Agent skill · software engineering · aiskillstore
auth
Authentication and access control skill for Next.js 15 + Supabase applications. Use when implementing user authentication, protecting routes, managing user sessions, enforcing role-based access control (admin/member), or working with multi-tenant family-based data isolation. Covers login/logout, registration with email verification, OAuth (GitHub), route protection for Server Components and Server Actions, admin-only features, and multi-tenant data access patterns.
Why this skill is useful
Provides specific workflows and code snippets for implementing authentication and access control in Next.js 15 + Supabase, which the AI wouldn't reliably generate on its own.
What it needs
Requires supabase account access. About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Authentication & Access Control This skill provides workflows for implementing authentication and access control in this Next.js 15 + Supabase application using server-side auth with httpOnly cookies, hybrid route protection, and multi-tenant family-based data isolation. System Overview Auth Provider: Supabase Auth with httpOnly cookies Architecture: Next.js 15 App Router with Server Components and Server Actions Route Protection: Hybrid approach (page-level auth checks, not middleware-only) Multi-Tenancy: Family-based data isolation with RLS policies Roles: Admin (first user in family) and Member Core Workflows Protecting a New Route To protect a route from unauthenticated users: 1. Import requireAuthRedirect from @/lib/auth/server-auth 2. Call await requireAuthRedirect() at the start of the component 3. User will be redirected to /login if not authenticated To protect an entire route group, add this to the layout component. All child routes will inherit the protection. Protecting a Server Action To require authentication in a Server Action: 1. Import requireAuth from @/lib/auth/server-auth 2. Call const user = await requireAuth() at the start of the action 3. Action will throw UnauthorizedError if user not authenticated Getting Current User Data getCurrentUser() - Auth user (email, id), returns null if not logged in getUserData() - Extended profile (role, familyId, firstName, lastName, active) getCurrentFamilyId() - Just the family ID All use React cache() - multiple calls in same request return cached value. Implementing Admin-Only Features To restrict a page to admins: To restrict a Server Action to admins: To conditionally show admin UI: Enforcing Multi-Tenant Data Access To ensure users only access their own family's data: When fetching current user's family data, use getCurrentFamilyId() instead - no need for requireFamilyAccess since it's their own family. Adding a New Authentication Page To create a new auth page (login, register, password reset): 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/auth--3d4f6f