluations, drafts
parent	Own child: status, receipts, payments

Blocks

Deployment of basketball-api (PII exposure without auth)

Design doc: ~/.claude/plans/2026-02-23-refine-planning-pal-e-docs-auth.md

## Goal Integrate pal-e-auth shared package into basketball-api for user authentication. ## Prerequisite - forgejo_admin/pal-e-auth#1 (scaffold shared auth package) ## Scope - Add `pal-e-auth` to requirements.txt - Include auth router at `/auth/` - Protect mutation endpoints with `require_role("admin", "coach")` - Protect parent-facing endpoints with `require_role("admin", "coach", "parent")` - Add `pal-e-auth-secrets` to k8s secrets (JWT_SECRET_KEY, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET) - Update k8s deployment env to read auth secrets ## User Roles for basketball-api | Role | Access | |------|--------| | admin | Everything | | coach | Own program: roster, evaluations, drafts | | parent | Own child: status, receipts, payments | ## Blocks - Deployment of basketball-api (PII exposure without auth) Design doc: `~/.claude/plans/2026-02-23-refine-planning-pal-e-docs-auth.md`