菜单
Documents bootstrap sign-up, OIDC-only login when configured, and single-owner bootstrap in simple-books. Use when changing auth, login, OIDC env vars, or user access.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Documents Docker image build, Helm chart, release-please versioning, GitHub Actions CI, and K8s deploy constraints for simple-books. Use when deploying, releasing, adding CI workflows, or configuring production infrastructure.
Documents smoke test runbook, when to add tests, and Playwright selector pitfalls for simple-books. Use when running E2E tests, debugging flakes, or writing UI tests.
Documents double-entry journal posting via postJournalSync, ACCT codes, and MVP recipes in simple-books. Use when adding business events, invoices, payments, mileage, reversals, or ledger entries.
Creates TanStack Start createServerFn RPC endpoints with requireAuthMiddleware and dynamic server imports in simple-books. Use when adding *.functions.ts files, server mutations, or fixing import-protection build errors.
Documents local and S3 attachment storage, upload API, and cleanup for simple-books. Use when working with file uploads, attachments, Garage/S3 config, or IRS retention.
Adversarial security review for financial apps: novel and chained exploits, LLM-powered attacker tactics, auth/RPC/upload/ledger invariants, and bad secure-coding process. Use before merge on security-sensitive changes, when auditing auth, money, attachments, deployment, or when the user asks for threat modeling, penetration mindset, or codesec review.
| name | multi-user-auth |
| description | Documents bootstrap sign-up, OIDC-only login when configured, and single-owner bootstrap in simple-books. Use when changing auth, login, OIDC env vars, or user access. |
user_id on business tables; no roles in MVP| OIDC configured? | First user (0 rows in user) | After first user |
|---|---|---|
| No | Email/password sign-up on /login | Email sign-in only |
| Yes | SSO only on /login (IdP provisions owner) | SSO only (email disabled) |
src/lib/auth.ts — emailAndPassword.enabled: !oidcConfigured; databaseHooks.user.create.before rejects user insert when COUNT(user) >= 1src/routes/api/auth/$.ts — blocks /sign-up/email when users exist; blocks /sign-in/email when OIDC is configuredOIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET — enable SSOOIDC_DISPLAY_NAME — button label on loginBETTER_AUTH_SECRET, BETTER_AUTH_URL — required in productionsrc/lib/auth.ts — genericOAuth plugin when OIDC env vars set.
When OIDC_* is configured, account.accountLinking sets trustedProviders: ['oidc']
and requireLocalEmailVerified: false (local email verification is off in MVP).
user count is 0, unless IdP adds more users after bootstrap — operators control IdP membership).mapProfileToUser in auth.ts maps the OIDC profile to the sole user row so trusted-provider linking runs (one install = one owner).Operators control who can sign in via the IdP. Trust the IdP: a malicious IdP that issues arbitrary emails could link to the owner account.
getAuthConfig returns { oidcEnabled, oidcDisplayName, needsFirstUser, emailAuthEnabled } (no secrets)src/routes/login.tsx — UI follows table above