workflow-implement-backend

You are in BACKEND IMPLEMENTATION MODE.

Use backend-api agent to build type-safe, secure backend services.

Implementation Workflow

1. Database Schema (10 mins)

Use database agent first:

// Define models, relations, indexes
model Post {
  id        String   @id @default(cuid())
  title     String
  content   String   @db.Text
  authorId  String
  author    User     @relation(fields: [authorId], references: [id])

  @@index([authorId])
}

Run migration:

npx prisma migrate dev --name add_posts
npx prisma generate

2. Input Validation Schemas (5 mins)

Define Zod schemas for type-safe validation:

// lib/validations/post.ts
import { z } from 'zod'

export const createPostSchema = z.object({
  title: z.string().min(1).max(255),
  content: z.string().min(1),
  published: z.boolean().default(false),
})

export const updatePostSchema = createPostSchema.partial()

export type CreatePostInput = z.infer<typeof createPostSchema>
export type UpdatePostInput = z.infer<typeof updatePostSchema>

3. tRPC Router (20-30 mins)

Build type-safe API with tRPC:

// server/routers/post.ts
import { router, publicProcedure, protectedProcedure } from '../trpc'
import { createPostSchema, updatePostSchema } from '@/lib/validations/post'

export const postRouter = router({
  // Public queries
  list: publicProcedure
    .input(z.object({
      limit: z.number().min(1).max(100).default(10),
      cursor: z.string().optional(),
      published: z.boolean().optional(),
    }))
    .query(async ({ ctx, input }) => {
      const posts = await ctx.db.post.findMany({
        take: input.limit + 1,
        cursor: input.cursor ? { id: input.cursor } : undefined,
        where: { published: input.published },
        orderBy: { createdAt: 'desc' },
        include: { author: { select: { name: true, image: true } } },
      })

      let nextCursor: string | undefined
      if (posts.length > input.limit) {
        const nextItem = posts.pop()
        nextCursor = nextItem!.id
      }

      return { posts, nextCursor }
    }),

  // Protected mutations
  create: protectedProcedure
    .input(createPostSchema)
    .mutation(async ({ ctx, input }) => {
      return await ctx.db.post.create({
        data: {
          ...input,
          authorId: ctx.session.user.id,
        },
      })
    }),

  update: protectedProcedure
    .input(z.object({
      id: z.string(),
      data: updatePostSchema,
    }))
    .mutation(async ({ ctx, input }) => {
      // Check ownership
      const post = await ctx.db.post.findUnique({
        where: { id: input.id },
        select: { authorId: true },
      })

      if (!post) {
        throw new TRPCError({ code: 'NOT_FOUND' })
      }

      if (post.authorId !== ctx.session.user.id) {
        throw new TRPCError({ code: 'FORBIDDEN' })
      }

      return await ctx.db.post.update({
        where: { id: input.id },
        data: input.data,
      })
    }),

  delete: protectedProcedure
    .input(z.string())
    .mutation(async ({ ctx, input }) => {
      // Check ownership
      const post = await ctx.db.post.findUnique({
        where: { id: input },
        select: { authorId: true },
      })

      if (!post) {
        throw new TRPCError({ code: 'NOT_FOUND' })
      }

      if (post.authorId !== ctx.session.user.id) {
        throw new TRPCError({ code: 'FORBIDDEN' })
      }

      return await ctx.db.post.delete({ where: { id: input } })
    }),
})