fastapi-fullstack 0.2.17__py3-none-any.whl → 0.2.18__py3-none-any.whl

{fastapi_fullstack-0.2.17.dist-info → fastapi_fullstack-0.2.18.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-fullstack
-Version: 0.2.17
+Version: 0.2.18
 Summary: Full-stack FastAPI + Next.js template generator with PydanticAI/LangChain agents, WebSocket streaming, 20+ enterprise integrations, and Logfire/LangSmith observability. Ship AI apps fast. CLI tool to generate production-ready FastAPI + Next.js projects with AI agents, auth, and observability.
 Project-URL: Homepage, https://github.com/vstorm-co/full-stack-ai-agent-template
 Project-URL: Documentation, https://github.com/vstorm-co/full-stack-ai-agent-template#readme
@@ -298,7 +298,9 @@ For frontend deployment to **Vercel**:
 cd frontend && npx vercel --prod
 ```
 
-In the Vercel dashboard set `BACKEND_URL`, `BACKEND_WS_URL`, `NEXT_PUBLIC_AUTH_ENABLED=true`.
+In the Vercel dashboard set `BACKEND_URL` (server-side), plus `NEXT_PUBLIC_API_URL`,
+`NEXT_PUBLIC_WS_URL` (`wss://…`) and `NEXT_PUBLIC_SITE_URL` — the `NEXT_PUBLIC_*` ones are
+inlined at build time, so they need a redeploy to take effect.
 
 </details>
 

{fastapi_fullstack-0.2.17.dist-info → fastapi_fullstack-0.2.18.dist-info}/RECORD

@@ -17,24 +17,24 @@ fastapi_gen/upgrade/rename_guard.py,sha256=ap0ds5k93Hh6hhQhOxrDPsh-utTE1BeBYysrT
 fastapi_gen/upgrade/render.py,sha256=PmEm7BPmEfUK29RcVgPN9PttTX7oHeWnDgf_vgGja1s,5497
 fastapi_gen/upgrade/report.py,sha256=49v9kq2tkbeqqbdH-kRIM3kccaFfPVfjhi7Tm5cCVvE,3802
 fastapi_gen/upgrade/runner.py,sha256=msnj2RYii6low6gPeZ4TRMlL01Hq8a0zJyLBzPotxCI,19302
-fastapi_gen/UPGRADES.yaml,sha256=1vnWLTRGs4jwND7rdW9Yckyyuoj4zZn6s8hr7PKbedc,691
+fastapi_gen/UPGRADES.yaml,sha256=DciwcDB-T5LBX-PVTLBqSrm3t6gVL3Mhm5McBkOkORo,1524
 fastapi_gen/template/VARIABLES.md,sha256=9CcimCDgXLshogzr1pjRYUTTmECCL9NAb1OzDFNTfgw,34322
 fastapi_gen/template/cookiecutter.json,sha256=xikYtcbOLG4VOwZXAk-0acbELW8jXhHAGEg4kGEgRdg,6337
-fastapi_gen/template/hooks/post_gen_project.py,sha256=ZmwbJr4nieVo22uftzea-WwMoB5FEiXJT3c_w5cL8Yk,57337
+fastapi_gen/template/hooks/post_gen_project.py,sha256=o79caVy6BKSjgK2rpEYlLx0TEA3kAOg03yPDePuGfkY,58054
 fastapi_gen/template/{{cookiecutter.project_slug}}/.gitignore,sha256=yC3ZUp8Txp_1TPDabDlz4pGa2p1cNwr49de0dCcctOw,1515
 fastapi_gen/template/{{cookiecutter.project_slug}}/.gitlab-ci.yml,sha256=dZh-VSLL5beOtj8_UxBbD86sBdE9ubTpmWvMcrRqr-M,4651
 fastapi_gen/template/{{cookiecutter.project_slug}}/AGENTS.md,sha256=HqhXNdBq1ZXlFJCC4V3CY8DorTkZkwFJcvv2O77Pwk4,2454
 fastapi_gen/template/{{cookiecutter.project_slug}}/CLAUDE.md,sha256=OwM3tVeznjnSr8h0Ors27AIqB7DqC8X1rYLw1fQE0x0,3657
 fastapi_gen/template/{{cookiecutter.project_slug}}/CONTRIBUTING.md,sha256=pxP7KcIbmZbao1HPnFEykJbCHa7VfW2RQWfBMNSE_kE,3304
-fastapi_gen/template/{{cookiecutter.project_slug}}/ENV_VARS.md,sha256=t8iwCVu3XV3lAJIvA3nYsbE7Y25JXgkrBMAJt_iiJUc,8234
+fastapi_gen/template/{{cookiecutter.project_slug}}/ENV_VARS.md,sha256=NSNkHTEphs6TCKgY5kzhnLmejw9PQKOP3KmWmvCnCSA,8975
 fastapi_gen/template/{{cookiecutter.project_slug}}/MANUAL_STEPS.md,sha256=6HJW2WE6-U4jbyQT7BjH17N6I2xAXbaAKbANiNEFNRA,7775
-fastapi_gen/template/{{cookiecutter.project_slug}}/Makefile,sha256=eW9jQETTbbgSV6rDzfV50OIr__i8hHMBLHYQD2JE2a0,17983
-fastapi_gen/template/{{cookiecutter.project_slug}}/README.md,sha256=faY_FSgHSMc5PhrHFbJGmJpRa0gxUwZLF6JZ4Qn7Ac4,13878
+fastapi_gen/template/{{cookiecutter.project_slug}}/Makefile,sha256=Pjqb8ph2XTiuEWhC99ECjYGMjq_ZiT8epdN5YgjzLos,18018
+fastapi_gen/template/{{cookiecutter.project_slug}}/README.md,sha256=nXNh5TKj2wMqxZDxoFp7Q1ej87IL-Rt_VTGBkQLfKCw,14314
 fastapi_gen/template/{{cookiecutter.project_slug}}/SECURITY.md,sha256=7X5u7feq2AXxWv2CMMNQZf5QQ5QkwBnzKlrcLz3RJ_Q,4735
-fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.dev.yml,sha256=r7WaOV4WNbKenkd28et8KRU6YD5VtF2rSyOysjN3fa8,12347
-fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.frontend.yml,sha256=nmMjmzmyVudK9vZoFBmHNv4q4-ydq_lW5X4YrxEpP8E,2052
-fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.prod.yml,sha256=cWGAIUXBywj1B1FmhhNzwIOgUtO2B8Fvl8-QNjLtkso,22282
-fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.yml,sha256=s9bplsIGSzg4i0AIPtDkAHe7X0lrnJDcBUOdca83FAg,13634
+fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.dev.yml,sha256=0LdkV4HIJX9lEtqTfYZsjbYARAvxSCeIjZ_VSRrN5LU,12347
+fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.frontend.yml,sha256=5Iu2j3ChoUGn7VTVKLkXbGwtI21z1WdHg0IPhV3dPOQ,2726
+fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.prod.yml,sha256=WJrgVG04QZpuD0j0iOmM7id4gurbFfQu6YJGSwaDWyM,24589
+fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.yml,sha256=rcYyrFsuRdY6yMTfVQvnFbOeeRIRkLLdnX2u_x0_ORs,13634
 fastapi_gen/template/{{cookiecutter.project_slug}}/.claude/settings.json,sha256=i6XfBDlx6N1AXg4-MrjmIzPhxRXvQC9PRXJFZyfNs1Y,363
 fastapi_gen/template/{{cookiecutter.project_slug}}/.claude/commands/add-endpoint.md,sha256=p0EsXDvW23v4uOSPRlwA84nVrB7_VVL_FnKFEE442AQ,1648
 fastapi_gen/template/{{cookiecutter.project_slug}}/.claude/commands/fix-issue.md,sha256=3bcQwYzf_EXTit9nlkplUd0-G5T9-gGranogIDS_kjU,800
@@ -60,7 +60,7 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/backend/.env.example,sha256=H
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/.pre-commit-config.yaml,sha256=22sYeJOrYywl_5PWgPzCyIwhpqmymIDIzx2hlBRQ-yI,681
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/Dockerfile,sha256=CKyuUKwt41LHIH9VB28TEzes5_TQkUEo9rIBjE3v8a8,2184
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/alembic.ini,sha256=vncO8XHTAW1ospWsdvtXD5PyMhp91CJmdVfv-6TakAY,737
-fastapi_gen/template/{{cookiecutter.project_slug}}/backend/pyproject.toml,sha256=2mEGHW6wmz0FiRrwJ-W4OfuEIs9B3g08ymBKH-zxOY0,14030
+fastapi_gen/template/{{cookiecutter.project_slug}}/backend/pyproject.toml,sha256=nWgclrugZfrxqEA1dgSjMNTMNfCU11Qf0Vs9AjRnpHE,14780
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/alembic/env.py,sha256=ifDazpmfYDUI0KGxaGcAgJbz6HNzu9bQYB6li88OMcU,3163
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/alembic/script.py.mako,sha256=ZCfgWrEMJRDF_WF_GRGptwAIJI6YnAditBG1axwAP9Q,700
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/alembic/versions/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -96,7 +96,7 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/admin.py,sha256=Q
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/main.py,sha256=CcUQKjWvANuNCRIS_vEry6ZglCs1wIwD76HkbMa3BHw,18948
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/__init__.py,sha256=DP_Hrjq0WlyuWhrkplLKmS3pVsoGZgFQgXhAcsjqBlQ,1889
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/assistant.py,sha256=NXZTvQBn7iaqQVcXCUwAusSKx1PmBpcDiYl2uUa6hKA,22196
-fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/deepagents_assistant.py,sha256=DDNw13jlftfntPsM2ZVdJQyWqc2FFPcEXFo6wyZttbM,30208
+fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/deepagents_assistant.py,sha256=vziHT47EmLWSh7RJWCAUHGu5orxm1PrINwLEc7OJJN8,30372
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/langchain_assistant.py,sha256=sX9dbzwR-X-HQvPWLgEunbzEv-DcJp7Db6VsCYwf0eY,13158
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/langgraph_assistant.py,sha256=uSDnHa7VvbPwQ_csqjMpmTlv_RTym4GkHUasbWlQdpU,15363
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/mcp.py,sha256=g3-R_dWEwNUzNN8BPsgc1sqNR1n7JoNiwtUYRgTAm8o,8614
@@ -150,7 +150,7 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/api/routes/v1/tel
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/api/routes/v1/users.py,sha256=maIccIgybZvB_54IaE9wrI8-TxdAoSb1ATWTDbk3sZU,3802
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/api/routes/v1/webhooks.py,sha256=1q3lkSy7cEr8KY2PNSbWYhOrJjqHKC3ujMbvxi4mkMs,5647
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/clients/__init__.py,sha256=gA4EUVDQQoTzeaLzFHZEA6Ps0eO7eo8NYjhNUDkzwzs,281
-fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/clients/redis.py,sha256=i_HpxZnpHkyF5U80fS1wDawC4d3ShzGqAObOjgEPP0k,2731
+fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/clients/redis.py,sha256=Q67nC1xl-ImX-oWh-Ii1QBsl9srd9IZt3v8-Pr0bwzw,3075
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/commands/__init__.py,sha256=P912XHMGspKPltxdR7Ac7anC76a6DyDVXc_o-clV_94,3097
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/commands/channel.py,sha256=l5tHqHirVT00g0kkPASvcYQANrsm-fq5_F2yTb-3De8,6182
 fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/commands/cleanup.py,sha256=ocirlds_LqKbzB-s0Jbz6n0CJdv3Uec34ysZHkm16rQ,2110
@@ -390,10 +390,10 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/docs/adding_features.md,sha25
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/architecture.md,sha256=Lg8RzpLDO9tA-zVE3lFnllnTkW-FvQwc7-XMseneTq4,11806
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/commands.md,sha256=fwd58qBEN_mRS4ipOaUnR6A4B3SlqE5piMdsUXXQULg,11621
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/configuration.md,sha256=dKeJ3tmZp15HbK1ndnfQ3dVVfVGpcj9CSBXQutoxv4A,17645
-fastapi_gen/template/{{cookiecutter.project_slug}}/docs/deploy.md,sha256=NkFgg_n6CA9Av-CzM4ALvksafLEF2bt2zBurN-TsgRk,5715
+fastapi_gen/template/{{cookiecutter.project_slug}}/docs/deploy.md,sha256=AvOHofpCqSXTNtt_7LagS5PVIxMQXorALiPe9FtTTU4,7607
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/file-processing.md,sha256=ss5pGrKvcKPqi2hU31iKd35JS2FzqPWObavfD5DpMmU,11003
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/patterns.md,sha256=FiEkdtRMkhPcU32spCnnEQFts0gh-3kGchKZoA1QK9A,5976
-fastapi_gen/template/{{cookiecutter.project_slug}}/docs/permissions.md,sha256=dEoSArf7qyni9dwz1mXBfpRkcUE-y7zIgJu_SgODoEo,9883
+fastapi_gen/template/{{cookiecutter.project_slug}}/docs/permissions.md,sha256=lzXlt-qE2p2R1tXs-Oc5EKJ4OfFDORsdyTYg5oFfYSc,9877
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/testing.md,sha256=aWdWyLDRJ7g25KXZqDM1c9OR8BlHE3XrCcB1Awz9imE,2835
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/howto/add-agent-tool.md,sha256=vQan0rrqcxNWu0GlWt3_DWN81WUddasINoUzxS3jlhE,2188
 fastapi_gen/template/{{cookiecutter.project_slug}}/docs/howto/add-api-endpoint.md,sha256=vk4vpjvMxuqpDXNC4_KpJpGsluj6BUtgR-If20B3Egg,5883
@@ -431,12 +431,12 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/emails/compiled/welcome.html,
 fastapi_gen/template/{{cookiecutter.project_slug}}/emails/compiled/welcome.txt,sha256=WzYZXM4pbV22E_C8KjSCRevn1j7wbx7ojIXYUuzp1e4,240
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.dockerignore,sha256=aPWb-zCIZu6TI0jiXFs481-eMrOO-FxVvRL3992jrDY,343
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.editorconfig,sha256=bWeW8XS3NrzXpomZ4w0vGaNxmtkjVdzAz9_OimaGRVM,188
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.env.example,sha256=-DZjR8Yz4gVjwlAEVz2WU5lUAtZ6wDUKaUpXc3JGBq8,1076
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.env.example,sha256=kKFRnghhxAoGij0jMyzwqycIGyjVwGV-dGgI3OUuErA,1481
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.gitignore,sha256=fZEN8HisQjcSmxEB3IDWoKA5dTYDzEAXLtqYKvdsprs,439
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.prettierignore,sha256=wYnkkZcvXw2mtuFVzYAjH-eFldFkK5Xn26fsZZ19BK0,161
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.prettierrc,sha256=1byVwTV0G71t2x5Ko6ryNm2oZ8753NfLLqhrCcon4v0,227
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/Dockerfile,sha256=gFukCLmTFut_vKbCOIXSuONONsUjxfc20YzfOSPa5MA,2059
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/README.md,sha256=VWOZbs83mmN49T9LhPASrSeH9aM-NOHY2eeAhrtD1uA,2504
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/Dockerfile,sha256=aRLL3IL_5b-v0Jkev_w9Mif6D3tBa-L_GAwWW5iN1vg,2323
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/README.md,sha256=2vyKiIM-umf7-RlKkgeNLIJhPAyWsan22OhSsiKyDJs,3689
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/eslint.config.mjs,sha256=y48aSi3BZvVi6GvePRqKmfaMJdK6ymN9X5fyeHFlpPU,2663
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/instrumentation.ts,sha256=KKUhYC1lApvs-Vtw9kkzqYiZBaW5axDvHhxeHznljM4,344
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/next.config.ts,sha256=5LYPHgUWe0H8oDoQ7aFBT-OlwC0SSvFJMmoroPAYqp0,3497
@@ -564,15 +564,15 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/admin/st
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/admin/users/route.ts,sha256=OHFRS6yqJ0Dssp_2JILdMrlWPOwN9IObsETNlrcQYyA,1260
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/admin/users/[userId]/route.ts,sha256=n7qz_WZIQsM9982wk8ggIB0KrcioEJ-nnujB_ElrQzQ,2493
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/admin/users/[userId]/impersonate/route.ts,sha256=IoQ5agh5YZHujKHcEfuiBRF-yL1WALXM6gkR7c0jLWM,962
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/login/route.ts,sha256=ns4uvrWQ-d2nacsF1pTYG1cEakvCzNY7NSa7uMZrMKI,1882
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/logout/route.ts,sha256=0qxHR2OPvB2-IVKx0oS5f_U85e6EHq1oM5BCkUBsVeA,1167
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/login/route.ts,sha256=5RaTlPXW0OqhAXyxPBZc4ACbd0zlxskqVE5wkM3FHL0,1600
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/logout/route.ts,sha256=UzERrsLNPhLVYcD6rSAjpqtdol9txwLdReZAW8xvqpo,905
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/magic-link/request/route.ts,sha256=NEeaJx8y4KzSCAoYMYy3BxaeIh5P6hnXj4Z3EGe-RIA,684
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/magic-link/verify/route.ts,sha256=opdxw2xpY7w6PG_vtQ6ciGeVstBxHY0AtFAil_tnamQ,1468
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/me/route.ts,sha256=qifKtoFn6mhc-WKGCgRkMLXAozaV1njzze-7ZC-nMrY,2644
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/oauth-callback/route.ts,sha256=6HCAesKyqQS58QfrLM0LX_9aPDdZ4D7FCxFKQOtzvdU,1505
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/magic-link/verify/route.ts,sha256=2PQ6sHiMH3XcJsQUOs0_T9UEUF1JhR-RNEzwXAbl0bk,1215
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/me/route.ts,sha256=MEo19GyVCzg8E0SiPvf8pmLxbiKgj_80565XKiJ7Azc,2238
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/oauth-callback/route.ts,sha256=Frn_q5_2SY-KrtrqKt2m0fLiDZeGtn1i6GK1X74FT-I,1252
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/password-reset/confirm/route.ts,sha256=u96o_UzWdjLkTFnHfe39BndXK6aNY4F_H-gNjOTwU1M,688
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/password-reset/request/route.ts,sha256=Udibt_OsmUVlF4KhrhoptCg7nc3X58Qt16mwb-Lg9cQ,688
-fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/refresh/route.ts,sha256=NMmXK5X92mofkQ9ca24xrB5vYb2avJWPa7408M2Ibw8,1978
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/refresh/route.ts,sha256=siZmFcGWKSQHnxBacQ4Zw0kUdMMFHnaMdzSV1wqYB8A,1307
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/register/route.ts,sha256=nZVHtIebfXLSFQo1YKiwRSG1sq8sx057O6Y_ufmVF94,792
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/billing/checkout/route.ts,sha256=p1M8tlu9k2OWCcImClgU8_9HuvQ9RNGzo3Nh8HSvwEg,886
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/billing/invoices/route.ts,sha256=-x41bnrREpw__eKDQLVvswWo3xaBG80AFKpS2zLPvEo,860
@@ -858,6 +858,8 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/active-route
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/admin-auth.ts,sha256=2K09o5o8Q24yn1dn1uAfqIIlrCgQQDz4tTFFdJVSCTU,904
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/agent-step-captions.ts,sha256=JjD-uhglLL3D9aUoNElMkjbdD-r4P9AayGUC2YmVO44,2388
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/api-client.ts,sha256=v9qO6pac2VH5j-o0oMhawpOUXDKqGQNrPo4KPUlLFX4,4107
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/auth-cookies.test.ts,sha256=dFoaULW2It1Iv9SZy5MnSAdvYEZHVJuxaOp6yBgLbzM,2802
+fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/auth-cookies.ts,sha256=p9O-xSVIzk0zpJlQ8K2-ANdYxDNhvmzMcQA8ymbKsfA,2344
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/blog.ts,sha256=xaVKtXjwO53zzvVSPEfaifwfVXQzHnpNvpM8zDfElns,4304
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/changelog.ts,sha256=1z3pSuUEks_KmO-E9u5VUt1yXqQFDOrsXeJ-RvUHB0s,4340
 fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/chat-sources.ts,sha256=P7P2-8OvQQTvAzSaRiqRvOb3IkFF6CDgBnRdEAsL9rU,2035
@@ -911,11 +913,11 @@ fastapi_gen/template/{{cookiecutter.project_slug}}/kubernetes/kustomization.yaml
 fastapi_gen/template/{{cookiecutter.project_slug}}/kubernetes/namespace.yaml,sha256=hS9-TeXJNgu28AB0Pv43ob6lLDiavlYu0bwSRI804sA,360
 fastapi_gen/template/{{cookiecutter.project_slug}}/kubernetes/secret.yaml,sha256=IyRrqpENJb5bQon8kxhxbJV0ohKPFyihWJ9tGPFDuVI,1524
 fastapi_gen/template/{{cookiecutter.project_slug}}/kubernetes/service.yaml,sha256=o3bCXguj8E5aQ0H1o3cBD3z_iZ_RA_Pmx1bc0sVzK28,682
-fastapi_gen/template/{{cookiecutter.project_slug}}/nginx/nginx.conf,sha256=gJWUMMqNvr9TwNZOcc_WPPGZvdAlRUH3jLhbllOb_YY,7359
+fastapi_gen/template/{{cookiecutter.project_slug}}/nginx/nginx.conf,sha256=2bWaxnv_rN4driEdtWgVz9eVfoKhB_Ohd_G8eOC3P3M,7619
 fastapi_gen/template/{{cookiecutter.project_slug}}/nginx/ssl/.gitkeep,sha256=o_WQQOgVGOLttT48x0EXSC4BbbDFemApFpmwhybcVUU,617
 fastapi_gen/template/{{cookiecutter.project_slug}}/scripts/export_demo_html.py,sha256=H1tbIfr1xrh2pRuoy5NwvAOYEu0S2vgnw_XsKNMKXeM,10414
-fastapi_fullstack-0.2.17.dist-info/METADATA,sha256=vEhQBnsjDOX1d_ITkhH3yPVog6s_lbND6Et3A1tcXGA,60444
-fastapi_fullstack-0.2.17.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-fastapi_fullstack-0.2.17.dist-info/entry_points.txt,sha256=s9JXrISZp8LMYJGeVofOAd1wPTzpq-jwjSgSf4hWzjs,59
-fastapi_fullstack-0.2.17.dist-info/licenses/LICENSE,sha256=bL4JuK_rcA8y__Gg7PEuTs3g2Qf6VvSz2w2Jajd6nVU,1063
-fastapi_fullstack-0.2.17.dist-info/RECORD,,
+fastapi_fullstack-0.2.18.dist-info/METADATA,sha256=LJac85BvO3ex5oIo2gj3B0A2qB7fLY8e1s855n2Jb7c,60593
+fastapi_fullstack-0.2.18.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+fastapi_fullstack-0.2.18.dist-info/entry_points.txt,sha256=s9JXrISZp8LMYJGeVofOAd1wPTzpq-jwjSgSf4hWzjs,59
+fastapi_fullstack-0.2.18.dist-info/licenses/LICENSE,sha256=bL4JuK_rcA8y__Gg7PEuTs3g2Qf6VvSz2w2Jajd6nVU,1063
+fastapi_fullstack-0.2.18.dist-info/RECORD,,

fastapi_gen/UPGRADES.yaml

@@ -18,4 +18,8 @@
 #   manual_steps:
 #     - "Run `alembic upgrade head` (new billing tables)."
 
-[]
+- version: "0.2.18"
+  manual_steps:
+    - "Rebuild the frontend image: `docker compose -f docker-compose.prod.yml build --no-cache frontend`. NEXT_PUBLIC_* is inlined into the browser bundle at build time and now comes from compose build args, so an image built before this upgrade still has the old ws://localhost URL baked in."
+    - "Serving the frontend over plain http:// with no TLS? Set COOKIE_SECURE=false on the frontend service. The auth cookies are Secure in production and a browser discards a Secure cookie sent over http://, which makes login appear to succeed while every request after it returns 401."
+    - "BACKEND_WS_URL and NEXT_PUBLIC_AUTH_ENABLED were never read by any code and are gone from the env examples. If your deployment sets them, the browser-facing WebSocket origin is NEXT_PUBLIC_WS_URL (build-time)."

fastapi_gen/template/hooks/post_gen_project.py

@@ -623,19 +623,26 @@ else:
                 "# Backend API URL (server-side only - not exposed to browser)",
                 "BACKEND_URL=http://localhost:{{ cookiecutter.backend_port }}",
                 "",
-                "# WebSocket URL for real-time features",
-                "BACKEND_WS_URL=ws://localhost:{{ cookiecutter.backend_port }}",
+                "# Send the auth cookies with the Secure flag. Unset follows NODE_ENV,",
+                "# so production means Secure — and a browser discards a Secure cookie",
+                "# served over plain http://, which logs you in and then 401s every",
+                "# request after it. Only set false for http:// on a trusted network.",
+                "# COOKIE_SECURE=false",
+                "",
+                "# WebSocket URL for the chat stream. Read by the BROWSER, so it must",
+                "# be an address the browser can reach — and NEXT_PUBLIC_* is inlined",
+                "# at build time, so in Docker it has to be passed as a build arg.",
+                "NEXT_PUBLIC_WS_URL=ws://localhost:{{ cookiecutter.backend_port }}",
+                "",
+                "# Public API URL, exposed to the browser (OAuth redirects, API docs",
+                "# links). Same build-time rule as NEXT_PUBLIC_WS_URL above.",
+                "NEXT_PUBLIC_API_URL=http://localhost:{{ cookiecutter.backend_port }}",
                 "",
                 "# Canonical site URL — used for SEO metadata, OG tags, sitemap.xml,",
                 "# robots.txt, schema.org organization. Override in production with",
                 "# the real https origin.",
                 "NEXT_PUBLIC_SITE_URL=http://localhost:{{ cookiecutter.frontend_port }}",
             ]
-            env_lines.extend([
-                "",
-                "# Authentication (always enabled)",
-                "NEXT_PUBLIC_AUTH_ENABLED=true",
-            ])
             if enable_oauth:
                 # Build the comma-separated provider list the OAuth buttons read.
                 # Currently only Google has full backend wiring; expand here when
@@ -644,9 +651,6 @@ else:
                 if "{{ cookiecutter.enable_oauth_google }}" == "True":
                     providers.append("google")
                 env_lines.extend([
-                    "",
-                    "# Public API URL for OAuth redirects (exposed to browser)",
-                    "NEXT_PUBLIC_API_URL=http://localhost:{{ cookiecutter.backend_port }}",
                     "",
                     "# OAuth providers shown on /login + /register (comma-separated).",
                     "# Drives the <OAuthButtons> component — must include only providers",
@@ -670,8 +674,10 @@ else:
             if "{{ cookiecutter.enable_brand_from_config }}" == "True":
                 env_lines.extend([
                     "",
-                    "# Runtime brand override (white-label)",
-                    "# Set NEXT_PUBLIC_BRAND_COLOR to one of: blue, green, red, violet, orange",
+                    "# Brand override (white-label). NEXT_PUBLIC_* is inlined at build",
+                    "# time, so changing these needs a rebuild — in Docker they are",
+                    "# passed as build args (see docker-compose.frontend.yml).",
+                    "# NEXT_PUBLIC_BRAND_COLOR: blue, green, red, violet or orange",
                     "NEXT_PUBLIC_BRAND_COLOR={{ cookiecutter.brand_color }}",
                     "NEXT_PUBLIC_BRAND_LOGO_URL=",
                 ])

fastapi_gen/template/{{cookiecutter.project_slug}}/ENV_VARS.md

@@ -174,6 +174,19 @@ group is for and which are required vs optional.
 | `S3_REGION` | optional | `us-east-1` | AWS region |
 {%- endif %}
 
+{%- if cookiecutter.use_frontend %}
+
+## Frontend (`frontend/.env.local`)
+
+Separate from the backend `.env` above — `frontend/README.md` has the full table.
+The two that decide whether a deployment works at all:
+
+| Variable | Read by | Description |
+|---|---|---|
+| `NEXT_PUBLIC_WS_URL` | browser | WebSocket origin for chat. Inlined at **build** time, so it needs a rebuild to change, and it must be an address the browser can reach — not a Docker service name |
+| `COOKIE_SECURE` | server | `Secure` flag on the auth cookies. Unset follows `NODE_ENV`. A browser drops a `Secure` cookie served over plain `http://`, which makes every request after login return 401 — set `false` only for `http://` on a trusted network |
+{%- endif %}
+
 ## Validation
 
 ```bash

fastapi_gen/template/{{cookiecutter.project_slug}}/Makefile

@@ -387,10 +387,9 @@ vercel-deploy:
 	@echo "✅ Frontend deployed to Vercel!"
 	@echo "   Set environment variables in Vercel dashboard:"
 	@echo "   BACKEND_URL=https://api.your-domain.com"
-	@echo "   BACKEND_WS_URL=wss://api.your-domain.com"
-{%- if cookiecutter.use_jwt %}
-	@echo "   NEXT_PUBLIC_AUTH_ENABLED=true"
-{%- endif %}
+	@echo "   NEXT_PUBLIC_API_URL=https://api.your-domain.com"
+	@echo "   NEXT_PUBLIC_WS_URL=wss://api.your-domain.com"
+	@echo "   NEXT_PUBLIC_SITE_URL=https://your-domain.com"
 {%- if cookiecutter.enable_rag %}
 	@echo "   NEXT_PUBLIC_RAG_ENABLED=true"
 {%- endif %}

fastapi_gen/template/{{cookiecutter.project_slug}}/README.md

@@ -318,7 +318,7 @@ bun run lint
 bun run build
 ```
 
-The frontend talks to the backend through Next.js API route handlers in `src/app/api/*` (server-side proxy that forwards auth cookies to the FastAPI backend). Direct calls to `localhost:{{ cookiecutter.backend_port }}` from the browser are deliberately avoided.
+The frontend talks to the backend through Next.js API route handlers in `src/app/api/*` (server-side proxy that forwards auth cookies to the FastAPI backend), so HTTP traffic never leaves the frontend origin. The one exception is the chat WebSocket: the browser opens it straight against the backend at `NEXT_PUBLIC_WS_URL`, so that origin must be reachable from the browser and the backend port (or a proxy route to it) has to be exposed.
 
 i18n (PL + EN) ships out of the box via `next-intl`. Add a new locale by extending `messages/<lang>.json` and `src/i18n.ts`.
 {%- endif %}
@@ -335,13 +335,18 @@ cd frontend && npx vercel --prod
 
 Set in the Vercel dashboard:
 
-- `BACKEND_URL` = `https://api.your-domain.com`
-- `BACKEND_WS_URL` = `wss://api.your-domain.com`
-- `NEXT_PUBLIC_AUTH_ENABLED` = `true`
+- `BACKEND_URL` = `https://api.your-domain.com` (server-side only)
+- `NEXT_PUBLIC_API_URL` = `https://api.your-domain.com`
+- `NEXT_PUBLIC_WS_URL` = `wss://api.your-domain.com`
+- `NEXT_PUBLIC_SITE_URL` = `https://your-domain.com`
 {%- if cookiecutter.enable_rag %}
 - `NEXT_PUBLIC_RAG_ENABLED` = `true`
 {%- endif %}
 
+`NEXT_PUBLIC_*` values are inlined into the browser bundle at build time, so
+changing one needs a redeploy, and each must be an address the **browser** can
+reach.
+
 ### Backend → your server
 
 ```bash

fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/agents/deepagents_assistant.py

@@ -25,11 +25,10 @@ Configuration via settings:
 """
 
 import logging
-from collections.abc import Callable
 from typing import Any, TypedDict
 
 from deepagents import create_deep_agent
-from deepagents.backends import StateBackend
+from deepagents.backends import BackendProtocol, StateBackend
 from langchain_core.language_models import BaseChatModel
 from langchain_core.messages import AIMessage, HumanMessage, SystemMessage
 {%- if cookiecutter.enable_rag or cookiecutter.enable_web_search or cookiecutter.web_fetch_tool or cookiecutter.enable_charts %}
@@ -307,13 +306,17 @@ class DeepAgentsAssistant:
         self._graph = None
         self._checkpointer = MemorySaver()
 
-    def _create_backend(self) -> Callable:
+    def _create_backend(self) -> BackendProtocol:
         """Create the file-storage backend.
 
+        `create_deep_agent` takes a backend instance, and StateBackend reads the
+        current run's state out of the LangGraph config itself, so it needs no
+        constructor argument.
+
         Returns:
-            BackendFactory (callable) for StateBackend (in-memory, ephemeral).
+            StateBackend (in-memory file state, ephemeral, no external deps).
         """
-        return lambda rt: StateBackend(rt)
+        return StateBackend()
 
     def _create_model(self) -> BaseChatModel:
         """Create the LLM model for DeepAgents."""

fastapi_gen/template/{{cookiecutter.project_slug}}/backend/app/clients/redis.py

@@ -39,10 +39,18 @@ class RedisClient:
             self.client = None
 
     async def get(self, key: str) -> str | None:
-        """Get a value by key."""
+        """Get a value by key.
+
+        `connect()` sets decode_responses=True, so the value comes back decoded —
+        but redis-py's annotation cannot express that and still admits `bytes`.
+        Decode explicitly rather than asserting the flag through a type: ignore.
+        """
         if not self.client:
             raise RuntimeError("Redis client not connected")
-        return await self.client.get(key)  # type: ignore[no-any-return]
+        value: str | bytes | None = await self.client.get(key)
+        if isinstance(value, bytes):
+            return value.decode("utf-8")
+        return value
 
     async def set(
         self,

fastapi_gen/template/{{cookiecutter.project_slug}}/backend/pyproject.toml

@@ -75,7 +75,13 @@ dependencies = [
     "aiosmtplib>=3.0.0",
 {%- endif %}
 {%- if cookiecutter.enable_pagination %}
-    "fastapi-pagination>=0.12.31",
+    # 0.15.16 is broken against every FastAPI without the private _get_body_field
+    # helpers (i.e. anything below 0.140.5, which includes the pin above): its
+    # ImportError fallback binds the public get_body_field but still sets
+    # _get_body_field_new_signature = True, so add_pagination() calls it with a
+    # body_params kwarg it does not accept and the app dies on import. Lift the
+    # cap once upstream fixes the fallback or the FastAPI pin moves past 0.140.5.
+    "fastapi-pagination>=0.12.31,<0.15.16",
 {%- endif %}
 {%- if cookiecutter.enable_sentry %}
     "sentry-sdk[fastapi]>=2.53.0",
@@ -154,7 +160,11 @@ dependencies = [
     "langgraph-checkpoint>=4.0.0",
 {%- endif %}
 {%- if cookiecutter.use_deepagents %}
-    "deepagents>=0.1.0",
+    # Capped: the backend API is still moving between minors (0.7 dropped the
+    # runtime argument from StateBackend and switched create_deep_agent to take
+    # an instance instead of a factory), so an unbounded pin breaks generation
+    # on release day.
+    "deepagents>=0.7.1,<0.8",
 {%- if cookiecutter.use_openai %}
     "langchain-openai>=1.1.0",
 {%- endif %}

fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.dev.yml

@@ -162,7 +162,7 @@ services:
     restart: unless-stopped
 
   milvus:
-    image: milvusdb/milvus:v2.6.21
+    image: milvusdb/milvus:v2.6.22
     container_name: {{ cookiecutter.project_slug }}_milvus
     command: ["milvus", "run", "standalone"]
     ports:

fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.frontend.yml

@@ -11,26 +11,32 @@ services:
       context: ./frontend
       dockerfile: Dockerfile
       args:
-        # NEXT_PUBLIC_* are baked into the browser bundle at build time. The
-        # browser runs on the host, so it reaches the backend on localhost.
-        - NEXT_PUBLIC_API_URL=http://localhost:{{ cookiecutter.backend_port }}
-        - NEXT_PUBLIC_WS_URL=ws://localhost:{{ cookiecutter.backend_port }}
-        - NEXT_PUBLIC_SITE_URL=http://localhost:{{ cookiecutter.frontend_port }}
+        # NEXT_PUBLIC_* are baked into the browser bundle at build time, so a
+        # runtime `environment:` entry cannot change them — after editing these
+        # you must rebuild: docker compose -f docker-compose.frontend.yml build
+        # --no-cache frontend. They must point at an address the BROWSER can
+        # reach; the defaults assume the browser runs on the Docker host. When
+        # you open the app from another machine, set PUBLIC_HOST to this host's
+        # address (e.g. PUBLIC_HOST=10.0.0.5) or override each URL directly.
+        - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://${PUBLIC_HOST:-localhost}:{{ cookiecutter.backend_port }}}
+        - NEXT_PUBLIC_WS_URL=${NEXT_PUBLIC_WS_URL:-ws://${PUBLIC_HOST:-localhost}:{{ cookiecutter.backend_port }}}
+        - NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-http://${PUBLIC_HOST:-localhost}:{{ cookiecutter.frontend_port }}}
         - NEXT_PUBLIC_MAX_UPLOAD_SIZE_MB=50
 {%- if cookiecutter.enable_oauth %}
         - NEXT_PUBLIC_OAUTH_PROVIDERS={% if cookiecutter.enable_oauth_google %}google{% endif %}
 {%- endif %}
         - NEXT_PUBLIC_RAG_ENABLED={% if cookiecutter.enable_rag %}true{% else %}false{% endif %}
+{%- if cookiecutter.enable_brand_from_config %}
+        - NEXT_PUBLIC_BRAND_COLOR=${NEXT_PUBLIC_BRAND_COLOR:-{{ cookiecutter.brand_color }}}
+        - NEXT_PUBLIC_BRAND_LOGO_URL=${NEXT_PUBLIC_BRAND_LOGO_URL:-}
+{%- endif %}
     container_name: {{ cookiecutter.project_slug }}_frontend
     ports:
       - "{{ cookiecutter.frontend_port }}:{{ cookiecutter.frontend_port }}"
     environment:
       - NODE_ENV=development
-      - BACKEND_URL=http://host.docker.internal:{{ cookiecutter.backend_port }}
-      - BACKEND_WS_URL=ws://host.docker.internal:{{ cookiecutter.backend_port }}
-{%- if cookiecutter.enable_rag %}
-      - NEXT_PUBLIC_RAG_ENABLED=true
-{%- endif %}
+      # Server-side only: resolved inside this container, never by the browser.
+      - BACKEND_URL=${BACKEND_URL:-http://host.docker.internal:{{ cookiecutter.backend_port }}}
     extra_hosts:
       - "host.docker.internal:host-gateway"
     restart: unless-stopped

fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.prod.yml

@@ -313,7 +313,7 @@ services:
           memory: 256M
 
   milvus:
-    image: milvusdb/milvus:v2.6.21
+    image: milvusdb/milvus:v2.6.22
     container_name: {{ cookiecutter.project_slug }}_milvus
     command: ["milvus", "run", "standalone"]
     # NO external ports - only accessible within backend-internal network
@@ -655,11 +655,44 @@ services:
     build:
       context: ./frontend
       dockerfile: Dockerfile
+      # NEXT_PUBLIC_* are inlined into the browser bundle at build time, so they
+      # must be build args — an `environment:` entry cannot override them, and
+      # changing one needs a rebuild (docker compose -f docker-compose.prod.yml
+      # build --no-cache frontend). Every value here has to be reachable from
+      # the BROWSER, not from inside the compose network.
+      args:
+{%- if cookiecutter.include_traefik_labels or cookiecutter.include_nginx_service %}
+        # The proxy terminates TLS and serves the backend on api.DOMAIN.
+        - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-https://api.${DOMAIN:-localhost}}
+        - NEXT_PUBLIC_WS_URL=${NEXT_PUBLIC_WS_URL:-wss://api.${DOMAIN:-localhost}}
+        - NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-https://${DOMAIN:-localhost}}
+{%- else %}
+        # No proxy in front, so the browser talks to the published ports.
+        # Set PUBLIC_HOST to this host's address — the localhost default only
+        # works when the browser runs on the Docker host itself.
+        - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://${PUBLIC_HOST:-localhost}:{{ cookiecutter.backend_port }}}
+        - NEXT_PUBLIC_WS_URL=${NEXT_PUBLIC_WS_URL:-ws://${PUBLIC_HOST:-localhost}:{{ cookiecutter.backend_port }}}
+        - NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-http://${PUBLIC_HOST:-localhost}:{{ cookiecutter.frontend_port }}}
+{%- endif %}
+        - NEXT_PUBLIC_MAX_UPLOAD_SIZE_MB=${NEXT_PUBLIC_MAX_UPLOAD_SIZE_MB:-50}
+{%- if cookiecutter.enable_oauth %}
+        - NEXT_PUBLIC_OAUTH_PROVIDERS={% if cookiecutter.enable_oauth_google %}google{% endif %}
+{%- endif %}
+        - NEXT_PUBLIC_RAG_ENABLED={% if cookiecutter.enable_rag %}true{% else %}false{% endif %}
+{%- if cookiecutter.enable_brand_from_config %}
+        - NEXT_PUBLIC_BRAND_COLOR=${NEXT_PUBLIC_BRAND_COLOR:-{{ cookiecutter.brand_color }}}
+        - NEXT_PUBLIC_BRAND_LOGO_URL=${NEXT_PUBLIC_BRAND_LOGO_URL:-}
+{%- endif %}
     container_name: {{ cookiecutter.project_slug }}_frontend
     environment:
       - NODE_ENV=production
+      # Server-side only: resolved inside the compose network by the Next server.
       - BACKEND_URL=http://app:{{ cookiecutter.backend_port }}
-      - BACKEND_WS_URL=ws://app:{{ cookiecutter.backend_port }}
+      # The auth cookies are Secure in production, and a browser discards a
+      # Secure cookie that arrives over plain HTTP — login then "works" while
+      # every request after it is 401. Serve this over TLS, or set
+      # COOKIE_SECURE=false if it really is http:// on a trusted network.
+      - COOKIE_SECURE=${COOKIE_SECURE:-true}
 {%- if cookiecutter.include_traefik_labels %}
     networks:
       - traefik-public

fastapi_gen/template/{{cookiecutter.project_slug}}/docker-compose.yml

@@ -164,7 +164,7 @@ services:
     restart: unless-stopped
 
   milvus:
-    image: milvusdb/milvus:v2.6.21
+    image: milvusdb/milvus:v2.6.22
     container_name: {{ cookiecutter.project_slug }}_milvus
     command: ["milvus", "run", "standalone"]
     ports:

fastapi_gen/template/{{cookiecutter.project_slug}}/docs/deploy.md

@@ -32,10 +32,45 @@ curl http://localhost:{{ cookiecutter.backend_port }}/api/v1/health
 {% if cookiecutter.use_frontend %}# Frontend: http://localhost:{{ cookiecutter.frontend_port }}{% endif %}
 ```
 
+{% if cookiecutter.use_frontend %}
+### Serving from a host that isn't localhost
+
+The defaults assume the browser runs on the Docker host. Opening the app from
+another machine (a LAN IP, a staging box, a tunnel) needs two things set, and
+both fail in a way that looks like something else:
+
+```bash
+# In the .env next to docker-compose.prod.yml
+PUBLIC_HOST=10.0.0.5     # an address the BROWSER can reach
+COOKIE_SECURE=false      # ONLY if you serve over plain http:// (see below)
+```
+
+```bash
+# NEXT_PUBLIC_* is inlined into the bundle, so this needs a real rebuild
+docker compose -f docker-compose.prod.yml build --no-cache frontend
+docker compose -f docker-compose.prod.yml up -d frontend
+```
+
+1. **`NEXT_PUBLIC_*` is baked in at build time.** Next.js inlines those values
+   into the JavaScript the browser downloads, so a runtime env var cannot change
+   them — `docker-compose.prod.yml` passes them as `build:` args instead. Miss
+   this and the chat socket dials `ws://localhost:{{ cookiecutter.backend_port }}` from
+   the visitor's own machine and the input stays disabled ("Offline").
+2. **The auth cookies are `Secure` in production, and a browser silently drops a
+   `Secure` cookie that arrives over `http://`.** Login looks like it worked (the
+   user comes back in the response body) and then every request carrying no
+   cookie answers 401, `/api/auth/me` included, so the token never refreshes.
+   TLS is the real fix; `COOKIE_SECURE=false` is the escape hatch for a trusted
+   network.
+
+Reaching the backend matters too: the chat socket is opened by the browser
+directly against `NEXT_PUBLIC_WS_URL`, so either publish the backend port or
+route `/api/v1/ws` through your proxy with the `Upgrade` headers set.
+{% endif %}
 ### Reverse proxy
 
 {%- if cookiecutter.use_nginx %}
-Nginx config in `nginx/` proxies `/` → frontend, `/api` → backend, `/ws` → backend WebSocket. Update `server_name` and TLS cert paths in `nginx/conf.d/app.conf`.
+Nginx config in `nginx/nginx.conf` proxies `/` → frontend, `/` on `api.DOMAIN` → backend, and `/api/v1/ws` → backend WebSocket. Update `server_name` and the TLS cert paths there.
 {%- elif cookiecutter.use_traefik %}
 Traefik labels in `docker-compose.yml` route based on `Host()`. Set `DOMAIN` env var, then point your DNS at the host. ACME / Let's Encrypt configured via labels — uncomment in `docker-compose.yml` and set `ACME_EMAIL`.
 {%- else %}
@@ -108,7 +143,9 @@ cd frontend
 vercel
 ```
 
-Set `BACKEND_URL` and `NEXT_PUBLIC_API_URL` env vars in Vercel dashboard pointing to your backend host.
+Set `BACKEND_URL`, `NEXT_PUBLIC_API_URL`, `NEXT_PUBLIC_WS_URL` (`wss://…`) and
+`NEXT_PUBLIC_SITE_URL` in the Vercel dashboard, pointing at your backend host,
+then redeploy — the `NEXT_PUBLIC_*` ones are only picked up by a fresh build.
 {% else %}
 Not applicable — this project doesn't generate a frontend.
 {% endif %}

fastapi_gen/template/{{cookiecutter.project_slug}}/docs/permissions.md

@@ -51,7 +51,7 @@ These are defined in `app/api/deps.py` and used throughout the route layer:
 
 | Endpoint | Method | Admin | User | Notes |
 |----------|--------|-------|------|-------|
-| `/agent/ws/agent` | WS | Y | Y | WebSocket chat with AI agent |
+| `/ws/agent` | WS | Y | Y | WebSocket chat with AI agent |
 
 ### Conversations
 

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/.env.example

@@ -1,21 +1,22 @@
 # Backend API URL (server-side only - not exposed to browser)
 BACKEND_URL=http://localhost:{{ cookiecutter.backend_port }}
 
-# WebSocket URL for real-time features
-BACKEND_WS_URL=ws://localhost:{{ cookiecutter.backend_port }}
+# Send the auth cookies with the Secure flag. Unset follows NODE_ENV, so
+# production means Secure — and a browser silently discards a Secure cookie
+# served over plain http://, which logs you in and then 401s every request
+# after it. Only set this to false for an http:// deployment on a trusted
+# network; the real fix is to serve the app over TLS.
+# COOKIE_SECURE=false
 
-{%- if cookiecutter.use_jwt or cookiecutter.enable_oauth %}
-# Authentication (set to true when JWT or OAuth is enabled)
-NEXT_PUBLIC_AUTH_ENABLED=true
-{%- else %}
-# Authentication (set to true when JWT or OAuth is enabled)
-NEXT_PUBLIC_AUTH_ENABLED=false
-{%- endif %}
-{%- if cookiecutter.enable_oauth %}
+# WebSocket URL for the chat stream. Read by the BROWSER, so it must be an
+# address the browser can reach (not a Docker service name), and because
+# NEXT_PUBLIC_* is inlined at build time it has to be set before `bun run
+# build` — in Docker that means a build arg, see docker-compose.frontend.yml.
+NEXT_PUBLIC_WS_URL=ws://localhost:{{ cookiecutter.backend_port }}
 
-# Public API URL for OAuth redirects (exposed to browser)
+# Public API URL, exposed to the browser (OAuth redirects, links to the API
+# docs). Same build-time rule as NEXT_PUBLIC_WS_URL above.
 NEXT_PUBLIC_API_URL=http://localhost:{{ cookiecutter.backend_port }}
-{%- endif %}
 {%- if cookiecutter.enable_rag %}
 
 # RAG (Retrieval Augmented Generation)

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/Dockerfile

@@ -36,6 +36,12 @@ ENV NEXT_PUBLIC_OAUTH_PROVIDERS=$NEXT_PUBLIC_OAUTH_PROVIDERS
 {%- endif %}
 ARG NEXT_PUBLIC_RAG_ENABLED=false
 ENV NEXT_PUBLIC_RAG_ENABLED=$NEXT_PUBLIC_RAG_ENABLED
+{%- if cookiecutter.enable_brand_from_config %}
+ARG NEXT_PUBLIC_BRAND_COLOR={{ cookiecutter.brand_color }}
+ENV NEXT_PUBLIC_BRAND_COLOR=$NEXT_PUBLIC_BRAND_COLOR
+ARG NEXT_PUBLIC_BRAND_LOGO_URL=
+ENV NEXT_PUBLIC_BRAND_LOGO_URL=$NEXT_PUBLIC_BRAND_LOGO_URL
+{%- endif %}
 
 # Build the application
 ENV NEXT_TELEMETRY_DISABLED=1

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/README.md

@@ -21,18 +21,30 @@ Or run it in Docker from the project root: `make dev-frontend`.
 
 Copy `.env.example` to `.env.local` and adjust as needed:
 
-| Variable | Description |
-|----------|-------------|
-| `BACKEND_URL` | Backend HTTP base URL (server-side calls / proxying) |
-| `BACKEND_WS_URL` | Backend WebSocket URL for the chat stream |
-| `NEXT_PUBLIC_AUTH_ENABLED` | Toggle auth UI (`true` when JWT/OAuth is enabled) |
+| Variable | Read by | Description |
+|----------|---------|-------------|
+| `BACKEND_URL` | server | Backend HTTP base URL used by the route handlers in `src/app/api/*` |
+| `COOKIE_SECURE` | server | `Secure` flag on the auth cookies. Unset follows `NODE_ENV`; set `false` only for an `http://` deployment on a trusted network |
+| `NEXT_PUBLIC_WS_URL` | browser | Backend WebSocket origin for the chat stream (e.g. `wss://api.example.com`) |
+| `NEXT_PUBLIC_API_URL` | browser | Public API URL (OAuth redirects, links to the API docs) |
+| `NEXT_PUBLIC_SITE_URL` | browser | Canonical site origin for SEO metadata, OG tags, `sitemap.xml` |
 {%- if cookiecutter.enable_oauth %}
-| `NEXT_PUBLIC_API_URL` | Public API URL used by OAuth redirects |
+| `NEXT_PUBLIC_OAUTH_PROVIDERS` | browser | Comma-separated providers shown on `/login` + `/register` |
 {%- endif %}
 {%- if cookiecutter.enable_rag %}
-| `NEXT_PUBLIC_RAG_ENABLED` | Show knowledge-base / RAG UI |
+| `NEXT_PUBLIC_RAG_ENABLED` | browser | Show knowledge-base / RAG UI |
 {%- endif %}
 
+Two rules that cause most of the deployment confusion:
+
+- **`NEXT_PUBLIC_*` is inlined into the browser bundle at build time.** Setting one
+  at runtime does nothing — you have to set it before `bun run build`, which in
+  Docker means a `build:` arg (see `docker-compose.frontend.yml`) followed by a
+  rebuild. Everything else in the table is read at runtime.
+- **`NEXT_PUBLIC_*` values must be reachable from the browser**, so never a Docker
+  service name. `BACKEND_URL` is the opposite: it is resolved inside the
+  container, so a service name is exactly right there.
+
 ## Scripts
 
 ```bash
@@ -71,5 +83,8 @@ Add a locale by extending `i18n.ts` and providing its message catalog.
 npx vercel --prod
 ```
 
-In the Vercel dashboard set `BACKEND_URL`, `BACKEND_WS_URL`, and
-`NEXT_PUBLIC_AUTH_ENABLED=true`. See the project root `docs/deploy.md` for details.
+In the Vercel dashboard set `BACKEND_URL=https://api.your-domain.com`,
+`NEXT_PUBLIC_API_URL=https://api.your-domain.com`, `NEXT_PUBLIC_WS_URL=wss://api.your-domain.com`
+and `NEXT_PUBLIC_SITE_URL=https://your-domain.com`, then redeploy — the
+`NEXT_PUBLIC_*` ones only take effect on a fresh build. See the project root
+`docs/deploy.md` for details.

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/login/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { setAuthCookies } from "@/lib/auth-cookies";
 import { backendFetch, BackendApiError } from "@/lib/server-api";
 import type { LoginResponse } from "@/types";
 
@@ -31,20 +32,9 @@ export async function POST(request: NextRequest) {
       message: "Login successful",
     });
 
-    response.cookies.set("access_token", data.access_token, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "lax",
-      maxAge: 60 * 15, // 15 minutes
-      path: "/",
-    });
-
-    response.cookies.set("refresh_token", data.refresh_token, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "lax",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
-      path: "/",
+    setAuthCookies(response, {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
     });
 
     return response;

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/logout/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 
+import { clearAuthCookies } from "@/lib/auth-cookies";
 import { backendFetch, BackendApiError } from "@/lib/server-api";
 
 export async function POST(request: NextRequest) {
@@ -22,20 +23,7 @@ export async function POST(request: NextRequest) {
 
   const response = NextResponse.json({ message: "Logged out successfully" });
 
-  response.cookies.set("access_token", "", {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: 0,
-    path: "/",
-  });
-  response.cookies.set("refresh_token", "", {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    maxAge: 0,
-    path: "/",
-  });
+  clearAuthCookies(response);
 
   return response;
 }

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/magic-link/verify/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse, type NextRequest } from "next/server";
 
+import { setAuthCookies } from "@/lib/auth-cookies";
 import { BackendApiError, backendFetch } from "@/lib/server-api";
 
 interface TokenResponse {
@@ -26,20 +27,9 @@ export async function POST(request: NextRequest) {
       message: "Sign-in successful",
     });
 
-    const isProd = process.env.NODE_ENV === "production";
-    response.cookies.set("access_token", data.access_token, {
-      httpOnly: true,
-      secure: isProd,
-      sameSite: "lax",
-      maxAge: 60 * 15,
-      path: "/",
-    });
-    response.cookies.set("refresh_token", data.refresh_token, {
-      httpOnly: true,
-      secure: isProd,
-      sameSite: "lax",
-      maxAge: 60 * 60 * 24 * 7,
-      path: "/",
+    setAuthCookies(response, {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
     });
     return response;
   } catch (error) {

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/me/route.ts

@@ -1,19 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
+import { clearAuthCookies, setAuthCookies } from "@/lib/auth-cookies";
 import { backendFetch, BackendApiError } from "@/lib/server-api";
 import type { User } from "@/types";
 
-const ACCESS_MAXAGE = 60 * 15; // 15 min
-const REFRESH_MAXAGE = 60 * 60 * 24 * 7; // 7 days
-
-const cookieOpts = (maxAge: number) =>
-  ({
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax" as const,
-    maxAge,
-    path: "/",
-  }) as const;
-
 function fetchMe(token: string) {
   return backendFetch<User>("/api/v1/auth/me", {
     headers: { Authorization: `Bearer ${token}` },
@@ -55,16 +44,15 @@ export async function GET(request: NextRequest) {
     );
     const data = await fetchMe(refreshed.access_token);
     const response = NextResponse.json({ ...data, access_token: refreshed.access_token });
-    response.cookies.set("access_token", refreshed.access_token, cookieOpts(ACCESS_MAXAGE));
-    if (refreshed.refresh_token) {
-      response.cookies.set("refresh_token", refreshed.refresh_token, cookieOpts(REFRESH_MAXAGE));
-    }
+    setAuthCookies(response, {
+      accessToken: refreshed.access_token,
+      refreshToken: refreshed.refresh_token,
+    });
     return response;
   } catch {
     // Refresh failed → truly logged out. Clear cookies.
     const response = NextResponse.json({ detail: "Not authenticated" }, { status: 401 });
-    response.cookies.set("access_token", "", cookieOpts(0));
-    response.cookies.set("refresh_token", "", cookieOpts(0));
+    clearAuthCookies(response);
     return response;
   }
 }

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/oauth-callback/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 
+import { setAuthCookies } from "@/lib/auth-cookies";
 import { backendFetch, BackendApiError } from "@/lib/server-api";
 
 interface OAuthCallbackBody {
@@ -24,20 +25,9 @@ export async function POST(request: NextRequest) {
       message: "Sign-in successful",
     });
 
-    const isProd = process.env.NODE_ENV === "production";
-    response.cookies.set("access_token", body.access_token, {
-      httpOnly: true,
-      secure: isProd,
-      sameSite: "lax",
-      maxAge: 60 * 15,
-      path: "/",
-    });
-    response.cookies.set("refresh_token", body.refresh_token, {
-      httpOnly: true,
-      secure: isProd,
-      sameSite: "lax",
-      maxAge: 60 * 60 * 24 * 7,
-      path: "/",
+    setAuthCookies(response, {
+      accessToken: body.access_token,
+      refreshToken: body.refresh_token,
     });
     return response;
   } catch (error) {

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/app/api/auth/refresh/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { clearAuthCookies, setAuthCookies } from "@/lib/auth-cookies";
 import { backendFetch, BackendApiError } from "@/lib/server-api";
 import type { RefreshTokenResponse } from "@/types";
 
@@ -20,44 +21,18 @@ export async function POST(request: NextRequest) {
       message: "Token refreshed",
     });
 
-    response.cookies.set("access_token", data.access_token, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "lax",
-      maxAge: 60 * 15, // 15 minutes
-      path: "/",
+    // The refresh token is only re-set when the backend rotated it.
+    setAuthCookies(response, {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
     });
 
-    // Rotate refresh token if backend returns a new one
-    if (data.refresh_token) {
-      response.cookies.set("refresh_token", data.refresh_token, {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
-        sameSite: "lax",
-        maxAge: 60 * 60 * 24 * 7, // 7 days
-        path: "/",
-      });
-    }
-
     return response;
   } catch (error) {
     if (error instanceof BackendApiError) {
       const response = NextResponse.json({ detail: "Session expired" }, { status: 401 });
 
-      response.cookies.set("access_token", "", {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
-        sameSite: "lax",
-        maxAge: 0,
-        path: "/",
-      });
-      response.cookies.set("refresh_token", "", {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
-        sameSite: "lax",
-        maxAge: 0,
-        path: "/",
-      });
+      clearAuthCookies(response);
 
       return response;
     }

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/auth-cookies.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from "vitest";
+import { NextResponse } from "next/server";
+import {
+  ACCESS_TOKEN_MAX_AGE,
+  REFRESH_TOKEN_MAX_AGE,
+  clearAuthCookies,
+  resolveCookieSecure,
+  setAuthCookies,
+} from "./auth-cookies";
+
+describe("resolveCookieSecure", () => {
+  it("follows NODE_ENV when COOKIE_SECURE is unset", () => {
+    expect(resolveCookieSecure({ NODE_ENV: "production" })).toBe(true);
+    expect(resolveCookieSecure({ NODE_ENV: "development" })).toBe(false);
+    expect(resolveCookieSecure({})).toBe(false);
+  });
+
+  it("lets COOKIE_SECURE override NODE_ENV in both directions", () => {
+    // The whole point of the flag: a production build served over plain HTTP
+    // has to be able to turn Secure off, or the browser drops the cookie.
+    expect(resolveCookieSecure({ COOKIE_SECURE: "false", NODE_ENV: "production" })).toBe(false);
+    expect(resolveCookieSecure({ COOKIE_SECURE: "true", NODE_ENV: "development" })).toBe(true);
+    expect(resolveCookieSecure({ COOKIE_SECURE: "FALSE", NODE_ENV: "production" })).toBe(false);
+  });
+
+  it("ignores a value it does not understand instead of guessing", () => {
+    // A typo must not silently downgrade production to insecure cookies.
+    expect(resolveCookieSecure({ COOKIE_SECURE: "0", NODE_ENV: "production" })).toBe(true);
+    expect(resolveCookieSecure({ COOKIE_SECURE: "", NODE_ENV: "production" })).toBe(true);
+    expect(resolveCookieSecure({ COOKIE_SECURE: "yes", NODE_ENV: "development" })).toBe(false);
+  });
+});
+
+describe("setAuthCookies", () => {
+  it("stores both tokens httpOnly, scoped to the whole site", () => {
+    const response = NextResponse.json({});
+    setAuthCookies(response, { accessToken: "access", refreshToken: "refresh" });
+
+    const access = response.cookies.get("access_token");
+    expect(access?.value).toBe("access");
+    expect(access?.httpOnly).toBe(true);
+    expect(access?.sameSite).toBe("lax");
+    expect(access?.path).toBe("/");
+    expect(access?.maxAge).toBe(ACCESS_TOKEN_MAX_AGE);
+
+    const refresh = response.cookies.get("refresh_token");
+    expect(refresh?.value).toBe("refresh");
+    expect(refresh?.maxAge).toBe(REFRESH_TOKEN_MAX_AGE);
+  });
+
+  it("leaves the refresh cookie alone when the backend did not rotate it", () => {
+    const response = NextResponse.json({});
+    setAuthCookies(response, { accessToken: "access" });
+
+    expect(response.cookies.get("access_token")?.value).toBe("access");
+    expect(response.cookies.get("refresh_token")).toBeUndefined();
+  });
+});
+
+describe("clearAuthCookies", () => {
+  it("expires both cookies", () => {
+    const response = NextResponse.json({});
+    clearAuthCookies(response);
+
+    expect(response.cookies.get("access_token")?.maxAge).toBe(0);
+    expect(response.cookies.get("refresh_token")?.maxAge).toBe(0);
+  });
+});

fastapi_gen/template/{{cookiecutter.project_slug}}/frontend/src/lib/auth-cookies.ts

@@ -0,0 +1,61 @@
+/**
+ * Auth cookie handling shared by every `/api/auth/*` route handler.
+ *
+ * The browser silently discards a `Secure` cookie sent from an insecure origin.
+ * A deployment served over plain HTTP — a LAN IP, a bare Docker host, a tunnel
+ * without TLS — therefore accepts the login response and then sends no cookie
+ * back on any request after it, so `/api/auth/me` answers 401 forever, the
+ * access token is never refreshed and the chat socket never authenticates.
+ *
+ * `COOKIE_SECURE` makes that flag explicit: unset follows `NODE_ENV`, `false`
+ * opts a trusted-network HTTP deployment out, `true` forces it on (e.g. a dev
+ * server behind an HTTPS proxy). Anything else falls back to the `NODE_ENV`
+ * default rather than guessing, so a typo cannot downgrade production.
+ */
+import type { NextResponse } from "next/server";
+
+export const ACCESS_TOKEN_MAX_AGE = 60 * 15; // 15 minutes
+export const REFRESH_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
+
+/** Exported for the unit test — the module-level value is read once at startup. */
+export function resolveCookieSecure(env: { COOKIE_SECURE?: string; NODE_ENV?: string }): boolean {
+  switch (env.COOKIE_SECURE?.toLowerCase()) {
+    case "false":
+      return false;
+    case "true":
+      return true;
+    default:
+      return env.NODE_ENV === "production";
+  }
+}
+
+const COOKIE_SECURE = resolveCookieSecure(process.env);
+
+const cookieOptions = (maxAge: number) =>
+  ({
+    httpOnly: true,
+    secure: COOKIE_SECURE,
+    sameSite: "lax",
+    maxAge,
+    path: "/",
+  }) as const;
+
+interface AuthTokens {
+  accessToken: string;
+  /** Only set when the backend issued (or rotated) one. */
+  refreshToken?: string;
+}
+
+/** Store the session tokens as httpOnly cookies on an outgoing response. */
+export function setAuthCookies(response: NextResponse, { accessToken, refreshToken }: AuthTokens) {
+  response.cookies.set("access_token", accessToken, cookieOptions(ACCESS_TOKEN_MAX_AGE));
+  if (refreshToken) {
+    response.cookies.set("refresh_token", refreshToken, cookieOptions(REFRESH_TOKEN_MAX_AGE));
+  }
+}
+
+/** Expire both session cookies — logout, or a refresh token the backend rejected. */
+export function clearAuthCookies(response: NextResponse) {
+  response.cookies.set("access_token", "", cookieOptions(0));
+  response.cookies.set("refresh_token", "", cookieOptions(0));
+}

fastapi_gen/template/{{cookiecutter.project_slug}}/nginx/nginx.conf

@@ -96,8 +96,11 @@ server {
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Port $server_port;
 
-    # WebSocket support for /ws endpoint
-    location /ws {
+    # WebSocket support. The chat sockets are mounted under the versioned API
+    # prefix (/api/v1/ws/agent, /api/v1/ws/projects/...), so this prefix has to
+    # match it — anything falling through to `location /` below is proxied
+    # without the Upgrade headers and the handshake fails.
+    location /api/v1/ws {
         proxy_pass http://backend;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;