Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/blockmatic/basilicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/blockmatic/basilic/auth)<a href="https://agentmods.dev/rules/blockmatic/basilic/auth"><img src="https://agentmods.dev/badge/rules/blockmatic/basilic/auth/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/blockmatic/basilic/auth"><img src="https://agentmods.dev/badge/rules/blockmatic/basilic/auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00678 |
| Opus 5.5 | $0.00000 | $0.00271 |
| Sonnet 5.5 | $0.00000 | $0.00136 |
| Haiku 4.5 | $0.00000 | $0.00068 |
Grade A, and why
auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cookie Storage
- Single cookie
api.session(env:AUTH_COOKIE_NAME/NEXT_PUBLIC_AUTH_COOKIE_NAME) stores JSON{ token, refreshToken } - Next is the only process that writes
api.session. Fastify is the only process that creates, rotates, or deletes the session row - Config in
lib/env.tsvia createEnv httpOnly: falsestays so the browser can send Bearer to Fastify for domain data
createClient Auth Modes
| Mode | Config | Refresh on 401 |
|---|---|---|
| apiKey | apiKey: 'bask_xxx' |
Never |
| JWT (Next web) | getAuthToken, getRefreshToken, onTokensRefreshed, refreshTokens → POST /api/auth/refresh |
Yes—Next cookie hop, not Fastify from the browser |
| JWT (CLI / other) | getAuthToken, getRefreshToken, onTokensRefreshed |
Yes—Fastify POST /auth/session/refresh |
| no-auth | baseUrl only |
Never |
Web auth hop
- Browser never calls Fastify refresh. 401 → same-origin
POST /api/auth/refresh→ SDKauth.session.refresh→Set-Cookie→{ token, refreshToken } proxy.tsand/api/auth/refreshsharerefreshTokensWithRefreshToken/createBffClient. Do not duplicate fetch-to-Fastify in the proxy- Discriminated refresh: clear cookies only on
invalid;unavailable(429/5xx/network) leaves the cookie - Logout, callbacks, and in-page issuance (magic-link code, passkey, Google one-tap) use Next route → SDK → Fastify →
Set-Cookie. Keepupdate-tokensfor in-page Fastify token pairs - Domain mutations stay
client SDK → Fastify. Do not rewrite them as Server Actions or a general BFF
Mutations
- Login, profile, passkeys, TOTP, and API keys mutate via
@repo/core/@repo/react→ Fastify. Do not rewrite them as Next.js Server Actions. - Pending/optimistic UI stays on TanStack mutation flags; do not rewrite to
useFormStatus/useOptimistic. - Next API routes exist only for cookie + SSR + auth exchange.
Auth Protection (proxy.ts)
- Proxy (
proxy.ts) is the UI gate: unauthenticated users →/auth/login; authenticated on/auth/login→/. It is not the revocation authority - Never add
getAuthStatus()+redirect()in layouts or pages for auth gating—proxy already enforces this - Use
getAuthStatus()orgetUserInfo()only when you need user/session data for rendering (e.g. shell, profile), not for redirect logic
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +3 lines bd6594b2520d
- 1mo ago Changed · +5 lines · -14 tokens per session fb1105d2f9b4
- 1mo ago First seen · 34 lines · 14 tokens per session scan A 92747a372225
auth is a cursor rule published in the GitHub repository blockmatic/basilic (90 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 678 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
trigger.basic
Only the most important rules for writing basic Trigger.dev tasks.
python--typescript-guide-cursorrules-prompt-file
Cursor rules for Python development with TypeScript guide integration.
handle-rate-limiting-responses
Cursor rule "handle-rate-limiting-responses" from PaulJPhilp/EffectPatterns, covering handle rate limiting responses and example.
control-repetition-with-schedule
Cursor rule "control-repetition-with-schedule" from PaulJPhilp/EffectPatterns, covering control repetition with schedule and example.
create-a-reusable-runtime-from-layers
Cursor rule "create-a-reusable-runtime-from-layers" from PaulJPhilp/EffectPatterns, covering create a reusable runtime from layers and example.
define-a-type-safe-configuration-schema
Cursor rule "define-a-type-safe-configuration-schema" from PaulJPhilp/EffectPatterns, covering define a type-safe configuration schema and example.