devise-pundit-rodauth

What problem does it solve?

AI coding agents frequently generate insecure or non-conventional Rails authentication and authorization code, such as using weak password hashing, skipping email confirmation, leaking unauthorized records in index actions, or selecting the wrong auth stack for the use case. This Skill eliminates those errors by providing curated guidance for selecting the correct auth stack and enforcing production-grade secure defaults.

Core Features & Use Cases

• Stack selection decision matrix: Recommends the optimal auth stack for every use case, including Rails 8 built-in auth for simple apps, Devise + Pundit for standard monoliths, Rodauth for MFA/WebAuthn/compliance needs, and devise-jwt for API-only applications.
• Secure default configurations: Provides copy-paste ready, OWASP-aligned configuration for Devise and Rodauth, including password length requirements, bcrypt cost factors, brute-force lockout, email confirmation, and password reset expiry.
• Pundit authorization patterns: Covers policy-per-model structure, the scope pattern for index actions to prevent record leaks, namespaced policies for admin interfaces, and verify_authorized guardrails to catch missing auth checks at development time.
• Common mistake avoidance: Explicitly calls out and prevents high-risk errors such as open redirects after login, weak password hashing algorithms, long-lived JWTs, and putting authorization logic in models.

Quick Start

Use the devise-pundit-rodauth skill to select the correct authentication and authorization stack for your Rails application and implement secure default configurations for user sign-up, login, and access control.