[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FG1WHNVGJC02ACZSZSDFXP":3,"skill-same:01M6FG1WHNVGJC02ACZSZSDFXP":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M6FG1WHNVGJC02ACZSZSDFXP","access-control-rbac",null,"Role-based access control (RBAC) with permissions and policies. Use for admin dashboards, enterprise access, multi-tenant apps, fine-grained authorization, or encountering permission hierarchies, role inheritance, policy conflicts.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Faccess-control-rbac\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"rbac","access control rbac","control","Access Control","access","authorization","dashboards","Enterprise","use","conflicts","permission","inheritance","admin","permissions","apps","multi","Role-Based","with","policy","2026-11-10 10:12:30",false,"---\nname: access-control-rbac\ndescription: Role-based access control (RBAC) with permissions and policies. Use for admin dashboards, enterprise access, multi-tenant apps, fine-grained authorization, or encountering permission hierarchies, role inheritance, policy conflicts.\nlicense: MIT\n---\n\n# Access Control & RBAC\n\nImplement secure access control systems with fine-grained permissions using RBAC, ABAC, or hybrid approaches.\n\n## Access Control Models\n\n| Model | Description | Best For |\n|-------|-------------|----------|\n| RBAC | Role-based - users assigned to roles with permissions | Most applications |\n| ABAC | Attribute-based - policies evaluate user\u002Fresource attributes | Complex rules |\n| MAC | Mandatory - system-enforced classification levels | Government\u002Fmilitary |\n| DAC | Discretionary - resource owners control access | File systems |\n| ReBAC | Relationship-based - access via entity relationships | Social apps |\n\n## Node.js RBAC Implementation\n\n```javascript\nclass Permission {\n  constructor(resource, action) {\n    this.resource = resource;\n    this.action = action;\n  }\n\n  matches(resource, action) {\n    return (this.resource === '*' || this.resource === resource) &&\n           (this.action === '*' || this.action === action);\n  }\n}\n\nclass Role {\n  constructor(name, permissions = [], parent = null) {\n    this.name = name;\n    this.permissions = permissions;\n    this.parent = parent;\n  }\n\n  hasPermission(resource, action) {\n    if (this.permissions.some(p => p.matches(resource, action))) return true;\n    return this.parent?.hasPermission(resource, action) ?? false;\n  }\n}\n\nclass RBACSystem {\n  constructor() {\n    this.roles = new Map();\n    this.userRoles = new Map();\n  }\n\n  createRole(name, permissions = [], parentRole = null) {\n    const parent = parentRole ? this.roles.get(parentRole) : null;\n    this.roles.set(name, new Role(name, permissions, parent));\n  }\n\n  assignRole(userId, roleName) {\n    const userRoles = this.userRoles.get(userId) || [];\n    userRoles.push(this.roles.get(roleName));\n    this.userRoles.set(userId, userRoles);\n  }\n\n  can(userId, resource, action) {\n    const roles = this.userRoles.get(userId) || [];\n    return roles.some(role => role.hasPermission(resource, action));\n  }\n}\n\n\u002F\u002F Express middleware\nconst requirePermission = (resource, action) => (req, res, next) => {\n  if (!rbac.can(req.user.id, resource, action)) {\n    return res.status(403).json({ error: 'Forbidden' });\n  }\n  next();\n};\n\n\u002F\u002F Setup default roles\nconst rbac = new RBACSystem();\nrbac.createRole('viewer', [new Permission('*', 'read')]);\nrbac.createRole('editor', [new Permission('*', 'write')], 'viewer');\nrbac.createRole('admin', [new Permission('*', '*')], 'editor');\n```\n\n## Python ABAC Pattern\n\n```python\nclass Policy:\n    def __init__(self, name, effect, resource, action, conditions):\n        self.name = name\n        self.effect = effect  # 'allow' or 'deny'\n        self.resource = resource\n        self.action = action\n        self.conditions = conditions\n\n    def matches(self, context):\n        if self.resource != \"*\" and self.resource != context.get(\"resource\"):\n            return False\n        if self.action != \"*\" and self.action != context.get(\"action\"):\n            return False\n        return True\n\n    def evaluate(self, context):\n        return all(cond(context) for cond in self.conditions)\n\n\nclass ABACEngine:\n    def __init__(self):\n        self.policies = []\n\n    def add_policy(self, policy):\n        self.policies.append(policy)\n\n    def check_access(self, context):\n        for policy in self.policies:\n            if policy.matches(context) and policy.evaluate(context):\n                return policy.effect == 'allow'\n        return False  # Deny by default\n\n\n# Condition functions\ndef is_resource_owner(ctx):\n    return ctx.get(\"user_id\") == ctx.get(\"resource_owner_id\")\n\ndef is_within_business_hours(ctx):\n    from datetime import datetime\n    return 9 \u003C= datetime.now().hour \u003C 18\n```\n\nSee [references\u002Fpython-abac.md](references\u002Fpython-abac.md) for complete implementation with Flask integration.\n\n## Java Spring Security\n\nSee [references\u002Fjava-spring-security.md](references\u002Fjava-spring-security.md) for enterprise implementation with:\n- Spring Security configuration\n- Method-level security with `@PreAuthorize`\n- Custom permission service\n- Custom security expressions\n\n## Best Practices\n\n**Do:**\n- Apply least privilege principle\n- Use role hierarchies to reduce duplication\n- Audit all access changes\n- Review permissions quarterly\n- Cache permission checks for performance\n- Separate authentication from authorization\n\n**Don't:**\n- Hardcode permission checks\n- Allow permission creep without review\n- Skip audit logging\n- Use overly broad wildcards\n\n## References\n\n- [NIST RBAC Model](https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Frole-based-access-control)\n- [OWASP Access Control Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FAccess_Control_Cheat_Sheet.html)\n- [AWS IAM Best Practices](https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Fbest-practices.html)\n","# Access Control & RBAC\n\nImplement secure access control systems with fine-grained permissions using RBAC, ABAC, or hybrid approaches.\n\n## Access Control Models\n\n| Model | Description | Best For |\n|-------|-------------|----------|\n| RBAC | Role-based - users assigned to roles with permissions | Most applications |\n| ABAC | Attribute-based - policies evaluate user\u002Fresource attributes | Complex rules |\n| MAC | Mandatory - system-enforced classification levels | Government\u002Fmilitary |\n| DAC | Discretionary - resource owners control access | File systems |\n| ReBAC | Relationship-based - access via entity relationships | Social apps |\n\n## Node.js RBAC Implementation\n\n```javascript\nclass Permission {\n  constructor(resource, action) {\n    this.resource = resource;\n    this.action = action;\n  }\n\n  matches(resource, action) {\n    return (this.resource === '*' || this.resource === resource) &&\n           (this.action === '*' || this.action === action);\n  }\n}\n\nclass Role {\n  constructor(name, permissions = [], parent = null) {\n    this.name = name;\n    this.permissions = permissions;\n    this.parent = parent;\n  }\n\n  hasPermission(resource, action) {\n    if (this.permissions.some(p => p.matches(resource, action))) return true;\n    return this.parent?.hasPermission(resource, action) ?? false;\n  }\n}\n\nclass RBACSystem {\n  constructor() {\n    this.roles = new Map();\n    this.userRoles = new Map();\n  }\n\n  createRole(name, permissions = [], parentRole = null) {\n    const parent = parentRole ? this.roles.get(parentRole) : null;\n    this.roles.set(name, new Role(name, permissions, parent));\n  }\n\n  assignRole(userId, roleName) {\n    const userRoles = this.userRoles.get(userId) || [];\n    userRoles.push(this.roles.get(roleName));\n    this.userRoles.set(userId, userRoles);\n  }\n\n  can(userId, resource, action) {\n    const roles = this.userRoles.get(userId) || [];\n    return roles.some(role => role.hasPermission(resource, action));\n  }\n}\n\n\u002F\u002F Express middleware\nconst requirePermission = (resource, action) => (req, res, next) => {\n  if (!rbac.can(req.user.id, resource, action)) {\n    return res.status(403).json({ error: 'Forbidden' });\n  }\n  next();\n};\n\n\u002F\u002F Setup default roles\nconst rbac = new RBACSystem();\nrbac.createRole('viewer', [new Permission('*', 'read')]);\nrbac.createRole('editor', [new Permission('*', 'write')], 'viewer');\nrbac.createRole('admin', [new Permission('*', '*')], 'editor');\n```\n\n## Python ABAC Pattern\n\n```python\nclass Policy:\n    def __init__(self, name, effect, resource, action, conditions):\n        self.name = name\n        self.effect = effect  # 'allow' or 'deny'\n        self.resource = resource\n        self.action = action\n        self.conditions = conditions\n\n    def matches(self, context):\n        if self.resource != \"*\" and self.resource != context.get(\"resource\"):\n            return False\n        if self.action != \"*\" and self.action != context.get(\"action\"):\n            return False\n        return True\n\n    def evaluate(self, context):\n        return all(cond(context) for cond in self.conditions)\n\n\nclass ABACEngine:\n    def __init__(self):\n        self.policies = []\n\n    def add_policy(self, policy):\n        self.policies.append(policy)\n\n    def check_access(self, context):\n        for policy in self.policies:\n            if policy.matches(context) and policy.evaluate(context):\n                return policy.effect == 'allow'\n        return False  # Deny by default\n\n\n# Condition functions\ndef is_resource_owner(ctx):\n    return ctx.get(\"user_id\") == ctx.get(\"resource_owner_id\")\n\ndef is_within_business_hours(ctx):\n    from datetime import datetime\n    return 9 \u003C= datetime.now().hour \u003C 18\n```\n\nSee [references\u002Fpython-abac.md](references\u002Fpython-abac.md) for complete implementation with Flask integration.\n\n## Java Spring Security\n\nSee [references\u002Fjava-spring-security.md](references\u002Fjava-spring-security.md) for enterprise implementation with:\n- Spring Security configuration\n- Method-level security with `@PreAuthorize`\n- Custom permission service\n- Custom security expressions\n\n## Best Practices\n\n**Do:**\n- Apply least privilege principle\n- Use role hierarchies to reduce duplication\n- Audit all access changes\n- Review permissions quarterly\n- Cache permission checks for performance\n- Separate authentication from authorization\n\n**Don't:**\n- Hardcode permission checks\n- Allow permission creep without review\n- Skip audit logging\n- Use overly broad wildcards\n\n## References\n\n- [NIST RBAC Model](https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Frole-based-access-control)\n- [OWASP Access Control Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FAccess_Control_Cheat_Sheet.html)\n- [AWS IAM Best Practices](https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Fbest-practices.html)\n",{"name":5,"license":15,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Fsecondsky\u002Fclaude-skills\u002Faccess-control-rbac",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill access-control-rbac",{"tool":58,"command":59},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill access-control-rbac",{"tool":61,"command":62},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill access-control-rbac","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Faccess-control-rbac\u002FSKILL.md",true,[66,72],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Fjava-spring-security.md","REFERENCE","参考文档",5447,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Faccess-control-rbac\u002Freferences\u002Fjava-spring-security.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fpython-abac.md",6499,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Faccess-control-rbac\u002Freferences\u002Fpython-abac.md",[77,91,101,109,115,122],{"skillNo":78,"name":79,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":38},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[88,89,90],"model","model hierarchy","model hierarchy skill",{"skillNo":92,"name":93,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":97,"publishedAt":38},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[96],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[98,99,100],"MCP","zoom","zoom mcp",{"skillNo":102,"name":103,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":38},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[107,108,33,99],"sdk","zoom apps sdk",{"skillNo":110,"name":111,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":38},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[111],{"skillNo":116,"name":117,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":121,"publishedAt":38},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[120],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[117],{"skillNo":123,"name":124,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":38},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[124]]