A rule for local and test-only login routes used by screenshot tools, end-to-end tests, and developer identity switching. These routes must return not found outside their intended runtime.

It is for designing, testing, and securing local login-bypass routes and test-session creation.

It prevents development authentication bypasses from becoming usable in deployed environments while keeping automated testing possible.

dev-login — Cursor rule for Cursor by YuDefine

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starter

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/dev-login.svg)](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/dev-login)

Your own site

<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/dev-login"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/dev-login.svg" alt="Measured on agentmods" height="20"></a>

Per session 0 Nothing until a file matches its globs; then the whole rule loads.

When invoked 1,737 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.01737
Opus 5	$0.00000	$0.00869
Sonnet 5	$0.00000	$0.00347
Haiku 4.5	$0.00000	$0.00174

Measured today against content hash 8feea514a1a1, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

dev-login scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

template/.cursor/rules/dev-login.mdc · 65 lines

How it starts

The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Dev-login routes are local/test-only auth bypasses for screenshot automation, E2E, and developer identity switching. Treat them as critical auth surfaces.

MUST

MUST 先讀 ~/offline/clade/docs/conventions/dev-login.md 再改本檔涵蓋的任何路徑——本 rule 管的是「route 要不要 fail closed」，而開啟畫面連結能不能用由那份 convention 的三個 gate 旗標（loopbackOnly / emailRequired / POST-only）決定：本機契約 MUST 先判旗標、後判 origin 偏好，loopback-gated 的 route 從 tunnel 打必 404。review-gui PWA 的 skip-auth GET 契約（MUST 是 GET、MUST NOT 做 loopback gate、種完 session MUST sendRedirect 到檢驗起點）也只在那份 convention 裡有全文。
MUST fail closed with 404 outside the intended local/e2e runtime.
MUST use import.meta.dev when the route only needs nuxt dev; use an explicit env/runtime local gate only when E2E runs against a production build or Workers local runtime.
MUST ensure production deploy config never enables the dev-login gate (NUXT_E2E_TESTING, NUXT_KNOWLEDGE_ENVIRONMENT=local, or project equivalent).
MUST use canonical as for role/scenario selection. Existing role query params may remain as compatibility aliases, but new docs/tests should use as.
MUST validate as against the project role source: DB role names for role-as-data systems, local const enum for code-defined role systems, allowlist-derived admin for better-auth.
MUST keep email as a concrete identity selector. If both email and as are present, email selects the user and as validates/overrides only according to project rules.
MUST protect redirect with startsWith('/') && !startsWith('//'). POST dev-login endpoints should return JSON and let the caller navigate after success.
MUST emit a structured server-side dev-login log containing route, email, requested as, resolved role, action, and environment.
MUST mark any persistent rows created by dev-login with a dev/test provider marker such as provider='dev-login', provider='test', or provider_id='e2e-*'.
MUST add or update focused tests for the guard, role resolution, email handling, session payload, and open-redirect rejection.
MUST normalize IPv6 zone-id before comparing against any loopback allowlist (e.g. Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])). On macOS, h3 getRequestIP(event) returns IPv6 with zone-id (::1%lo0); strict Set comparison fails and the gate falls through to 404. Use ip.replace(/%.*$/, '') (or equivalent normalization) before the lookup. See docs/pitfalls/2026-05-18-macos-ipv6-zone-id-loopback-gate.md.
MUST keep the loopback allowlist greppable (isLoopbackRequest / LOOPBACK_IPS or equivalent named constant) when the gate restricts request origin. resolveDevLoginContract() derives the loopbackOnly flag from exactly these source signals, and review-gui / dispatchers use it to decide whether a one-click login link can exist at all. An inlined, unnamed IP comparison reads as "no gate" to tooling, which then renders a link that always 404s.
MUST treat a loopback gate as a deliberate trade-off, not a free hardening step: it makes that specific route unusable from a public -dev. origin, because the tunnel reaches it as an external source IP. Local screenshot review and E2E can keep using a loopback-gated local route. The review-gui PWA MUST NOT be told to open http://127.0.0.1:<port>.
MUST serve GET /auth/_dev-login on the public -dev. origin used by review-gui, without a loopback gate, so a browser click can mint the fixture session (as + e2e-<role>@dev.local) and honor redirect=. After minting the session, MUST sendRedirect to that path. redirect MUST be the complete inspect start for that item (path + specified query / route params), the same rule for every consumer. POST /api/_dev/login is not a clickable 開啟畫面. See docs/decisions/2026-08-21-review-gui-skip-auth-inspect.md.

Read the full file on GitHub · 65 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · +1 lines 8feea514a1a1
5d ago First seen · 64 lines · 0 tokens per session scan A 70e4468f41c7

Subscribe to this mod's changes

dev-login is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,737 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Claude Code E2E testing Security TDD Testing ai-assisted nuxt supabase template

testing

Vitest, React Testing Library, and Playwright testing standards. Enforces TDD/BDD, test pyramid, zero brittle mocks, and complete assertion coverage.

kok-o/koko-contextos-agents · 32 tokens

entire-external-agent

Build standalone external agent binaries for the Entire CLI using E2E-first TDD.

entireio/external-agents · 16 tokens

functional-test-principals.rules

Purpose: Ensure all test suites — regardless of test framework — validate real, end-to-end or integration-level functionality. Tests must act as a backstop for the app. If they pass, the app works. If they fail, something meaningful is broken. This allows the agent to self-validate and iterate safely.

drumnation/unsplash-smart-mcp-server · 1,105 tokens

dev-login