Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →webiny/webiny-api-permissions
Schema-based permission system for API features.
Passed 21 of 22 test cases with the skill, and 8 of 22 without it.
and 22 more in the full report
14 fixed7 passed either way0 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
What property shape must a domain entity implement on its TypeScript interface so that item-level ownership checks like canAccess and canEdit can verify record ownership?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies that ownable item types must include a createdBy object with an id property. | Missed | Passed |
The instructions your model reads when the skill loads.
Permissions follow two layers: domain (schema) and features (DI abstractions + feature registration). Each package declares a permission schema and gets a typed Permissions abstraction injectable into use cases via DI. Methods like canRead, canEdit, canDelete, canPublish, onlyOwnRecords replace manual identityContext.getPermission() calls.
Define the schema in src/domain/permissionsSchema.ts:
import { createPermissionSchema } from "webiny/api/security";
export const SM_PERMISSIONS_SCHEMA = createPermissionSchema({
prefix: "sm",
fullAccess: true,
entities: [
{
id: "product",
permission: "sm.product",
scopes: ["full", "own"],
actions: [{ name: "rwd" }, { name: "pw" }]
},
{
id: "settings",
permission: "sm.settings",
scopes: ["full"]
}
]
});
The schema MUST use as const inference (handled by createPermissionSchema) for TypeScript to narrow entity IDs in method signatures.
| Field | Description |
|---|---|
prefix | Namespaces the DI abstraction: ${prefix}:Permissions |
fullAccess | true for standard full access. Pass an object with custom boolean flags for full-access extras (e.g., { canForceUnlock: true }). |
test cases passed, vs 8 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.