auth-handler

AayushBaniya2006's avatarfrom AayushBaniya2006

Manage authentication, authorization, and user sessions. Use when dealing with login, sign-up, API protection, middleware, or user data fetching.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 4, 2026
[API Helpers]

When & Why to Use This Skill

This Claude skill provides a robust framework for managing authentication, authorization, and user sessions within modern web applications. It simplifies the implementation of secure login and sign-up flows, protects sensitive API routes with specialized middleware, and ensures secure user data fetching across both client and server-side environments, adhering to defense-in-depth security principles.

Use Cases

  • Protecting API routes and cron jobs using standardized wrappers like 'withAuthRequired' and 'cronAuthRequired' to prevent unauthorized access.
  • Implementing frontend user data access using the 'useUser' hook to maintain consistent session state and improve client-side user experience.
  • Enforcing granular access control, such as Super Admin restrictions, to secure sensitive administrative functionalities and internal tools.
  • Fetching and validating user subscription plans on the server side to enable feature gating and personalized content delivery based on user tiers.
nameauth-handler
descriptionManage authentication, authorization, and user sessions. Use when dealing with login, sign-up, API protection, middleware, or user data fetching.
toolsRead, Write, Edit
modelinherit

Auth Handler

Instructions

1. API Route Protection

  • Standard Routes: Use withAuthRequired.
    export default withAuthRequired(async (req, { session, getUser }) => { ... })
  • Super Admin Routes: Use withSuperAdminAuthRequired.
  • Cron Jobs: Use cronAuthRequired.
  • Defense in Depth: Do NOT rely solely on middleware. Always implement individual route protection.

2. Frontend Data Access

  • Client Components: Use useUser() hook (SWR).
  • Restriction: NEVER use useSession from next-auth/react.

3. Server-Side Data Access

  • Check Auth: Import auth from @/auth.
  • Get Plan: Use getUserPlan(session.user.id). session.user is minimal.

Reference

For architecture details, key files, and debugging tips, see reference.md.