Session Management

import { getAuth } from "@/lib/auth/server";

// Cached session retrieval (recommended)
const auth = await getAuth();

// auth: { user, session } | null
if (auth?.user) {
  console.log("Logged in as:", auth.user.email);
  console.log("Session expires:", auth.session.expiresAt);
  console.log("User role:", auth.user.role);
}

import { auth } from "@/lib/auth/server";
import { headers } from "next/headers";

const session = await auth.api.getSession({
  headers: await headers(),
});

import { auth } from "@/lib/auth/server";
import { UserRole } from "@/db/enums";

// Require specific role(s)
const session = await auth.requireRole(UserRole.USER);
const session = await auth.requireRole([UserRole.USER, UserRole.ADMIN]);

// With callback preservation
await auth.requireRole(UserRole.ADMIN, { preserveCallback: true });

// With onboarding required
await auth.requireRole(UserRole.ADMIN, { requireOnboardingCompleted: true });

// Require unauthenticated (for login/register pages)
await auth.requireUnauthenticated();

// Session is automatically available in context
export const myRouter = createTRPCRouter({
  protectedRoute: authProcedure.query(async ({ ctx }) => {
    // ctx.user is guaranteed to be non-null
    const userId = ctx.user.id;
    const userEmail = ctx.user.email;
    return { userId, userEmail };
  }),
});

import { getAuth } from "@/lib/auth/server";
import { unauthorized } from "next/navigation";
import { NextRequest } from "next/server";

export async function GET(request: NextRequest) {
  const auth = await getAuth();

  if (!auth) {
    unauthorized();
  }

  // Proceed with authenticated request
  return Response.json({ user: auth.user });
}

"use client";

import { useAuth } from "@/lib/auth/client";

export function UserProfile() {
  const { user, session, isAuthenticated, signOut } = useAuth();

  if (!isAuthenticated) return <LoginPrompt />;

  return (
    <div>
      <h1>Welcome, {user.name}</h1>
      <p>Email: {user.email}</p>
      <p>Role: {user.role}</p>
      <p>Session expires: {session.expiresAt.toISOString()}</p>
      <button onClick={() => signOut()}>Logout</button>
    </div>
  );
}

import { authClient } from "@/lib/auth/client";

// Sign in with email/password
await authClient.signIn.email({
  email: "user@example.com",
  password: "password123",
});

// Sign in with OAuth
await authClient.signIn.social({
  provider: "google",
  callbackURL: PageDashboard(),
});

// Sign in with magic link
await authClient.signIn.magicLink({
  email: "user@example.com",
  callbackURL: PageDashboard(),
});

await authClient.signUp.email({
  email: "user@example.com",
  password: "password123",
  name: "John Doe",
});

await authClient.signOut();

// Configure in AuthConfig
sessionFreshAge: 300, // 5 minutes in seconds

// In procedure
export const sensitiveRouter = createTRPCRouter({
  deleteAccount: authProcedure.mutation(async ({ ctx }) => {
    if (ctx.session.fresh === false) {
      throw new TRPCError({
        code: "FORBIDDEN",
        message: "Please re-authenticate",
      });
    }
    
    // Proceed with sensitive operation
  }),
});

// src/config/app.ts
export const AuthConfig = {
  storeSessionInDatabase: false, // Default
};

// src/config/app.ts
export const AuthConfig = {
  storeSessionInDatabase: true,
};

// Disable auto-refresh if needed
export const AuthConfig = {
  disableSessionRefresh: true,
};

// Check expiration
if (auth?.session.expiresAt < new Date()) {
  // Session expired - redirect to login
}

await authClient.signOut();

await auth.api.revokeAllSessions({ userId: user.id });

import { FormChangePassword } from "@/features/auth/components";

<FormChangePassword />

import { FormChangeEmail } from "@/features/auth/components";

<FormChangeEmail currentEmail={user.email} />

import { FormDeleteAccount } from "@/features/auth/components";

// Requires typing "DELETE" to confirm
<FormDeleteAccount />

// ❌ Bad - Client-only check
if (user?.role === "admin") {
  // Can be bypassed
}

// ✅ Good - Server-side check
await auth.requireRole(UserRole.ADMIN);

try {
  const auth = await getAuth();
  if (!auth) throw new Error("Unauthorized");
} catch (error) {
  redirect(PageLogin());
}

// app/[locale]/(admin)/layout.tsx
export default async function Layout({ children }) {
  await auth.requireRole(UserRole.ADMIN, { preserveCallback: true });
  return <AdminLayout>{children}</AdminLayout>;
}

if (ctx.session.fresh === false) {
  return {
    success: false,
    message: ctx.t("auth.reAuthRequired"),
  };
}