Auth spike snapshot — 2026-05-18
Frozen copy of every file that lived on the auth-spike branch (tag
auth-stashed-v1, tip commit 7fea5e8e). The branch was deleted after
extraction; this directory is the durable in-tree copy.
These files are not part of any workspace, won't compile, and don't run anything. They sit here as plain text so future-us can find them via normal repo browsing without needing to know the tag exists.
What's here
| Path | What it is |
|---|---|
SPIKE-LOG.md |
Six-hour chronological learning journal (gotchas, surprises, dead ends) |
wiki/content/runbooks/AUTH-OPS.md |
Mint / revoke / rotate / debug / wipe runbook |
lib/auth-bearer/ |
Shared SHA-256 bearer token library extracted from qa-platform. 37 tests in src/*.test.ts. |
careervector-auth/ |
New CF Worker scaffold for CV admin sessions (passkey-only, kysely-d1). 2 tests. |
jobcache/interface/src/auth/ |
Better Auth integration: config, plugins (passkey + api-key), session middleware, GDPR me-endpoints, PII strip, rate-limit + bearer-vs-session learning tests. 51 tests. |
jobcache/interface/src/ui/hooks.server.ts |
SvelteKit session hydration + redirect-to-sign-in gating |
jobcache/interface/src/ui/lib/auth-guard.ts |
requireSession() / getSession() helpers for SK server handlers |
When you come back
- Read
SPIKE-LOG.mdfirst — it has every gotcha as a dated entry. - Read
../auth-pick/README.md(one level up) for the design rationale. - Read
../PRIVACY-POSTURE.mdfor the data-minimization principle. - The code here is a starting point, not the final answer. Better Auth 1.6.11 was the library at spike time; check for newer versions.
- The 14 commits that built this spike live at tag
auth-stashed-v1if you want the chronological git history. The branch is gone.