Samir Boulahtit
33c5875bc8
Split the monolithic .architecture-rules.yaml (1700+ lines) into focused domain-specific files in .architecture-rules/ directory: - _main.yaml: Core config, principles, ignore patterns, severity levels - api.yaml: API endpoint rules (API-001 to API-005) - service.yaml: Service layer rules (SVC-001 to SVC-007) - model.yaml: Model rules (MDL-001 to MDL-004) - exception.yaml: Exception handling rules (EXC-001 to EXC-005) - naming.yaml: Naming convention rules (NAM-001 to NAM-005) - auth.yaml: Auth and multi-tenancy rules (AUTH-*, MT-*) - middleware.yaml: Middleware rules (MDW-001 to MDW-002) - frontend.yaml: Frontend rules (JS-*, TPL-*, FE-*, CSS-*) - language.yaml: Language/i18n rules (LANG-001 to LANG-010) - quality.yaml: Code quality rules (QUAL-001 to QUAL-003) Also creates scripts/validators/ module with base classes for future modular validator extraction. The validate_architecture.py loader now auto-detects and merges split YAML files while maintaining backward compatibility with single file mode. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
88 lines
2.9 KiB
YAML
88 lines
2.9 KiB
YAML
# Architecture Rules - Authentication & Authorization Rules
|
|
# Rules for auth patterns and multi-tenancy
|
|
|
|
auth_rules:
|
|
|
|
- id: "AUTH-001"
|
|
name: "Use JWT tokens in Authorization header"
|
|
severity: "error"
|
|
description: |
|
|
Authentication must use JWT tokens in Authorization: Bearer header
|
|
pattern:
|
|
file_pattern: "app/api/**/*.py"
|
|
enforcement: "middleware"
|
|
|
|
- id: "AUTH-002"
|
|
name: "Role-based access control with Depends"
|
|
severity: "error"
|
|
description: |
|
|
Use Depends(get_current_admin/vendor/customer) for role checks
|
|
pattern:
|
|
file_pattern: "app/api/v1/**/*.py"
|
|
required: "Depends\\(get_current_"
|
|
|
|
- id: "AUTH-003"
|
|
name: "Never store plain passwords"
|
|
severity: "error"
|
|
description: |
|
|
Always hash passwords with bcrypt before storing
|
|
pattern:
|
|
file_pattern: "app/services/auth_service.py"
|
|
required: "bcrypt"
|
|
|
|
- id: "AUTH-004"
|
|
name: "Vendor context pattern - use appropriate dependency for endpoint type"
|
|
severity: "error"
|
|
description: |
|
|
Two vendor context patterns exist - use the appropriate one:
|
|
|
|
1. SHOP ENDPOINTS (public, no authentication required):
|
|
- Use: vendor: Vendor = Depends(require_vendor_context())
|
|
- Vendor is detected from URL/subdomain/domain
|
|
- File pattern: app/api/v1/shop/**/*.py
|
|
- Mark as public with: # public
|
|
|
|
2. VENDOR API ENDPOINTS (authenticated):
|
|
- Use: current_user.token_vendor_id from JWT token
|
|
- Or use permission dependencies: require_vendor_permission(), require_vendor_owner
|
|
- These dependencies get vendor from token and set request.state.vendor
|
|
- File pattern: app/api/v1/vendor/**/*.py
|
|
|
|
DEPRECATED for vendor APIs:
|
|
- require_vendor_context() - only for shop endpoints
|
|
- getattr(request.state, "vendor", None) without permission dependency
|
|
|
|
See: docs/backend/vendor-in-token-architecture.md
|
|
pattern:
|
|
file_pattern: "app/api/v1/vendor/**/*.py"
|
|
anti_patterns:
|
|
- "require_vendor_context\\(\\)"
|
|
file_pattern: "app/api/v1/shop/**/*.py"
|
|
required_patterns:
|
|
- "require_vendor_context\\(\\)|# public"
|
|
|
|
# ============================================================================
|
|
# MULTI-TENANCY RULES
|
|
# ============================================================================
|
|
|
|
multi_tenancy_rules:
|
|
|
|
- id: "MT-001"
|
|
name: "All queries must be scoped to vendor_id"
|
|
severity: "error"
|
|
description: |
|
|
In vendor/shop contexts, all database queries must filter by vendor_id
|
|
pattern:
|
|
file_pattern: "app/services/**/*.py"
|
|
context: "vendor_shop"
|
|
required_pattern: ".filter\\(.*vendor_id.*\\)"
|
|
|
|
- id: "MT-002"
|
|
name: "No cross-vendor data access"
|
|
severity: "error"
|
|
description: |
|
|
Queries must never access data from other vendors
|
|
pattern:
|
|
file_pattern: "app/services/**/*.py"
|
|
enforcement: "database_query_level"
|