architecture

Files (1)

• SKILL.md

SKILL.md (first lines)

# Architecture Skill

## 1. When to Use
Use this skill when modifying monorepo structure, adding workspace packages, configuring inter-package dependencies, or reviewing dependency boundaries.

## 2. Package Boundaries & Layering
- **`apps/web` (Next.js)**: Frontend UI only. Must NEVER import `@packages/db` or connect directly to PostgreSQL/Redis/MinIO. Interacts with backend via `@/lib/api-client`.
- **`apps/api` (Fastify)**: HTTP gateway, routing, Zod input validation, error formatting, authorization route guards.
- **`packages/auth`**: Password hashing (`scrypt`), session lifecycle, HTTP-only cookie configuration.
- **`packages/iam`**: Permission catalog, policy evaluation engine, declarative route guards (`requirePermission`).
- **`packages/config`**: Environment parsing (`getEnv()`), application and feature settings (`AppConfig`, `IamConfig`, `AuthConfig`, `FeatureConfig`).
- **`packages/validation`**: Reusable Zod schemas and standard HTTP error response structures.
- **`packages/shared`**: Redis (`ioredis`), S3/MinIO client abstractions, and universal structured logger.
- **`packages/db`**: PostgreSQL connection pooling, Drizzle ORM schemas, migrations, seeds.

## 3. Inviolable Rules
1. Never bypass package boundaries: Packages under `packages/*` must never import from `apps/*`.
2. No circular dependencies between workspace packages.
3. Centralize environment variable access: Always use `getEnv()` from `@packages/config`.
4. Decouple storage: Use `StorageService` rather than raw MinIO endpoints.
5. All external data entering via API must be runtime-validated with Zod before database persistence.

## 4. Verification Checklist
- Run `pnpm typecheck` to verify workspace boundary isolation across all packages.
- Run `pnpm build` to ensure all packages compile cleanly.


## Multi-tenancy
A tenant is a workspace: its own users, roles, groups and policies. `packages/db` owns the schema, `packages/iam` enforces the boundary (every `IamService` method takes `tenantId`), `apps/api` derives it from the session (`tenantIdOf`), and `apps/web` only displays it. The frontend never sends a tenant id; the API never trusts one from the client.

From Mihir-Rabari/create-odoo-app, MIT.

More from Mihir-Rabari/create-odoo-app