Session handling
Auth.js handles sign-in state and session cookies for authenticated surfaces.
Middleware enforces access-gate behavior and rewrites public handle routes.
Role-based access
Dashboard and cpanel surfaces enforce role checks server-side for protected actions.
UI visibility can reflect role state, but authorization decisions must remain server-authoritative.
Security guidance
For privileged changes, include documentation updates and validate migration requirements before deploy.
- Do not trust client-only checks for sensitive operations
- Audit key permission decisions in server actions
- Prefer explicit deny defaults for new privileged routes