What problem does it solve? Applications often need feature-level capability flags (e.g., "can reject leave requests", "can see a dashboard widget") that are not tied to any collection or CRUD operation. This Skill adds such custom permissions to a DaaS-backed app so they share the existing Policy → Role → User assignment chain and can be enforced in both React components and Next.js API routes. ## Core Features & Use Cases - Schema Extension via MCP: Adds a custom_permissions JSONB column to daas_policies using the DaaS MCP fields tool, with no SQL migration or DaaS code change required. - Server & Client Enforcement: Provides getCustomPermissions, hasCustomPermission, and enforceCustomPermission server utilities plus useCustomPermission React hooks, with admin bypass and OR-merge semantics across policies. - Policy Editor UI: Ships a CustomPermissionsEditor component that validates dot-notation keys and persists flags via PATCH /api/policies/:id. - Use Case: An admin wants only certain roles to reject leave requests. Create the key MyApp.LeaveRequest.Reject, assign it to the appropriate policy, guard the API route with enforceCustomPermission, and hide the Reject button with useCustomPermission. ## Quick Start Ask the AI to add a custom permission key such as "MyApp.Dashboard.TaskWidget" and assign it to the desired policies and roles in the DaaS-backed application.
