.greptile/ File Reference

{
  "strictness": 2,
  "commentTypes": ["logic", "syntax"],
  "triggerOnUpdates": true,
  "ignorePatterns": "**/*.generated.*\ndist/**\nnode_modules/**",
  "summarySection": {
    "included": true,
    "collapsible": true,
    "defaultOpen": false
  },
  "instructions": "This is a TypeScript monorepo using pnpm workspaces. We use Prisma for database access and zod for validation.",
  "rules": [
    {
      "id": "no-console",
      "rule": "Do not use console.log in production code. Use the logger service instead.",
      "scope": ["src/**"],
      "severity": "medium"
    },
    {
      "rule": "All async functions must have error handling.",
      "severity": "high"
    }
  ],
  "disabledRules": []
}

# Code Review Rules

## Error Handling

All async functions must use try-catch blocks. Never swallow errors silently.
At minimum, log the error with context:

​```typescript
try {
  await operation();
} catch (error) {
  logger.error('Operation failed', { error, context });
  throw error;
}
​```

## SQL Injection Prevention

Always use parameterized queries. Never interpolate user input into SQL strings.

- Use prepared statements
- Validate input types before queries
- Use Prisma's query builder instead of raw SQL where possible

## API Input Validation

Validate all API inputs using zod schemas before processing. Define the schema
next to the route handler.

{
  "files": [
    {
      "path": "prisma/schema.prisma",
      "description": "Database schema — reference for model relationships and field types"
    },
    {
      "path": "docs/api-contracts.yaml",
      "description": "OpenAPI specification for all public endpoints",
      "scope": ["src/api/**"]
    },
    {
      "path": "docs/auth-flow.md",
      "description": "Authentication and authorization flow documentation",
      "scope": ["src/auth/**", "src/middleware/auth*"]
    }
  ]
}