worldcrafter-auth-guard

Enforce Supabase Auth authentication and RBAC on routes, actions, and APIs.

Updated Nov 9, 2025

Search Tags:#security #routing #RBAC #Supabase #auth #server-actions #redirect

Ready to run

npx skills add https://github.com/hopeoverture/worldcrafter-v2 --skill worldcrafter-auth-guard

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: worldcrafter-auth-guard
Source: https://github.com/hopeoverture/worldcrafter-v2/tree/main/.claude/skills/worldcrafter-auth-guard
Command: npx skills add https://github.com/hopeoverture/worldcrafter-v2 --skill worldcrafter-auth-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @supabase/supabase-js, prisma, zod, and includes assets (resource) and references (resource) components.

What problem does it solve?

This Skill provides patterns and tools to implement authentication and authorization in WorldCrafter apps using Supabase Auth.

Core Features & Use Cases

Protected routes & actions: Add authentication checks to pages, server actions, and API endpoints to ensure only authenticated users can perform sensitive operations.
Role-based access control (RBAC): Implement a 5-tier RBAC system (OWNER, ADMIN, EDITOR, COMMENTER, VIEWER) to control what users can read or modify.
Login/Logout flows & session management: Patterns for login state handling, redirects after login, and secure session storage (HTTP-only cookies).

Quick Start

Say: "Protect the dashboard" or "Add authentication to the admin area". Start by wiring an auth check on the route or layout, then implement a minimal login flow and a requireRole helper to gate admin routes. Finally, redirect non-authenticated users to /login and non-admins to /unauthorized.

Frequently Asked Questions about worldcrafter-auth-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I protect routes and server actions with authentication in a Next.js app?▼

Protect routes and server actions by enforcing authentication checks using Supabase Auth. Implement guards on layouts, pages, and server action endpoints to verify user sessions with HTTP-only cookies, redirecting unauthenticated users to /login before allowing access to protected resources.

What's the best way to implement role-based access control in Supabase applications?▼

Implement RBAC using a 5-tier role system (OWNER, ADMIN, EDITOR, COMMENTER, VIEWER) with Supabase Auth. Apply requireRole helpers to gate routes and actions by user permission level, ensuring users can only perform operations their role permits.

Can I use Supabase Auth with server components and API routes?▼

Yes. Supabase Auth integrates across server components, layouts, API routes, and server actions. Use middleware-based session management with HTTP-only cookies and continuous session refresh to maintain authenticated state across your entire application.

How do I handle login redirects and session management with HTTP-only cookies?▼

Store sessions in HTTP-only cookies for security and implement post-login redirects to dashboards or specified routes. Use continuous session refresh patterns to keep users authenticated across page navigations and API calls without exposing tokens.

Does Supabase Auth support OAuth providers and email verification?▼

Yes. Supabase Auth supports OAuth providers and email verification flows. You can enforce password strength requirements, implement account lockout policies, and enable API key authentication for programmatic access within protected routes and server actions.

What authentication patterns work for protecting API endpoints and dashboards?▼

Protect API endpoints and dashboards using Supabase session validation in middleware and route handlers. Combine layout-level protection with server action guards and API route authentication to enforce consistent access control across your entire application.