front-auth-roles

Documents Nuxt front-end authentication, localStorage keys, and active-role permission logic.

Updated May 5, 2025
One-click install
npx skills add https://github.com/sebauvray/toollab-api --skill front-auth-roles-sebauvray
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: front-auth-roles
Source: https://github.com/sebauvray/toollab-api/tree/main/.claude/skills/front-auth-roles
Command: npx skills add https://github.com/sebauvray/toollab-api --skill front-auth-roles-sebauvray

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It prevents authentication and authorization bugs in the Nuxt front-end by documenting the exact localStorage contract, the single active-role model, route middlewares, and teacher confinement rules that govern access, redirection, and conditional display. ## Core Features & Use Cases - localStorage contract: Defines every key (auth.token, current_school_roles, current_school_active_role, etc.), who writes it, and when it is purged. - Active-role permission model: Explains utils/schoolRoles.js helpers such as readActiveSchoolRoles(), hasAnyRole(), and isTeacherOnly() so permissions are computed on the active role only, never on the union of roles or French labels. - Middleware and redirection rules: Covers auth.global.js, admin-director.js, super-admin.js, teacher confinement to /professeur/, post-login redirection logic, and school invitation handling. - Use Case: When adding a new page for teachers outside /professeur/, consult this Skill to learn it must be added to the teacherAllowed list or teachers will be redirected in a loop. ## Quick Start Ask the AI to explain how to gate a new Nuxt page by active role and which middleware or localStorage keys are involved.

Frequently Asked Questions about front-auth-roles

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check user permissions by role in a Nuxt page?▼

Compute permissions on the active role only using hasAnyRole(readActiveSchoolRoles(), ['director', 'admin']) from utils/schoolRoles.js. Never test the union of all roles or compare against French role labels, which have been removed from the codebase.

Why is user null after login in my Nuxt app?▼

This happens when login goes through authService.login() directly with an SPA router.push, leaving useAuth's shared user ref null until a full reload. Always log in via useAuth().login() so the module-level refs are hydrated.

How does teacher route confinement work in Nuxt middleware?▼

The auth.global.js middleware checks isTeacherOnly(readActiveSchoolRoles()) and redirects teachers to /professeur/classes unless the path starts with /professeur, is /settings, or is in noSchoolNeeded. New teacher screens outside /professeur/* must be added to teacherAllowed.

What localStorage keys does a Nuxt auth flow use?▼

Typical keys are auth.token, auth.user, current_school_id, current_school_year_id, current_school_roles (JSON slug array), and current_school_active_role. They are purged on 401 responses, logout, and when entering platform admin mode.

Is front-end role gating enough to secure routes?▼

No. Front-end gating is never the sole protection; the API must also refuse unauthorized requests. The admin-director middleware additionally confirms roles server-side via getUserRoles, so switching the active role alone cannot open access by URL.