make-app-permission

Use this skill when a request creates, changes, reviews, or debugs Make App single-app permission enforcement. It must be enabled by default for every generated or refactored Make App. Do not omit the IAM proxy, route guards, permission-aware Schema, or permission audits merely because the request focuses on UI, Service, Schema, or runtime work.

This skill owns permission semantics. Use make-app-auth for login/session, make-app-service for Service and Schema transport, makeui for rendering, canvas-table-integration for cell-editor mechanics, and make-app-runtime for packaging/runtime.

Quick start

1. Inspect apps/docs/api.md, Service/UI schema adapters and types, principal-permission code, providers, router, object pages, create/edit forms, submit builders, refresh flow, and tests.
2. Read references/permission-boundaries.md before selecting scope, permissionKey, schema collection, or field access state.
3. Read references/service-principal-permission.md before changing /principal/permission or interpreting IAM fieldAccess.
4. Read references/ui-permission-runtime.md before changing route/action gates, create/read/update field sets, payload filtering, or refresh.
5. Read references/system-field-contract.md before implementing ID/audit create or edit capability.
6. Read references/testing-and-audit.md before implementation and before reporting completion.
7. Implement tests first, then the Service/schema boundary, permission pure model, route/action gates, field-set consumers, submit allowlists, and refresh invalidation.
8. Run host tests, the behavioral conformance suite, and node skills/make-app-permission/scripts/audit-make-app-permission.mjs <project-root>. Wire both permission checks into the host's default test, CI, or publish gate; a one-off local run is not a continuous gate.
9. When publishing or installing this Skill, run check-installed-skill-sync.mjs with explicit source and installed directories. When the release changes shared Make response/auth/permission guidance, publish the platform package, run npx skills update qfeius/make-platform-skills, then run the repository-wide check-installed-make-platform-skills-sync.mjs with explicit source and installed Skill roots. Keep these local release checks out of portable host CI.

Required contract