SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsauditing-business-logic

auditing-business-logic

Security & auditing

View repository

Updated 10-16 06:18

About this skill

Auditing Business Logic & Side-Effects

Analyze the implicit "rules" and external behaviors of a legacy application to ensure they are accurately replicated in the modern architecture.

Objective

Reverse-engineer the application's authentication flows, authorization logic (RBAC/ABAC), and any asynchronous side-effects (Mailers, External APIs, File Storage).

Instructions for the Audit Subagent

Copy this checklist and track your progress:

Task Progress:
- [ ] Step 1: Analyze AuthN & AuthZ Flows
- [ ] Step 2: Map Side-Effects (External APIs, Mailers)
- [ ] Step 3: Analyze Global Middleware
- [ ] Step 4: Draft Modernization Advisory
- [ ] Step 5: Generate Business_Logic_Rules.md

Step 1. Analyze AuthN & AuthZ Flows

  • Authentication (AuthN): Locate Passport, session, or JWT configurations (e.g., config/passport.js). Document the login strategies (Local, OAuth, etc.) and required fields.
  • Authorization (AuthZ): Document the logic used for access control. How does the system verify a user's role or ownership of a Primary Resource? (e.g., requiresRole('admin') or isOwner(resource_id)).

Step 2. Map Side-Effects

Identify actions that occur outside of the primary request/response cycle:

  • External Services: Check package.json and controllers for Stripe (Payments), Twilio (SMS), SendGrid (Email), etc.
  • Mailers: Audit the mailer/ or services/email/ directory. Does creating a resource trigger an automated notification?
  • File Storage: Locate file upload configurations (e.g., Multer). Determine where assets are stored (Local Disk vs Cloud Storage).

Step 3. Analyze Global Middleware

Examine app.js or config/express.js. Document global middlewares such as helmet, cors, custom loggers, or csurf. Determine which remain relevant for a modern Next.js API.

Step 4. Provide Modernization Advisory

Flag potential pitfalls for the modern stack (e.g., Next-Auth vs Passport). Recommend modern equivalents for legacy side-effects (e.g., moving from local file storage to S3/Uploadthing).

Step 5. Generate Business_Logic_Rules.md & Identify Probes

Compile findings into docs/legacy-audit/Business_Logic_Rules.md. Additionally, identify specific logic-parity probes (e.g., "Attempt to submit a form without the required OAuth session to verify the redirect loop matches legacy"). Append these logic-specific test cases to docs/verification/Verification_Plan.md.