auth-patterns
Provides authentication and authorization patterns for JWT handling and RBAC; use when implementing login, token management, OAuth integration, or RBAC, or when reviewing auth code.
Source facts
- Repository
- sawrus/agent-guides
- Last source activity
- October 16, 2026 at 19:08
- Detected SKILL.md language
- English
- Stars
- 19
- Forks
- 4
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview- name
- auth-patterns
- description
- Provides authentication and authorization patterns for JWT handling and RBAC; use when implementing login, token management, OAuth integration, or RBAC, or when reviewing auth code.
# Skill: Authentication & Authorization Patterns
## When to load
When implementing login, token management, OAuth integration, RBAC, or reviewing auth code.
## JWT Best Practices
```python
def create_access_token(user_id: str) -> str:
return jwt.encode(
payload={
"sub": user_id,
"iat": datetime.utcnow(),
"exp": datetime.utcnow() + timedelta(minutes=15), # Short expiry
"jti": str(uuid.uuid4()), # Unique ID for revocation
"type": "access", # Prevent refresh token as access token
},
key=settings.JWT_PRIVATE_KEY,
algorithm="RS256", # Asymmetric. Never HS256 in distributed systems.
)
```
**Anti-patterns**: No `exp` claim; storing JWT in `localStorage`; using `alg: none`; sensitive data in payload.
## RBAC Pattern
```python
PERMISSIONS = {
"invoices:read": ["viewer", "editor", "admin"],
"invoices:create": ["editor", "admin"],
"invoices:delete": ["admin"],
}
def require_permission(permission: str):
def dependency(current_user: User = Depends(get_current_user)):
allowed_roles = PERMISSIONS.get(permission, [])
if current_user.role not in allowed_roles:
raise HTTPException(status_code=403)
return current_user
return dependency
```
View on GitHub