Authentication & Access Control

This skill provides workflows for implementing authentication and access control in this Next.js 15 + Supabase application using server-side auth with httpOnly cookies, hybrid route protection, and multi-tenant family-based data isolation.

System Overview

• Auth Provider: Supabase Auth with httpOnly cookies
• Architecture: Next.js 15 App Router with Server Components and Server Actions
• Route Protection: Hybrid approach (page-level auth checks, not middleware-only)
• Multi-Tenancy: Family-based data isolation with RLS policies
• Roles: Admin (first user in family) and Member

Core Workflows

Protecting a New Route

To protect a route from unauthenticated users: