skills.rest
lety-ai
lety-aiOFFICIAL
Explore all skills by this author →
GitHub

backend-resource-permissions

Register backend RBAC resources across CASL, PostgreSQL, and NestJS gateways.

Updated Apr 6, 2026
Search Tags:#permissions#migration#rbac#nestjs#auth#typeorm#casl
One-click install
npx skills add https://github.com/lety-ai/lety-skill-hub --skill backend-resource-permissions
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: backend-resource-permissions
Source: https://github.com/lety-ai/lety-skill-hub/tree/main/plugins/casl/skills/backend-resource-permissions
Command: npx skills add https://github.com/lety-ai/lety-skill-hub --skill backend-resource-permissions

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents unexpected 403 permission errors and inconsistent RBAC state by guiding developers through the complete process of registering a new resource across CASL, the auth database, and gateway decorators.

Core Features & Use Cases

  • Enum registration: Add the new resource to the TypeScript enum used by the auth database so database values and application enums match.
  • CASL mapping: Map the resource to its primary entity in CASL constants so PermissionsGuard can evaluate abilities correctly.
  • Auth DB migration & role assignments: Create an idempotent migration that extends the PostgreSQL enum, inserts the resource and four actions, and assigns role_permissions according to role limits.
  • Gateway integration: Register the migration and apply @Permissions decorators on controllers to protect endpoints.
  • Use Case: Use this when adding a new feature module, introducing a new entity type, or troubleshooting a 403 error for a missing resource.

Quick Start

Add the new resource by updating the TypeScript enum and CASL mapping, creating and registering an idempotent auth DB migration that inserts the resource and permissions and assigns role_permissions, and annotating gateway controllers with the appropriate @Permissions decorators.

Frequently Asked Questions about backend-resource-permissions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I register a new RBAC resource in NestJS with CASL to prevent 403 errors?▼

To register a new RBAC resource in NestJS with CASL, you update the TypeScript resource enum, map the resource to its primary entity in CASL constants, create an idempotent auth database migration, and apply @Permissions decorators on gateway controllers to prevent 403 errors.

Why does my NestJS application return a 403 error after adding a new feature module?▼

A 403 error occurs because the new resource is missing from the CASL entity mappings or the auth database lacks the corresponding resource and permission rows, causing the PermissionsGuard to fail evaluation.

Does this RBAC registration process work with TypeORM and PostgreSQL enums?▼

Yes, the RBAC registration process works with TypeORM and PostgreSQL by generating an idempotent migration that alters the PostgreSQL enum, inserts resource and permission rows, and assigns role_permissions according to role limits.

How to create an idempotent auth DB migration for adding CASL permissions?▼

You create an idempotent auth DB migration for CASL permissions by writing a script that safely extends the PostgreSQL enum, inserts the resource and four actions, and assigns role_permissions according to role limits without duplicating existing data.

What steps are needed to map a new entity type in CASL and apply Permissions decorators?▼

The steps to map a new entity type in CASL and apply Permissions decorators include adding the resource to the TypeScript enum, mapping it to its primary entity in CASL constants, running the auth DB migration, and annotating gateway controllers with the appropriate decorators.

Related Skills

Explore More Software Engineering Skills→
AgentiveCityAgentiveCity
2

nestjs-typeorm-integration

Configure TypeORM data sources, entities, migrations, and transactions in NestJS projects.

Official
Intermediate
ColdBoxColdBox

coldbox-security-rbac

Implement role-based access control for ColdBox applications with database schemas.

Official
Intermediate
JoyanLabsJoyanLabs

auth-guards

Enforce roles and permissions on NestJS endpoints with guards and decorators.

Official
Intermediate
MolcajeteAIMolcajeteAI
2

authorization-patterns

Implement RBAC and ABAC authorization patterns with TypeScript and Fastify.

Official
Advanced