# Authentication Flow Implementation Planner

Plan sign-up, sign-in, recovery, session, and authorization behavior for an AI-built app before authentication code is generated.

## Prompt

You are an application security engineer who specializes in practical authentication and session flows for small web applications.

Inputs:
1. App, users, and protected actions: {{app_context}}
2. Authentication provider and technology stack: {{auth_stack}}
3. Required sign-up, sign-in, recovery, and account flows: {{required_flows}}
4. Roles, permissions, and sensitive data: {{access_context}}
5. Security, privacy, UX, and deployment constraints: {{constraints}}

Do the following:
1. Map every authentication state, including anonymous, pending verification, authenticated, expired, locked, recovery pending, and signed out, plus the transitions between them.
2. Separate authentication from authorization and define server-side enforcement for every protected resource and action rather than relying on hidden interface elements.
3. Specify session storage, expiration, refresh, logout, device handling, redirect safety, error behavior, rate limits, and account-recovery safeguards using the provider's supported patterns.
4. Define user-facing screens and messages for success, invalid credentials, duplicate accounts, expired links, provider outages, and inaccessible email without exposing account existence unnecessarily.
5. Produce an implementation sequence, route and middleware matrix, state diagram in text, test cases, environment-variable checklist, and security review points. Flag provider-specific details that must be verified against current documentation.

## Best for

Vibe coders adding authentication who need a complete flow and authorization plan instead of a copied login snippet.

## Compatible tools

- Claude
- ChatGPT

## How to use

- List protected resources and actions, not only user roles.
- Name the actual authentication provider and framework.
- Include invitation, recovery, and session-expiry requirements.
- Verify provider-specific implementation details before coding.

## Customization tips

- Use server-side authorization for every write.
- Add abuse and cross-account access tests.
- Define what happens when email access is lost.
- Keep secrets and callback URLs environment-specific.

## Example input

App: Private family document vault. Stack: Remix, TypeScript, PostgreSQL, and Clerk. Flows: invitation-only account creation, email sign-in, passwordless recovery, sign out all devices, and invitation expiration. Roles: vault owner and member; only owners can invite or permanently delete files. Constraints: EU hosting, no social login, sessions expire after 12 hours of inactivity, deleted-account emails must not reveal stored filenames.

## Example output

The plan defines invitation, verification, active-session, expired-session, revoked-member, and recovery states. Clerk confirms identity, while server loaders and actions enforce vault membership and owner permissions for every resource. It includes safe redirects, generic recovery responses, invitation expiry, all-device revocation, 12-hour idle behavior, and tests for cross-vault access, revoked sessions, expired links, and hidden owner-only controls backed by server denial.