make-app-permission

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

make-app-permission

Use this skill when a request creates, changes, reviews, or debugs Make App single-app permission enforcement. It must be enabled by default for every generated or refactored Make App. Do not omit the IAM proxy, route guards, permission-aware Schema, or permission audits merely because the request focuses on UI, Service, Schema, or runtime work.

This skill owns permission semantics. Use

make-app-auth

for login/session,

make-app-service

for Service and Schema transport,

makeui

for rendering,

canvas-table-integration

for cell-editor mechanics, and

make-app-runtime

for packaging/runtime.

当需求涉及创建、修改、审查或调试Make App单应用权限强制执行时，使用本技能。对于所有生成或重构的Make App，必须默认启用本技能。不得仅因为需求聚焦于UI、Service、Schema或运行时相关工作，就省略IAM代理、路由守卫、权限感知Schema或权限审计。

本技能负责权限语义相关逻辑。登录/会话相关请使用

make-app-auth

，Service与Schema传输相关请使用

make-app-service

，渲染相关请使用

makeui

，单元格编辑器机制相关请使用

canvas-table-integration

，打包/运行时相关请使用

make-app-runtime

。

Quick start

快速开始

Inspect
```
apps/docs/api.md
```
, Service/UI schema adapters and types, principal-permission code, providers, router, object pages, create/edit forms, submit builders, refresh flow, and tests.
Read
```
references/permission-boundaries.md
```
before selecting scope, permissionKey, schema collection, or field access state.

Read

references/service-principal-permission.md

before changing

/principal/permission

or interpreting IAM

fieldAccess

Read
```
references/ui-permission-runtime.md
```
before changing route/action gates, create/read/update field sets, payload filtering, or refresh.
Read
```
references/system-field-contract.md
```
before implementing ID/audit create or edit capability.
Read
```
references/testing-and-audit.md
```
before implementation and before reporting completion.
Implement tests first, then the Service/schema boundary, permission pure model, route/action gates, field-set consumers, submit allowlists, and refresh invalidation.
Run host tests, the behavioral conformance suite, and
```
node skills/make-app-permission/scripts/audit-make-app-permission.mjs <project-root>
```
. Wire both permission checks into the host's default test, CI, or publish gate; a one-off local run is not a continuous gate.
When publishing or installing this Skill, run
```
check-installed-skill-sync.mjs
```
with explicit source and installed directories. When the release changes shared Make response/auth/permission guidance, publish the platform package, run
```
npx skills update qfeius/make-platform-skills
```
, then run the repository-wide
```
check-installed-make-platform-skills-sync.mjs
```
with explicit source and installed Skill roots. Keep these local release checks out of portable host CI.

检查
```
apps/docs/api.md
```
、Service/UI schema适配器与类型定义、principal-permission相关代码、providers、路由、对象页面、新建/编辑表单、提交构建器、刷新流程及测试用例。
在选择范围、permissionKey、schema集合或字段访问状态之前，请先阅读
```
references/permission-boundaries.md
```
。

在修改

/principal/permission

或解读IAM

fieldAccess

之前，请先阅读

references/service-principal-permission.md

。

在修改路由/操作守卫、新建/读取/更新字段集、payload过滤或刷新逻辑之前，请先阅读
```
references/ui-permission-runtime.md
```
。
在实现ID/审计字段的新建或编辑能力之前，请先阅读
```
references/system-field-contract.md
```
。
在实现功能及报告完成之前，请先阅读
```
references/testing-and-audit.md
```
。
优先实现测试，然后依次实现Service/schema边界、纯权限模型、路由/操作守卫、字段集消费者、提交白名单及刷新失效逻辑。
运行宿主测试、行为一致性套件，以及
```
node skills/make-app-permission/scripts/audit-make-app-permission.mjs <project-root>
```
。将这两项权限检查接入宿主的默认测试、CI或发布门禁；单次本地运行不能作为持续门禁。
发布或安装本技能时，需指定明确的源码目录和安装目录，运行
```
check-installed-skill-sync.mjs
```
。当本次发布修改了共享的Make响应/认证/权限规范时，需先发布平台包，运行
```
npx skills update qfeius/make-platform-skills
```
，然后指定明确的源码根目录和已安装技能根目录，运行仓库级的
```
check-installed-make-platform-skills-sync.mjs
```
。请勿将这些本地发布检查加入可移植的宿主CI中。

Required contract

必需契约

Expose
```
/api/make/app/principal/permission
```
; have Service call
```
/api/make/iam/v1/principal/permission
```
with App scope,
```
MakeService.GetResource
```
, and the established login context. This is a direct Make proxy: return every completed IAM response unchanged, including 2xx/4xx/5xx status, Content-Type, and body. Do not request tenant-root scope or upstream platform permission filters. Before strict normalization, classify rows with
```
references/permission-boundaries.md
```
: ignore only clearly unrelated rows, and fail closed for every selected or unclassifiable row.
Match exact, wildcard, parent, App, entity, IAM namespace-wildcard App resources, and deny correctly. Use the most-specific allow field range; deny wins.

Keep create, visibility, and editability as separate field-set decisions:

create form:

createFields ∩ meta.field.read fieldAccess(creatable|readonly|editable|partialMask|fullMask|*)

;

list/detail/filter:

fields ∩ meta.field.read fieldAccess(readable states)

;

edit/cell edit: visible

fields ∩ meta.field.update fieldAccess(editable|*)

Keep entity navigation, table headers, and record data independent:
```
meta.entity.read
```
controls whether a Schema-present entity appears in navigation and can enter its object route; both the navigation and the dynamic route must reject the entity when this permission is absent.
```
meta.field.read
```
controls the authorized columns/table headers;
```
data.record.read
```
controls record/detail requests and rows only. When record read is denied or revoked but entity and fields are authorized, keep the navigation item and table shell with authorized headers, skip every record request, and render an explicit empty row set so cached values cannot remain visible.
Preserve every access state returned for a field. Current IAM responses may use arrays such as
```
["creatable", "readonly"]
```
or scalar strings; normalize a supported scalar string to a one-element array and authorize a permission dimension when any state is allowed for that dimension. Never coerce an array with
```
String(value)
```
or template interpolation.
Treat missing
```
createFields
```
as empty. Never fall back to
```
fields
```
, and do not consume
```
editableFields
```
for current edit behavior.
Gate the create entry and submit with
```
data.record.create
```
only; derive create fields from the matched
```
meta.field.read
```
row and
```
createFields
```
.
```
meta.field.create
```
is not a platform permission point and must not be required, inferred, or emitted. The operation gate never grants field access or bypasses the create-field intersection. Gate update/delete/bulk-update independently with their own operation keys.
Recompute the latest create/edit allowlist before submit and build payloads from it. Never spread the complete form store into a protected mutation.
Exclude ID and system audit fields from create capability. Keep existing audit-field edit capability when the field is visible, update-authorized, and supported by the host editor.
Keep create-only invisible fields available only in create mode. A
```
creatable
```
access state is not readable or editable.
Add App/object/fixed-route guards; hiding menus or buttons is not authorization. Recheck handlers before reads and mutations.
Refresh permission and permission-trimmed Schema in one access generation before data refresh. Invalidate stale permission, Schema, form, and record work; do not close a still-authorized create surface merely because read is revoked.
Fail closed on permission or Schema failure. Leave row-level
```
dataCondition
```
enforcement to backend APIs.
Add Service/schema, permission-model, route/page, payload, special-field, refresh, and negative audit tests.

暴露
```
/api/make/app/principal/permission
```
接口；由Service使用应用范围、
```
MakeService.GetResource
```
及已建立的登录上下文调用
```
/api/make/iam/v1/principal/permission
```
。这是一个直接的Make代理：需原样返回所有完整的IAM响应，包括2xx/4xx/5xx状态码、Content-Type和响应体。不得请求租户根范围或上游平台权限过滤器。在严格规范化之前，需依据
```
references/permission-boundaries.md
```
对数据行进行分类：仅忽略明确无关的行，所有选中或无法分类的行均需执行默认拒绝。
需正确匹配精确、通配符、父级、应用、实体、IAM命名空间通配符等各类应用资源，并正确执行拒绝逻辑。采用最具体的允许字段范围；拒绝优先。

将新建、可见性、可编辑性作为独立的字段集决策：

新建表单：

createFields ∩ meta.field.read fieldAccess(creatable|readonly|editable|partialMask|fullMask|*)

；

列表/详情/筛选：

fields ∩ meta.field.read fieldAccess(readable states)

；

编辑/单元格编辑：可见

fields ∩ meta.field.update fieldAccess(editable|*)

。

保持实体导航、表格表头和记录数据三者相互独立：
```
meta.entity.read
```
控制Schema中存在的实体是否出现在导航中、是否可进入其对象路由；当缺少该权限时，导航和动态路由都必须拒绝该实体。
```
meta.field.read
```
控制已授权的列/表格表头；
```
data.record.read
```
仅控制记录/详情请求及数据行。当记录读取权限被拒绝或撤销，但实体和字段权限仍有效时，需保留导航项和带有已授权表头的表格框架，跳过所有记录请求，并显式渲染空行集，以避免缓存值仍然可见。
保留字段返回的所有访问状态。当前IAM响应可能使用数组（如
```
["creatable", "readonly"]
```
）或标量字符串；需将支持的标量字符串规范化为单元素数组，且只要某个权限维度的任意状态被允许，就授权该维度。严禁使用
```
String(value)
```
或模板插值强制转换数组。
将缺失的
```
createFields
```
视为空集。严禁回退使用
```
fields
```
，且当前编辑行为不得使用
```
editableFields
```
。
新建入口和提交仅通过
```
data.record.create
```
进行守卫；新建字段需从匹配的
```
meta.field.read
```
行和
```
createFields
```
推导而来。
```
meta.field.create
```
不属于平台权限点，不得要求、推断或输出该权限点。操作守卫永远不会授予字段访问权限，也不会绕过新建字段的交集逻辑。更新/删除/批量更新需使用各自的操作键独立进行守卫。
提交前需重新计算最新的新建/编辑白名单，并基于白名单构建payload。严禁将完整的表单存储展开到受保护的变更操作中。
新建能力需排除ID和系统审计字段。当审计字段可见、拥有更新权限且宿主编辑器支持时，保留现有的审计字段编辑能力。
仅新建可见的字段仅在新建模式下可用。
```
creatable
```
访问状态不代表可读或可编辑。
添加应用/对象/固定路由守卫；隐藏菜单或按钮不等于授权。读取和变更操作前需重新检查处理函数。
数据刷新前，需在同一个访问周期内刷新权限和经过权限裁剪的Schema。使过期的权限、Schema、表单和记录工作失效；不得仅因为读取权限被撤销，就关闭仍有权限的新建界面。
权限或Schema故障时执行默认拒绝。行级
```
dataCondition
```
强制执行交由后端API处理。
需添加Service/schema、权限模型、路由/页面、payload、特殊字段、刷新及反向审计测试。

Reference map

参考映射

Task	Read
Platform vs App scope, create/read/update field surfaces, Schema collections, matching	`references/permission-boundaries.md`
Service endpoint, IAM request/response, `meta.field.read.fieldAccess`	`references/service-principal-permission.md`
Providers, helpers, routes, create/edit flow, payload, refresh, Lookup	`references/ui-permission-runtime.md`
Exact ID/audit create exclusions and edit compatibility	`references/system-field-contract.md`
Required tests, audit signals, completion blockers	`references/testing-and-audit.md`
Auth/session	Use `make-app-auth`
Schema/API transport and cache	Use `make-app-service`
Form/empty-state presentation	Use `makeui`
Table/cell-editor mechanics	Use `canvas-table-integration`
Selection, row precheck, batch actions	Use `make-app-actions`
Runtime gateway and packaging	Use `make-app-runtime`

任务	参考文档
平台与应用范围、新建/读取/更新字段面、Schema集合、匹配逻辑	`references/permission-boundaries.md`
Service端点、IAM请求/响应、 `meta.field.read.fieldAccess`	`references/service-principal-permission.md`
Providers、辅助函数、路由、新建/编辑流程、payload、刷新、Lookup	`references/ui-permission-runtime.md`
ID/审计字段新建排除规则及编辑兼容性	`references/system-field-contract.md`
必需测试、审计信号、完成阻塞项	`references/testing-and-audit.md`
认证/会话	使用 `make-app-auth`
Schema/API传输与缓存	使用 `make-app-service`
表单/空状态展示	使用 `makeui`
表格/单元格编辑器机制	使用 `canvas-table-integration`
选择、行预检查、批量操作	使用 `make-app-actions`
运行时网关与打包	使用 `make-app-runtime`

Audit

审计

bash

node skills/make-app-permission/scripts/audit-make-app-permission.mjs <project-root>

Treat failures as blockers and warnings as review items. The audit is heuristic and never replaces runtime tests. It rejects obvious

fieldAccess

state-array coercion through

String(...)

, text helpers, template interpolation,

.toString()

, or

.join()

when the coerced value affects normalization output or permission evaluation, including direct control-flow conditions. Diagnostic-only logging, comments, and string literals inside a named normalization helper must not fail the audit, regardless of whether the parameter uses a generic or

fieldAccess

-specific name. The executable behavior contract remains authoritative.

Also expose a thin host adapter and run the executable behavior contract:

bash

node skills/make-app-permission/scripts/permission-conformance-suite.mjs <host-adapter-module>

If the adapter is TypeScript, run the same command through the host's existing TypeScript runner. Do not add a runtime dependency only for this check. The adapter must delegate to the production permission helpers and create-capability guard; it must not reimplement them in the test. Keep the audit and conformance runner project-local or install them through a versioned dependency before making them a host gate. Do not hardcode another workspace checkout or a developer home-directory Skill path into portable CI.

For local Skill install/release verification, compare the complete source and installed directories:

bash

node skills/make-app-permission/scripts/check-installed-skill-sync.mjs \
  skills/make-app-permission <installed-skill-dir>

The checker reports source-only, installed-only, and content-mismatch files. Pass an explicit install directory; do not embed a developer home path in the Skill or in host CI.

For a release that changes the shared Service/auth/permission contract, update the installed platform package first, then verify all affected Make App Skills:

bash

npx skills update qfeius/make-platform-skills
node scripts/check-installed-make-platform-skills-sync.mjs \
  skills <installed-skills-dir>

Run this only after the source revision has been published through the platform Skill release flow. It is a local release verification, not portable host CI.

bash

node skills/make-app-permission/scripts/audit-make-app-permission.mjs <project-root>

失败项视为阻塞问题，警告项视为审查项。该审计是启发式的，永远不能替代运行时测试。当强制转换后的值会影响规范化输出或权限评估（包括直接控制流条件）时，审计会拒绝通过

String(...)

、文本辅助函数、模板插值、

.toString()

或

.join()

对

fieldAccess

状态数组进行的明显强制转换。仅用于诊断的日志、注释以及命名规范化辅助函数内的字符串字面量不会导致审计失败，无论参数使用的是通用名称还是

fieldAccess

特定名称。可执行的行为契约始终具有权威性。

还需暴露一个轻量宿主适配器，并运行可执行行为契约：

bash

node skills/make-app-permission/scripts/permission-conformance-suite.mjs <host-adapter-module>

如果适配器是TypeScript编写的，通过宿主现有的TypeScript运行器运行相同的命令。不得仅为该检查添加运行时依赖。适配器必须委托给生产环境的权限辅助函数和新建能力守卫；不得在测试中重新实现这些逻辑。将审计和一致性运行器保留在项目本地，或在将其设为宿主门禁之前通过版本化依赖安装。不得将其他工作区检出路径或开发者主目录下的技能路径硬编码到可移植CI中。

对于本地技能安装/发布验证，需对比完整的源码目录和安装目录：

bash

node skills/make-app-permission/scripts/check-installed-skill-sync.mjs \
  skills/make-app-permission <installed-skill-dir>

检查器会报告仅存在于源码、仅存在于安装目录以及内容不匹配的文件。需传入明确的安装目录；不得在技能或宿主CI中嵌入开发者主目录路径。

对于修改了共享Service/认证/权限契约的发布，需先更新已安装的平台包，然后验证所有受影响的Make App技能：

bash

npx skills update qfeius/make-platform-skills
node scripts/check-installed-make-platform-skills-sync.mjs \
  skills <installed-skills-dir>

仅当源码修订版已通过平台技能发布流程发布后，再运行此命令。这是本地发布验证，不属于可移植宿主CI的一部分。