Authentication

Execution Workflow

1. Choose the identity mechanism first: session, JWT header, JWT cookie, OAuth2 password bearer, or custom middleware based on client and trust boundaries.
2. Attach authentication once at app scope with on_app_init or middleware.
3. Configure exclusion rules explicitly for login, schema, health, and other public routes.
4. Use request.user and request.auth only after authentication has been established.
5. Apply guards separately for authorization checks.
6. Keep missing or invalid credential behavior consistent with the exception-handling strategy.

Core Rules

• Keep authentication separate from request parsing and authorization.
• Let request parsing validate input fields before auth-specific business logic where possible.
• Prefer built-in security backends before custom middleware.
• Use custom middleware only when the identity source does not fit a built-in backend.
• Treat request.user and request.auth as authenticated context, not parsing shortcuts.
• Keep exclusion rules narrow and reviewable.