/gen.auth-integration <provider> <backend-framework>

# Examples:
/gen.auth-integration "better-auth" "fastapi"
/gen.auth-integration "jwt" "fastapi"

phase-XX/src/auth/
  ├── middleware.py        # Auth middleware
  ├── jwt_handler.py      # JWT token logic
  ├── password.py          # Password hashing
  ├── dependencies.py      # FastAPI deps
  └── models.py          # Auth models (Token, User)

from datetime import datetime, timedelta
from typing import Optional
from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPBearer
from jose import JWTError, jwt
from passlib.context import CryptContext
import bcrypt

# Password hashing
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

SECRET_KEY = os.getenv("JWT_SECRET")
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

def hash_password(password: str) -> str:
    """Hash password using bcrypt."""
    return pwd_context.hash(password)

def verify_password(plain_password: str, hashed_password: str) -> bool:
    """Verify password against hash."""
    return pwd_context.verify(plain_password, hashed_password)

def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
    """Create JWT access token."""
    to_encode = data.copy()
    if expires_delta:
        expire = datetime.utcnow() + expires_delta
    else:
        expire = datetime.utcnow() + timedelta(minutes=15)

    to_encode.update({"exp": expire})
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt

# FastAPI dependency for protected routes
security = HTTPBearer()

async def get_current_user(
    credentials: HTTPAuthorizationCredentials = Depends(security),
    session: Session = Depends(get_session)
):
    """Extract and validate user from JWT token."""
    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Could not validate credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )

    try:
        token = credentials.credentials
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        user_id: str = payload.get("sub")
        if user_id is None:
            raise credentials_exception

    except JWTError:
        raise credentials_exception

    user = session.get(User, user_id)
    if user is None:
        raise credentials_exception

    return user

# Usage in endpoints
@router.post("/protected-endpoint")
async def protected_route(
    current_user: User = Depends(get_current_user)
):
    """Endpoint protected by JWT authentication."""
    return {"user_id": current_user.id, "email": current_user.email}

POST   /api/v1/auth/register    - Register new user
POST   /api/v1/auth/login       - Login and get token
POST   /api/v1/auth/refresh     - Refresh access token
POST   /api/v1/auth/logout      - Logout (invalidate token)
GET     /api/v1/auth/me          - Get current user profile
PUT     /api/v1/auth/me          - Update profile

JWT_SECRET=your-secret-key-here
JWT_ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30
REFRESH_TOKEN_EXPIRE_DAYS=7
BCRYPT_ROUNDS=12