Multi Tenant Fullstack Crud Skill — Security skill for Claude Code

Multi-Tenant Full-Stack CRUD Skill

  

A **multi-tenant full-stack CRUD Agent Skill** for Claude Code that teaches an opinionated, production-oriented architecture for building **role-scoped, audited business web apps** with **Express, Sequelize, MySQL, vanilla JavaScript, Docker and Traefik**.

Use it to start a full-stack CRUD application or extend an existing one with models, controllers, routes, views, authorization rules, audit trails, tests and deployment configuration.

The architecture deliberately trades framework features for a surface small enough that one person can hold all of it: **no frontend framework, no build step, no migrations, no hand-written CRUD and no action routes**.

A generic `crudThat` factory serves almost every resource. What an operation *means* belongs in the model's controller hooks rather than in additional endpoints. Authorization is enforced through tenant and role scopes rather than UI state, and the browser and server run the same domain-rules module so each rule has one implementation with enforcement on both sides of the API boundary.

The repository includes `samples/`, a runnable reference implementation of the complete stack: frontend, backend, shared rules, authentication, role-based access, auditing, MySQL deployment and three levels of automated testing.

Its annotated files document not just what the architecture does, but why particular decisions exist. Many of those decisions came from bugs that were paid for once already.

What this skill teaches Claude to do differently

• **Adds a hook, not a route.** `POST /tasks/:id/cancel` creates a second authorization surface and it is the one that gets forgotten, so cancelling is a `PUT` told apart by what the body carries.

• **Puts access control in `extraFilters`.** It is a `where`