Passo-a-passo detalhado do skill, referenciando as fases cognitivas:
1SENSE — Identificar provider e requirements
Escolher provider baseado no contexto: social login → OAuth 2.1; enterprise → SAML; microservices → JWT
Verificar se PKCE é necessário (obrigatório para public clients em OAuth 2.1)
2CONTEXTUALIZE — Analisar arquitetura existente
Ler middleware/guards existentes para não duplicar proteções
Identificar estratégia de token storage: cookies httpOnly (recomendado) vs. localStorage
3RECOMMEND — Implementar com NextAuth.js v5
```typescript
// auth.ts
import NextAuth from "next-auth";
import GitHub from "next-auth/providers/github";
export const { auth, handlers, signIn, signOut } = NextAuth({
providers: [GitHub],
session: { strategy: "jwt" },
callbacks: {
async jwt({ token, account }) {
if (account?.access_token) token.accessToken = account.access_token;
if (Date.now() < (token.exp as number) * 1000) return token;
return refreshAccessToken(token); // rotation
},
async session({ session, token }) {
session.user.role = token.role as string;
return session;
},
},
cookies: {
sessionToken: {
options: { httpOnly: true, sameSite: "strict", secure: true },
},
},
});
```
4EVALUATE — Validar segurança
```typescript
// Testar fluxo completo
describe('Auth', () => {
it('rejects requests without token', async () => {
const res = await fetch('/api/protected');
expect(res.status).toBe(401);
});
it('rejects expired tokens', async () => {
const res = await fetch('/api/protected', {
headers: { Authorization: `Bearer ${expiredToken}` },
});
expect(res.status).toBe(401);
});
});
```
5RECOMMEND — Configurar PKCE para OAuth flows
```typescript
// Geração do code_verifier e challenge
const codeVerifier = crypto.randomBytes(64).toString('base64url');
const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
// Incluir no authorization request: code_challenge + code_challenge_method=S256
```
6REFLECT — Verificar e documentar
Rodar OWASP ZAP scan no endpoint de login
Documentar fluxo de refresh com diagrama de sequência
Reportar telemetria via mcp-skillschain
SynapticSkills