skills.rest
webiny
webinyOFFICIAL
Explore all skills by this author →
Website𝕏@WebinyCMSGitHub

webiny-api-permissions

Implements schema-based API authorization with DI-injectable permission checks in Webiny use cases.

8.0k|673|Updated Jan 9, 2018
Search Tags:#Authorization#api security#typeScript#Dependency Injection#Permissions#webiny#Access Control
One-click install
npx skills add https://github.com/webiny/webiny-js --skill webiny-api-permissions
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: webiny-api-permissions
Source: https://github.com/webiny/webiny-js/tree/main/skills/user-skills/api/permissions
Command: npx skills add https://github.com/webiny/webiny-js --skill webiny-api-permissions

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implementing authorization in Webiny API use cases manually requires repetitive identityContext.getPermission() calls and ad-hoc ownership checks, which leads to inconsistent access control and security gaps across features.

Core Features & Use Cases

  • Permission Schema Definition: Declare namespaced permission schemas with createPermissionSchema, defining entities, scopes (full/own), and actions (rwd, pw, custom flags).
  • DI-Injectable Permissions: Generate typed Permissions abstractions via createPermissionsAbstraction and register them as features with createPermissionsFeature for use in any use case.
  • Use Case Integration Patterns: Apply ready-made patterns for Get, List, Update, Delete, and Publish use cases, including own-record scoping via onlyOwnRecords and item-level checks like canDelete.
  • Use Case: When building a products API where editors should only modify their own records, define the schema once, inject SmPermissions into each use case, and get typed canRead/canEdit/canDelete checks with automatic ownership enforcement.

Quick Start

Ask the AI to add permission checks to a Webiny API use case using a createPermissionSchema-based permissions feature with own-record scoping.

Frequently Asked Questions about webiny-api-permissions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement permissions in a Webiny API use case?▼

Define a permission schema with createPermissionSchema, create an abstraction with createPermissionsAbstraction, register the feature in your context plugin, then inject the permissions abstraction into your use case and call methods like canRead or canEdit before executing logic.

How do I restrict users to only their own records in Webiny?▼

Add the "own" scope to your schema entity, then use onlyOwnRecords(entity) in List use cases to filter where.createdBy by the current identity, and pass items to canAccess or canDelete for item-level ownership checks.

Why does canDelete return false when checking permissions?▼

canDelete returns false when the permission has own: true and no item is passed, because ownership cannot be verified without the record. Always fetch the item first via the Get use case, then call canDelete with the item.

What is the difference between canEdit and canDelete without an item?▼

canEdit without an item returns true for own-scoped permissions, intentionally allowing edits to new or unsaved records. canDelete without an item returns false, forcing you to fetch the record first to verify ownership.

How do API permissions match admin-side permissions in Webiny?▼

Both sides must use the same prefix, entity IDs, and action names in their createPermissionSchema definitions. This ensures permissions emitted by the admin UI are correctly evaluated by the API layer.

Related Skills

Explore More Software Engineering Skills→
webinywebiny
8.0k

backend-developer

Implement backend API features using Webiny architecture and GraphQL schemas.

Official
Advanced
fullstackherofullstackhero
6.7k

add-permission

Add authorization permissions across .NET server and React admin UI.

Official
Intermediate
enbiyagoralenbiyagoral
2

update-permissions

Update allow/deny command patterns in .claude/settings.json.

Community
Intermediate
techwithanirudhtechwithanirudh
1

organization-best-practices

Configure and manage multi-tenant organizations with RBAC, teams, and invitations in Better Auth's organization plugin.

Community
Advanced