admin-authorization

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

admin-authorization

The most common critical bug in vibe-coded apps:

/admin

is "protected" because the link is hidden, and the API behind it answers anyone. This skill checks the server, where authorization actually lives.

vibe-coded 应用中最常见的严重 bug：

/admin

似乎“受到保护”，只是因为链接被隐藏，而其背后的 API 会响应任何人的请求。这个 skill 会检查服务端，因为授权逻辑真正存在于那里。

Activate when

何时启用

Any admin/staff/operator route or API exists (
```
/admin
```
,
```
/dashboard/users
```
,
```
/api/admin/*
```
, role fields, "isAdmin" checks), or roles/permissions exist.
```
production-all
```
/
```
web-security
```
routes here.
Not to design admin features (that is
```
admin-dashboard
```
, which calls this skill for access control). If the only "admin" is the database console, say so.

存在任何 admin/staff/operator 路由或 API（
```
/admin
```
、
```
/dashboard/users
```
、
```
/api/admin/*
```
、role 字段、
```
isAdmin
```
检查），或者存在角色/权限。
```
production-all
```
/
```
web-security
```
会路由到这里。
不要用于设计 admin 功能（应使用
```
admin-dashboard
```
，它会调用此 skill 进行访问控制）。如果唯一的“admin”只是数据库控制台，请明确说明。

Inspect

检查

Enumerate privileged surfaces from routes, API handlers, server actions, database policies, and UI conditionals: user management, content moderation, refunds, exports, impersonation, feature flags, settings, data deletion, "run job" endpoints, internal tools.
For each, find the check: authentication (who are you?) and authorization (may you do this on this object?) executed on the server at the handler, middleware, or database policy. Client-side route guards, hidden links,
```
if (user.isAdmin)
```
in React, and obscure URLs are not authorization.
Roles and grants: where roles come from (database column, JWT claim, provider metadata); can a user modify their own role via any endpoint (mass assignment:
```
PATCH /api/me
```
accepting
```
role
```
)? First-user-becomes-admin logic; default/seed admins with default passwords; invite/reset flows for staff.
Object-level access: an admin's or user's request for another resource ID (
```
/api/orders/123
```
); listing endpoints returning all users' data to non-admins; database row-level security present for tables holding admin-only or per-user data.
Test on local/staging (never against production or other people's accounts): request each privileged route/API (a) with no session, (b) with a normal test user, (c) with an admin test user. Expect (a) and (b) denied (401/403, not a 200 with empty data and not a redirect that still leaks data), (c) allowed. Also try direct API calls that bypass the UI, and ID substitution.
Discoverability: admin routes not in the sitemap or
```
robots.txt
```
as a hint (
```
seo-readiness
```
); consistent
```
noindex
```
; login page protections: rate limiting, no user enumeration, MFA where the product warrants.
Sensitive destructive actions: confirmation, and an audit trail (
```
admin-audit-log
```
).

枚举特权入口：从路由、API handlers、server actions、database policies 和 UI 条件判断中枚举用户管理、内容审核、退款、导出、用户身份模拟、feature flags、设置、数据删除、
```
run job
```
端点和内部工具。
逐项查找检查：身份验证（authentication，你是谁？）和授权（authorization，你能否对这个对象执行此操作？）必须在服务端执行，可以位于 handler、middleware 或 database policy 中。客户端路由守卫、隐藏链接、React 中的
```
if (user.isAdmin)
```
以及不直观的 URL 都不构成授权。
角色与权限授予：角色来自哪里（数据库列、JWT claim、provider metadata）；用户能否通过任意端点修改自己的角色（mass assignment：接受
```
role
```
的
```
PATCH /api/me
```
）？检查 first-user-becomes-admin 逻辑、通过默认配置或 seed 创建且使用默认密码的 admin，以及面向 staff 的邀请/密码重置流程。
对象级访问（object-level access）：admin 或用户针对另一个资源 ID 发起请求（
```
/api/orders/123
```
）；列出数据的端点是否向非 admin 返回所有用户的数据；存储 admin-only 或按用户划分数据的表是否配置了 database row-level security。
在 local/staging 上测试（绝不针对 production 或他人的账户）：分别以无会话（session）、普通测试用户和 admin 测试用户身份请求每个特权路由/API：(a) 无会话，(b) 普通测试用户，(c) admin 测试用户。预期 (a) 和 (b) 被拒绝（返回 401/403，而不是以 200 返回空数据，也不是重定向后仍泄露数据），(c) 被允许。还要尝试绕过 UI 的直接 API 调用，以及替换 ID。
可发现性：admin 路由未出现在 sitemap 或
```
robots.txt
```
中只能作为提示（
```
seo-readiness
```
）；一致地设置
```
noindex
```
；登录页面保护：rate limiting、防止 user enumeration，以及在产品适用时启用 MFA。
敏感破坏性操作：确认机制和审计跟踪（
```
admin-audit-log
```
）。

Evidence that counts

有效证据

Label each claim OBSERVED, SOURCE-INDICATED, DECLARED, INFERRED, UNKNOWN, or REVIEW REQUIRED. UNKNOWN is never a pass and never a failure.

Denied/allowed behavior seen in requests as specific test users: OBSERVED. A check present in source: SOURCE-INDICATED (it may not run on every path).
A protected route with an unprotected sibling API is still a hole; report both.
Third-party admin tools (provider dashboards) are outside the codebase: UNKNOWN.

将每项结论标记为 OBSERVED、SOURCE-INDICATED、DECLARED、INFERRED、UNKNOWN 或 REVIEW REQUIRED。UNKNOWN 绝不能算通过，也不能算失败。

以特定测试用户发起请求时观察到的拒绝/允许行为：OBSERVED。源码中存在检查：SOURCE-INDICATED（它可能不会在每条路径上执行）。
受保护的路由如果存在未受保护的 sibling API，仍然是一个漏洞；两者都要报告。
第三方 admin 工具（provider 控制台）位于代码库之外：UNKNOWN。

May change

可以进行的更改

Add server-side authentication and authorization checks to privileged handlers following the project's pattern (middleware, guards, RLS policies); remove role fields from writable user endpoints; remove default credentials from seeds; return proper 401/403; add a "no admin surface" note when true. Do not build a new admin interface, invent a role model, or change production users.

遵循项目现有模式，为特权 handlers 添加 server-side authentication 和 authorization 检查（middleware、guards、RLS policies）；从可写用户端点中移除 role 字段；从 seed 中移除默认凭据；返回正确的 401/403；当确实不存在 admin surface 时，添加“no admin surface”说明。不要构建新的 admin 界面，不要发明 role model，也不要修改 production 用户。

Must not claim

不得声称

"Secure admin area", "role-based access implemented", or "authorized" from UI conditionals. Report which endpoints you tested as which principals.

不得仅凭 UI 条件判断就声称“admin 区域安全”“已实现基于角色的访问”或“已授权”。报告你以哪些主体测试了哪些端点。

Verify

验证

Repeat the anonymous / normal-user / admin request matrix on every changed handler and the sibling API routes; confirm the UI still works for admins; confirm no data returns to non-admins in error bodies.

对每个已更改的 handler 及其 sibling API routes 重复执行匿名用户/普通用户/admin 请求矩阵；确认 UI 对 admin 仍然可用；确认向非 admin 返回的 error bodies 中没有数据。

Escalate

升级处理

Any privileged route reachable by unauthorized principals: HIGH, fix or block before launch and tell the owner. Systems handling money, health, or others' personal data: recommend an independent security review. Real user data exposure: stop and report.

任何特权路由都可被未授权主体访问：HIGH；在上线前修复或阻止，并告知 owner。涉及资金、健康信息或他人个人数据的系统：建议进行独立安全审查。发生真实用户数据暴露：停止操作并报告。

No change is valid when

无需更改的情况

No privileged surfaces exist, or every one demonstrably enforces server-side authorization. Do not add roles to a product with one user type.

不存在特权入口，或者每一个特权入口都经证实执行了 server-side authorization。不要给只有一种用户类型的产品添加角色。