Expert guidance for developing the RISCURA risk management platform with Next.js 15, Prisma, NextAuth, and enterprise architecture patterns
Expert guidance for developing the RISCURA enterprise risk management platform built with Next.js 15, TypeScript, Prisma ORM, and NextAuth.js.
Provides comprehensive development guidance for the RISCURA codebase, including:
When starting work on RISCURA:
1. **Verify development environment**:
```bash
npm run dev:setup
```
2. **Test authentication flow**:
```bash
npm run test:auth-flow
```
3. **Run full stack validation**:
```bash
./test-website.sh
```
**Before starting any coding**:
**Standard development cycle**:
1. Start dev server: `npm run dev`
2. Make changes with type checking: `npm run type-check:watch`
3. Run linter: `npm run lint:fix`
4. Before committing: `npm run precommit`
**Always use `withApiMiddleware()` for new API endpoints**:
```typescript
// Current pattern (most endpoints):
export const POST = withApiMiddleware(async (req) => {
const user = (req as any).user;
// Handler code
return NextResponse.json({ data });
});
// Recommended pattern (with validation & rate limiting):
export const POST = withApiMiddleware({
requireAuth: true,
bodySchema: MyBodySchema,
rateLimiters: ['standard']
})(async (context, validatedData) => {
const { user, organizationId } = context;
return { data: result };
});
```
**Rate limiter options**:
**Error handling**: Use standardized error classes from `/src/lib/api/errors.ts`:
**Multi-tenant requirement**: Always include `organizationId` in queries:
```typescript
const risks = await prisma.risk.findMany({
where: {
organizationId: user.organizationId,
// other filters
}
});
```
**Database commands**:
**Current status**: Strict mode disabled (~785 errors across 165 files)
**When to use `// @ts-ignore`** (sparingly):
```typescript
// @ts-ignore - [REASON]: [DESCRIPTION] - [TRACKING_ID]
// TODO: [CLEANUP_PLAN] - Target: [DATE/MILESTONE]
```
**Never use for**:
**Priority**: All new code should be fully typed
**Before committing**:
```bash
npm run precommit # Type-check + lint
```
**Test suites**:
**Single test file**:
```bash
npm test -- path/to/test.spec.ts
```
**For large datasets (100+ items)**:
**Analysis commands**:
```bash
npm run performance:analyze # Bundle analysis
npm run security:check # Security configuration
```
**Pre-deployment checklist**:
```bash
npm run verify # Full verification
npm run build # Production build
npm run production:ready # Comprehensive validation
```
**Environment variables**: Check `env.example` for required configs including:
**Phase 2**: Technical debt resolution
1. **❌ Skipping `withApiMiddleware()`** - All API routes must use it
2. **❌ Forgetting `organizationId`** - Multi-tenant queries require it
3. **❌ Not running `precommit`** - Catch errors before pushing
4. **❌ Exposing secrets** - Never put API keys in client code
5. **❌ Using `@ts-ignore` without documentation** - Must include reason and tracking
Leave a review
No reviews yet. Be the first to review this skill!
# Download SKILL.md from killerskills.ai/api/skills/riscura-development-guide/raw