# Build Role-Based Authorization for Caffeine AI

Applications need consistent authentication and role checks across Motoko backends and React frontends. This skill provides Caffeine AI patterns for protected endpoints, profiles, login state, and migrations.

## Install

```bash
npx skillstore add caffeinelabs/extension-authorization
```

## Metadata

- Status: approved
- Slug: caffeinelabs-extension-authorization
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: 069fada8cd402d208a79e0f2adbbc1eee9c13b0f6255cedbeea2411f7bacc32f
- Author: caffeinelabs
- GitHub username: caffeinelabs
- License: MIT
- Repository: https://github.com/caffeinelabs/skills/tree/main/skills/extension-authorization/
- Ref: a39a91716eadede5f4cdefd78178fed4e837a128
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: filesystem, external\_commands, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/caffeinelabs-extension-authorization
- Manifest: https://skillstore.pages.dev/api/skills/caffeinelabs-extension-authorization/manifest

## Capabilities

- Provides Motoko setup patterns for the Caffeine AI authorization mixin.
- Shows role checks for administrators, users, guests, and resource owners.
- Defines protected profile endpoints for reading and saving user data.
- Explains verified Internet Identity name, email, and SSO attributes.
- Guides React login, logout, session restoration, and cache clearing.
- Documents the authorization upgrade from version 0.x to version 1.x.

## Use Cases

- Protect a New Caffeine AI Application: Add standard roles, guarded Motoko endpoints, profiles, and Internet Identity login to a new application.
- Build Reliable Authentication Screens: Coordinate restored sessions, login progress, profile setup, logout, and cached data in a React interface.
- Upgrade Authorization Dependencies: Migrate authorization and core infrastructure packages while adopting the verified attribute callback.

## Prompt Templates

### Add Basic Authorization

```
Add Caffeine AI authorization to my application. Create administrator, user, and guest access with guarded backend endpoints.
```

### Implement Protected Profiles

```
Implement user profiles with owner and administrator access. Include profile setup after login and clear cached profile data during logout.
```

### Migrate to Version 1

```
Migrate my existing authorization integration from version 0.x to 1.x. Update dependencies and add the optional verified attribute callback.
```

### Review an Authorization Design

```
Review my Motoko and React authorization flow. Identify missing role checks, ownership checks, session-state errors, cache leaks, and administrator bootstrap risks.
```

## Limitations

- Requires Caffeine AI packages and Internet Identity conventions.
- Does not secure the initial administrator bootstrap against first-login takeover.
- Examples require application-specific ownership and permission decisions.
- Does not deploy, compile, or test the generated application.

## Best Practices

- Apply backend authorization checks to every protected operation.
- Verify resource ownership in addition to checking broad user roles.
- Clear all user-specific cached data when the identity logs out.

## Anti Patterns

- Do not rely on hidden frontend controls as an authorization boundary.
- Do not gate restored sessions on interactive login success state.
- Do not expose personal records through unguarded query methods.

## Security Audit

- Audited at: 2026-07-23T11:59:10.905\+00:00
- Summary: All 67 static findings are false positives caused by Markdown, code examples, relative links, imports, or descriptive identity text. No external command execution, path traversal, reconnaissance, or runtime network request is present. A separate high-severity bootstrap risk allows the first authenticated user to become administrator without prior authorization.

## Stats

- Views: 0
- Downloads: 4
- Favorites: 0
- Popularity score: 0