Develop and extend
Reference Available

Backend Code Standards

Keep changes domain-oriented and scoped. Public service and repository methods use explicit types, user-visible Agent access follows permission-backed RBAC, and database changes include migrations and PostgreSQL coverage.

For
Backend contributors and reviewers
On this page
  1. Domain structure and dependencies
  2. HTTP and models
  3. Authorization is part of data access
  4. Review and completion
01

Domain structure and dependencies

New domains normally contain models, repository, service, and routes modules. Add parsers, builders, or provider modules only for a real responsibility. Use dependency injection and the shared PostgreSQL delegate for ordinary persistence.

02

HTTP and models

Use conventional status codes: 200/201/204 for success, 400 for business preconditions, 401 for unauthenticated, 403 for known unauthorized actions, 404 for missing or concealed tenant resources, 409 for state or uniqueness conflicts, and 422 for schema validation. Keep database models and API DTOs distinct.

03

Authorization is part of data access

Any Agent or subordinate-resource query must reuse the accessible-Agent pattern before count and pagination. Mutations resolve effective Permissions from current state. Never trust role names, client flags, or cached grants.

04

Review and completion

Review correctness first, then contract safety, tenancy and authorization, transaction/external failure behavior, test gaps, and maintainability. Finish with focused checks, required migrations, current documentation, and no unrelated refactor or style churn.

Documentation