What is the main goal of the Permissions skill?

It ensures that authorization checks are consistent and secure across both client-side actions and server-side functions in a multi-tenant environment.

How does it handle multi-tenancy?

It requires a teamId for every permission check, ensuring that users can only access or modify data belonging to their specific team.

What is the difference between hasTeamPermission and requireTeamPermission?

hasTeamPermission returns a boolean for manual logic in actions, while requireTeamPermission automatically throws an error if the user lacks access, making it ideal for server functions.

How do I fix a permission mismatch?

Identify the mismatch between the action and server function, determine the correct granular permission, and update the server function to match the action's requirements.

Team Authorization & RBAC

Name: Team Authorization & RBAC
Author: wodsmith

bywodsmith

0•

セキュリティとテスト

Manages team-based permissions and role-based access control to ensure consistent authorization across client-side actions and server-side functions.

This skill provides comprehensive guidance for implementing and maintaining a robust multi-tenant authorization system within the WODsmith codebase. It streamlines the process of checking permissions for team members, aligning security logic between the frontend and backend, and managing granular access to resources like workout components, user roles, and billing. By utilizing standardized patterns and utility functions, it prevents authorization mismatches and ensures that every operation is correctly scoped to the appropriate team context, maintaining high security standards across the application.

主な機能

01Multi-tenant support via team-scoped permission checks

020 GitHub stars

03Standardized RBAC implementation across client and server layers

04Guidelines for synchronizing permission constants between actions and functions

05Granular resource access management for workout components and settings

06Pre-built utilities for checking and enforcing access rights

ユースケース

01Synchronizing permission checks between a ZSA Server Action and a core server function

02Implementing multi-tenant security logic when creating new team-based features

03Auditing and fixing authorization mismatches in existing CRUD operations

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add wodsmith/thewodapp permissions

For use in Claude.ai and ChatGPT

Download Skill