Three JWTs + RBAC in Fastify: What I Actually Shipped
Most JWT tutorials show you a single token, a login route, and call it a day. Real projects need more: token refresh without re-login, forced password changes for new accounts, role-based access control that doesn't fall apart when requirements get weird.
I recently shipped the auth layer for a side project — the admin backend for a community RPG. Three roles (Admin, Game Master, Moderator), a nested permission tree covering player management and game content, and a forced password change flow for newly onboarded GMs. Here's what the implementation actually looks like in Fastify + Drizzle ORM.
