Fix Fake Auth

About this workflow

Your login 'works' but nothing is real: convert visual-only auth into persisted users, sessions, and guards.

What happens when you run it

1. 1
   Map exactly which parts of auth are theater before rebuilding.

   Runs flow-fix-fake-auth-1-diagnose-what-is-fake on Claude Sonnet 4.6
2. 2
   Signup must create actual users with hashed passwords.

   Runs flow-fix-fake-auth-2-implement-real-user-persistence on Claude Sonnet 4.6
3. 3
   Login must check the password, not just navigate.

   Runs flow-fix-fake-auth-3-implement-real-credential-verification on Claude Sonnet 4.6
4. 4
   Auth state must live somewhere durable, restored on load.

   Runs flow-fix-fake-auth-4-implement-session-persistence-and-logout on Claude Sonnet 4.6
5. 5
   Protection must exist in two layers: router and backend.

   Runs flow-fix-fake-auth-5-enforce-guards-on-routes-and-apis on Claude Sonnet 4.6
6. 6
   Run the complete honest test suite on the rebuilt auth.

   Runs flow-fix-fake-auth-6-full-auth-verification on Claude Sonnet 4.6

Best for

• •Recurring tasks you currently copy-paste between tools.
• •When a single prompt isn't enough — you need a chain where output(n) feeds prompt(n+1).
• •Fork and adapt if your inputs differ materially from the author's use case.

Models used