Initial commit

2026-04-27 18:40:30 +08:00
commit 2120774b05
112 changed files with 12308 additions and 0 deletions
@@ -0,0 +1,58 @@
+# Quality Guidelines
+
+> Backend quality constraints for the JSP + Servlet + MySQL application.
+
+---
+
+## Overview
+
+No application source code exists yet, but the developer has established the
+backend stack and layered design. Future backend work should preserve those
+decisions and update these specs with real file paths once code exists.
+
+---
+
+## Required Patterns
+
+- Keep strict layer boundaries: Servlet -> Service -> DAO -> MySQL.
+- Use JSP/CSS only for presentation; JSPs must not contain SQL or business
+  workflow logic.
+- Validate request parameters in Servlet controllers before calling services.
+- Enforce permission checks in filters/services for administrator, librarian,
+  and reader roles.
+- Keep inventory status updates inside service workflows so borrow, return,
+  renew, overdue handling, and book intake remain consistent.
+- Use primary keys and foreign keys for core entity relationships.
+- Record key operations and exceptions according to the logging spec.
+
+---
+
+## Forbidden Patterns
+
+- Do not introduce React, Vue, SPA routing, ORM conventions, or non-Servlet
+  backend frameworks unless the developer explicitly changes the stack.
+- Do not place SQL in JSP files or directly in presentation helpers.
+- Do not put business workflows in DAO classes.
+- Do not rely on client-side validation as the only validation for protected
+  operations.
+- Do not expose stack traces, raw SQL errors, or sensitive personal data to end
+  users.
+
+---
+
+## Checks And Testing
+
+When Java source exists, document and run the actual compile/test commands for
+the chosen IDEA/Tomcat project structure. Until then, documentation-only
+changes should run Trellis validation, Python compile checks for Trellis
+scripts when relevant, and placeholder scans for scaffold markers.
+
+---
+
+## Review Checklist
+
+- Does the change preserve JSP + Servlet + MySQL + Tomcat assumptions?
+- Are Servlet, service, DAO, and JSP responsibilities separated?
+- Are book, category, reader, borrowing, administrator, permission, and log
+  data flows covered where relevant?
+- Are role permissions and operation logs handled for protected workflows?