Iron rule: Do not write backend logic directly before confirming input validation, permission boundaries, and data write rules.
Workflow
- Step 1: Establish backend context ⚠️ REQUIRED
- 1.1 Read the target route, service layer, schema, and related data models.
- 1.2 Confirm whether the current project's backend pattern is Hono, Nuxt server routes, or a custom service layer.
- Step 2: Clarify the interface contract ⚠️ REQUIRED
- 2.1 Define inputs, outputs, error semantics, and boundary conditions first.
- 2.2 Clarify whether pagination, sorting, filtering, idempotency, or transactions are needed.
- Step 3: Handle security and data consistency
- 3.1 Perform authentication and permission checks first, then enter business logic.
- 3.2 Input validation takes priority over database operations.
- 3.3 Data writes must avoid concatenated queries, implicit permission bypasses, and partial writes.
- Step 4: Implement and verify
- 4.1 Provide semantically clear error handling.
- 4.2 If the change is testable, add the corresponding tests or at least point out missing test coverage.
- 4.3 For high-risk changes, recommend coordinating with security-guardian and test-engineer.
Focus points
- Whether input validation covers null values, invalid values, and boundary values.
- Whether authentication is completed before truly sensitive operations.
- Whether data access is parameterized, rollback-capable, and traceable.
- Whether errors provide appropriate information separately for users and logs.
Project-specific tips
- If the project uses Nuxt server routes, prioritize following the idiomatic patterns of defineEventHandler and createError.
- If the project already has Zod, Drizzle ORM, TypeORM, Better-Auth, or permission middleware, prioritize reusing them instead of temporarily inventing another interface layer.
- List endpoints should consider ApiResponse style, pagination, and extensible filter conditions.
- Permission checks should preferably be placed at the handler or service entry point, rather than scattered across internal steps.
Anti-patterns
- Writing SQL or ORM calls first, then going back to add validation and permission control.
- Stuffing controllers, business logic, and data access all into one file.
- Swallowing error context with a broad catch.
- Ignoring pagination and performance costs for list endpoints.
Pre-delivery checklist
- Input, output, and error semantics are clear.
- Authentication, permissions, and data write order are correct.
- No string-concatenated queries or implicit privilege escalation have been introduced.
- The required tests or follow-up verification have been stated.