本文へ移動
cccskills
無料GitHub で公開

nextjs-supabase-auth

Integrate Supabase Auth with Next.js App Router using middleware, callback handling, protected routes, and server/client client boundaries.

インストール方法を見る

含まれるファイル(1)

  • SKILL.md2.6 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Next.js + Supabase Auth

Use this skill for authentication work in Next.js App Router with Supabase Auth.

When to Apply

Use this skill when:

  • Implementing login/signup/logout and session flows
  • Protecting routes with middleware
  • Handling auth callback exchanges
  • Wiring auth checks in Server Components, Server Actions, and route handlers
  • Debugging cookie/session desync between server and client

Do not use this skill when:

  • The task is primarily query/index/schema optimization (use supabase-postgres-best-practices)
  • The task spans broader Supabase surface area beyond Next.js auth wiring (use docs/ai/skills/supabase/SKILL.md)
  • The task is UI-only and does not change auth behavior

Core Rules

  1. Use @supabase/ssr patterns for App Router integration.
  2. Use @/lib/supabase/server for server-side code and @/lib/supabase/client for client-side code.
  3. Use middleware to refresh and enforce session state on protected routes.
  4. Do not manually store or forward auth tokens in client code.
  5. Use Server Actions (or secure route handlers) for privileged auth operations.
  6. Maintain RLS assumptions; do not bypass policy boundaries.

Workflow

  1. Identify execution boundary first (server component, client component, middleware, action, or route handler).
  2. Ensure the correct Supabase client is used for that boundary.
  3. Verify middleware coverage for protected routes.
  4. Verify callback handling exchanges auth code/session correctly.
  5. Validate auth checks before sensitive reads/writes.
  6. Verify end-to-end login/logout/session refresh behavior.

Checklist

  • Server code imports @/lib/supabase/server
  • Client code imports @/lib/supabase/client
  • Protected paths are covered by auth middleware
  • Callback route/session exchange is correctly handled
  • No service role keys in client-side code
  • No manual token persistence logic added

Common Anti-Patterns

  • Using browser clients in server actions
  • Using server clients in client components
  • Calling getSession blindly in server render paths without user validation
  • Storing JWTs manually in localStorage/cookies

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Audit and fix accessibility in Core UI. Use when changing or reviewing buttons, links, forms, validation, dialogs, menus, tabs, tables, keyboard interactions, focus management, accessible names, announcements, contrast, touch targets, reduced motion, or WCAG/a11y behavior.

日本語の概要は準備中です。原文の説明を表示しています。

Asymmetric-al/core3812026年10月12日 更新

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.

日本語の概要は準備中です。原文の説明を表示しています。

Asymmetric-al/core3812026年10月12日 更新

Use when building any system where email content triggers actions — AI agent inboxes, automated support handlers, email-to-task pipelines, or any workflow processing untrusted inbound email. Always use this skill when the user wants to receive emails and act on them programmatically, even if they don't mention "agent" — the skill contains critical security patterns (sender allowlists, content filtering, sandboxed processing) that prevent untrusted email from controlling your system.

日本語の概要は準備中です。原文の説明を表示しています。

Asymmetric-al/core3812026年10月12日 更新

anim

無料

Tasteful, subtle web UI animation following Emil Kowalski / animations.dev principles. Use when adding or reviewing interface motion — hover and press feedback, entrances and exits, modals, toasts, menus, loading and skeleton states, staggered reveals, page or view transitions — so motion stays refined and purposeful, not decorative. Covers CSS, Web Animations, and React timing/easing. Pair with the motion skill for motion/react API specifics.

日本語の概要は準備中です。原文の説明を表示しています。

Asymmetric-al/core3812026年10月12日 更新

animate

無料

Build an animation from scratch, making the decisions in the order that determines whether it feels right — should it animate at all, what purpose, which tool, which properties, which curve and duration, how it interrupts, how it exits. Writes the implementation. Use when asked to animate something, add motion, make a component feel alive, or build a transition. For critiquing existing motion use review-animations; for auditing a whole codebase use improve-animations. Only runs when explicitly invoked; it does not trigger on its own.

日本語の概要は準備中です。原文の説明を表示しています。

Asymmetric-al/core3812026年10月12日 更新

Build animations for Expo and React Native only, using Reanimated, Gesture Handler, Expo Router, and expo-haptics. Use when the target runtime is an Expo or React Native app. Do not use it for Core Next.js web motion; use `animate` for web. Only runs when explicitly invoked; it does not trigger on its own.

日本語の概要は準備中です。原文の説明を表示しています。

Asymmetric-al/core3812026年10月12日 更新

Asymmetric-al のスキルをすべて見る

このスキルの問題を報告する