القائمة
Least privilege principle, RBAC, authentication, authorization, and session management following Hack23 Access Control Policy
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/Hack23/homepage --skill access-controlيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
GitHub Agentic Workflows (gh-aw) - markdown-based AI automation with 5-layer security, safe outputs, and Continuous AI patterns
gh-aw CLI usage, compilation, testing, debugging, add-wizard, and CI/CD practices for GitHub Agentic Workflows
Multi-agent coordination, orchestrator-worker patterns, /plan decomposition, and project coordination for GitHub Agentic Workflows
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | access-control |
| description | Least privilege principle, RBAC, authentication, authorization, and session management following Hack23 Access Control Policy |
| license | Apache-2.0 |
This skill enforces access control requirements as defined in the Hack23 ISMS Access Control Policy. It ensures that all systems implement proper authentication, authorization, and session management based on the principle of least privilege.
MUST:
MUST NOT:
MUST:
Roles for Hack23 Projects:
MUST NOT:
MUST:
MUST NOT:
MUST:
MUST NOT:
MUST:
MUST NOT:
MUST:
MUST NOT:
MUST:
MUST NOT:
// Define roles and permissions
const ROLES = {
PUBLIC: 'public',
USER: 'user',
CONTRIBUTOR: 'contributor',
MAINTAINER: 'maintainer',
ADMIN: 'administrator'
};
const PERMISSIONS = {
READ_PUBLIC: 'read:public',
READ_PRIVATE: 'read:private',
WRITE_CODE: 'write:code',
MERGE_PR: 'merge:pr',
MANAGE_USERS: 'manage:users',
MANAGE_SECURITY: 'manage:security'
};
// Role to permissions mapping
const rolePermissions = {
[ROLES.PUBLIC]: [PERMISSIONS.READ_PUBLIC],
[ROLES.USER]: [PERMISSIONS.READ_PUBLIC, PERMISSIONS.READ_PRIVATE],
[ROLES.CONTRIBUTOR]: [PERMISSIONS.READ_PUBLIC, PERMISSIONS.READ_PRIVATE, PERMISSIONS.WRITE_CODE],
[ROLES.MAINTAINER]: [PERMISSIONS., ., ., .],
[.]: .()
};
() {
{
(!req.) {
res.().({ : });
}
userPermissions = rolePermissions[req..] || [];
(!userPermissions.(permission)) {
res.().({ : });
}
();
};
}
app.(, (.), {
});
app.(, (.), {
});
app.(, (.), {
});
const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const redis = require('redis');
const redisClient = redis.createClient({
host: process.env.REDIS_HOST,
port: process.env.REDIS_PORT,
password: process.env.REDIS_PASSWORD
});
// GOOD: Secure session configuration
app.use(session({
store: new RedisStore({
client: redisClient,
prefix: 'sess:'
}),
secret: process.env.SESSION_SECRET, // Strong random secret from env
name: 'sid', // Don't use default name
resave: false,
saveUninitialized: false,
rolling: true, // Reset expiry on activity
cookie: {
secure: true, // HTTPS only
httpOnly: true, // No JavaScript access
: ,
: ,
:
}
}));
app.( {
(req.) {
now = .();
lastActivity = req.. || now;
inactivityTimeout = * * ;
(now - lastActivity > inactivityTimeout) {
req..();
res.().({ : });
}
req.. = now;
}
();
});
app.(, (req, res) => {
{ username, password } = req.;
user = (username, password);
(!user) {
res.().({ : });
}
req..( {
(err) {
res.().({ : });
}
req.. = user.;
req.. = user.;
req.. = .();
res.({ : , : { : user., : user. } });
});
});
app.(, {
req..( {
(err) {
res.().({ : });
}
res.();
res.({ : });
});
});
const speakeasy = require('speakeasy');
const QRCode = require('qrcode');
// Enable MFA for user
app.post('/api/user/mfa/enable', requireAuth, async (req, res) => {
const user = req.user;
// Generate secret
const secret = speakeasy.generateSecret({
name: `Hack23 (${user.email})`,
issuer: 'Hack23'
});
// Generate QR code
const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
// Store secret (encrypted) in database
await db.users.update(user.id, {
mfa_secret: encrypt(secret.base32),
mfa_enabled: false // Not enabled until verified
});
res.json({
secret: secret.base32,
qrCode: qrCodeUrl
});
});
// Verify and activate MFA
app.post('/api/user/mfa/verify', requireAuth, async (req, res) => {
const { token } = req.body;
user = req.;
userData = db..(user.);
secret = (userData.);
verified = speakeasy..({
: secret,
: ,
: token,
:
});
(!verified) {
res.().({ : });
}
db..(user., {
:
});
res.({ : });
});
app.(, (req, res) => {
{ username, password, mfa_token } = req.;
user = (username, password);
(!user) {
res.().({ : });
}
(user.) {
(!mfa_token) {
res.().({
: ,
:
});
}
secret = (user.);
verified = speakeasy..({
: secret,
: ,
: mfa_token,
:
});
(!verified) {
res.().({ : });
}
}
req..( {
(err) {
res.().({ : });
}
req.. = user.;
req.. = user.;
res.({ : , : { : user., : user. } });
});
});
const crypto = require('crypto');
// Generate API key
function generateApiKey() {
// Generate 32 bytes (256 bits) of random data
const key = crypto.randomBytes(32).toString('base64');
return key;
}
// Hash API key for storage
function hashApiKey(apiKey) {
return crypto.createHash('sha256').update(apiKey).digest('hex');
}
// Create API key with scopes
app.post('/api/keys', requireAuth, async (req, res) => {
const { name, scopes, expiresInDays } = req.body;
// Generate key
const apiKey = generateApiKey();
const hashedKey = hashApiKey(apiKey);
// Calculate expiry
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + (expiresInDays || 365));
// Store hashed key
await db.apiKeys.create({
user_id: req.user.,
: name,
: hashedKey,
: scopes,
: expiresAt,
: ()
});
res.({
: apiKey,
: name,
: scopes,
: expiresAt,
:
});
});
() {
authHeader = req..;
(!authHeader || !authHeader.()) {
res.().({ : });
}
apiKey = authHeader.();
hashedKey = (apiKey);
keyRecord = db..(hashedKey);
(!keyRecord) {
res.().({ : });
}
( () > keyRecord.) {
res.().({ : });
}
(!keyRecord.) {
res.().({ : });
}
db..(keyRecord.);
req. = keyRecord;
req. = db..(keyRecord.);
();
}
app.(, validateApiKey, (), {
});