# Auth Locked > **Skill Purpose:** Authentication and authorization security patterns with access control --- ## Core Skill Pattern **Objective:** Establish comprehensive authentication and authorization patterns with role-based access control, security policies, and cross-system integration. **Universal Pattern:** 1. Define authentication requirements and security policies 2. Create authorization patterns and role-based access control 3. Set up session management and token security 4. Establish cross-department access verification 5. Create security monitoring and audit procedures **Key Decisions (Project-Specific):** - Authentication methods and security requirements - Role-based access control complexity - Session management and token lifecycle - Cross-system integration depth - Security monitoring and audit requirements --- ## Project-Specific Implementation Notes **Customize per project:** - Authentication methods based on user requirements - Access control complexity based on data sensitivity - Session security based on compliance requirements - Cross-checks based on system integration needs - Monitoring depth based on security requirements --- ## Example Implementation (Authentication Security Pattern) > **Note:** This is an example pattern for authentication and authorization. Adapt security methods and access control based on your specific project requirements and compliance needs. ### Prerequisites (Example) - Authentication service configured - User roles and permissions defined - Security requirements established - Cross-system integration points identified --- ## Example: Authentication Security Implementation > **Framework-Specific Example:** This demonstrates authentication patterns. Adapt for your auth service and security requirements. ### 1. Authentication Configuration ```typescript // Authentication configuration interface AuthConfig { providers: AuthProvider[]; sessionDuration: number; tokenRefreshThreshold: number; mfaRequired: boolean; passwordPolicy: PasswordPolicy; } interface AuthProvider { name: string; type: 'email' | 'oauth' | 'sso'; config: Record; } interface PasswordPolicy { minLength: number; requireUppercase: boolean; requireLowercase: boolean; requireNumbers: boolean; requireSymbols: boolean; preventReuse: number; } // Example configuration const authConfig: AuthConfig = { providers: [ { name: 'email', type: 'email', config: {} }, { name: 'google', type: 'oauth', config: { clientId: process.env.GOOGLE_CLIENT_ID } } ], sessionDuration: 24 * 60 * 60 * 1000, // 24 hours tokenRefreshThreshold: 5 * 60 * 1000, // 5 minutes mfaRequired: false, passwordPolicy: { minLength: 8, requireUppercase: true, requireLowercase: true, requireNumbers: true, requireSymbols: false, preventReuse: 5 } }; ``` ### 2. Role-Based Access Control ```typescript // Role and permission definitions interface Role { id: string; name: string; permissions: Permission[]; inherits?: string[]; } interface Permission { resource: string; actions: ('create' | 'read' | 'update' | 'delete')[]; conditions?: AccessCondition[]; } interface AccessCondition { field: string; operator: 'eq' | 'ne' | 'in' | 'nin'; value: any; } // Example roles const roles: Role[] = [ { id: 'admin', name: 'Administrator', permissions: [ { resource: '*', actions: ['create', 'read', 'update', 'delete'] } ] }, { id: 'user', name: 'User', permissions: [ { resource: 'profile', actions: ['read', 'update'] }, { resource: 'content', actions: ['read'] } ] }, { id: 'moderator', name: 'Moderator', permissions: [ { resource: 'profile', actions: ['read', 'update'] }, { resource: 'content', actions: ['read', 'update'] }, { resource: 'comments', actions: ['create', 'read', 'update', 'delete'] } ] } ]; // Permission checking function hasPermission( userRole: Role, resource: string, action: string, context?: Record ): boolean { // Check direct permissions const permission = userRole.permissions.find(p => p.resource === resource || p.resource === '*' ); if (!permission) return false; if (!permission.actions.includes(action as any)) return false; // Check conditions if (permission.conditions && context) { for (const condition of permission.conditions) { const contextValue = context[condition.field]; if (!evaluateCondition(contextValue, condition)) { return false; } } } return true; } function evaluateCondition(value: any, condition: AccessCondition): boolean { switch (condition.operator) { case 'eq': return value === condition.value; case 'ne': return value !== condition.value; case 'in': return Array.isArray(condition.value) && condition.value.includes(value); case 'nin': return Array.isArray(condition.value) && !condition.value.includes(value); default: return false; } } ``` ### 3. Session Management ```typescript // Session management interface Session { id: string; userId: string; token: string; refreshToken: string; expiresAt: Date; createdAt: Date; lastActivity: Date; ipAddress: string; userAgent: string; } class SessionManager { private sessions = new Map(); createSession(userId: string, token: string, refreshToken: string): Session { const session: Session = { id: generateId(), userId, token, refreshToken, expiresAt: new Date(Date.now() + authConfig.sessionDuration), createdAt: new Date(), lastActivity: new Date(), ipAddress: '', userAgent: '' }; this.sessions.set(session.id, session); return session; } validateSession(sessionId: string): Session | null { const session = this.sessions.get(sessionId); if (!session || session.expiresAt < new Date()) { this.sessions.delete(sessionId); return null; } session.lastActivity = new Date(); return session; } refreshSession(refreshToken: string): Session | null { const session = Array.from(this.sessions.values()) .find(s => s.refreshToken === refreshToken); if (!session) return null; // Generate new tokens const newToken = generateToken(); const newRefreshToken = generateRefreshToken(); session.token = newToken; session.refreshToken = newRefreshToken; session.expiresAt = new Date(Date.now() + authConfig.sessionDuration); return session; } revokeSession(sessionId: string): void { this.sessions.delete(sessionId); } revokeAllUserSessions(userId: string): void { Array.from(this.sessions.entries()) .forEach(([id, session]) => { if (session.userId === userId) { this.sessions.delete(id); } }); } } ``` ### 4. Cross-Department Access Verification ```typescript // Cross-department access checks interface CrossDepartmentCheck { department: string; resource: string; requiredPermissions: string[]; checkFunction: (user: User, context: any) => Promise; } class AccessController { private crossChecks: CrossDepartmentCheck[] = []; registerCrossCheck(check: CrossDepartmentCheck): void { this.crossChecks.push(check); } async verifyCrossDepartmentAccess( user: User, department: string, resource: string, context: any ): Promise { const checks = this.crossChecks.filter( check => check.department === department && check.resource === resource ); for (const check of checks) { const hasAccess = await check.checkFunction(user, context); if (!hasAccess) { return false; } } return true; } } // Example cross-department checks const accessController = new AccessController(); // UI routes access check accessController.registerCrossCheck({ department: 'ui', resource: 'routes', requiredPermissions: ['read'], checkFunction: async (user, context) => { // Check if user can access UI routes const routePermissions = await getUserRoutePermissions(user.id); return routePermissions.some(rp => rp.route === context.route && rp.canAccess); } }); // API endpoints access check accessController.registerCrossCheck({ department: 'api', resource: 'endpoints', requiredPermissions: ['execute'], checkFunction: async (user, context) => { // Check if user can access API endpoints const endpointPermissions = await getUserEndpointPermissions(user.id); return endpointPermissions.some(ep => ep.endpoint === context.endpoint && ep.canExecute); } }); ``` ### 5. Security Monitoring ```typescript // Security monitoring and audit interface SecurityEvent { id: string; type: 'login' | 'logout' | 'access_denied' | 'permission_change' | 'suspicious_activity'; userId?: string; ipAddress: string; userAgent: string; timestamp: Date; details: Record; } class SecurityMonitor { private events: SecurityEvent[] = []; private suspiciousPatterns = new Map(); logEvent(event: Omit): void { const securityEvent: SecurityEvent = { ...event, id: generateId(), timestamp: new Date() }; this.events.push(securityEvent); this.analyzeForSuspiciousActivity(securityEvent); } private analyzeForSuspiciousActivity(event: SecurityEvent): void { // Check for failed login attempts if (event.type === 'access_denied') { const key = `${event.ipAddress}:${event.type}`; const count = (this.suspiciousPatterns.get(key) || 0) + 1; this.suspiciousPatterns.set(key, count); if (count > 5) { // Threshold for suspicious activity this.handleSuspiciousActivity(event); } } } private handleSuspiciousActivity(event: SecurityEvent): void { // Log suspicious activity console.warn('Suspicious activity detected:', event); // Could trigger additional security measures: // - Lock account temporarily // - Require additional authentication // - Notify security team // - Block IP address } getSecurityReport(timeRange: { start: Date; end: Date }): SecurityReport { const eventsInRange = this.events.filter( event => event.timestamp >= timeRange.start && event.timestamp <= timeRange.end ); return { totalEvents: eventsInRange.length, eventsByType: this.groupEventsByType(eventsInRange), suspiciousActivities: eventsInRange.filter(e => e.type === 'suspicious_activity'), topIPAddresses: this.getTopIPAddresses(eventsInRange) }; } private groupEventsByType(events: SecurityEvent[]): Record { return events.reduce((acc, event) => { acc[event.type] = (acc[event.type] || 0) + 1; return acc; }, {} as Record); } private getTopIPAddresses(events: SecurityEvent[]): Array<{ ip: string; count: number }> { const ipCounts = events.reduce((acc, event) => { acc[event.ipAddress] = (acc[event.ipAddress] || 0) + 1; return acc; }, {} as Record); return Object.entries(ipCounts) .map(([ip, count]) => ({ ip, count })) .sort((a, b) => b.count - a.count) .slice(0, 10); } } interface SecurityReport { totalEvents: number; eventsByType: Record; suspiciousActivities: SecurityEvent[]; topIPAddresses: Array<{ ip: string; count: number }>; } ``` ### 6. Middleware Integration ```typescript // Authentication middleware for Next.js import { NextRequest, NextResponse } from 'next/server'; export async function authMiddleware(request: NextRequest) { const token = request.headers.get('authorization')?.replace('Bearer ', ''); if (!token) { return NextResponse.json({ error: 'No token provided' }, { status: 401 }); } try { const user = await verifyToken(token); const session = sessionManager.validateSession(user.sessionId); if (!session) { return NextResponse.json({ error: 'Invalid session' }, { status: 401 }); } // Add user to request context request.headers.set('x-user-id', user.id); request.headers.set('x-user-role', user.role); return NextResponse.next(); } catch (error) { return NextResponse.json({ error: 'Invalid token' }, { status: 401 }); } } // Authorization middleware export function authorizationMiddleware(requiredPermissions: string[]) { return async (request: NextRequest) => { const userId = request.headers.get('x-user-id'); const userRole = request.headers.get('x-user-role'); if (!userId || !userRole) { return NextResponse.json({ error: 'Authentication required' }, { status: 401 }); } const role = roles.find(r => r.id === userRole); if (!role) { return NextResponse.json({ error: 'Invalid role' }, { status: 403 }); } // Check permissions for (const permission of requiredPermissions) { const [resource, action] = permission.split(':'); if (!hasPermission(role, resource, action)) { return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 }); } } return NextResponse.next(); }; } ``` --- ## Integration Patterns ### UI Department Integration - Route protection and access control - Component-level authorization - User interface permission checks ### API Department Integration - Endpoint protection and authorization - Request-level access control - API rate limiting and security ### Data Department Integration - Row Level Security (RLS) policies - Database access control - Data encryption and privacy --- ## Stop Conditions **STOP operations and escalate if:** - Authentication service compromised - Unauthorized access patterns detected - Security breach suspected - Cross-department access conflicts - Session hijacking detected **PAUSE operations if:** - Security audit in progress - Authentication system maintenance - Security policy updates - Compliance review in progress --- ## Security Best Practices **Authentication Security:** - Multi-factor authentication - Strong password policies - Session timeout management - Token rotation and refresh **Authorization Security:** - Principle of least privilege - Role-based access control - Regular permission audits - Cross-department access verification **Monitoring Security:** - Real-time threat detection - Anomaly detection algorithms - Security event logging - Automated incident response

Auth Locked

Install this skill

Comments