Scaffold pal-e-auth shared package #1

New issue

Closed

opened 2026-02-23 18:23:44 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-02-23 18:23:44 +00:00

Owner

Goal

Create the shared auth package used by all pal-e platform services.

Scope

JWT token create/decode utilities (HS256, configurable secret)
Google OAuth flow (authorization URL, callback handler, ID token validation)
FastAPI dependencies: get_current_user, require_role, optional_user
Auth router: /auth/google, /auth/callback, /auth/logout
Pydantic models: User, TokenPayload, AuthConfig
pyproject.toml for pip install from git

User Model

Role	Who	Description
admin	Lucas	Full access
coach	Marcus + future coaches	Own program management
parent	Registrants	View own child status
viewer	Unauthenticated	Public read-only

Token Format

JWT with HS256 signing
Claims: sub, email, name, role, tenant_id, iat, exp, iss
Access: 24h, refresh: 30d in Postgres
httpOnly cookies

Dependencies

authlib or python-jose for JWT
httpx for Google token exchange
FastAPI + Pydantic

Integration Pattern

Services add to requirements.txt:

pal-e-auth @ git+https://forgejo.tail5b443a.ts.net/forgejo_admin/pal-e-auth.git

Design doc: ~/.claude/plans/2026-02-23-refine-planning-pal-e-docs-auth.md

## Goal Create the shared auth package used by all pal-e platform services. ## Scope - JWT token create/decode utilities (HS256, configurable secret) - Google OAuth flow (authorization URL, callback handler, ID token validation) - FastAPI dependencies: `get_current_user`, `require_role`, `optional_user` - Auth router: `/auth/google`, `/auth/callback`, `/auth/logout` - Pydantic models: User, TokenPayload, AuthConfig - `pyproject.toml` for pip install from git ## User Model | Role | Who | Description | |------|-----|-------------| | admin | Lucas | Full access | | coach | Marcus + future coaches | Own program management | | parent | Registrants | View own child status | | viewer | Unauthenticated | Public read-only | ## Token Format - JWT with HS256 signing - Claims: sub, email, name, role, tenant_id, iat, exp, iss - Access: 24h, refresh: 30d in Postgres - httpOnly cookies ## Dependencies - authlib or python-jose for JWT - httpx for Google token exchange - FastAPI + Pydantic ## Integration Pattern Services add to requirements.txt: ``` pal-e-auth @ git+https://forgejo.tail5b443a.ts.net/forgejo_admin/pal-e-auth.git ``` Design doc: `~/.claude/plans/2026-02-23-refine-planning-pal-e-docs-auth.md`