Declares access rules for procedures, interceptors, route guards, and admin panel sections.
npx skills add https://github.com/Eyhenij/rt-tools --skill permissions-eyhenij
Please help me install this Agent Skill. Skill: permissions Source: https://github.com/Eyhenij/rt-tools/tree/main/.claude/skills/permissions Command: npx skills add https://github.com/Eyhenij/rt-tools --skill permissions-eyhenij
@RequiresPermission('bookings:manage')), any signed-in person (@RequiresAuth), public (@PublicProcedure), and public with a read of the sign-in (@OptionalAuthProcedure). - Rights model: a user's rights are the preset's rights with personal overrides applied; rights are re-read from storage on every call, and silence about a right means refusal. - Gating rules: the right is checked by an interceptor before the procedure body, menu items and section addresses share one declaration, and public record-creating procedures get a rate limiter. - Use Case: When adding a new admin panel section for managing roles, apply this rule to declare roles:manage on the procedure, gate the child routes with the session guard, and close the menu item with the same right. ## Quick Start Apply the permissions rule to declare access on my new Connect procedure and gate the corresponding admin panel section.High-intent search queries and answers about installing and using this skill.
Declare access with exactly one decorator on the procedure class: @RequiresPermission('resource:action') for right-based access, @RequiresAuth('reason') for any signed-in person, @PublicProcedure('reason') for public access, or @OptionalAuthProcedure('reason') for public with a sign-in read. A procedure with no declaration or two declarations prevents the application from starting.
The four kinds are: by a right (a resource-and-action string like bookings:manage), to any signed-in person, public, and public with a read of the sign-in. The last kind lets a signed-in person see more than a guest, such as an owner viewing hidden objects in a shared list.
A user's rights are the preset (role) rights with personal overrides applied over them, and they are read from storage on every call rather than taken from the issued sign-in token. A right the role says nothing about counts as not given, and non-boolean values are discarded.
A request without a sign-in is refused as unauthenticated (Code.Unauthenticated), while a signed-in request lacking the right is refused as permission denied (Code.PermissionDenied). The first is cured by signing in; the second is not.
A guard on the route group runs once per page load and does not see navigation between sections. Placing the guard on the child routes of the protected group ensures every move between admin panel sections is checked against the current rights.
A public procedure that creates a record must be closed by a rate limiter, since no right watches it and otherwise the sender controls the table's growth rate. The limit is counted by a client key shared across all such procedures; read-only public procedures need no limiter.
AratKruglikSelect and compose NestJS built-in decorators for controllers, guards, and interceptors.
JoyanLabsEnforce roles and permissions on NestJS endpoints with guards and decorators.
SennTseAutomate 1Password CLI secret management with tmux-isolated sign-in and read operations.
alfadocsRefresh AlfaDocs OAuth tokens with concurrency-safe row locking in Supabase Edge Functions.