Auth Service

​

Overview

​

Endpoints

​

Authentication

​

Email Verification and Password

​

Organization Management

​

Platform Config (Superadmin)

​

Prompt Type Registry (Superadmin)

​

System Prompt Defaults (Superadmin)

​

JWT Pattern

• The auth service issues and signs JWTs (signJwt); the gateway verifies them on every request (verifyJwt(token, JWT_SECRET)); downstream services trust the auth context the gateway forwards as headers:
  // Auth service signs:
  const token = signJwt(payload, JWT_SECRET);
  // Gateway verifies:
  const payload = verifyJwt(token, JWT_SECRET);
  
• Payload structure:
  {
    "userId": "uuid",
    "email": "[email protected]",
    "platformRole": "user",
    "organizations": [
      { "id": "uuid", "name": "My Org", "slug": "my-org", "role": "owner" }
    ]
  }
  
• Access token: 24h, Refresh token: 7d (configurable)
• First registered user is auto-promoted to superadmin

​

Platform Config System

• Repository: ConfigRepository manages the platform_config table
• Encryption: AES-256-GCM using JWT_SECRET as key (via @brainstormer/shared encrypt/decrypt)
• Precedence: DB values take precedence over env vars (getConfigValue() checks DB first, falls back to process.env)
• Categories: ai, voice, knowledge, feature_flags
• Admin UI: Manages all API keys (OPENROUTER, OPENAI, ELEVENLABS, LIVEKIT, PINECONE, etc.)

​

Prompt Registry and Defaults

​

Database Tables

​

Email (Resend)

• Email types: verification, OTP, password reset, invitation, welcome
• Fallback: Console logging if RESEND_API_KEY not set
• Config: RESEND_API_KEY, EMAIL_FROM, WEB_APP_URL

​

Configuration Variables

JWT_SECRET=your-secret
JWT_EXPIRES_IN=24h
JWT_REFRESH_EXPIRES_IN=7d
DATABASE_URL=postgresql://brainstormer:<password set by POSTGRES_PASSWORD>@localhost:5432/brainstormer
RESEND_API_KEY=re_...
EMAIL_FROM=[email protected]
WEB_APP_URL=https://bsio2.brainstormer.io
BCRYPT_ROUNDS=12
REDIS_HOST=localhost