mcpField
A
authentication

authentication

github.com/santiagoxorSecurity35 installs
Repository

About authentication

authentication is a skill that documents authentication and authorization patterns for a Next.js project using NextAuth.js. It guides developers through session checks, role verification, route protection, and safer token handling.

Key features

  1. 01Retrieve the current session with auth()
  2. 02Check user roles for admin operations
  3. 03Protect routes with middleware
  4. 04Use httpOnly cookies instead of localStorage for tokens
  5. 05Validate JWTs in API routes

Use cases

  1. 01Require a signed-in session for an API route
  2. 02Restrict administrative operations by user role
  3. 03Protect routes with middleware

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/santiagoxor/pintureria-digital --skill authentication

After installing, type/authenticationin Claude Code to confirm it loaded.

Details

From the project README

Authentication

Quick Start

When working with authentication:

  1. Use auth() from @/lib/auth to get current session
  2. Verify roles before admin operations
  3. Use middleware for route protection
  4. Never store tokens in localStorage (use httpOnly cookies)
  5. Validate JWT tokens in API routes

Key Files

  • auth.ts - NextAuth.js configuration
  • src/lib/auth/ - Auth utilities
  • middleware.ts - Route protection
  • src/app/api/auth/ - Auth API routes

Common Patterns

Get Current Session
import { auth } from '@/lib/auth';

export async function GET(request: NextRequest) {
  const session = await auth();
  
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }
  
  return NextResponse.json({ user: session.user });
}
Check Admin Role
const session = await auth();

if (session?.user?.role !== 'admin') {
  return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
Protected API Route
import { auth } from '@/lib/auth';
import { NextRequest, NextResponse } from 'next/server';

export async function POST(request: NextRequest) {
  // 1. Check authentication
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }
  
  // 2. Check authorization (if needed)
  if (session.user.role !== 'admin') {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
  }
  
  // 3. Process request
  const body = await request.json();
  // ... business logic
}
Middleware Protection
// middleware.ts
import { auth } from '@/lib/auth';
import { NextResponse } from 'next/server';

export async function middleware(request: NextRequest) {
  const session = await auth();
  
  // Protect admin routes
  if (request.nextUrl.pathname.startsWith('/admin')) {
    if (!session || session.user.role !== 'admin') {
      return NextResponse.redirect(new URL('/login', request.url));
    }
  }
  
  return NextResponse.next();
}
Sign In/Out
import { signIn, signOut } from '@/lib/auth';

// Sign in
await signIn('google', {
  callbackUrl: '/dashboard',
});

// Sign out
await signOut({
  callbackUrl: '/',
});

User Roles

  • admin - Full access
  • customer - Regular user
  • moderator - Limited admin access

Session Structure

interface Session {
  user: {
    id: string;
    email: string;
    name?: string;
    role: 'admin' | 'customer' | 'moderator';
    image?: string;
  };
  expires: string;
}

Comments

Markdown supported