e10f8f81bc
* docs(naming): drop scrum4me- prefix from doc filenames Rename 10 docs/scrum4me-*.md files to unprefixed kebab-case names. Update every internal link in docs/, CLAUDE.md, AGENTS.md, README.md. * docs(naming): lowercase API.md and MD3 filenames Rename docs/API.md → docs/api.md and docs/MD3_Color_Scheme_Documentation.md → docs/md3-color-scheme.md. Update all internal links across 7 files. * docs(naming): rename plan file to kebab-case ASCII Rename "docs/plans/Tweede Claude Agent — Planning Agent.md" → docs/plans/tweede-claude-agent-planning.md. No external links needed updating. * docs(naming): rename middleware.md to proxy.md (next 16) docs/patterns/middleware.md → docs/patterns/proxy.md following the Next.js 16 proxy.ts rename. Update link in CLAUDE.md. * docs(naming): polish CLAUDE.md doc-index after renames Fix doubled scrum4me-scrum4me-mcp repo references (cascade from prior sed) in CLAUDE.md, docs/architecture.md, backlog.md, agent-instruction-audit.md, and plans/ST-1109. Update 'Middleware' label to 'Proxy middleware' in patterns table.
38 lines
1.8 KiB
Markdown
38 lines
1.8 KiB
Markdown
<!-- BEGIN:nextjs-agent-rules -->
|
|
# This is NOT the Next.js you know
|
|
|
|
This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` before writing any code. Heed deprecation notices.
|
|
<!-- END:nextjs-agent-rules -->
|
|
|
|
# Scrum4Me Codex Rules
|
|
|
|
Read `CLAUDE.md` and the relevant files in `docs/` before changing behavior. The same product and security rules apply to Codex work.
|
|
|
|
## Access Control
|
|
|
|
- Product-scoped access is owner-or-member: use `productAccessFilter(userId)` from `lib/product-access.ts`.
|
|
- Use owner-only `user_id` checks only for actions that truly require ownership, such as product archiving and team management.
|
|
- Never trust client-provided IDs by themselves. For reorder, promotion, completion, or bulk updates, fetch the records with both `id in (...)` and the parent scope (`product_id`, `pbi_id`, `sprint_id`, or `story_id`) before writing.
|
|
- Reject duplicate IDs in ordered lists or decision payloads.
|
|
- Derive denormalized fields from database parents, for example `pbi.product_id`, not from form data or JSON bodies.
|
|
- Demo users and demo API tokens must receive 403 on write operations.
|
|
|
|
## Documentation Sync
|
|
|
|
When changing behavior, API responses, dependencies, environment variables, deployment behavior, or analytics, update the matching docs in the same change:
|
|
|
|
- `README.md` for setup, dependencies, deployment, and API overview.
|
|
- `docs/functional.md` for user-facing/API requirements.
|
|
- `docs/architecture.md` for stack, access model, data model, env vars, and deployment.
|
|
- `docs/patterns/` when a reusable implementation rule changes.
|
|
- `CLAUDE.md` and this file when an agent instruction would have prevented the issue.
|
|
|
|
## Verification
|
|
|
|
Before handing work back, run:
|
|
|
|
```bash
|
|
npm run lint
|
|
npm test
|
|
npm run build
|
|
```
|