Jeppe Bundgaard
7d450e285e
Transitioned from obsolete gateway object classes (`edge_gateway_shell_action_jobs_o`, `edge_gateway_shell_events_o`, `edge_gateway_shell_sessions_o`, `edge_gateway_update_jobs_o`) to the new agent implementation (`edge-gateway-agent/agent.php`).
1000 B
1000 B
apply
| apply |
|---|
| always |
Backend Route Rules
These rules apply to files under services/nginx/app/routes and the classes they call.
- Keep route handlers thin: validate input, enforce permissions, call domain code, and write the response.
- Default to protected endpoints. Use the existing authentication and permission helpers instead of ad hoc access checks.
- Add or update backend tests in the
php1container whenever route behavior changes. - Update
openapi.yamlwhenever paths, parameters, request bodies, response envelopes, or permissions change. - Prefer deterministic route tests and avoid live external integrations in route coverage.
- Use concise API errors and keep sensitive implementation details out of the response body.
- When a change touches department, order, or subuser authorization, cover both the allow path and the deny path.
Canonical workflow reference: .ai-workflow/workflow.md.