skills.rest
palfish-t-i-u
palfish-t-i-uOFFICIAL
Explore all skills by this author →
GitHub

rbac-and-auth-accounts

Implements and debugs RBAC roles, activation gates, and permission matrices in a FastAPI and Supabase app.

1|Updated May 23, 2026
Search Tags:#fastapi#access control#rbac#user activation#supabase auth#jwt verification#permissions matrix
One-click install
npx skills add https://github.com/palfish-t-i-u/palfish-t-i-u-h-th-ng-ver-2 --skill rbac-and-auth-accounts-palfish-t-i-u
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rbac-and-auth-accounts
Source: https://github.com/palfish-t-i-u/palfish-t-i-u-h-th-ng-ver-2/tree/main/.claude/skills/rbac-and-auth-accounts
Command: npx skills add https://github.com/palfish-t-i-u/palfish-t-i-u-h-th-ng-ver-2 --skill rbac-and-auth-accounts-palfish-t-i-u

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Managing role-based access control, user activation, and dynamic permission matrices across a FastAPI backend and React frontend is error-prone, especially when debugging 403 errors, onboarding users, or adding new module permission keys that must stay in sync across backend, frontend, and database. ## Core Features & Use Cases - JWT Verification & Role Resolution: Documents the resolve_actor() flow in backend/rbac.py, including role normalization, the 4-level role hierarchy, and sub-team data scoping via enforce_report_scope(). - Activation Gate Runbook: Explains the is_activated signup gate, the admin activation procedure, the CRM-link prerequisite for sale accounts, and the one-shot backfill script for existing users. - Dynamic Permission Matrix: Step-by-step procedure for adding a new permission key across MODULE_LIST, DEFAULT_DEPT_PERMISSIONS, frontend constants, and DB seeding. - Use Case: A new user reports a bare 403 on first login. Use this Skill to trace the activation gate, verify SYSTEM_ADMIN_EMAILS bypass rules, and walk the admin through the activation toggle in the Auth Accounts tab. ## Quick Start Ask the assistant to diagnose why a newly signed-up user gets a 403 error and walk through the admin activation steps.

Frequently Asked Questions about rbac-and-auth-accounts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix a 403 error for a newly signed-up user in Supabase Auth?▼

New signups get is_activated=false in user_metadata, so resolve_actor() returns HTTP 403 on the first API call. An admin with system role must activate the user via PATCH /admin/auth-users/{user_id} in the Auth Accounts tab.

How do I add a new permission key to a dynamic RBAC matrix?▼

Add the key to MODULE_LIST and DEFAULT_DEPT_PERMISSIONS in backend/admin_routes.py, mirror it in frontend/src/types/permissions.ts, then seed the department_permissions table via POST /admin/permissions/seed and guard routes with require_module_access().

Does the database role override the JWT role in Supabase RBAC?▼

Yes. If a staff row exists in nhan_su_sale, its role column wins over user_metadata.role in the JWT. To fix a wrong role, update the nhan_su_sale row rather than the JWT metadata.

Why does activating a sale account fail with a 400 error?▼

The PATCH endpoint rejects is_activated=true for sale-department accounts that have no linked crm_name. The admin must set crmName in the same PATCH call or a prior call before toggling activation.

How do I backfill is_activated for existing Supabase users?▼

Run backend/migrate_activate_existing_users.py with --apply after a dry run. It assigns tiers based on SYSTEM_ADMIN_EMAILS membership and nhan_su_sale CRM linkage, skipping users already at the target value.

When should allow_unactivated=True be used on a route?▼

Only GET /me, PATCH /me, and one internal re-read currently use it so unactivated users can view their own profile. Do not add it to new routes without explicit product approval, since all other routes block unactivated users.

Related Skills

Explore More Software Engineering Skills→
ohdaveedohdaveed

supabase

Diagnose Supabase RLS, migration, and Data API issues with verification queries.

Community
Advanced
TimeKastTimeKast

sk-e2e

Orchestrate Playwright E2E runs with isolated Neon branches and per-role auth sessions.

Official
Advanced
humanerd-drewhumanerd-drew
2

Webhook Subscriptions

Manage webhook subscriptions for AI agents to receive external service events.

Official
Intermediate
Aurelian1974Aurelian1974

authorization

Implements RBAC authorization with permission policies, JWT claims, and React permission guards for ERP systems.

Community
Intermediate