skills.rest
CleanExpo
CleanExpoCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auth-patterns

Document authentication and authorization patterns to prevent auth drift across SYNTHEX services.

3|Updated Aug 3, 2025
Search Tags:#authorization#authentication#oauth#jwt#supabase#rbac#pkce
One-click install
npx skills add https://github.com/CleanExpo/Synthex --skill auth-patterns-cleanexpo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-patterns
Source: https://github.com/CleanExpo/Synthex/tree/main/.claude/skills/auth-patterns
Command: npx skills add https://github.com/CleanExpo/Synthex --skill auth-patterns-cleanexpo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This guide reduces security and reliability issues caused by inconsistent use of authentication and authorization mechanisms across the codebase, commonly known as auth drift. It helps developers choose the correct layer to avoid privilege escalation, data leaks, and broken access controls when adding or changing endpoints and middleware.

Core Features & Use Cases

  • Layered decision tree: Clear guidance on when to use Supabase sessions for middleware, APISecurityChecker for API routes, RBAC for fine-grained permissions, and owner bypass for platform-level operations.
  • Implementation map: References to where each pattern is implemented (middleware.ts, lib/auth/*, lib/security/api-security-checker.ts) and common migration paths for legacy routes.
  • Security patterns: PKCE for OAuth exchanges, fail-secure RBAC behavior, rate limiting, and required environment variables for safe operation.
  • Use Case: Migrate legacy API routes that call raw JWT verification to APISecurityChecker, ensuring consistent rate limiting and CSRF protections.

Quick Start

Audit the /api/posts route to replace raw jwt.verify usage with APISecurityChecker and produce a step-by-step migration plan.

Frequently Asked Questions about auth-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is auth drift and how does inconsistent authentication cause security issues?▼

Auth drift is the inconsistent use of authentication and authorization mechanisms across a codebase. It causes privilege escalation, data leaks, and broken access controls when developers apply mismatched auth layers to new or modified API endpoints and middleware.

How do I migrate legacy API routes from raw JWT verification to consistent auth checks?▼

To migrate legacy API routes from raw JWT verification, replace jwt.verify calls with APISecurityChecker. This migration ensures your API endpoints adopt consistent rate limiting and CSRF protections while aligning with standardized authorization patterns.

When should I use RBAC permission checks versus owner email checks for authorization?▼

Use RBAC for fine-grained permission checks across general application resources. Apply owner email checks specifically for platform-level access and owner bypass scenarios, ensuring strict boundary control when creating or modifying endpoints and middleware.

Does Supabase work with Next.js middleware for route protection?▼

Yes, Supabase sessions work directly with Next.js middleware for route protection. This pattern is specifically prescribed for guarding routes, while APISecurityChecker handles API route security and PKCE secures OAuth exchanges.

What is the best way to implement OAuth PKCE flows for secure token exchanges?▼

The best way to implement OAuth PKCE flows is by following the designated security pattern for OAuth exchanges. This prevents auth drift by standardizing how authorization codes are exchanged, avoiding inconsistent or vulnerable custom implementations.

Related Skills

Explore More Software Engineering Skills→
Alexander-M-DickersonAlexander-M-Dickerson
58

wrds-ssh

Establish SSH sessions to WRDS cloud for SAS, SQL, and Python workflows with file transfers.

Community
Intermediate
esassocesassoc
6

migrate-grid

Migrate data grids from legacy MVC to Angular with neptune-grid and ag-Grid.

Official
Advanced
TimeKastTimeKast

kb-security

Provide defensive auth patterns for NextAuth.js v5 and Next.js 16+.

Official
Advanced
Razaib-khanRazaib-khan

configuring-better-auth

Configure Better Auth OAuth 2.1 and OIDC authentication flows.

Community
Advanced