feat: migrate authentication to Better-Auth (Phase 1)

Replace hand-rolled JWT auth with Better-Auth session-based authentication.

- Scaffold auth/ Node.js service with Better-Auth, bcrypt password compat,
  Postgres adapter mapped to existing users table
- Add Alembic migration (002) creating sessions, accounts, verifications
  tables and migrating password hashes to accounts table
- Update FastAPI auth dependency to validate sessions via shared DB
  (supports both cookie and Bearer token)
- Remove registration/login/refresh endpoints from API gateway (now
  handled by Better-Auth service)
- Update frontend to use better-auth/react client with httpOnly cookies
  (no tokens in localStorage or memory)
- Rewrite auth store, Login, Register, Dashboard, Settings, ProtectedRoute
  to use session-based auth
- Update all tests to create sessions directly in DB instead of JWT tokens

Resolves CAR-27
See plan: CAR-26#document-plan

Co-Authored-By: Paperclip <noreply@paperclip.ing>

This commit is contained in:

Coupon Carl

2026-03-28 04:46:10 +00:00

parent 3a31f82c8d

commit cfda1b544d

11 changed files with 562 additions and 527 deletions

									
										package.json
									
		+1
		
												View File
												
				@@ -13,6 +13,7 @@

				  },

				  "dependencies": {

				    "@tanstack/react-query": "^5.0.0",

				    "better-auth": "^1.2.0",

				    "react": "^18.3.1",

				    "react-dom": "^18.3.1",

				    "react-router-dom": "^7.0.0",