Implements staff-only admin features gated behind three independent security guards.
npx skills add https://github.com/latitude-dev/latitude-llm --skill backoffice
Please help me install this Agent Skill. Skill: backoffice Source: https://github.com/latitude-dev/latitude-llm/tree/main/.agents/skills/backoffice Command: npx skills add https://github.com/latitude-dev/latitude-llm --skill backoffice
Building internal admin tooling often leads to inconsistent authorization checks that leak the existence of privileged surfaces. This Skill enforces a uniform pattern for adding staff-only /backoffice features in the Latitude codebase, where every non-admin request is indistinguishable from a random 404.
requireAdminSession), server-function guard (adminMiddleware on every createServerFn), and database guard (getAdminPostgresClient with the system organization scope that bypasses RLS).NotFoundError instead of 401/403/redirects, so non-admins cannot enumerate or fingerprint the admin surface.impersonatingMiddleware for stopImpersonating, which gates on session.impersonatedBy since the active session carries the target user's role during impersonation.@domain/admin feature folders, apps/web/src/domains/admin/*.functions.ts, routes under routes/backoffice/<feature>/) so the guards, adapter discipline, and test strategy are applied consistently.Add a new backoffice server function for searching users across all organisations, making sure it attaches adminMiddleware and uses the admin Postgres client.
High-intent search queries and answers about installing and using this skill.
Call createServerFn literally at the call site and attach adminMiddleware before inputValidator, then run the use case through withPostgres using getAdminPostgresClient. Do not wrap createServerFn in a factory, because the Vite plugin pattern-matches the literal chain and a factory breaks the build.
Returning NotFoundError makes every refusal indistinguishable from hitting a random missing route, so non-admin users cannot enumerate or fingerprint the backoffice surface. Redirects, 401, and 403 responses all leak that a protected path exists.
users.role is the global platform-staff flag ("user" or "admin") that gates backoffice access and is DBA-only. members.role is per-organisation ("owner", "admin", "member") and grants zero backoffice access even when set to admin.
Admin queries run through getAdminPostgresClient, a pool on the separate LAT_ADMIN_DATABASE_URL superuser secret, with withPostgres defaulting the scope to OrganizationId("system"). That scope is the only sanctioned signal to skip the RLS set_config call, and passing an organisation id from a backoffice handler is a bug.
During impersonation the session's user.role is the target's role, usually "user", so an admin-role check would reject the exit call. impersonatingMiddleware instead gates on session.impersonatedBy being set and injects both the admin and target user ids for the audit event.
AutumnsGroveConfigure and harden Better Auth with security best practices.
kraftvaerkImplement Umbraco backoffice routing with `umb-router-slot` for custom sections and dashboards.
devtintTests API authorization for vertical, horizontal, and role-bypass privilege escalation vulnerabilities.
fusebase-devIntegrate Gmail, Asana, and Todoist into applications via the FuseBase Gate SDK.