Auth decision guide: OAuth2/OIDC+PKCE, JWT rotation, RBAC/ABAC/ReBAC, token storage, revocation, MFA, sessions.
The English summary is being prepared. Showing the original description.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Antes de recomendar o implementar cualquier estrategia de auth, completar estos pasos en orden.
Clarificar (o inferir del contexto si ya fue especificado):
Si el usuario ya especificó estos valores, saltar directamente al Step 1.
Usar las tablas de OAuth / JWT / Authorization más abajo. Elegir el modelo correcto para el contexto. Explicar en 1-2 oraciones por qué.
Implementar. Al terminar, validar contra el Checklist al final de este documento.
Pipeline: Authentication (who) -> Token (proof) -> Authorization (what they can do).
| Flow | Use |
|---|---|
| Auth Code + PKCE (S256) | Default for ALL clients (SPA, mobile, server) |
| Client Credentials | Server-to-server / M2M only |
| Implicit / Password Grant | NEVER — deprecated |
Always use PKCE even with client_secret. Validate state (CSRF), nonce (in id_token), code_challenge S256 (never plain), redirect_uri exact HTTPS (no wildcards). Verify id_token signature via JWKS + iss + aud + exp + nonce. Post-login: id_token is NOT a session token — create your own session.
| Algorithm | When | Avoid |
|---|---|---|
| RS256 | Default, broad interop | — |
| EdDSA | Performance, smaller tokens | If consumers lack Ed25519 |
| HS256 | Single service only | Multi-service (shared secret) |
alg: none | NEVER | — |
Lifetimes: Access 5-15 min. Refresh 7-30 days, rotated every use.
Refresh rotation: Track by family_id. On use: mark rotated, issue new with same family. Reuse of rotated token -> revoke entire family (theft detected).
Revocation: user_version claim (scales better — password/role change increments version) or blacklist jti with TTL (+1 cache hit/request).
JWKS: Expose /.well-known/jwks.json, rotate every 90 days with two active kid.
Storage:
| Platform | Access | Refresh |
|---|---|---|
| Web SPA | In-memory (JS var) | HttpOnly+Secure+SameSite=Lax cookie |
| Mobile | SecureStore (Keychain/Keystore) | SecureStore |
| NEVER | localStorage, sessionStorage, AsyncStorage | — |
Claims: Only sub (UUID) + authorization claims. Never PII — especially with minors.
| Model | When | Complexity |
|---|---|---|
| RBAC + tenant scope | Default (~80% of apps) | Low |
| ABAC (Casbin) | Dynamic context rules (time, state, resource props) | Medium |
| ReBAC (OpenFGA/SpiceDB) | Granular sharing (Google Docs-style) | High |
Start RBAC. Migrate to ABAC only when static roles can't express rules. Permission naming: resource:action (e.g., post:write). Never roles as permissions. Middleware order: auth -> tenant scope -> permission -> ownership (service layer). Ownership checks live in service layer (need business context). RLS is defense-in-depth (complements middleware, never replaces). Frontend auth is UX-only — backend ALWAYS validates. Cache permissions per user+tenant, TTL ~5 min, invalidate on role change.
| MFA trigger | Method |
|---|---|
| Admin/privileged roles | TOTP (broad support) |
| Phishing resistance needed | WebAuthn/passkeys |
| Sensitive actions (delete, export, payment) | Step-up re-prompt |
Sessions: Concurrent limits per user/tenant. Absolute expiry (24h) + idle timeout (30 min). Invalidate on password/role change. Server-side storage, client holds opaque ID only.
→ Read references/anti-patterns.md for the full 17-item checklist.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Plan, design, and implement A/B tests and experiments with statistical rigor. Covers hypothesis frameworks, sample sizing, metrics, and result analysis.
The English summary is being prepared. Showing the original description.
Web/mobile accessibility decision guide: WCAG 2.2 AA, ARIA, keyboard nav, focus management, contrast, testing. Use for: a11y, accessibility, wcag, aria, screen reader, keyboard, contrast.
The English summary is being prepared. Showing the original description.
Generate, iterate, and scale ad creative for paid advertising across Google, Meta, LinkedIn, and X. Covers platform specs, creative frameworks, and quality validation.
The English summary is being prepared. Showing the original description.
Musica interactiva para juegos: layering vertical, re-secuenciacion horizontal, stingers, reglas de transicion con sync points, y mapeo de estados de gameplay a musica. Usar para: musica adaptativa, sistema de musica dinamica, transiciones musicales, combat music.
The English summary is being prepared. Showing the original description.
Design multi-agent systems, create agent architectures, define communication patterns, and build autonomous agent workflows with structured evaluation frameworks.
The English summary is being prepared. Showing the original description.
Inter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, response formats, and quality loops.
The English summary is being prepared. Showing the original description.