Skip to content

SKILL.md

Latest commit

 

History

History
256 lines (198 loc) · 7.89 KB

SKILL.md

File metadata and controls

256 lines (198 loc) · 7.89 KB
Raw
name contentbox-boxlang-security-permissions
description Use this skill when implementing ContentBox security and permissions, including roles, permission modeling, cbSecurity integration, authorization checks, CSRF/rate-limiting protections, and hardening patterns.
applyTo **/*.{bx,bxm,cfc,cfm,cfml}

ContentBox Security & Permissions (BoxLang)

Manage authentication, authorization, roles, permissions, and security rules in ContentBox CMS using BoxLang.

Security Architecture

ContentBox uses cbSecurity for its security layer with a database-driven RBAC (Role-Based Access Control) model.

Security Entities

Entity File Description
Author models/security/Author.cfc User entity with password, roles, preferences, 2FA
Role models/security/Role.cfc RBAC roles with M2M to permissions
Permission models/security/Permission.cfc Individual permissions
PermissionGroup models/security/PermissionGroup.cfc Permission grouping
SecurityRule models/security/SecurityRule.cfc Firewall rules (whitelist/securelist/roles/permissions)
LoginAttempt models/security/LoginAttempt.cfc Login attempt tracking

Security Services

Service File Description
SecurityService models/security/SecurityService.cfc Authentication, session, password reset, encryption
AuthorService models/security/AuthorService.cfc Author CRUD, preferences, avatar
RoleService models/security/RoleService.cfc Role management
PermissionService models/security/PermissionService.cfc Permission management
SecurityRuleService models/security/SecurityRuleService.cfc Security rules from DB
LoginTrackerService models/security/LoginTrackerService.cfc Login attempt tracking
RateLimiter models/security/RateLimiter.cfc Rate limiting interceptor

Authentication

SecurityService Methods

property name="securityService" inject="securityService@contentbox"

// Authentication
securityService.login( author )           // Authenticate and set session
securityService.logout()                  // Clear session
securityService.isLoggedIn()              // Check auth status
securityService.getAuthorSession()        // Get current author from session

// Password management
securityService.generateResetToken( author )  // Generate password reset token
securityService.resetPassword( author, newPassword )  // Reset password

// Session management
securityService.getKeepMeLoggedIn()       // Remember-me cookie handling
securityService.updateAuthorLoginTimestamp( author )  // Update last login

Author Entity

property name="authorService" inject="authorService@contentbox"

// Author properties
author.getAuthorID()
author.getUsername()
author.getEmail()
author.getFirstName()
author.getLastName()
author.getFullName()          // "FirstName LastName"
author.getBiography()
author.getIsActive()
author.getLastLogin()
author.getCreatedDate()
author.getModifiedDate()

// Roles and permissions
author.getRoles()             // Array of Role entities
author.hasRole( "Admin" )     // Check if author has role
author.hasPermission( "ENTRY_EDIT" )  // Check permission

// 2FA
author.getTwoFactorEnabled()
author.getTwoFactorSecret()
author.getTwoFactorProvider()

// Preferences
author.getPreferences()       // Struct of user preferences
author.getPreference( "key" ) // Get specific preference

Roles and Permissions

Creating Roles

property name="roleService" inject="roleService@contentbox"

// Create a role
role = roleService.new( {
	name        : "Editor",
	description : "Can edit and publish entries"
} )
roleService.save( role )

// Add permissions to role
permission = permissionService.findByPermission( "ENTRY_EDIT" )
role.addPermission( permission )
roleService.save( role )

Creating Permissions

property name="permissionService" inject="permissionService@contentbox"

// Create a permission
permission = permissionService.new( {
	permission  : "MYMODULE_ACCESS",
	description : "Access to my custom module"
} )
permissionService.save( permission )

Permission Groups

property name="permissionGroupService" inject="permissionGroupService@contentbox"

// Create a permission group
group = permissionGroupService.new( {
	name        : "My Module",
	description : "Permissions for my custom module"
} )
permissionGroupService.save( group )

// Assign permission to group
permission.setPermissionGroup( group )

Security Rules

Security rules are stored in the cb_securityRule table and loaded by securityRuleService@contentbox:

Field Description
whitelist Events/URLs that don't require authentication
securelist Events/URLs that require authentication
roles Required roles (comma-separated)
permissions Required permissions (comma-separated)
redirect Redirect URL on failure
overrideEvent Override event on failure
useSSL Force SSL for these rules
action Action to take (redirect/override)

Creating Security Rules

property name="securityRuleService" inject="securityRuleService@contentbox"

rule = securityRuleService.new( {
	whitelist   : "cbadmin/myModule.index,cbadmin/myModule.public",
	securelist  : "cbadmin/myModule.*",
	roles       : "Admin,Editor",
	permissions : "MYMODULE_ACCESS",
	redirect    : "cbadmin/security/login",
	useSSL      : false,
	action      : "redirect"
} )
securityRuleService.save( rule )

Checking Permissions in Code

property name="securityService" inject="securityService@contentbox"

// Check if logged in
if( securityService.isLoggedIn() ){
	author = securityService.getAuthorSession()
}

// Check role
if( author.hasRole( "Admin" ) ){
	// Admin-only logic
}

// Check permission
if( author.hasPermission( "ENTRY_EDIT" ) ){
	// Can edit entries
}

// Check multiple permissions
if( author.hasPermission( "ENTRY_EDIT,ENTRY_PUBLISH" ) ){
	// Has both permissions
}

Password Security

  • Passwords are hashed using BCrypt via BCrypt@BCrypt
  • Password reset tokens are generated with generateResetToken()
  • Login attempts are tracked via LoginTrackerService

Rate Limiting

The RateLimiter@contentbox interceptor protects against brute-force attacks:

// Registered in core ModuleConfig.bx
interceptors = [
	{
		class : "contentbox.models.security.RateLimiter",
		name  : "RateLimiter@contentbox"
	}
]

CSRF Protection

property name="cbcsrf" inject="cbcsrf@cbcsrf"

// Generate CSRF token
token = cbcsrf.getToken( "formName" )

// Verify CSRF token
if( cbcsrf.verify( rc.csrfToken ) ){
	// Valid token
}

Best Practices

  1. Use cbSecurity rules — define rules in the database, not in code
  2. Check permissions — use hasPermission() before sensitive operations
  3. Use roles for grouping — assign permissions to roles, roles to authors
  4. Track login attempts — use LoginTrackerService for audit trails
  5. Enable 2FA — enforce two-factor authentication for admin users
  6. Use BCrypt — never store plain-text passwords
  7. Implement rate limiting — protect login endpoints
  8. Use CSRF tokens — protect all form submissions
  9. Log security events — use log.info() for audit trails
  10. Test with different roles — verify access control for each role

Engine Compatibility

This skill targets BoxLang engine. For CFML-specific syntax (Lucee 5+, Adobe ColdFusion 2018+), see the CFML variant of this skill.

Key BoxLang advantages:

  • Cleaner script syntax without <cfcomponent> / <cffunction> tags
  • No parentheses needed for zero-argument function calls
  • #{...}# for inline expression output in .bx templates
  • Modern syntax: ?: null coalescing, ?. safe navigation
  • Native support for modern data structures