Leonardo Devai
80f2a6dbb0
Pinned 2026 toolchains (Go 1.26, Rust 1.98/edition 2024, Python 3.14 + uv, Node 24, Zig 0.16, NixOS 26.05), postgres 18 / mongo 8, lockfiles built from, non-root runtimes, .dockerignore, per-project LICENSE, READMEs with the git.devai.io clone line, checkout@v7 CI. Security fixes in the legacy Rust APIs (any-password login, self-assigned admin, hard-coded JWT secret), JWT alg/exp/sub enforcement across the blog series, safe markdown links in the frontends, and many smaller bugs — every project was built, run and exercised end to end. Adds scripts/publish.sh + a CI publish job that splits every folder into its own repo at git.devai.io/templates/<folder>. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01128fhuZbgivaSJvtMf4s1G
32 lines
1.5 KiB
Markdown
32 lines
1.5 KiB
Markdown
# Auth via Clerk
|
|
|
|
Replaces the built-in email/password auth with [Clerk](https://clerk.com).
|
|
Clerk owns sign-up, sign-in and sessions; the API only verifies the session
|
|
JWT it receives against your instance's JWKS (RS256 signature, issuer,
|
|
expiry, `azp`). One file, no Clerk SDK.
|
|
|
|
## Install
|
|
|
|
1. Add the RS256 backend: `uv add "pyjwt[crypto]"`
|
|
2. Copy `clerk_auth.py` to `app/clerk_auth.py`
|
|
3. In `app/posts.py`, change one import:
|
|
`from .clerk_auth import current_user_id`
|
|
4. Set `CLERK_ISSUER` to your Frontend API URL from the Clerk dashboard,
|
|
e.g. `https://your-app.clerk.accounts.dev`, and `CLERK_AUTHORIZED_PARTIES`
|
|
to the origins allowed to mint tokens for this API (comma-separated,
|
|
checked against the `azp` claim; leave it unset to skip the check),
|
|
e.g. `https://your-site.com,http://localhost:5173`
|
|
|
|
## Delete / adjust
|
|
|
|
- `app/auth.py` and its router registration in `app/main.py` — Clerk replaces
|
|
`/auth/register` and `/auth/login`.
|
|
- The `users` table in `schema.sql` — Clerk stores your users.
|
|
- `posts.author_id` now holds a Clerk user id (a string like `user_2f…`):
|
|
change the column to `author_id text NOT NULL` and drop the `REFERENCES`
|
|
clause (edit `schema.sql` before first start, or `ALTER TABLE` a live db).
|
|
Type hints in `app/posts.py` change from `int` to `str` to match.
|
|
- `AUTH_SECRET` is unused.
|
|
|
|
Clients get a token from Clerk's SDK (`getToken()`) and send it as
|
|
`Authorization: Bearer <token>` — the write endpoints work unchanged.
|