“alexvisualmakers”
a893084a88
- Add paths frontmatter to frontend, backend, and security rules so they only load when editing relevant files - Add mandatory new-project detection to general rules that redirects to /requirements before any implementation - Add write-then-verify protocol for feature tracking updates to prevent hallucinated file edits Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
33 lines
1004 B
Markdown
33 lines
1004 B
Markdown
---
|
|
paths:
|
|
- "src/app/api/**"
|
|
- "src/lib/supabase*"
|
|
- "supabase/**"
|
|
---
|
|
|
|
# Backend Development Rules
|
|
|
|
## Database (Supabase)
|
|
- ALWAYS enable Row Level Security on every table
|
|
- Create RLS policies for SELECT, INSERT, UPDATE, DELETE
|
|
- Add indexes on columns used in WHERE, ORDER BY, and JOIN clauses
|
|
- Use foreign keys with ON DELETE CASCADE where appropriate
|
|
- Never skip RLS - security first
|
|
|
|
## API Routes
|
|
- Validate all inputs using Zod schemas before processing
|
|
- Always check authentication: verify user session exists
|
|
- Return meaningful error messages with appropriate HTTP status codes
|
|
- Use `.limit()` on all list queries
|
|
|
|
## Query Patterns
|
|
- Use Supabase joins instead of N+1 query loops
|
|
- Use `unstable_cache` from Next.js for rarely-changing data
|
|
- Always handle errors from Supabase responses
|
|
|
|
## Security
|
|
- Never hardcode secrets in source code
|
|
- Use environment variables for all credentials
|
|
- Validate and sanitize all user input
|
|
- Use parameterized queries (Supabase handles this)
|