Deep Instruction · Phases 16–19
Authentication + Authorization — Identity, Trust, and Permissions
Separate proving identity from deciding permission, then attack your own assumptions.
01code-first02code-first03code-first04code-first05code-first06code-first07code-first08code-first
Authentication vs Authorization
Keep “who are you?” separate from “may you do this?”
Supabase Session Lifecycle
Understand access/refresh tokens and browser session persistence.
NestJS Bearer Token Guard
Verify tokens at the API boundary before controllers trust identity.
Current User Decorator and Trusted Identity
Make trusted identity ergonomic without scattering request plumbing.
RBAC and Permission Mapping
Use roles as one input to policy, not as a substitute for resource context.
Ownership and Workspace Scope
Combine permission with the actual resource boundary.
IDOR/Broken Access Control Attack Lab
Treat identifiers as locators, never as proof of permission.
Capstone: Secure TaskFlow
Protect routes, mutations, ownership, and admin operations with regression tests.