App-Specific Authentication

Overview

The authentication system has been updated to provide complete isolation between apps. Each app (PromptNow, GrokTalk, NextJS-Base) now has its own separate user pool.

Key Changes

1. User Segregation

• Users must sign up separately for each app
• Email addresses can be reused across different apps
• No shared authentication between apps

2. Database Structure

• users table now includes an appId field
• Indexes ensure email uniqueness per app: by_app_email
• User profiles remain app-specific

3. Authentication Flow

Sign Up

1. User provides email/password on app-specific sign-up page
2. System checks if email exists for that specific app
3. New user is created with the app's ID
4. User profile is created for that app only

Sign In

1. User provides credentials
2. System verifies user exists for the specific app
3. Session is created for that app only

OAuth (GitHub/Google)

1. User authenticates with provider
2. System checks if user exists for the app
3. If new, creates user with app ID
4. Creates or updates app-specific profile

Implementation Details

Frontend (PromptNow example)

// components/app-auth-provider.tsx
export function useAppAuth() {
  // Handles app-specific authentication
  // Automatically sets appId during sign-up
  // Checks email uniqueness per app
}

Backend Queries

// Get user for specific app
getCurrentUserForApp({ appId: "promptnow" })

// Check if email exists for app
checkEmailForApp({ email: "user@example.com", appId: "promptnow" })

Migration

If you have existing users that need to be separated:

cd tools/convex
npx convex run migrations/separateAppUsers:separateUsersByApp '{"dryRun": true}'

Benefits

1. Complete Isolation: No data leakage between apps
2. Independent User Bases: Each app can have different user requirements
3. Flexibility: Users can have different profiles/settings per app
4. Security: Compromised account in one app doesn't affect others

Considerations

1. Users need separate accounts for each app
2. No single sign-on between apps
3. Email can be reused across apps
4. OAuth accounts are app-specific