Build Multi-Tenant Auth & RBAC Core on nextjs-postgres
Orgs, invites, roles, sessions, and Postgres-RLS tenant isolation — the auth spine of a B2B SaaS, with cross-tenant isolation proven by the verify suite.
This build pack is pinned for nextjs-postgres, with verification pending. No pass rate is published until the harness runs it.
nextjs-postgres versions lock
| next | 16.2.12 |
| react | 19.2.8 |
| react-dom | 19.2.8 |
| pg | 8.22.0 |
| zod | 4.4.3 |
| @node-rs/argon2 | 2.0.2 |
| typescript | 5.9.3 |
| @types/node | 24.13.3 |
| @types/pg | 8.20.3 |
| @types/react | 19.2.18 |
| @types/react-dom | 19.2.4 |
| tailwindcss | 4.3.3 |
| @tailwindcss/postcss | 4.3.3 |
| class-variance-authority | 0.7.1 |
| clsx | 2.1.1 |
| tailwind-merge | 3.6.0 |
| @radix-ui/react-slot | 1.3.3 |
| tw-animate-css | 1.4.0 |
| postgres | 18.4 |
| node | 24.18.1 |
What you get
**Features**
- Email/password accounts with argon2id hashing and enumeration-resistant login
- DB-backed sessions: hashed tokens, sliding 30-day expiry, rotation on login, logout, revoke-all-others on password change
- Multi-org membership: create orgs, belong to many, act in one per request
- Roles `owner / admin / member` with owner-only role changes & removals, last-owner protection, and instant effect (no stale claims)
- Invite lifecycle: single-use hashed tokens, email-bound, 7-day expiry, role caps by inviter, revoke, re-invite supersedes
- Postgres row-level security on every tenant table — default-deny, `WITH CHECK` on writes, membership verified inside the database
- SSO-ready identity table (`(provider, provider_user_id)` unique) with safe no-auto-link rules
- `notes` — a fully worked org-scoped CRUD resource to copy for every future tenant table
- 39-check / ~105-assertion verification suite incl. direct-SQL cross-tenant probes, wired for OneShot receipts (`CHECK:` lines)
**Screens** (shadcn/ui + Tailwind, functional not fancy)
- `/login` — sign in / sign up
- `/` — your orgs, create-org form, logout
- `/orgs/[orgId]` — notes list + editor; members list with role controls (owner) and invite form (owner/admin), gated by your role
**API** — 19 JSON endpoints (auth ×4, me, orgs ×2, members ×3, invites ×4, notes ×5, health); full contract in ACCEPTANCE.md.
Prescribed services
Disclosure: some links on this page are affiliate links. We may earn a commission if you sign up through them, at no extra cost to you. We only link to services the pack actually verified against.