User Authentication

Relevant source files

The following files were used as context for generating this wiki page:

• lib/auth.ts
• api/signup/route.ts
• auth/signup/_components/signup-form.tsx
• auth/signin/_components/signin-form.tsx
• schema.prisma
• types/next-auth.d.ts
• package.json
• dashboard/page.tsx

The user authentication system for the GUC Resume Enhancer is built upon NextAuth.js, providing a secure and robust mechanism for user sign-up, sign-in, and session management. It supports both traditional email/password credentials and social login via Google. The backend leverages a PostgreSQL database managed by the Prisma ORM to persist user data.

This system is responsible for gating access to core application features like the user dashboard, resume uploading, and enhancement history. It uses JSON Web Tokens (JWT) for session strategy, ensuring stateless and scalable session handling. User information, including custom fields like role and firstName, is propagated from the database to the session token and made available throughout the application.

Core Technologies & Dependencies

The authentication system relies on several key libraries to function.

Package	Version	Description
next-auth	4.24.11	The core authentication framework.
@next-auth/prisma-adapter	1.0.7	Connects NextAuth.js to the Prisma client for database operations.
bcryptjs	2.4.3	Used for securely hashing and comparing user passwords.

Sources: package.json:42, package.json:40, package.json:59

Database Schema for Authentication

User, account, and session data are modeled in the Prisma schema. The User model is central, storing profile information and credentials. The Account and Session models are standard NextAuth.js models used by the Prisma adapter to manage provider links and user sessions.

The following diagram illustrates the relationships between authentication-related database models.

User Model

The User model contains all primary information about a user.

Field	Type	Description
id	String	Unique identifier (CUID).
name	String?	User's full name.
email	String	Unique email address for login.
password	String?	Hashed password for credentials-based login.
firstName	String?	User's first name.
lastName	String?	User's last name.
role	String	User role, defaults to "user". Can be "admin".
accounts	Account[]	Relation to linked provider accounts (e.g., Google).
sessions	Session[]	Relation to active user sessions.

Sources: schema.prisma:41-56

NextAuth.js Configuration

All NextAuth.js behavior is configured in lib/auth.ts. This file defines the authentication providers, session strategy, adapter, and callbacks for token and session handling.

Sources: lib/auth.ts

Configuration Options

Option	Value	Description
adapter	PrismaAdapter(prisma)	Uses Prisma to store user, account, and session data in the database.
session.strategy	"jwt"	Employs JSON Web Tokens for session management.
pages.signIn	"/auth/signin"	Specifies the custom sign-in page URL.
providers	[CredentialsProvider(...)]	Defines the authentication providers. Currently configured for email/password.

Sources: lib/auth.ts:6-12

Credentials Provider

The application uses a CredentialsProvider for email and password authentication. The authorize function contains the core logic for validating user credentials.

The following flowchart shows the logic within the authorize function.

Session and JWT Callbacks

Custom callbacks are used to augment the JWT and session objects with additional data from the User model.

• jwt({ token, user }): When a user signs in, this callback is triggered. It takes the user object returned from the authorize function and adds its properties (id, role, firstName, etc.) to the token.
• session({ session, token }): This callback is triggered on every session access. It takes the data from the JWT token and populates the session.user object, making it available to the client-side application.

Sources: lib/auth.ts:50-74

The Session and User types in next-auth are extended in types/next-auth.d.ts to include these custom fields, providing type safety.

Sources: types/next-auth.d.ts

User Registration (Sign-Up)

New users can create an account using the sign-up form, which communicates with a dedicated API endpoint.

Sign-Up Flow

The following sequence diagram illustrates the process of creating a new user account.

API Endpoint: POST /api/signup

This endpoint handles the creation of new users.

Request Body:

Field	Type	Required	Description
email	string	Yes	The user's email address.
password	string	Yes	The user's password (min 12 characters).
firstName	string	No	The user's first name.
lastName	string	No	The user's last name.
companyName	string	No	The user's company name.

Sources: api/signup/route.ts:28

Logic:

1. Rate Limiting: Applies a rate limit of 5 signup attempts per 15 minutes per IP address.
2. Validation: Checks for the presence of email and password, validates the email format, and ensures the password is at least 12 characters long.
3. Duplicate Check: Queries the database to ensure the email is not already in use.
4. Password Hashing: Hashes the plain-text password using bcrypt.hash().
5. User Creation: Creates a new User record in the database with the provided details and the hashed password.

Sources: api/signup/route.ts:15-71

After a successful signup, the SignUpForm component automatically calls signIn to log the new user in and redirect them to the dashboard.

Sources: auth/signup/_components/signup-form.tsx:44-52

User Login (Sign-In)

Existing users can sign in via the sign-in page.

Sign-In Flow

The SignInForm component uses the signIn function from next-auth/react to initiate the authentication process.

Social Login (Google)

Both the sign-in and sign-up forms include a "Continue with Google" button. This functionality is handled by NextAuth.js. Clicking the button calls signIn("google", { callbackUrl: "/dashboard" }), which initiates the OAuth flow. Although the Google provider is not explicitly configured in the provided lib/auth.ts, the UI components are built to support it.

Sources: auth/signin/_components/signin-form.tsx:43-45, auth/signup/_components/signup-form.tsx:62-64