genesis-auth
Installation
SKILL.md
genesis-auth
Adds authentication to a genesis project. The user picks a tier and states requirements; the skill derives the mechanism — never quiz the user on implementation choices like JWT vs cookie — then writes the code directly into the target project.
This skill is a guideline, not a copy job. There is no reference implementation to clone: read the target project's existing code and write auth that matches it.
Prerequisite: the server needs the genesis DB layer — internal/db with goose migrations, sqlc, and the users table. The genesis CLI does not generate it. If it is missing, stop and tell the user to add it first with /genesis sqlc.
Tiers
| Tier | Use case | Includes |
|---|---|---|
basic |
Internal tools | Single admin seeded from env var, password login, cookie session in Postgres. No signup, no email. |
standard |
Normal apps | Email+password users with email verification, optional Google/Apple SSO, sessions in Postgres, password reset, admin/user roles. |
strict |
Sensitive data | standard + MFA (TOTP, optionally a passkey instead), rate limiting + temporary lockout, session rotation on privilege change, audit log. Beyond this, recommend an external IdP (Keycloak, Auth0, WorkOS) instead of more homegrown code. |