FastAPI & Supabase JWT Auth Zero-Trust Cursor Rules
Secure FastAPI microservice .cursorrules with Supabase asymmetric JWT verification, Zero-Trust mTLS headers, and OpenAI SDK v4.
Framework: FASTAPI
Database/ORM: SUPABASE
Security: MTLS, DOCKER, OAUTH
AI SDK: OPENAI
Audience: Fintech and healthtech backend teams needing compliance
Production .cursorrules Blueprint
---
description: Secure FastAPI microservice .cursorrules with Supabase asymmetric JWT verification, Zero-Trust mTLS headers, and OpenAI SDK v4.
globs: ["src/**/*", "app/**/*", "services/**/*"]
alwaysApply: true
---
# ====================================================================
# Warplogic AI Production Stack Rules: FastAPI & Supabase JWT Auth Zero-Trust Cursor Rules
# Generated via Warplogic AI Stack Builder (https://www.warplogicai.com)
# Free Zero-Trust Mesh & .cursorrules Generator
# Share this configuration: https://www.warplogicai.com/?tab=builder&fw=fastapi&db=supabase&sec=mtls,docker,oauth&ai=openai
# ====================================================================
You are an expert Principal Engineer specializing in high-performance, secure software architecture.
## 1. Core Architecture & Framework Standards:
- Target: Python 3.12+ with FastAPI and Pydantic v2.
- All request/response payloads must be strongly validated via Pydantic BaseModel with strict type annotations.
- Use native async def route handlers with dependency injection (Depends()).
- Structure controllers into APIRouter modules co-located in api/v1 namespaces.
## 2. Database & State Integrity:
- Target: Supabase Postgres with Row Level Security (RLS) ALWAYS ENABLED.
- Every table MUST have explicit SELECT, INSERT, UPDATE, DELETE policies bound to auth.uid().
- Access data using the official @supabase/ssr or supabase-py client with service_role keys restricted to secure backends.
## 3. Security & Zero-Trust Guardrails (Warplogic Hardened):
- SPIFFE/SVID Mutual TLS: Inter-service communication must require TLS 1.3 with client certificate SAN URI validation.
- Block unauthenticated plain HTTP traffic between internal microservices.
- Production Docker: Multi-stage builds, non-root user (USER nonroot:nonroot), zero sensitive build-args in final images.
- Keep base images pinned to minimal distroless or alpine hashes.
- Auth & Tokens: Use RS256/ES256 asymmetric JWT validation with automatic public key rotation.
- Never store plaintext secrets or API tokens in git; load via environment variables or secret vaults.
## 4. AI & Agent Integration:
- Use OpenAI SDK v4 with beta.chat.completions.parse() and Zod schemas for guaranteed 100% structured JSON outputs.
- Stream responses using async iterators (for await ... of stream).
Related Architecture & Compliance Blueprints (Canva-Style Grid)