# Nrpg Workflow

> Use when working on NRPG Platform tasks to follow repo conventions (NextAuth cookie sessions, tenant safety, and contractor privacy) and to run the correct checks.

- Skill: `majiayu000/nrpg-workflow` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/nrpg-workflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/nrpg-workflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/nrpg-workflow

---


Follow these rules when implementing changes in this repository:

## Auth (critical)

- Use NextAuth cookie sessions for web UI flows.
- Do not use `localStorage` tokens for auth in the UI.
- In API routes, prefer `getServerSession(authOptions)` and server-side role checks.
- Only allow `Authorization: Bearer ...` when explicitly required for non-browser clients.

## Multi-tenancy & privacy (critical)

- Never expose contractor identities to clients.
- Clients must not be able to browse/search contractors or contact them directly.
- Enforce role-based access for any contractor profile endpoints/pages.

## Implementation workflow

1. Scan for auth-token usage (`localStorage`, `Authorization: Bearer`) and remove/limit as required.
2. Verify server-side auth checks in any modified `app/api/**/route.ts`.
3. Run targeted checks for the area changed:
   - `npm run lint`
   - `npm test`
   - `npm run build`
4. Fix failures only if they are related to the change being made.