54 lines
2.1 KiB
Markdown
54 lines
2.1 KiB
Markdown
# AGENTS.md — Fiddy (External DB)
|
||
|
||
## Authority
|
||
- Source of truth: `PROJECT_INSTRUCTIONS.md` (repo root). If conflict, follow it.
|
||
- Bugfix protocol: `DEBUGGING_INSTRUCTIONS.md` (repo root).
|
||
- Do not implement features unless required to fix the bug.
|
||
|
||
## Non-negotiables
|
||
- External DB: `DATABASE_URL` points to on-prem Postgres (NOT a container).
|
||
- Dev/Prod share schema via migrations in `packages/db/migrations`.
|
||
- No cron/worker jobs. Fixes must work without background tasks.
|
||
- Server-side RBAC only. Client checks are UX only.
|
||
|
||
## Security / logging (hard rules)
|
||
- Never log secrets (passwords/tokens/cookies).
|
||
- Never log receipt bytes.
|
||
- Never log full invite codes; logs/audit store last4 only.
|
||
|
||
## Non-regression contracts
|
||
- Sessions are DB-backed (`sessions` table) and cookies are HttpOnly.
|
||
- Receipt images stored in `receipts` (`bytea`).
|
||
- Entries list endpoints must NEVER return receipt bytes.
|
||
- API responses must include `request_id`; audit logs must include `request_id`.
|
||
|
||
## Architecture boundaries (follow existing patterns; don’t invent)
|
||
1) API routes: `app/api/**/route.ts`
|
||
- Thin: parse/validate + call service, return JSON.
|
||
2) Server services: `lib/server/*`
|
||
- Own DB + authz. Must include `import "server-only";`.
|
||
3) Client wrappers: `lib/client/*`
|
||
- Typed fetch + error normalization; always send credentials.
|
||
4) Hooks: `hooks/use-*.ts`
|
||
- Primary UI-facing API layer; components avoid raw `fetch()`.
|
||
|
||
## Next.js dynamic route params (required)
|
||
- In `app/api/**/[param]/route.ts`, treat `context.params` as async:
|
||
- `const { id } = await context.params;`
|
||
|
||
## Working style
|
||
- Scan repo first; don’t guess file names or patterns.
|
||
- Make the smallest change that resolves the issue.
|
||
- Keep touched files free of TS warnings and lint errors.
|
||
- Add/update tests when API behavior changes (include negative cases).
|
||
- Keep text encoding clean (no mojibake).
|
||
|
||
## Response icon legend
|
||
Use the same status icons defined in `PROJECT_INSTRUCTIONS.md` section "Agent Response Legend (required)":
|
||
- `🔄` in progress
|
||
- `✅` completed
|
||
- `🧪` verification/test result
|
||
- `⚠️` risk/blocker/manual action
|
||
- `❌` failure
|
||
- `🧭` recommendation/next step
|