What problem does it solve? Authentication and database row-level security boundaries often fail silently: default credentials slip into production, empty authUserId values get written into RLS session variables, and session failures go unlogged. This Skill prevents those incidents by enforcing fail-fast configuration, input validation, audit logging, and minimal regression tests. ## Core Features & Use Cases - Fail-fast credential checks: Throws errors when OAuth clientId/clientSecret or secrets are missing instead of falling back to defaults, and flags trustedOrigins/baseURL mismatches. - RLS context validation: Rejects empty, null, or undefined authUserId values before calling set_config('app.auth_user_id'), and requires per-request RLS context initialization. - Audit logging for auth failures: Records path, method, and IP via a structured logger whenever session retrieval fails. - Use Case: A Next.js app using Better Auth passes session user IDs into Postgres RLS via set_config. Apply this Skill to add a Vitest regression test proving empty authUserId throws, then harden the middleware and DB context layers. ## Quick Start Ask the agent to audit the Better Auth configuration and RLS context code for missing fail-fast checks, authUserId validation, and audit logging, then add a minimal regression test.
