skills.rest
snow-gift111
snow-gift111COMMUNITY
Explore all skills by this author →
GitHub

authorization

Explains OrangeHRM's role-based authorization model for REST endpoints and Vue pages.

Updated Jul 23, 2026
Search Tags:#authorization#php#permissions#rbac#symfony#rest api#orangehrm
One-click install
npx skills add https://github.com/snow-gift111/orangehrm-ai-sdlc-capstone --skill authorization-snow-gift111
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authorization
Source: https://github.com/snow-gift111/orangehrm-ai-sdlc-capstone/tree/main/.agents/skills/authorization
Command: npx skills add https://github.com/snow-gift111/orangehrm-ai-sdlc-capstone --skill authorization-snow-gift111

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Adding or debugging access control in OrangeHRM requires understanding three layered authorization gates, permission seeding tables, and the marker interface for public routes, which is easy to get wrong and produces confusing 403 errors. ## Core Features & Use Cases - Authorization Model Reference: Documents the three-gate subscriber flow (authentication, screen permissions, API data-group permissions), effective role computation, and OR-merge semantics. - Step-by-Step Recipes: Provides checklists for adding authenticated or public REST endpoints and Vue pages, including permission/api.yaml and permission/screens.yaml seeding via migrations. - 403 Debugging Guides: Ordered troubleshooting checklists for both REST and page authorization failures, covering missing _api attributes, permission rows, dynamic roles, and the self flag. - Use Case: When adding a new REST endpoint to an OrangeHRM plugin, follow the recipe to create the Endpoint class, register the route with _api, seed role permissions through a migration, and verify access per role. ## Quick Start Ask the agent to explain how to add a new authenticated REST endpoint with role-based permissions to an OrangeHRM plugin.

Frequently Asked Questions about authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new authenticated REST endpoint in OrangeHRM?▼

Create an Endpoint class in the plugin's Api directory, add a route pointing at GenericRestController::handle with the _api default set to the endpoint FQCN, then seed permissions via a permission/api.yaml file loaded by insertApiPermissions in a migration.

How do I make an OrangeHRM route public without login?▼

Implement the empty PublicControllerInterface marker interface on the controller, which makes all three authorization subscribers skip the request. For REST endpoints, point the route at GenericPublicRestController::handle instead; no permission rows are needed.

Why does my OrangeHRM API return 403 Unauthorized?▼

Common causes include a missing _api route attribute, no ohrm_api_permission row for the endpoint FQCN, no ohrm_user_role_data_group row matching the user's effective role and HTTP verb, or an unenforced self-flag ownership check in the endpoint.

How are user roles computed in OrangeHRM authorization?▼

Effective roles start from the static users.user_role_id (Admin or ESS), always include ESS, and dynamically add Supervisor, ProjectAdmin, HiringManager, Interviewer, or Reviewer based on the employee's relationships. Permissions across all matching roles are OR-merged.

What is the difference between screen permissions and data group permissions?▼

Screen permissions (ohrm_user_role_screen) gate Vue page access by module and action_url, checking mainly can_read. Data group permissions (ohrm_user_role_data_group) gate REST endpoints by CRUD bit matching the HTTP verb, with an optional self flag for row-level ownership.

When should I use CapableViewController in OrangeHRM?▼

Implement CapableViewController when static role-screen permissions are insufficient, such as pages gated by feature flags or employee state. Its isCapable method runs after the screen permission check and returning false shows a 403 page.

Related Skills

Explore More Software Engineering Skills→
orangehrmorangehrm
1.1k

console-commands

Implement and register Symfony console commands for OrangeHRM entry points.

Official
Intermediate
stacksjsstacksjs
622

stacks-migrations

Manage versioned database migrations and apply them via the Buddy CLI.

Official
Advanced
majedsiefalnasrmajedsiefalnasr

api-testing-patterns

Automate RBAC and API behavior verification with Laravel integration and feature tests.

Community
Advanced
jacob-balslevjacob-balslev
1

postgres-rls-pattern

Enforce tenant-scoped Postgres Row Level Security with orgQuery wrappers.

Community
Intermediate