skills.rest
qfeius
qfeiusOFFICIAL
Explore all skills by this author →
GitHub

make-app-permission

Enforces Make App single-app IAM permissions across Service proxy, routes, fields, and record operations.

5|Updated Apr 1, 2026
Search Tags:#access control#audit#permissions#iam#route guards#make app#field security
One-click install
npx skills add https://github.com/qfeius/make-platform-skills --skill make-app-permission-qfeius
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: make-app-permission
Source: https://github.com/qfeius/make-platform-skills/tree/main/skills/make-app-permission
Command: npx skills add https://github.com/qfeius/make-platform-skills --skill make-app-permission-qfeius

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Make Apps must enforce per-user IAM permissions consistently across navigation, routes, table headers, record reads, and create/edit/delete operations; this Skill defines the complete contract so generated or refactored apps never leak unauthorized fields, records, or actions. ## Core Features & Use Cases - Service IAM Proxy Contract: Exposes /api/make/app/principal/permission as a transparent proxy to Make IAM with App-scoped requests, login-context forwarding, and unchanged upstream responses. - Permission-Aware UI Runtime: Gates entity navigation and dynamic routes with meta.entity.read, derives visible/editable/creatable field sets from meta.field.read and meta.field.update, and filters submit payloads to the current allowlist. - Static Audit and Conformance Suite: Ships scripts that statically audit a host project for permission contract violations and run an executable behavior conformance suite against the host's permission helpers. - Use Case: When building a Make App record list page, use this Skill to ensure a user without data.record.read still sees authorized table headers but zero rows, and cannot reach the create form without data.record.create. ## Quick Start Ask the AI to apply the make-app-permission skill to implement the full create, read, and update permission chain for your Make App, then run the audit script against your project root.

Frequently Asked Questions about make-app-permission

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce field-level permissions in a Make App?▼

Derive three independent field sets: create fields from createFields intersected with meta.field.read creatable states, visible fields from fields intersected with readable states, and editable fields from visible fields intersected with meta.field.update editable states. Never use data.record.* operations or meta.field.create to choose fields.

How should the Service expose the principal permission endpoint?▼

Expose GET /api/make/app/principal/permission and proxy it to POST /api/make/iam/v1/principal/permission with X-Make-Target: MakeService.GetResource and scope make://<tenantId>/meta/app/<appKey>. Return the IAM status, Content-Type, and body unchanged for every response.

What happens when a user loses data.record.read permission?▼

The entity navigation item and table shell with authorized meta.field.read headers remain visible, but no record request is issued and the row set is rendered empty so cached values cannot persist. Only record-backed controls like pagination, detail, and selection are disabled.

Why must create forms not fall back to visible fields when createFields is missing?▼

A missing createFields collection means the create field set is empty; falling back to fields would expose fields the user is not authorized to create. The create entry itself is gated only by data.record.create, independent of how many creatable fields exist.

How do I verify a host project follows the permission contract?▼

Run the static audit script audit-make-app-permission.mjs against the project root, and run permission-conformance-suite.mjs against a thin host adapter that delegates to the production permission helpers. Treat audit failures as blockers and wire both checks into the host's test or CI gate.

When should I not use this Skill for permission work?▼

Do not use it for platform-admin or tenant-root permissions, login and session handling, generic Service API design, UI layout, CanvasTable internals, DSL modeling, or deployment packaging. Those belong to make-app-auth, make-app-service, makeui, canvas-table-integration, and make-app-runtime respectively.

Related Skills

Explore More Software Engineering Skills→
sergueiksergueik
9

uipath-admin

Administer UiPath Identity, Authorization, OMS, IP restriction, and audit via the uip CLI.

Community
Advanced
sixerssixers

fakturownia-departments

Manage Fakturownia departments via CLI with list, fetch, create, update, delete, and set-logo operations.

Community
Intermediate
neo4j-contribneo4j-contrib
101

neo4j-mcp-skill

Configures the official Neo4j MCP server for schema exploration and Cypher execution.

Official
Intermediate
PlazaCCPlazaCC
2

non-json-content-types

Enable tRPC mutations to accept FormData and binary streams via octetInputParser and splitLink.

Official
Advanced