refactor(auth): type jwt user payload and drop any casts (#541)

[ramnnn2006]

summary

this PR removes the remaining any usages in the backend auth module and replaces them with proper fastify types and a dedicated jwt payload interface.
this closes out the auth.ts scope of the type-safety umbrella issue, so request.userand theauthenticate` decorator are now type-checked instead of being cast away.

Fixes #541

type of Change

• Bug fix
• New feature
• Refactor (no functional change)
• UI / Design change
• Tests only
• Documentation
• Infrastructure / DevOps
• Security

---

What Changed

• 9added an AuthenticatedUser { id, username } interface in apps/backend/src/types/fastify.d.ts and augmented @fastify/jwt's FastifyJWT interface so request.user is typed. went through Fasti FastifyRequest.userdirectly since@fastify/jwt`already owns that field and doing it the other way would clash

• declared the authenticate decorator on FastifyInstan.authenticate is no longer untyped

• typed the authenticate decorator in apps/backend/src/app.ts (request: any, reply: any to FastifyRequest, FastifyReply) and passed the
  user shape through `request.jwtVerify(

• dropped the (request.user as any) casts in apps/backend/src/routes/auth.ts (the /me route and the secure logout route).

---

How to Test

1. npm run typecheck -w apps/backend passes with no errors
2. npm run lint -w apps/backend stays clean
3. 4, npx vitest run src/__tests__/logout.test.ts

---

Checklist

• My code follows the project's coding style
• TypeScript compiles without errors (npm run typecheck).
• I have added or updated tests for the changes I mad
• All tests pass locally
• I have updated documentation where necessary.
• No new console.log or debug statements left in the code.
• Breaking changes are documented in this PR descript

---

Screenshots / Recordings

n/a, no ui changes.

---

Additional Context

[vercel]

@ramnnn2006 is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @ramnnn2006,

Thanks for opening this pull request.

This PR has been automatically classified based on the files modified.

Applied Labels

• gssoc:approved
• backend

Primary Review Area

• backend

Reviewer

@Harxhit has been identified as the primary reviewer for this pull request.

If you have any questions regarding the affected area or implementation details, feel free to reach out to the assigned reviewer.

Thank you for your contribution!

[github-actions]

CI — All Checks Passed

Backend — PASS

Check	Result
Lint	PASS
Test	PASS
Typecheck	PASS

Mobile — SKIP

Check	Result
Lint	-
Test	-

Web — SKIP

Check	Result
Check	-
Build	-

---

Last updated: Sat, 13 Jun 2026 10:45:16 GMT

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR improves Fastify JWT/auth type safety by introducing a typed AuthenticatedUser, adding Fastify module augmentations for JWT user and an authenticate decorator, and removing any casts from auth routes.

Changes:

• Added AuthenticatedUser type and @fastify/jwt / fastify module augmentations (typed request.user and app.authenticate)
• Updated route code to use strongly typed request.user.id and safer optional logging
• Updated authenticate decorator implementation to use FastifyRequest/FastifyReply types and a typed jwtVerify call

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
apps/backend/src/types/fastify.d.ts	Adds JWT/Fastify TypeScript module augmentation and AuthenticatedUser type
apps/backend/src/routes/auth.ts	Removes any casts by using typed request.user
apps/backend/src/app.ts	Types authenticate decorator params and uses typed jwtVerify payload

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ramnnn2006]

it's an import type, so it should probably get stripped out at compile time and nothing actually tries to load that file at runtime.
and for typechecking, the backend is set to moduleResolution: bundler, which means a .js import just maps to the matching .ts or .d.ts file, so ./types/fastify.js points at fastify.d.ts fine

anddd the typecheck passing in CI backs that up.

[ramnnn2006]

hmm i think it might be a false positive/

[Harxhit]

Merging this PR is required before contributors can start working on the linked sub-issues, as it provides the necessary foundation for those tasks. Approving

[github-actions]

Congratulations @ramnnn2006 on getting PR #560 merged!

Thank you for your contribution to the project.

To receive the appropriate GSSoC labels and recognition, please mention @Harxhit in the #get-labels channel on our Discord server and share your merged PR link.