Auth Service

goalixa-auth/
├── app.py                    # Single-file Flask application
├── auth/
│   ├── jwt.py               # JWT token handling
│   ├── models.py            # Database models
│   ├── oauth.py             # Google OAuth
│   ├── email.py             # Email service
│   ├── metrics.py           # Prometheus metrics
│   └── rate_limiter.py      # Rate limiting
├── data.db                  # SQLite database
└── requirements.txt

class User:
    id: int
    email: str
    password_hash: str
    active: bool
    email_verified: bool
    created_at: datetime
    updated_at: datetime

class RefreshToken:
    id: int
    user_id: int
    jti: str              # Token identifier
    token: str            # Hashed token
    device_name: str
    device_type: str
    fingerprint: str
    user_agent: str
    ip_address: str
    expires_at: datetime
    created_at: datetime

class PasswordResetToken:
    id: int
    user_id: int
    token: str
    expires_at: datetime  # 30 minute TTL
    created_at: datetime

curl -X POST http://localhost:5001/api/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePass123!"
  }'

{
  "message": "User registered successfully",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "email_verified": false
  }
}

curl -X POST http://localhost:5001/api/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePass123!"
  }'

{
  "message": "Login successful",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "email_verified": true
  }
}

curl -X POST http://localhost:5001/api/refresh \
  -H "Cookie: refresh_token=<refresh_token>"

{
  "message": "Token refreshed"
}

curl -X POST http://localhost:5001/api/logout \
  -H "Cookie: access_token=<access_token>"

# Step 1: Initiate OAuth
curl -X GET "http://localhost:5001/api/oauth/google/start?return_to=http://localhost:3000"
 
# Redirects to Google, then callback sets cookies

# All auth cookies are:
- HTTPOnly: True      # Prevent JavaScript access
- Secure: True        # HTTPS only in production
- SameSite: "lax"     # CSRF protection
- Domain: Configurable

docker run -p 5001:5001 \
  -e AUTH_JWT_SECRET=your-secret \
  -e GOOGLE_CLIENT_ID=your-client-id \
  -e GOOGLE_CLIENT_SECRET=your-client-secret \
  goalixa-auth:latest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth-service
spec:
  replicas: 2
  selector:
    matchLabels:
      app: auth-service
  template:
    metadata:
      labels:
        app: auth-service
    spec:
      containers:
      - name: auth-service
        image: goalixa/auth:latest
        ports:
        - containerPort: 5001
        env:
        - name: AUTH_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: goalixa-secrets
              key: jwt-secret
        - name: AUTH_DATABASE_URI
          value: postgresql://user:pass@postgres:5432/auth
        - name: GOOGLE_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: goalixa-secrets
              key: google-client-id
        - name: GOOGLE_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: goalixa-secrets
              key: google-client-secret
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
        livenessProbe:
          httpGet:
            path: /health
            port: 5001
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 5001
          initialDelaySeconds: 5
          periodSeconds: 5