Auth Expert | Bootspring Docs

The Auth Expert agent specializes in authentication patterns, session management, OAuth, protected routes, and security best practices for web applications.

Expertise Areas#

Clerk Authentication - Modern auth provider integration
NextAuth.js (Auth.js) - Self-hosted authentication
Protected Routes - Middleware and route protection
Role-Based Access Control - RBAC implementation
Session Management - JWT and cookie sessions
OAuth Flow - Third-party provider integration
Webhook Integration - User sync and events

Usage Examples#

Clerk Setup#

Use the auth-expert agent to set up Clerk authentication with protected routes in a Next.js app.

Response includes:

Middleware configuration
Provider setup
Protected route patterns
Auth component usage

NextAuth.js Integration#

Use the auth-expert agent to implement NextAuth.js with Google and GitHub providers plus email/password.

Response includes:

Provider configuration
Prisma adapter setup
Callback customization
Session handling

RBAC Implementation#

Use the auth-expert agent to implement role-based access control for admin and user roles.

Response includes:

Role definition
Permission checking
Protected API routes
UI authorization

Best Practices Applied#

1. Authentication#

Secure session management
Token handling best practices
Multi-provider support
Password security

2. Authorization#

Role-based access control
Permission granularity
Resource-level permissions
Admin override patterns

3. Security#

CSRF protection
Secure cookies
Token expiration
Session invalidation

4. Integration#

Database sync via webhooks
User profile management
Account linking
SSO support

Common Patterns#

Clerk Middleware#

// middleware.ts
import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server';

const isPublicRoute = createRouteMatcher([
  '/',
  '/sign-in(.*)',
  '/sign-up(.*)',
  '/api/webhooks(.*)',
]);

export default clerkMiddleware((auth, req) => {
  if (!isPublicRoute(req)) {
    auth().protect();
  }
});

export const config = {
  matcher: ['/((?!.*\\..*|_next).*)', '/', '/(api|trpc)(.*)'],
};

NextAuth.js Configuration#

// auth.ts
import NextAuth from 'next-auth';
import GitHub from 'next-auth/providers/github';
import Google from 'next-auth/providers/google';
import { PrismaAdapter } from '@auth/prisma-adapter';
import { prisma } from '@/lib/db';

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  session: { strategy: 'jwt' },
  providers: [
    GitHub({
      clientId: process.env.GITHUB_ID,
      clientSecret: process.env.GITHUB_SECRET,
    }),
    Google({
      clientId: process.env.GOOGLE_ID,
      clientSecret: process.env.GOOGLE_SECRET,
    }),
  ],
  callbacks: {
    async jwt({ token, user }) {
      if (user) token.id = user.id;
      return token;
    },
    async session({ session, token }) {
      if (session.user) session.user.id = token.id as string;
      return session;
    },
  },
});

Role-Based Access Control#

// lib/rbac.ts
import { auth } from '@/auth';
import { prisma } from '@/lib/db';

export type Role = 'USER' | 'ADMIN' | 'SUPER_ADMIN';

export async function requireRole(allowedRoles: Role[]) {
  const session = await auth();

  if (!session?.user) {
    throw new Error('Unauthorized');
  }

  const user = await prisma.user.findUnique({
    where: { id: session.user.id },
    select: { role: true },
  });

  if (!allowedRoles.includes(user?.role as Role)) {
    throw new Error('Forbidden');
  }

  return { session, role: user?.role };
}

User Sync Webhook#

// app/api/webhooks/clerk/route.ts
import { Webhook } from 'svix';
import { headers } from 'next/headers';
import { WebhookEvent } from '@clerk/nextjs/server';
import { prisma } from '@/lib/db';

export async function POST(req: Request) {
  const body = await req.text();
  const headerPayload = headers();

  const svix = new Webhook(process.env.CLERK_WEBHOOK_SECRET!);
  let event: WebhookEvent;

  try {
    event = svix.verify(body, {
      'svix-id': headerPayload.get('svix-id')!,
      'svix-timestamp': headerPayload.get('svix-timestamp')!,
      'svix-signature': headerPayload.get('svix-signature')!,
    }) as WebhookEvent;
  } catch {
    return Response.json({ error: 'Invalid signature' }, { status: 400 });
  }

  switch (event.type) {
    case 'user.created':
      await prisma.user.create({
        data: {
          clerkId: event.data.id,
          email: event.data.email_addresses[0].email_address,
        },
      });
      break;
  }

  return Response.json({ received: true });
}

Sample Prompts#

Task	Prompt
Clerk setup	"Set up Clerk authentication with protected dashboard routes"
NextAuth	"Configure NextAuth.js with OAuth providers and Prisma"
RBAC	"Implement role-based access control for API routes"
Session	"Set up secure session management with JWTs"
Webhook	"Create user sync webhook for Clerk events"

Configuration#

// bootspring.config.js
module.exports = {
  agents: {
    customInstructions: {
      'auth-expert': `
        - Use Clerk for managed authentication
        - Implement proper middleware protection
        - Set up role-based access control
        - Configure webhook for user sync
        - Follow security best practices
      `,
    },
  },
  auth: {
    provider: 'clerk',
    roles: ['USER', 'ADMIN'],
  },
};

Security Expert - Security best practices
Backend Expert - API protection
Database Expert - User data management