skills.rest
hontauadrian
hontauadrianCOMMUNITY
Explore all skills by this author →
GitHub

generated-app-role-management

Maintains Keycloak client roles across auth manifests, API guards, frontend UI, and tests.

Updated Apr 7, 2026
Search Tags:#authorization#rbac#keycloak#oauth2-proxy#role management#auth manifest#api guards
One-click install
npx skills add https://github.com/hontauadrian/sfx-app-empty-test --skill generated-app-role-management-hontauadrian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: generated-app-role-management
Source: https://github.com/hontauadrian/sfx-app-empty-test/tree/main/.overstory/claude-profiles/merger/skills/generated-app-role-management
Command: npx skills add https://github.com/hontauadrian/sfx-app-empty-test --skill generated-app-role-management-hontauadrian

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Adding or changing authorization roles in a generated app touches many layers at once: the auth manifest, Keycloak provisioning, API guards, frontend role-based UI, and tests. This Skill keeps all of those layers consistent so roles work end to end without drift or security gaps. ## Core Features & Use Cases - Role contract management: Add, rename, or remove Keycloak client roles in the auth manifest while keeping protected baseline roles stable. - API authorization updates: Apply typed role constants and @AuthRoles guards on protected endpoints, keeping /auth/me minimal. - Frontend role handling: Fetch roles from /api/v1/auth/me and centralize role-to-UI decisions in hooks and mappers instead of inline JSX. - Use Case: When adding a finance-approver role to a generated app, use this Skill to update the manifest, guard the approval endpoints, render the approver UI, and verify 401/403/allow behavior through oauth2-proxy and real Keycloak. ## Quick Start Add a new viewer role to my generated app and update the auth manifest, API guards, frontend role UI, and tests accordingly.

Frequently Asked Questions about generated-app-role-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new role to a generated app with Keycloak?▼

Add the role to the app's auth manifest, create it as a client role on the API client via SFX Panel provisioning, guard endpoints with @AuthRoles, and map the role to UI in frontend hooks. Then test 401, 403, and allowed-access cases end to end.

Should generated app roles be Keycloak realm roles or client roles?▼

Generated app roles must be Keycloak client roles on the API client, read from resource_access[OAUTH_API_CLIENT_ID].roles. Realm roles, groups, frontend state, and cookies must never be used for generated app authorization decisions.

How should the frontend check user roles in a generated app?▼

Fetch roles from /api/v1/auth/me and put role-to-UI decisions in hooks or mappers rather than inline JSX conditionals. Show a clear pending or no-access state when an authenticated user has no app role.

Can the generated app create or assign roles at runtime?▼

No. The generated app must never self-create or grant roles. SFX Panel owns dev provisioning, and SFX Foreman or controlled infrastructure owns preprod and production provisioning.

What tests are required when changing an app role?▼

Verify the API returns 401 for missing tokens, 403 for valid tokens lacking the role, and success with the role. Also confirm /auth/me exposes the role, the frontend renders role-specific UI, and the browser flow works through oauth2-proxy with real Keycloak.

Related Skills

Explore More Software Engineering Skills→
MassimilianoPiliMassimilianoPili

keycloak-oidc

Configure Keycloak OIDC clients, realms, and role mappings for SSO.

Community
Advanced
BrownbullBrownbull

devops-orchestrator

Automate infrastructure provisioning, CI/CD pipelines, and deployments across cloud environments.

Community
Advanced
goodnight000goodnight000

auth-implementation-patterns

Implement JWT, OAuth2, session management, and RBAC for REST or GraphQL APIs.

Community
Advanced
CJCreator-NewCJCreator-New

hims-rbac-abac

Design and review RBAC and ABAC authorization policies for HIMS users.

Community
Advanced