nocobase-acl-manage

Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.

Aller à l'installation

Dépôt: Agents-Store/claude-plugins
Dernière activité de la source: 11 mai 2026 à 16:59
Langue détectée de SKILL.md: anglais
Étoiles: 0
Forks: 0

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/Agents-Store/claude-plugins --skill nocobase-acl-manage

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

17 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

feedback

This skill should be used when the user reports a problem with macstack-dev or the MACSTACK standard — "this skill did the wrong thing", "the schema is missing a field", "the passport for X is wrong", "send macstack feedback", "improve the schema based on my edit", "fix the macstack plugin" — and the fix must land in the right source (plugin, schema repo, or registry repo).

2026-08-09

infisical-env

This skill should be used when the user asks to "set up Infisical for this project", "create .infisical.json", "pull the env keys", "wire the env", "sync secrets", or scaffold-project reaches the env step. Creates .infisical.json, pulls .env.prod/.env.dev, ensures every key from macstack.json resources.accesses exists, and installs the mandatory secrets scripts and commands.

2026-08-09

scaffold-project

This skill should be used when the user asks to "scaffold the project from macstack.json", "create the project working files", "generate project files from the spec", "build the project from macstack.json", or after a macstack.json is validated and the working tree must be built. Creates project files strictly in the prototype → stack plugins → dev plugins order.

2026-08-09

Tout voir dans ce dépôt

Non-Goals

Do not bypass CLI by calling direct REST endpoints.

Do not mutate ACL through ad-hoc database operations.

Do not create temporary script files to execute ACL writes.

Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.

Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).

Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task

User Outcome

Required Inputs

Optional Inputs

role.audit-all

list all roles with comparable policy summary

none

data_source_key, output

role.create-blank

create a role with default read-only baseline (single creation mode)

role_name

role_title, description, hidden, allow_configure, allow_new_menu

role.compare

explain differences between roles

role_names[]

data_source_key, output

B) Global Role-Mode Domain

Task

Non-Goals

Do not bypass CLI by calling direct REST endpoints.

Do not mutate ACL through ad-hoc database operations.

Do not create temporary script files to execute ACL writes.

Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.

Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).

Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task

User Outcome

Required Inputs

Optional Inputs

role.audit-all

list all roles with comparable policy summary

none

data_source_key, output

role.create-blank

create a role with default read-only baseline (single creation mode)

role_name

role_title, description, hidden, allow_configure, allow_new_menu

role.compare

explain differences between roles

role_names[]

data_source_key, output

B) Global Role-Mode Domain

Task

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.\|global.role-mode.\|permission.\|user.\|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.\|global.role-mode.\|permission.\|user.\|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

`global.role-mode.get`	read current global role mode	none	`output`
`global.role-mode.set`	switch global role mode	`role_mode`	`strict_mode`

Task	User Outcome	Required Inputs	Optional Inputs
`permission.system-snippets.set`	set role-level system snippets	`role_name`, (`snippet_preset` or `snippets`)	none
`permission.route.desktop.set`	set desktop route permissions for a role	`role_name`, `route_ids[]`	`set_mode` (`set` or `add` or `remove`)
`permission.data-source.global.set`	set global strategy actions for all tables in one data source	`role_name`, `global_actions[]`	`data_source_key`
`permission.data-source.resource.set`	set independent actions for one or more collections	`role_name`, (`collection_hint` or `collection_hints[]`), `actions[]`	`data_source_key`, `fields_map`, `scope_map`, `resource_scope` (`all` by default)
`permission.scope.manage`	create/update/list reusable scopes	`scope_task`	`data_source_key`, `scope_id`, `scope_payload`

Task	User Outcome	Required Inputs	Optional Inputs
`user.assign-role`	assign one role to one or many users	`role_name`, (`user_ids[]` or `user_filter`)	`allow_generic_association_write`
`user.unassign-role`	remove one role from one or many users	`role_name`, (`user_ids[]` or `user_filter`)	`allow_generic_association_write`
`user.audit-role-membership`	inspect users bound to roles	(`role_name` or `user_id`)	`output`

nocobase-acl-manage

Options d'installation

Vérifiez les fichiers source

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

C) Permission Domain

D) User Domain

E) Risk Domain

Input Contract

Mandatory Clarification Gate

Workflow

Tooling Policy

Safety Gate

Capability Boundary Messaging

Verification Checklist

Minimal Test Scenarios

Reference Loading Map

References

Task	User Outcome	Required Inputs	Optional Inputs
`risk.assess-role`	risk score and rationale for one role	`role_name`	`data_source_key`, `output`
`risk.assess-user`	risk score based on user-role-permission relationship	`user_id`	`data_source_key`, `output`
`risk.assess-system`	system-level ACL governance risk summary	none	`data_source_key`, `output`

Input	Required	Default	Validation	Clarification Question
`task`	yes	none	one of canonical tasks or alias	"Which ACL governance task should run?"
`role_name`	conditional	none	role exists for update/audit tasks; write tasks normalize to `r_*` uid	"Which role should be targeted?"
`role_mode`	conditional	none	one of `default/allow-use-union/only-use-union`	"Which global role mode should be set?"
`collection_hint` / `collection_hints[]`	conditional	none	required for `permission.data-source.resource.set`; business name/keyword input is allowed	"Which business table(s) should be configured?"
`resolved_collection_names[]`	conditional	runtime resolved	required before write for `permission.data-source.resource.set`; each collection must exist in selected data source	"I found these matching collections. Which should be used?"
`actions[]`	conditional	none	required for `permission.data-source.resource.set`	"Which actions should be granted on these collections?"
`resource_scope`	no	`all`	one of `all` / `own` / `custom(scope_id or scope_filter)`	"Which data scope should be used? Default is all; choose own/custom only when needed."
`data_source_key`	no	`main`	must exist at runtime	"Which data source key should be used? (default: main)"
`strict_mode`	no	`safe`	`safe` or `fast`	"Use safe mode with full readback?"
`allow_generic_association_write`	no	`false`	boolean	"Allow guarded generic association writes for user-role assignment?"
`output`	no	`text+matrix`	`text`, `text+matrix`, `text+evidence`	"How detailed should the result be?"

Reference	Use When	Notes
references/intent-presets-v1.md	intent normalization and defaults	includes global role-mode wording
references/intent-to-tool-map-v1.md	runtime command resolution	maps logical tasks to CLI command patterns
references/execution-guard-template.md	every ACL write task	fixed preflight command template for base-dir lock and fail-closed checks
references/result-format-v1.md	output rendering	includes risk cards and capability path
references/configuration.md	ACL policy details	detailed data-source and scope guidance
references/independent-permissions.md	resource-level permission writes	`usingActionsConfig + actions + fields + scope` complete-write policy
tests/capability-test-plan.md	capability matrix	aligned with v2 domains
tests/test-playbook.md	acceptance regression	prompt-first TC01, TC02, TC04-TC20 with runtime evidence commands
references/refactor-plan-v2.md	capability gaps and rollout plan	includes CLI migration notes
tests/README.md	runtime verification	playbook execution flow and reporting notes

nocobase-acl-manage

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

C) Permission Domain

D) User Domain

E) Risk Domain

Input Contract

Mandatory Clarification Gate

Workflow

Tooling Policy

Safety Gate

Capability Boundary Messaging

Verification Checklist

Minimal Test Scenarios

Reference Loading Map

References