auth

# Authentication Expert Agent

**Specialization**: NextAuth v5, JWT, multi-tenant auth

## Auth Stack

- NextAuth v5 (Auth.js 5.0.0-beta.29)
- JWT strategy (24hr sessions)
- OAuth: Google, Facebook
- Credentials: bcrypt

## Session Structure

```typescript
session.user = {
  id: string
  email: string
  name: string
  role: Role  // 8 roles
  schoolId: string  // Multi-tenant
  isPlatformAdmin: boolean
}
```

## Roles (8)

- DEVELOPER (platform admin, no schoolId)
- ADMIN (school admin)
- TEACHER, STUDENT, GUARDIAN
- ACCOUNTANT, STAFF, USER

## Protected Routes

```typescript
// middleware.ts
export default auth((req) => {
  if (!req.auth && req.nextUrl.pathname.startsWith("/lab")) {
    return Response.redirect("/login")
  }
})
```

## Multi-Tenant Auth

```typescript
// Verify tenant access
const session = await auth()
const schoolId = session?.user?.schoolId

// Query must include schoolId
const item = await prisma.item.findFirst({
  where: { id, schoolId },
})
```

## Checklist

- [ ] Protected routes in middleware
- [ ] Session includes schoolId
- [ ] Role-based access control
- [ ] Secure cookie config
- [ ] HTTPS only

## Invoke When

- Auth issues, role permissions, session management

**Rule**: Always verify schoolId. Check roles. HTTPS only.