Awcms Abac Guard

When to use this skill

Use Awcms Abac Guard when an AI agent needs a reusable SKILL.md workflow for this job: Terapkan kontrol akses RBAC+ABAC default-deny plus RLS pada endpoint/service AWCMS. Gunakan pada setiap endpoint non-public dan setiap akses data tenant-scoped. Menegakkan default deny, deny-overrides-allow, decision log, dan tenant isolation sesuai doc 03 & 10.

When not to use it

Skip Awcms Abac Guard when the task is outside the coding category, or when a more specific skill in this directory already covers the same workflow with clearer triggers.

How to install

1. Personal install: create ~/.claude/skills/awcms-abac-guard/SKILL.md (and any bundled scripts) so Claude Code, Claude Desktop, and compatible agents can load it in every project.
2. Project install: commit the same folder at .claude/skills/awcms-abac-guard/ so teammates get the skill with the repo.
3. Restart the agent session after copying files so it re-scans the skills directory, then ask for the task in words that match the skill description.

Full install guide for Claude, Cursor, and Codex

What this skill does

# AWCMS — ABAC Guard & Tenant Isolation

Ikuti `docs/awcms/03_srs_detail_per_modul.md`, `docs/awcms/10_template_kode_coding_standard.md`, dan **`docs/awcms/17_default_seed_rbac_abac.md`** (matriks role→permission & default ABAC policy). Mekanisme RLS/tenant context konkret: `docs/awcms/16_backend_data_access_integration.md`.

## Prinsip

1. **Default deny** — tidak ada policy yang mengizinkan = tolak. 2. **Deny overrides allow** — satu deny mengalahkan semua allow. 3. **RLS tetap wajib** walau ABAC sudah cek (defense in depth). 4. Akses ditolak yang high-risk → catat di decision log. 5. UI hiding **bukan** kontrol utama; backend tetap validasi. 6. Archive/restore/purge soft delete default deny sampai permission eksplisit tersedia.

## Bentuk request/decision

```ts type AccessRequest = { moduleKey: string; activityCode: string; action: | "read" | "create" | "update" | "delete" | "post" | "cancel" | "approve" | "export" | "send" | "configure" | "analyze" | "assign" | "restore" | "purge" | "retry" | "sync" | "enable" | "disable" | "check" | "publish" | "schedule" | "archive" | "verify" | "set_primary" // Issue #562 (tenant_domain) — see access-control.ts's own comment for why neither is in HIGH_RISK_ACTIONS | "connect" | "disconnect" // Issue #643 (social_publishing) — unlike verify/set_primary, BOTH are in HIGH_RISK_ACTIONS (write a credential-bearing token_reference) | "preview" // Issue #641 (blog_content) — read-only (internal-links preview), not in HIGH_RISK_ACTIONS // Platform-evolution epic #738 additions (identity-access/domain/access-control.ts:73-188): | "release" // #745 data_lifecycle: legal_hold.release — HIGH_RISK | "replay" // #742 domain_event_runtime: deliveries.replay — not high-risk (idempotent by event ID) | "manage" // #742 domain_event_runtime: consumers.manage (pause/resume) — not high-risk | "revoke" // #746 identity-access: business-scope/SoD-exception revoke — HIGH_RISK | "override" // #746 identity-access: reserved for future conflict-override hook — HIGH_RISK | "reject" // #746 identity-access: reject a SoD conflict exception request — not high-risk (safe outcome) | "retire" // #747 workflow_approval: voluntary definition retirement — HIGH_RISK | "reassign" // #747 workflow_approval: reassign a pending task's open seats — HIGH_RISK | "force_decide" // #747 workflow_approval: force-approve/reject bypassing quorum — HIGH_RISK | "merge" // #748 profile_identity: profile_merge.merge (execute approved merge) — HIGH_RISK | "commit" // #750 reference_data imports.commit / #751 document_infrastructure number-sequence commit — HIGH_RISK | "rollback" // #750 reference_data: imports.rollback — HIGH_RISK | "void" // #751 document_infrastructure: irreversible-by-default document void — HIGH_RISK | "reclassify" // #751 document_infrastructure: change document classification/confidentiality — HIGH_RISK | "reserve" // #751 document_infrastructure: document number sequence reservation — HIGH_RISK | "rebuild"; // #753 reporting: trigger/resume a full projection rebuild — HIGH_RISK resourceType?: string; resourceId?: string; resourceAttributes?: Record<string, unknown>; environmentAttributes?: Record<string, unknown>; }; type AccessDecision = { allowed: boolean; reason: string; decisionId?: string; matchedPolicy?: string; }; ```

## Prosedur

```mermaid flowchart LR Req[Request] --> Ctx[Tenant context + SET app.current_tenant_id] --> Eval[Evaluate ABAC] --> D{allowed?} D -- Tidak --> Log[Decision log jika high-risk] --> Deny[403 ACCESS_DENIED] D -- Ya --> Next[Lanjut ke validasi/service] ```

## Aturan implementasi

- **Guard HANYA pada `action` yang DI-SEED di `awcms_permissions`.** Katalog permission disemai lewat migrasi `sql/*` (mis. `sql/005` untuk `access_control` = `read`/`assign`/`configure`, `office_management` = `read`/`create`/`update`). Owner role di-grant SELURUH baris `awcms_permissions` saat bootstrap (`platform-bootstrap.ts` `SELECT id FROM awcms_permissions`), dan jalur e2e = migrasi → `POST /setup/initialize` TANPA module permission-sync di antaranya. Jadi guard pada `action` yang tidak ter-seed **men-DENY bahkan owner (403)** — dan ini LATENT: e2e admin env-gated sering ter-skip di CI kosong → hijau padahal rusak. Sebelum menulis guard baru: pakai action yang sudah ter-seed untuk aktivitas itu (mis. administrasi role/policy → `configure`, assign role → `assign`), ATAU tambah action lewat **migrasi seed baru** (`INSERT ... ON CONFLICT DO NOTHING`; migrasi terapan immutable — jangan edit `sql/005`). Deklarasi di `module.ts` `permissions[]` **tidak cukup** — itu bukan baris katalog DB saat bootstrap (Issue #171). Cocokkan gate UI SSR dengan action guard endpoint yang sama. - Set tenant context di **awal** transaction: `SET app.current_tenant_id = ...`. - Query tenant-scoped **wajib** filter `tenant_id` (jangan hanya andalkan RLS). - **Role sistem (`is_system`) itu invarian:** tolak soft-delete, grant/revoke permission, dan assign/unassign role sistem via API (mirror `softDeleteRole`), dan jangan biarkan admin dinonaktifkan sampai tak ada admin aktif tersisa — jika tidak, holder permission terdelegasi bisa eskalasi/mengunci tenant (Issue #171 review). - Query resource soft-deletable default `deleted_at IS NULL`; `includeDeleted`, `restore`, dan `purge` wajib ABAC eksplisit. - Contoh batas peran: operator ditolak akses pajak/export/assign role; cross-tenant selalu blocked. - `tenantUserId`/`identityId` berasal dari auth middleware, **bukan** header public mentah. - **Layar admin write-form** memakai `sendJson`/`postJson`/`lockElement` (`src/lib/ui/admin-form-client.ts`, skill `awcms-ui-screen`) untuk memanggil endpoint mutation — pastikan gate/permission yang dicek untuk menampilkan tombol/form itu adalah `action` yang SAMA dan SUDAH ter-seed di `awcms_permissions` (aturan di atas), bukan action yang "kelihatan benar" tapi belum ter-seed — kalau salah, tombolnya tampil tapi request-nya 403 bahkan untuk owner.

## Verifikasi (test)

- default deny; deny overrides allow; cashier limit; tax officer access; cross-tenant blocked; archive/restore denied tanpa permission; decision log tercatat.

Intended uses

• Use Awcms Abac Guard when this documented workflow matches the task.