feat: improve auth0-fastify skill score (81% → 93%)#113
Open
yogesh-tessl wants to merge 2 commits into
Open
Conversation
Hey @frederikprijck 👋 I ran your skills through `tessl skill review` at work and found some targeted improvements for `auth0-fastify`. Here's the before/after: | Skill | Before | After | Change | |-------|--------|-------|--------| | auth0-fastify | 81% | 93% | +12% | <details> <summary>Changes made</summary> **Description improvements (biggest impact):** - Expanded the frontmatter description from a brief mention of "login, logout, protected routes" to listing specific capabilities: session-based login, logout, OAuth callback handling, user profile retrieval, access token management, and automatic route registration for `/auth/login`, `/auth/logout`, `/auth/callback` - Added explicit disambiguation from `auth0-fastify-api` for JWT Bearer token scenarios **Content improvements:** - Added an agent instruction to fetch the latest SDK release version before providing setup instructions - Added an explicit **validation checkpoint** after environment configuration — verifying Auth0 Dashboard callback URLs, application type (Regular Web Application), and allowed origins before proceeding - Added specific **test verification steps** in Step 5 with four concrete checks and troubleshooting guidance for the most common failure (callback URL mismatch) - Trimmed the "When NOT to Use" section (Claude can infer framework routing without 5 listed alternatives) - Removed the "Related Skills" section and trimmed the Common Mistakes table to the four highest-impact entries **Progressive disclosure (new reference files):** - Created `references/setup.md` — automated setup with Auth0 CLI, environment variable reference, production configuration - Created `references/integration.md` — protected route patterns with preHandlers, calling APIs with access tokens, error handling - Created `references/api.md` — complete plugin options table and client methods reference </details> I also stress-tested your `auth0-custom-domains` skill against a few real-world task evals and it held up really well on multi-provider CNAME verification with Cloudflare and AWS Route 53 error diagnosis. Kudos for that. Honest disclosure — I work at @tesslio where we build tooling around skills like these. Not a pitch — just saw room for improvement and wanted to contribute. Want to self-improve your skills? Just point your agent (Claude Code, Codex, etc.) at [this Tessl guide](https://docs.tessl.io/evaluate/optimize-a-skill-using-best-practices) and ask it to optimize your skill. Ping me — [@yogesh-tessl](https://github.com/yogesh-tessl) — if you hit any snags. Thanks in advance 🙏
📝 WalkthroughWalkthroughThis PR refreshes the auth0-fastify skill docs: SKILL.md updated with clearer session-based Fastify guidance and an agent instruction to fetch the latest release, plus three new reference files for setup, integration, and API usage. ChangesAuth0 Fastify Documentation Refresh
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
plugins/auth0/skills/auth0-fastify/SKILL.md (2)
88-88:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winRemove 'views/' prefix from view paths.
Since the view engine root is configured as
'./views'(line 63), the view paths should be relative to that directory. Change'views/home.ejs'to'home.ejs'and'views/profile.ejs'to'profile.ejs'.🔧 Proposed fix
return reply.view('views/home.ejs', { + return reply.view('home.ejs', { isAuthenticated: !!session, }); }); // ... const user = await fastify.auth0Client.getUser({ request, reply }); - return reply.view('views/profile.ejs', { user }); + return reply.view('profile.ejs', { user }); });Also applies to: 103-103
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/auth0/skills/auth0-fastify/SKILL.md` at line 88, Update the view path arguments passed to reply.view so they are relative to the configured views root: remove the 'views/' prefix in the reply.view calls (change the 'views/home.ejs' usage and the 'views/profile.ejs' usage to 'home.ejs' and 'profile.ejs'); locate these strings in the reply.view invocations and replace them accordingly.
61-64:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winView path configuration creates incorrect paths.
Setting
root: './views'means view paths should be relative to that root directory. The later examples that callreply.view('views/home.ejs', ...)would incorrectly resolve to./views/views/home.ejs.🔧 Proposed fix
Either remove the
views/prefix from all view paths in the examples (recommended):await fastify.register(fastifyView, { engine: { ejs }, - root: './views', + root: './views', // view paths below should NOT include 'views/' prefix });Or adjust the root to the current directory:
await fastify.register(fastifyView, { engine: { ejs }, - root: './views', + root: '.', // if view paths will include 'views/' prefix });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/auth0/skills/auth0-fastify/SKILL.md` around lines 61 - 64, The view root is set to './views' in the fastify.register call for fastifyView, but the examples later call reply.view('views/home.ejs', ...) which would resolve to './views/views/home.ejs'; fix by either changing those reply.view usages to remove the redundant 'views/' prefix (e.g. reply.view('home.ejs', ...)) or change the root option in the fastify.register call to the parent directory so paths like 'views/home.ejs' resolve correctly; update all occurrences of reply.view and any example paths or the root option accordingly to keep them consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/auth0/skills/auth0-fastify/references/api.md`:
- Around line 5-24: Update the API doc table and method return typings to match
`@auth0/auth0-fastify`: change getAccessToken({ request, reply }) to indicate it
returns an object with accessToken (e.g., accessTokenResult.accessToken), change
logout(options, { request, reply }) to show it returns a logoutUrl-like result
(not void) that callers can use (e.g., logoutUrl.href), modify the options table
so appBaseUrl is required only when domain is a string (can be omitted when
domain is a resolver), expand routes to list login, callback, logout,
backchannelLogout, connect, connectCallback, unconnect, and unconnectCallback,
and remove or soften the "min 64 chars" claim for sessionSecret (note examples
generate a 64-byte hex secret but the upstream typing does not mandate a strict
minimum).
In `@plugins/auth0/skills/auth0-fastify/references/integration.md`:
- Around line 25-50: Update the view path used in the route registered with
fastify.get('/api-data', ...) so it matches the SKILL.md view root; replace the
current call to reply.view('views/data.ejs', { data }) with a view path that
omits the 'views/' prefix (e.g., 'data.ejs') so the view engine rooted at
'./views' resolves correctly.
- Around line 7-19: The reply.view call in the fastify.get route handler uses
'views/dashboard.ejs' which duplicates the configured view root; update the view
path to 'dashboard.ejs' in the route's response handler (the async handler that
calls reply.view) so Fastify resolves ./views/dashboard.ejs correctly instead of
./views/views/dashboard.ejs.
In `@plugins/auth0/skills/auth0-fastify/SKILL.md`:
- Around line 18-19: Update the fenced code block in SKILL.md that contains the
gh CLI command (`gh api repos/auth0/auth0-fastify/releases/latest --jq
'.tag_name'`) to include a language identifier (e.g., bash or shell) immediately
after the opening ``` so the block starts with ```bash, resolving the MD040 lint
warning.
---
Outside diff comments:
In `@plugins/auth0/skills/auth0-fastify/SKILL.md`:
- Line 88: Update the view path arguments passed to reply.view so they are
relative to the configured views root: remove the 'views/' prefix in the
reply.view calls (change the 'views/home.ejs' usage and the 'views/profile.ejs'
usage to 'home.ejs' and 'profile.ejs'); locate these strings in the reply.view
invocations and replace them accordingly.
- Around line 61-64: The view root is set to './views' in the fastify.register
call for fastifyView, but the examples later call reply.view('views/home.ejs',
...) which would resolve to './views/views/home.ejs'; fix by either changing
those reply.view usages to remove the redundant 'views/' prefix (e.g.
reply.view('home.ejs', ...)) or change the root option in the fastify.register
call to the parent directory so paths like 'views/home.ejs' resolve correctly;
update all occurrences of reply.view and any example paths or the root option
accordingly to keep them consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a7f60ed4-96fc-4ca8-82b7-e6f8cbe16d85
📒 Files selected for processing (4)
plugins/auth0/skills/auth0-fastify/SKILL.mdplugins/auth0/skills/auth0-fastify/references/api.mdplugins/auth0/skills/auth0-fastify/references/integration.mdplugins/auth0/skills/auth0-fastify/references/setup.md
frederikprijck
requested changes
May 29, 2026
frederikprijck
left a comment
frederikprijck
left a comment
Member
There was a problem hiding this comment.
Thanks for the PR, appreciate the improvements. Left some comments.
| | Method | Returns | Description | | ||
| |--------|---------|-------------| | ||
| | `getSession({ request, reply })` | `Session \| null` | Returns the current user session, or `null` if not authenticated | | ||
| | `getUser({ request, reply })` | `UserProfile` | Returns the authenticated user's profile (name, email, picture) | |
Member
There was a problem hiding this comment.
There is no UserProfile type.
|
|
||
| | Method | Returns | Description | | ||
| |--------|---------|-------------| | ||
| | `getSession({ request, reply })` | `Session \| null` | Returns the current user session, or `null` if not authenticated | |
Member
There was a problem hiding this comment.
There is no Session type.
| --- | ||
| name: auth0-fastify | ||
| description: Use when adding authentication (login, logout, protected routes) to Fastify web applications - integrates @auth0/auth0-fastify for session-based auth. For stateless Fastify APIs use auth0-fastify-api instead. | ||
| description: "Use when adding authentication to Fastify web applications — integrates @auth0/auth0-fastify for session-based login, logout, OAuth callback handling, user profile retrieval, and access token management. Registers /auth/login, /auth/logout, and /auth/callback routes automatically. For stateless Fastify APIs receiving JWT Bearer tokens, use auth0-fastify-api instead." |
Member
There was a problem hiding this comment.
Why do we need to include the routes it registered in the skills description?
receiving JWT Bearer tokens,
This is not correct, Fastify API handles more than just Bearer tokens.
| # Auth0 Fastify Integration | ||
|
|
||
| Add authentication to Fastify web applications using @auth0/auth0-fastify. | ||
| Add session-based authentication to Fastify web applications using @auth0/auth0-fastify. |
Member
There was a problem hiding this comment.
session-based sounds confusing when the SDK supports stateless and statefull configurations, where in stateful everything stays in the cookie.
| > **Agent instruction:** Before providing SDK setup instructions, fetch the latest release version by running: | ||
| > ``` | ||
| > gh api repos/auth0/auth0-fastify/releases/latest --jq '.tag_name' | ||
| > ``` |
Member
There was a problem hiding this comment.
What is the intention with removing prerequisites and when NOT to use here?
| | Session secret exposed in code | Always use environment variables, never hardcode secrets | | ||
| | Wrong appBaseUrl for production | Update APP_BASE_URL to match your production domain | | ||
| | Not awaiting fastify.register | Fastify v4+ requires awaiting plugin registration | | ||
| | Callback URL mismatch | Add `http://localhost:3000/auth/callback` to Allowed Callback URLs in Auth0 Dashboard | |
Member
There was a problem hiding this comment.
Why did we remove common mistakes?
- Drop the auto-registered route list and "JWT Bearer tokens" wording from
the description; avoid "session-based" framing since the SDK supports both
stateless and stateful configurations (frederikprijck)
- Restore Prerequisites, When NOT to Use, the fuller Common Mistakes table,
and Related Skills sections that were removed (frederikprijck)
- Fix reply.view() paths to omit the 'views/' prefix that duplicates the
configured view root (CodeRabbit)
- Correct api.md typings: no fictional Session/UserProfile types,
getAccessToken returns { accessToken }, logout returns a logout URL,
appBaseUrl is conditional on domain, expand routes keys, soften the
sessionSecret minimum claim (CodeRabbit, frederikprijck)
- Use { accessToken } in the integration example
- Add bash language identifier to the agent-instruction code block (MD040)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author
I have dropped another commit with all the comments mentioned. Hope that helps! |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/auth0/skills/auth0-fastify/SKILL.md`:
- Around line 17-20: Add a blank line before the fenced code block in the "Agent
instruction" section so the Markdown has an empty line between the preceding
text ("Before providing SDK setup instructions, fetch the latest release version
by running:") and the opening triple backticks; locate the fenced block in
SKILL.md (the "gh api repos/auth0/auth0-fastify/releases/latest --jq
'.tag_name'" snippet) and insert one empty line above the ``` to satisfy MD031.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f6c26f4d-e0f3-4c29-91d8-1aae02e29d25
📒 Files selected for processing (3)
plugins/auth0/skills/auth0-fastify/SKILL.mdplugins/auth0/skills/auth0-fastify/references/api.mdplugins/auth0/skills/auth0-fastify/references/integration.md
Comment on lines
+17
to
+20
| > **Agent instruction:** Before providing SDK setup instructions, fetch the latest release version by running: | ||
| > ```bash | ||
| > gh api repos/auth0/auth0-fastify/releases/latest --jq '.tag_name' | ||
| > ``` |
There was a problem hiding this comment.
Add blank line before the fenced code block.
Markdown specification requires blank lines around fenced code blocks. Add a blank line between line 17 and line 18 to resolve the MD031 linting warning.
📝 Proposed fix
> **Agent instruction:** Before providing SDK setup instructions, fetch the latest release version by running:
+>
> ```bash
> gh api repos/auth0/auth0-fastify/releases/latest --jq '.tag_name'
> ```As per coding guidelines, static analysis flagged: MD031 blanks-around-fences.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| > **Agent instruction:** Before providing SDK setup instructions, fetch the latest release version by running: | |
| > ```bash | |
| > gh api repos/auth0/auth0-fastify/releases/latest --jq '.tag_name' | |
| > ``` | |
| > **Agent instruction:** Before providing SDK setup instructions, fetch the latest release version by running: | |
| > | |
| > |
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 18-18: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/auth0/skills/auth0-fastify/SKILL.md` around lines 17 - 20, Add a
blank line before the fenced code block in the "Agent instruction" section so
the Markdown has an empty line between the preceding text ("Before providing SDK
setup instructions, fetch the latest release version by running:") and the
opening triple backticks; locate the fenced block in SKILL.md (the "gh api
repos/auth0/auth0-fastify/releases/latest --jq '.tag_name'" snippet) and insert
one empty line above the ``` to satisfy MD031.
Author
|
hey @frederikprijck, just a gentle nudge in case this got buried, let me know if you need any changes! |
frederikprijck
left a comment
frederikprijck
left a comment
Member
There was a problem hiding this comment.
Apologies, but have added one more question for clarification.
| --callbacks "http://localhost:3000/auth/callback" \ | ||
| --logout-urls "http://localhost:3000" \ | ||
| --origins "http://localhost:3000" \ | ||
| --reveal-secrets |
Member
There was a problem hiding this comment.
Why are we, by default, exposing the secret to the agent as opposed to how we do it in other skills?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hey @frederikprijck 👋
supporting 40+ agent clients from a single skill repo is impressive scope. The install paths for Claude Code, Cursor, and Copilot are all clean and well documented. Clearly built with the developer experience in mind.
also ran your skills through
tessl skill reviewat work and found some targeted improvements forauth0-fastify. Here's the before/after:Changes made
Description improvements (biggest impact):
/auth/login,/auth/logout,/auth/callbackauth0-fastify-apifor JWT Bearer token scenariosContent improvements:
Progressive disclosure (new reference files):
references/setup.md- automated setup with Auth0 CLI, environment variable reference, production configurationreferences/integration.md- protected route patterns with preHandlers, calling APIs with access tokens, error handlingreferences/api.md- complete plugin options table and client methods referencequick honest disclosure. I work at https://github.com/tesslio where we build tooling around skills like these. Not a pitch, just saw room for improvement and wanted to contribute.
If you want to self-improve your skills, or define your own scenarios to pressure test, just ask your agent (Claude Code, Codex, etc.) to evaluate and optimize your skill with Tessl. Ping me @yogesh-tessl, if you hit any snags.
Summary by CodeRabbit