Authentication flow

Approach

The web app uses Better Auth 1.6 with its Prisma adapter and database-backed sessions. Email/password authentication is enabled for seeded internal accounts; public signup is disabled. Better Auth hashes passwords with scrypt and provides signed HTTP-only session cookies, CSRF/origin validation, and request rate limiting.

Sign in

1. An unauthenticated visitor is redirected to /login by Next.js 16 Proxy.
2. The browser submits email and password to Better Auth's same-origin /api/auth/* handler.
3. Better Auth finds the credential account and verifies the scrypt password hash.
4. A pre-session hook rejects inactive users.
5. Better Auth writes a database session and sets the signed HTTP-only cookie.
6. The post-session hook records auth.login and updates lastLoginAt.
7. Protected server components validate the session again and load current RBAC grants.

Sign out

The dashboard logout control calls Better Auth's sign-out endpoint. The database session is deleted, the cookie is cleared, and an auth.logout activity event is recorded.

Defense in depth

Proxy provides centralized request protection, but it is not the authorization boundary. Protected server pages call requireCurrentPrincipal, and future server actions/data access must call assertPermission or an equivalent resource policy immediately before protected work.

Current limitations

There is no signup, invitation, password recovery, email delivery, MFA, SSO, device management, or session-administration UI. Those require separate security decisions. A production secret and HTTPS cookie configuration are required before deployment; deployment itself is out of scope.