Auth strategy: roll-your-own vs alternatives #24

New issue

Closed

opened 2026-03-22 21:56:00 +00:00 by barrettruth · 0 comments

barrettruth commented

2026-03-22 21:56:00 +00:00

Question

What auth approach fits delta? It's self-hosted but friends may want accounts too.

Current Implementation (on `feat/scaffold`)

~100-line src/core/auth.ts with:

bcrypt password hashing
Random session tokens (7-day expiry, httpOnly cookies)
API key generation and validation for CLI/integrations
Multi-user: each user gets their own account, sessions, API keys

Considerations

Hosted at delta.barrettruth.com — internet-accessible
Multi-user schema already exists (D010)
Friends may want their own accounts
Need API access for CLI client (#23)
Lucia (popular Next.js auth lib) is deprecated; author recommends DIY
Auth.js is overkill for this use case

Open Questions

Should users be able to self-register, or invite-only?
Per-user task isolation or shared workspace?
Rate limiting on login endpoint?

Status

Basic implementation exists and is tested (11 tests). Revisit when multi-user becomes a real requirement.

## Question What auth approach fits delta? It's self-hosted but friends may want accounts too. ## Current Implementation (on `feat/scaffold`) ~100-line `src/core/auth.ts` with: - bcrypt password hashing - Random session tokens (7-day expiry, httpOnly cookies) - API key generation and validation for CLI/integrations - Multi-user: each user gets their own account, sessions, API keys ## Considerations - Hosted at `delta.barrettruth.com` — internet-accessible - Multi-user schema already exists (D010) - Friends may want their own accounts - Need API access for CLI client (#23) - Lucia (popular Next.js auth lib) is deprecated; author recommends DIY - Auth.js is overkill for this use case ## Open Questions - Should users be able to self-register, or invite-only? - Per-user task isolation or shared workspace? - Rate limiting on login endpoint? ## Status Basic implementation exists and is tested (11 tests). Revisit when multi-user becomes a real requirement.