What problem does it solve?
Browser-facing BFF endpoints often rely on implicit middleware ordering and hand-maintained route lists, so routes silently ship without authentication, CSRF, or Origin checks. This Skill makes every production entry point declare an explicit access classification and installs the correct protection chain by construction, with automated gates that fail the build on any bypass.
Core Features & Use Cases
- Explicit Access Classification: Every route declares public, protected-read, protected-browser-mutation, or protected-upgrade; an unclassified route is a build failure, not a silent default.
- Composition-Prepared Registrar: A deep module installs session resolution, Origin/Fetch Metadata/CSRF/content-type policy, and RFC 9457 error translation so endpoint owners cannot choose, order, or omit middleware.
- Realtime and Session Coverage: Protected SSE streams, a sibling WebSocket upgrade registrar, a single browser authentication coordinator, and a derived entry catalog reconciled against the runtime route table and OpenAPI document.
- Use Case: When adding a new POST endpoint to a Hono or Fastify BFF, use this Skill to declare its contract, let the registrar install the full browser-mutation chain, and add the hostile-matrix and provider-free authorization tests the enforcement gates require.
Quick Start
Use the bff-entry-points skill to classify every route in my BFF and design a registrar that enforces session, Origin, and CSRF policy by construction.
