Authentication

Overview

Authentication is handled by NextAuth.js (Auth.js) with Google OAuth as the primary provider. Sessions use JWT strategy for stateless auth.

Auth Flow

1. User clicks "Sign in with Google"
2. OAuth flow with Google (consent screen, redirect)
3. On first login: User document created in MongoDB
4. JWT token issued with user ID, admin flag
5. Session available server-side via auth() and client-side via useSession()

Admin System

• admin boolean on the User model (default false)
• Set manually in the database
• JWT callback reads admin from DB and stores it in the token
• adminProcedure middleware checks the flag on every admin request

Route Protection

• Server components — auth() + redirect in layout files
• tRPC — procedure-level middleware
• Client — useSession() for conditional UI

Technical Details

<!-- Add details about session strategy decisions, token refresh, etc. -->

Content coming soon — add your video and detailed writeup here.