Quality Guidelines

Backend quality constraints for the JSP + Servlet + MySQL application.

Overview

No application source code exists yet, but the developer has established the backend stack and layered design. Future backend work should preserve those decisions and update these specs with real file paths once code exists.

Required Patterns

Keep strict layer boundaries: Servlet -> Service -> DAO -> MySQL.
Use JSP/CSS only for presentation; JSPs must not contain SQL or business workflow logic.
Validate request parameters in Servlet controllers before calling services.
Enforce permission checks in filters/services for administrator, librarian, and reader roles.
Keep inventory status updates inside service workflows so borrow, return, renew, overdue handling, and book intake remain consistent.
Use primary keys and foreign keys for core entity relationships.
Record key operations and exceptions according to the logging spec.

Forbidden Patterns

Do not introduce React, Vue, SPA routing, ORM conventions, or non-Servlet backend frameworks unless the developer explicitly changes the stack.
Do not place SQL in JSP files or directly in presentation helpers.
Do not put business workflows in DAO classes.
Do not rely on client-side validation as the only validation for protected operations.
Do not expose stack traces, raw SQL errors, or sensitive personal data to end users.

Checks And Testing

When Java source exists, document and run the actual compile/test commands for the chosen IDEA/Tomcat project structure. Until then, documentation-only changes should run Trellis validation, Python compile checks for Trellis scripts when relevant, and placeholder scans for scaffold markers.

For this workspace, Maven is available at:

/home/sjy/.sdkman/candidates/maven/current/bin/mvn

Use the explicit path when mvn is not on PATH:

/home/sjy/.sdkman/candidates/maven/current/bin/mvn clean package

Review Checklist

Does the change preserve JSP + Servlet + MySQL + Tomcat assumptions?
Are Servlet, service, DAO, and JSP responsibilities separated?
Are book, category, reader, borrowing, administrator, permission, and log data flows covered where relevant?
Are role permissions and operation logs handled for protected workflows?

2.3 KiB Raw Blame History