vulkro rbac

Pro

vulkro rbac is part of Pro: RBAC matrix (rbac), every endpoint against every auth tier, in one table. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Emit a role-based-access-control matrix from your discovered endpoints

• METHOD PATH rows x AuthTier columns, where the endpoint requires that tier. Markdown for audit handoff, JSON for tooling.

Usage

vulkro rbac .                          # markdown matrix to stdout
vulkro rbac . --format json            # structured JSON
vulkro rbac . --output rbac.md         # write to a file

Arguments

Argument	Description	Default
PATH	Project root.	.

Flags

Flag	Description	Default
--format <FMT>	md (Markdown table) or json.	md
--output <FILE>, -o	Write to file instead of stdout.	stdout

What the matrix shows

Vulkro's auth model has been extended beyond the original Protected/Unprotected/Unknown flag: each endpoint now carries an AuthRequirement with three fields the matrix surfaces.

• AuthTier - one of Anonymous, User, Admin, Service, Machine, Unknown. Inferred from decorators and middleware (@UseGuards(AdminGuard), IsAdminUser, is_staff, [Authorize(Roles="Admin")], @PreAuthorize("hasRole('ADMIN')"), auth:sanctum, etc.).
• Scopes - list of OAuth-style scope checks. Populated from @Security(scopes=["users:read"]), @Scopes('foo'), RequiresScope(...), etc.
• TenantScoping - ScopedByTenant | GlobalNoTenant | Unknown. Flagged when the handler body references current_user.tenant_id, request.tenant, req.user.organisation_id, or similar.

The matrix presents the first dimension (tier) as columns and the endpoints as rows; scopes and tenant scoping appear as extra columns.

Markdown example

| Method | Path | Anonymous | User | Admin | Service | Machine | Scopes | Tenant |
|---|---|:--:|:--:|:--:|:--:|:--:|---|---|
| GET | /api/health |  | | | | | | global |
| GET | /api/me | |  | | | | | by tenant |
| POST | /api/users/:id/promote | | |  | | | users:admin | by tenant |
| POST | /api/internal/sync | | | |  | | | global |

JSON example

{
  "endpoints": [
    {
      "method": "POST",
      "path": "/api/users/:id/promote",
      "tier": "Admin",
      "scopes": ["users:admin"],
      "tenant_scoping": "ScopedByTenant",
      "file": "src/api/users.ts",
      "line": 142
    }
  ]
}

Why this is useful

• Audit handoff. Auditors asking "which endpoints can role X reach?" get a one-page answer instead of "let me grep the middleware."
• Sanity check on a release. A diff of the RBAC matrix before and after a release surfaces accidentally-exposed admin endpoints.
• Tenant-boundary review. The TenantScoping column reveals endpoints in a multi-tenant codebase that don't visibly scope by tenant - a common IDOR shape.

How tier inference works (per language)

The inference is best-effort and never invents a tier - it falls back to Unknown when no clear evidence is visible. Examples:

Language	Admin signal	Service signal
Python	IsAdminUser, is_staff, permission_classes=[IsAdmin*], @staff_member_required	X-Service-Token, verify_service_token, mTLS hints
Node/TS	@UseGuards(AdminGuard), requireAdmin, IsInRole("Admin")	@UseGuards(ServiceTokenGuard), X-Service-Token
Go	route registered behind a RequireAdmin middleware	route behind a ServiceAuth middleware

Related

• vulkro discover - produces the endpoint list the matrix is computed from.
• vulkro openapi - emits an OpenAPI 3.1 spec with the same auth-tier info as x-vulkro-tier extensions.

Command reference

Generated from vulkro help rbac on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Print which login level each endpoint requires, as a matrix.

[Pro] Emit the per-endpoint RBAC matrix - rows are endpoints, columns are AuthTier variants (Anonymous / User / Admin / Service / Machine / Unknown). Useful for eyeballing tier coverage at a glance and for downstream CI gates that want to assert "no endpoint is Admin without also being Protected."

Exit code: 0 matrix written (to stdout or `--output`), 2 scan / IO error. It renders coverage rather than failing on it, so it never returns 1.

Usage: vulkro rbac [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
      --format <FORMAT>
          Output format - `md` for a Markdown table, `json` for structured rows. Markdown is the default
          
          [default: md]
          [possible values: md, json]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -o, --output <OUTPUT>
          Write to a file instead of stdout

  -h, --help
          Print help (see a summary with '-h')