← Auth / Security

Stack and structure

auth / security · workzone
Backend
stack — libraries
Framework
FastAPI Pydantic Settings SQLAlchemy · async asyncpg Redis
Authentication
argon2-cffi PyJWT email-validator python-multipart · Form
Password policy → Password policy
zxcvbn · strength httpx · HIBP API
stdlib → Crypto core
secrets · CSPRNG hmac · const-time hashlib · SHA-256
Encryption → Crypto core
cryptography · AES-256-GCM
Additional v2
pyotp · TOTP
structure — files · achilles/auth/ 
auth/              module = its own package
├── *.py           constants · models · schemas · security · dependencies · …
├── services/      business logic — a folder from the start
└── routes/        endpoints — a folder from the start
Frontend
stack — libraries
Stack
React TanStack Query react-router-dom ky · HTTP + auth
structure — files · src/features/auth/ 
features/auth/     module = its own package
├── *.ts / *.tsx   api · types · constants · AuthProvider · useAuth · ProtectedRoute
└── pages/         module screens
Why features/ — domain modules
Alongside the existing shared folders (components/, hooks/, lib/). Future modules → features/admin/, features/agents/, etc.
Forbidden libraries — do not use: python-jose (history of CVEs, poorly maintained), passlib (unmaintained since 2020).