@for-the-people-initiative/auth-kit

Authentication, multitenancy, and GDPR baseline for Nuxt 3 + Supabase projects in the 001-FOR-THE-PEOPLE/ workspace.

Status: v0.0.1 — pre-stable. Breaking changes allowed until v1.0.

Pillars

1. Auth — email/password signup, login, email verification, password reset, logout, session middleware.
2. Tenancy — tenants + tenant_admins schema, 4-policy RLS template, auto-tenant-on-signup trigger with optional consumer hook.
3. GDPR / compliance — consent capture, account deletion (right-to-erasure), sanitised security event logging.

Install

pnpm add -D @for-the-people-initiative/auth-kit \
            @for-the-people-initiative/supabase-kit

@for-the-people-initiative/supabase-kit is a required peer dep — it provides the @nuxtjs/supabase wiring this kit relies on.

Extend

// nuxt.config.ts
export default defineNuxtConfig({
  extends: [
    '@for-the-people-initiative/nuxt-kit', // workspace baseline (optional)
    '@for-the-people-initiative/supabase-kit', // foundation (required)
    '@for-the-people-initiative/auth-kit', // this layer
  ],
});

Init

After installing, run the bootstrap helper to copy migrations + Playwright setup into the consumer and to generate auth-kit.config.ts:

pnpm exec authkit init

Configuration

See the full AuthKitConfig interface in nuxt.config.ts. Common fields:

• loginPath, signupPath, forgotPasswordPath, resetPasswordPath, confirmPath, postLoginRedirect, publicRoutes
• password.minLength (default 8) etc.
• consentBuckets — array of { id, required, labelKey }. Default: TOS + Privacy required; Marketing + Analytics optional.
• tenancy.defaultTenantName, tenancy.onTenantCreated (SQL function name), tenancy.enabled (set false for single-tenant projects).
• trustGate — optional bot-detection provider; default is always-pass stub.

Compatibility matrix

| auth-kit | Nuxt | supabase-kit | @nuxtjs/supabase | Postgres | | -------- | ----- | ------------ | ---------------- | -------- | | 0.0.1 | ^3.20 | ^0.0.1 | ^2 (transitive) | 15+ |

Tenant rename

The kit ships canonical tenants / tenant_admins. Consumers wanting domain-friendly names (e.g. families / family_admins) wrap them with a read-only DB view. No alias mechanism is shipped in v0.x.

License

MIT