CloudBase platform overview and routing guide. This skill should be used when users need high-level capability selection, platform concepts, console navigation, or cross-platform best practices before choosing a more specific implementation skill.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
CloudBase platform overview and routing guide. This skill should be used when users need high-level capability selection, platform concepts, console navigation, or cross-platform best practices before choosing a more specific implementation skill.
version
2.24.1
alwaysApply
false
Standalone Install Note
If this environment only installed the current skill, start from the CloudBase main entry and use the published cloudbase/references/... paths for sibling skills.
CloudBase main entry: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/SKILL.md
Current skill raw source: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/cloudbase-platform/SKILL.md
Keep local references/... paths for files that ship with the current skill directory. When this file points to a sibling skill such as auth-tool or web-development, use the standalone fallback URL shown next to that reference.
Cross-cutting protocols (always load these when doing code changes or deployments in standalone mode):
The user asks which CloudBase capability, service, or tool to use, or needs a high-level understanding of hosting, storage, authentication, cloud functions, or database options.
The task is about console navigation, cross-platform differences, permission models, or platform-level best practices before implementation.
Read before writing code if
It is still unclear whether the task belongs to Web, mini program, cloud functions, storage, MySQL / NoSQL, or auth.
The response needs platform selection, conceptual explanation, or control-plane navigation more than direct implementation steps.
Then also read
Web app implementation -> ../web-development/SKILL.md (standalone fallback: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/web-development/SKILL.md)
Web auth and provider setup -> ../auth-tool/SKILL.md (standalone fallback: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/auth-tool/SKILL.md), ../auth-web/SKILL.md (standalone fallback: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/auth-web/SKILL.md)
Mini program development -> ../miniprogram-development/SKILL.md (standalone fallback: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/miniprogram-development/SKILL.md)
WeChat Pay, Official Account OAuth, JSAPI Pay, or Native QR-code Pay through CloudBase Integration Center -> ../cloudbase-wechat-integration/SKILL.md (standalone fallback: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/cloudbase-wechat-integration/SKILL.md; official docs: https://docs.cloudbase.net/integration/introduce/index.md)
Official HTTP API clients -> ../http-api/SKILL.md (standalone fallback: https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/cloudbase/references/http-api/SKILL.md)
Direct implementation of web pages, auth flows, functions, or database operations when a more specific skill already fits.
Low-level API parameter references or SDK recipes that belong in specialized skills.
Common mistakes / gotchas
Treating this general skill as the default entry point for all CloudBase development.
Staying here after the correct implementation skill is already clear.
Mixing platform overview with platform-specific API shapes or SDK details.
Using this overview skill as a detour in an existing application where the active auth, storage, and data files are already obvious.
Making code or configuration changes without first following the Change Safety Protocol (cloudbase-platform/references/protocols/change-safety-protocol.md).
Starting any deployment, publish, custom domain, or CloudRun work without first completing the checks in cloudbase-platform/references/protocols/deployment-gate.md.
Confusing security domains with custom domains: These are two completely different tools for different purposes:
envDomainManagement (action: create/delete) = Security domains (安全域名) for CORS/request source validation - used for browser upload whitelisting. Does NOT accept certificateId.
manageGateway(action="bindCustomDomain") = Custom domains (自定义域名) for public HTTPS access with SSL certificates - requires domain and certificateId parameters.
When to use this skill
Use this skill for CloudBase platform knowledge when you need to:
Understand CloudBase storage and hosting concepts
Compare platform capabilities before implementation
Understand cross-platform auth differences (Web vs Mini Program)
Understand database permissions and access control
Access CloudBase console management pages
This skill provides foundational knowledge that applies to all CloudBase projects, regardless of whether they are Web, Mini Program, or backend services.
How to use this skill (for a coding agent)
Understand platform differences
Web and Mini Program have completely different authentication approaches
Must strictly distinguish between platforms
Never mix authentication methods across platforms
If the workspace is already an application with TODOs or prebuilt handlers, do not stay in platform overview mode. Move quickly to the concrete implementation skill and the existing files that own the flow.
Use cloud functions for cross-collection operations
Use correct SDKs and APIs
Different platforms require different SDKs for data models
MySQL data models must use models SDK, not collection API
PostgreSQL / CloudBase PG work must route to postgresql-development; do not reuse NoSQL app.database() / db.collection(...) snippets or MySQL queryMysqlDatabase / manageMysqlDatabase for PG data paths
Use envQuery tool to get environment ID
In an existing Web application with fixed structure, inspect the existing src/lib/backend.*, src/lib/auth.*, src/lib/*service.*, and bound page handlers before broad concept reading.
Use the canonical CloudBase MCP setup from the main cloudbase guideline
This platform overview intentionally does not duplicate the full MCP / mcporter config block
For the canonical config snippet, CLI commands, and auth examples, read the main cloudbase guideline first
Keep the same core rules here: use MCP first, inspect tool schemas before execution, and do not hard-code Secret ID / Secret Key / Env ID in config
Keep the auth split explicit: management-side login uses auth, while application-side auth configuration uses queryAppAuth / manageAppAuth
CloudBase Platform Knowledge
Domain Management Tools: Clear Distinction
When working with domain-related tasks, use the correct tool based on the requirement:
Requirement
Tool
Parameters
Purpose
Security Domain (安全域名)
envDomainManagement
action, domains (array of host:port strings)
CORS/request source validation for browser uploads. No certificate involved.
Custom Domain (自定义域名)
manageGateway(action="bindCustomDomain")
domain (string), certificateId (string)
Public HTTPS access with SSL certificate. Requires certId from SSL console.
Delete Custom Domain
manageGateway(action="deleteCustomDomain")
domain (string)
Remove custom domain binding.
Key indicators for choosing the right tool:
Task mentions "certificate ID" or "SSL" → Use manageGateway(action="bindCustomDomain")
Task mentions "浏览器上传" or "CORS" or "安全域名" → Use envDomainManagement
Task mentions "public access" or "HTTPS" with domain → Use manageGateway
Recording Operation Results
When a task explicitly requires recording operation steps or results to a file (e.g., RESULT.json):
Perform the tool calls first to get actual results
Collect all operation steps with their success/failure status
Write the complete record to the specified file in the required format
Include both successful operations and failed attempts with error messages
Example structure for operation recording:
{"steps":[{"action":"listDomains","success":true,"message":"Found 3 domains"},{"action":"bindDomain","success":false,"message":"Certificate not found"}],"summary":{"totalAttempted":2,"succeeded":1,"failed":1}}
Storage and Hosting
Static Hosting vs Cloud Storage:
CloudBase static hosting and cloud storage are two different buckets
Generally, publicly accessible files can be stored in static hosting, which provides a public web address
Cloud storage is suitable for files with privacy requirements, can get temporary access addresses via temporary file URLs
If the task needs COS SDK polling, file metadata lookup, or temporary URLs for an uploaded object, use cloud storage tools (manageStorage / queryStorage), not manageHosting(action="upload")
Static Hosting Domain:
CloudBase static hosting domain and website document config can be obtained via queryHosting(action="websiteConfig")
Combine with static hosting file paths to construct final access addresses
Important: If access address is a directory, it must end with /
Cloud Storage Public URL:
CRITICAL: manageStorage(action=upload) and queryStorage(action=url) return temporaryUrl which is a temporary signed URL that expires (default 1 hour). Do NOT use this as a permanent public URL.
To get the permanent public access URL for a cloud storage object:
Call envQuery(action=info) to get environment details
Extract the storage CDN domain from EnvInfo.Storages[0].CdnDomain (e.g., your-env-id.tcb.qcloud.la)
Construct the public URL: https://{CdnDomain}/{cloudPath}
Example: If CdnDomain is env-xxx.tcb.qcloud.la and cloudPath is uploads/avatar.jpg, the public URL is https://env-xxx.tcb.qcloud.la/uploads/avatar.jpg
Note: The public URL is accessible only if the storage bucket ACL allows public read (default is PRIVATE which requires signed URLs)
Environment and Authentication
SDK Initialization:
CloudBase SDK initialization requires environment ID
Can query environment ID via envQuery tool
If the user only provides an environment alias, nickname, or other short form, resolve it with envQuery(action="list", alias=..., aliasExact=true) first and use the returned full EnvId
Do not pass alias-like short forms directly into SDK init, auth.set_env, console URLs, or generated config files
Important: Authentication methods for different platforms are completely different, must strictly distinguish!
Web Authentication
Must use SDK built-in authentication: CloudBase Web SDK provides complete authentication features
Recommended method: SMS login with auth.getVerification(), for detailed, refer to web auth related docs
Forbidden behavior: Do not use cloud functions to implement login authentication logic
Session management: For route guards and login proof, use auth.getSession() and require data.session; do not use deprecated getLoginState() or auth.getUser() / auth.getCurrentUser() as proof of real login.
Provider and login-method setup: Use queryAppAuth / manageAppAuth, not the MCP auth tool
Anonymous login is disabled by default. The SDK initialized with accessKey automatically creates an anonymous session. If the app uses AuthGuard or RLS for access control, ensure is_anonymous checks are in place when anonymous access is allowed.
⚠️ PG RLS: Use auth.uid(), NOT current_user. When writing RLS policies for CloudBase PostgreSQL, the user identity must use auth.uid() (returns the JWT sub / actual user ID). Do NOT use current_user or current_setting(...) — these PostgreSQL built-in functions return the database role name (e.g. authenticated), not the CloudBase auth user ID. CloudBase PG provides four auth helper functions: auth.uid(), auth.role(), auth.email(), auth.jwt(). Verify availability with SELECT proname FROM pg_proc WHERE pronamespace = 'auth'::regnamespace.
Mini Program Authentication
Login-free feature: Mini program CloudBase is naturally login-free, no login flow needed
User identifier: In cloud functions, get wxContext.OPENID via wx-server-sdk
User management: Manage user data in cloud functions based on openid
Forbidden behavior: Do not generate login pages or login flow code
Cloud Functions
Node.js Cloud Functions:
Node.js cloud functions need to include package.json, declaring required dependencies
Can use manageFunctions(action="createFunction") to create functions
Use manageFunctions(action="updateFunctionCode") to deploy cloud functions
Prioritize cloud dependency installation, do not upload node_modules
functionRootPath refers to the parent directory of function directories, e.g., cloudfunctions directory
Database Permissions
⚠️ CRITICAL: Always configure permissions BEFORE writing database operation code!
Permission Model:
CloudBase database access has permissions
Default basic permissions include:
READONLY: Everyone can read, only creator/admin can write
PRIVATE: Only creator/admin can read/write
ADMINWRITE: Everyone can read, only admin can write (⚠️ NOT for Web SDK write!)
ADMINONLY: Only admin can read/write
CUSTOM: Fine-grained control with custom rules
Platform Compatibility (CRITICAL):
⚠️ Web SDK cannot use ADMINWRITE or ADMINONLY for write operations
✅ For user-generated content in Web apps, use CUSTOM rules
✅ For admin-managed data (products, settings), use READONLY
✅ Cloud functions have full access regardless of permission type
Use managePermissions(action="updateResourcePermission") to configure resource permissions
If permissions were just changed, allow a short propagation window (typically 2-5 minutes) before retesting, but do not assume every failure is cache. Re-check the actual rule shape and active client write pattern first.
See no-sql-web-sdk/security-rules.md for detailed resourceType="noSqlDatabase" examples only; do not treat doc._openid, auth.openid, query-subset validation, or create / update / delete JSON templates as generic rules for functions, storage, or SQL tables
Official references:
General security rules overview: https://cloud.tencent.com/document/product/876/41802
E-commerce products: READONLY (admin manages via cloud functions)
Shopping carts: CUSTOM with auth.uid check (users manage their own)
Orders: CUSTOM with ownership validation
System logs: PRIVATE or ADMINONLY
Cross-Collection Operations:
If user has no special requirements, operations involving cross-database collections must be implemented via cloud functions
Role Management (MCP)
CloudBase MCP provides role management capabilities through the queryPermissions and managePermissions tools. These are equivalent to the CLI tcb role commands.
⚠️ CRITICAL: Role policies and resource permissions are two independent systems with NO automatic synchronization.
Resource permissions (security rules) control access to specific resources (tables, collections, functions, storage)
Roles (identity dimension) control policy bundles and member assignments
Available Actions
Query Operations (via queryPermissions):
Action
Description
listRoles
List all roles (system and custom)
getRole
Get detailed role information by roleId/roleIdentity/roleName
Management Operations (via managePermissions):
Action
Description
createRole
Create a new custom role
updateRole
Update an existing role (add/remove policies or members)
deleteRoles
Delete one or more custom roles
addRoleMembers
Add members to a role
removeRoleMembers
Remove members from a role
addRolePolicies
Add policies to a role
removeRolePolicies
Remove policies from a role
Usage Examples
List all roles:
queryPermissions(action="listRoles")
Get specific role details:
queryPermissions(action="getRole", roleId="role-xxx")
# or by identity
queryPermissions(action="getRole", roleIdentity="dev_role")
# or by name
queryPermissions(action="getRole", roleName="Developer")
Use manageDataModel tool's docs method to get specific SDK usage
Console Management
After creating/deploying resources, provide corresponding console management page links. All console URLs follow the pattern: https://tcb.cloud.tencent.com/dev?envId=${envId}#/{path}.
The CloudBase console is updated frequently. If a live, logged-in console shows a different hash path from this document, prefer the live console path over stale documentation and then update this skill to match.
Base URL Pattern: https://tcb.cloud.tencent.com/dev?envId=${envId}#/{path}
Replace Variables: Always replace ${envId} with the actual environment ID queried via envQuery tool
Alias Handling: If the conversation only contains an alias or shorthand, first resolve it with envQuery(action="list", alias=..., aliasExact=true) and use the returned EnvId; if the alias is ambiguous or missing, ask the user to confirm before generating links
Resource-Specific URLs: For specific resources (collections, functions, models), replace resource name variables with actual values
Usage: After creating/deploying resources, provide these console links to users for management operations
Quick Reference
When directing users to console pages:
Use the full URL with environment ID
Explain what they can do on each page
Provide context about why they need to access that specific page
For configuration pages (like login management), guide users through the setup process
