templates/blog-python-mongo
Template
1
Fork 0
Code Activity
blog-python-mongo/extras/auth-auth0
History
Exact
Leonardo Devai f17d20ff48 Review and modernize all 42 projects to the updated standard 
Pinned 2026 toolchains (Go 1.26, Rust 1.98/edition 2024, Python 3.14 + uv, Node 24,
Zig 0.16, NixOS 26.05), postgres 18 / mongo 8, lockfiles built from, non-root
runtimes, .dockerignore, per-project LICENSE, READMEs with the git.devai.io clone
line, checkout@v7 CI. Security fixes in the legacy Rust APIs (any-password login,
self-assigned admin, hard-coded JWT secret), JWT alg/exp/sub enforcement across the
blog series, safe markdown links in the frontends, and many smaller bugs — every
project was built, run and exercised end to end.

Adds scripts/publish.sh + a CI publish job that splits every folder into its own
repo at git.devai.io/templates/<folder>.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01128fhuZbgivaSJvtMf4s1G
2026-09-27 21:10:38 +02:00
..
auth0_auth.py Review and modernize all 42 projects to the updated standard 2026-09-27 21:10:38 +02:00
README.md Add the devai.io boilerplate library: 42 runnable projects 2026-07-19 16:31:48 +02:00

README.md

Auth via Auth0

Replaces the built-in email/password auth with Auth0. Auth0 issues RS256 access tokens; the API verifies them against your tenant's JWKS, checking issuer and audience. One file, no Auth0 SDK.

Install

  1. In the Auth0 dashboard, create an API — its identifier becomes your audience.
  2. Add the RS256 backend: uv add "pyjwt[crypto]"
  3. Copy auth0_auth.py to app/auth0_auth.py
  4. In app/posts.py, change one import: from .auth0_auth import current_user_id
  5. Set AUTH0_DOMAIN (e.g. your-tenant.us.auth0.com) and AUTH0_AUDIENCE (the API identifier from step 1).

Delete / adjust

  • app/auth.py and its router registration in app/main.py — Auth0 replaces /auth/register and /auth/login.
  • The users collection and its email index in app/db.py — Auth0 stores your users.
  • posts.author_id now holds an Auth0 user id (a string like auth0|64ef…) instead of an ObjectId string. It was already stored as a string, so nothing to migrate — only the id format changes.
  • AUTH_SECRET is unused.

Clients obtain tokens through any Auth0 flow (Authorization Code + PKCE for SPAs; the API's Test tab issues one for quick manual checks) and send them as Authorization: Bearer <token>.