Variant B — Claude Light · Compact Pane
◐
lokma-web · main
Lokma Harness · #482

Good afternoon, Aylin.
What are we building today?

Start with a brief. Lokma will scaffold the plan, run tools, and keep an inspectable trail.

Aylin
Aylin 14:32

Let's refactor the auth middleware. Move JWT verification into a Fastify preHandler hook so every route can opt-in with a single decorator. Keep it framework-native — no extra deps.

lokma-server Fastify 5
◐
Lokma Claude 4 Sonnet 14:32 · 1.2s

Perfect — that's the cleanest approach. Here's a minimal, typed implementation you can drop in. One hook, one decorator, zero magic.

plugins/auth.ts 
// Fastify preHandler — opt-in per route
import fp from 'fastify-plugin'
import { verifyJwt } from './jwt'

export default fp(async (app) => {
  app.decorateRequest('user', null)
  app.addHook('preHandler', async (req, reply) => {
    if (!req.routeOptions.config?.auth) return
    const token = req.headers.authorization?.replace('Bearer ', '')
    if (!token) return reply.code(401).send({ error: 'missing token' })
    req.user = await verifyJwt(token)
  })
})
No new dependencies · hook runs only when config.auth is set

Why this works well

  • Framework-native. Uses Fastify's own hook system.
  • Opt-in per route. Only routes with config.auth pay the cost.
  • Inspectable. Attaches to request.user.
Aylin
Aylin 14:33

Add rate limiting per user — 60 req/min. Keep it in the same hook if possible.

Thinking — checking rate-limit patterns…

Lokma can make mistakes. Review patches before applying.