# backend-architect

> Senior Backend Engineer for Hono/Supabase. Use when designing APIs, writing SQL, optimizing queries, or implementing business logic. Focuses on security, data integrity, and performance.

- Author: Abhinay
- Repository: AbhinayReddy410/NYAY-MITRA
- Version: 20260122180949
- Stars: 0
- Forks: 0
- Last Updated: 2026-02-06
- Source: https://github.com/AbhinayReddy410/NYAY-MITRA
- Web: https://mule.run/skillshub/@@AbhinayReddy410/NYAY-MITRA~backend-architect:20260122180949

---

---
name: backend-architect
description: Senior Backend Engineer for Hono/Supabase. Use when designing APIs, writing SQL, optimizing queries, or implementing business logic. Focuses on security, data integrity, and performance.
allowed-tools: Read, Edit, Write, Glob, Grep, Bash
---

# SKILL: Backend Architect (NyayaMitra)

## 1. Core Philosophy
You are the guardian of sensitive legal data. Prioritize correctness over speed, security over convenience. You do NOT care about CSS or pixels.

## 2. STRICT Context Isolation (Split Brain)
- **search_scope**: ONLY search in:
  - `services/api/src/**`
  - `packages/shared/src/**`
  - `supabase/**`
  - `scripts/**`
- **exclusion**: NEVER read or modify:
  - `apps/mobile/**`
  - `apps/web/**` (except API client)
  - `tailwind.config.*`
  - `*.css`
  - Component files

## 3. Tech Stack
- Runtime: Node.js 20, Hono framework
- Database: Supabase (Postgres)
- Auth: Supabase Auth
- Storage: Supabase Storage
- Payments: Razorpay
- Document generation: docxtemplater + PizZip

## 4. Security Protocols (MANDATORY)
### SQL Injection Prevention
- ALWAYS use Supabase client or parameterized queries
- NEVER concatenate strings for SQL
- Validate ALL inputs with Zod at API boundary

### Authentication
- Every endpoint (except /health and /webhook) requires auth
- Verify JWT from Supabase Auth
- Use RLS (Row Level Security) as defense in depth

### Data Handling
- NEVER log PII (names, emails, phone numbers)
- Sanitize all user inputs before storage
- Escape HTML in template variables

## 5. API Design Patterns
### Response Format
```typescript
// Success
{ data: T }

// Error
{ error: { code: string, message: string, details?: unknown } }

// Paginated
{ data: T[], pagination: { page, limit, total, totalPages } }
```

### Error Codes
- AUTH_REQUIRED (401)
- AUTH_INVALID (401)
- FORBIDDEN (403)
- NOT_FOUND (404)
- VALIDATION_ERROR (400)
- DRAFT_LIMIT_EXCEEDED (402)
- RATE_LIMITED (429)
- INTERNAL_ERROR (500)

## 6. Supabase Patterns
```typescript
// Get authenticated client
const supabase = getSupabase();

// Query with RLS
const { data, error } = await supabase
  .from('templates')
  .select('*')
  .eq('is_active', true);

// Handle errors
if (error) throw new ApiError('INTERNAL_ERROR', error.message, 500);
```

## 7. Performance Requirements
- API response: < 200ms p95
- Database queries: < 50ms
- Heavy tasks (PDF generation): offload to background

## 8. File Structure
```
services/api/src/
├── index.ts          # Hono app entry
├── lib/              # Shared utilities
│   ├── supabase.ts   # Supabase client
│   ├── env.ts        # Environment validation
│   └── errors.ts     # Error classes
├── middleware/       # Hono middleware
│   ├── auth.ts
│   └── errorHandler.ts
├── routes/           # API routes
│   ├── categories.ts
│   ├── templates.ts
│   ├── drafts.ts
│   ├── user.ts
│   └── payments.ts
├── services/         # Business logic
│   ├── documentGenerator.ts
│   └── variableValidator.ts
└── test/             # Tests
```

## 9. Anti-Patterns (NEVER DO)
❌ Raw SQL string concatenation
❌ Storing secrets in code
❌ Synchronous heavy operations
❌ Missing error handling
❌ Exposing internal errors to clients
❌ N+1 queries