vibe-backend-general

Read ONLY if touching existing code:

• wiki/decisions/ — any relevant architectural decisions
• wiki/techstack/backend.json — approved backend stack
• Existing module files: src/modules/{module}/*.ts

STOP reading when you can answer:

• What endpoints must I implement?
• What DTOs and entities are needed?
• What business rules must the service layer enforce?
• Are there security requirements (auth, roles)?

Implementation Order

1. Entity & Migration (co-activate vibe-db-general if schema change)
2. DTOs (InboundDto, ResponseDto — based on contract schemas)
3. Service layer (business logic, calls repository)
4. Controller (maps HTTP to service, uses contract endpoint shape)
5. Module wiring (imports, providers, exports)
6. Unit tests (service tests with mocked repository)
7. Integration tests (controller tests against real DB if needed)

Architecture Guard

Every module MUST follow N-tier:

Controller → Service → Repository → Entity

NEVER:

• Call TypeORM in a Controller
• Call another module's Repository directly (use Service)
• Mix business logic into Controllers
• Write inline SQL (except in raw query methods)

Completion Duties

After implementation, the backend engineer:

1. Verifies build passes: npm run build
2. Verifies tests pass: npm run test
3. Updates wiki/features/{feature-id}.json — tasks marked done
4. Updates wiki/api-contracts/{module}.json — notes implemented: true
5. Writes to wiki/history/{date}.json
6. Flags vibe-qa-general that backend is ready for test case writing

Security Minimum

Every endpoint that touches user data must:

• Require @UseGuards(JwtAuthGuard) or RolesGuard
• Validate DTO with class-validator — never trust raw input
• Never return stack traces in production error responses
• Log security-relevant events to the audit log

References

• Existing System Reads
• API Design Standards
• Refactoring Protocol
• Backend Wiki Duties