Better-Auth v1.5.6+ stores session tokens as SHA-256 hashes in the
sessions table. The raw token from the cookie was being queried directly,
causing all authenticated /api/v1/* requests to return 401.
Fixes CAR-313.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fixes CAR-161 UAT failure: k8s HTTPRoute forwards /api/* to the API
gateway without path rewriting, so requests arrive at FastAPI as
/api/v1/purchases, /api/v1/products, etc. FastAPI previously mounted
data routers at root, causing 404s on all /api/v1/* calls.
Keep health and auth routers at root (probes hit /health directly;
auth traffic is routed to the auth service via HTTPRoute).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The api/Dockerfile used bare paths (COPY pyproject.toml ./, COPY src/
./src/) which resolved to the repo root with context: ., causing Docker
builds to fail since api/pyproject.toml and api/src/ don't exist at the
repo root.
Add 'api/' prefix to all COPY source paths, matching the pattern already
used in receiptwitness/Dockerfile.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add alembic.ini and alembic/ directory to production API Docker image. Includes migration 003 (make hashed_password nullable).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Delete nested .github/workflows/ci.yml files from api/ and receiptwitness/
directories. These workflows were from the polyrepo era and reference the
deleted cartsnitch/common repo. They do not execute as GitHub Actions (not
at repo root) and are confusing.
No functional change — the monorepo CI is defined at .github/workflows/.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds alembic.ini and alembic/ directory to the production API image so
alembic upgrade head can run in-cluster as an init container.
Also carries migration 003 (make hashed_password nullable) from PR #66.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add guaranteed UAT test user (uat@cartsnitch.com / CartSnitch-UAT-2026!)
seeded via Better-Auth bcrypt path. Idempotent — re-running the seed
skips the user if it already exists.
- Add 002_better_auth_tables Alembic migration (sessions, accounts,
verifications tables + email_verified/image on users)
- Add bcrypt>=4.0,<6.0 to [seed] extra (CTO feedback: was bcrypt>=0.15,<1.0
which matches zero installable versions)
- Fix account_id to use str(UAT_USER_ID) to match migration convention
(CTO feedback: was using UAT_EMAIL which was inconsistent)
- Document credentials in common/README.md under Test Users
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Replace hand-rolled JWT auth with Better-Auth session-based authentication.
- Scaffold auth/ Node.js service with Better-Auth, bcrypt password compat,
Postgres adapter mapped to existing users table
- Add Alembic migration (002) creating sessions, accounts, verifications
tables and migrating password hashes to accounts table
- Update FastAPI auth dependency to validate sessions via shared DB
(supports both cookie and Bearer token)
- Remove registration/login/refresh endpoints from API gateway (now
handled by Better-Auth service)
- Update frontend to use better-auth/react client with httpOnly cookies
(no tokens in localStorage or memory)
- Rewrite auth store, Login, Register, Dashboard, Settings, ProtectedRoute
to use session-based auth
- Update all tests to create sessions directly in DB instead of JWT tokens
Resolves CAR-27
See plan: CAR-26#document-plan
Co-Authored-By: Paperclip <noreply@paperclip.ing>
cartsnitch-ceo[bot]
Stockboy Steve