skills.rest
weeglooapi
weeglooapiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

weegloo-space-role

Configure SpaceRole and ServiceUserRole permission filters for Weegloo content, media, and scripts.

1|2|Updated Feb 20, 2026
Search Tags:#content management#access control#permissions#rbac#least privilege#weegloo#spacerole
One-click install
npx skills add https://github.com/weeglooapi/weegloo-mcp-plugin --skill weegloo-space-role-weeglooapi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: weegloo-space-role
Source: https://github.com/weeglooapi/weegloo-mcp-plugin/tree/main/plugins/weegloo/skills/weegloo-space-role
Command: npx skills add https://github.com/weeglooapi/weegloo-mcp-plugin --skill weegloo-space-role-weeglooapi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Designing least-privilege access in Weegloo requires knowing exactly which actions, filters, and settings each role type accepts — and mistakes like hard-coding user ids, misusing the self filter, or putting unsupported actions on a ServiceUserRole cause save-time rejections or silent permission gaps. ## Core Features & Use Cases - Permission map design: Defines the contentType, content, media, and script maps with Allow/Deny filter rules (contentType, createdBy, tag, self), including the action subset a ServiceUserRole accepts. - Settings axis guidance: Explains the flat SETTING_* list (Webhook, Locale, Scheduler, EmailAccount, and more) that gates Space configuration, plus the token-type restrictions that apply to it. - Ready-made recipes: Provides patterns for per-user private Content with createdBy: ":self", pinning Script Execute to one specific Script via the self Refer filter, and async external-API job ContentTypes. - Use Case: You want each member of an open sign-up product to read and edit only their own rows. Use this Skill to build a ServiceUserRole with a createdBy.sys.id: ":self" filter scoped to the right ContentType and wire it to ServiceLogin. ## Quick Start Create a Weegloo SpaceRole that lets each user read only the Content entries they created for a given ContentType.

Frequently Asked Questions about weegloo-space-role

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I restrict Weegloo users to only their own content?▼

Set the createdBy filter with sys.id ":self" on the content map of a SpaceRole or ServiceUserRole, optionally combined with a contentType Refer. The :self sentinel resolves to the current caller at request time, so one role works for every user.

How do I let a user execute only one specific Weegloo Script?▼

Grant Execute on the script map with an Allow rule using the self filter — a Refer whose sys.id is the Script id and targetType is Script. This pins the permission to exactly that Script without granting Create, Edit, or Delete.

What is the difference between SpaceRole and ServiceUserRole in Weegloo?▼

SpaceRole applies to Weegloo Users via CMA/CDA and supports the full action set. ServiceUserRole applies to Service Users via ACMA/ACDA and accepts only a subset — contentType is Read-only, and Publish, Unpublish, Archive, Unarchive, and Save are rejected at save with WGL400076.

Why does creating a Webhook return 403 even with full content permissions?▼

Space configuration resources are gated by the settings axis, not the content maps. The role needs the matching SETTING_* action (e.g. SETTING_WEBHOOK), and the caller must use a console session or Personal Access Token — SpaceAccessToken and ServiceUser tokens are always refused.

Why does the :self filter return nothing on ACDA or CDA delivery?▼

The :self createdBy filter only works on delivery if the ContentType has publishWithAuthor set to true. Without it, the published snapshot has no sys.createdBy to match, so the filter silently matches nothing on ACDA/CDA.

What permissions are required to create a Weegloo Scheduler?▼

Creating a Scheduler requires SETTING_SCHEDULER plus a script Execute grant covering the target Script, typically scoped with the self filter. The Execute grant is re-checked before every run, so revoking it deactivates the Scheduler.

Related Skills

Explore More Software Engineering Skills→
contentstackcontentstack
2

contentstack-management-dotnet-sdk

Configure ContentstackClient and authenticate with Contentstack CMA .NET SDK tokens.

Official
Intermediate
microsoftmicrosoft
808

assign-offline-profile

Binds users and teams to a Dataverse Mobile Offline Profile via Web API membership records.

Official
Advanced
cockroachdbcockroachdb
3

hardening-user-privileges

Audit CockroachDB users and role grants to reduce excessive privileges.

Official
Advanced
CantaraCantara
3

resistor

Parse resistor part numbers to extract resistance, tolerance, and package codes.

Official
Intermediate