القائمة
Documents bootstrap sign-up, OIDC-only login when configured, and single-owner bootstrap in simple-books. Use when changing auth, login, OIDC env vars, or user access.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Documents Docker image build, Helm chart, release-please versioning, GitHub Actions CI, and K8s deploy constraints for simple-books. Use when deploying, releasing, adding CI workflows, or configuring production infrastructure.
Documents smoke test runbook, when to add tests, and Playwright selector pitfalls for simple-books. Use when running E2E tests, debugging flakes, or writing UI tests.
Documents double-entry journal posting via postJournalSync, ACCT codes, and MVP recipes in simple-books. Use when adding business events, invoices, payments, mileage, reversals, or ledger entries.
Creates TanStack Start createServerFn RPC endpoints with requireAuthMiddleware and dynamic server imports in simple-books. Use when adding *.functions.ts files, server mutations, or fixing import-protection build errors.
Documents local and S3 attachment storage, upload API, and cleanup for simple-books. Use when working with file uploads, attachments, Garage/S3 config, or IRS retention.
Adversarial security review for financial apps: novel and chained exploits, LLM-powered attacker tactics, auth/RPC/upload/ledger invariants, and bad secure-coding process. Use before merge on security-sensitive changes, when auditing auth, money, attachments, deployment, or when the user asks for threat modeling, penetration mindset, or codesec review.
| name | multi-user-auth |
| description | Documents bootstrap sign-up, OIDC-only login when configured, and single-owner bootstrap in simple-books. Use when changing auth, login, OIDC env vars, or user access. |
user_id on business tables; no roles in MVP| OIDC configured? | First user (0 rows in user) | After first user |
|---|---|---|
| No | Email/password sign-up on /login | Email sign-in only |
| Yes | SSO only on /login (IdP provisions owner) | SSO only (email disabled) |
src/lib/auth.ts — emailAndPassword.enabled: !oidcConfigured; databaseHooks.user.create.before rejects user insert when COUNT(user) >= 1src/routes/api/auth/$.ts — blocks /sign-up/email when users exist; blocks /sign-in/email when OIDC is configuredOIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET — enable SSOOIDC_DISPLAY_NAME — button label on loginBETTER_AUTH_SECRET, BETTER_AUTH_URL — required in productionsrc/lib/auth.ts — genericOAuth plugin when OIDC env vars set.
When OIDC_* is configured, account.accountLinking sets trustedProviders: ['oidc']
and requireLocalEmailVerified: false (local email verification is off in MVP).
user count is 0, unless IdP adds more users after bootstrap — operators control IdP membership).mapProfileToUser in auth.ts maps the OIDC profile to the sole user row so trusted-provider linking runs (one install = one owner).Operators control who can sign in via the IdP. Trust the IdP: a malicious IdP that issues arbitrary emails could link to the owner account.
getAuthConfig returns { oidcEnabled, oidcDisplayName, needsFirstUser, emailAuthEnabled } (no secrets)src/routes/login.tsx — UI follows table above