🔐 Vibe Auth Kit

You are an expert backend engineer specializing in secure authentication systems. I need you to help me build a production-ready authentication system for a Next.js application using Auth.js v5, PostgreSQL, Prisma, and TypeScript. ## Requirements ### 1. Core Authentication Flows Build the following authentication flows: **Email & Password Authentication** - User signup with email, password, and profile information - Password validation (minimum 12 characters, uppercase, lowercase, number, special char) - Password hashing using bcrypt (cost factor: 12) or Argon2 - Login with email and password - Automatic session creation upon successful login - Account lockout after 5 failed attempts (15-minute cooldown) **Magic Link Authentication** - Passwordless login via email magic links - 15-minute token expiration - Tokens stored in database with hash - One-time use enforcement - Resend email integration for sending **OAuth Providers (Google & GitHub)** - OAuth 2.0 implementation using Arctic - User linking if email matches existing account - First-time signup auto-population of profile - Graceful fallback to email/password if OAuth fails **Email Verification Flow** - Send verification email on signup (unless using OAuth) - Verification token with 24-hour expiration - Prevent login until verified (optional: grace period) - Resend verification email functionality **Password Reset** - Forgot password flow via email - Reset tokens with 1-hour expiration - New password must be different from last 3 passwords - Send confirmation email after reset - Invalidate all active sessions after password reset ### 2. Session Management - JWT-based sessions with HttpOnly, Secure, SameSite cookies - 30-day session expiration (configurable) - Refresh token rotation every 24 hours - Session invalidation on logout - Multiple session tracking per user (device management optional) - Rate-limited session endpoints (10 requests per minute per user) ### 3. Role-Based Access Control (RBAC) Create a basic RBAC system with roles: user, moderator, admin - Middleware to check user roles before route access - Permission matrix for CRUD operations - Database schema supporting role assignments - Audit logging of permission changes ### 4. Security Checklist (MUST IMPLEMENT) - CSRF protection via tokens - Rate limiting on login (5 attempts per 15 minutes) - Rate limiting on signup (3 per hour per IP) - Rate limiting on password reset (3 per hour per email) - Secure password storage with bcrypt/Argon2 - HTTPS only in production - HttpOnly, Secure, SameSite=Strict cookies - Session CSRF tokens - Input validation and sanitization - SQL injection prevention via ORM - XSS protection in email templates - No password hints or recovery questions - Account enumeration prevention ### 5. Database Schema (Prisma) Create comprehensive schema including: - User model (id, email, password, name, emailVerified, createdAt, updatedAt) - Session model (id, userId, token, expiresAt, createdAt) - VerificationToken model (email, token, expires, type) - Account model (for OAuth linking) - Role model (id, name, permissions) - UserRole model (userId, roleId) - AuditLog model (userId, action, resource, timestamp, details) ### 6. API Endpoints (Next.js API routes or App Router) - POST /auth/signup - Register new user - POST /auth/login - Email/password login - POST /auth/logout - Destroy session - POST /auth/magic-link - Request magic link - GET /auth/magic-link/verify?token=X - Verify magic link - POST /auth/oauth/[provider] - OAuth flow initiation - GET /auth/oauth/[provider]/callback - OAuth callback - POST /auth/email/verify - Request email verification - GET /auth/email/verify?token=X - Verify email - POST /auth/password/forgot - Initiate password reset - POST /auth/password/reset - Complete password reset - GET /auth/session - Get current session - POST /auth/session/logout-all - Logout from all devices - GET /auth/user/profile - Get user profile - PATCH /auth/user/profile - Update profile - GET /api/admin/users - List users (admin only) - PATCH /api/admin/users/[id]/role - Change user role (admin only) ### 7. Email Templates Design professional email templates using React Email components: - Welcome email with email verification link - Magic link login email - Password reset confirmation - Email change confirmation - Suspicious login alert ### 8. Environment Configuration List all required environment variables: - DATABASE_URL - NEXTAUTH_SECRET - NEXTAUTH_URL - GOOGLE_CLIENT_ID - GOOGLE_CLIENT_SECRET - GITHUB_CLIENT_ID - GITHUB_CLIENT_SECRET - RESEND_API_KEY ### 9. Testing Strategy Provide unit tests for: - Password hashing and verification - Email validation regex - Session creation and validation - Rate limiting logic - Role-based access control - CSRF token validation ### 10. Deployment Checklist - Environment variables secured in production - Database backups configured - Rate limiting properly tuned for scale - Session cleanup cron job (remove expired sessions daily) - Error logging configured - Performance monitoring ## Output Format Provide: 1. Complete Prisma schema 2. Core middleware/utilities for auth 3. All API endpoints with full implementation 4. Security utilities (hashing, rate limiting, CSRF) 5. Email templates using React Email 6. TypeScript types for auth objects 7. Error handling patterns 8. Environment setup guide Make it production-ready, secure, and maintainable. Follow Next.js best practices and use TypeScript throughout.