All modules
MODULE 04 · LOGIN, ROLES, PERMISSIONS
Auth
Never hand-rolled. Not once. Not ever.
Who is this user, and what are they allowed to do? Use a managed provider at the start; move to self-issued JWT with role-based access only when a separate backend exists to enforce it.
WHEN YOU NEED IT
The moment anyone logs in — which is the definition of Tier 1.
THE CHOICE, PER TIER
- T1Supabase Auth — email/password + Google
- T2Supabase Auth or self-issued JWT
- T3JWT + RBAC with scoped permissions per resource
SAY THIS TO YOUR AGENT
"Wire Supabase Auth with email/password and Google sign-in. Protect every page and API route that needs a user. Add a roles column now even if there's only one role today."
DONE WHEN
- Logged-out users can't reach logged-in pages or APIs
- One user can never read another user's data
- Password reset actually works — you tested it