code-review

name	code-review
description	Review code changes against Grant Platform guardrails and layer conventions. Use when reviewing pull requests, staged changes, or when the user asks for a code review.

Code Review

Review changes against the project's layer boundaries, type conventions, and patterns.

Review checklist

Copy and fill as you review:

Code Review:
- [ ] Layer boundaries
- [ ] Type reuse from @grantjs/schema
- [ ] Handler conventions
- [ ] Service conventions
- [ ] Repository conventions
- [ ] REST / OpenAPI sync
- [ ] Web patterns
- [ ] i18n
- [ ] Error handling
- [ ] Comments (no narrative blocks; behavior in docs/README)

What to check

Layer boundaries

• Handlers call services only — never repositories or DB directly.
• Services call repositories only — never DB directly.
• Repositories use only domain-related schemas from @grantjs/database.
• GraphQL resolvers and REST routes call handlers only.

Type reuse

• All args, inputs, and return types should come from @grantjs/schema codegen (used fully, extended, or partial — e.g. Omit<QueryXArgs, 'scope'>).
• No manual redefinitions of types that exist in the generated schema.

Handler conventions

• Extends CacheHandler.
• Queries scope IDs from cache; invalidates cache on mutations.
• Mutations wrapped in ITransactionalConnection.withTransaction() when atomic.
• Args follow pattern: QueryXArgs & SelectedFields<X>.

Service conventions

• Extends AuditService; logs mutations via logCreate/logUpdate/logSoftDelete/logHardDelete.
• Validates input and output with zod schemas (validateInput, validateOutput).
• Args follow pattern: Omit<QueryXArgs, 'scope'> & SelectedFields<X>.
• Only accesses domain-related repositories.

Repository conventions

• Extends EntityRepository or PivotRepository.
• Uses only domain-related schemas from @grantjs/database.
• relations config correctly maps joined entities.

REST and OpenAPI

• Route, zod schema, and OpenAPI spec are all in sync.
• Routes use validate() middleware, authorizeRestRoute(), and requireEmailVerificationRest() where applicable.
• Mutation variables match @grantjs/schema types.

Web patterns

• Hooks use generated operation documents from @grantjs/schema.
• Feature modules follow toolbar / viewer / pagination / dialog / skeleton structure.
• New UI primitives added via shadcn CLI (not manually).
• State stores are per-module and isolated.

i18n

• All new user-facing text uses next-intl translation keys.
• Translation keys added to apps/web/i18n/locales/.

Error handling

• Shared error types from @/lib/errors; no swallowed errors.
• Errors logged with cause/context.

Feedback format

Use severity levels:

• Critical — Must fix: layer violation, missing validation, broken type contract.
• Suggestion — Should consider: inconsistency with existing patterns, missing audit log, missing i18n.
• Nit — Optional: naming, style, minor improvements.