authentication-authorization

Name: authentication-authorization
Author: Josh-git-lab

Custom auth with bcrypt, httpOnly sessions, and server-side RBAC — no third-party auth providers

by Josh-git-lab(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Instruction file imported from Josh-git-lab/Starlit (.cursor/rules/authentication-authorization.mdc). Copyright stays with the author.

Authentication & Authorization (Rule B)

Starlit v1 uses:

custom authentication
bcrypt password hashing
secure httpOnly session cookies
server-side session validation
fixed application roles (receptionist, manager, owner, platform admin)

Do NOT use

Clerk, Auth0, Descope, Supabase Auth, or any other authentication provider unless explicitly instructed.

Enforcement

Never rely only on client-side role checks.
Authorization must be enforced server-side on every protected endpoint.
UI hiding is not authorization.
Sensitive operations must verify both:
1. authenticated identity
2. permission for the requested organization/resource/action

Session cookies

Use HttpOnly, Secure (production), and appropriate SameSite settings. Use separate cookie namespaces for tenant users vs platform admins.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

josh-git-lab-starlit-authentication-authorization-rule.ocm.jsonjson

{
  "ocm": "1",
  "id": "josh-git-lab-starlit-authentication-authorization-rule",
  "kind": "skill",
  "name": "authentication-authorization",
  "description": "Custom auth with bcrypt, httpOnly sessions, and server-side RBAC — no third-party auth providers",
  "publisher": "Josh-git-lab",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "github-cursor-rules"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Custom auth with bcrypt, httpOnly sessions, and server-side RBAC — no third-party auth providers"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github-cursor-rules",
      "repository": "https://github.com/Josh-git-lab/Starlit",
      "path": ".cursor/rules/authentication-authorization.mdc",
      "ref": "fab7d9c6da0361bd35dade9aeb5ac9bf980e5f5a",
      "url": "https://github.com/Josh-git-lab/Starlit/blob/fab7d9c6da0361bd35dade9aeb5ac9bf980e5f5a/.cursor/rules/authentication-authorization.mdc",
      "key": "Josh-git-lab/Starlit/.cursor/rules/authentication-authorization.mdc"
    }
  },
  "instructions": "# Authentication & Authorization (Rule B)\n\nStarlit v1 uses:\n\n- custom authentication\n- bcrypt password hashing\n- secure httpOnly session cookies\n- server-side session validation\n- fixed application roles (receptionist, manager, owner, platform admin)\n\n## Do NOT use\n\nClerk, Auth0, Descope, Supabase Auth, or any other authentication provider unless explicitly instructed.\n\n## Enforcement\n\n- Never rely only on client-side role checks.\n- Authorization must be enforced server-side on every protected endpoint.\n- UI hiding is not authorization.\n- Sensitive operations must verify both:\n  1. authenticat",
  "cost": {
    "context_tokens": 209
  }
}

Fetch it by URL: GET /api/v1/registry/josh-git-lab-starlit-authentication-authorization-rule/manifest?version=1.0.0