Implements persistent data storage and permissions for HTML micro-apps using MagicBase tables.
npx skills add https://github.com/dtyq/magic --skill magicbase
Please help me install this Agent Skill. Skill: magicbase Source: https://github.com/dtyq/magic/tree/main/backend/super-magic/agents/skills/magicbase Command: npx skills add https://github.com/dtyq/magic --skill magicbase
HTML micro-apps often need persistent data, current-user identity, ownership, and permission control, but building a backend for each small app is impractical. This Skill provides a complete guide to MagicBase, a hosted database layer that gives micro-apps schema management, row-level CRUD, dynamic permissions, and current-user context without custom backend code.
.magicbase/migrations.json and MICRO-APP.md.window.Magic.db inside HTML for queryRows, createRow, updateRow, deleteRow, filtering, sorting, pagination, and field projection against real table IDs.window.Magic.getContext(), enforce creator-owned rows via system created_by, configure dynamic_permissions scopes (public, private_user, private_department, private_org), and gate administrator pages with getProjectAdminAccess().Ask the agent to create a MagicBase-backed todo micro-app where all team members can read tasks but only each task's creator can edit or delete it.
High-intent search queries and answers about installing and using this skill.
Create a MagicBase table with the create_magicbase_table agent tool, then use window.Magic.db inside the HTML for row operations like queryRows, createRow, updateRow, and deleteRow. Always use the real table ID returned by the tools, never the table key or name.
Call window.Magic.getContext() during initialization to get the current user's ID, name, organization, and language. Compare row.created_by with context.userId for ownership checks, and never hard-code tokens or write fake identities.
MagicBase supports five MySQL-like data types: text, number, datetime, boolean, and json. Low-code field types like single_select, multi_select, user, department, attachment, or reference are not available as column types.
Yes, MagicBase dynamic_permissions enforce row scopes such as private_user, which restricts read, edit, and delete to the row creator via the system created_by field. Frontend button hiding is only a UI safeguard, not a security boundary.
MagicBase cannot enforce state-dependent, cross-table, hierarchical, time-window, quota, or workflow permissions, nor sensitive operations like payments or approvals. These require custom backend logic; UI-only restrictions can be bypassed by calling MagicBase directly.
MagicBase accepts only specific formats like YYYY-MM-DD, YYYY-MM-DD HH:mm:ss, and ISO 8601 with timezone. Do not strip the Z or timezone offset before writing, since removing it changes the represented instant instead of converting it.
promptlylabsTrace Django access control and IDOR risks across views, models, and queries.
sunyonghuanGenerate runnable Layui pages with component scaffolding and initialization.
VictorSmaniottoImplement Laravel RBAC with Guards, Policies, Gates, and Spatie permissions.
KatlyngDesign and implement reusable Convex components with isolated tables and app-facing wrappers.