Skip to main content

permissions-demo-tokens

Find real users in the local ebdb MySQL database that hold a specific permission role, then generate JWT tokens for them via the existing sandbox token CLI โ€” so you can test different permission levels in a local environment. Ported from cursor-rules; used by auth-security when testing RBAC.

Local-only, demo/test purpose. This operates against the local ebdb sandbox DB and the sandbox token CLI โ€” never production. The tokens are for testing permission boundaries locally.

Supported roles: super-admin ยท organization-admin ยท community-admin ยท leader (optionally restricted by organization and/or community, and optionally "only this role" excluding stronger admin roles).

Prerequisitesโ€‹

  • backend-services is available with a .env carrying SQL_HOST / SQL_PORT / SQL_USERNAME / SQL_PASSWORD / SQL_NAME.
  • Local MySQL is running with the ebdb schema and the usual tables: users, users_permissions, organizations_admins, communities_admins, groups.
  • The sandbox PHP token CLI (in the consumer/backend sandbox) for minting the JWT.

Workflowโ€‹

  1. Find a user with the role. Query ebdb for a user holding the requested role โ€” join users with users_permissions / organizations_admins / communities_admins as appropriate; filter by org/community if asked; if "only this role" is requested, exclude users who also hold a stronger admin role.
  2. Confirm the candidate โ€” surface the user id + email + the role(s) they actually hold, so the developer picks deliberately (don't silently grab the first row).
  3. Mint the JWT via the sandbox token CLI for that user: 
    docker exec -it php-nginx-dev php yii token/create <user-id> --oId=<organization-id>
  4. Return the user identity + the JWT + which role/scope it represents, and a one-line "use this to test X".

A bundled helper (find_permission_user.mjs, in the cursor-rules version) automates step 1 against the .env-configured DB. Port/run it from this skill's directory when present; otherwise do the query directly. Never log the minted JWT into shared output beyond what the developer needs locally.

Cross-referencesโ€‹

  • auth-security โ€” owns Cognito/JWT/RBAC; uses this skill to exercise permission boundaries in tests.
  • database โ€” owns the ebdb/Aurora schema this queries.
  • Source: cursor-rules bewith-permissions-demo-tokens skill (+ its find_permission_user.mjs script + the sandbox token CLI).