Auth System Designer

Auth System Designer works through your specific app before recommending anything. You describe your stack, client types, user model, and tenancy requirements; the skill inventories your revocation needs, selects the right session or token strategy based on those constraints, designs a permission model with a single enforcement choke point, and maps your OAuth or SSO integration path if needed. Every choice comes with the security reasoning behind it — not just a pattern to copy.

A typical input: 'Next.js frontend, Node/Express API, PostgreSQL. B2B SaaS with workspace-level tenancy, three user roles per workspace, need Google SSO for enterprise customers, currently using JWTs for everything including sessions.' The skill uses that to work through client types and revocation requirements, flag where stateless JWTs are causing silent exposure, and produce a concrete architecture before you write an endpoint.

A representative output excerpt covers: Session strategy — httpOnly cookie-backed sessions recommended over JWTs for this use case, because workspace revocation on logout cannot be guaranteed with stateless tokens at your session lifetime; Permission model — workspace-scoped RBAC with a single middleware choke point on all API routes, roles resolved from DB at request time; SSO path — OAuth 2.0 Authorization Code flow with PKCE for Google, federated identity mapped to internal workspace membership at first login; Risks flagged — current JWT approach stores tokens in localStorage, XSS exposure, rotate immediately.