Skip to main content

Authentication

CakeMarket uses Auth.js v5 with a JWT strategy for session management.

Auth Stack​

  • Provider: Auth.js v5
  • Strategy: JWT (stateless sessions)
  • Session storage: JWT tokens in HTTP-only cookies
  • Guest support: localStorage token + browser fingerprint

Auth Helpers​

Located in src/lib/auth/helpers.ts:

getCurrentUser()​

Returns the current authenticated user or null. Does not throw.

requireAuth()​

Returns the current user or throws a 401 error. Use in API routes that require authentication.

requireAdmin()​

Returns the current user if they have the admin role, or throws a 403 error.

requireOrgMember(orgId: string)​

Verifies the current user is a member of the specified organisation. Throws 403 if not.

requireOrgAdmin(orgId: string)​

Verifies the current user is an admin of the specified organisation. Throws 403 if not.

Guest Sessions​

Guests are identified by a combination of:

  • A UUID token stored in localStorage
  • A browser fingerprint

Guest capabilities:

  • Create cake requests
  • View and accept offers
  • Create orders and make payments

Guest-to-User Conversion​

POST /api/guest/convert migrates a guest session to a full user account:

  • Transfers all existing requests
  • Transfers all existing orders
  • Preserves preferences
  • Validated by guestConvertSchema

Security Middleware​

src/middleware.ts handles:

  • CORS headers for API routes
  • Route matching for protected paths
  • Security headers (CSP, HSTS, X-Frame-Options) configured in next.config.ts