skills.rest
TimeKast
TimeKastOFFICIAL
Explore all skills by this author →
WebsiteGitHub

sk-security

Implement NextAuth v5 authentication with role-based route ACLs and permissions.

Updated May 19, 2026
Search Tags:#rate limiting#security headers#rbac#audit logging#password reset#nextauth#route acl
One-click install
npx skills add https://github.com/TimeKast/AgendaInteligente --skill sk-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sk-security
Source: https://github.com/TimeKast/AgendaInteligente/tree/main/.claude/skills/sk-security
Command: npx skills add https://github.com/TimeKast/AgendaInteligente --skill sk-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Centralizes secure authentication and authorization for the TimeKast Starter Kit, preventing role/route mistakes and closing common security gaps around NextAuth, RBAC checks, rate limiting, audit logging, and password reset flows.

Core Features & Use Cases

  • NextAuth v5 split-config pattern: keeps Edge-safe callbacks in auth.config.ts while Node-only logic (adapter, providers, DB sync) lives in auth.ts.
  • Single, correct Route ACL location: enforces Route ACL via authorized() (so auth.user.role is populated) instead of scattering checks across middleware and components.
  • SSOT RBAC model: uses ROLE_CONFIG and helpers to define hierarchy, display metadata, invitation rules, and role validation in one place.
  • Two-layer authorization model: separates Route ACL (ROUTE_ACL/isRouteAllowed) from resource permissions (PERMISSIONS/hasPermission) to avoid mixing responsibilities.
  • Password reset with anti-enumeration guarantees: hashes reset tokens, enforces expiration and one-time use, and ensures requestPasswordReset returns success regardless of user existence.
  • Auth hardening infrastructure: ships rate-limit buckets, audit logging helpers, and project-level security headers configuration guidance.
  • Practical integration guidance: explains what to wire to kit auth, RBAC guards, and shipped headers to avoid silent auth/ACL failures.

Quick Start

Plug this skill into your kit’s NextAuth integration by wiring the Edge-safe callbacks in src/lib/auth/auth.config.ts and placing route authorization only in authorized() so role-aware ACL works end-to-end.

Frequently Asked Questions about sk-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement RBAC route protection with NextAuth v5 in Next.js?▼

Implement RBAC route protection by enforcing a single Route ACL via the authorized() callback so auth.user.role is populated. This centralizes role-aware access control in middleware instead of scattering checks across components.

Why split NextAuth configuration into Edge and Node environments?▼

Split NextAuth configuration to keep Edge-safe callbacks in auth.config.ts while placing Node-only adapter, providers, and DB sync logic in auth.ts. This prevents runtime errors when middleware executes on the Edge runtime.

How does the password reset flow prevent user enumeration attacks?▼

Password reset prevents enumeration by hashing reset tokens, enforcing expiration and one-time use, and ensuring requestPasswordReset returns success regardless of whether the user actually exists in the database.

What is the difference between Route ACL and resource permissions in Next.js authorization?▼

Route ACL uses ROUTE_ACL and isRouteAllowed to control page access, while resource permissions use PERMISSIONS and hasPermission to govern specific resource actions. Separating them prevents mixing authorization responsibilities.

How do I add rate limiting and audit logging to a Next.js authentication system?▼

Add rate limiting and audit logging by utilizing the shipped rate-limit buckets and audit logging helpers. These security hardening primitives integrate directly with the authentication infrastructure to track and throttle requests.

Do I need a specific Next.js Starter Kit to use this security skill?▼

Yes, this skill is designed for the TimeKast Starter Kit. It requires using provided helpers and models like ROLE_CONFIG and ROUTE_ACL, and wiring Edge-safe callbacks into src/lib/auth/auth.config.ts to avoid silent auth failures.

Related Skills

Explore More Software Engineering Skills→
vuanhtu1993vuanhtu1993

authjs-skills

Set up Auth.js v5 authentication in Next.js apps with Google OAuth.

Community
Intermediate
MakFlyMakFly
187

symfony:symfony-voters

Implement custom Symfony Voters for granular authorization logic.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

generating-orm-code

Generate ORM models and database schemas across multiple frameworks.

Community
Intermediate
mrlynnmrlynn
8

mongodb-rbac-middleware

Implement role-based access control for Next.js edge middleware routes.

Community
Intermediate