Authentication and Roles

Dashboard authentication

Auth.js provides GitHub OAuth. Configure GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and AUTH_SECRET. The development identity provider exists only when NODE_ENV is not production and DEV_AUTH_BYPASS=true.

Anonymous browser requests to protected product routes are redirected to the public landing page. Users start authentication explicitly from the landing page or /sign-in.

The Intertool mark on the sign-in page returns to the public landing page without starting authentication.

The browser never sends an organisation ID to the database layer. Next.js signs the authenticated session identity with WEB_INTERNAL_SECRET; Fastify verifies the timestamped signature and resolves the user's first active organisation membership itself. Organisation switching is not part of the MVP.

MCP authentication

MCP and direct REST clients use personal bearer tokens:

Authorization: Bearer itk_ab12cd34_...

The full token is returned once. PostgreSQL stores its safe prefix and SHA-256 hash, along with owner, organisation, expiry, revocation, creation, and last-used timestamps. Candidate hash comparison is constant-time.

Roles

• Owner/admin: manage repositories, inspect organisation token metadata and the team roster, manage all memories, dispute memories, resolve reports, and review organisation state.
• Member: retrieve published memories, create and publish their own drafts after explicit confirmation, edit/archive their own memories, report problems, and manage their own tokens.

Every tenant-owned read and mutation includes the organisation resolved from the authenticated session or token. The API does not accept organization_id from request bodies.