auditing-business-logic

name	auditing-business-logic
description	Analyzes authentication flows, authorization rules, middleware logic, and side-effects. Use when extracting business rules, Passport configurations, or mailer logic from an Express application.

Auditing Business Logic & Side-Effects

Analyze the implicit "rules" and external behaviors of a legacy application to ensure they are accurately replicated in the modern architecture.

Objective

Reverse-engineer the application's authentication flows, authorization logic (RBAC/ABAC), and any asynchronous side-effects (Mailers, External APIs, File Storage).

Instructions for the Audit Subagent

Copy this checklist and track your progress:

Task Progress:
- [ ] Step 1: Analyze AuthN & AuthZ Flows
- [ ] Step 2: Map Side-Effects (External APIs, Mailers)
- [ ] Step 3: Analyze Global Middleware
- [ ] Step 4: Draft Modernization Advisory
- [ ] Step 5: Generate Business_Logic_Rules.md

Step 1. Analyze AuthN & AuthZ Flows

• Authentication (AuthN): Locate Passport, session, or JWT configurations (e.g., config/passport.js). Document the login strategies (Local, OAuth, etc.) and required fields.
• Authorization (AuthZ): Document the logic used for access control. How does the system verify a user's role or ownership of a Primary Resource? (e.g., requiresRole('admin') or isOwner(resource_id)).

Step 2. Map Side-Effects

Identify actions that occur outside of the primary request/response cycle:

• External Services: Check package.json and controllers for Stripe (Payments), Twilio (SMS), SendGrid (Email), etc.
• Mailers: Audit the mailer/ or services/email/ directory. Does creating a resource trigger an automated notification?
• File Storage: Locate file upload configurations (e.g., Multer). Determine where assets are stored (Local Disk vs Cloud Storage).

Step 3. Analyze Global Middleware

Examine app.js or config/express.js. Document global middlewares such as helmet, cors, custom loggers, or csurf. Determine which remain relevant for a modern Next.js API.

Step 4. Provide Modernization Advisory

Flag potential pitfalls for the modern stack (e.g., Next-Auth vs Passport). Recommend modern equivalents for legacy side-effects (e.g., moving from local file storage to S3/Uploadthing).

Step 5. Generate Business_Logic_Rules.md & Identify Probes

Compile findings into docs/legacy-audit/Business_Logic_Rules.md. Additionally, identify specific logic-parity probes (e.g., "Attempt to submit a form without the required OAuth session to verify the redirect loop matches legacy"). Append these logic-specific test cases to docs/verification/Verification_Plan.md.