Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Auth & Multi-Tenant SaaS Foundation Skill

    1

    Architect and implement secure multi-tenant authentication, tenant isolation, and role-based access control.

    $14.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Auth & Multi-Tenant SaaS Foundation Skill

    Auth & Multi-Tenant SaaS Foundation Skill

    Example session with this skill installed

    I need a multi-tenant auth plan for a Next.js app using Supabase and Prisma. Users belong to Organizations. I need roles for Admin and Member, plus a secure invitation flow.

    • Read your context and instructions
    • Compiled the auth & multi-tenant

    I will outline the authentication and multi-tenant authorization foundation for your Next.js, Supabase, and Prisma stack. This plan assumes a shared-database, shared-schema model using row-level security (RLS) as defense-in-depth.

    Auth & Multi-Tenant Foundation

    ComponentStrategy
    Identity ProviderSupabase Auth (GoTrue)
    ORMPrisma with Middleware for Tenant Switching
    Tenant BoundaryOrganization (UUID)
    SessionJWT with PKCE flow, Secure/HttpOnly cookies
    IsolationPostgres RLS + Prisma $extends query filters

    Implementation Code

    // prisma/schema.prisma
model Organization {
  id        String   @id @default(uuid())
  name      String
  members   Membership[]
  projects  Project[]
}

model Membership {
  id             String       @id @default(uuid())
  role           Role         @default(MEMBER)
  organizationId String
  userId         String       // Maps to supabase.auth.users.id
  organization   Organization @relation(fields: [organizationId], references: [id])
}

enum Role {
  OWNER
  ADMIN
  MEMBER
}

// Example Middleware for Tenant Scoping
export const config = {
  // Enforce tenant check on every request
  authorize: async (userId, orgId) => {
    const membership = await prisma.membership.findFirst({
      where: { userId, organizationId: orgId }
    });
    if (!membership) throw new Error("Access Denied: Not a member of this tenant");
    return membership.role;
  }
}

    Security Test Plan

    • IDOR Check: Attempt to fetch Project by ID using a valid token from a different Organization.
    • Invitation Abuse: Test if a single-use invite token can be reused after acceptance.
    • Privilege Escalation: Verify a MEMBER cannot update Membership.role via mass assignment.

    Next steps

    1. Configure Supabase RLS policies to use auth.uid() and check against the memberships table.
    2. Implement the useOrganization hook in Next.js to manage active orgId in the session.
    3. Set up the invitation email trigger using Supabase Edge Functions.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Building a multi-tenant SaaS application requires solving complex identity and isolation problems before writing a single feature. This skill helps you architect and implement a secure authentication and authorization foundation that keeps tenant data strictly separated.

    What it does

    • Architects multi-tenancy by defining clear boundaries between users, organizations, teams, and memberships.
    • Designs auth strategies comparing managed identity providers against framework-native solutions based on your stack.
    • Enforces isolation through server-side authorization checks, tenant-scoped query patterns, and database row-level security.
    • Models membership logic including invitation lifecycles, role assignment, and secure revocation flows.
    • Hardens security by identifying BOLA/IDOR risks, session hijacking vulnerabilities, and mass assignment flaws.

    How it works

    1. Identify the stack by providing your backend, frontend, database, and preferred auth provider.
    2. Define the tenant model to establish how accounts, workspaces, or organizations map to your data.
    3. Generate implementation artifacts including data models, session configurations, and framework-specific code.
    4. Execute the security test plan using the provided unit and integration test strategies for cross-tenant isolation.

    Frameworks & tools

    Works with any modern backend (Node.js, Python, Go, Ruby) and database (PostgreSQL, MySQL, MongoDB). Supports managed providers like Auth0, Clerk, or Kinde, as well as framework-native tools like Devise, NextAuth.js, or Django Allauth.

    Why this beats prompting it yourself

    Generic prompts often overlook the "deny-by-default" principle or fail to account for session rotation and CSRF protection. This skill forces a systematic review of identity versus authorization, ensuring tenant IDs are never trusted from client input.

    Use cases

    • Building a B2B SaaS where users belong to multiple independent organizations.
    • Implementing enterprise SSO/SAML with strict redirect URI and PKCE requirements.
    • Adding row-level security (RLS) to an existing Postgres database for tenant isolation.
    • Refactoring a single-user app to support teams and invitation-based onboarding.

    Known limitations

    Does not provide production-ready cryptographic algorithms or bypass the need for a professional security audit. Requires a defined tenant model to generate accurate data queries.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 3 days ago

    • Passed all security checks, Safe to install

    Listed3 days ago

    What's inside

    Frequently Asked Questions