qauth

Auth engine rules for QAuth. Use when working with CredentialProvider implementations, token claim generation, the provider registry, or the federation layer. Enforces the pluggable provider pattern and correct token claim behaviour.

OAuth 2.1 / OIDC rules for QAuth. Use when working with authorization endpoints, token flows, PKCE, JWKS, OIDC discovery, or spec compliance (RFC 9700, OIDC Core 1.0). Covers endpoint behaviour, email claim rules, and token security.

Database schema rules for QAuth. Use when working with the identity model, Drizzle ORM, migrations, repositories, or claim resolution. Reflects the CURRENT shipped schema — the identifier-abstraction model (ADR-002, IMPLEMENTED via Epic

Link GitHub issues in parent-child (sub-issue) relationships using GraphQL

Add a GitHub issue to a project board using gh project item-add

Create a new GitHub issue following QAuth project conventions using gh issue create

Create a pull request following QAuth conventions with gh pr create

Error handling for QAuth — domain errors from @qauth-labs/shared-errors, consistent error response shape, and security (no enumeration, no production stack traces). Use when throwing or handling errors, writing the global error handler, or working in apps/auth-server or libs/shared/errors.

Fastify usage for QAuth — plugin authoring (encapsulation, decorators, lifecycle), route schemas with the Zod type provider, production/reverse-proxy setup, and the Fastify version/CVE requirement. Use when adding or modifying @qauth-labs/fastify-plugin-* libraries, auth-server routes, or deployment config.

Shared GitHub conventions for QAuth — repo, gh CLI usage, branch naming, Conventional Commits, issue/PR body templates, labels, and milestones. Use when creating or editing issues, PRs, branches, or commits. The focused github skills (create-issue, create-pr, add-sub-issue, add-to-project, investigate-issue, set-milestone) reference this for conventions.

Gather context and requirements for a GitHub issue using gh issue view and related commands

Implements and reviews security controls for auth-server and OAuth flows following OWASP API Security Top 10, dependency hygiene (CVE/audit), and timing-safe practices. Use when hardening authentication, rate limiting, secrets handling, or when the user asks about security, CVEs, or OWASP.

Add, update, or remove milestones on GitHub issues using gh issue edit

Input validation and Zod v4 schemas for QAuth — standalone format validators (z.email/z.uuid/z.url, not the deprecated string-method form), schema organization, length limits, and normalize-before-validate. Use when adding or reviewing Zod schemas, route validation, or config validation.

Designs and reviews HTTP APIs with resource-oriented REST, schema validation, and consistent error responses. Use when adding or changing auth-server routes, request/response schemas, or when the user asks about API design, versioning, or OpenAPI.

Create and manage Nx projects (libraries and applications). Use when creating new libs, organizing projects, or setting up project tags and dependencies.

Testing workflows with Vitest in Nx monorepo. Use when writing tests, running test suites, or debugging test failures.

Implements and reviews OAuth 2.0/2.1 flows following RFC 6749, RFC 9700 (BCP), and PKCE (RFC 7636). Use when implementing authorization code flow, token handling, client registration, or securing OAuth endpoints.

CI/CD workflows with Nx affected commands. Use when setting up pipelines, debugging CI failures, or optimizing builds.

Nx command reference for common tasks. Use when running builds, tests, linting, or any Nx workspace operations.

Database management with Drizzle ORM. Use when modifying schemas, running migrations, or working with database operations.

Docker and containerization for Nx projects. Use when building images, managing containers, or working with docker-compose.