Authentication & Authorization

Included auth screens

The template includes presentation flows for login, registration, password recovery, email verification, and multi-step authentication examples. These screens do not create real users or sessions.

Choose an identity strategy

Use an established authentication library, managed identity provider, or your existing backend. Define session storage, expiry, refresh, logout, recovery, and multi-factor requirements before connecting UI handlers.

• Server-readable session
• Secure HttpOnly cookies
• CSRF protection where applicable
• Rate limits
• Account recovery
• Audit events

Protect workspace routes

Check the session before rendering protected content. Redirect unauthenticated users to the login route and preserve a validated return destination when appropriate.

export default async function PrivateLayout({ children }: { children: React.ReactNode }) {
  const session = await getSession();
  if (!session) redirect("/auth/login-basic");
  return <AppShell>{children}</AppShell>;
}

Authorize every action

Permissions must be verified using server-side identity and record context for reads and writes. The menu can reflect permissions for convenience, but it is never the security boundary.

• Route access
• API access
• Record ownership
• Role or capability checks
• Field-level restrictions
• Audit logging