跳到正文
cccskills
免费在 GitHub 公开

audit-rbac

Review NestJS API endpoints and frontend components for role-based access control and audit log compliance. The skill lists permission, guard, route, and UI gating rules, then directs the agent to fix violations and run type checks.

中文简介正在准备中。当前显示英语简介。

原文查看原文说明

Audit & fix RBAC and audit log compliance in API endpoints and frontend components

trycompai/comp星标 2,061(GitHub 2,061 + cccskills 0)

实测评分 未实测

查看安装方法

适用场景

  • Auditing API routes for permission decorators
  • Checking UI actions against user permissions
  • Fixing access control inconsistencies

包含的文件（1）

  • SKILL.md2.6 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Audit the specified files or directories for RBAC and audit log compliance. Fix every issue found immediately.

Rules

API Endpoints (NestJS — apps/api/src/)

  1. Every mutation endpoint (POST, PATCH, PUT, DELETE) MUST have @RequirePermission('resource', 'action'). If missing, add it.
  2. Read endpoints (GET) should have @RequirePermission('resource', 'read'). If missing, add it.
  3. Self-endpoints (e.g., /me/preferences) may skip @RequirePermission — authentication via HybridAuthGuard is sufficient.
  4. Controller format: Must use @Controller({ path: 'name', version: '1' }), NOT @Controller('v1/name'). If wrong, fix it.
  5. Guards: Use @UseGuards(HybridAuthGuard, PermissionGuard) at controller or endpoint level. Never skip PermissionGuard.
  6. Webhooks: External webhook endpoints use @Public() — no auth required.

Frontend Components (apps/app/src/)

  1. Every mutation element (button, form submit, toggle, switch, file upload) MUST be gated with usePermissions from @/hooks/use-permissions. If not:
    • Create/Add buttons: Wrap with {hasPermission('resource', 'create') && <Button>...
    • Edit/Delete in dropdown menus: Wrap the menu item
    • Inline form fields on detail pages: Add disabled={!canUpdate}
    • Status/property selectors: Add disabled={!canUpdate}
  2. Actions columns in tables: hide entire column when user lacks write permission.
  3. No manual role string parsing (role.includes('admin')) — use hasPermission().
  4. Nav items: gate with canAccessRoute(permissions, 'routeSegment').
  5. Page-level: call requireRoutePermission('segment', orgId) server-side.

Permission Resources

organization, member, control, evidence, policy, risk, vendor, task, framework, audit, finding, questionnaire, integration, apiKey, trust, pentest, app, compliance

Multi-Product RBAC

  • Products (compliance, pen testing) are org-level feature flags — NOT RBAC
  • app:read gates compliance dashboard; pentest:read gates security product
  • Custom roles can grant access to any combination of resources
  • Portal-only resources (policy, compliance) do NOT grant app access

Process

  1. Read files specified in $ARGUMENTS (or scan the directory)
  2. Check each rule above
  3. Fix every violation immediately — don't just report
  4. Run typecheck to verify: bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护，适用 Google 的隐私权政策和服务条款。

同一仓库的技能

api-endpoint-contract

免费

Guide API endpoint changes so request DTOs, runtime validation, OpenAPI documentation, and MCP tool metadata stay aligned. It covers discoverability, authentication, uploads, long-running tasks, and response types that MCP tools cannot handle.

中文简介正在准备中。当前显示英语简介。

  • Adding an API endpoint with a request body
  • Updating DTO validation and OpenAPI metadata
  • Making an endpoint available as an MCP tool
trycompai/comp20612026年10月24日 更新

audit-design-system

免费

Review specified files for design system usage, replace legacy @trycompai/ui components and lucide-react icons with available @trycompai/design-system equivalents, and run the app type check to verify the migration.

中文简介正在准备中。当前显示英语简介。

  • Migrating legacy UI components
  • Replacing lucide-react icons with Carbon icons
  • Checking specified files for design system compliance
trycompai/comp20612026年10月24日 更新

audit-hooks

免费

Review specified files for outdated hook and API patterns, then replace them with the prescribed SWR hooks, API clients, or server API calls. The guidance covers data fetching, mutations, cache updates, and response handling, followed by a typecheck command.

中文简介正在准备中。当前显示英语简介。

  • Auditing files for disallowed API and hook patterns
  • Replacing raw fetch calls with the API client
  • Migrating server actions and database mutations to API hooks
trycompai/comp20612026年10月24日 更新

audit-tests

免费

Audit unit tests for components that use permissions. Add missing tests and fix failures, checking that administrators can use mutation controls, auditors cannot, and read-only content remains visible to both.

中文简介正在准备中。当前显示英语简介。

  • Adding permission tests for a component
  • Checking admin and auditor behavior
  • Fixing failing permission-related tests
trycompai/comp20612026年10月24日 更新

better-auth-best-practices

免费

Set up Better Auth for TypeScript applications, including server and client configuration, database adapters, sessions, email and social sign-in, and plugins. The guide also highlights environment variables, schema generation, and security settings to review.

中文简介正在准备中。当前显示英语简介。

  • Configuring Better Auth in a TypeScript app
  • Connecting an ORM or database adapter
  • Setting up sessions and cookie storage
trycompai/comp20612026年10月24日 更新

billing

免费

Use this skill when changing subscription billing with Stripe. It guides catalog and SKU updates, checkout, local entitlements and usage records, audit events, and webhook handling that tolerates retries and out-of-order delivery.

中文简介正在准备中。当前显示英语简介。

  • Adding or updating a billing SKU
  • Implementing subscription checkout
  • Handling billing webhooks safely
trycompai/comp20612026年10月24日 更新

查看 trycompai 的全部技能

报告此技能的问题