diff --git a/openspec/changes/user-accounts/tasks.md b/openspec/changes/user-accounts/tasks.md
index 95b8aef..d9b4e63 100644
--- a/openspec/changes/user-accounts/tasks.md
+++ b/openspec/changes/user-accounts/tasks.md
@@ -27,7 +27,7 @@
 ## 5. Auth Middleware & Helpers
 
 - [x] 5.1 `[sonnet]` Create `proxy.ts` at project root: protect `/app/*` routes (redirect to `/login`), protect `/api/*` except `/api/auth/*` and `/api/health` (return 401), redirect authenticated users from `/login` and `/register` to `/app`
-- [ ] 5.2 `[haiku]` Create `src/lib/auth.ts` with `getAuthUser()` helper that extracts user from Auth.js session
+- [x] 5.2 `[haiku]` Create `src/lib/auth.ts` with `getAuthUser()` helper that extracts user from Auth.js session
 
 ## 6. User Settings API
 
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
new file mode 100644
index 0000000..1edbe95
--- /dev/null
+++ b/src/lib/auth.ts
@@ -0,0 +1,6 @@
+import { auth } from "@/auth";
+
+export async function getAuthUser() {
+  const session = await auth();
+  return session?.user ?? null;
+}