TanStack, SSR, Auth, SSO

Initialize a TanStack Start project and configure environment variables for server and client contexts.

Configure the Vinxi bundler for Server-Side Rendering (SSR) and client hydration.

Compare TanStack Router's file-based routing conventions with Next.js App Router patterns.

Create typed route definitions with path parameters and search params.

Implement typed navigation using the Link component and useNavigate hook.

Implement nested routes and layout routes for shared UI.

Analyze TanStack Start's mechanism for distinguishing server-only ('use server') and client-side code execution.

Implement server-side data fetching in route loaders with typed data returns.

Handle loader errors and implement pending states for route transitions.

Implement data preloading on link hover to improve perceived performance.

Identify client-only dependencies (e.g., charting libraries) and refactor them for conditional loading in an SSR environment.

Refactor data fetching from client-side `useEffect` hooks to server-side route loaders.

Isolate and handle browser-specific APIs (e.g., `window`, `document`) to prevent server-side errors.

Refactor an existing client-side router to use TanStack's file-based routing conventions.

Implement a progressively enhanced form using TanStack Start server functions for submission and validation.

Configure streaming SSR for progressive page rendering and handle potential hydration mismatches.

Store a JWT securely in an HTTP-only cookie upon successful login.

Implement server-side token validation in middleware to protect API endpoints and server functions.

Create a typed authentication context for use on both the server and the client.

Serialize and inject the initial authentication state from the server into the HTML document for client-side hydration.

Initialize the client-side authentication context from the hydrated state, implementing logic to prevent UI mismatches.

Implement protected routes using a typed, reusable `beforeLoad` function for server-side authentication checks.

Handle authentication redirects with return URL preservation for a seamless user experience.

Access authenticated user data from the validated context within server functions and route loaders.

Modify the authentication process to issue a secure, HTTP-only refresh token alongside the access token.

Create a dedicated server function to handle token refresh requests, including refresh token rotation.

Implement automatic token refresh detection in server middleware when an access token is expired.

Implement a client-side interceptor to automatically refresh an expired access token and retry a single failed request.

Develop a strategy to manage concurrent client-side requests that occur during a token refresh.

Implement a secure logout mechanism that invalidates both access and refresh tokens on the server.

Configure Google OAuth 2.0 client credentials and redirect URIs in the application's environment.

Implement the server-side logic to initiate the OAuth authorization code flow with PKCE.

Create a server endpoint to handle the OAuth callback, validating the `state` parameter to prevent CSRF attacks.

Exchange the received authorization code for access and refresh tokens from Google.

Retrieve and validate the user's profile information from Google's APIs using the access token.

Map the OAuth identity to an application-specific JWT to integrate with the existing authentication system.

Handle user-initiated cancellation and provider-side errors during the OAuth flow gracefully.

Implement a strategy for linking an OAuth identity to an existing local user account.

Implement role-based access control (RBAC) by validating user roles within server loaders and `beforeLoad` functions.

Compose multiple authentication and authorization checks in a type-safe and reusable manner.

Manage and log server-side failures during the OAuth token exchange and user info retrieval process.

Implement structured logging for critical authentication events (e.g., login, logout, token refresh) within server functions.