Clarify best practices for implementing authentication in Next.js, including what Next.js and React features to use and when. With the minimum number of tools, we'll try to teach authentication from first principles (simple password + email), then recommend Next.js-compatible libraries, and further resources.

Authentication:

• Forms and Server Actions
• Server-side form validation and early returns
• Form errors with useFormStatus()
• Pending states with useFormState()

Session Management:

• Stateless Sessions
• Database Sessions
• Setting cookies on the server
  • cookies()
• sever-only

Authorization:

• Optimistic vs. secure checks
• Middleware for optimistic checks
  • Performance caveats - what not to do
• DAL - centralizing data requests, verifying auth state close to the data source
  • redirect()
• DTO - returning the minimum data, preventing exposure on the client
• Recommendations for:
  • Server Components
    • Partial rendering and layout caveats
  • Server Actions
  • Route Handlers

DX Content: "What is the right way to do authentication?".
Test Example: vercel-labs/app-router-auth#1

This is how I currently visualize it, this diagram is not meant for users, but to help clarify our current understanding. What am I missing?