Zzzz
59 lines
2.1 KiB
Markdown
59 lines
2.1 KiB
Markdown
# Quality Guidelines
|
|
|
|
> Backend quality constraints for the JSP + Servlet + MySQL application.
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
No application source code exists yet, but the developer has established the
|
|
backend stack and layered design. Future backend work should preserve those
|
|
decisions and update these specs with real file paths once code exists.
|
|
|
|
---
|
|
|
|
## Required Patterns
|
|
|
|
- Keep strict layer boundaries: Servlet -> Service -> DAO -> MySQL.
|
|
- Use JSP/CSS only for presentation; JSPs must not contain SQL or business
|
|
workflow logic.
|
|
- Validate request parameters in Servlet controllers before calling services.
|
|
- Enforce permission checks in filters/services for administrator, librarian,
|
|
and reader roles.
|
|
- Keep inventory status updates inside service workflows so borrow, return,
|
|
renew, overdue handling, and book intake remain consistent.
|
|
- Use primary keys and foreign keys for core entity relationships.
|
|
- Record key operations and exceptions according to the logging spec.
|
|
|
|
---
|
|
|
|
## Forbidden Patterns
|
|
|
|
- Do not introduce React, Vue, SPA routing, ORM conventions, or non-Servlet
|
|
backend frameworks unless the developer explicitly changes the stack.
|
|
- Do not place SQL in JSP files or directly in presentation helpers.
|
|
- Do not put business workflows in DAO classes.
|
|
- Do not rely on client-side validation as the only validation for protected
|
|
operations.
|
|
- Do not expose stack traces, raw SQL errors, or sensitive personal data to end
|
|
users.
|
|
|
|
---
|
|
|
|
## Checks And Testing
|
|
|
|
When Java source exists, document and run the actual compile/test commands for
|
|
the chosen IDEA/Tomcat project structure. Until then, documentation-only
|
|
changes should run Trellis validation, Python compile checks for Trellis
|
|
scripts when relevant, and placeholder scans for scaffold markers.
|
|
|
|
---
|
|
|
|
## Review Checklist
|
|
|
|
- Does the change preserve JSP + Servlet + MySQL + Tomcat assumptions?
|
|
- Are Servlet, service, DAO, and JSP responsibilities separated?
|
|
- Are book, category, reader, borrowing, administrator, permission, and log
|
|
data flows covered where relevant?
|
|
- Are role permissions and operation logs handled for protected workflows?
|