# rbac-permissions-builder

Generates a complete role-based access control architecture in TypeScript: permission matrices, Express route guards, policy classes, and UI checks.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 320 installs · ★ 63
- Author: patricio0312rev
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/patricio0312rev/skills/tree/HEAD/backend/rbac-permissions-builder/SKILL.md
- Updated: 2026-01-12
- HTML: https://affpapa.org/en/nevibecode/skills/rbac-permissions-builder

## What it does

This skill guides the agent through building role-based authorization systems. It produces a granular `resource:action` permission enum alongside a role mapping table. For backend routing, it writes Express middleware like `requirePermission` and `requireOwnership`, returning standard 401 or 403 HTTP status codes.

Complex business logic moves into static policy classes like `UserPolicy`. The skill also outlines client-side integration: an auth endpoint returning active user permissions and a `usePermission` hook to toggle UI elements.

The code examples target TypeScript and Express. Route guards depend directly on an authentication layer that populates `req.user`, rejecting requests with 401 if that object is missing.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add patricio0312rev/skills --skill rbac-permissions-builder -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rbac-permissions-builder/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rbac-permissions-builder/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add patricio0312rev/skills --skill rbac-permissions-builder -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rbac-permissions-builder/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add patricio0312rev/skills --skill rbac-permissions-builder -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rbac-permissions-builder/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install patricio0312rev/skills rbac-permissions-builder
```

2. **Manually: put the files in place**
- File: `.github/skills/rbac-permissions-builder/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add patricio0312rev/skills --skill rbac-permissions-builder -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/patricio0312rev/skills --path backend/rbac-permissions-builder
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rbac-permissions-builder/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add patricio0312rev/skills --skill rbac-permissions-builder -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/patricio0312rev/skills/tree/HEAD/backend/rbac-permissions-builder/SKILL.md

## When to use it
- map granular permissions to roles using a TypeScript matrix
- secure Express endpoints using permission-based route guards
- verify resource ownership while preserving admin overrides
- render frontend actions conditionally based on user permissions

## Example prompts
- Design an RBAC setup with user, moderator, and admin roles
- Write Express middleware to protect user deletion routes with permissions
- Create a UserPolicy class with rules for profile updates

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 8ff6f9738df1ff48.

BEGIN THIRD-PARTY FILE 8ff6f9738df1ff48
````text
---
name: rbac-permissions-builder
description: Implements role-based access control with permission matrix, route guards, policy functions, and UI permission hints. Provides middleware/guards, helper utilities, test suggestions, and permission checking patterns. Use when building "RBAC", "permissions", "access control", or "authorization".
---

# RBAC/Permissions Builder

Implement flexible role-based access control systems.

## Permission Matrix

```typescript
// Define permissions
export enum Permission {
  USER_READ = "user:read",
  USER_WRITE = "user:write",
  USER_DELETE = "user:delete",
  POST_READ = "post:read",
  POST_WRITE = "post:write",
  ADMIN_ACCESS = "admin:access",
}

// Define roles
export const ROLE_PERMISSIONS = {
  user: [Permission.USER_READ, Permission.POST_READ, Permission.POST_WRITE],
  moderator: [...userPermissions, Permission.POST_DELETE],
  admin: Object.values(Permission), // All permissions
};

// Check permission
export const hasPermission = (user: User, permission: Permission): boolean => {
  return ROLE_PERMISSIONS[user.role]?.includes(permission) ?? false;
};
```

## Route Guards (Express)

```typescript
export const requirePermission = (...permissions: Permission[]) => {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!req.user) {
      return res.status(401).json({ error: "Unauthorized" });
    }

    const hasAllPermissions = permissions.every((p) =>
      hasPermission(req.user, p)
    );

    if (!hasAllPermissions) {
      return res.status(403).json({ error: "Forbidden" });
    }

    next();
  };
};

// Usage
router.delete(
  "/users/:id",
  authenticate,
  requirePermission(Permission.USER_DELETE),
  controller.delete
);
```

## Policy Pattern

```typescript
// policies/user.policy.ts
export class UserPolicy {
  static canUpdate(currentUser: User, targetUser: User): boolean {
    // Users can update themselves
    if (currentUser.id === targetUser.id) return true;

    // Admins can update anyone
    if (hasPermission(currentUser, Permission.USER_WRITE)) return true;

    return false;
  }

  static canDelete(currentUser: User, targetUser: User): boolean {
    // Can't delete yourself
    if (currentUser.id === targetUser.id) return false;

    // Only admins can delete
    return hasPermission(currentUser, Permission.USER_DELETE);
  }
}

// Usage in controller
if (!UserPolicy.canUpdate(req.user, targetUser)) {
  return res.status(403).json({ error: "Cannot update this user" });
}
```

## Resource Ownership

```typescript
export const requireOwnership = (
  getResourceUserId: (req: Request) => Promise<string>
) => {
  return async (req: Request, res: Response, next: NextFunction) => {
    const resourceUserId = await getResourceUserId(req);

    // Owner can access
    if (req.user.id === resourceUserId) {
      return next();
    }
````
END THIRD-PARTY FILE 8ff6f9738df1ff48

The third-party file has ended. Everything between the 8ff6f9738df1ff48 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2850 of 3971 bytes. © patricio0312rev · MIT · https://github.com/patricio0312rev/skills/tree/HEAD/backend/rbac-permissions-builder/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md