| name | erpclaw-selfservice |
| version | 1.0.0 |
| description | Generic self-service permission layer for ERPClaw. 25 actions across permission profiles, portal configuration, session management, and activity logging. Enables scoped access for employees, clients, tenants, patients, and vendors across all verticals. |
| author | AvanSaber |
| homepage | https://github.com/avansaber/erpclaw-addons |
| source | https://github.com/avansaber/erpclaw-addons |
| tier | 2 |
| category | infrastructure |
| requires | ["erpclaw"] |
| database | ~/.openclaw/erpclaw/data.sqlite |
| user-invocable | true |
| tags | ["erpclaw","self-service","permissions","portal","session","access-control","rbac","employee-portal","client-portal","tenant-portal"] |
| scripts | ["scripts/db_query.py"] |
| metadata | {"openclaw":{"type":"executable","install":{"post":"python3 scripts/db_query.py --action status"},"requires":{"bins":"[Truncated]","env":"[Truncated]","optionalEnv":"[Truncated]"},"os":["darwin","linux"]}} |
erpclaw-selfservice
You are a Self-Service Portal Manager for ERPClaw. You manage permission profiles that control what actions
external users (employees, clients, tenants, patients, vendors) can perform through self-service portals.
You configure portal branding and settings, manage scoped sessions with expiration, enforce permission
checks on every action, and maintain a complete activity audit trail.
Security Model
- Local-only: All data stored in
~/.openclaw/erpclaw/data.sqlite
- Zero network calls: No external API calls, no telemetry, no cloud dependencies
- No credentials required: Uses erpclaw_lib shared library (installed by erpclaw)
- SQL injection safe: All queries use parameterized statements
Skill Activation Triggers
Activate this skill when the user mentions: self-service, portal, permission profile, access control,
employee portal, client portal, tenant portal, patient portal, vendor portal, session management,
permission check, activity log, portal config, field visibility, record scope.
Setup (First Use Only)
python3 {baseDir}/../erpclaw/scripts/erpclaw-setup/db_query.py --action initialize-database
python3 {baseDir}/init_db.py
python3 {baseDir}/scripts/db_query.py --action status
Quick Start (Tier 1)
1. Create a permission profile:
--action selfservice-add-profile --company-id {id} --name "Employee Self-Service" --target-role employee --allowed-actions '["list-leave","add-leave","get-payslip"]' --record-scope own
2. Assign permission and create a portal:
--action selfservice-add-permission --company-id {id} --profile-id {id} --user-id {uid} --user-email "jane@co.com"
--action selfservice-add-portal-config --company-id {id} --name "Employee Portal" --welcome-message "Welcome!"
3. Session and permission check:
--action selfservice-create-session --company-id {id} --user-id {uid} --profile-id {id} --token "abc123" --expires-at "2026-12-31T23:59:59Z"
--action selfservice-validate-permission --user-id {uid} --action-name "list-leave"
--action selfservice-get-session --token "abc123"
All Actions (Tier 2)
For all actions: python3 {baseDir}/scripts/db_query.py --action <action> [flags]
Profiles (4 actions)
| Action | Required Flags | Optional Flags |
|---|
