AgentSkillsCN

kirby-security-and-auth

使用访问限制、用户角色、权限和受保护下载来保护Kirby站点。当实施基于登录/角色的访问、权限或文件保护时使用。

SKILL.md
--- frontmatter
name: kirby-security-and-auth
description: Secures Kirby sites with access restriction, user roles, permissions, and protected downloads. Use when implementing login/role-based access, permissions, or file protection.

Kirby Security and Auth

KB entry points

  • •kirby://kb/scenarios/62-access-restriction-login
  • •kirby://kb/scenarios/43-user-registration-and-login
  • •kirby://kb/scenarios/63-files-firewall-protected-downloads
  • •kirby://kb/scenarios/64-permission-tricks-role-based
  • •kirby://kb/scenarios/67-indieauth-rel-me

Required inputs

  • •Protected pages/data and required roles.
  • •Login/logout flow and redirect rules.
  • •Download protection or route constraints.

Role matrix template

RolePagesActionsDownloads
adminallallall
editoreditpublishlimited

Default guard pattern

  • •Check $kirby->user() and required role/permission before returning content.
  • •Redirect or return a 403 for unauthorized requests.
  • •Enforce CSRF and validation on auth-related forms.

Login redirect rule

  • •Store intended URL in the session and redirect after successful login.
  • •Fall back to the home page when no intent is stored.

Common pitfalls

  • •Checking access only in templates while routes remain public.
  • •Returning a 404 for unauthorized access instead of a 403 or redirect.

Verification checklist

  • •Test the role matrix across protected pages and downloads.
  • •Verify login/logout flows and session handling.
  • •Confirm CSRF failures render safely.

Workflow

  1. •Clarify which pages/data are protected, required roles, and login/logout behavior.
  2. •Call kirby:kirby_init and read kirby://roots.
  3. •Inspect templates/controllers/blueprints to align with existing patterns:
    • •kirby:kirby_templates_index
    • •kirby:kirby_controllers_index
    • •kirby:kirby_blueprints_index
  4. •For protected downloads or auth routes, inspect routes with kirby:kirby_routes_index and kirby://config/routes (install runtime if needed).
  5. •Search the KB with kirby:kirby_search (examples: "access restriction login", "user registration and login", "files firewall", "permission tricks", "page on own domain").
  6. •Implement least-privilege checks in templates/controllers or routes; enforce CSRF and validation on auth forms.
  7. •Verify by rendering protected pages (kirby:kirby_render_page) and manually testing login and download URLs.