better-auth-skill

This skill provides guidance for configuring Better Auth with JWT for secure user authentication.

` backend/ ├── auth/ │ ├── __init__.py │ ├── service.py # Auth business logic │ ├── dependencies.py # FastAPI dependencies │ ├── routes.py # Auth endpoints │ └── schemas.py # Pydantic schemas frontend/ └── src/ ├── lib/ │ └── auth.ts # Frontend auth utilities └── hooks/ └── useAuth.ts # Auth state hook `

from pydantic_settings import BaseSettings from datetime import timedelta from typing import Optional class AuthSettings(BaseSettings): SECRET_KEY: str ALGORITHM: str = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES: int = 30 REFRESH_TOKEN_EXPIRE_DAYS: int = 7 class Config: env_file = ".env" env_file_encoding = "utf-8" auth_settings = AuthSettings() `

from datetime import datetime, timedelta from typing import Optional from jose import JWTError, jwt from passlib.context import CryptContext from models.user import User from database import AsyncSessionLocal from sqlalchemy import select from fastapi import Depends, HTTPException, status from fastapi.security import OAuth2PasswordBearer pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/v1/auth/login") ALGORITHM = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES = 30 def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str: """Create JWT access token.""" to_encode = data.copy() if expires_delta: expire = datetime.utcnow() + expires_delta else: expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) to_encode.update({"exp": expire}) encoded_jwt = jwt.encode( to_encode, auth_settings.SECRET_KEY, algorithm=ALGORITHM ) return encoded_jwt def create_refresh_token(data: dict) -> str: """Create JWT refresh token.""" to_encode = data.copy() expire = datetime.utcnow() + timedelta(days=7) to_encode.update({"exp": expire, "type": "refresh"}) return jwt.encode(to_encode, auth_settings.SECRET_KEY, algorithm=ALGORITHM) def verify_password(plain_password: str, hashed_password: str) -> bool: """Verify password against hash.""" return pwd_context.verify(plain_password, hashed_password) def hash_password(password: str) -> str: """Hash password for storage.""" return pwd_context.hash(password) async def authenticate_user(email: str, password: str) -> Optional[User]: """Authenticate user by email and password.""" async with AsyncSessionLocal() as db: result = await db.execute( select(User).where(User.email == email) ) user = result.scalar_one_or_none() if not user: return None if not verify_password(password, user.hashed_password): return None return user async def get_user_by_email(email: str) -> Optional[User]: """Get user by email.""" async with AsyncSessionLocal() as db: result = await db.execute( select(User).where(User.email == email) ) return result.scalar_one_or_none() async def create_user(email: str, password: str, name: str) -> User: """Create new user.""" async with AsyncSessionLocal() as db: hashed_password = hash_password(password) user = User( email=email, hashed_password=hashed_password, name=name ) db.add(user) await db.commit() await db.refresh(user) return user `