Identity, Access & Tenant Trust
auth
Better Auth on Postgres — organization membership, device-flow login, MFA-enforced, session HMAC-signed. One identity layer, no vendor in the loop.
@nebutra/auth
Sign in to Nebutra
One auth provider, every sign-in method it needs — Better Auth, no vendor in the loop.
or sign in with email
Better Auth · SSO ready · MFA enforced
More in nebutra.com
- auditHash-chained, SHA-256 append-only audit log for actor/tenant actions. SOC 2-grade tamper detection, streaming export, and replay-safe queries.
- captchaBot challenge with Cloudflare Turnstile / hCaptcha / reCAPTCHA behind one verify() call. Server-side scoring, per-route enable, no third-party tracker on the client.
- identityShared actor primitive — usr_/svc_/api_ ID space, role/membership lookup, tenant attachment. The single identity object every iam package reads.
- oauthYour own OIDC identity provider — "Sign in with Nebutra" for third-party apps. Authorization code + PKCE, refresh-token rotation, consent, clients stored in Postgres.
- permissionsRBAC + ABAC engine — CASL for in-process checks. defineAbility() server, <Can /> in React.
- tenantRequest-scoped tenant context via AsyncLocalStorage, with Prisma RLS bridge. One tenantId resolves through middleware and propagates the whole stack.