authgear

Guidelines for updating or designing pages in the portal React frontend (portal/src). Covers component conventions, link rendering rules, i18n patterns, and common pitfalls.

Produce a structured code review report for the current branch's PR (purpose, API interface changes, code quality, bugs, security, performance), with a mandatory second verification pass. Use when the user asks "what does this PR do", "review this branch/PR",…

Add or change a feature config field/section in pkg/lib/config (authgear.features.yaml). Use when adding a new feature config field, adding a new top-level section, or touching an existing section's Merge implementation.

Audit and fix dependency vulnerabilities in Go and Node.js packages. Runs govulncheck for Go and npm audit for each package.json directory. Commits fixes directory by directory.

Set up a fresh authgear-server development environment from scratch. Use when onboarding a new contributor, setting up a new machine, or when the user says "set up local dev from scratch" / "first-time setup". Covers the asdf + Homebrew install path on macOS;…

Update Authgear email templates using the correct source files, translation files, and commit order. Use when editing email wording, email structure, or subject lines.

Write or extend Go unit tests in this repo. Use when the user asks to add or update Go tests.

Draft or update detailed implementation plans for authgear-server specs, design changes, and docs/plans files. Use when Codex needs to turn a spec or outdated plan into a concrete implementation plan with exact files, exact methods, runtime call flow,…

Rules for authoring or regenerating a local reference/lookup data file (e.g. src/data/countries.ts) whose values are validated against a backend-enforced set. Use before adding, regenerating, or extending any fixed list backing a picker/select control.

Update vulnerable npm dependencies safely. Only applies non-breaking changes. Prefers lock-file-only fixes via `npm audit fix`. Generates a summary of what was updated, what was skipped, and why. Use when asked to fix security vulnerabilities, run…

Wire a frontend page in the Authgear Site Admin Portal to the real Site Admin API, replacing mock data from src/data/. Use this skill when asked to connect a page to the API, replace dummy/mock data with live data, implement an API call on a screen, or fetch…

Rules for writing correct date code in this project. The server stores all data in UTC — all date arithmetic, comparisons, and state must use UTC methods, never local time methods.

Write unit tests for API integration code. Required for all changes to src/api/

Audit JavaScript and TypeScript dependencies across every directory in this repository that contains a package.json, using the correct install root for each project, apply non-breaking security upgrades, and stop to summarize any fixes that require a…

Add or update entries in the repo's hand-maintained CHANGELOG.md, and stamp the "Unreleased" section with a version and date when cutting a release. Use when asked to update the changelog, document a change for release notes, record a breaking change, or…

Audit and fix Go dependency vulnerabilities. Runs govulncheck and upgrades affected modules.

Audit npm dependencies across all workspaces and fix vulnerabilities. Use when the user asks to audit deps, check for vulnerabilities, run npm audit, or fix security issues in packages.

Scan this repo's npm dependencies for known vulnerabilities, auto-apply non-breaking fixes, flag any that need a breaking upgrade, and produce a report. Use when the user asks to audit, scan, or check dependencies for vulnerabilities/CVEs, or to update…

Scan this Go module's dependencies for known vulnerabilities with govulncheck, upgrade any that have a non-breaking fix available, leave breaking ones untouched, and produce a report of what was vulnerable/fixed/still-needs-manual-upgrade. Use when asked to…