​

Authentication

​

Architecture

​

Web App Auth Flow (Next.js 16)

1. User enters credentials on /login or creates account on /signup
2. Upon success, user is redirected to /dashboard
3. @supabase/ssr handles Supabase auth call
4. Session stored as HTTP-only cookies
5. proxy.ts refreshes session cookie on every request (replaced deprecated middleware.ts)
6. Data access layer performs actual auth checks in Server Components/Actions

⚠️ Next.js 16 Change: Authentication logic belongs in the data access layer, NOT in the proxy. The proxy.ts only handles session cookie refresh and lightweight route redirects.

​

API Auth Flow

1. Web app includes JWT in Authorization: Bearer <token> header
2. SupabaseGuard extracts and verifies token via Supabase Admin
3. Authenticated user attached to request.user
4. All downstream services can access the verified user

​

User Logout

1. Click the Sign out button in the dashboard sidebar.
2. The logout() server action (in apps/web/actions/auth.ts) is triggered.
3. Supabase session is revoked.
4. User is redirected to /login.

​

Key Files

​

UI Components