validate-project-rules_skill

Overview

This skill validates the labSIS-KIT business rules for a Laravel + Filament SaaS starter kit. It focuses on enforcing tenant isolation, dynamic role bindings per tenant, and controlled destructive actions. The goal is to ensure the kit remains a reliable educational reference for secure SaaS architecture.

How this skill works

The validator runs automated checks and integration tests against the application to confirm expected behaviors. It inspects global scopes, policies, and pivot role assignments, simulates cross-tenant access attempts, and verifies installer script behavior. It reports failures with clear status codes and actionable guidance for remediation.

When to use it

• Before merging major tenant or permission changes
• During CI to prevent regressions in isolation or RBAC
• After implementing or updating the install script
• Before releases that affect destructive actions or administrative flows
• When auditing the kit for security or educational correctness

Best practices

• Enforce tenant isolation at ORM/global scope level rather than relying on controllers
• Store roles on the tenant-user relationship (pivot) so permissions vary by context
• Restrict tenant deletion to a global Super Admin role and test that Owners cannot delete their tenant
• Automate validation in CI with tests that assert 403/404 on cross-tenant access
• Provide a one-command installer that runs migrations and seeds for reproducible demos

Example use cases

• Run checks to confirm a user with Owner role in Tenant A cannot view Tenant B resources
• Validate that the same user can hold different roles across two tenants and has appropriate permissions in each
• Execute the install script in a fresh environment and verify the application is functional without manual steps
• Attempt tenant deletion as an Owner and assert the action is blocked or absent
• Include the validator in CI to catch regressions to isolation or RBAC logic