bknd-public-vs-auth

Define and enforce public versus authenticated access in BKND backends.

1|Updated Jan 23, 2026

Search Tags:#authorization #security #backend #permissions #roles #access-control #bknd

Ready to run

npx skills add https://github.com/cameronapak/melos --skill bknd-public-vs-auth

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bknd-public-vs-auth
Source: https://github.com/cameronapak/melos/tree/main/.agents/skills/bknd-public-vs-auth
Command: npx skills add https://github.com/cameronapak/melos --skill bknd-public-vs-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill defines and enforces public versus authenticated access in a BKND-based backend.

Core Features & Use Cases

Quick setup of a default anonymous role to control public data exposure.
Entity-specific permissions and mixed access patterns for APIs and UI.
Testing guidance to validate public and authenticated access across endpoints.

Quick Start

Define the BKND authorization by adding a default anonymous role, assign permissions to public endpoints, enable guard, and run tests against anonymous and authenticated requests.

Frequently Asked Questions about bknd-public-vs-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up public vs authenticated data access in a backend?▼

Public versus authenticated data access is configured by defining a default anonymous role, assigning entity-level permissions, and enabling the authorization guard. This ensures anonymous users only see allowed public endpoints while authenticated users access protected data.

What is a default anonymous role in backend access control?▼

A default anonymous role in backend access control assigns baseline permissions to unauthenticated users. It controls public data exposure by explicitly defining what public endpoints and entity data can be accessed without requiring authentication credentials.

How do I configure entity-level permissions for mixed access patterns?▼

Entity-level permissions for mixed access patterns are configured using code-mode with explicit policies and conditions. This allows you to define granular access control rules that differentiate public visibility from authenticated access for specific entities.

Does the authorization guard need to be enabled for public API endpoints?▼

Yes, the authorization guard must be enabled for public API endpoints to enforce access control. Even with a default anonymous role set for public access, the guard ensures that explicit policies and permissions are actively validated against incoming requests.

How do I test public and authenticated access across API endpoints?▼

Testing public and authenticated access involves running test requests against both anonymous and authenticated states for your API endpoints. This validates that the configured permissions and guard correctly enforce data exposure rules for each user role.