Build Auth System

Implements a complete authentication and authorization system for your API, supporting JWT tokens, OAuth2 flows, API keys, session-based auth, and multi-factor authentication. Generates production-ready auth middleware, user management, and role-based access control.

When to Use

Use this command when:

• Starting a new API that requires user authentication
• Adding authentication to an existing unprotected API
• Migrating from one auth method to another
• Implementing OAuth2 provider or consumer
• Adding multi-factor authentication (MFA/2FA)
• Setting up role-based or permission-based access control
• Building a SaaS application with tenant isolation

Do NOT use this command for:

• Static websites without user accounts
• Public APIs that don't require authentication
• Internal microservices using service mesh auth
• Simple basic auth for development environments

Prerequisites

Before running this command, ensure:

• Database or user store is configured
• Framework/language for API is chosen
• Security requirements are defined
• Compliance requirements identified (GDPR, SOC2, etc.)
• Session storage decided (Redis, database, memory)

Process

Step 1: Analyze Authentication Requirements

Examines your application to determine the best auth strategy:

• Identifies user types and roles
• Determines session vs stateless requirements
• Evaluates security compliance needs
• Assesses scalability requirements
• Reviews existing auth infrastructure

Step 2: Generate Authentication Components

Creates the core authentication system:

• User model with secure password storage
• Authentication middleware/filters
• Token generation and validation
• Session management if required
• Password reset and recovery flows

Step 3: Implement Authorization Logic

Sets up access control mechanisms:

• Role-based access control (RBAC)
• Permission-based authorization
• Resource-level permissions
• API endpoint protection
• Tenant isolation for multi-tenant apps

Step 4: Configure Security Features

Implements additional security measures:

• Rate limiting for auth endpoints
• Account lockout after failed attempts
• Password complexity requirements
• Token refresh mechanisms
• Audit logging for auth events

Output Format

auth-system/
├── models/
│   ├── user.js              # User model with auth fields
│   ├── role.js              # Role definitions
│   └── permission.js        # Permission mappings
├── middleware/
│   ├── authenticate.js      # Auth verification middleware
│   ├── authorize.js         # Permission checking
│   └── rate-limit.js        # Rate limiting
├── services/
│   ├── auth.service.js      # Core auth logic
│   ├── token.service.js     # Token management
│   └── password.service.js  # Password utilities
├── routes/
│   ├── auth.routes.js       # Auth endpoints
│   └── user.routes.js       # User management
├── config/
│   ├── auth.config.js       # Auth configuration
…

Examples

Example 1: JWT-based Authentication for REST API

User Input:

/auth --type jwt --framework express

Generated Authentication Service:

// services/auth.service.js
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
const crypto = require('crypto');

class AuthService {
  constructor() {
    this.saltRounds = 12;
    this.tokenExpiry = '1h';
    this.refreshTokenExpiry = '7d';
  }

  async register(userData) {
    // Validate input
    this.validateRegistration(userData);

    // Check if user exists
    const existing = await User.findOne({ email: userData.email });
…

Generated Middleware:

// middleware/authenticate.js
const jwt = require('jsonwebtoken');

const authenticate = async (req, res, next) => {
  try {
    // Extract token
    const token = extractToken(req);
    if (!token) {
      return res.status(401).json({ error: 'No token provided' });
    }

    // Check blacklist
    const isBlacklisted = await BlacklistedToken.exists({ token });
    if (isBlacklisted) {
      return res.status(401).json({ error: 'Token revoked' });
    }

    // Verify token
…

Example 2: OAuth2 Provider Implementation

User Input:

/auth --type oauth2-provider --framework fastapi

Generated OAuth2 Provider:

# services/oauth2_provider.py
from datetime import datetime, timedelta
from typing import Optional
import secrets
from fastapi import Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from jose import JWTError, jwt
from passlib.context import CryptContext
from sqlalchemy.orm import Session

class OAuth2Provider:
    def __init__(self):
        self.pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
        self.oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
        self.SECRET_KEY = os.getenv("SECRET_KEY")
        self.ALGORITHM = "HS256"
        self.ACCESS_TOKEN_EXPIRE_MINUTES = 30
        self.REFRESH_TOKEN_EXPIRE_DAYS = 7
…