The Complete Production SOP: How to Deploy and Run Lucia Auth Lightweight Database Session Management in Autonomous AI Agents

---
name: "lucia-auth-sessions-framework"
description: "Implement complete session-based authentication in Next.js/SvelteKit/Astro using Lucia Auth."
metadata:
  author: "Lucia"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "setup lucia auth sessions"
  - "validate session cookie lucia"
  - "create session lucia"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

import { Lucia } from "lucia";
import { PrismaAdapter } from "@lucia-auth/adapter-prisma";
import { prisma } from "@/lib/prisma";

const adapter = new PrismaAdapter(prisma.session, prisma.user);

export const lucia = new Lucia(adapter, {
  sessionCookie: {
    attributes: {
      secure: process.env.NODE_ENV === "production"
    }
  },
  getUserAttributes: (attributes) => {
    return {
      username: attributes.username
    };
  }
});

declare module "lucia" {
  interface Register {
    Lucia: typeof lucia;
    DatabaseUserAttributes: DatabaseUserAttributes;
  }
}

interface DatabaseUserAttributes {
  username: string;
}

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
import { lucia } from "@/lib/auth";

export async function middleware(request: NextRequest) {
  const sessionId = request.cookies.get(lucia.sessionCookieName)?.value ?? null;
  if (!sessionId) {
    return NextResponse.next();
  }

  const { session, user } = await lucia.validateSession(sessionId);
  if (session && session.fresh) {
    const sessionCookie = lucia.createSessionCookie(session.id);
    const response = NextResponse.next();
    response.cookies.set(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
    return response;
  }
  if (!session) {
    const sessionCookie = lucia.createBlankSessionCookie();
    const response = NextResponse.next();
    response.cookies.set(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
    return response;
  }

  return NextResponse.next();
}