moai-domain-backend

Define Pydantic response models, create endpoints with HTTPBearer security dependencies, and return typed responses. The Skill provides patterns for list and create endpoints with JWT-based authentication using HS256 tokens.

Use a CryptContext with bcrypt for password hashing and encode JWTs with HS256 algorithm and expiration claims. The Skill's SecurityManager pattern defaults to 15-minute token expiration with hash_password and verify_password methods.

SQLAlchemy provides ORM-based access to PostgreSQL with connection pooling and declarative models, while Motor is an async driver for MongoDB document operations. Choose SQLAlchemy for relational schemas and Motor for flexible document storage.

Yes, configure the engine with QueuePool, pool_size of 20, max_overflow of 30, and pool_pre_ping for health checks. Add event listeners to track query timing and log queries exceeding 100ms thresholds.

Frontend validation improves user experience but provides no security since requests can bypass the client entirely. Backend validation is the actual security boundary and must sanitize all input before processing.

Use event-driven patterns when services need loose coupling and asynchronous communication, such as publishing domain events after state changes. The Skill's EventBus pattern uses aio_pika to publish JSON-serialized events with routing keys.