Slice · AI prompt

RBAC — Roles & Permissions

RBAC engine: 6 role presets + wildcard permissions + <PermissionGate>. Props-driven. No Clerk.

Copy this prompt into Claude / Codex / Cursor

rbac-roles.prompt.mdmarkdown

# Install `rbac-roles` — RBAC — Roles & Permissions

> RBAC engine: 6 role presets + wildcard permissions + <PermissionGate>. Props-driven. No Clerk.

📚 Knowledge base : https://resource.rahmanef.com/llms.txt
📦 Slice detail   : https://resource.rahmanef.com/slices/rbac-roles
🧠 JSON catalog   : https://resource.rahmanef.com/api/knowledge?slice=rbac-roles
🔗 Source         : https://github.com/rahmanef63/resource-site/tree/main/frontend/slices/rbac-roles

## 1. Install

```bash
npx rahman-resources add rbac-roles
# alias: npx rr add rbac-roles
```

The CLI copies `frontend/slices/rbac-roles/` into your project + augments `.env.example` + installs npm deps automatically. Run it from your project root.

## 2. What it ships

- shadcn primitives: `badge`, `checkbox`, `label`
- peer slices (cascade install):
  - `convex-auth` — RBAC checks resolve the authed user via getAuthUserId.
- env vars:
  - `PLATFORM_ADMIN_EMAILS` (convex) — Comma-separated emails granted cross-tenant superadmin (`*`).
- convex feature paths: `convex/features/rbac_roles`

## 3. Wire it up

Run `npx rr add rbac-roles`. Frontend: import { PermissionGate, usePermissions, RoleBadge, PermissionMatrix, resolvePermissions, ROLE_PRESETS } from "@/features/rbac-roles". Feed usePermissions/PermissionGate the actor's resolved permission list (from your membership query or resolvePermissions(roleSlug)). Convex: spread rbacRolesTables into your schema, call seedSystemRoles({tenantId}) once, gate privileged fns with requirePermission(ctx, tenantId, "members.manage"). Set PLATFORM_ADMIN_EMAILS for superadmins. Add the user-management slice for the members/invites UI (provides um_members).

## Rules of engagement

- shadcn-only UI primitives. No raw `<button>` / `<dialog>` / native date or file inputs.
- 200-line hard cap per source file (extract neighbours when over).
- All Convex queries hit an index (`.withIndex(...)`); never bare `.collect()`.
- Public mutations/queries declare `args:` validators + authz.
- Full ruleset: https://resource.rahmanef.com/best-practice

The agent will fetch /llms.txt for the full ruleset and use /api/knowledge for the JSON catalog.

# Install `rbac-roles` — RBAC — Roles & Permissions > RBAC engine: 6 role presets + wildcard permissions + <PermissionGate>. Props-driven. No Clerk. 📚 Knowledge base : https://resource.rahmanef.com/llms.txt 📦 Slice detail : https://resource.rahmanef.com/slices/rbac-roles 🧠 JSON catalog : https://resource.rahmanef.com/api/knowledge?slice=rbac-roles 🔗 Source : https://github.com/rahmanef63/resource-site/tree/main/frontend/slices/rbac-roles ## 1. Install ```bash npx rahman-resources add rbac-roles # alias: npx rr add rbac-roles ``` The CLI copies `frontend/slices/rbac-roles/` into your project + augments `.env.example` + installs npm deps automatically. Run it from your project root. ## 2. What it ships - shadcn primitives: `badge`, `checkbox`, `label` - peer slices (cascade install): - `convex-auth` — RBAC checks resolve the authed user via getAuthUserId. - env vars: - `PLATFORM_ADMIN_EMAILS` (convex) — Comma-separated emails granted cross-tenant superadmin (`*`). - convex feature paths: `convex/features/rbac_roles` ## 3. Wire it up Run `npx rr add rbac-roles`. Frontend: import { PermissionGate, usePermissions, RoleBadge, PermissionMatrix, resolvePermissions, ROLE_PRESETS } from "@/features/rbac-roles". Feed usePermissions/PermissionGate the actor's resolved permission list (from your membership query or resolvePermissions(roleSlug)). Convex: spread rbacRolesTables into your schema, call seedSystemRoles({tenantId}) once, gate privileged fns with requirePermission(ctx, tenantId, "members.manage"). Set PLATFORM_ADMIN_EMAILS for superadmins. Add the user-management slice for the members/invites UI (provides um_members). ## Rules of engagement - shadcn-only UI primitives. No raw `<button>` / `<dialog>` / native date or file inputs. - 200-line hard cap per source file (extract neighbours when over). - All Convex queries hit an index (`.withIndex(...)`); never bare `.collect()`. - Public mutations/queries declare `args:` validators + authz. - Full ruleset: https://resource.rahmanef.com/best-practice