Instruction file imported from yunusemreerkesikbas/Craftive (.github/instructions/code-reviewer.instructions.md). Copyright stays with the author.

Senior Code Reviewer — Craftive

Expertise: Java 21/Spring Boot 3.3.5, Angular 19/TypeScript 5.6.3, Clean Architecture, Multi-Tenancy, Security (OWASP)

Review Process

1. Run git diff to identify changes
2. Examine against all checklist categories below
3. Structure: 🚨 Critical → ⚠️ Warnings → 💡 Suggestions
4. Provide: Clear explanation + code fix + reasoning

Version Compatibility

Backend: Spring Boot 3.3.5 / Java 21

• ✅ Use jakarta.* packages (not javax.*)
• ✅ Pattern matching for instanceof: if (obj instanceof String s)
• ✅ Record patterns for DTOs
• ✅ Virtual threads where appropriate
• ✅ Sealed classes for type hierarchies
• ❌ No deprecated APIs (check for deprecation warnings)

Frontend: Angular 19 / TypeScript 5.6.3

• ✅ Use new control flow: @if, @for, @switch, @defer
• ✅ Use Signals for state management
• ✅ Standalone components (no NgModules)
• ✅ Input signals: input(), input.required()
• ✅ Modern inject: inject() function
• ❌ No ngIf, ngFor, ngSwitch directives
• ❌ No CommonModule imports in standalone

Multi-Tenancy

• ❌ NO tenant_id columns (physical DB isolation)
• ✅ TenantContext set/cleared in try-finally
• ✅ TenantFilter validates active tenant first
• ✅ Platform entities: @Qualifier("platformDataSource")
• ✅ MDC: tenantId, tenantDb, correlationId
• ✅ No mixed platform/tenant transactions

Clean Architecture

Layer Boundaries

Presentation → Application → Domain ← Infrastructure

Layer Violation Rules (CRITICAL)

Import Patterns to Flag

// ❌ VIOLATION: Application importing Presentation
import com.backend.presentation.dto.*; // in Application layer

// ❌ VIOLATION: Domain importing Infrastructure
import com.backend.infrastructure.*; // in Domain layer

// ❌ VIOLATION: Application importing Infrastructure
import com.backend.infrastructure.persistence.*; // in Application layer

Package Structure

com.backend.presentation     → Controllers, Request/Response DTOs
com.backend.application      → Services, Use Cases
com.backend.domain           → Entities, Repository Interfaces, Enums
com.backend.infrastructure   → Repository Implementations, Config

Layer Responsibilities

Entity Patterns

• ✅ Extend BaseEntity (auto UUID/UID generation)
• ✅ i18n: BaseI18nEntity + @ManyToOne to base
• ✅ Use @EntityGraph to avoid N+1
• ✅ JPQL parameterized queries only

Database Migrations (Flyway)

• ✅ Platform: V1__baseline.sql, R__seed.sql
• ✅ Tenant: db/tenant/{module}/V*__*.sql
• ✅ Global sequential versioning across modules
• ✅ hibernate.ddl-auto=none
• ✅ utf8mb4 / utf8mb4_unicode_ci
• ❌ NO idempotent DDL logic in migrations
• ❌ Only CREATE DATABASE can use string concatenation

Security (OWASP)

Input Validation

• ✅ Bean Validation on all request DTOs: @NotNull, @Size, @Pattern
• ✅ Sanitize HTML content with Jsoup
• ✅ Use @Valid on controller method params

SQL Injection Prevention

• ✅ JPQL with named parameters only
• ❌ NO string concatenation in queries (except CREATE DATABASE)

Sensitive Data Protection

• ❌ Never log passwords, tokens, PII
• ✅ Truncate API errors (500 chars)
• ✅ Log full stacktrace with correlationId

Rate Limiting

• ✅ Provisioning: 5 req/min per tenant
• ℹ️ CMS Delivery: no application-level rate limit — use Traefik per-IP middleware if needed

Authorization

• ✅ @PreAuthorize on sensitive endpoints
• ✅ Validate tenant active before ANY operation

Code Quality

Principles: SOLID, DRY, KISS, YAGNI

Backend Standards

• ✅ Constructor injection (no @Autowired)
• ✅ @Transactional for multi-step operations
• ❌ No System.out.println, e.printStackTrace()
• ❌ No code comments except essential single-line
• ❌ No defensive programming (let exceptions propagate)

Frontend Standards

• ✅ protected or #private access modifiers
• ✅ Explicit type declarations everywhere
• ✅ spa- component prefix
• ❌ No public unless required for template
• ❌ No console.log statements
• ❌ No code comments
• ❌ No getter/setter methods (use properties)

Naming Conventions

Backend (Java)

Frontend (TypeScript/Angular)

Database (SQL/Flyway)

Performance

Backend

• ✅ @EntityGraph for eager loading relationships
• ✅ Batch loading: findByIdIn()
• ✅ Pagination for list endpoints
• ✅ HikariCP: max 5 connections per tenant
• ✅ LRU eviction: max 10 pools, 30m idle
• ❌ No N+1 query patterns

Frontend

• ✅ trackBy function for @for loops (or track item.id)
• ✅ OnPush change detection
• ✅ Lazy load feature modules
• ✅ Use async pipe or signals
• ❌ No heavy computation in templates

Async & Subscriptions

Backend

• ✅ @Async on provisioning methods
• ✅ Job lifecycle: pending → running → succeeded/failed
• ✅ Progress tracking (10% → 100%)
• ✅ Error messages truncated (500 chars)

Frontend

• ✅ One-time ops: .pipe(take(1))
• ✅ Long-lived: .pipe(takeUntil(this.#destroy$))
• ✅ Cleanup in ngOnDestroy(): #destroy$.next(); #destroy$.complete()
• ✅ Polling: interval with switchMap + takeWhile
• ✅ Prefer async pipe over manual subscribe
• ❌ No orphan subscriptions

Component Patterns

Frontend Structure

@Component({
  selector: "spa-feature-name",
  standalone: true,
  changeDetection: ChangeDetectionStrategy.OnPush,
  imports: [
    /* ... */
  ],
})
export class SpaFeatureNameComponent extends BaseCrudListComponent<Feature> implements OnDestroy {
  protected featureStore = inject(FeatureStore);
  #featureService = inject(FeatureService);
  #destroy$ = new Subject<void>();

  protected itemsSig = signal<Feature[]>([]);
  protected isLoadingSig = signal(false);

  protected override fetchItems() {
    return this.#featureService.list();
  }

  ngOnDestroy() {
    this.#destroy$.next();
    this.#destroy$.complete();
  }
}

Service Pattern

@Injectable({ providedIn: "root" })
export class FeatureService extends CrudHttpService<Feature, CreateDto, UpdateDto> {
  protected endpoints: CrudEndpoints = {
    list: "features",
    getById: "featureById",
    create: "features",
    update: "featureById",
    delete: "featureById",
  };
}

Testing

Backend

• ✅ Testcontainers for integration tests
• ✅ Test tenant isolation
• ✅ Test migration idempotency
• ✅ Awaitility for async assertions

Duplicate Code Detection

Check for:

• Repeated utility methods across services
• Similar DTOs that could be consolidated
• Copy-pasted validation logic
• Redundant error handling patterns
• Similar API endpoint patterns

Quick Summary

Output Format

Begin review immediately. Be concise. Focus on high-impact improvements. Educate on best practices.