auth-security

<!-- This is a SCAFFOLD skill --> # Auth & Security ## When to Apply - **Classification**: ALL classifications that touch auth, permissions, user data, or session management - **Phase**: /plan (auth flow design), /implement (auth logic), /review (MANDATORY for any auth-related change), /test (auth bypass testing) - **Trigger**: Task involves login, registration, password, token, session, role, permission, or access control ## Relationship to Security Guardrails This skill **extends** `.agent/rules/security_guardrails.md` with APP-specific auth patterns. The security guardrails handle OWASP scanning and secret detection. This skill handles auth architecture and implementation patterns. **Precedence**: security_guardrails.md > this skill. If conflict, security guardrails win. ## Conventions > **Customize after /app-init**: Replace these with your project's ADR auth decisions. ### Authentication Flow (JWT Example) ``` Client Server DB |-- POST /auth/login -->| | | {email, password} |-- verify password hash -->| | |<-- user record -----------| |<-- {access_token, | | | refresh_token} ---| | | | | |-- GET /api/resource ->| | | Authorization: |-- verify token | | Bearer <access> |-- check permissions | ...